The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ic/atw.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $OpenBSD: atw.c,v 1.100 2022/04/21 21:03:02 stsp Exp $  */
    2 /*      $NetBSD: atw.c,v 1.69 2004/07/23 07:07:55 dyoung Exp $  */
    3 
    4 /*-
    5  * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
    6  * All rights reserved.
    7  *
    8  * This code is derived from software contributed to The NetBSD Foundation
    9  * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
   10  *
   11  * Redistribution and use in source and binary forms, with or without
   12  * modification, are permitted provided that the following conditions
   13  * are met:
   14  * 1. Redistributions of source code must retain the above copyright
   15  *    notice, this list of conditions and the following disclaimer.
   16  * 2. Redistributions in binary form must reproduce the above copyright
   17  *    notice, this list of conditions and the following disclaimer in the
   18  *    documentation and/or other materials provided with the distribution.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
   21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
   24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   30  * POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 /*
   34  * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
   35  */
   36 
   37 #include "bpfilter.h"
   38 
   39 #include <sys/param.h>
   40 #include <sys/systm.h>
   41 #include <sys/mbuf.h>
   42 #include <sys/malloc.h>
   43 #include <sys/kernel.h>
   44 #include <sys/socket.h>
   45 #include <sys/ioctl.h>
   46 #include <sys/errno.h>
   47 #include <sys/device.h>
   48 #include <sys/time.h>
   49 #include <sys/endian.h>
   50 
   51 #include <net/if.h>
   52 #include <net/if_media.h>
   53 
   54 #if NBPFILTER > 0
   55 #include <net/bpf.h>
   56 #endif
   57 
   58 #include <netinet/in.h>
   59 #include <netinet/if_ether.h>
   60 
   61 #include <net80211/ieee80211_var.h>
   62 #include <net80211/ieee80211_radiotap.h>
   63 
   64 #include <machine/bus.h>
   65 #include <machine/intr.h>
   66 
   67 #include <dev/ic/atwreg.h>
   68 #include <dev/ic/rf3000reg.h>
   69 #include <dev/ic/si4136reg.h>
   70 #include <dev/ic/atwvar.h>
   71 #include <dev/ic/smc93cx6var.h>
   72 
   73 /* XXX TBD open questions
   74  *
   75  *
   76  * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
   77  * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
   78  * handle this for me?
   79  *
   80  */
   81 /* device attachment
   82  *
   83  *    print TOFS[012]
   84  *
   85  * device initialization
   86  *
   87  *    clear ATW_FRCTL_MAXPSP to disable max power saving
   88  *    set ATW_TXBR_ALCUPDATE to enable ALC
   89  *    set TOFS[012]? (hope not)
   90  *    disable rx/tx
   91  *    set ATW_PAR_SWR (software reset)
   92  *    wait for ATW_PAR_SWR clear
   93  *    disable interrupts
   94  *    ack status register
   95  *    enable interrupts
   96  *
   97  * rx/tx initialization
   98  *
   99  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
  100  *    allocate and init descriptor rings
  101  *    write ATW_PAR_DSL (descriptor skip length)
  102  *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
  103  *    write ATW_NAR_SQ for one/both transmit descriptor rings
  104  *    write ATW_NAR_SQ for one/both transmit descriptor rings
  105  *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
  106  *
  107  * rx/tx end
  108  *
  109  *    stop DMA
  110  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
  111  *    flush tx w/ ATW_NAR_HF
  112  *
  113  * scan
  114  *
  115  *    initialize rx/tx
  116  *
  117  * BSS join: (re)association response
  118  *
  119  *    set ATW_FRCTL_AID
  120  *
  121  * optimizations ???
  122  *
  123  */
  124 
  125 #define ATW_REFSLAVE    /* slavishly do what the reference driver does */
  126 
  127 int atw_bbp_io_enable_delay = 20 * 1000;
  128 int atw_bbp_io_disable_delay = 2 * 1000;
  129 int atw_writewep_delay = 1000;
  130 int atw_beacon_len_adjust = 4;
  131 int atw_dwelltime = 200;
  132 int atw_xindiv2 = 0;
  133 
  134 #ifdef ATW_DEBUG
  135 int atw_debug = 0;
  136 
  137 #define ATW_DPRINTF(x)  if (atw_debug > 0) printf x
  138 #define ATW_DPRINTF2(x) if (atw_debug > 1) printf x
  139 #define ATW_DPRINTF3(x) if (atw_debug > 2) printf x
  140 #define DPRINTF(sc, x)  if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) printf x
  141 #define DPRINTF2(sc, x) if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
  142 #define DPRINTF3(sc, x) if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
  143 void atw_print_regs(struct atw_softc *, const char *);
  144 void atw_dump_pkt(struct ifnet *, struct mbuf *);
  145 
  146 /* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
  147 #       ifdef ATW_BBPDEBUG
  148 int atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
  149 void atw_rf3000_print(struct atw_softc *);
  150 #       endif /* ATW_BBPDEBUG */
  151 
  152 #       ifdef ATW_SYNDEBUG
  153 int atw_si4126_read(struct atw_softc *, u_int, u_int *);
  154 void atw_si4126_print(struct atw_softc *);
  155 #       endif /* ATW_SYNDEBUG */
  156 
  157 #else
  158 #define ATW_DPRINTF(x)
  159 #define ATW_DPRINTF2(x)
  160 #define ATW_DPRINTF3(x)
  161 #define DPRINTF(sc, x)  /* nothing */
  162 #define DPRINTF2(sc, x) /* nothing */
  163 #define DPRINTF3(sc, x) /* nothing */
  164 #endif
  165 
  166 #ifdef ATW_STATS
  167 void    atw_print_stats(struct atw_softc *);
  168 #endif
  169 
  170 const char *atw_printmac(u_int8_t);
  171 
  172 /* ifnet methods */
  173 void    atw_start(struct ifnet *);
  174 void    atw_watchdog(struct ifnet *);
  175 int     atw_ioctl(struct ifnet *, u_long, caddr_t);
  176 int     atw_init(struct ifnet *);
  177 void    atw_stop(struct ifnet *, int);
  178 
  179 /* Rx/Tx process */
  180 void    atw_rxdrain(struct atw_softc *);
  181 void    atw_txdrain(struct atw_softc *);
  182 int     atw_add_rxbuf(struct atw_softc *, int);
  183 void    atw_idle(struct atw_softc *, u_int32_t);
  184 
  185 /* Device (de)activation and power state */
  186 void    atw_disable(struct atw_softc *);
  187 void    atw_reset(struct atw_softc *);
  188 
  189 /* Interrupt handlers */
  190 void    atw_rxintr(struct atw_softc *);
  191 void    atw_txintr(struct atw_softc *);
  192 void    atw_linkintr(struct atw_softc *, u_int32_t);
  193 
  194 /* 802.11 state machine */
  195 int     atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
  196 int     atw_tune(struct atw_softc *);
  197 #ifndef IEEE80211_STA_ONLY
  198 void    atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
  199             struct ieee80211_node *, struct ieee80211_rxinfo *, int);
  200 #endif
  201 void    atw_next_scan(void *);
  202 
  203 /* Device initialization */
  204 void    atw_wcsr_init(struct atw_softc *);
  205 void    atw_cmdr_init(struct atw_softc *);
  206 void    atw_tofs2_init(struct atw_softc *);
  207 void    atw_txlmt_init(struct atw_softc *);
  208 void    atw_test1_init(struct atw_softc *);
  209 void    atw_rf_reset(struct atw_softc *);
  210 void    atw_cfp_init(struct atw_softc *);
  211 void    atw_tofs0_init(struct atw_softc *);
