The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ic/atw.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: atw.c,v 1.172 2021/09/21 14:42:01 christos Exp $  */
    2 
    3 /*-
    4  * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
    5  * All rights reserved.
    6  *
    7  * This code is derived from software contributed to The NetBSD Foundation
    8  * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  *
   19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
   20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
   23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   29  * POSSIBILITY OF SUCH DAMAGE.
   30  */
   31 
   32 /*
   33  * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
   34  */
   35 
   36 #include <sys/cdefs.h>
   37 __KERNEL_RCSID(0, "$NetBSD: atw.c,v 1.172 2021/09/21 14:42:01 christos Exp $");
   38 
   39 
   40 #include <sys/param.h>
   41 #include <sys/systm.h>
   42 #include <sys/callout.h>
   43 #include <sys/mbuf.h>
   44 #include <sys/malloc.h>
   45 #include <sys/kernel.h>
   46 #include <sys/socket.h>
   47 #include <sys/ioctl.h>
   48 #include <sys/errno.h>
   49 #include <sys/device.h>
   50 #include <sys/kauth.h>
   51 #include <sys/time.h>
   52 #include <sys/proc.h>
   53 #include <sys/atomic.h>
   54 #include <lib/libkern/libkern.h>
   55 
   56 #include <machine/endian.h>
   57 
   58 #include <net/if.h>
   59 #include <net/if_dl.h>
   60 #include <net/if_media.h>
   61 #include <net/if_ether.h>
   62 
   63 #include <net80211/ieee80211_netbsd.h>
   64 #include <net80211/ieee80211_var.h>
   65 #include <net80211/ieee80211_radiotap.h>
   66 
   67 #include <net/bpf.h>
   68 
   69 #include <sys/bus.h>
   70 #include <sys/intr.h>
   71 
   72 #include <dev/ic/atwreg.h>
   73 #include <dev/ic/rf3000reg.h>
   74 #include <dev/ic/si4136reg.h>
   75 #include <dev/ic/atwvar.h>
   76 #include <dev/ic/smc93cx6var.h>
   77 
   78 /* XXX TBD open questions
   79  *
   80  *
   81  * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
   82  * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
   83  * handle this for me?
   84  *
   85  */
   86 /* device attachment
   87  *
   88  *    print TOFS[012]
   89  *
   90  * device initialization
   91  *
   92  *    clear ATW_FRCTL_MAXPSP to disable max power saving
   93  *    set ATW_TXBR_ALCUPDATE to enable ALC
   94  *    set TOFS[012]? (hope not)
   95  *    disable rx/tx
   96  *    set ATW_PAR_SWR (software reset)
   97  *    wait for ATW_PAR_SWR clear
   98  *    disable interrupts
   99  *    ack status register
  100  *    enable interrupts
  101  *
  102  * rx/tx initialization
  103  *
  104  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
  105  *    allocate and init descriptor rings
  106  *    write ATW_PAR_DSL (descriptor skip length)
  107  *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
  108  *    write ATW_NAR_SQ for one/both transmit descriptor rings
  109  *    write ATW_NAR_SQ for one/both transmit descriptor rings
  110  *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
  111  *
  112  * rx/tx end
  113  *
  114  *    stop DMA
  115  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
  116  *    flush tx w/ ATW_NAR_HF
  117  *
  118  * scan
  119  *
  120  *    initialize rx/tx
  121  *
  122  * BSS join: (re)association response
  123  *
  124  *    set ATW_FRCTL_AID
  125  *
  126  * optimizations ???
  127  *
  128  */
  129 
  130 #define ATW_REFSLAVE    /* slavishly do what the reference driver does */
  131 
  132 int atw_pseudo_milli = 1;
  133 int atw_magic_delay1 = 100 * 1000;
  134 int atw_magic_delay2 = 100 * 1000;
  135 /* more magic multi-millisecond delays (units: microseconds) */
  136 int atw_nar_delay = 20 * 1000;
  137 int atw_magic_delay4 = 10 * 1000;
  138 int atw_rf_delay1 = 10 * 1000;
  139 int atw_rf_delay2 = 5 * 1000;
  140 int atw_plcphd_delay = 2 * 1000;
  141 int atw_bbp_io_enable_delay = 20 * 1000;
  142 int atw_bbp_io_disable_delay = 2 * 1000;
  143 int atw_writewep_delay = 1000;
  144 int atw_beacon_len_adjust = 4;
  145 int atw_dwelltime = 200;
  146 int atw_xindiv2 = 0;
  147 
  148 #ifdef ATW_DEBUG
  149 int atw_debug = 0;
  150 
  151 #define ATW_DPRINTF(x)  if (atw_debug > 0) printf x
  152 #define ATW_DPRINTF2(x) if (atw_debug > 1) printf x
  153 #define ATW_DPRINTF3(x) if (atw_debug > 2) printf x
  154 #define DPRINTF(sc, x)  if ((sc)->sc_if.if_flags & IFF_DEBUG) printf x
  155 #define DPRINTF2(sc, x) if ((sc)->sc_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
  156 #define DPRINTF3(sc, x) if ((sc)->sc_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
  157 
  158 static void     atw_dump_pkt(struct ifnet *, struct mbuf *);
  159 static void     atw_print_regs(struct atw_softc *, const char *);
  160 
  161 /* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
  162 #       ifdef ATW_BBPDEBUG
  163 static void     atw_rf3000_print(struct atw_softc *);
  164 static int      atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
  165 #       endif /* ATW_BBPDEBUG */
  166 
  167 #       ifdef ATW_SYNDEBUG
  168 static void     atw_si4126_print(struct atw_softc *);
  169 static int      atw_si4126_read(struct atw_softc *, u_int, u_int *);
  170 #       endif /* ATW_SYNDEBUG */
  171 #define __atwdebugused  /* empty */
  172 #else
  173 #define ATW_DPRINTF(x)
  174 #define ATW_DPRINTF2(x)
  175 #define ATW_DPRINTF3(x)
  176 #define DPRINTF(sc, x)  /* nothing */
  177 #define DPRINTF2(sc, x) /* nothing */
  178 #define DPRINTF3(sc, x) /* nothing */
  179 #define __atwdebugused  __unused
  180 #endif
  181 
  182 /* ifnet methods */
  183 int     atw_init(struct ifnet *);
  184 int     atw_ioctl(struct ifnet *, u_long, void *);
  185 void    atw_start(struct ifnet *);
  186 void    atw_stop(struct ifnet *, int);
  187 void    atw_watchdog(struct ifnet *);
  188 
  189 /* Device attachment */
  190 void    atw_attach(struct atw_softc *);
  191 int     atw_detach(struct atw_softc *);
  192 static void atw_evcnt_attach(struct atw_softc *);
  193 static void atw_evcnt_detach(struct atw_softc *);
  194 
  195 /* Rx/Tx process */
  196 int     atw_add_rxbuf(struct atw_softc *, int);
  197 void    atw_idle(struct atw_softc *, uint32_t);
  198 void    atw_rxdrain(struct atw_softc *);
  199 void    atw_txdrain(struct atw_softc *);
  200 
  201 /* Device (de)activation and power state */
  202 void    atw_reset(struct atw_softc *);
  203 
  204 /* Interrupt handlers */
  205 void    atw_softintr(void *);
  206 void    atw_linkintr(struct atw_softc *, uint32_t);
  207 void    atw_rxintr(struct atw_softc *);
  208 void    atw_txintr(struct atw_softc *, uint32_t);
  209 
  210 /* 802.11 state machine */
  211 static int      atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
  212 static void     atw_next_scan(void *);
  213 static void     atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
  214                               struct ieee80211_node *, int, int, uint32_t);
  215 static int      atw_tune(struct atw_softc *);
  216 
  217 /* Device initialization */
  218 static void     atw_bbp_io_init(struct atw_softc *);
  219 static void     atw_cfp_init(struct atw_softc *);
  220 static void     atw_cmdr_init(struct atw_softc *);
  221 static void     atw_ifs_init(struct atw_softc *);
  222 static void     atw_nar_init(struct atw_softc *);
  223 static void     atw_response_times_init(struct atw_softc *);
  224 static void     atw_rf_reset(struct atw_softc *);
  225 static void     atw_test1_init(struct atw_softc *);
  226 static void     atw_tofs0_init(struct atw_softc *);
  227 static void     atw_tofs2_init(struct atw_softc *);
  228 static void     atw_txlmt_init(struct atw_softc *);
  229 static void     atw_wcsr_init(struct atw_softc *);
  230 
  231 /* Key management */
  232 static int atw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
  233 static int atw_key_set(struct ieee80211com *, const struct ieee80211_key *,
  234         const uint8_t[IEEE80211_ADDR_LEN]);
  235 static void atw_key_update_begin(struct ieee80211com *);
  236 static void atw_key_update_end(struct ieee80211com *);
  237 
  238 /* RAM/ROM utilities */
  239 static void     atw_clear_sram(struct atw_softc *);
  240 static void     atw_write_sram(struct atw_softc *, u_int, uint8_t *, u_int);
  241 static int      atw_read_srom(struct atw_softc *);
  242 
  243 /* BSS setup */
  244 static void     atw_predict_beacon(struct atw_softc *);
  245 static void     atw_start_beacon(struct atw_softc *, int);
  246 static void     atw_write_bssid(struct atw_softc *);
  247 static void     atw_write_ssid(struct atw_softc *);
  248 static void     atw_write_sup_rates(struct atw_softc *);
  249 static void     atw_write_wep(struct atw_softc *);
  250 
  251 /* Media */
  252 static int      atw_media_change(struct ifnet *);
  253 
  254 static void     atw_filter_setup(struct atw_softc *);
  255 
  256 /* 802.11 utilities */
  257 static uint64_t                 atw_get_tsft(struct atw_softc *);
  258 static inline uint32_t  atw_last_even_tsft(uint32_t, uint32_t,
  259                                                    uint32_t);
  260 static struct ieee80211_node    *atw_node_alloc(struct ieee80211_node_table *);
  261 static void                     atw_node_free(struct ieee80211_node *);
  262 
  263 /*
  264  * Tuner/transceiver/modem
  265  */
  266 static void     atw_bbp_io_enable(struct atw_softc *, int);
  267 
  268 /* RFMD RF3000 Baseband Processor */
  269 static int      atw_rf3000_init(struct atw_softc *);
  270 static int      atw_rf3000_tune(struct atw_softc *, u_int);
  271 static int      atw_rf3000_write(struct atw_softc *, u_int, u_int);
  272 
  273 /* Silicon Laboratories Si4126 RF/IF Synthesizer */
  274 static void     atw_si4126_tune(struct atw_softc *, u_int);
  275 static void     atw_si4126_write(struct atw_softc *, u_int, u_int);
  276 
  277 const struct atw_txthresh_tab atw_txthresh_tab_lo[] = ATW_TXTHRESH_TAB_LO_RATE;
  278 const struct atw_txthresh_tab atw_txthresh_tab_hi[] = ATW_TXTHRESH_TAB_HI_RATE;
  279 
  280 const char *atw_tx_state[] = {
  281         "STOPPED",
  282         "RUNNING - read descriptor",
  283         "RUNNING - transmitting",
  284         "RUNNING - filling fifo",       /* XXX */
  285         "SUSPENDED",
  286         "RUNNING -- write descriptor",
  287         "RUNNING -- write last descriptor",
  288         "RUNNING - fifo full"
  289 };
  290 
  291 const char *atw_rx_state[] = {
  292         "STOPPED",
  293         "RUNNING - read descriptor",
  294         "RUNNING - check this packet, pre-fetch next",
  295         "RUNNING - wait for reception",
  296         "SUSPENDED",
  297         "RUNNING - write descriptor",
  298         "RUNNING - flush fifo",
  299         "RUNNING - fifo drain"
  300 };
  301 
  302 static inline int
  303 is_running(struct ifnet *ifp)
  304 {
  305         return (ifp->if_flags & (IFF_RUNNING | IFF_UP))
  306             == (IFF_RUNNING | IFF_UP);
  307 }
  308 
  309 int
  310 atw_activate(device_t self, enum devact act)
  311 {
  312         struct atw_softc *sc = device_private(self);
  313 
  314         switch (act) {
  315         case DVACT_DEACTIVATE:
  316                 if_deactivate(&sc->sc_if);
  317                 return 0;
  318         default:
  319                 return EOPNOTSUPP;
  320         }
  321 }
  322 
  323 bool
  324 atw_suspend(device_t self, const pmf_qual_t *qual)
  325 {
  326         struct atw_softc *sc = device_private(self);
  327 
  328         atw_rxdrain(sc);
  329         sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
  330 
  331         return true;
  332 }
  333 
  334 /* Returns -1 on failure. */
  335 static int
  336 atw_read_srom(struct atw_softc *sc)
  337 {
  338         struct seeprom_descriptor sd;
  339         uint32_t test0, fail_bits;
  340 
  341         (void)memset(&sd, 0, sizeof(sd));
  342 
  343         test0 = ATW_READ(sc, ATW_TEST0);
  344 
  345         switch (sc->sc_rev) {
  346         case ATW_REVISION_BA:
  347         case ATW_REVISION_CA:
  348                 fail_bits = ATW_TEST0_EPNE;
  349                 break;
  350         default:
  351                 fail_bits = ATW_TEST0_EPNE | ATW_TEST0_EPSNM;
  352                 break;
  353         }
  354         if ((test0 & fail_bits) != 0) {
  355                 aprint_error_dev(sc->sc_dev, "bad or missing/bad SROM\n");
  356                 return -1;
  357         }
  358 
  359         switch (test0 & ATW_TEST0_EPTYP_MASK) {
  360         case ATW_TEST0_EPTYP_93c66:
  361                 ATW_DPRINTF(("%s: 93c66 SROM\n", device_xname(sc->sc_dev)));
  362                 sc->sc_sromsz = 512;
  363                 sd.sd_chip = C56_66;
  364                 break;
  365         case ATW_TEST0_EPTYP_93c46:
  366                 ATW_DPRINTF(("%s: 93c46 SROM\n", device_xname(sc->sc_dev)));
  367                 sc->sc_sromsz = 128;
  368                 sd.sd_chip = C46;
  369                 break;
  370         default:
  371                 printf("%s: unknown SROM type %" __PRIuBITS "\n",
  372                     device_xname(sc->sc_dev),
  373                     __SHIFTOUT(test0, ATW_TEST0_EPTYP_MASK));
  374                 return -1;
  375         }
  376 
  377         sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_WAITOK | M_ZERO);
  378 
  379         /* ADM8211 has a single 32-bit register for controlling the
  380          * 93cx6 SROM.  Bit SRS enables the serial port. There is no
  381          * "ready" bit. The ADM8211 input/output sense is the reverse
  382          * of read_seeprom's.
  383          */
  384         sd.sd_tag = sc->sc_st;
  385         sd.sd_bsh = sc->sc_sh;
  386         sd.sd_regsize = 4;
  387         sd.sd_control_offset = ATW_SPR;
  388         sd.sd_status_offset = ATW_SPR;
  389         sd.sd_dataout_offset = ATW_SPR;
  390         sd.sd_CK = ATW_SPR_SCLK;
  391         sd.sd_CS = ATW_SPR_SCS;
  392         sd.sd_DI = ATW_SPR_SDO;
  393         sd.sd_DO = ATW_SPR_SDI;
  394         sd.sd_MS = ATW_SPR_SRS;
  395         sd.sd_RDY = 0;
  396 
  397         if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
  398                 aprint_error_dev(sc->sc_dev, "could not read SROM\n");
  399                 free(sc->sc_srom, M_DEVBUF);
  400                 return -1;
  401         }
  402 #ifdef ATW_DEBUG
  403         {
  404                 int i;
  405                 ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
  406                 for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
  407                         if (((i % 8) == 0) && (i != 0)) {
  408                                 ATW_DPRINTF(("\n\t"));
  409                         }
  410                         ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
  411                 }
  412                 ATW_DPRINTF(("\n"));
  413         }
  414 #endif /* ATW_DEBUG */
  415         return 0;
  416 }
  417 
  418 #ifdef ATW_DEBUG
  419 static void
  420 atw_print_regs(struct atw_softc *sc, const char *where)
  421 {
  422 #define PRINTREG(sc, reg) \
  423         ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
  424             device_xname(sc->sc_dev), reg, ATW_READ(sc, reg)))
  425 
  426         ATW_DPRINTF2(("%s: %s\n", device_xname(sc->sc_dev), where));
  427 
  428         PRINTREG(sc, ATW_PAR);
  429         PRINTREG(sc, ATW_FRCTL);
  430         PRINTREG(sc, ATW_TDR);
  431         PRINTREG(sc, ATW_WTDP);
  432         PRINTREG(sc, ATW_RDR);
  433         PRINTREG(sc, ATW_WRDP);
  434         PRINTREG(sc, ATW_RDB);
  435         PRINTREG(sc, ATW_CSR3A);
  436         PRINTREG(sc, ATW_TDBD);
  437         PRINTREG(sc, ATW_TDBP);
  438         PRINTREG(sc, ATW_STSR);
  439         PRINTREG(sc, ATW_CSR5A);
  440         PRINTREG(sc, ATW_NAR);
  441         PRINTREG(sc, ATW_CSR6A);
  442         PRINTREG(sc, ATW_IER);
  443         PRINTREG(sc, ATW_CSR7A);
  444         PRINTREG(sc, ATW_LPC);
  445         PRINTREG(sc, ATW_TEST1);
  446         PRINTREG(sc, ATW_SPR);
  447         PRINTREG(sc, ATW_TEST0);
  448         PRINTREG(sc, ATW_WCSR);
  449         PRINTREG(sc, ATW_WPDR);
  450         PRINTREG(sc, ATW_GPTMR);
  451         PRINTREG(sc, ATW_GPIO);
  452         PRINTREG(sc, ATW_BBPCTL);
  453         PRINTREG(sc, ATW_SYNCTL);
  454         PRINTREG(sc, ATW_PLCPHD);
  455         PRINTREG(sc, ATW_MMIWADDR);
  456         PRINTREG(sc, ATW_MMIRADDR1);
  457         PRINTREG(sc, ATW_MMIRADDR2);
  458         PRINTREG(sc, ATW_TXBR);
  459         PRINTREG(sc, ATW_CSR15A);
  460         PRINTREG(sc, ATW_ALCSTAT);
  461         PRINTREG(sc, ATW_TOFS2);
  462         PRINTREG(sc, ATW_CMDR);
  463         PRINTREG(sc, ATW_PCIC);
  464         PRINTREG(sc, ATW_PMCSR);
  465         PRINTREG(sc, ATW_PAR0);
  466         PRINTREG(sc, ATW_PAR1);
  467         PRINTREG(sc, ATW_MAR0);
  468         PRINTREG(sc, ATW_MAR1);
  469         PRINTREG(sc, ATW_ATIMDA0);
  470         PRINTREG(sc, ATW_ABDA1);
  471         PRINTREG(sc, ATW_BSSID0);
  472         PRINTREG(sc, ATW_TXLMT);
  473         PRINTREG(sc, ATW_MIBCNT);
  474         PRINTREG(sc, ATW_BCNT);
  475         PRINTREG(sc, ATW_TSFTH);
  476         PRINTREG(sc, ATW_TSC);
  477         PRINTREG(sc, ATW_SYNRF);
  478         PRINTREG(sc, ATW_BPLI);
  479         PRINTREG(sc, ATW_CAP0);
  480         PRINTREG(sc, ATW_CAP1);
  481         PRINTREG(sc, ATW_RMD);
  482         PRINTREG(sc, ATW_CFPP);
  483         PRINTREG(sc, ATW_TOFS0);
  484         PRINTREG(sc, ATW_TOFS1);
  485         PRINTREG(sc, ATW_IFST);
  486         PRINTREG(sc, ATW_RSPT);
  487         PRINTREG(sc, ATW_TSFTL);
  488         PRINTREG(sc, ATW_WEPCTL);
  489         PRINTREG(sc, ATW_WESK);
  490         PRINTREG(sc, ATW_WEPCNT);
  491         PRINTREG(sc, ATW_MACTEST);
  492         PRINTREG(sc, ATW_FER);
  493         PRINTREG(sc, ATW_FEMR);
  494         PRINTREG(sc, ATW_FPSR);
  495         PRINTREG(sc, ATW_FFER);
  496 #undef PRINTREG
  497 }
  498 #endif /* ATW_DEBUG */
  499 
  500 /*
  501  * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
  502  */
  503 void
  504 atw_attach(struct atw_softc *sc)
  505 {
  506         static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
  507                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  508         };
  509         struct ieee80211com *ic = &sc->sc_ic;
  510         struct ifnet *ifp = &sc->sc_if;
  511         int country_code, error, i, srom_major;
  512         uint32_t reg;
  513         static const char *type_strings[] = {"Intersil (not supported)",
  514             "RFMD", "Marvel (not supported)"};
  515 
  516         pmf_self_suspensor_init(sc->sc_dev, &sc->sc_suspensor, &sc->sc_qual);
  517 
  518         sc->sc_soft_ih = softint_establish(SOFTINT_NET, atw_softintr, sc);
  519         if (sc->sc_soft_ih == NULL) {
  520                 aprint_error_dev(sc->sc_dev, "unable to establish softint\n");
  521                 goto fail_0;
  522         }
  523 
  524         sc->sc_txth = atw_txthresh_tab_lo;
  525 
  526         SIMPLEQ_INIT(&sc->sc_txfreeq);
  527         SIMPLEQ_INIT(&sc->sc_txdirtyq);
  528 
  529 #ifdef ATW_DEBUG
  530         atw_print_regs(sc, "atw_attach");
  531 #endif /* ATW_DEBUG */
  532 
  533         /*
  534          * Allocate the control data structures, and create and load the
  535          * DMA map for it.