  212 void    atw_ifs_init(struct atw_softc *);
  213 void    atw_response_times_init(struct atw_softc *);
  214 void    atw_bbp_io_init(struct atw_softc *);
  215 void    atw_nar_init(struct atw_softc *);
  216 
  217 /* RAM/ROM utilities */
  218 void    atw_clear_sram(struct atw_softc *);
  219 void    atw_write_sram(struct atw_softc *, u_int, u_int8_t *, u_int);
  220 int     atw_read_srom(struct atw_softc *);
  221 
  222 /* BSS setup */
  223 void    atw_predict_beacon(struct atw_softc *sc);
  224 void    atw_start_beacon(struct atw_softc *, int);
  225 void    atw_write_bssid(struct atw_softc *);
  226 void    atw_write_ssid(struct atw_softc *);
  227 void    atw_write_sup_rates(struct atw_softc *);
  228 void    atw_write_wep(struct atw_softc *);
  229 
  230 /* Media */
  231 int     atw_media_change(struct ifnet *);
  232 void    atw_media_status(struct ifnet *, struct ifmediareq *);
  233 
  234 void    atw_filter_setup(struct atw_softc *);
  235 
  236 /* 802.11 utilities */
  237 struct  ieee80211_node *atw_node_alloc(struct ieee80211com *);
  238 void    atw_node_free(struct ieee80211com *, struct ieee80211_node *);
  239 static  __inline uint32_t atw_last_even_tsft(uint32_t, uint32_t, uint32_t);
  240 uint64_t atw_get_tsft(struct atw_softc *sc);
  241 void    atw_change_ibss(struct atw_softc *);
  242 int     atw_compute_duration1(int, int, uint32_t, int, struct atw_duration *);
  243 int     atw_compute_duration(struct ieee80211_frame *, int, uint32_t, int,
  244             int, struct atw_duration *, struct atw_duration *, int *, int);
  245 
  246 /*
  247  * Tuner/transceiver/modem
  248  */
  249 void    atw_bbp_io_enable(struct atw_softc *, int);
  250 
  251 /* RFMD RF3000 Baseband Processor */
  252 int     atw_rf3000_init(struct atw_softc *);
  253 int     atw_rf3000_tune(struct atw_softc *, u_int);
  254 int     atw_rf3000_write(struct atw_softc *, u_int, u_int);
  255 
  256 /* Silicon Laboratories Si4126 RF/IF Synthesizer */
  257 void    atw_si4126_tune(struct atw_softc *, u_int);
  258 void    atw_si4126_write(struct atw_softc *, u_int, u_int);
  259 void    atw_si4126_init(struct atw_softc *);
  260 
  261 const struct atw_txthresh_tab atw_txthresh_tab_lo[] = {
  262         { ATW_NAR_TR_L64,       "64 bytes" },
  263         { ATW_NAR_TR_L160,      "160 bytes" },
  264         { ATW_NAR_TR_L192,      "192 bytes" },
  265         { ATW_NAR_SF,           "store and forward" },
  266         { 0,                    NULL }
  267 };
  268 const struct atw_txthresh_tab atw_txthresh_tab_hi[] = {
  269         { ATW_NAR_TR_H96,       "96 bytes" },
  270         { ATW_NAR_TR_H288,      "288 bytes" },
  271         { ATW_NAR_TR_H544,      "544 bytes" },
  272         { ATW_NAR_SF,           "store and forward" },
  273         { 0,                    NULL }
  274 };
  275 
  276 struct cfdriver atw_cd = {
  277     NULL, "atw", DV_IFNET
  278 };
  279 
  280 static const u_int atw_rfmd2958_ifn[] = {
  281         0x22bd, 0x22d2, 0x22e8, 0x22fe, 0x2314, 0x232a, 0x2340,
  282         0x2355, 0x236b, 0x2381, 0x2397, 0x23ad, 0x23c2, 0x23f7
  283 };
  284 
  285 static const u_int atw_rfmd2958_rf1r[] = {
  286         0x05d17, 0x3a2e8, 0x2e8ba, 0x22e8b, 0x1745d, 0x0ba2e, 0x00000,
  287         0x345d1, 0x28ba2, 0x1d174, 0x11745, 0x05d17, 0x3a2e8, 0x11745
  288 };
  289 
  290 
  291 #ifdef ATW_DEBUG
  292 
  293 const char *atw_tx_state[] = {
  294         "STOPPED",
  295         "RUNNING - read descriptor",
  296         "RUNNING - transmitting",
  297         "RUNNING - filling fifo",       /* XXX */
  298         "SUSPENDED",
  299         "RUNNING -- write descriptor",
  300         "RUNNING -- write last descriptor",
  301         "RUNNING - fifo full"
  302 };
  303 
  304 const char *atw_rx_state[] = {
  305         "STOPPED",
  306         "RUNNING - read descriptor",
  307         "RUNNING - check this packet, pre-fetch next",
  308         "RUNNING - wait for reception",
  309         "SUSPENDED",
  310         "RUNNING - write descriptor",
  311         "RUNNING - flush fifo",
  312         "RUNNING - fifo drain"
  313 };
  314 
  315 #endif
  316 
  317 /*
  318  * atw_enable:
  319  *
  320  *      Enable the ADM8211 chip.
  321  */
  322 int
  323 atw_enable(struct atw_softc *sc)
  324 {
  325 
  326         if (ATW_IS_ENABLED(sc) == 0) {
  327                 if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
  328                         printf("%s: device enable failed\n",
  329                             sc->sc_dev.dv_xname);
  330                         return (EIO);
  331                 }
  332                 sc->sc_flags |= ATWF_ENABLED;
  333         }
  334         return (0);
  335 }
  336 
  337 /*
  338  * atw_disable:
  339  *
  340  *      Disable the ADM8211 chip.
  341  */
  342 void
  343 atw_disable(struct atw_softc *sc)
  344 {
  345         if (!ATW_IS_ENABLED(sc))
  346                 return;
  347         if (sc->sc_disable != NULL)
  348                 (*sc->sc_disable)(sc);
  349         sc->sc_flags &= ~ATWF_ENABLED;
  350 }
  351 
  352 /* Returns -1 on failure. */
  353 int
  354 atw_read_srom(struct atw_softc *sc)
  355 {
  356         struct seeprom_descriptor sd;
  357         u_int32_t test0, fail_bits;
  358 
  359         (void)memset(&sd, 0, sizeof(sd));
  360 
  361         test0 = ATW_READ(sc, ATW_TEST0);
  362 
  363         switch (sc->sc_rev) {
  364         case ATW_REVISION_BA:
  365         case ATW_REVISION_CA:
  366                 fail_bits = ATW_TEST0_EPNE;
  367                 break;
  368         default:
  369                 fail_bits = ATW_TEST0_EPNE|ATW_TEST0_EPSNM;
  370                 break;
  371         }
  372         if ((test0 & fail_bits) != 0) {
  373                 printf("%s: bad or missing/bad SROM\n", sc->sc_dev.dv_xname);
  374                 return -1;
  375         }
  376 
  377         switch (test0 & ATW_TEST0_EPTYP_MASK) {
  378         case ATW_TEST0_EPTYP_93c66:
  379                 ATW_DPRINTF(("%s: 93c66 SROM\n", sc->sc_dev.dv_xname));
  380                 sc->sc_sromsz = 512;
  381                 sd.sd_chip = C56_66;
  382                 break;
  383         case ATW_TEST0_EPTYP_93c46:
  384                 ATW_DPRINTF(("%s: 93c46 SROM\n", sc->sc_dev.dv_xname));
  385                 sc->sc_sromsz = 128;
  386                 sd.sd_chip = C46;
  387                 break;
  388         default:
  389                 printf("%s: unknown SROM type %d\n", sc->sc_dev.dv_xname,
  390                     MASK_AND_RSHIFT(test0, ATW_TEST0_EPTYP_MASK));
  391                 return -1;
  392         }
  393 
  394         sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_NOWAIT | M_ZERO);
  395         if (sc->sc_srom == NULL) {
  396                 printf("%s: unable to allocate SROM buffer\n",
  397                     sc->sc_dev.dv_xname);
  398                 return -1;
  399         }
  400 
  401         /*
  402          * ADM8211 has a single 32-bit register for controlling the
  403          * 93cx6 SROM.  Bit SRS enables the serial port. There is no
  404          * "ready" bit. The ADM8211 input/output sense is the reverse
  405          * of read_seeprom's.
  406          */
  407         sd.sd_tag = sc->sc_st;
  408         sd.sd_bsh = sc->sc_sh;
  409         sd.sd_regsize = 4;
  410         sd.sd_control_offset = ATW_SPR;
  411         sd.sd_status_offset = ATW_SPR;
  412         sd.sd_dataout_offset = ATW_SPR;
  413         sd.sd_CK = ATW_SPR_SCLK;
  414         sd.sd_CS = ATW_SPR_SCS;
  415         sd.sd_DI = ATW_SPR_SDO;
  416         sd.sd_DO = ATW_SPR_SDI;
  417         sd.sd_MS = ATW_SPR_SRS;
  418         sd.sd_RDY = 0;
  419 
  420         if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
  421                 printf("%s: could not read SROM\n", sc->sc_dev.dv_xname);
  422                 free(sc->sc_srom, M_DEVBUF, sc->sc_sromsz);
  423                 return -1;
  424         }
  425 #ifdef ATW_DEBUG
  426         {
  427                 int i;
  428                 ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
  429                 for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
  430                         if (((i % 8) == 0) && (i != 0)) {
  431                                 ATW_DPRINTF(("\n\t"));
  432                         }
  433                         ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
  434                 }
  435                 ATW_DPRINTF(("\n"));
  436         }
  437 #endif /* ATW_DEBUG */
  438         return 0;
  439 }
  440 
  441 #ifdef ATW_DEBUG
  442 void
  443 atw_print_regs(struct atw_softc *sc, const char *where)
  444 {
  445 #define PRINTREG(sc, reg) \
  446         ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
  447             sc->sc_dev.dv_xname, reg, ATW_READ(sc, reg)))
  448 
  449         ATW_DPRINTF2(("%s: %s\n", sc->sc_dev.dv_xname, where));
  450 
  451         PRINTREG(sc, ATW_PAR);
  452         PRINTREG(sc, ATW_FRCTL);
  453         PRINTREG(sc, ATW_TDR);
  454         PRINTREG(sc, ATW_WTDP);
  455         PRINTREG(sc, ATW_RDR);
  456         PRINTREG(sc, ATW_WRDP);
  457         PRINTREG(sc, ATW_RDB);
  458         PRINTREG(sc, ATW_CSR3A);
  459         PRINTREG(sc, ATW_TDBD);
  460         PRINTREG(sc, ATW_TDBP);
  461         PRINTREG(sc, ATW_STSR);
  462         PRINTREG(sc, ATW_CSR5A);
  463         PRINTREG(sc, ATW_NAR);
  464         PRINTREG(sc, ATW_CSR6A);
  465         PRINTREG(sc, ATW_IER);
  466         PRINTREG(sc, ATW_CSR7A);
  467         PRINTREG(sc, ATW_LPC);
  468         PRINTREG(sc, ATW_TEST1);
  469         PRINTREG(sc, ATW_SPR);
  470         PRINTREG(sc, ATW_TEST0);
  471         PRINTREG(sc, ATW_WCSR);
  472         PRINTREG(sc, ATW_WPDR);
  473         PRINTREG(sc, ATW_GPTMR);
  474         PRINTREG(sc, ATW_GPIO);
  475         PRINTREG(sc, ATW_BBPCTL);
  476         PRINTREG(sc, ATW_SYNCTL);
  477         PRINTREG(sc, ATW_PLCPHD);
  478         PRINTREG(sc, ATW_MMIWADDR);
  479         PRINTREG(sc, ATW_MMIRADDR1);
  480         PRINTREG(sc, ATW_MMIRADDR2);
  481         PRINTREG(sc, ATW_TXBR);
  482         PRINTREG(sc, ATW_CSR15A);
  483         PRINTREG(sc, ATW_ALCSTAT);
  484         PRINTREG(sc, ATW_TOFS2);
  485         PRINTREG(sc, ATW_CMDR);
  486         PRINTREG(sc, ATW_PCIC);
  487         PRINTREG(sc, ATW_PMCSR);
  488         PRINTREG(sc, ATW_PAR0);
  489         PRINTREG(sc, ATW_PAR1);
  490         PRINTREG(sc, ATW_MAR0);
  491         PRINTREG(sc, ATW_MAR1);
  492         PRINTREG(sc, ATW_ATIMDA0);
  493         PRINTREG(sc, ATW_ABDA1);
  494         PRINTREG(sc, ATW_BSSID0);
  495         PRINTREG(sc, ATW_TXLMT);
  496         PRINTREG(sc, ATW_MIBCNT);
  497         PRINTREG(sc, ATW_BCNT);
  498         PRINTREG(sc, ATW_TSFTH);
  499         PRINTREG(sc, ATW_TSC);
  500         PRINTREG(sc, ATW_SYNRF);
  501         PRINTREG(sc, ATW_BPLI);
  502         PRINTREG(sc, ATW_CAP0);
  503         PRINTREG(sc, ATW_CAP1);
  504         PRINTREG(sc, ATW_RMD);
  505         PRINTREG(sc, ATW_CFPP);
  506         PRINTREG(sc, ATW_TOFS0);
  507         PRINTREG(sc, ATW_TOFS1);
  508         PRINTREG(sc, ATW_IFST);
  509         PRINTREG(sc, ATW_RSPT);
  510         PRINTREG(sc, ATW_TSFTL);
  511         PRINTREG(sc, ATW_WEPCTL);
  512         PRINTREG(sc, ATW_WESK);
  513         PRINTREG(sc, ATW_WEPCNT);
  514         PRINTREG(sc, ATW_MACTEST);
  515         PRINTREG(sc, ATW_FER);
  516         PRINTREG(sc, ATW_FEMR);
  517         PRINTREG(sc, ATW_FPSR);
  518         PRINTREG(sc, ATW_FFER);
  519 #undef PRINTREG
  520 }
  521 #endif /* ATW_DEBUG */
  522 
  523 const char*
  524 atw_printmac(u_int8_t rev) {
  525         switch (rev) {
  526         case ATW_REVISION_AB:
  527                 return "ADM8211AB";
  528         case ATW_REVISION_AF:
  529                 return "ADM8211AF";
  530         case ATW_REVISION_BA:
  531                 return "ADM8211BA";
  532         case ATW_REVISION_CA:
  533                 return "ADM8211CA";
  534         default:
  535                 return "unknown";
  536         }
  537 }
  538 
  539 /*
  540  * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
  541  */
  542 void
  543 atw_attach(struct atw_softc *sc)
  544 {
  545         static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
  546                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  547         };
  548         struct ieee80211com *ic = &sc->sc_ic;
  549         struct ifnet *ifp = &ic->ic_if;
  550         int country_code, error, i, srom_major;
  551         u_int32_t reg;
  552         static const char *type_strings[] = {"Intersil (not supported)",
  553             "RFMD", "Marvel (not supported)"};
  554 
  555         sc->sc_txth = atw_txthresh_tab_lo;
  556 
  557         SIMPLEQ_INIT(&sc->sc_txfreeq);
  558         SIMPLEQ_INIT(&sc->sc_txdirtyq);
  559 
  560 #ifdef ATW_DEBUG
  561         atw_print_regs(sc, "atw_attach");
  562 #endif /* ATW_DEBUG */
  563 
  564         /*
  565          * Allocate the control data structures, and create and load the
  566          * DMA map for it.