  536          */
  537         if ((error = bus_dmamem_alloc(sc->sc_dmat,
  538             sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
  539             1, &sc->sc_cdnseg, 0)) != 0) {
  540                 aprint_error_dev(sc->sc_dev,
  541                     "unable to allocate control data, error = %d\n",
  542                     error);
  543                 goto fail_0;
  544         }
  545 
  546         if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
  547             sizeof(struct atw_control_data), (void **)&sc->sc_control_data,
  548             BUS_DMA_COHERENT)) != 0) {
  549                 aprint_error_dev(sc->sc_dev,
  550                     "unable to map control data, error = %d\n",
  551                     error);
  552                 goto fail_1;
  553         }
  554 
  555         if ((error = bus_dmamap_create(sc->sc_dmat,
  556             sizeof(struct atw_control_data), 1,
  557             sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
  558                 aprint_error_dev(sc->sc_dev,
  559                     "unable to create control data DMA map, error = %d\n",
  560                     error);
  561                 goto fail_2;
  562         }
  563 
  564         if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
  565             sc->sc_control_data, sizeof(struct atw_control_data), NULL,
  566             0)) != 0) {
  567                 aprint_error_dev(sc->sc_dev,
  568                     "unable to load control data DMA map, error = %d\n", error);
  569                 goto fail_3;
  570         }
  571 
  572         /*
  573          * Create the transmit buffer DMA maps.
  574          */
  575         sc->sc_ntxsegs = ATW_NTXSEGS;
  576         for (i = 0; i < ATW_TXQUEUELEN; i++) {
  577                 if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
  578                     sc->sc_ntxsegs, MCLBYTES, 0, 0,
  579                     &sc->sc_txsoft[i].txs_dmamap)) != 0) {
  580                         aprint_error_dev(sc->sc_dev,
  581                             "unable to create tx DMA map %d, error = %d\n", i,
  582                             error);
  583                         goto fail_4;
  584                 }
  585         }
  586 
  587         /*
  588          * Create the receive buffer DMA maps.
  589          */
  590         for (i = 0; i < ATW_NRXDESC; i++) {
  591                 if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
  592                     MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
  593                         aprint_error_dev(sc->sc_dev,
  594                             "unable to create rx DMA map %d, error = %d\n", i,
  595                             error);
  596                         goto fail_5;
  597                 }
  598         }
  599         for (i = 0; i < ATW_NRXDESC; i++) {
  600                 sc->sc_rxsoft[i].rxs_mbuf = NULL;
  601         }
  602 
  603         switch (sc->sc_rev) {
  604         case ATW_REVISION_AB:
  605         case ATW_REVISION_AF:
  606                 sc->sc_sramlen = ATW_SRAM_A_SIZE;
  607                 break;
  608         case ATW_REVISION_BA:
  609         case ATW_REVISION_CA:
  610                 sc->sc_sramlen = ATW_SRAM_B_SIZE;
  611                 break;
  612         }
  613 
  614         /* Reset the chip to a known state. */
  615         atw_reset(sc);
  616 
  617         if (atw_read_srom(sc) == -1)
  618                 goto fail_5;
  619 
  620         sc->sc_rftype = __SHIFTOUT(sc->sc_srom[ATW_SR_CSR20],
  621             ATW_SR_RFTYPE_MASK);
  622 
  623         sc->sc_bbptype = __SHIFTOUT(sc->sc_srom[ATW_SR_CSR20],
  624             ATW_SR_BBPTYPE_MASK);
  625 
  626         if (sc->sc_rftype >= __arraycount(type_strings)) {
  627                 aprint_error_dev(sc->sc_dev, "unknown RF\n");
  628                 goto fail_5;
  629         }
  630         if (sc->sc_bbptype >= __arraycount(type_strings)) {
  631                 aprint_error_dev(sc->sc_dev, "unknown BBP\n");
  632                 goto fail_5;
  633         }
  634 
  635         aprint_normal_dev(sc->sc_dev, "%s RF, %s BBP",
  636             type_strings[sc->sc_rftype], type_strings[sc->sc_bbptype]);
  637 
  638         /* XXX There exists a Linux driver which seems to use RFType = 0 for
  639          * MARVEL. My bug, or theirs?
  640          */
  641 
  642         reg = __SHIFTIN(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
  643 
  644         switch (sc->sc_rftype) {
  645         case ATW_RFTYPE_INTERSIL:
  646                 reg |= ATW_SYNCTL_CS1;
  647                 break;
  648         case ATW_RFTYPE_RFMD:
  649                 reg |= ATW_SYNCTL_CS0;
  650                 break;
  651         case ATW_RFTYPE_MARVEL:
  652                 break;
  653         }
  654 
  655         sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
  656         sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
  657 
  658         reg = __SHIFTIN(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
  659 
  660         switch (sc->sc_bbptype) {
  661         case ATW_BBPTYPE_INTERSIL:
  662                 reg |= ATW_BBPCTL_TWI;
  663                 break;
  664         case ATW_BBPTYPE_RFMD:
  665                 reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
  666                     ATW_BBPCTL_CCA_ACTLO;
  667                 break;
  668         case ATW_BBPTYPE_MARVEL:
  669                 break;
  670         case ATW_C_BBPTYPE_RFMD:
  671                 aprint_error_dev(sc->sc_dev,
  672                     "ADM8211C MAC/RFMD BBP not supported yet.\n");
  673                 break;
  674         }
  675 
  676         sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
  677         sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
  678 
  679         /*
  680          * From this point forward, the attachment cannot fail.  A failure
  681          * before this point releases all resources that may have been
  682          * allocated.
  683          */
  684         sc->sc_flags |= ATWF_ATTACHED;
  685 
  686         ATW_DPRINTF((" SROM MAC %04x%04x%04x",
  687             htole16(sc->sc_srom[ATW_SR_MAC00]),
  688             htole16(sc->sc_srom[ATW_SR_MAC01]),
  689             htole16(sc->sc_srom[ATW_SR_MAC10])));
  690 
  691         srom_major = __SHIFTOUT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
  692             ATW_SR_MAJOR_MASK);
  693 
  694         if (srom_major < 2)
  695                 sc->sc_rf3000_options1 = 0;
  696         else if (sc->sc_rev == ATW_REVISION_BA) {
  697                 sc->sc_rf3000_options1 =
  698                     __SHIFTOUT(sc->sc_srom[ATW_SR_CR28_CR03],
  699                     ATW_SR_CR28_MASK);
  700         } else
  701                 sc->sc_rf3000_options1 = 0;
  702 
  703         sc->sc_rf3000_options2 = __SHIFTOUT(sc->sc_srom[ATW_SR_CTRY_CR29],
  704             ATW_SR_CR29_MASK);
  705 
  706         country_code = __SHIFTOUT(sc->sc_srom[ATW_SR_CTRY_CR29],
  707             ATW_SR_CTRY_MASK);
  708 
  709 #define ADD_CHANNEL(_ic, _chan) do {                                    \
  710         _ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;            \
  711         _ic->ic_channels[_chan].ic_freq =                               \
  712             ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
  713 } while (0)
  714 
  715         /* Find available channels */
  716         switch (country_code) {
  717         case COUNTRY_MMK2:      /* 1-14 */
  718                 ADD_CHANNEL(ic, 14);
  719                 /*FALLTHROUGH*/
  720         case COUNTRY_ETSI:      /* 1-13 */
  721                 for (i = 1; i <= 13; i++)
  722                         ADD_CHANNEL(ic, i);
  723                 break;
  724         case COUNTRY_FCC:       /* 1-11 */
  725         case COUNTRY_IC:        /* 1-11 */
  726                 for (i = 1; i <= 11; i++)
  727                         ADD_CHANNEL(ic, i);
  728                 break;
  729         case COUNTRY_MMK:       /* 14 */
  730                 ADD_CHANNEL(ic, 14);
  731                 break;
  732         case COUNTRY_FRANCE:    /* 10-13 */
  733                 for (i = 10; i <= 13; i++)
  734                         ADD_CHANNEL(ic, i);
  735                 break;
  736         default:        /* assume channels 10-11 */
  737         case COUNTRY_SPAIN:     /* 10-11 */
  738                 for (i = 10; i <= 11; i++)
  739                         ADD_CHANNEL(ic, i);
  740                 break;
  741         }
  742 
  743         /* Read the MAC address. */
  744         reg = ATW_READ(sc, ATW_PAR0);
  745         ic->ic_myaddr[0] = __SHIFTOUT(reg, ATW_PAR0_PAB0_MASK);
  746         ic->ic_myaddr[1] = __SHIFTOUT(reg, ATW_PAR0_PAB1_MASK);
  747         ic->ic_myaddr[2] = __SHIFTOUT(reg, ATW_PAR0_PAB2_MASK);
  748         ic->ic_myaddr[3] = __SHIFTOUT(reg, ATW_PAR0_PAB3_MASK);
  749         reg = ATW_READ(sc, ATW_PAR1);
  750         ic->ic_myaddr[4] = __SHIFTOUT(reg, ATW_PAR1_PAB4_MASK);
  751         ic->ic_myaddr[5] = __SHIFTOUT(reg, ATW_PAR1_PAB5_MASK);
  752 
  753         if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
  754                 aprint_error_dev(sc->sc_dev,
  755                     "could not get mac address, attach failed\n");
  756                 goto fail_5;
  757         }
  758 
  759         aprint_normal(" 802.11 address %s\n", ether_sprintf(ic->ic_myaddr));
  760 
  761         memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
  762         ifp->if_softc = sc;
  763         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
  764         ifp->if_ioctl = atw_ioctl;
  765         ifp->if_start = atw_start;
  766         ifp->if_watchdog = atw_watchdog;
  767         ifp->if_init = atw_init;
  768         ifp->if_stop = atw_stop;
  769         IFQ_SET_READY(&ifp->if_snd);
  770 
  771         ic->ic_ifp = ifp;
  772         ic->ic_phytype = IEEE80211_T_DS;
  773         ic->ic_opmode = IEEE80211_M_STA;
  774         ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
  775             IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
  776 
  777         ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
  778 
  779         /*
  780          * Call MI attach routines.
  781          */
  782 
  783         if_initialize(ifp);
  784         ieee80211_ifattach(ic);
  785         /* Use common softint-based if_input */
  786         ifp->if_percpuq = if_percpuq_create(ifp);
  787         if_register(ifp);
  788 
  789         atw_evcnt_attach(sc);
  790 
  791         sc->sc_newstate = ic->ic_newstate;
  792         ic->ic_newstate = atw_newstate;
  793 
  794         sc->sc_recv_mgmt = ic->ic_recv_mgmt;
  795         ic->ic_recv_mgmt = atw_recv_mgmt;
  796 
  797         sc->sc_node_free = ic->ic_node_free;
  798         ic->ic_node_free = atw_node_free;
  799 
  800         sc->sc_node_alloc = ic->ic_node_alloc;
  801         ic->ic_node_alloc = atw_node_alloc;
  802 
  803         ic->ic_crypto.cs_key_delete = atw_key_delete;
  804         ic->ic_crypto.cs_key_set = atw_key_set;
  805         ic->ic_crypto.cs_key_update_begin = atw_key_update_begin;
  806         ic->ic_crypto.cs_key_update_end = atw_key_update_end;
  807 
  808         /* possibly we should fill in our own sc_send_prresp, since
  809          * the ADM8211 is probably sending probe responses in ad hoc
  810          * mode.
  811          */
  812 
  813         /* complete initialization */
  814         ieee80211_media_init(ic, atw_media_change, ieee80211_media_status);
  815         callout_init(&sc->sc_scan_ch, 0);
  816 
  817         bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
  818             sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
  819 
  820         memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
  821         sc->sc_rxtap.ar_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
  822         sc->sc_rxtap.ar_ihdr.it_present = htole32(ATW_RX_RADIOTAP_PRESENT);
  823 
  824         memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
  825         sc->sc_txtap.at_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
  826         sc->sc_txtap.at_ihdr.it_present = htole32(ATW_TX_RADIOTAP_PRESENT);
  827 
  828         ieee80211_announce(ic);
  829         return;
  830 
  831         /*
  832          * Free any resources we've allocated during the failed attach
  833          * attempt.  Do this in reverse order and fall through.
  834          */
  835  fail_5:
  836         for (i = 0; i < ATW_NRXDESC; i++) {
  837                 if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
  838                         continue;
  839                 bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
  840         }
  841  fail_4:
  842         for (i = 0; i < ATW_TXQUEUELEN; i++) {
  843                 if (sc->sc_txsoft[i].txs_dmamap == NULL)
  844                         continue;
  845                 bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
  846         }
  847         bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
  848  fail_3:
  849         bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
  850  fail_2:
  851         bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_control_data,
  852             sizeof(struct atw_control_data));
  853  fail_1:
  854         bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
  855  fail_0:
  856         if (sc->sc_soft_ih != NULL) {
  857                 softint_disestablish(sc->sc_soft_ih);
  858                 sc->sc_soft_ih = NULL;
  859         }
  860 }
  861 
  862 static struct ieee80211_node *
  863 atw_node_alloc(struct ieee80211_node_table *nt)
  864 {
  865         struct atw_softc *sc = (struct atw_softc *)nt->nt_ic->ic_ifp->if_softc;
  866         struct ieee80211_node *ni = (*sc->sc_node_alloc)(nt);
  867 
  868         DPRINTF(sc, ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
  869         return ni;
  870 }
  871 
  872 static void
  873 atw_node_free(struct ieee80211_node *ni)
  874 {
  875         struct atw_softc *sc = (struct atw_softc *)ni->ni_ic->ic_ifp->if_softc;
  876 
  877         DPRINTF(sc, ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
  878             ether_sprintf(ni->ni_bssid)));
  879         (*sc->sc_node_free)(ni);
  880 }
  881 
  882 
  883 static void
  884 atw_test1_reset(struct atw_softc *sc)
  885 {
  886         switch (sc->sc_rev) {
  887         case ATW_REVISION_BA:
  888                 if (1 /* XXX condition on transceiver type */) {
  889                         ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
  890                 }
  891                 break;
  892         case ATW_REVISION_CA:
  893                 ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
  894                 break;
  895         default:
  896                 break;
  897         }
  898 }
  899 
  900 /*
  901  * atw_reset:
  902  *
  903  *      Perform a soft reset on the ADM8211.
  904  */
  905 void
  906 atw_reset(struct atw_softc *sc)
  907 {
  908         int i;
  909         uint32_t lpc __atwdebugused;
  910 
  911         ATW_WRITE(sc, ATW_NAR, 0x0);
  912         DELAY(atw_nar_delay);
  913 
  914         /* Reference driver has a cryptic remark indicating that this might
  915          * power-on the chip.  I know that it turns off power-saving....
  916          */
  917         ATW_WRITE(sc, ATW_FRCTL, 0x0);
  918 
  919         ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
  920 
  921         for (i = 0; i < 50000 / atw_pseudo_milli; i++) {
  922                 if ((ATW_READ(sc, ATW_PAR) & ATW_PAR_SWR) == 0)
  923                         break;
  924                 DELAY(atw_pseudo_milli);
  925         }
  926 
  927         /* ... and then pause 100ms longer for good measure. */
  928         DELAY(atw_magic_delay1);
  929 
  930         DPRINTF2(sc, ("%s: atw_reset %d iterations\n", device_xname(sc->sc_dev), i));
  931 
  932         if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
  933                 aprint_error_dev(sc->sc_dev, "reset failed to complete\n");
  934 
  935         /*
  936          * Initialize the PCI Access Register.
  937          */
  938         sc->sc_busmode = ATW_PAR_PBL_8DW;
  939 
  940         ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
  941         DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", device_xname(sc->sc_dev),
  942             ATW_READ(sc, ATW_PAR), sc->sc_busmode));
  943 
  944         atw_test1_reset(sc);
  945 
  946         /* Turn off maximum power saving, etc. */
  947         ATW_WRITE(sc, ATW_FRCTL, 0x0);
  948 
  949         DELAY(atw_magic_delay2);
  950 
  951         /* Recall EEPROM. */
  952         ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
  953 
  954         DELAY(atw_magic_delay4);
  955 
  956         lpc = ATW_READ(sc, ATW_LPC);
  957 
  958         DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
  959 
  960         /* A reset seems to affect the SRAM contents, so put them into
  961          * a known state.
  962          */
  963         atw_clear_sram(sc);
  964 
  965         memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
  966 }
  967 
  968 static void
  969 atw_clear_sram(struct atw_softc *sc)
  970 {
  971         memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
  972         sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
  973         /* XXX not for revision 0x20. */
  974         atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
  975 }
  976 
  977 /* TBD atw_init
  978  *
  979  * set MAC based on ic->ic_bss->myaddr
  980  * write WEP keys
  981  * set TX rate
  982  */
  983 
  984 /* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
  985  * without receiving a beacon with the preferred BSSID & SSID.