  567          */
  568         if ((error = bus_dmamem_alloc(sc->sc_dmat,
  569             sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
  570             1, &sc->sc_cdnseg, 0)) != 0) {
  571                 printf("%s: unable to allocate control data, error = %d\n",
  572                     sc->sc_dev.dv_xname, error);
  573                 goto fail_0;
  574         }
  575 
  576         if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
  577             sizeof(struct atw_control_data), (caddr_t *)&sc->sc_control_data,
  578             BUS_DMA_COHERENT)) != 0) {
  579                 printf("%s: unable to map control data, error = %d\n",
  580                     sc->sc_dev.dv_xname, error);
  581                 goto fail_1;
  582         }
  583 
  584         if ((error = bus_dmamap_create(sc->sc_dmat,
  585             sizeof(struct atw_control_data), 1,
  586             sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
  587                 printf("%s: unable to create control data DMA map, "
  588                     "error = %d\n", sc->sc_dev.dv_xname, error);
  589                 goto fail_2;
  590         }
  591 
  592         if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
  593             sc->sc_control_data, sizeof(struct atw_control_data), NULL,
  594             0)) != 0) {
  595                 printf("%s: unable to load control data DMA map, error = %d\n",
  596                     sc->sc_dev.dv_xname, error);
  597                 goto fail_3;
  598         }
  599 
  600         /*
  601          * Create the transmit buffer DMA maps.
  602          */
  603         sc->sc_ntxsegs = ATW_NTXSEGS;
  604         for (i = 0; i < ATW_TXQUEUELEN; i++) {
  605                 if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
  606                     sc->sc_ntxsegs, MCLBYTES, 0, 0,
  607                     &sc->sc_txsoft[i].txs_dmamap)) != 0) {
  608                         printf("%s: unable to create tx DMA map %d, "
  609                             "error = %d\n", sc->sc_dev.dv_xname, i, error);
  610                         goto fail_4;
  611                 }
  612         }
  613 
  614         /*
  615          * Create the receive buffer DMA maps.
  616          */
  617         for (i = 0; i < ATW_NRXDESC; i++) {
  618                 if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
  619                     MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
  620                         printf("%s: unable to create rx DMA map %d, "
  621                             "error = %d\n", sc->sc_dev.dv_xname, i, error);
  622                         goto fail_5;
  623                 }
  624         }
  625         for (i = 0; i < ATW_NRXDESC; i++) {
  626                 sc->sc_rxsoft[i].rxs_mbuf = NULL;
  627         }
  628 
  629         switch (sc->sc_rev) {
  630         case ATW_REVISION_AB:
  631         case ATW_REVISION_AF:
  632                 sc->sc_sramlen = ATW_SRAM_A_SIZE;
  633                 break;
  634         case ATW_REVISION_BA:
  635         case ATW_REVISION_CA:
  636                 sc->sc_sramlen = ATW_SRAM_B_SIZE;
  637                 break;
  638         }
  639 
  640         /* Reset the chip to a known state. */
  641         atw_reset(sc);
  642 
  643         if (atw_read_srom(sc) == -1)
  644                 return;
  645 
  646         sc->sc_rftype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
  647             ATW_SR_RFTYPE_MASK);
  648 
  649         sc->sc_bbptype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
  650             ATW_SR_BBPTYPE_MASK);
  651 
  652         if (sc->sc_rftype >= nitems(type_strings)) {
  653                 printf("%s: unknown RF\n", sc->sc_dev.dv_xname);
  654                 return;
  655         }
  656         if (sc->sc_bbptype >= nitems(type_strings)) {
  657                 printf("%s: unknown BBP\n", sc->sc_dev.dv_xname);
  658                 return;
  659         }
  660 
  661         printf("%s: MAC %s, BBP %s, RF %s", sc->sc_dev.dv_xname,
  662             atw_printmac(sc->sc_rev), type_strings[sc->sc_bbptype],
  663             type_strings[sc->sc_rftype]);
  664 
  665         /* XXX There exists a Linux driver which seems to use RFType = 0 for
  666          * MARVEL. My bug, or theirs?
  667          */
  668 
  669         reg = LSHIFT(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
  670 
  671         switch (sc->sc_rftype) {
  672         case ATW_RFTYPE_INTERSIL:
  673                 reg |= ATW_SYNCTL_CS1;
  674                 break;
  675         case ATW_RFTYPE_RFMD:
  676                 reg |= ATW_SYNCTL_CS0;
  677                 break;
  678         case ATW_RFTYPE_MARVEL:
  679                 break;
  680         }
  681 
  682         sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
  683         sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
  684 
  685         reg = LSHIFT(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
  686 
  687         switch (sc->sc_bbptype) {
  688         case ATW_BBPTYPE_INTERSIL:
  689                 reg |= ATW_BBPCTL_TWI;
  690                 break;
  691         case ATW_BBPTYPE_RFMD:
  692                 reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
  693                     ATW_BBPCTL_CCA_ACTLO;
  694                 break;
  695         case ATW_BBPTYPE_MARVEL:
  696                 break;
  697         case ATW_C_BBPTYPE_RFMD:
  698                 printf("%s: ADM8211C MAC/RFMD BBP not supported yet.\n",
  699                     sc->sc_dev.dv_xname);
  700                 break;
  701         }
  702 
  703         sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
  704         sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
  705 
  706         /*
  707          * From this point forward, the attachment cannot fail.  A failure
  708          * before this point releases all resources that may have been
  709          * allocated.
  710          */
  711         sc->sc_flags |= ATWF_ATTACHED /* | ATWF_RTSCTS */;
  712 
  713         ATW_DPRINTF((" SROM MAC %04x%04x%04x",
  714             htole16(sc->sc_srom[ATW_SR_MAC00]),
  715             htole16(sc->sc_srom[ATW_SR_MAC01]),
  716             htole16(sc->sc_srom[ATW_SR_MAC10])));
  717 
  718         srom_major = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
  719             ATW_SR_MAJOR_MASK);
  720 
  721         if (srom_major < 2)
  722                 sc->sc_rf3000_options1 = 0;
  723         else if (sc->sc_rev == ATW_REVISION_BA) {
  724                 sc->sc_rf3000_options1 =
  725                     MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CR28_CR03],
  726                     ATW_SR_CR28_MASK);
  727         } else
  728                 sc->sc_rf3000_options1 = 0;
  729 
  730         sc->sc_rf3000_options2 = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
  731             ATW_SR_CR29_MASK);
  732 
  733         country_code = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
  734             ATW_SR_CTRY_MASK);
  735 
  736 #define ADD_CHANNEL(_ic, _chan) do {                                    \
  737         _ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;            \
  738         _ic->ic_channels[_chan].ic_freq =                               \
  739             ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
  740 } while (0)
  741 
  742         /* Find available channels */
  743         switch (country_code) {
  744         case COUNTRY_MMK2:      /* 1-14 */
  745                 ADD_CHANNEL(ic, 14);
  746                 /*FALLTHROUGH*/
  747         case COUNTRY_ETSI:      /* 1-13 */
  748                 for (i = 1; i <= 13; i++)
  749                         ADD_CHANNEL(ic, i);
  750                 break;
  751         case COUNTRY_FCC:       /* 1-11 */
  752         case COUNTRY_IC:        /* 1-11 */
  753                 for (i = 1; i <= 11; i++)
  754                         ADD_CHANNEL(ic, i);
  755                 break;
  756         case COUNTRY_MMK:       /* 14 */
  757                 ADD_CHANNEL(ic, 14);
  758                 break;
  759         case COUNTRY_FRANCE:    /* 10-13 */
  760                 for (i = 10; i <= 13; i++)
  761                         ADD_CHANNEL(ic, i);
  762                 break;
  763         default:        /* assume channels 10-11 */
  764         case COUNTRY_SPAIN:     /* 10-11 */
  765                 for (i = 10; i <= 11; i++)
  766                         ADD_CHANNEL(ic, i);
  767                 break;
  768         }
  769 
  770         /* Read the MAC address. */
  771         reg = ATW_READ(sc, ATW_PAR0);
  772         ic->ic_myaddr[0] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB0_MASK);
  773         ic->ic_myaddr[1] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB1_MASK);
  774         ic->ic_myaddr[2] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB2_MASK);
  775         ic->ic_myaddr[3] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB3_MASK);
  776         reg = ATW_READ(sc, ATW_PAR1);
  777         ic->ic_myaddr[4] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB4_MASK);
  778         ic->ic_myaddr[5] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB5_MASK);
  779 
  780         if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
  781                 printf(" could not get mac address, attach failed\n");
  782                 return;
  783         }
  784 
  785         printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
  786 
  787         memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
  788         ifp->if_softc = sc;
  789         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
  790         ifp->if_ioctl = atw_ioctl;
  791         ifp->if_start = atw_start;
  792         ifp->if_watchdog = atw_watchdog;
  793 
  794         ic->ic_phytype = IEEE80211_T_DS;
  795         ic->ic_opmode = IEEE80211_M_STA;
  796         ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
  797 #ifndef IEEE80211_STA_ONLY
  798         ic->ic_caps |= IEEE80211_C_IBSS;
  799 #endif
  800         ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;       
  801 
  802         /*
  803          * Call MI attach routines.