  986  * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
  987  */
  988 static void
  989 atw_wcsr_init(struct atw_softc *sc)
  990 {
  991         uint32_t wcsr;
  992 
  993         wcsr = ATW_READ(sc, ATW_WCSR);
  994         wcsr &= ~ATW_WCSR_BLN_MASK;
  995         wcsr |= __SHIFTIN(7, ATW_WCSR_BLN_MASK);
  996         /* We always want to wake up on link loss or TSFT out of range */
  997         wcsr |= ATW_WCSR_LSOE | ATW_WCSR_TSFTWE;
  998         ATW_WRITE(sc, ATW_WCSR, wcsr);
  999 
 1000         DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
 1001             device_xname(sc->sc_dev), __func__, ATW_READ(sc, ATW_WCSR)));
 1002 }
 1003 
 1004 /* Turn off power management.  Set Rx store-and-forward mode. */
 1005 static void
 1006 atw_cmdr_init(struct atw_softc *sc)
 1007 {
 1008         uint32_t cmdr;
 1009         cmdr = ATW_READ(sc, ATW_CMDR);
 1010         cmdr &= ~ATW_CMDR_APM;
 1011         cmdr |= ATW_CMDR_RTE;
 1012         cmdr &= ~ATW_CMDR_DRT_MASK;
 1013         cmdr |= ATW_CMDR_DRT_SF;
 1014 
 1015         ATW_WRITE(sc, ATW_CMDR, cmdr);
 1016 }
 1017 
 1018 static void
 1019 atw_tofs2_init(struct atw_softc *sc)
 1020 {
 1021         uint32_t tofs2;
 1022         /* XXX this magic can probably be figured out from the RFMD docs */
 1023 #ifndef ATW_REFSLAVE
 1024         tofs2 = __SHIFTIN(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
 1025               __SHIFTIN(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
 1026               __SHIFTIN(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
 1027               __SHIFTIN(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
 1028               __SHIFTIN(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
 1029               __SHIFTIN(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
 1030               __SHIFTIN(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
 1031               __SHIFTIN(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
 1032 #else
 1033         /* XXX new magic from reference driver source */
 1034         tofs2 = __SHIFTIN(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
 1035               __SHIFTIN(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 8 us */
 1036               __SHIFTIN(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 1 us */
 1037               __SHIFTIN(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
 1038               __SHIFTIN(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
 1039               __SHIFTIN(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
 1040               __SHIFTIN(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 1 us */
 1041               __SHIFTIN(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 8 us */
 1042 #endif
 1043         ATW_WRITE(sc, ATW_TOFS2, tofs2);
 1044 }
 1045 
 1046 static void
 1047 atw_nar_init(struct atw_softc *sc)
 1048 {
 1049         ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF | ATW_NAR_PB);
 1050 }
 1051 
 1052 static void
 1053 atw_txlmt_init(struct atw_softc *sc)
 1054 {
 1055         ATW_WRITE(sc, ATW_TXLMT, __SHIFTIN(512, ATW_TXLMT_MTMLT_MASK) |
 1056                                  __SHIFTIN(1, ATW_TXLMT_SRTYLIM_MASK));
 1057 }
 1058 
 1059 static void
 1060 atw_test1_init(struct atw_softc *sc)
 1061 {
 1062         uint32_t test1;
 1063 
 1064         test1 = ATW_READ(sc, ATW_TEST1);
 1065         test1 &= ~(ATW_TEST1_DBGREAD_MASK | ATW_TEST1_CONTROL);
 1066         /* XXX magic 0x1 */
 1067         test1 |= __SHIFTIN(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
 1068         ATW_WRITE(sc, ATW_TEST1, test1);
 1069 }
 1070 
 1071 static void
 1072 atw_rf_reset(struct atw_softc *sc)
 1073 {
 1074         /* XXX this resets an Intersil RF front-end? */
 1075         /* TBD condition on Intersil RFType? */
 1076         ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
 1077         DELAY(atw_rf_delay1);
 1078         ATW_WRITE(sc, ATW_SYNRF, 0);
 1079         DELAY(atw_rf_delay2);
 1080 }
 1081 
 1082 /* Set 16 TU max duration for the contention-free period (CFP). */
 1083 static void
 1084 atw_cfp_init(struct atw_softc *sc)
 1085 {
 1086         uint32_t cfpp;
 1087 
 1088         cfpp = ATW_READ(sc, ATW_CFPP);
 1089         cfpp &= ~ATW_CFPP_CFPMD;
 1090         cfpp |= __SHIFTIN(16, ATW_CFPP_CFPMD);
 1091         ATW_WRITE(sc, ATW_CFPP, cfpp);
 1092 }
 1093 
 1094 static void
 1095 atw_tofs0_init(struct atw_softc *sc)
 1096 {
 1097         /* XXX I guess that the Cardbus clock is 22 MHz?
 1098          * I am assuming that the role of ATW_TOFS0_USCNT is
 1099          * to divide the bus clock to get a 1 MHz clock---the datasheet is not
 1100          * very clear on this point. It says in the datasheet that it is
 1101          * possible for the ADM8211 to accommodate bus speeds between 22 MHz
 1102          * and 33 MHz; maybe this is the way? I see a binary-only driver write
 1103          * these values. These values are also the power-on default.
 1104          */
 1105         ATW_WRITE(sc, ATW_TOFS0,
 1106             __SHIFTIN(22, ATW_TOFS0_USCNT_MASK) |
 1107             ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
 1108 }
 1109 
 1110 /* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
 1111 static void
 1112 atw_ifs_init(struct atw_softc *sc)
 1113 {
 1114         uint32_t ifst;
 1115         /* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
 1116          * Go figure.
 1117          */
 1118         ifst = __SHIFTIN(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
 1119               __SHIFTIN(22 * 10 /* IEEE80211_DUR_DS_SIFS */ /* # of 22 MHz cycles */,
 1120                      ATW_IFST_SIFS_MASK) |
 1121               __SHIFTIN(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
 1122               __SHIFTIN(IEEE80211_DUR_DS_EIFS, ATW_IFST_EIFS_MASK);
 1123 
 1124         ATW_WRITE(sc, ATW_IFST, ifst);
 1125 }
 1126 
 1127 static void
 1128 atw_response_times_init(struct atw_softc *sc)
 1129 {
 1130         /* XXX More magic. Relates to ACK timing?  The datasheet seems to
 1131          * indicate that the MAC expects at least SIFS + MIRT microseconds
 1132          * to pass after it transmits a frame that requires a response;
 1133          * it waits at most SIFS + MART microseconds for the response.
 1134          * Surely this is not the ACK timeout?
 1135          */
 1136         ATW_WRITE(sc, ATW_RSPT, __SHIFTIN(0xffff, ATW_RSPT_MART_MASK) |
 1137             __SHIFTIN(0xff, ATW_RSPT_MIRT_MASK));
 1138 }
 1139 
 1140 /* Set up the MMI read/write addresses for the baseband. The Tx/Rx
 1141  * engines read and write baseband registers after Rx and before
 1142  * Tx, respectively.
 1143  */
 1144 static void
 1145 atw_bbp_io_init(struct atw_softc *sc)
 1146 {
 1147         uint32_t mmiraddr2;
 1148 
 1149         /* XXX The reference driver does this, but is it *really*
 1150          * necessary?
 1151          */
 1152         switch (sc->sc_rev) {
 1153         case ATW_REVISION_AB:
 1154         case ATW_REVISION_AF:
 1155                 mmiraddr2 = 0x0;
 1156                 break;
 1157         default:
 1158                 mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
 1159                 mmiraddr2 &=
 1160                     ~(ATW_MMIRADDR2_PROREXT | ATW_MMIRADDR2_PRORLEN_MASK);
 1161                 break;
 1162         }
 1163 
 1164         switch (sc->sc_bbptype) {
 1165         case ATW_BBPTYPE_INTERSIL:
 1166                 ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
 1167                 ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
 1168                 mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
 1169                 break;
 1170         case ATW_BBPTYPE_MARVEL:
 1171                 /* TBD find out the Marvel settings. */
 1172                 break;
 1173         case ATW_BBPTYPE_RFMD:
 1174         default:
 1175                 ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
 1176                 ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
 1177                 mmiraddr2 |= ATW_MMIRADDR2_RFMD;
 1178                 break;
 1179         }
 1180         ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
 1181         ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
 1182 }
 1183 
 1184 /*
 1185  * atw_init:            [ ifnet interface function ]
 1186  *
 1187  *      Initialize the interface.  Must be called at splnet().
 1188  */
 1189 int
 1190 atw_init(struct ifnet *ifp)
 1191 {
 1192         struct atw_softc *sc = ifp->if_softc;
 1193         struct ieee80211com *ic = &sc->sc_ic;
 1194         struct atw_txsoft *txs;
 1195         struct atw_rxsoft *rxs;
 1196         int i, error = 0;
 1197 
 1198         if (device_is_active(sc->sc_dev)) {
 1199                 /*
 1200                  * Cancel any pending I/O.
 1201                  */
 1202                 atw_stop(ifp, 0);
 1203         } else if (!pmf_device_subtree_resume(sc->sc_dev, &sc->sc_qual) ||
 1204                    !device_is_active(sc->sc_dev))
 1205                 return 0;
 1206 
 1207         /*
 1208          * Reset the chip to a known state.
 1209          */
 1210         atw_reset(sc);
 1211 
 1212         DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
 1213             __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
 1214             ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
 1215 
 1216         atw_wcsr_init(sc);
 1217 
 1218         atw_cmdr_init(sc);
 1219 
 1220         /* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
 1221          *
 1222          * XXX Set transmit power for ATIM, RTS, Beacon.
 1223          */
 1224         ATW_WRITE(sc, ATW_PLCPHD, __SHIFTIN(10, ATW_PLCPHD_SIGNAL_MASK) |
 1225             __SHIFTIN(0xb0, ATW_PLCPHD_SERVICE_MASK));
 1226 
 1227         atw_tofs2_init(sc);
 1228 
 1229         atw_nar_init(sc);
 1230 
 1231         atw_txlmt_init(sc);
 1232 
 1233         atw_test1_init(sc);
 1234 
 1235         atw_rf_reset(sc);
 1236 
 1237         atw_cfp_init(sc);
 1238 
 1239         atw_tofs0_init(sc);
 1240 
 1241         atw_ifs_init(sc);
 1242 
 1243         /* XXX Fall asleep after one second of inactivity.
 1244          * XXX A frame may only dribble in for 65536us.
 1245          */
 1246         ATW_WRITE(sc, ATW_RMD,
 1247             __SHIFTIN(1, ATW_RMD_PCNT) | __SHIFTIN(0xffff, ATW_RMD_RMRD_MASK));
 1248 
 1249         atw_response_times_init(sc);
 1250 
 1251         atw_bbp_io_init(sc);
 1252 
 1253         ATW_WRITE(sc, ATW_STSR, 0xffffffff);
 1254 
 1255         if ((error = atw_rf3000_init(sc)) != 0)
 1256                 goto out;
 1257 
 1258         ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
 1259         DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", device_xname(sc->sc_dev),
 1260             ATW_READ(sc, ATW_PAR), sc->sc_busmode));
 1261 
 1262         /*
 1263          * Initialize the transmit descriptor ring.
 1264          */
 1265         memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
 1266         for (i = 0; i < ATW_NTXDESC; i++) {
 1267                 sc->sc_txdescs[i].at_ctl = 0;
 1268                 /* no transmit chaining */
 1269                 sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
 1270                 sc->sc_txdescs[i].at_buf2 =
 1271                     htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
 1272         }
 1273         /* use ring mode */
 1274         sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
 1275         ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
 1276             BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 1277         sc->sc_txfree = ATW_NTXDESC;
 1278         sc->sc_txnext = 0;
 1279 
 1280         /*
 1281          * Initialize the transmit job descriptors.
 1282          */
 1283         SIMPLEQ_INIT(&sc->sc_txfreeq);
 1284         SIMPLEQ_INIT(&sc->sc_txdirtyq);
 1285         for (i = 0; i < ATW_TXQUEUELEN; i++) {
 1286                 txs = &sc->sc_txsoft[i];
 1287                 txs->txs_mbuf = NULL;
 1288                 SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
 1289         }
 1290 
 1291         /*
 1292          * Initialize the receive descriptor and receive job
 1293          * descriptor rings.
 1294          */
 1295         for (i = 0; i < ATW_NRXDESC; i++) {
 1296                 rxs = &sc->sc_rxsoft[i];
 1297                 if (rxs->rxs_mbuf == NULL) {
 1298                         if ((error = atw_add_rxbuf(sc, i)) != 0) {
 1299                                 aprint_error_dev(sc->sc_dev,
 1300                                     "unable to allocate or map rx buffer %d, "
 1301                                     "error = %d\n", i, error);
 1302                                 /*
 1303                                  * XXX Should attempt to run with fewer receive
 1304                                  * XXX buffers instead of just failing.
 1305                                  */
 1306                                 atw_rxdrain(sc);
 1307                                 goto out;
 1308                         }
 1309                 } else
 1310                         atw_init_rxdesc(sc, i);
 1311         }
 1312         sc->sc_rxptr = 0;
 1313 
 1314         /*
 1315          * Initialize the interrupt mask and enable interrupts.
 1316          */
 1317         /* normal interrupts */
 1318         sc->sc_inten = ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
 1319             ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
 1320 
 1321         /* abnormal interrupts */
 1322         sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
 1323             ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
 1324             ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
 1325 
 1326         sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
 1327             ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
 1328         sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
 1329         sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
 1330             ATW_INTR_TRT;
 1331 
 1332         sc->sc_linkint_mask &= sc->sc_inten;
 1333         sc->sc_rxint_mask &= sc->sc_inten;
 1334         sc->sc_txint_mask &= sc->sc_inten;
 1335 
 1336         ATW_WRITE(sc, ATW_IER, sc->sc_inten);
 1337         ATW_WRITE(sc, ATW_STSR, 0xffffffff);
 1338 
 1339         DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
 1340             device_xname(sc->sc_dev), ATW_READ(sc, ATW_IER), sc->sc_inten));
 1341 
 1342         /*
 1343          * Give the transmit and receive rings to the ADM8211.
 1344          */
 1345         ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
 1346         ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
 1347 
 1348         sc->sc_txthresh = 0;
 1349         sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
 1350             sc->sc_txth[sc->sc_txthresh].txth_opmode;
 1351 
 1352         /* common 802.11 configuration */
 1353         ic->ic_flags &= ~IEEE80211_F_IBSSON;
 1354         switch (ic->ic_opmode) {
 1355         case IEEE80211_M_STA:
 1356                 break;
 1357         case IEEE80211_M_AHDEMO: /* XXX */
 1358         case IEEE80211_M_IBSS:
 1359                 ic->ic_flags |= IEEE80211_F_IBSSON;
 1360                 /*FALLTHROUGH*/
 1361         case IEEE80211_M_HOSTAP: /* XXX */
 1362                 break;
 1363         case IEEE80211_M_MONITOR: /* XXX */
 1364                 break;
 1365         }
 1366 
 1367         switch (ic->ic_opmode) {
 1368         case IEEE80211_M_AHDEMO:
 1369         case IEEE80211_M_HOSTAP:
 1370 #ifndef IEEE80211_NO_HOSTAP
 1371                 ic->ic_bss->ni_intval = ic->ic_lintval;
 1372                 ic->ic_bss->ni_rssi = 0;
 1373                 ic->ic_bss->ni_rstamp = 0;
 1374 #endif /* !IEEE80211_NO_HOSTAP */
 1375                 break;
 1376         default:                                        /* XXX */
 1377                 break;
 1378         }
 1379 
 1380         sc->sc_wepctl = 0;
 1381 
 1382         atw_write_ssid(sc);
 1383         atw_write_sup_rates(sc);
 1384         atw_write_wep(sc);
 1385 
 1386         ic->ic_state = IEEE80211_S_INIT;
 1387 
 1388         /*
 1389          * Set the receive filter.  This will start the transmit and
 1390          * receive processes.
 1391          */
 1392         atw_filter_setup(sc);
 1393 
 1394         /*
 1395          * Start the receive process.
 1396          */
 1397         ATW_WRITE(sc, ATW_RDR, 0x1);
 1398 
 1399         /*
 1400          * Note that the interface is now running.
 1401          */
 1402         ifp->if_flags |= IFF_RUNNING;
 1403 
 1404         /* send no beacons, yet. */
 1405         atw_start_beacon(sc, 0);
 1406 
 1407         if (ic->ic_opmode == IEEE80211_M_MONITOR)
 1408                 error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 1409         else
 1410                 error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 1411  out:
 1412         if (error) {
 1413                 ifp->if_flags &= ~IFF_RUNNING;
 1414                 sc->sc_tx_timer = 0;
 1415                 ifp->if_timer = 0;
 1416                 printf("%s: interface not running\n", device_xname(sc->sc_dev));
 1417         }
 1418 #ifdef ATW_DEBUG
 1419         atw_print_regs(sc, "end of init");
 1420 #endif /* ATW_DEBUG */
 1421 
 1422         return (error);
 1423 }
 1424 
 1425 /* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
 1426  *           0: MAC control of RF3000/Si4126.
 1427  *
 1428  * Applies power, or selects RF front-end? Sets reset condition.
 1429  *
 1430  * TBD support non-RFMD BBP, non-SiLabs synth.
 1431  */
 1432 static void
 1433 atw_bbp_io_enable(struct atw_softc *sc, int enable)
 1434 {
 1435         if (enable) {
 1436                 ATW_WRITE(sc, ATW_SYNRF,
 1437                     ATW_SYNRF_SELRF | ATW_SYNRF_PE1 | ATW_SYNRF_PHYRST);
 1438                 DELAY(atw_bbp_io_enable_delay);
 1439         } else {
 1440                 ATW_WRITE(sc, ATW_SYNRF, 0);
 1441                 DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
 1442         }
 1443 }
 1444 
 1445 static int
 1446 atw_tune(struct atw_softc *sc)
 1447 {
 1448         int rc;
 1449         u_int chan;
 1450         struct ieee80211com *ic = &sc->sc_ic;
 1451 
 1452         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
 1453         if (chan == IEEE80211_CHAN_ANY)
 1454                 panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
 1455 
 1456         if (chan == sc->sc_cur_chan)
 1457                 return 0;
 1458 
 1459         DPRINTF(sc, ("%s: chan %d -> %d\n", device_xname(sc->sc_dev),
 1460             sc->sc_cur_chan, chan));
 1461 
 1462         atw_idle(sc, ATW_NAR_SR | ATW_NAR_ST);
 1463 
 1464         atw_si4126_tune(sc, chan);
 1465         if ((rc = atw_rf3000_tune(sc, chan)) != 0)
 1466                 printf("%s: failed to tune channel %d\n", device_xname(sc->sc_dev),
 1467                     chan);
 1468 
 1469         ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
 1470         DELAY(atw_nar_delay);
 1471         ATW_WRITE(sc, ATW_RDR, 0x1);
 1472 
 1473         if (rc == 0) {
 1474                 sc->sc_cur_chan = chan;
 1475                 sc->sc_rxtap.ar_chan_freq = sc->sc_txtap.at_chan_freq =
 1476                     htole16(ic->ic_curchan->ic_freq);
 1477                 sc->sc_rxtap.ar_chan_flags = sc->sc_txtap.at_chan_flags =
 1478                     htole16(ic->ic_curchan->ic_flags);
 1479         }
 1480 
 1481         return rc;
 1482 }
 1483 
 1484 #ifdef ATW_SYNDEBUG
 1485 static void
 1486 atw_si4126_print(struct atw_softc *sc)
 1487 {
 1488         struct ifnet *ifp = &sc->sc_if;
 1489         u_int addr, val;
 1490 
 1491         val = 0;
 1492 
 1493         if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
 1494                 return;
 1495 
 1496         for (addr = 0; addr <= 8; addr++) {
 1497                 printf("%s: synth[%d] = ", device_xname(sc->sc_dev), addr);
 1498                 if (atw_si4126_read(sc, addr, &val) == 0) {
 1499                         printf("<unknown> (quitting print-out)\n");
 1500                         break;
 1501                 }
 1502                 printf("%05x\n", val);
 1503         }
 1504 }
 1505 #endif /* ATW_SYNDEBUG */
 1506 
 1507 /* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
 1508  *
 1509  * The RF/IF synthesizer produces two reference frequencies for
 1510  * the RF2948B transceiver.  The first frequency the RF2948B requires
 1511  * is two times the so-called "intermediate frequency" (IF). Since
 1512  * a SAW filter on the radio fixes the IF at 374 MHz, I program the
 1513  * Si4126 to generate IF LO = 374 MHz x 2 = 748 MHz.  The second
 1514  * frequency required by the transceiver is the radio frequency
 1515  * (RF). This is a superheterodyne transceiver; for f(chan) the
 1516  * center frequency of the channel we are tuning, RF = f(chan) -
 1517  * IF.
 1518  *
 1519  * XXX I am told by SiLabs that the Si4126 will accept a broader range
 1520  * of XIN than the 2-25 MHz mentioned by the datasheet, even *without*
 1521  * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
 1522  * works, but I have still programmed for XINDIV2 = 1 to be safe.
 1523  */
 1524 static void
 1525 atw_si4126_tune(struct atw_softc *sc, u_int chan)
 1526 {
 1527         u_int mhz;
 1528         u_int R;
 1529         uint32_t gpio;
 1530         uint16_t gain;
 1531 
 1532 #ifdef ATW_SYNDEBUG
 1533         atw_si4126_print(sc);
 1534 #endif /* ATW_SYNDEBUG */
 1535 
 1536         if (chan == 14)
 1537                 mhz = 2484;
 1538         else
 1539                 mhz = 2412 + 5 * (chan - 1);
 1540 
 1541         /* Tune IF to 748 MHz to suit the IF LO input of the
 1542          * RF2494B, which is 2 x IF. No need to set an IF divider
 1543          * because an IF in 526 MHz - 952 MHz is allowed.
 1544          *
 1545          * XIN is 44.000 MHz, so divide it by two to get allowable
 1546          * range of 2-25 MHz. SiLabs tells me that this is not
 1547          * strictly necessary.
 1548          */
 1549 
 1550         if (atw_xindiv2)
 1551                 R = 44;
 1552         else
 1553                 R = 88;
 1554 
 1555         /* Power-up RF, IF synthesizers. */
 1556         atw_si4126_write(sc, SI4126_POWER,
 1557             SI4126_POWER_PDIB | SI4126_POWER_PDRB);
 1558 
 1559         /* set LPWR, too? */
 1560         atw_si4126_write(sc, SI4126_MAIN,
 1561             (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
 1562 
 1563         /* Set the phase-locked loop gain.  If RF2 N > 2047, then
 1564          * set KP2 to 1.
 1565          *
 1566          * REFDIF This is different from the reference driver, which
 1567          * always sets SI4126_GAIN to 0.
 1568          */
 1569         gain = __SHIFTIN(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
 1570 
 1571         atw_si4126_write(sc, SI4126_GAIN, gain);
 1572 
 1573         /* XIN = 44 MHz.
 1574          *
 1575          * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
 1576          * R = 44 so that 1496/(2 * 44) * 44 MHz = 748 MHz.
 1577          *
 1578          * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
 1579          * so that 1496/88 * 44 MHz = 748 MHz.
 1580          */
 1581         atw_si4126_write(sc, SI4126_IFN, 1496);
 1582 
 1583         atw_si4126_write(sc, SI4126_IFR, R);
 1584 
 1585 #ifndef ATW_REFSLAVE
 1586         /* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
 1587          * then RF1 becomes the active RF synthesizer, even on the Si4126,
 1588          * which has no RF1!
 1589          */
 1590         atw_si4126_write(sc, SI4126_RF1R, R);
 1591 
 1592         atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
 1593 #endif
 1594 
 1595         /* N/R * XIN = RF. XIN = 44 MHz. We desire RF = mhz - IF,
 1596          * where IF = 374 MHz.  Let's divide XIN to 1 MHz. So R = 44.
 1597          * Now let's multiply it to mhz. So mhz - IF = N.
 1598          */
 1599         atw_si4126_write(sc, SI4126_RF2R, R);
 1600 
 1601         atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
 1602 
 1603         /* wait 100us from power-up for RF, IF to settle */
 1604         DELAY(100);
 1605 
 1606         gpio = ATW_READ(sc, ATW_GPIO);
 1607         gpio &= ~(ATW_GPIO_EN_MASK | ATW_GPIO_O_MASK | ATW_GPIO_I_MASK);
 1608         gpio |= __SHIFTIN(1, ATW_GPIO_EN_MASK);
 1609 
 1610         if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
 1611                 /* Set a Prism RF front-end to a special mode for channel 14?
 1612                  *
 1613                  * Apparently the SMC2635W needs this, although I don't think
 1614                  * it has a Prism RF.
 1615                  */
 1616                 gpio |= __SHIFTIN(1, ATW_GPIO_O_MASK);
 1617         }
 1618         ATW_WRITE(sc, ATW_GPIO, gpio);
 1619 
 1620 #ifdef ATW_SYNDEBUG
 1621         atw_si4126_print(sc);
 1622 #endif /* ATW_SYNDEBUG */
 1623 }
 1624 
 1625 /* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
 1626  * diversity.
 1627  *
 1628  * !!!
 1629  * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
 1630  * !!!
 1631  */
 1632 static int
 1633 atw_rf3000_init(struct atw_softc *sc)
 1634 {
 1635         int rc = 0;
 1636 
 1637         atw_bbp_io_enable(sc, 1);
 1638 
 1639         /* CCA is acquisition sensitive */
 1640         rc = atw_rf3000_write(sc, RF3000_CCACTL,
 1641             __SHIFTIN(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
 1642 
 1643         if (rc != 0)
 1644                 goto out;
 1645 
 1646         /* enable diversity */
 1647         rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
 1648 
 1649         if (rc != 0)
 1650                 goto out;
 1651 
 1652         /* sensible setting from a binary-only driver */
 1653         rc = atw_rf3000_write(sc, RF3000_GAINCTL,
 1654             __SHIFTIN(0x1d, RF3000_GAINCTL_TXVGC_MASK));
 1655 
 1656         if (rc != 0)
 1657                 goto out;
 1658 
 1659         /* magic from a binary-only driver */
 1660         rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
 1661             __SHIFTIN(0x38, RF3000_LOGAINCAL_CAL_MASK));
 1662 
 1663         if (rc != 0)
 1664                 goto out;
 1665 
 1666         rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
 1667 
 1668         if (rc != 0)
 1669                 goto out;
 1670 
 1671         /* XXX Reference driver remarks that Abocom sets this to 50.
 1672          * Meaning 0x50, I think....  50 = 0x32, which would set a bit
 1673          * in the "reserved" area of register RF3000_OPTIONS1.
 1674          */
 1675         rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
 1676 
 1677         if (rc != 0)
 1678                 goto out;
 1679 
 1680         rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
 1681 
 1682         if (rc != 0)
 1683                 goto out;
 1684 
 1685 out:
 1686         atw_bbp_io_enable(sc, 0);
 1687         return rc;
 1688 }
 1689 
 1690 #ifdef ATW_BBPDEBUG
 1691 static void
 1692 atw_rf3000_print(struct atw_softc *sc)
 1693 {
 1694         struct ifnet *ifp = &sc->sc_if;
 1695         u_int addr, val;
 1696 
 1697         if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
 1698                 return;
 1699 
 1700         for (addr = 0x01; addr <= 0x15; addr++) {
 1701                 printf("%s: bbp[%d] = \n", device_xname(sc->sc_dev), addr);
 1702                 if (atw_rf3000_read(sc, addr, &val) != 0) {
 1703                         printf("<unknown> (quitting print-out)\n");
 1704                         break;
 1705                 }
 1706                 printf("%08x\n", val);
 1707         }
 1708 }
 1709 #endif /* ATW_BBPDEBUG */
 1710 
 1711 /* Set the power settings on the BBP for channel `chan'. */
 1712 static int
 1713 atw_rf3000_tune(struct atw_softc *sc, u_int chan)
 1714 {
 1715         int rc = 0;
 1716         uint32_t reg;
 1717         uint16_t txpower, lpf_cutoff, lna_gs_thresh;
 1718 
 1719         txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
 1720         lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
 1721         lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
 1722 
 1723         /* odd channels: LSB, even channels: MSB */
 1724         if (chan % 2 == 1) {
 1725                 txpower &= 0xFF;
 1726                 lpf_cutoff &= 0xFF;
 1727                 lna_gs_thresh &= 0xFF;
 1728         } else {
 1729                 txpower >>= 8;
 1730                 lpf_cutoff >>= 8;
 1731                 lna_gs_thresh >>= 8;
 1732         }
 1733 
 1734 #ifdef ATW_BBPDEBUG
 1735         atw_rf3000_print(sc);
 1736 #endif /* ATW_BBPDEBUG */
 1737 
 1738         DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
 1739             "lna_gs_thresh %02x\n",
 1740             device_xname(sc->sc_dev), chan, txpower, lpf_cutoff, lna_gs_thresh));
 1741 
 1742         atw_bbp_io_enable(sc, 1);
 1743 
 1744         if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
 1745             __SHIFTIN(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
 1746                 goto out;
 1747 
 1748         if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
 1749                 goto out;
 1750 
 1751         if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
 1752                 goto out;
 1753 
 1754         rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0);
 1755 
 1756         if (rc != 0)
 1757                 goto out;
 1758 
 1759         rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
 1760 
 1761         if (rc != 0)
 1762                 goto out;
 1763 
 1764 #ifdef ATW_BBPDEBUG
 1765         atw_rf3000_print(sc);
 1766 #endif /* ATW_BBPDEBUG */
 1767 
 1768 out:
 1769         atw_bbp_io_enable(sc, 0);
 1770 
 1771         /* set beacon, rts, atim transmit power */
 1772         reg = ATW_READ(sc, ATW_PLCPHD);
 1773         reg &= ~ATW_PLCPHD_SERVICE_MASK;
 1774         reg |= __SHIFTIN(__SHIFTIN(txpower, RF3000_GAINCTL_TXVGC_MASK),
 1775             ATW_PLCPHD_SERVICE_MASK);
 1776         ATW_WRITE(sc, ATW_PLCPHD, reg);
 1777         DELAY(atw_plcphd_delay);
 1778 
 1779         return rc;
 1780 }
 1781 
 1782 /* Write a register on the RF3000 baseband processor using the
 1783  * registers provided by the ADM8211 for this purpose.
 1784  *
 1785  * Return 0 on success.
 1786  */
 1787 static int
 1788 atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
 1789 {
 1790         uint32_t reg;
 1791         int i;
 1792 
 1793         reg = sc->sc_bbpctl_wr |
 1794              __SHIFTIN(val & 0xff, ATW_BBPCTL_DATA_MASK) |
 1795              __SHIFTIN(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
 1796 
 1797         for (i = 20000 / atw_pseudo_milli; --i >= 0; ) {
 1798                 ATW_WRITE(sc, ATW_BBPCTL, reg);
 1799                 DELAY(2 * atw_pseudo_milli);
 1800                 if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
 1801                         break;
 1802         }
 1803 
 1804         if (i < 0) {
 1805                 printf("%s: BBPCTL still busy\n", device_xname(sc->sc_dev));
 1806                 return ETIMEDOUT;
 1807         }
 1808         return 0;
 1809 }
 1810 
 1811 /* Read a register on the RF3000 baseband processor using the registers
 1812  * the ADM8211 provides for this purpose.
 1813  *
 1814  * The 7-bit register address is addr.  Record the 8-bit data in the register
 1815  * in *val.
 1816  *
 1817  * Return 0 on success.
 1818  *
 1819  * XXX This does not seem to work. The ADM8211 must require more or
 1820  * different magic to read the chip than to write it. Possibly some
 1821  * of the magic I have derived from a binary-only driver concerns
 1822  * the "chip address" (see the RF3000 manual).
 1823  */
 1824 #ifdef ATW_BBPDEBUG
 1825 static int
 1826 atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
 1827 {
 1828         uint32_t reg;
 1829         int i;
 1830 
 1831         for (i = 1000; --i >= 0; ) {
 1832                 if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD | ATW_BBPCTL_WR)
 1833                     == 0)
 1834                         break;
 1835                 DELAY(100);
 1836         }
 1837 
 1838         if (i < 0) {
 1839                 printf("%s: start atw_rf3000_read, BBPCTL busy\n",
 1840                     device_xname(sc->sc_dev));
 1841                 return ETIMEDOUT;
 1842         }
 1843 
 1844         reg = sc->sc_bbpctl_rd | __SHIFTIN(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
 1845 
 1846         ATW_WRITE(sc, ATW_BBPCTL, reg);
 1847 
 1848         for (i = 1000; --i >= 0; ) {
 1849                 DELAY(100);
 1850                 if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
 1851                         break;
 1852         }
 1853 
 1854         ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
 1855 
 1856         if (i < 0) {
 1857                 printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
 1858                     device_xname(sc->sc_dev), reg);
 1859                 return ETIMEDOUT;
 1860         }
 1861         if (val != NULL)
 1862                 *val = __SHIFTOUT(reg, ATW_BBPCTL_DATA_MASK);
 1863         return 0;
 1864 }
 1865 #endif /* ATW_BBPDEBUG */
 1866 
 1867 /* Write a register on the Si4126 RF/IF synthesizer using the registers
 1868  * provided by the ADM8211 for that purpose.
 1869  *
 1870  * val is 18 bits of data, and val is the 4-bit address of the register.
 1871  *
 1872  * Return 0 on success.
 1873  */
 1874 static void
 1875 atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
 1876 {
 1877         uint32_t bits, mask, reg;
 1878         const int nbits = 22;
 1879 
 1880         KASSERT((addr & ~__SHIFTOUT_MASK(SI4126_TWI_ADDR_MASK)) == 0);
 1881         KASSERT((val & ~__SHIFTOUT_MASK(SI4126_TWI_DATA_MASK)) == 0);
 1882 
 1883         bits = __SHIFTIN(val, SI4126_TWI_DATA_MASK) |
 1884                __SHIFTIN(addr, SI4126_TWI_ADDR_MASK);
 1885 
 1886         reg = ATW_SYNRF_SELSYN;
 1887         /* reference driver: reset Si4126 serial bus to initial
 1888          * conditions?
 1889          */
 1890         ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
 1891         ATW_WRITE(sc, ATW_SYNRF, reg);
 1892 
 1893         for (mask = __BIT(nbits - 1); mask != 0; mask >>= 1) {
 1894                 if ((bits & mask) != 0)
 1895                         reg |= ATW_SYNRF_SYNDATA;
 1896                 else
 1897                         reg &= ~ATW_SYNRF_SYNDATA;
 1898                 ATW_WRITE(sc, ATW_SYNRF, reg);
 1899                 ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
 1900                 ATW_WRITE(sc, ATW_SYNRF, reg);
 1901         }
 1902         ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
 1903         ATW_WRITE(sc, ATW_SYNRF, 0x0);
 1904 }
 1905 
 1906 /* Read 18-bit data from the 4-bit address addr in Si4126
 1907  * RF synthesizer and write the data to *val. Return 0 on success.
 1908  *
 1909  * XXX This does not seem to work. The ADM8211 must require more or
 1910  * different magic to read the chip than to write it.
 1911  */
 1912 #ifdef ATW_SYNDEBUG
 1913 static int
 1914 atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
 1915 {
 1916         uint32_t reg;
 1917         int i;
 1918 
 1919         KASSERT((addr & ~__SHIFTOUT_MASK(SI4126_TWI_ADDR_MASK)) == 0);
 1920 
 1921         for (i = 1000; --i >= 0; ) {
 1922                 if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD | ATW_SYNCTL_WR)
 1923                     == 0)
 1924                         break;
 1925                 DELAY(100);
 1926         }
 1927 
 1928         if (i < 0) {
 1929                 printf("%s: start atw_si4126_read, SYNCTL busy\n",
 1930                     device_xname(sc->sc_dev));
 1931                 return ETIMEDOUT;
 1932         }
 1933 
 1934         reg = sc->sc_synctl_rd | __SHIFTIN(addr, ATW_SYNCTL_DATA_MASK);
 1935 
 1936         ATW_WRITE(sc, ATW_SYNCTL, reg);
 1937 
 1938         for (i = 1000; --i >= 0; ) {
 1939                 DELAY(100);
 1940                 if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
 1941                         break;
 1942         }
 1943 
 1944         ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
 1945 
 1946         if (i < 0) {
 1947                 printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
 1948                     device_xname(sc->sc_dev), reg);
 1949                 return ETIMEDOUT;
 1950         }
 1951         if (val != NULL)
 1952                 *val = __SHIFTOUT(ATW_READ(sc, ATW_SYNCTL),
 1953                                        ATW_SYNCTL_DATA_MASK);
 1954         return 0;
 1955 }
 1956 #endif /* ATW_SYNDEBUG */
 1957 
 1958 /* XXX is the endianness correct? test. */
 1959 #define atw_calchash(addr) \
 1960         (ether_crc32_le((addr), IEEE80211_ADDR_LEN) & __BITS(5, 0))
 1961 
 1962 /*
 1963  * atw_filter_setup:
 1964  *
 1965  *      Set the ADM8211's receive filter.
 1966  */
 1967 static void
 1968 atw_filter_setup(struct atw_softc *sc)
 1969 {
 1970         struct ieee80211com *ic = &sc->sc_ic;
 1971         struct ethercom *ec = &sc->sc_ec;
 1972         struct ifnet *ifp = &sc->sc_if;
 1973         int hash;
 1974         uint32_t hashes[2];
 1975         struct ether_multi *enm;
 1976         struct ether_multistep step;
 1977 
 1978         /* According to comments in tlp_al981_filter_setup
 1979          * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
 1980          * multicast filter to be set while it is running.  Hopefully
 1981          * the ADM8211 is not the same!
 1982          */
 1983         if ((ifp->if_flags & IFF_RUNNING) != 0)
 1984                 atw_idle(sc, ATW_NAR_SR);
 1985 
 1986         sc->sc_opmode &= ~(ATW_NAR_PB | ATW_NAR_PR | ATW_NAR_MM);
 1987         ifp->if_flags &= ~IFF_ALLMULTI;
 1988 
 1989         /* XXX in scan mode, do not filter packets.  Maybe this is
 1990          * unnecessary.
 1991          */
 1992         if (ic->ic_state == IEEE80211_S_SCAN ||
 1993             (ifp->if_flags & IFF_PROMISC) != 0) {
 1994                 sc->sc_opmode |= ATW_NAR_PR | ATW_NAR_PB;
 1995                 goto allmulti;
 1996         }
 1997 
 1998         hashes[0] = hashes[1] = 0x0;
 1999 
 2000         /*
 2001          * Program the 64-bit multicast hash filter.
 2002          */
 2003         ETHER_LOCK(ec);
 2004         ETHER_FIRST_MULTI(step, ec, enm);
 2005         while (enm != NULL) {
 2006                 if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
 2007                     ETHER_ADDR_LEN) != 0) {
 2008                         ETHER_UNLOCK(ec);
 2009                         goto allmulti;
 2010                 }
 2011 
 2012                 hash = atw_calchash(enm->enm_addrlo);
 2013                 hashes[hash >> 5] |= 1 << (hash & 0x1f);
 2014                 ETHER_NEXT_MULTI(step, enm);
 2015                 sc->sc_opmode |= ATW_NAR_MM;
 2016         }
 2017         ETHER_UNLOCK(ec);
 2018         ifp->if_flags &= ~IFF_ALLMULTI;
 2019         goto setit;
 2020 
 2021 allmulti:
 2022         sc->sc_opmode |= ATW_NAR_MM;
 2023         ifp->if_flags |= IFF_ALLMULTI;
 2024         hashes[0] = hashes[1] = 0xffffffff;
 2025 
 2026 setit:
 2027         ATW_WRITE(sc, ATW_MAR0, hashes[0]);
 2028         ATW_WRITE(sc, ATW_MAR1, hashes[1]);
 2029         ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
 2030         DELAY(atw_nar_delay);
 2031         ATW_WRITE(sc, ATW_RDR, 0x1);
 2032 
 2033         DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", device_xname(sc->sc_dev),
 2034             ATW_READ(sc, ATW_NAR), sc->sc_opmode));
 2035 }
 2036 
 2037 /* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
 2038  * a beacon's BSSID and SSID against the preferred BSSID and SSID
 2039  * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
 2040  * no beacon with the preferred BSSID and SSID in the number of
 2041  * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
 2042  */
 2043 static void
 2044 atw_write_bssid(struct atw_softc *sc)
 2045 {
 2046         struct ieee80211com *ic = &sc->sc_ic;
 2047         uint8_t *bssid;
 2048 
 2049         bssid = ic->ic_bss->ni_bssid;
 2050 
 2051         ATW_WRITE(sc, ATW_BSSID0,
 2052             __SHIFTIN(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
 2053             __SHIFTIN(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
 2054             __SHIFTIN(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
 2055             __SHIFTIN(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
 2056 
 2057         ATW_WRITE(sc, ATW_ABDA1,
 2058             (ATW_READ(sc, ATW_ABDA1) &
 2059             ~(ATW_ABDA1_BSSIDB4_MASK | ATW_ABDA1_BSSIDB5_MASK)) |
 2060             __SHIFTIN(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
 2061             __SHIFTIN(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
 2062 
 2063         DPRINTF(sc, ("%s: BSSID %s -> ", device_xname(sc->sc_dev),
 2064             ether_sprintf(sc->sc_bssid)));
 2065         DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
 2066 
 2067         memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
 2068 }
 2069 
 2070 /* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
 2071  * 16-bit word.