  804          */
  805 
  806         if_attach(ifp);
  807         ieee80211_ifattach(ifp);
  808 
  809         sc->sc_newstate = ic->ic_newstate;
  810         ic->ic_newstate = atw_newstate;
  811 
  812 #ifndef IEEE80211_STA_ONLY
  813         sc->sc_recv_mgmt = ic->ic_recv_mgmt;
  814         ic->ic_recv_mgmt = atw_recv_mgmt;
  815 #endif
  816 
  817         sc->sc_node_free = ic->ic_node_free;
  818         ic->ic_node_free = atw_node_free;
  819 
  820         sc->sc_node_alloc = ic->ic_node_alloc;
  821         ic->ic_node_alloc = atw_node_alloc;
  822 
  823         /* possibly we should fill in our own sc_send_prresp, since
  824          * the ADM8211 is probably sending probe responses in ad hoc
  825          * mode.
  826          */
  827 
  828         /* complete initialization */
  829         ieee80211_media_init(ifp, atw_media_change, atw_media_status);
  830         timeout_set(&sc->sc_scan_to, atw_next_scan, sc);
  831 
  832 #if NBPFILTER > 0
  833         bpfattach(&sc->sc_radiobpf, ifp, DLT_IEEE802_11_RADIO,
  834             sizeof(struct ieee80211_frame) + 64);
  835 #endif
  836 
  837         memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
  838         sc->sc_rxtap.ar_ihdr.it_len = sizeof(sc->sc_rxtapu);
  839         sc->sc_rxtap.ar_ihdr.it_present = ATW_RX_RADIOTAP_PRESENT;
  840 
  841         memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
  842         sc->sc_txtap.at_ihdr.it_len = sizeof(sc->sc_txtapu);
  843         sc->sc_txtap.at_ihdr.it_present = ATW_TX_RADIOTAP_PRESENT;
  844 
  845         return;
  846 
  847         /*
  848          * Free any resources we've allocated during the failed attach
  849          * attempt.  Do this in reverse order and fall through.
  850          */
  851  fail_5:
  852         for (i = 0; i < ATW_NRXDESC; i++) {
  853                 if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
  854                         continue;
  855                 bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
  856         }
  857  fail_4:
  858         for (i = 0; i < ATW_TXQUEUELEN; i++) {
  859                 if (sc->sc_txsoft[i].txs_dmamap == NULL)
  860                         continue;
  861                 bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
  862         }
  863         bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
  864  fail_3:
  865         bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
  866  fail_2:
  867         bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
  868             sizeof(struct atw_control_data));
  869  fail_1:
  870         bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
  871  fail_0:
  872         return;
  873 }
  874 
  875 struct ieee80211_node *
  876 atw_node_alloc(struct ieee80211com *ic)
  877 {
  878         struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
  879         struct ieee80211_node *ni = (*sc->sc_node_alloc)(ic);
  880 
  881         DPRINTF(sc, ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
  882         return ni;
  883 }
  884 
  885 void
  886 atw_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
  887 {
  888         struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
  889 
  890         DPRINTF(sc, ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
  891             ether_sprintf(ni->ni_bssid)));
  892         (*sc->sc_node_free)(ic, ni);
  893 }
  894 
  895 
  896 static void
  897 atw_test1_reset(struct atw_softc *sc)
  898 {
  899         switch (sc->sc_rev) {
  900         case ATW_REVISION_BA:
  901                 if (1 /* XXX condition on transceiver type */) {
  902                         ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
  903                 }
  904                 break;
  905         case ATW_REVISION_CA:
  906                 ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
  907                 break;
  908         default:
  909                 break;
  910         }
  911 }
  912 
  913 /*
  914  * atw_reset:
  915  *
  916  *      Perform a soft reset on the ADM8211.
  917  */
  918 void
  919 atw_reset(struct atw_softc *sc)
  920 {
  921         int i;
  922         uint32_t lpc;
  923 
  924         ATW_WRITE(sc, ATW_NAR, 0x0);
  925         DELAY(20 * 1000);
  926 
  927         /* Reference driver has a cryptic remark indicating that this might
  928          * power-on the chip.  I know that it turns off power-saving....
  929          */
  930         ATW_WRITE(sc, ATW_FRCTL, 0x0);
  931 
  932         ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
  933 
  934         for (i = 0; i < 50; i++) {
  935                 if (ATW_READ(sc, ATW_PAR) == 0)
  936                         break;
  937                 DELAY(1000);
  938         }
  939 
  940         /* ... and then pause 100ms longer for good measure. */
  941         DELAY(100 * 1000);
  942 
  943         DPRINTF2(sc, ("%s: atw_reset %d iterations\n", sc->sc_dev.dv_xname, i));
  944 
  945         if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
  946                 printf("%s: reset failed to complete\n", sc->sc_dev.dv_xname);
  947 
  948         atw_test1_reset(sc);
  949         /*
  950          * Initialize the PCI Access Register.
  951          */
  952         sc->sc_busmode = ATW_PAR_PBL_8DW;
  953 
  954         ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
  955         DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
  956             ATW_READ(sc, ATW_PAR), sc->sc_busmode));
  957 
  958         /* Turn off maximum power saving, etc.
  959          *
  960          * XXX Following example of reference driver, should I set
  961          * an AID of 1?  It didn't seem to help....
  962          */
  963         ATW_WRITE(sc, ATW_FRCTL, 0x0);
  964 
  965         DELAY(100 * 1000);
  966 
  967         /* Recall EEPROM. */
  968         ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
  969 
  970         DELAY(10 * 1000);
  971 
  972         lpc = ATW_READ(sc, ATW_LPC);
  973 
  974         DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
  975 
  976         /* A reset seems to affect the SRAM contents, so put them into
  977          * a known state.
  978          */
  979         atw_clear_sram(sc);
  980 
  981         memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
  982 }
  983 
  984 void
  985 atw_clear_sram(struct atw_softc *sc)
  986 {
  987         memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
  988         /* XXX not for revision 0x20. */
  989         atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
  990 }
  991 
  992 /* TBD atw_init
  993  *
  994  * set MAC based on ic->ic_bss->myaddr
  995  * write WEP keys
  996  * set TX rate
  997  */
  998 
  999 /* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
 1000  * without receiving a beacon with the preferred BSSID & SSID.
 1001  * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
 1002  */
 1003 void
 1004 atw_wcsr_init(struct atw_softc *sc)
 1005 {
 1006         uint32_t wcsr;
 1007 
 1008         wcsr = ATW_READ(sc, ATW_WCSR);
 1009         wcsr &= ~(ATW_WCSR_BLN_MASK|ATW_WCSR_LSOE|ATW_WCSR_MPRE|ATW_WCSR_LSOE);
 1010         wcsr |= LSHIFT(7, ATW_WCSR_BLN_MASK);
 1011         ATW_WRITE(sc, ATW_WCSR, wcsr);  /* XXX resets wake-up status bits */
 1012 
 1013         DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
 1014             sc->sc_dev.dv_xname, __func__, ATW_READ(sc, ATW_WCSR)));
 1015 }
 1016 
 1017 /* Turn off power management.  Set Rx store-and-forward mode. */
 1018 void
 1019 atw_cmdr_init(struct atw_softc *sc)
 1020 {
 1021         uint32_t cmdr;
 1022         cmdr = ATW_READ(sc, ATW_CMDR);
 1023         cmdr &= ~ATW_CMDR_APM;
 1024         cmdr |= ATW_CMDR_RTE;
 1025         cmdr &= ~ATW_CMDR_DRT_MASK;
 1026         cmdr |= ATW_CMDR_DRT_SF;
 1027 
 1028         ATW_WRITE(sc, ATW_CMDR, cmdr);
 1029 }
 1030 
 1031 void
 1032 atw_tofs2_init(struct atw_softc *sc)
 1033 {
 1034         uint32_t tofs2;
 1035         /* XXX this magic can probably be figured out from the RFMD docs */
 1036 #ifndef ATW_REFSLAVE
 1037         tofs2 = LSHIFT(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
 1038               LSHIFT(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
 1039               LSHIFT(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
 1040               LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
 1041               LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
 1042               LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
 1043               LSHIFT(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
 1044               LSHIFT(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
 1045 #else
 1046         /* XXX new magic from reference driver source */
 1047         tofs2 = LSHIFT(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
 1048               LSHIFT(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
 1049               LSHIFT(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
 1050               LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
 1051               LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
 1052               LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
 1053               LSHIFT(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
 1054               LSHIFT(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
 1055 #endif
 1056         ATW_WRITE(sc, ATW_TOFS2, tofs2);
 1057 }
 1058 
 1059 void
 1060 atw_nar_init(struct atw_softc *sc)
 1061 {
 1062         ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF|ATW_NAR_PB);
 1063 }
 1064 
 1065 void
 1066 atw_txlmt_init(struct atw_softc *sc)
 1067 {
 1068         ATW_WRITE(sc, ATW_TXLMT, LSHIFT(512, ATW_TXLMT_MTMLT_MASK) |
 1069                                  LSHIFT(1, ATW_TXLMT_SRTYLIM_MASK));
 1070 }
 1071 
 1072 void
 1073 atw_test1_init(struct atw_softc *sc)
 1074 {
 1075         uint32_t test1;
 1076 
 1077         test1 = ATW_READ(sc, ATW_TEST1);
 1078         test1 &= ~(ATW_TEST1_DBGREAD_MASK|ATW_TEST1_CONTROL);
 1079         /* XXX magic 0x1 */
 1080         test1 |= LSHIFT(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
 1081         ATW_WRITE(sc, ATW_TEST1, test1);
 1082 }
 1083 
 1084 void
 1085 atw_rf_reset(struct atw_softc *sc)
 1086 {
 1087         /* XXX this resets an Intersil RF front-end? */
 1088         /* TBD condition on Intersil RFType? */
 1089         ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
 1090         DELAY(10 * 1000);
 1091         ATW_WRITE(sc, ATW_SYNRF, 0);
 1092         DELAY(5 * 1000);
 1093 }
 1094 
 1095 /* Set 16 TU max duration for the contention-free period (CFP). */
 1096 void
 1097 atw_cfp_init(struct atw_softc *sc)
 1098 {
 1099         uint32_t cfpp;
 1100 
 1101         cfpp = ATW_READ(sc, ATW_CFPP);
 1102         cfpp &= ~ATW_CFPP_CFPMD;
 1103         cfpp |= LSHIFT(16, ATW_CFPP_CFPMD);
 1104         ATW_WRITE(sc, ATW_CFPP, cfpp);
 1105 }
 1106 
 1107 void
 1108 atw_tofs0_init(struct atw_softc *sc)
 1109 {
 1110         /* XXX I guess that the Cardbus clock is 22MHz?
 1111          * I am assuming that the role of ATW_TOFS0_USCNT is
 1112          * to divide the bus clock to get a 1MHz clock---the datasheet is not
 1113          * very clear on this point. It says in the datasheet that it is
 1114          * possible for the ADM8211 to accommodate bus speeds between 22MHz
 1115          * and 33MHz; maybe this is the way? I see a binary-only driver write
 1116          * these values. These values are also the power-on default.
 1117          */
 1118         ATW_WRITE(sc, ATW_TOFS0,
 1119             LSHIFT(22, ATW_TOFS0_USCNT_MASK) |
 1120             ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
 1121 }
 1122 
 1123 /* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
 1124 void
 1125 atw_ifs_init(struct atw_softc *sc)
 1126 {
 1127         uint32_t ifst;
 1128         /* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
 1129          * Go figure.
 1130          */
 1131         ifst = LSHIFT(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
 1132             LSHIFT(22 * 5 /* IEEE80211_DUR_DS_SIFS */ /* # of 22MHz cycles */,
 1133                    ATW_IFST_SIFS_MASK) |
 1134             LSHIFT(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
 1135             LSHIFT(0x64 /* IEEE80211_DUR_DS_EIFS */, ATW_IFST_EIFS_MASK);
 1136 
 1137         ATW_WRITE(sc, ATW_IFST, ifst);
 1138 }
 1139 
 1140 void
 1141 atw_response_times_init(struct atw_softc *sc)
 1142 {
 1143         /* XXX More magic. Relates to ACK timing?  The datasheet seems to
 1144          * indicate that the MAC expects at least SIFS + MIRT microseconds
 1145          * to pass after it transmits a frame that requires a response;
 1146          * it waits at most SIFS + MART microseconds for the response.
 1147          * Surely this is not the ACK timeout?
 1148          */
 1149         ATW_WRITE(sc, ATW_RSPT, LSHIFT(0xffff, ATW_RSPT_MART_MASK) |
 1150             LSHIFT(0xff, ATW_RSPT_MIRT_MASK));
 1151 }
 1152 
 1153 /* Set up the MMI read/write addresses for the baseband. The Tx/Rx
 1154  * engines read and write baseband registers after Rx and before
 1155  * Tx, respectively.
 1156  */
 1157 void
 1158 atw_bbp_io_init(struct atw_softc *sc)
 1159 {
 1160         uint32_t mmiraddr2;
 1161 
 1162         /* XXX The reference driver does this, but is it *really*
 1163          * necessary?