 2072  */
 2073 static void
 2074 atw_write_sram(struct atw_softc *sc, u_int ofs, uint8_t *buf, u_int buflen)
 2075 {
 2076         u_int i;
 2077         uint8_t *ptr;
 2078 
 2079         memcpy(&sc->sc_sram[ofs], buf, buflen);
 2080 
 2081         KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
 2082 
 2083         KASSERT(buflen + ofs <= sc->sc_sramlen);
 2084 
 2085         ptr = &sc->sc_sram[ofs];
 2086 
 2087         for (i = 0; i < buflen; i += 2) {
 2088                 ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
 2089                     __SHIFTIN((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
 2090                 DELAY(atw_writewep_delay);
 2091 
 2092                 ATW_WRITE(sc, ATW_WESK,
 2093                     __SHIFTIN((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
 2094                 DELAY(atw_writewep_delay);
 2095         }
 2096         ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
 2097 
 2098         if (sc->sc_if.if_flags & IFF_DEBUG) {
 2099                 int n_octets = 0;
 2100                 printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
 2101                     device_xname(sc->sc_dev), buflen, ofs, sc->sc_wepctl);
 2102                 for (i = 0; i < buflen; i++) {
 2103                         printf(" %02x", ptr[i]);
 2104                         if (++n_octets % 24 == 0)
 2105                                 printf("\n");
 2106                 }
 2107                 if (n_octets % 24 != 0)
 2108                         printf("\n");
 2109         }
 2110 }
 2111 
 2112 static int
 2113 atw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
 2114 {
 2115         struct atw_softc *sc = ic->ic_ifp->if_softc;
 2116         u_int keyix = k->wk_keyix;
 2117 
 2118         DPRINTF(sc, ("%s: delete key %u\n", __func__, keyix));
 2119 
 2120         if (keyix >= IEEE80211_WEP_NKID)
 2121                 return 0;
 2122         if (k->wk_keylen != 0)
 2123                 sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
 2124 
 2125         return 1;
 2126 }
 2127 
 2128 static int
 2129 atw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
 2130         const uint8_t mac[IEEE80211_ADDR_LEN])
 2131 {
 2132         struct atw_softc *sc = ic->ic_ifp->if_softc;
 2133 
 2134         DPRINTF(sc, ("%s: set key %u\n", __func__, k->wk_keyix));
 2135 
 2136         if (k->wk_keyix >= IEEE80211_WEP_NKID)
 2137                 return 0;
 2138 
 2139         sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
 2140 
 2141         return 1;
 2142 }
 2143 
 2144 static void
 2145 atw_key_update_begin(struct ieee80211com *ic)
 2146 {
 2147 #ifdef ATW_DEBUG
 2148         struct ifnet *ifp = ic->ic_ifp;
 2149         struct atw_softc *sc = ifp->if_softc;
 2150 #endif
 2151 
 2152         DPRINTF(sc, ("%s:\n", __func__));
 2153 }
 2154 
 2155 static void
 2156 atw_key_update_end(struct ieee80211com *ic)
 2157 {
 2158         struct ifnet *ifp = ic->ic_ifp;
 2159         struct atw_softc *sc = ifp->if_softc;
 2160 
 2161         DPRINTF(sc, ("%s:\n", __func__));
 2162 
 2163         if ((sc->sc_flags & ATWF_WEP_SRAM_VALID) != 0)
 2164                 return;
 2165         if (!device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
 2166                 return;
 2167         atw_idle(sc, ATW_NAR_SR | ATW_NAR_ST);
 2168         atw_write_wep(sc);
 2169         ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
 2170         DELAY(atw_nar_delay);
 2171         ATW_WRITE(sc, ATW_RDR, 0x1);
 2172 }
 2173 
 2174 /* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
 2175 static void
 2176 atw_write_wep(struct atw_softc *sc)
 2177 {
 2178 #if 0
 2179         struct ieee80211com *ic = &sc->sc_ic;
 2180         uint32_t reg;
 2181         int i;
 2182 #endif
 2183         /* SRAM shared-key record format: key0 flags key1 ... key12 */
 2184         uint8_t buf[IEEE80211_WEP_NKID]
 2185                     [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
 2186 
 2187         sc->sc_wepctl = 0;
 2188         ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
 2189 
 2190         memset(&buf[0][0], 0, sizeof(buf));
 2191 
 2192 #if 0
 2193         for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 2194                 if (ic->ic_nw_keys[i].wk_keylen > 5) {
 2195                         buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
 2196                 } else if (ic->ic_nw_keys[i].wk_keylen != 0) {
 2197                         buf[i][1] = ATW_WEP_ENABLED;
 2198                 } else {
 2199                         buf[i][1] = 0;
 2200                         continue;
 2201                 }
 2202                 buf[i][0] = ic->ic_nw_keys[i].wk_key[0];
 2203                 memcpy(&buf[i][2], &ic->ic_nw_keys[i].wk_key[1],
 2204                     ic->ic_nw_keys[i].wk_keylen - 1);
 2205         }
 2206 
 2207         reg = ATW_READ(sc, ATW_MACTEST);
 2208         reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
 2209         reg &= ~ATW_MACTEST_KEYID_MASK;
 2210         reg |= __SHIFTIN(ic->ic_def_txkey, ATW_MACTEST_KEYID_MASK);
 2211         ATW_WRITE(sc, ATW_MACTEST, reg);
 2212 
 2213         if ((ic->ic_flags & IEEE80211_F_PRIVACY) != 0)
 2214                 sc->sc_wepctl |= ATW_WEPCTL_WEPENABLE;
 2215 
 2216         switch (sc->sc_rev) {
 2217         case ATW_REVISION_AB:
 2218         case ATW_REVISION_AF:
 2219                 /* Bypass WEP on Rx. */
 2220                 sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
 2221                 break;
 2222         default:
 2223                 break;
 2224         }
 2225 #endif
 2226 
 2227         atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (uint8_t*)&buf[0][0],
 2228             sizeof(buf));
 2229 
 2230         sc->sc_flags |= ATWF_WEP_SRAM_VALID;
 2231 }
 2232 
 2233 static void
 2234 atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
 2235     struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
 2236 {
 2237         struct atw_softc *sc = (struct atw_softc *)ic->ic_ifp->if_softc;
 2238 
 2239         /* The ADM8211A answers probe requests. TBD ADM8211B/C. */
 2240         if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_REQ)
 2241                 return;
 2242 
 2243         (*sc->sc_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
 2244 
 2245         switch (subtype) {
 2246         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 2247         case IEEE80211_FC0_SUBTYPE_BEACON:
 2248                 if (ic->ic_opmode == IEEE80211_M_IBSS &&
 2249                     ic->ic_state == IEEE80211_S_RUN) {
 2250                         if (le64toh(ni->ni_tstamp.tsf) >= atw_get_tsft(sc))
 2251                                 (void)ieee80211_ibss_merge(ni);
 2252                 }
 2253                 break;
 2254         default:
 2255                 break;
 2256         }
 2257         return;
 2258 }
 2259 
 2260 /* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
 2261  * In ad hoc mode, the SSID is written to the beacons sent by the
 2262  * ADM8211. In both ad hoc and infrastructure mode, beacons received
 2263  * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
 2264  * indications.
 2265  */
 2266 static void
 2267 atw_write_ssid(struct atw_softc *sc)
 2268 {
 2269         struct ieee80211com *ic = &sc->sc_ic;
 2270         /* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
 2271          * it only expects the element length, not its ID.
 2272          */
 2273         uint8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
 2274 
 2275         memset(buf, 0, sizeof(buf));
 2276         buf[0] = ic->ic_bss->ni_esslen;
 2277         memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
 2278 
 2279         atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
 2280             roundup(1 + ic->ic_bss->ni_esslen, 2));
 2281 }
 2282 
 2283 /* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
 2284  * In ad hoc mode, the supported rates are written to beacons sent by the
 2285  * ADM8211.
 2286  */
 2287 static void
 2288 atw_write_sup_rates(struct atw_softc *sc)
 2289 {
 2290         struct ieee80211com *ic = &sc->sc_ic;
 2291         /* 14 bytes are probably (XXX) reserved in the ADM8211 SRAM for
 2292          * supported rates
 2293          */
 2294         uint8_t buf[roundup(1 /* length */ + IEEE80211_RATE_SIZE, 2)];
 2295 
 2296         memset(buf, 0, sizeof(buf));
 2297 
 2298         buf[0] = ic->ic_bss->ni_rates.rs_nrates;
 2299 
 2300         memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates,
 2301             ic->ic_bss->ni_rates.rs_nrates);
 2302 
 2303         atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
 2304 }
 2305 
 2306 /* Start/stop sending beacons. */
 2307 void
 2308 atw_start_beacon(struct atw_softc *sc, int start)
 2309 {
 2310         struct ieee80211com *ic = &sc->sc_ic;
 2311         uint16_t chan;
 2312         uint32_t bcnt, bpli, cap0, cap1, capinfo;
 2313         size_t len;
 2314 
 2315         if (!device_is_active(sc->sc_dev))
 2316                 return;
 2317 
 2318         /* start beacons */
 2319         len = sizeof(struct ieee80211_frame) +
 2320             8 /* timestamp */ + 2 /* beacon interval */ +
 2321             2 /* capability info */ +
 2322             2 + ic->ic_bss->ni_esslen /* SSID element */ +
 2323             2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
 2324             3 /* DS parameters */ +
 2325             IEEE80211_CRC_LEN;
 2326 
 2327         bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
 2328         cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
 2329         cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
 2330 
 2331         ATW_WRITE(sc, ATW_BCNT, bcnt);
 2332         ATW_WRITE(sc, ATW_CAP1, cap1);
 2333 
 2334         if (!start)
 2335                 return;
 2336 
 2337         /* TBD use ni_capinfo */
 2338 
 2339         capinfo = 0;
 2340         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
 2341                 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
 2342         if (ic->ic_flags & IEEE80211_F_PRIVACY)
 2343                 capinfo |= IEEE80211_CAPINFO_PRIVACY;
 2344 
 2345         switch (ic->ic_opmode) {
 2346         case IEEE80211_M_IBSS:
 2347                 len += 4; /* IBSS parameters */
 2348                 capinfo |= IEEE80211_CAPINFO_IBSS;
 2349                 break;
 2350         case IEEE80211_M_HOSTAP:
 2351                 /* XXX 6-byte minimum TIM */
 2352                 len += atw_beacon_len_adjust;
 2353                 capinfo |= IEEE80211_CAPINFO_ESS;
 2354                 break;
 2355         default:
 2356                 return;
 2357         }
 2358 
 2359         /* set listen interval
 2360          * XXX do software units agree w/ hardware?
 2361          */
 2362         bpli = __SHIFTIN(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
 2363             __SHIFTIN(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
 2364 
 2365         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
 2366 
 2367         bcnt |= __SHIFTIN(len, ATW_BCNT_BCNT_MASK);
 2368         cap0 |= __SHIFTIN(chan, ATW_CAP0_CHN_MASK);
 2369         cap1 |= __SHIFTIN(capinfo, ATW_CAP1_CAPI_MASK);
 2370 
 2371         ATW_WRITE(sc, ATW_BCNT, bcnt);
 2372         ATW_WRITE(sc, ATW_BPLI, bpli);
 2373         ATW_WRITE(sc, ATW_CAP0, cap0);
 2374         ATW_WRITE(sc, ATW_CAP1, cap1);
 2375 
 2376         DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
 2377             device_xname(sc->sc_dev), bcnt));
 2378 
 2379         DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
 2380             device_xname(sc->sc_dev), cap1));
 2381 }
 2382 
 2383 /* Return the 32 lsb of the last TSFT divisible by ival. */
 2384 static inline uint32_t
 2385 atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
 2386 {
 2387         /* Following the reference driver's lead, I compute
 2388          *
 2389          *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
 2390          *
 2391          * without using 64-bit arithmetic, using the following
 2392          * relationship:
 2393          *
 2394          *     (0x100000000 * H + L) % m
 2395          *   = ((0x100000000 % m) * H + L) % m
 2396          *   = (((0xffffffff + 1) % m) * H + L) % m
 2397          *   = ((0xffffffff % m + 1 % m) * H + L) % m
 2398          *   = ((0xffffffff % m + 1) * H + L) % m
 2399          */
 2400         return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
 2401 }
 2402 
 2403 static uint64_t
 2404 atw_get_tsft(struct atw_softc *sc)
 2405 {
 2406         int i;
 2407         uint32_t tsfth, tsftl;
 2408         for (i = 0; i < 2; i++) {
 2409                 tsfth = ATW_READ(sc, ATW_TSFTH);
 2410                 tsftl = ATW_READ(sc, ATW_TSFTL);
 2411                 if (ATW_READ(sc, ATW_TSFTH) == tsfth)
 2412                         break;
 2413         }
 2414         return ((uint64_t)tsfth << 32) | tsftl;
 2415 }
 2416 
 2417 /* If we've created an IBSS, write the TSF time in the ADM8211 to
 2418  * the ieee80211com.
 2419  *
 2420  * Predict the next target beacon transmission time (TBTT) and
 2421  * write it to the ADM8211.
 2422  */
 2423 static void
 2424 atw_predict_beacon(struct atw_softc *sc)
 2425 {
 2426 #define TBTTOFS 20 /* TU */
 2427 
 2428         struct ieee80211com *ic = &sc->sc_ic;
 2429         uint64_t tsft;
 2430         uint32_t ival, past_even, tbtt, tsfth, tsftl;
 2431         union {
 2432                 uint64_t        word;
 2433                 uint8_t         tstamp[8];
 2434         } u;
 2435 
 2436         if ((ic->ic_opmode == IEEE80211_M_HOSTAP) ||
 2437             ((ic->ic_opmode == IEEE80211_M_IBSS) &&
 2438              (ic->ic_flags & IEEE80211_F_SIBSS))) {
 2439                 tsft = atw_get_tsft(sc);
 2440                 u.word = htole64(tsft);
 2441                 (void)memcpy(&ic->ic_bss->ni_tstamp, &u.tstamp[0],
 2442                     sizeof(ic->ic_bss->ni_tstamp));
 2443         } else
 2444                 tsft = le64toh(ic->ic_bss->ni_tstamp.tsf);
 2445 
 2446         ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
 2447 
 2448         tsftl = tsft & 0xFFFFFFFF;
 2449         tsfth = tsft >> 32;
 2450 
 2451         /* We sent/received the last beacon `past' microseconds
 2452          * after the interval divided the TSF timer.
 2453          */
 2454         past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
 2455 
 2456         /* Skip ten beacons so that the TBTT cannot pass before
 2457          * we've programmed it.  Ten is an arbitrary number.
 2458          */
 2459         tbtt = past_even + ival * 10;
 2460 
 2461         ATW_WRITE(sc, ATW_TOFS1,
 2462             __SHIFTIN(1, ATW_TOFS1_TSFTOFSR_MASK) |
 2463             __SHIFTIN(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
 2464             __SHIFTIN(__SHIFTOUT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
 2465                 ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
 2466 #undef TBTTOFS
 2467 }
 2468 
 2469 static void
 2470 atw_next_scan(void *arg)
 2471 {
 2472         struct atw_softc *sc = arg;
 2473         struct ieee80211com *ic = &sc->sc_ic;
 2474         int s;
 2475 
 2476         /* don't call atw_start w/o network interrupts blocked */
 2477         s = splnet();
 2478         if (ic->ic_state == IEEE80211_S_SCAN)
 2479                 ieee80211_next_scan(ic);
 2480         splx(s);
 2481 }
 2482 
 2483 /* Synchronize the hardware state with the software state. */
 2484 static int
 2485 atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 2486 {
 2487         struct ifnet *ifp = ic->ic_ifp;
 2488         struct atw_softc *sc = ifp->if_softc;
 2489         int error = 0;
 2490 
 2491         callout_stop(&sc->sc_scan_ch);
 2492 
 2493         switch (nstate) {
 2494         case IEEE80211_S_AUTH:
 2495         case IEEE80211_S_ASSOC:
 2496                 atw_write_bssid(sc);
 2497                 error = atw_tune(sc);
 2498                 break;
 2499         case IEEE80211_S_INIT:
 2500                 callout_stop(&sc->sc_scan_ch);
 2501                 sc->sc_cur_chan = IEEE80211_CHAN_ANY;
 2502                 atw_start_beacon(sc, 0);
 2503                 break;
 2504         case IEEE80211_S_SCAN:
 2505                 error = atw_tune(sc);
 2506                 callout_reset(&sc->sc_scan_ch, atw_dwelltime * hz / 1000,
 2507                     atw_next_scan, sc);
 2508                 break;
 2509         case IEEE80211_S_RUN:
 2510                 error = atw_tune(sc);
 2511                 atw_write_bssid(sc);
 2512                 atw_write_ssid(sc);
 2513                 atw_write_sup_rates(sc);
 2514 
 2515                 if (ic->ic_opmode == IEEE80211_M_AHDEMO ||
 2516                     ic->ic_opmode == IEEE80211_M_MONITOR)
 2517                         break;
 2518 
 2519                 /* set listen interval
 2520                  * XXX do software units agree w/ hardware?
 2521                  */
 2522                 ATW_WRITE(sc, ATW_BPLI,
 2523                     __SHIFTIN(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
 2524                     __SHIFTIN(ic->ic_lintval / ic->ic_bss->ni_intval,
 2525                            ATW_BPLI_LI_MASK));
 2526 
 2527                 DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n", device_xname(sc->sc_dev),
 2528                     ATW_READ(sc, ATW_BPLI)));
 2529 
 2530                 atw_predict_beacon(sc);
 2531 
 2532                 switch (ic->ic_opmode) {
 2533                 case IEEE80211_M_AHDEMO:
 2534                 case IEEE80211_M_HOSTAP:
 2535                 case IEEE80211_M_IBSS:
 2536                         atw_start_beacon(sc, 1);
 2537                         break;
 2538                 case IEEE80211_M_MONITOR:
 2539                 case IEEE80211_M_STA:
 2540                         break;
 2541                 }
 2542 
 2543                 break;
 2544         }
 2545         return (error != 0) ? error : (*sc->sc_newstate)(ic, nstate, arg);
 2546 }
 2547 
 2548 /*
 2549  * atw_add_rxbuf:
 2550  *
 2551  *      Add a receive buffer to the indicated descriptor.