 1164          */
 1165         switch (sc->sc_rev) {
 1166         case ATW_REVISION_AB:
 1167         case ATW_REVISION_AF:
 1168                 mmiraddr2 = 0x0;
 1169                 break;
 1170         default:
 1171                 mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
 1172                 mmiraddr2 &=
 1173                     ~(ATW_MMIRADDR2_PROREXT|ATW_MMIRADDR2_PRORLEN_MASK);
 1174                 break;
 1175         }
 1176 
 1177         switch (sc->sc_bbptype) {
 1178         case ATW_BBPTYPE_INTERSIL:
 1179                 ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
 1180                 ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
 1181                 mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
 1182                 break;
 1183         case ATW_BBPTYPE_MARVEL:
 1184                 /* TBD find out the Marvel settings. */
 1185                 break;
 1186         case ATW_BBPTYPE_RFMD:
 1187         default:
 1188                 ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
 1189                 ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
 1190                 mmiraddr2 |= ATW_MMIRADDR2_RFMD;
 1191                 break;
 1192         }
 1193         ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
 1194 
 1195         atw_si4126_init(sc);
 1196 
 1197         ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
 1198 }
 1199 
 1200 void
 1201 atw_si4126_init(struct atw_softc *sc)
 1202 {
 1203         switch (sc->sc_rftype) {
 1204         case ATW_RFTYPE_RFMD:
 1205                 if (sc->sc_rev >= ATW_REVISION_BA) {
 1206                         atw_si4126_write(sc, 0x1f, 0x00000);
 1207                         atw_si4126_write(sc, 0x0c, 0x3001f);
 1208                         atw_si4126_write(sc, SI4126_GAIN, 0x29c03);
 1209                         atw_si4126_write(sc, SI4126_RF1N, 0x1ff6f);
 1210                         atw_si4126_write(sc, SI4126_RF2N, 0x29403);
 1211                         atw_si4126_write(sc, SI4126_RF2R, 0x1456f);
 1212                         atw_si4126_write(sc, 0x09, 0x10050);
 1213                         atw_si4126_write(sc, SI4126_IFR, 0x3fff8);
 1214                 }
 1215                 break;
 1216         default:
 1217                 break;
 1218         }
 1219 }
 1220 
 1221 /*
 1222  * atw_init:            [ ifnet interface function ]
 1223  *
 1224  *      Initialize the interface.  Must be called at splnet().
 1225  */
 1226 int
 1227 atw_init(struct ifnet *ifp)
 1228 {
 1229         struct atw_softc *sc = ifp->if_softc;
 1230         struct ieee80211com *ic = &sc->sc_ic;
 1231         struct atw_txsoft *txs;
 1232         struct atw_rxsoft *rxs;
 1233         int i, error = 0;
 1234 
 1235         if ((error = atw_enable(sc)) != 0)
 1236                 goto out;
 1237 
 1238         /*
 1239          * Cancel any pending I/O. This also resets.
 1240          */
 1241         atw_stop(ifp, 0);
 1242 
 1243         ic->ic_bss->ni_chan = ic->ic_ibss_chan;
 1244         DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
 1245             __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
 1246             ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
 1247 
 1248         atw_wcsr_init(sc);
 1249 
 1250         atw_cmdr_init(sc);
 1251 
 1252         /* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
 1253          *
 1254          * XXX Set transmit power for ATIM, RTS, Beacon.
 1255          */
 1256         ATW_WRITE(sc, ATW_PLCPHD, LSHIFT(10, ATW_PLCPHD_SIGNAL_MASK) |
 1257             LSHIFT(0xb0, ATW_PLCPHD_SERVICE_MASK));
 1258 
 1259         atw_tofs2_init(sc);
 1260 
 1261         atw_nar_init(sc);
 1262 
 1263         atw_txlmt_init(sc);
 1264 
 1265         atw_test1_init(sc);
 1266 
 1267         atw_rf_reset(sc);
 1268 
 1269         atw_cfp_init(sc);
 1270 
 1271         atw_tofs0_init(sc);
 1272 
 1273         atw_ifs_init(sc);
 1274 
 1275         /* XXX Fall asleep after one second of inactivity.
 1276          * XXX A frame may only dribble in for 65536us.
 1277          */
 1278         ATW_WRITE(sc, ATW_RMD,
 1279             LSHIFT(1, ATW_RMD_PCNT) | LSHIFT(0xffff, ATW_RMD_RMRD_MASK));
 1280 
 1281         atw_response_times_init(sc);
 1282 
 1283         atw_bbp_io_init(sc);
 1284 
 1285         ATW_WRITE(sc, ATW_STSR, 0xffffffff);
 1286 
 1287         if ((error = atw_rf3000_init(sc)) != 0)
 1288                 goto out;
 1289 
 1290         ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
 1291         DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
 1292             ATW_READ(sc, ATW_PAR), sc->sc_busmode));
 1293 
 1294         /*
 1295          * Initialize the transmit descriptor ring.
 1296          */
 1297         memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
 1298         for (i = 0; i < ATW_NTXDESC; i++) {
 1299                 sc->sc_txdescs[i].at_ctl = 0;
 1300                 /* no transmit chaining */
 1301                 sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
 1302                 sc->sc_txdescs[i].at_buf2 =
 1303                     htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
 1304         }
 1305         /* use ring mode */
 1306         sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
 1307         ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
 1308             BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 1309         sc->sc_txfree = ATW_NTXDESC;
 1310         sc->sc_txnext = 0;
 1311 
 1312         /*
 1313          * Initialize the transmit job descriptors.
 1314          */
 1315         SIMPLEQ_INIT(&sc->sc_txfreeq);
 1316         SIMPLEQ_INIT(&sc->sc_txdirtyq);
 1317         for (i = 0; i < ATW_TXQUEUELEN; i++) {
 1318                 txs = &sc->sc_txsoft[i];
 1319                 txs->txs_mbuf = NULL;
 1320                 SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
 1321         }
 1322 
 1323         /*
 1324          * Initialize the receive descriptor and receive job
 1325          * descriptor rings.
 1326          */
 1327         for (i = 0; i < ATW_NRXDESC; i++) {
 1328                 rxs = &sc->sc_rxsoft[i];
 1329                 if (rxs->rxs_mbuf == NULL) {
 1330                         if ((error = atw_add_rxbuf(sc, i)) != 0) {
 1331                                 printf("%s: unable to allocate or map rx "
 1332                                     "buffer %d, error = %d\n",
 1333                                     sc->sc_dev.dv_xname, i, error);
 1334                                 /*
 1335                                  * XXX Should attempt to run with fewer receive
 1336                                  * XXX buffers instead of just failing.
 1337                                  */
 1338                                 atw_rxdrain(sc);
 1339                                 goto out;
 1340                         }
 1341                 } else
 1342                         ATW_INIT_RXDESC(sc, i);
 1343         }
 1344         sc->sc_rxptr = 0;
 1345 
 1346         /*
 1347          * Initialize the interrupt mask and enable interrupts.
 1348          */
 1349         /* normal interrupts */
 1350         sc->sc_inten =  ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
 1351             ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
 1352 
 1353         /* abnormal interrupts */
 1354         sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
 1355             ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
 1356             ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
 1357 
 1358         sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
 1359             ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
 1360         sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
 1361         sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
 1362             ATW_INTR_TRT;
 1363 
 1364         sc->sc_linkint_mask &= sc->sc_inten;
 1365         sc->sc_rxint_mask &= sc->sc_inten;
 1366         sc->sc_txint_mask &= sc->sc_inten;
 1367 
 1368         ATW_WRITE(sc, ATW_IER, sc->sc_inten);
 1369         ATW_WRITE(sc, ATW_STSR, 0xffffffff);
 1370 
 1371         DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
 1372             sc->sc_dev.dv_xname, ATW_READ(sc, ATW_IER), sc->sc_inten));
 1373 
 1374         /*
 1375          * Give the transmit and receive rings to the ADM8211.
 1376          */
 1377         ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
 1378         ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
 1379 
 1380         sc->sc_txthresh = 0;
 1381         sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
 1382             sc->sc_txth[sc->sc_txthresh].txth_opmode;
 1383 
 1384         /* common 802.11 configuration */
 1385         ic->ic_flags &= ~IEEE80211_F_IBSSON;
 1386         switch (ic->ic_opmode) {
 1387         case IEEE80211_M_STA:
 1388                 break;
 1389 #ifndef IEEE80211_STA_ONLY
 1390         case IEEE80211_M_AHDEMO: /* XXX */
 1391         case IEEE80211_M_IBSS:
 1392                 ic->ic_flags |= IEEE80211_F_IBSSON;
 1393                 /*FALLTHROUGH*/
 1394 #endif
 1395         default: /* XXX */
 1396                 break;
 1397         }
 1398 
 1399 #ifndef IEEE80211_STA_ONLY
 1400         switch (ic->ic_opmode) {
 1401         case IEEE80211_M_AHDEMO:
 1402                 ic->ic_bss->ni_intval = ic->ic_lintval;
 1403                 ic->ic_bss->ni_rssi = 0;
 1404                 ic->ic_bss->ni_rstamp = 0;
 1405                 break;
 1406         default:                                        /* XXX */
 1407                 break;
 1408         }
 1409 #endif
 1410         sc->sc_wepctl = 0;
 1411 
 1412         atw_write_ssid(sc);
 1413         atw_write_sup_rates(sc);
 1414         if (ic->ic_caps & IEEE80211_C_WEP)
 1415                 atw_write_wep(sc);
 1416 
 1417         ic->ic_state = IEEE80211_S_INIT;
 1418 
 1419         /*
 1420          * Set the receive filter.  This will start the transmit and
 1421          * receive processes.