 2552  */
 2553 int
 2554 atw_add_rxbuf(struct atw_softc *sc, int idx)
 2555 {
 2556         struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
 2557         struct mbuf *m;
 2558         int error;
 2559 
 2560         MGETHDR(m, M_DONTWAIT, MT_DATA);
 2561         if (m == NULL)
 2562                 return (ENOBUFS);
 2563 
 2564         MCLGET(m, M_DONTWAIT);
 2565         if ((m->m_flags & M_EXT) == 0) {
 2566                 m_freem(m);
 2567                 return (ENOBUFS);
 2568         }
 2569 
 2570         if (rxs->rxs_mbuf != NULL)
 2571                 bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
 2572 
 2573         rxs->rxs_mbuf = m;
 2574 
 2575         error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
 2576             m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
 2577             BUS_DMA_READ | BUS_DMA_NOWAIT);
 2578         if (error) {
 2579                 aprint_error_dev(sc->sc_dev, "can't load rx DMA map %d, error = %d\n",
 2580                     idx, error);
 2581                 panic("atw_add_rxbuf"); /* XXX */
 2582         }
 2583 
 2584         bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
 2585             rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
 2586 
 2587         atw_init_rxdesc(sc, idx);
 2588 
 2589         return (0);
 2590 }
 2591 
 2592 /*
 2593  * Release any queued transmit buffers.
 2594  */
 2595 void
 2596 atw_txdrain(struct atw_softc *sc)
 2597 {
 2598         struct atw_txsoft *txs;
 2599 
 2600         while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
 2601                 SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
 2602                 if (txs->txs_mbuf != NULL) {
 2603                         bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
 2604                         m_freem(txs->txs_mbuf);
 2605                         txs->txs_mbuf = NULL;
 2606                 }
 2607                 SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
 2608                 sc->sc_txfree += txs->txs_ndescs;
 2609         }
 2610 
 2611         KASSERT((sc->sc_if.if_flags & IFF_RUNNING) == 0 ||
 2612                 !(SIMPLEQ_EMPTY(&sc->sc_txfreeq) ||
 2613                   sc->sc_txfree != ATW_NTXDESC));
 2614         sc->sc_if.if_flags &= ~IFF_OACTIVE;
 2615         sc->sc_tx_timer = 0;
 2616 }
 2617 
 2618 /*
 2619  * atw_stop:            [ ifnet interface function ]
 2620  *
 2621  *      Stop transmission on the interface.
 2622  */
 2623 void
 2624 atw_stop(struct ifnet *ifp, int disable)
 2625 {
 2626         struct atw_softc *sc = ifp->if_softc;
 2627         struct ieee80211com *ic = &sc->sc_ic;
 2628 
 2629         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 2630 
 2631         if (device_is_active(sc->sc_dev)) {
 2632                 /* Disable interrupts. */
 2633                 ATW_WRITE(sc, ATW_IER, 0);
 2634 
 2635                 /* Stop the transmit and receive processes. */
 2636                 ATW_WRITE(sc, ATW_NAR, 0);
 2637                 DELAY(atw_nar_delay);
 2638                 ATW_WRITE(sc, ATW_TDBD, 0);
 2639                 ATW_WRITE(sc, ATW_TDBP, 0);
 2640                 ATW_WRITE(sc, ATW_RDB, 0);
 2641         }
 2642 
 2643         sc->sc_opmode = 0;
 2644 
 2645         atw_txdrain(sc);
 2646 
 2647         /*
 2648          * Mark the interface down and cancel the watchdog timer.
 2649          */
 2650         ifp->if_flags &= ~IFF_RUNNING;
 2651         ifp->if_timer = 0;
 2652 
 2653         if (disable)
 2654                 pmf_device_suspend(sc->sc_dev, &sc->sc_qual);
 2655 }
 2656 
 2657 /*
 2658  * atw_rxdrain:
 2659  *
 2660  *      Drain the receive queue.
 2661  */
 2662 void
 2663 atw_rxdrain(struct atw_softc *sc)
 2664 {
 2665         struct atw_rxsoft *rxs;
 2666         int i;
 2667 
 2668         for (i = 0; i < ATW_NRXDESC; i++) {
 2669                 rxs = &sc->sc_rxsoft[i];
 2670                 if (rxs->rxs_mbuf == NULL)
 2671                         continue;
 2672                 bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
 2673                 m_freem(rxs->rxs_mbuf);
 2674                 rxs->rxs_mbuf = NULL;
 2675         }
 2676 }
 2677 
 2678 /*
 2679  * atw_detach:
 2680  *
 2681  *      Detach an ADM8211 interface.
 2682  */
 2683 int
 2684 atw_detach(struct atw_softc *sc)
 2685 {
 2686         struct ifnet *ifp = &sc->sc_if;
 2687         struct atw_rxsoft *rxs;
 2688         struct atw_txsoft *txs;
 2689         int i;
 2690 
 2691         /*
 2692          * Succeed now if there isn't any work to do.
 2693          */
 2694         if ((sc->sc_flags & ATWF_ATTACHED) == 0)
 2695                 return (0);
 2696 
 2697         pmf_device_deregister(sc->sc_dev);
 2698 
 2699         callout_stop(&sc->sc_scan_ch);
 2700 
 2701         ieee80211_ifdetach(&sc->sc_ic);
 2702         if_detach(ifp);
 2703 
 2704         for (i = 0; i < ATW_NRXDESC; i++) {
 2705                 rxs = &sc->sc_rxsoft[i];
 2706                 if (rxs->rxs_mbuf != NULL) {
 2707                         bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
 2708                         m_freem(rxs->rxs_mbuf);
 2709                         rxs->rxs_mbuf = NULL;
 2710                 }
 2711                 bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
 2712         }
 2713         for (i = 0; i < ATW_TXQUEUELEN; i++) {
 2714                 txs = &sc->sc_txsoft[i];
 2715                 if (txs->txs_mbuf != NULL) {
 2716                         bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
 2717                         m_freem(txs->txs_mbuf);
 2718                         txs->txs_mbuf = NULL;
 2719                 }
 2720                 bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
 2721         }
 2722         bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
 2723         bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
 2724         bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_control_data,
 2725             sizeof(struct atw_control_data));
 2726         bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
 2727 
 2728         if (sc->sc_srom)
 2729                 free(sc->sc_srom, M_DEVBUF);
 2730 
 2731         atw_evcnt_detach(sc);
 2732 
 2733         if (sc->sc_soft_ih != NULL) {
 2734                 softint_disestablish(sc->sc_soft_ih);
 2735                 sc->sc_soft_ih = NULL;
 2736         }
 2737 
 2738         return (0);
 2739 }
 2740 
 2741 /* atw_shutdown: make sure the interface is stopped at reboot time. */
 2742 bool
 2743 atw_shutdown(device_t self, int flags)
 2744 {
 2745         struct atw_softc *sc = device_private(self);
 2746 
 2747         atw_stop(&sc->sc_if, 1);
 2748         return true;
 2749 }
 2750 
 2751 #if 0
 2752 static void
 2753 atw_workaround1(struct atw_softc *sc)
 2754 {
 2755         uint32_t test1;
 2756 
 2757         test1 = ATW_READ(sc, ATW_TEST1);
 2758 
 2759         sc->sc_misc_ev.ev_count++;
 2760 
 2761         if ((test1 & ATW_TEST1_RXPKT1IN) != 0) {
 2762                 sc->sc_rxpkt1in_ev.ev_count++;
 2763                 return;
 2764         }
 2765         if (__SHIFTOUT(test1, ATW_TEST1_RRA_MASK) ==
 2766             __SHIFTOUT(test1, ATW_TEST1_RWA_MASK)) {
 2767                 sc->sc_rxamatch_ev.ev_count++;
 2768                 return;
 2769         }
 2770         sc->sc_workaround1_ev.ev_count++;
 2771         (void)atw_init(&sc->sc_if);
 2772 }
 2773 #endif
 2774 
 2775 int
 2776 atw_intr(void *arg)
 2777 {
 2778         struct atw_softc *sc = arg;
 2779         struct ifnet *ifp = &sc->sc_if;
 2780         uint32_t status;
 2781 
 2782 #ifdef DEBUG
 2783         if (!device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
 2784                 panic("%s: atw_intr: not enabled", device_xname(sc->sc_dev));
 2785 #endif
 2786 
 2787         /*
 2788          * If the interface isn't running, the interrupt couldn't
 2789          * possibly have come from us.
 2790          */
 2791         if ((ifp->if_flags & IFF_RUNNING) == 0 ||
 2792             !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
 2793                 return (0);
 2794 
 2795         status = ATW_READ(sc, ATW_STSR);
 2796         if (status == 0)
 2797                 return 0;
 2798 
 2799         if ((status & sc->sc_inten) == 0) {
 2800                 ATW_WRITE(sc, ATW_STSR, status);
 2801                 return 0;
 2802         }
 2803 
 2804         /* Disable interrupts */
 2805         ATW_WRITE(sc, ATW_IER, 0);
 2806 
 2807         softint_schedule(sc->sc_soft_ih);
 2808         return 1;
 2809 }
 2810 
 2811 void
 2812 atw_softintr(void *arg)
 2813 {
 2814         struct atw_softc *sc = arg;
 2815         struct ifnet *ifp = &sc->sc_if;
 2816         uint32_t status, rxstatus, txstatus, linkstatus;
 2817         int txthresh, s;
 2818 
 2819         if ((ifp->if_flags & IFF_RUNNING) == 0 ||
 2820             !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
 2821                 return;
 2822 
 2823         for (;;) {
 2824                 status = ATW_READ(sc, ATW_STSR);
 2825 
 2826                 if (status)
 2827                         ATW_WRITE(sc, ATW_STSR, status);
 2828 
 2829 #ifdef ATW_DEBUG
 2830 #define PRINTINTR(flag) do { \
 2831         if ((status & flag) != 0) { \
 2832                 printf("%s" #flag, delim); \
 2833                 delim = ","; \
 2834         } \
 2835 } while (0)
 2836 
 2837                 if (atw_debug > 1 && status) {
 2838                         const char *delim = "<";
 2839 
 2840                         printf("%s: reg[STSR] = %x",
 2841                             device_xname(sc->sc_dev), status);
 2842 
 2843                         PRINTINTR(ATW_INTR_FBE);
 2844                         PRINTINTR(ATW_INTR_LINKOFF);
 2845                         PRINTINTR(ATW_INTR_LINKON);
 2846                         PRINTINTR(ATW_INTR_RCI);
 2847                         PRINTINTR(ATW_INTR_RDU);
 2848                         PRINTINTR(ATW_INTR_REIS);
 2849                         PRINTINTR(ATW_INTR_RPS);
 2850                         PRINTINTR(ATW_INTR_TCI);
 2851                         PRINTINTR(ATW_INTR_TDU);
 2852                         PRINTINTR(ATW_INTR_TLT);
 2853                         PRINTINTR(ATW_INTR_TPS);
 2854                         PRINTINTR(ATW_INTR_TRT);
 2855                         PRINTINTR(ATW_INTR_TUF);
 2856                         PRINTINTR(ATW_INTR_BCNTC);
 2857                         PRINTINTR(ATW_INTR_ATIME);
 2858                         PRINTINTR(ATW_INTR_TBTT);
 2859                         PRINTINTR(ATW_INTR_TSCZ);
 2860                         PRINTINTR(ATW_INTR_TSFTF);
 2861                         printf(">\n");
 2862                 }
 2863 #undef PRINTINTR
 2864 #endif /* ATW_DEBUG */
 2865 
 2866                 if ((status & sc->sc_inten) == 0)
 2867                         break;
 2868 
 2869                 rxstatus = status & sc->sc_rxint_mask;
 2870                 txstatus = status & sc->sc_txint_mask;
 2871                 linkstatus = status & sc->sc_linkint_mask;
 2872 
 2873                 if (linkstatus) {
 2874                         atw_linkintr(sc, linkstatus);
 2875                 }
 2876 
 2877                 if (rxstatus) {
 2878                         /* Grab any new packets. */
 2879                         atw_rxintr(sc);
 2880 
 2881                         if (rxstatus & ATW_INTR_RDU) {
 2882                                 printf("%s: receive ring overrun\n",
 2883                                     device_xname(sc->sc_dev));
 2884                                 /* Get the receive process going again. */
 2885                                 ATW_WRITE(sc, ATW_RDR, 0x1);
 2886                         }
 2887                 }
 2888 
 2889                 if (txstatus) {
 2890                         /* Sweep up transmit descriptors. */
 2891                         atw_txintr(sc, txstatus);
 2892 
 2893                         if (txstatus & ATW_INTR_TLT) {
 2894                                 DPRINTF(sc, ("%s: tx lifetime exceeded\n",
 2895                                     device_xname(sc->sc_dev)));
 2896                                 (void)atw_init(&sc->sc_if);
 2897                         }
 2898 
 2899                         if (txstatus & ATW_INTR_TRT) {
 2900                                 DPRINTF(sc, ("%s: tx retry limit exceeded\n",
 2901                                     device_xname(sc->sc_dev)));
 2902                         }
 2903 
 2904                         /* If Tx under-run, increase our transmit threshold
 2905                          * if another is available.
 2906                          */
 2907                         txthresh = sc->sc_txthresh + 1;
 2908                         if ((txstatus & ATW_INTR_TUF) &&
 2909                             sc->sc_txth[txthresh].txth_name != NULL) {
 2910                                 /* Idle the transmit process. */
 2911                                 atw_idle(sc, ATW_NAR_ST);
 2912 
 2913                                 sc->sc_txthresh = txthresh;
 2914                                 sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
 2915                                 sc->sc_opmode |=
 2916                                     sc->sc_txth[txthresh].txth_opmode;
 2917                                 printf("%s: transmit underrun; new "
 2918                                     "threshold: %s\n", device_xname(sc->sc_dev),
 2919                                     sc->sc_txth[txthresh].txth_name);
 2920 
 2921                                 /* Set the new threshold and restart
 2922                                  * the transmit process.
 2923                                  */
 2924                                 ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
 2925                                 DELAY(atw_nar_delay);
 2926                                 ATW_WRITE(sc, ATW_TDR, 0x1);
 2927                                 /* XXX Log every Nth underrun from
 2928                                  * XXX now on?
 2929                                  */
 2930                         }
 2931                 }
 2932 
 2933                 if (status & (ATW_INTR_TPS | ATW_INTR_RPS)) {
 2934                         if (status & ATW_INTR_TPS)
 2935                                 printf("%s: transmit process stopped\n",
 2936                                     device_xname(sc->sc_dev));
 2937                         if (status & ATW_INTR_RPS)
 2938                                 printf("%s: receive process stopped\n",
 2939                                     device_xname(sc->sc_dev));
 2940                         s = splnet();
 2941                         (void)atw_init(ifp);
 2942                         splx(s);
 2943                         break;
 2944                 }
 2945 
 2946                 if (status & ATW_INTR_FBE) {
 2947                         aprint_error_dev(sc->sc_dev, "fatal bus error\n");
 2948                         s = splnet();
 2949                         (void)atw_init(ifp);
 2950                         splx(s);
 2951                         break;
 2952                 }
 2953 
 2954                 /*
 2955                  * Not handled:
 2956                  *
 2957                  *      Transmit buffer unavailable -- normal
 2958                  *      condition, nothing to do, really.
 2959                  *
 2960                  *      Early receive interrupt -- not available on
 2961                  *      all chips, we just use RI.  We also only
 2962                  *      use single-segment receive DMA, so this
 2963                  *      is mostly useless.
 2964                  *
 2965                  *      TBD others
 2966                  */
 2967         }
 2968 
 2969         /* Try to get more packets going. */
 2970         s = splnet();
 2971         atw_start(ifp);
 2972         splx(s);
 2973 
 2974         /* Enable interrupts */
 2975         ATW_WRITE(sc, ATW_IER, sc->sc_inten);
 2976 }
 2977 
 2978 /*
 2979  * atw_idle:
 2980  *
 2981  *      Cause the transmit and/or receive processes to go idle.
 2982  *
 2983  *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
 2984  *      process in STSR if I clear SR or ST after the process has already
 2985  *      ceased. Fair enough. But the Rx process status bits in ATW_TEST0
 2986  *      do not seem to be too reliable. Perhaps I have the sense of the
 2987  *      Rx bits switched with the Tx bits?
 2988  */
 2989 void
 2990 atw_idle(struct atw_softc *sc, uint32_t bits)
 2991 {
 2992         uint32_t ackmask = 0, opmode, stsr, test0;
 2993         int i, s;
 2994 
 2995         s = splnet();
 2996 
 2997         opmode = sc->sc_opmode & ~bits;
 2998 
 2999         if (bits & ATW_NAR_SR)
 3000                 ackmask |= ATW_INTR_RPS;
 3001 
 3002         if (bits & ATW_NAR_ST) {
 3003                 ackmask |= ATW_INTR_TPS;
 3004                 /* set ATW_NAR_HF to flush TX FIFO. */
 3005                 opmode |= ATW_NAR_HF;
 3006         }
 3007 
 3008         ATW_WRITE(sc, ATW_NAR, opmode);
 3009         DELAY(atw_nar_delay);
 3010 
 3011         for (i = 0; i < 1000; i++) {
 3012                 stsr = ATW_READ(sc, ATW_STSR);
 3013                 if ((stsr & ackmask) == ackmask)
 3014                         break;
 3015                 DELAY(10);
 3016         }
 3017 
 3018         ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
 3019 
 3020         if ((stsr & ackmask) == ackmask)
 3021                 goto out;
 3022 
 3023         test0 = ATW_READ(sc, ATW_TEST0);
 3024 
 3025         if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
 3026             (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
 3027                 printf("%s: transmit process not idle [%s]\n",
 3028                     device_xname(sc->sc_dev),
 3029                     atw_tx_state[__SHIFTOUT(test0, ATW_TEST0_TS_MASK)]);
 3030                 printf("%s: bits %08x test0 %08x stsr %08x\n",
 3031                     device_xname(sc->sc_dev), bits, test0, stsr);
 3032         }
 3033 
 3034         if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
 3035             (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
 3036                 DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
 3037                     device_xname(sc->sc_dev),
 3038                     atw_rx_state[__SHIFTOUT(test0, ATW_TEST0_RS_MASK)]));
 3039                 DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
 3040                     device_xname(sc->sc_dev), bits, test0, stsr));
 3041         }
 3042 out:
 3043         if ((bits & ATW_NAR_ST) != 0)
 3044                 atw_txdrain(sc);
 3045         splx(s);
 3046         return;
 3047 }
 3048 
 3049 /*
 3050  * atw_linkintr:
 3051  *
 3052  *      Helper; handle link-status interrupts.
 3053  */
 3054 void
 3055 atw_linkintr(struct atw_softc *sc, uint32_t linkstatus)
 3056 {
 3057         struct ieee80211com *ic = &sc->sc_ic;
 3058 
 3059         if (ic->ic_state != IEEE80211_S_RUN)
 3060                 return;
 3061 
 3062         if (linkstatus & ATW_INTR_LINKON) {
 3063                 DPRINTF(sc, ("%s: link on\n", device_xname(sc->sc_dev)));
 3064                 sc->sc_rescan_timer = 0;
 3065         } else if (linkstatus & ATW_INTR_LINKOFF) {
 3066                 DPRINTF(sc, ("%s: link off\n", device_xname(sc->sc_dev)));
 3067                 if (ic->ic_opmode != IEEE80211_M_STA)
 3068                         return;
 3069                 sc->sc_rescan_timer = 3;
 3070                 sc->sc_if.if_timer = 1;
 3071         }
 3072 }
 3073 
 3074 #if 0
 3075 static inline int
 3076 atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame_min *wh)
 3077 {
 3078         if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
 3079                 return 0;
 3080         if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
 3081                 return 0;
 3082         return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
 3083 }
 3084 #endif
 3085 
 3086 /*
 3087  * atw_rxintr:
 3088  *
 3089  *      Helper; handle receive interrupts.
 3090  */
 3091 void
 3092 atw_rxintr(struct atw_softc *sc)
 3093 {
 3094         static int rate_tbl[] = {2, 4, 11, 22, 44};
 3095         struct ieee80211com *ic = &sc->sc_ic;
 3096         struct ieee80211_node *ni;
 3097         struct ieee80211_frame_min *wh;
 3098         struct ifnet *ifp = &sc->sc_if;
 3099         struct atw_rxsoft *rxs;
 3100         struct mbuf *m;
 3101         uint32_t rxstat;
 3102         int i, s, len, rate, rate0;
 3103         uint32_t rssi, ctlrssi;
 3104 
 3105         for (i = sc->sc_rxptr;; i = sc->sc_rxptr) {
 3106                 rxs = &sc->sc_rxsoft[i];
 3107 
 3108                 ATW_CDRXSYNC(sc, i,
 3109                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 3110 
 3111                 rxstat = le32toh(sc->sc_rxdescs[i].ar_stat);
 3112                 ctlrssi = le32toh(sc->sc_rxdescs[i].ar_ctlrssi);
 3113                 rate0 = __SHIFTOUT(rxstat, ATW_RXSTAT_RXDR_MASK);
 3114 
 3115                 if (rxstat & ATW_RXSTAT_OWN) {
 3116                         ATW_CDRXSYNC(sc, i, BUS_DMASYNC_PREREAD);
 3117                         break;
 3118                 }
 3119 
 3120                 sc->sc_rxptr = ATW_NEXTRX(i);
 3121 
 3122                 DPRINTF3(sc,
 3123                     ("%s: rx stat %08x ctlrssi %08x buf1 %08x buf2 %08x\n",
 3124                     device_xname(sc->sc_dev),
 3125                     rxstat, ctlrssi,
 3126                     le32toh(sc->sc_rxdescs[i].ar_buf1),
 3127                     le32toh(sc->sc_rxdescs[i].ar_buf2)));
 3128 
 3129                 /*
 3130                  * Make sure the packet fits in one buffer.  This should
 3131                  * always be the case.
 3132                  */
 3133                 if ((rxstat & (ATW_RXSTAT_FS | ATW_RXSTAT_LS)) !=
 3134                     (ATW_RXSTAT_FS | ATW_RXSTAT_LS)) {
 3135                         printf("%s: incoming packet spilled, resetting\n",
 3136                             device_xname(sc->sc_dev));
 3137                         (void)atw_init(ifp);
 3138                         return;
 3139                 }
 3140 
 3141                 /*
 3142                  * If an error occurred, update stats, clear the status
 3143                  * word, and leave the packet buffer in place.  It will
 3144                  * simply be reused the next time the ring comes around.
 3145                  */
 3146                 if ((rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_RXTOE)) != 0) {
 3147 #define PRINTERR(bit, str)                                              \
 3148                         if (rxstat & (bit))                             \
 3149                                 aprint_error_dev(sc->sc_dev, "receive error: %s\n",     \
 3150                                     str)
 3151                         if_statinc(ifp, if_ierrors);
 3152                         PRINTERR(ATW_RXSTAT_DE, "descriptor error");
 3153                         PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
 3154 #if 0
 3155                         PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
 3156                         PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
 3157                         PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
 3158                         PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
 3159 #endif
 3160 #undef PRINTERR
 3161                         atw_init_rxdesc(sc, i);
 3162                         continue;
 3163                 }
 3164 
 3165                 bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
 3166                     rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
 3167 
 3168                 /*
 3169                  * No errors; receive the packet.  Note the ADM8211
 3170                  * includes the CRC in promiscuous mode.
 3171                  */
 3172                 len = __SHIFTOUT(rxstat, ATW_RXSTAT_FL_MASK);
 3173 
 3174                 /*
 3175                  * Allocate a new mbuf cluster.  If that fails, we are
 3176                  * out of memory, and must drop the packet and recycle
 3177                  * the buffer that's already attached to this descriptor.
 3178                  */
 3179                 m = rxs->rxs_mbuf;
 3180                 if (atw_add_rxbuf(sc, i) != 0) {
 3181                         if_statinc(ifp, if_ierrors);
 3182                         bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
 3183                             rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
 3184                         atw_init_rxdesc(sc, i);
 3185                         continue;
 3186                 }
 3187 
 3188                 if_statinc(ifp, if_ipackets);
 3189                 m_set_rcvif(m, ifp);
 3190                 m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
 3191 
 3192                 rate = (rate0 < __arraycount(rate_tbl)) ? rate_tbl[rate0] : 0;
 3193 
 3194                 /* The RSSI comes straight from a register in the
 3195                  * baseband processor.  I know that for the RF3000,
 3196                  * the RSSI register also contains the antenna-selection
 3197                  * bits.  Mask those off.
 3198                  *
 3199                  * TBD Treat other basebands.
 3200                  * TBD Use short-preamble bit and such in RF3000_RXSTAT.
 3201                  */
 3202                 if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
 3203                         rssi = ctlrssi & RF3000_RSSI_MASK;
 3204                 else
 3205                         rssi = ctlrssi;
 3206 
 3207                 s = splnet();
 3208 
 3209                 /* Pass this up to any BPF listeners. */
 3210                 if (sc->sc_radiobpf != NULL) {
 3211                         struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
 3212 
 3213                         tap->ar_rate = rate;
 3214 
 3215                         /* TBD verify units are dB */
 3216                         tap->ar_antsignal = (int)rssi;
 3217                         if (sc->sc_opmode & ATW_NAR_PR)
 3218                                 tap->ar_flags = IEEE80211_RADIOTAP_F_FCS;
 3219                         else
 3220                                 tap->ar_flags = 0;
 3221 
 3222                         if ((rxstat & ATW_RXSTAT_CRC32E) != 0)
 3223                                 tap->ar_flags |= IEEE80211_RADIOTAP_F_BADFCS;
 3224 
 3225                         bpf_mtap2(sc->sc_radiobpf, tap, sizeof(sc->sc_rxtapu),
 3226                             m, BPF_D_IN);
 3227                 }
 3228 
 3229                 sc->sc_recv_ev.ev_count++;
 3230 
 3231                 if ((rxstat & (ATW_RXSTAT_CRC16E | ATW_RXSTAT_CRC32E |
 3232                     ATW_RXSTAT_ICVE | ATW_RXSTAT_SFDE | ATW_RXSTAT_SIGE))
 3233                     != 0) {
 3234                         if (rxstat & ATW_RXSTAT_CRC16E)
 3235                                 sc->sc_crc16e_ev.ev_count++;
 3236                         if (rxstat & ATW_RXSTAT_CRC32E)
 3237                                 sc->sc_crc32e_ev.ev_count++;
 3238                         if (rxstat & ATW_RXSTAT_ICVE)
 3239                                 sc->sc_icve_ev.ev_count++;
 3240                         if (rxstat & ATW_RXSTAT_SFDE)
 3241                                 sc->sc_sfde_ev.ev_count++;
 3242                         if (rxstat & ATW_RXSTAT_SIGE)
 3243                                 sc->sc_sige_ev.ev_count++;
 3244                         if_statinc(ifp, if_ierrors);
 3245                         m_freem(m);
 3246                         splx(s);
 3247                         continue;
 3248                 }
 3249 
 3250                 if (sc->sc_opmode & ATW_NAR_PR)
 3251                         m_adj(m, -IEEE80211_CRC_LEN);
 3252 
 3253                 wh = mtod(m, struct ieee80211_frame_min *);
 3254                 ni = ieee80211_find_rxnode(ic, wh);
 3255 #if 0
 3256                 if (atw_hw_decrypted(sc, wh)) {
 3257                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
 3258                         DPRINTF(sc, ("%s: hw decrypted\n", __func__));
 3259                 }
 3260 #endif
 3261                 ieee80211_input(ic, m, ni, (int)rssi, 0);
 3262                 ieee80211_free_node(ni);
 3263                 splx(s);
 3264         }
 3265 }
 3266 
 3267 /*
 3268  * atw_txintr:
 3269  *
 3270  *      Helper; handle transmit interrupts.
 3271  */
 3272 void
 3273 atw_txintr(struct atw_softc *sc, uint32_t status)
 3274 {
 3275         static char txstat_buf[sizeof("ffffffff<>" ATW_TXSTAT_FMT)];
 3276         struct ifnet *ifp = &sc->sc_if;
 3277         struct atw_txsoft *txs;
 3278         uint32_t txstat;
 3279         int s;
 3280 
 3281         DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
 3282             device_xname(sc->sc_dev), sc->sc_flags));
 3283 
 3284         s = splnet();
 3285 
 3286         /*
 3287          * Go through our Tx list and free mbufs for those
 3288          * frames that have been transmitted.
 3289          */
 3290         while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
 3291                 ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
 3292                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 3293 
 3294 #ifdef ATW_DEBUG
 3295                 if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
 3296                         int i;
 3297                         printf("    txsoft %p transmit chain:\n", txs);
 3298                         ATW_CDTXSYNC(sc, txs->txs_firstdesc,
 3299                             txs->txs_ndescs - 1,
 3300                             BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 3301                         for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
 3302                                 printf("     descriptor %d:\n", i);
 3303                                 printf("       at_status:   0x%08x\n",
 3304                                     le32toh(sc->sc_txdescs[i].at_stat));
 3305                                 printf("       at_flags:      0x%08x\n",
 3306                                     le32toh(sc->sc_txdescs[i].at_flags));
 3307                                 printf("       at_buf1: 0x%08x\n",
 3308                                     le32toh(sc->sc_txdescs[i].at_buf1));
 3309                                 printf("       at_buf2: 0x%08x\n",
 3310                                     le32toh(sc->sc_txdescs[i].at_buf2));
 3311                                 if (i == txs->txs_lastdesc)
 3312                                         break;
 3313                         }
 3314                         ATW_CDTXSYNC(sc, txs->txs_firstdesc,
 3315                             txs->txs_ndescs - 1, BUS_DMASYNC_PREREAD);
 3316                 }
 3317 #endif
 3318 
 3319                 txstat = le32toh(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
 3320                 if (txstat & ATW_TXSTAT_OWN) {
 3321                         ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
 3322                             BUS_DMASYNC_PREREAD);
 3323                         break;
 3324                 }
 3325 
 3326                 SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
 3327 
 3328                 bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
 3329                     0, txs->txs_dmamap->dm_mapsize,
 3330                     BUS_DMASYNC_POSTWRITE);
 3331                 bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
 3332                 m_freem(txs->txs_mbuf);
 3333                 txs->txs_mbuf = NULL;
 3334 
 3335                 sc->sc_txfree += txs->txs_ndescs;
 3336                 SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
 3337 
 3338                 KASSERT(!SIMPLEQ_EMPTY(&sc->sc_txfreeq) && sc->sc_txfree != 0);
 3339                 sc->sc_tx_timer = 0;
 3340                 ifp->if_flags &= ~IFF_OACTIVE;
 3341 
 3342                 if ((ifp->if_flags & IFF_DEBUG) != 0 &&
 3343                     (txstat & ATW_TXSTAT_ERRMASK) != 0) {
 3344                         snprintb(txstat_buf, sizeof(txstat_buf),
 3345                             ATW_TXSTAT_FMT, txstat & ATW_TXSTAT_ERRMASK);
 3346                         printf("%s: txstat %s %" __PRIuBITS "\n",
 3347                             device_xname(sc->sc_dev), txstat_buf,
 3348                             __SHIFTOUT(txstat, ATW_TXSTAT_ARC_MASK));
 3349                 }
 3350 
 3351                 sc->sc_xmit_ev.ev_count++;
 3352 
 3353                 /*
 3354                  * Check for errors and collisions.
 3355                  */
 3356                 if (txstat & ATW_TXSTAT_TUF)
 3357                         sc->sc_tuf_ev.ev_count++;
 3358                 if (txstat & ATW_TXSTAT_TLT)
 3359                         sc->sc_tlt_ev.ev_count++;
 3360                 if (txstat & ATW_TXSTAT_TRT)
 3361                         sc->sc_trt_ev.ev_count++;
 3362                 if (txstat & ATW_TXSTAT_TRO)
 3363                         sc->sc_tro_ev.ev_count++;
 3364                 if (txstat & ATW_TXSTAT_SOFBR)
 3365                         sc->sc_sofbr_ev.ev_count++;
 3366 
 3367                 if ((txstat & ATW_TXSTAT_ES) == 0)
 3368                         if_statadd(ifp, if_collisions,
 3369                             __SHIFTOUT(txstat, ATW_TXSTAT_ARC_MASK));
 3370                 else
 3371                         if_statinc(ifp, if_oerrors);
 3372 
 3373                 if_statinc(ifp, if_opackets);
 3374         }
 3375 
 3376         KASSERT(txs != NULL || (ifp->if_flags & IFF_OACTIVE) == 0);
 3377 
 3378         splx(s);
 3379 }
 3380 
 3381 /*
 3382  * atw_watchdog:        [ifnet interface function]
 3383  *
 3384  *      Watchdog timer handler.
 3385  */
 3386 void
 3387 atw_watchdog(struct ifnet *ifp)
 3388 {
 3389         struct atw_softc *sc = ifp->if_softc;
 3390         struct ieee80211com *ic = &sc->sc_ic;
 3391 
 3392         ifp->if_timer = 0;
 3393         if (!device_is_active(sc->sc_dev))
 3394                 return;
 3395 
 3396         if (sc->sc_rescan_timer != 0 && --sc->sc_rescan_timer == 0)
 3397                 (void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 3398         if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0 &&
 3399             !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
 3400                 printf("%s: transmit timeout\n", ifp->if_xname);
 3401                 if_statinc(ifp, if_oerrors);
 3402                 (void)atw_init(ifp);
 3403                 atw_start(ifp);
 3404         }
 3405         if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
 3406                 ifp->if_timer = 1;
 3407         ieee80211_watchdog(ic);
 3408 }
 3409 
 3410 static void
 3411 atw_evcnt_detach(struct atw_softc *sc)
 3412 {
 3413         evcnt_detach(&sc->sc_sige_ev);
 3414         evcnt_detach(&sc->sc_sfde_ev);
 3415         evcnt_detach(&sc->sc_icve_ev);
 3416         evcnt_detach(&sc->sc_crc32e_ev);
 3417         evcnt_detach(&sc->sc_crc16e_ev);
 3418         evcnt_detach(&sc->sc_recv_ev);
 3419 
 3420         evcnt_detach(&sc->sc_tuf_ev);
 3421         evcnt_detach(&sc->sc_tro_ev);
 3422         evcnt_detach(&sc->sc_trt_ev);
 3423         evcnt_detach(&sc->sc_tlt_ev);
 3424         evcnt_detach(&sc->sc_sofbr_ev);
 3425         evcnt_detach(&sc->sc_xmit_ev);
 3426 
 3427         evcnt_detach(&sc->sc_rxpkt1in_ev);
 3428         evcnt_detach(&sc->sc_rxamatch_ev);
 3429         evcnt_detach(&sc->sc_workaround1_ev);
 3430         evcnt_detach(&sc->sc_misc_ev);
 3431 }
 3432 
 3433 static void
 3434 atw_evcnt_attach(struct atw_softc *sc)
 3435 {
 3436         evcnt_attach_dynamic(&sc->sc_recv_ev, EVCNT_TYPE_MISC,
 3437             NULL, sc->sc_if.if_xname, "recv");
 3438         evcnt_attach_dynamic(&sc->sc_crc16e_ev, EVCNT_TYPE_MISC,
 3439             &sc->sc_recv_ev, sc->sc_if.if_xname, "CRC16 error");
 3440         evcnt_attach_dynamic(&sc->sc_crc32e_ev, EVCNT_TYPE_MISC,
 3441             &sc->sc_recv_ev, sc->sc_if.if_xname, "CRC32 error");
 3442         evcnt_attach_dynamic(&sc->sc_icve_ev, EVCNT_TYPE_MISC,
 3443             &sc->sc_recv_ev, sc->sc_if.if_xname, "ICV error");
 3444         evcnt_attach_dynamic(&sc->sc_sfde_ev, EVCNT_TYPE_MISC,
 3445             &sc->sc_recv_ev, sc->sc_if.if_xname, "PLCP SFD error");
 3446         evcnt_attach_dynamic(&sc->sc_sige_ev, EVCNT_TYPE_MISC,
 3447             &sc->sc_recv_ev, sc->sc_if.if_xname, "PLCP Signal Field error");
 3448 
 3449         evcnt_attach_dynamic(&sc->sc_xmit_ev, EVCNT_TYPE_MISC,
 3450             NULL, sc->sc_if.if_xname, "xmit");
 3451         evcnt_attach_dynamic(&sc->sc_tuf_ev, EVCNT_TYPE_MISC,
 3452             &sc->sc_xmit_ev, sc->sc_if.if_xname, "transmit underflow");
 3453         evcnt_attach_dynamic(&sc->sc_tro_ev, EVCNT_TYPE_MISC,
 3454             &sc->sc_xmit_ev, sc->sc_if.if_xname, "transmit overrun");
 3455         evcnt_attach_dynamic(&sc->sc_trt_ev, EVCNT_TYPE_MISC,
 3456             &sc->sc_xmit_ev, sc->sc_if.if_xname, "retry count exceeded");
 3457         evcnt_attach_dynamic(&sc->sc_tlt_ev, EVCNT_TYPE_MISC,
 3458             &sc->sc_xmit_ev, sc->sc_if.if_xname, "lifetime exceeded");
 3459         evcnt_attach_dynamic(&sc->sc_sofbr_ev, EVCNT_TYPE_MISC,
 3460             &sc->sc_xmit_ev, sc->sc_if.if_xname, "packet size mismatch");
 3461 
 3462         evcnt_attach_dynamic(&sc->sc_misc_ev, EVCNT_TYPE_MISC,
 3463             NULL, sc->sc_if.if_xname, "misc");
 3464         evcnt_attach_dynamic(&sc->sc_workaround1_ev, EVCNT_TYPE_MISC,
 3465             &sc->sc_misc_ev, sc->sc_if.if_xname, "workaround #1");
 3466         evcnt_attach_dynamic(&sc->sc_rxamatch_ev, EVCNT_TYPE_MISC,
 3467             &sc->sc_misc_ev, sc->sc_if.if_xname, "rra equals rwa");
 3468         evcnt_attach_dynamic(&sc->sc_rxpkt1in_ev, EVCNT_TYPE_MISC,
 3469             &sc->sc_misc_ev, sc->sc_if.if_xname, "rxpkt1in set");
 3470 }
 3471 
 3472 #ifdef ATW_DEBUG
 3473 static void
 3474 atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
 3475 {
 3476         struct atw_softc *sc = ifp->if_softc;
 3477         struct mbuf *m;
 3478         int i, noctets = 0;
 3479 
 3480         printf("%s: %d-byte packet\n", device_xname(sc->sc_dev),
 3481             m0->m_pkthdr.len);
 3482 
 3483         for (m = m0; m; m = m->m_next) {
 3484                 if (m->m_len == 0)
 3485                         continue;
 3486                 for (i = 0; i < m->m_len; i++) {
 3487                         printf(" %02x", ((uint8_t*)m->m_data)[i]);
 3488                         if (++noctets % 24 == 0)
 3489                                 printf("\n");
 3490                 }
 3491         }
 3492         printf("%s%s: %d bytes emitted\n",
 3493             (noctets % 24 != 0) ? "\n" : "", device_xname(sc->sc_dev), noctets);
 3494 }
 3495 #endif /* ATW_DEBUG */
 3496 
 3497 /*
 3498  * atw_start:           [ifnet interface function]
 3499  *
 3500  *      Start packet transmission on the interface.
 3501  */
 3502 void
 3503 atw_start(struct ifnet *ifp)
 3504 {
 3505         struct atw_softc *sc = ifp->if_softc;
 3506         struct ieee80211_key *k;
 3507         struct ieee80211com *ic = &sc->sc_ic;
 3508         struct ieee80211_node *ni;
 3509         struct ieee80211_frame_min *whm;
 3510         struct ieee80211_frame *wh;
 3511         struct atw_frame *hh;
 3512         uint16_t hdrctl;
 3513         struct mbuf *m0, *m;
 3514         struct atw_txsoft *txs;
 3515         struct atw_txdesc *txd;
 3516         int npkt, rate;
 3517         bus_dmamap_t dmamap;
 3518         int ctl, error, firsttx, nexttx, lasttx, first, ofree, seg;
 3519 
 3520         DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
 3521             device_xname(sc->sc_dev), sc->sc_flags, ifp->if_flags));
 3522 
 3523         if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
 3524                 return;
 3525 
 3526         /*
 3527          * Remember the previous number of free descriptors and
 3528          * the first descriptor we'll use.
 3529          */
 3530         ofree = sc->sc_txfree;
 3531         firsttx = lasttx = sc->sc_txnext;
 3532 
 3533         DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
 3534             device_xname(sc->sc_dev), ofree, firsttx));
 3535 
 3536         /*
 3537          * Loop through the send queue, setting up transmit descriptors
 3538          * until we drain the queue, or use up all available transmit
 3539          * descriptors.
 3540          */
 3541         while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
 3542                sc->sc_txfree != 0) {
 3543 
 3544                 hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
 3545 
 3546                 /*
 3547                  * Grab a packet off the management queue, if it
 3548                  * is not empty. Otherwise, from the data queue.
 3549                  */
 3550                 IF_DEQUEUE(&ic->ic_mgtq, m0);
 3551                 if (m0 != NULL) {
 3552                         ni = M_GETCTX(m0, struct ieee80211_node *);
 3553                         M_CLEARCTX(m0);
 3554                 } else if (ic->ic_state != IEEE80211_S_RUN)
 3555                         break; /* send no data until associated */
 3556                 else {
 3557                         IFQ_DEQUEUE(&ifp->if_snd, m0);
 3558                         if (m0 == NULL)
 3559                                 break;
 3560                         bpf_mtap(ifp, m0, BPF_D_OUT);
 3561                         ni = ieee80211_find_txnode(ic,
 3562                             mtod(m0, struct ether_header *)->ether_dhost);
 3563                         if (ni == NULL) {
 3564                                 if_statinc(ifp, if_oerrors);
 3565                                 break;
 3566                         }
 3567                         if ((m0 = ieee80211_encap(ic, m0, ni)) == NULL) {
 3568                                 ieee80211_free_node(ni);
 3569                                 if_statinc(ifp, if_oerrors);
 3570                                 break;
 3571                         }
 3572                 }
 3573 
 3574                 rate = MAX(ieee80211_get_rate(ni), 2);
 3575 
 3576                 whm = mtod(m0, struct ieee80211_frame_min *);
 3577 
 3578                 if ((whm->i_fc[1] & IEEE80211_FC1_WEP) == 0)
 3579                         k = NULL;
 3580                 else if ((k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
 3581                         m_freem(m0);
 3582                         ieee80211_free_node(ni);
 3583                         if_statinc(ifp, if_oerrors);
 3584                         break;
 3585                 }
 3586 #if 0
 3587                 if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 3588                     m0->m_pkthdr.len > ic->ic_fragthreshold)
 3589                         hdrctl |= htole16(ATW_HDRCTL_MORE_FRAG);
 3590 #endif
 3591 
 3592                 if (m0->m_pkthdr.len + IEEE80211_CRC_LEN >= ic->ic_rtsthreshold)
 3593                         hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
 3594 
 3595                 if (ieee80211_compute_duration(whm, k, m0->m_pkthdr.len,
 3596                     ic->ic_flags, ic->ic_fragthreshold, rate,
 3597                     &txs->txs_d0, &txs->txs_dn, &npkt, 0) == -1) {
 3598                         DPRINTF2(sc, ("%s: fail compute duration\n", __func__));
 3599                         m_freem(m0);
 3600                         break;
 3601                 }
 3602 
 3603                 /* XXX Misleading if fragmentation is enabled.  Better
 3604                  * to fragment in software?
 3605                  */
 3606                 *(uint16_t *)whm->i_dur = htole16(txs->txs_d0.d_rts_dur);
 3607 
 3608                 /*
 3609                  * Pass the packet to any BPF listeners.
 3610                  */
 3611                 bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
 3612 
 3613                 if (sc->sc_radiobpf != NULL) {
 3614                         struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
 3615 
 3616                         tap->at_rate = rate;
 3617 
 3618                         bpf_mtap2(sc->sc_radiobpf, tap, sizeof(sc->sc_txtapu),
 3619                             m0, BPF_D_OUT);
 3620                 }
 3621 
 3622                 M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
 3623 
 3624                 if (ni != NULL)
 3625                         ieee80211_free_node(ni);
 3626 
 3627                 if (m0 == NULL) {
 3628                         if_statinc(ifp, if_oerrors);
 3629                         break;
 3630                 }
 3631 
 3632                 /* just to make sure. */
 3633                 m0 = m_pullup(m0, sizeof(struct atw_frame));
 3634 
 3635                 if (m0 == NULL) {
 3636                         if_statinc(ifp, if_oerrors);
 3637                         break;
 3638                 }
 3639 
 3640                 hh = mtod(m0, struct atw_frame *);
 3641                 wh = &hh->atw_ihdr;
 3642 
 3643                 /* Copy everything we need from the 802.11 header:
 3644                  * Frame Control; address 1, address 3, or addresses
 3645                  * 3 and 4. NIC fills in BSSID, SA.
 3646                  */
 3647                 if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
 3648                         if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
 3649                                 panic("%s: illegal WDS frame",
 3650                                     device_xname(sc->sc_dev));
 3651                         memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
 3652                 } else
 3653                         memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
 3654 
 3655                 *(uint16_t*)hh->atw_fc = *(uint16_t*)wh->i_fc;
 3656 
 3657                 /* initialize remaining Tx parameters */
 3658                 memset(&hh->u, 0, sizeof(hh->u));
 3659 
 3660                 hh->atw_rate = rate * 5;
 3661                 /* XXX this could be incorrect if M_FCS. _encap should
 3662                  * probably strip FCS just in case it sticks around in
 3663                  * bridged packets.
 3664                  */
 3665                 hh->atw_service = 0x00; /* XXX guess */
 3666                 hh->atw_paylen = htole16(m0->m_pkthdr.len -
 3667                     sizeof(struct atw_frame));
 3668 
 3669                 /* never fragment multicast frames */
 3670                 if (IEEE80211_IS_MULTICAST(hh->atw_dst))
 3671                         hh->atw_fragthr = htole16(IEEE80211_FRAG_MAX);
 3672                 else {
 3673                         if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
 3674                             (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE))
 3675                                 hdrctl |= htole16(ATW_HDRCTL_SHORT_PREAMBLE);
 3676                         hh->atw_fragthr = htole16(ic->ic_fragthreshold);
 3677                 }
 3678 
 3679                 hh->atw_rtylmt = 3;
 3680 #if 0
 3681                 if (do_encrypt) {
 3682                         hdrctl |= htole16(ATW_HDRCTL_WEP);
 3683                         hh->atw_keyid = ic->ic_def_txkey;
 3684                 }
 3685 #endif
 3686 
 3687                 hh->atw_head_plcplen = htole16(txs->txs_d0.d_plcp_len);
 3688                 hh->atw_tail_plcplen = htole16(txs->txs_dn.d_plcp_len);
 3689                 if (txs->txs_d0.d_residue)
 3690                         hh->atw_head_plcplen |= htole16(0x8000);
 3691                 if (txs->txs_dn.d_residue)
 3692                         hh->atw_tail_plcplen |= htole16(0x8000);
 3693                 hh->atw_head_dur = htole16(txs->txs_d0.d_rts_dur);
 3694                 hh->atw_tail_dur = htole16(txs->txs_dn.d_rts_dur);
 3695 
 3696                 hh->atw_hdrctl = hdrctl;
 3697                 hh->atw_fragnum = npkt << 4;
 3698 #ifdef ATW_DEBUG
 3699 
 3700                 if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
 3701                         printf("%s: dst = %s, rate = 0x%02x, "
 3702                             "service = 0x%02x, paylen = 0x%04x\n",
 3703                             device_xname(sc->sc_dev), ether_sprintf(hh->atw_dst),
 3704                             hh->atw_rate, hh->atw_service, hh->atw_paylen);
 3705 
 3706                         printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
 3707                             "dur1 = 0x%04x, dur2 = 0x%04x, "
 3708                             "dur3 = 0x%04x, rts_dur = 0x%04x\n",
 3709                             device_xname(sc->sc_dev), hh->atw_fc[0], hh->atw_fc[1],
 3710                             hh->atw_tail_plcplen, hh->atw_head_plcplen,
 3711                             hh->atw_tail_dur, hh->atw_head_dur);
 3712 
 3713                         printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
 3714                             "fragnum = 0x%02x, rtylmt = 0x%04x\n",
 3715                             device_xname(sc->sc_dev), hh->atw_hdrctl,
 3716                             hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
 3717 
 3718                         printf("%s: keyid = %d\n",
 3719                             device_xname(sc->sc_dev), hh->atw_keyid);
 3720 
 3721                         atw_dump_pkt(ifp, m0);
 3722                 }
 3723 #endif /* ATW_DEBUG */
 3724 
 3725                 dmamap = txs->txs_dmamap;
 3726 
 3727                 /*
 3728                  * Load the DMA map.  Copy and try (once) again if the packet
 3729                  * didn't fit in the alloted number of segments.
 3730                  */
 3731                 for (first = 1;
 3732                      (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
 3733                          BUS_DMA_WRITE | BUS_DMA_NOWAIT)) != 0 && first;
 3734                      first = 0) {
 3735                         MGETHDR(m, M_DONTWAIT, MT_DATA);
 3736                         if (m == NULL) {
 3737                                 aprint_error_dev(sc->sc_dev, "unable to allocate Tx mbuf\n");
 3738                                 break;
 3739                         }
 3740                         if (m0->m_pkthdr.len > MHLEN) {
 3741                                 MCLGET(m, M_DONTWAIT);
 3742                                 if ((m->m_flags & M_EXT) == 0) {
 3743                                         aprint_error_dev(sc->sc_dev, "unable to allocate Tx "
 3744                                             "cluster\n");
 3745                                         m_freem(m);
 3746                                         break;
 3747                                 }
 3748                         }
 3749                         m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
 3750                         m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
 3751                         m_freem(m0);
 3752                         m0 = m;
 3753                         m = NULL;
 3754                 }
 3755                 if (error != 0) {
 3756                         aprint_error_dev(sc->sc_dev, "unable to load Tx buffer, "
 3757                             "error = %d\n", error);
 3758                         m_freem(m0);
 3759                         break;
 3760                 }
 3761 
 3762                 /*
 3763                  * Ensure we have enough descriptors free to describe
 3764                  * the packet.
 3765                  */
 3766                 if (dmamap->dm_nsegs > sc->sc_txfree) {
 3767                         /*
 3768                          * Not enough free descriptors to transmit
 3769                          * this packet.  Unload the DMA map and
 3770                          * drop the packet.  Notify the upper layer
 3771                          * that there are no more slots left.
 3772                          *
 3773                          * XXX We could allocate an mbuf and copy, but
 3774                          * XXX it is worth it?
 3775                          */
 3776                         bus_dmamap_unload(sc->sc_dmat, dmamap);
 3777                         m_freem(m0);
 3778                         break;
 3779                 }
 3780 
 3781                 /*
 3782                  * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
 3783                  */
 3784 
 3785                 /* Sync the DMA map. */
 3786                 bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
 3787                     BUS_DMASYNC_PREWRITE);
 3788 
 3789                 /* XXX arbitrary retry limit; 8 because I have seen it in
 3790                  * use already and maybe 0 means "no tries" !
 3791                  */
 3792                 ctl = htole32(__SHIFTIN(8, ATW_TXCTL_TL_MASK));
 3793 
 3794                 DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
 3795                     device_xname(sc->sc_dev), rate * 5));
 3796                 ctl |= htole32(__SHIFTIN(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
 3797 
 3798                 /*
 3799                  * Initialize the transmit descriptors.
 3800                  */
 3801                 for (nexttx = sc->sc_txnext, seg = 0;
 3802                      seg < dmamap->dm_nsegs;
 3803                      seg++, nexttx = ATW_NEXTTX(nexttx)) {
 3804                         /*
 3805                          * If this is the first descriptor we're
 3806                          * enqueueing, don't set the OWN bit just
 3807                          * yet.  That could cause a race condition.
 3808                          * We'll do it below.
 3809                          */
 3810                         txd = &sc->sc_txdescs[nexttx];
 3811                         txd->at_ctl = ctl |
 3812                             ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
 3813 
 3814                         txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
 3815                         txd->at_flags =
 3816                             htole32(__SHIFTIN(dmamap->dm_segs[seg].ds_len,
 3817                                            ATW_TXFLAG_TBS1_MASK)) |
 3818                             ((nexttx == (ATW_NTXDESC - 1))
 3819                                 ? htole32(ATW_TXFLAG_TER) : 0);
 3820                         lasttx = nexttx;
 3821                 }
 3822 
 3823                 /* Set `first segment' and `last segment' appropriately. */
 3824                 sc->sc_txdescs[sc->sc_txnext].at_flags |=
 3825                     htole32(ATW_TXFLAG_FS);
 3826                 sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
 3827 
 3828 #ifdef ATW_DEBUG
 3829                 if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
 3830                         printf("     txsoft %p transmit chain:\n", txs);
 3831                         for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
 3832                                 printf("     descriptor %d:\n", seg);
 3833                                 printf("       at_ctl:   0x%08x\n",
 3834                                     le32toh(sc->sc_txdescs[seg].at_ctl));
 3835                                 printf("       at_flags:      0x%08x\n",
 3836                                     le32toh(sc->sc_txdescs[seg].at_flags));
 3837                                 printf("       at_buf1: 0x%08x\n",
 3838                                     le32toh(sc->sc_txdescs[seg].at_buf1));
 3839                                 printf("       at_buf2: 0x%08x\n",
 3840                                     le32toh(sc->sc_txdescs[seg].at_buf2));
 3841                                 if (seg == lasttx)
 3842                                         break;
 3843                         }
 3844                 }
 3845 #endif
 3846 
 3847                 /* Sync the descriptors we're using. */
 3848                 ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
 3849                     BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 3850 
 3851                 /*
 3852                  * Store a pointer to the packet so we can free it later,
 3853                  * and remember what txdirty will be once the packet is
 3854                  * done.
 3855                  */
 3856                 txs->txs_mbuf = m0;
 3857                 txs->txs_firstdesc = sc->sc_txnext;
 3858                 txs->txs_lastdesc = lasttx;
 3859                 txs->txs_ndescs = dmamap->dm_nsegs;
 3860 
 3861                 /* Advance the tx pointer. */
 3862                 sc->sc_txfree -= dmamap->dm_nsegs;
 3863                 sc->sc_txnext = nexttx;
 3864 
 3865                 SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
 3866                 SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
 3867         }
 3868 
 3869         if (sc->sc_txfree != ofree) {
 3870                 DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
 3871                     device_xname(sc->sc_dev), lasttx, firsttx));
 3872                 /*
 3873                  * Cause a transmit interrupt to happen on the
 3874                  * last packet we enqueued.
 3875                  */
 3876                 sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
 3877                 ATW_CDTXSYNC(sc, lasttx, 1,
 3878                     BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 3879 
 3880                 /*
 3881                  * The entire packet chain is set up.  Give the
 3882                  * first descriptor to the chip now.
 3883                  */
 3884                 sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
 3885                 ATW_CDTXSYNC(sc, firsttx, 1,
 3886                     BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 3887 
 3888                 /* Wake up the transmitter. */
 3889                 ATW_WRITE(sc, ATW_TDR, 0x1);
 3890 
 3891                 if (txs == NULL || sc->sc_txfree == 0)
 3892                         ifp->if_flags |= IFF_OACTIVE;
 3893 
 3894                 /* Set a watchdog timer in case the chip flakes out. */
 3895                 sc->sc_tx_timer = 5;
 3896                 ifp->if_timer = 1;
 3897         }
 3898 }
 3899 
 3900 /*
 3901  * atw_ioctl:           [ifnet interface function]
 3902  *
 3903  *      Handle control requests from the operator.
 3904  */
 3905 int
 3906 atw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
 3907 {
 3908         struct atw_softc *sc = ifp->if_softc;
 3909         struct ieee80211req *ireq;
 3910         int s, error = 0;
 3911 
 3912         s = splnet();
 3913 
 3914         switch (cmd) {
 3915         case SIOCSIFFLAGS:
 3916                 if ((error = ifioctl_common(ifp, cmd, data)) != 0)
 3917                         break;
 3918                 switch (ifp->if_flags & (IFF_UP | IFF_RUNNING)) {
 3919                 case IFF_UP | IFF_RUNNING:
 3920                         /*
 3921                          * To avoid rescanning another access point,
 3922                          * do not call atw_init() here.  Instead,
 3923                          * only reflect media settings.
 3924                          */
 3925                         if (device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
 3926                                 atw_filter_setup(sc);
 3927                         break;
 3928                 case IFF_UP:
 3929                         error = atw_init(ifp);
 3930                         break;
 3931                 case IFF_RUNNING:
 3932                         atw_stop(ifp, 1);
 3933                         break;
 3934                 case 0:
 3935                         break;
 3936                 }
 3937                 break;
 3938         case SIOCADDMULTI:
 3939         case SIOCDELMULTI:
 3940                 if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
 3941                         if (ifp->if_flags & IFF_RUNNING)
 3942                                 atw_filter_setup(sc); /* do not rescan */
 3943                         error = 0;
 3944                 }
 3945                 break;
 3946         case SIOCS80211:
 3947                 ireq = data;
 3948                 if (ireq->i_type == IEEE80211_IOC_FRAGTHRESHOLD) {
 3949                         if ((error = kauth_authorize_network(
 3950                             kauth_cred_get(), KAUTH_NETWORK_INTERFACE,
 3951                             KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp,
 3952                             (void *)cmd, NULL)) != 0)
 3953                                 break;
 3954                         if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
 3955                               ireq->i_val <= IEEE80211_FRAG_MAX))
 3956                                 error = EINVAL;
 3957                         else
 3958                                 sc->sc_ic.ic_fragthreshold = ireq->i_val;
 3959                         break;
 3960                 }
 3961                 /*FALLTHROUGH*/
 3962         default:
 3963                 error = ieee80211_ioctl(&sc->sc_ic, cmd, data);
 3964                 if (error == ENETRESET || error == ERESTART) {
 3965                         if (is_running(ifp))
 3966                                 error = atw_init(ifp);
 3967                         else
 3968                                 error = 0;
 3969                 }
 3970                 break;
 3971         }
 3972 
 3973         /* Try to get more packets going. */
 3974         if (device_is_active(sc->sc_dev))
 3975                 atw_start(ifp);
 3976 
 3977         splx(s);
 3978         return (error);
 3979 }
 3980 
 3981 static int
 3982 atw_media_change(struct ifnet *ifp)
 3983 {
 3984         int error;
 3985 
 3986         error = ieee80211_media_change(ifp);
 3987         if (error == ENETRESET) {
 3988                 if (is_running(ifp))
 3989                         error = atw_init(ifp);
 3990                 else
 3991                         error = 0;
 3992         }
 3993         return error;
 3994 }

Cache object: 0fa936858c8fb7f0da5e2c3e660888bd


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.