 1422          */
 1423         atw_filter_setup(sc);
 1424 
 1425         /*
 1426          * Start the receive process.
 1427          */
 1428         ATW_WRITE(sc, ATW_RDR, 0x1);
 1429 
 1430         /*
 1431          * Note that the interface is now running.
 1432          */
 1433         ifp->if_flags |= IFF_RUNNING;
 1434         ifq_clr_oactive(&ifp->if_snd);
 1435 
 1436         /* send no beacons, yet. */
 1437         atw_start_beacon(sc, 0);
 1438 
 1439         if (ic->ic_opmode == IEEE80211_M_MONITOR)
 1440                 error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 1441         else
 1442                 error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 1443  out:
 1444         if (error) {
 1445                 ifp->if_flags &= ~IFF_RUNNING;
 1446                 ifq_clr_oactive(&ifp->if_snd);
 1447                 ifp->if_timer = 0;
 1448                 printf("%s: interface not running\n", sc->sc_dev.dv_xname);
 1449         }
 1450 #ifdef ATW_DEBUG
 1451         atw_print_regs(sc, "end of init");
 1452 #endif /* ATW_DEBUG */
 1453 
 1454         return (error);
 1455 }
 1456 
 1457 /* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
 1458  *           0: MAC control of RF3000/Si4126.
 1459  *
 1460  * Applies power, or selects RF front-end? Sets reset condition.
 1461  *
 1462  * TBD support non-RFMD BBP, non-SiLabs synth.
 1463  */
 1464 void
 1465 atw_bbp_io_enable(struct atw_softc *sc, int enable)
 1466 {
 1467         if (enable) {
 1468                 ATW_WRITE(sc, ATW_SYNRF,
 1469                     ATW_SYNRF_SELRF|ATW_SYNRF_PE1|ATW_SYNRF_PHYRST);
 1470                 DELAY(atw_bbp_io_enable_delay);
 1471         } else {
 1472                 ATW_WRITE(sc, ATW_SYNRF, 0);
 1473                 DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
 1474         }
 1475 }
 1476 
 1477 int
 1478 atw_tune(struct atw_softc *sc)
 1479 {
 1480         int rc;
 1481         u_int chan;
 1482         struct ieee80211com *ic = &sc->sc_ic;
 1483 
 1484         chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 1485         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
 1486                 return 0;
 1487 
 1488         if (chan == sc->sc_cur_chan)
 1489                 return 0;
 1490 
 1491         DPRINTF(sc, ("%s: chan %d -> %d\n", sc->sc_dev.dv_xname,
 1492             sc->sc_cur_chan, chan));
 1493 
 1494         atw_idle(sc, ATW_NAR_SR|ATW_NAR_ST);
 1495 
 1496         atw_si4126_tune(sc, chan);
 1497         if ((rc = atw_rf3000_tune(sc, chan)) != 0)
 1498                 printf("%s: failed to tune channel %d\n", sc->sc_dev.dv_xname,
 1499                     chan);
 1500 
 1501         ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
 1502         DELAY(20 * 1000);
 1503         ATW_WRITE(sc, ATW_RDR, 0x1);
 1504 
 1505         if (rc == 0)
 1506                 sc->sc_cur_chan = chan;
 1507 
 1508         return rc;
 1509 }
 1510 
 1511 #ifdef ATW_SYNDEBUG
 1512 void
 1513 atw_si4126_print(struct atw_softc *sc)
 1514 {
 1515         struct ifnet *ifp = &sc->sc_ic.ic_if;
 1516         u_int addr, val;
 1517 
 1518         if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
 1519                 return;
 1520 
 1521         for (addr = 0; addr <= 8; addr++) {
 1522                 printf("%s: synth[%d] = ", sc->sc_dev.dv_xname, addr);
 1523                 if (atw_si4126_read(sc, addr, &val) == 0) {
 1524                         printf("<unknown> (quitting print-out)\n");
 1525                         break;
 1526                 }
 1527                 printf("%05x\n", val);
 1528         }
 1529 }
 1530 #endif /* ATW_SYNDEBUG */
 1531 
 1532 /* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
 1533  *
 1534  * The RF/IF synthesizer produces two reference frequencies for
 1535  * the RF2948B transceiver.  The first frequency the RF2948B requires
 1536  * is two times the so-called "intermediate frequency" (IF). Since
 1537  * a SAW filter on the radio fixes the IF at 374MHz, I program the
 1538  * Si4126 to generate IF LO = 374MHz x 2 = 748MHz.  The second
 1539  * frequency required by the transceiver is the radio frequency
 1540  * (RF). This is a superheterodyne transceiver; for f(chan) the
 1541  * center frequency of the channel we are tuning, RF = f(chan) -
 1542  * IF.
 1543  *
 1544  * XXX I am told by SiLabs that the Si4126 will accept a broader range
 1545  * of XIN than the 2-25MHz mentioned by the datasheet, even *without*
 1546  * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
 1547  * works, but I have still programmed for XINDIV2 = 1 to be safe.
 1548  */
 1549 void
 1550 atw_si4126_tune(struct atw_softc *sc, u_int chan)
 1551 {
 1552         u_int mhz;
 1553         u_int R;
 1554         u_int32_t gpio;
 1555         u_int16_t gain;
 1556 
 1557 #ifdef ATW_SYNDEBUG
 1558         atw_si4126_print(sc);
 1559 #endif /* ATW_SYNDEBUG */
 1560 
 1561         if (sc->sc_rev >= ATW_REVISION_BA) {
 1562                 atw_si4126_write(sc, SI4126_MAIN, 0x04007);
 1563                 atw_si4126_write(sc, SI4126_POWER, 0x00033);
 1564                 atw_si4126_write(sc, SI4126_IFN,
 1565                     atw_rfmd2958_ifn[chan - 1]);
 1566                 atw_si4126_write(sc, SI4126_RF1R,
 1567                     atw_rfmd2958_rf1r[chan - 1]);
 1568 #ifdef NOTYET
 1569                 /* set TX POWER? */
 1570                 atw_si4126_write(sc, 0x0a,
 1571                     (sc->sc_srom[ATW_SR_CSR20] & mask) |
 1572                     power << 9);
 1573 #endif
 1574                 /* set TX GAIN */
 1575                 atw_si4126_write(sc, 0x09, 0x00050 |
 1576                     sc->sc_srom[ATW_SR_TXPOWER(chan - 1)]);
 1577                 /* wait 100us from power-up for RF, IF to settle */
 1578                 DELAY(100);
 1579 
 1580                 return;
 1581         }
 1582 
 1583         if (chan == 14)
 1584                 mhz = 2484;
 1585         else
 1586                 mhz = 2412 + 5 * (chan - 1);
 1587 
 1588         /* Tune IF to 748MHz to suit the IF LO input of the
 1589          * RF2494B, which is 2 x IF. No need to set an IF divider
 1590          * because an IF in 526MHz - 952MHz is allowed.
 1591          *
 1592          * XIN is 44.000MHz, so divide it by two to get allowable
 1593          * range of 2-25MHz. SiLabs tells me that this is not
 1594          * strictly necessary.
 1595          */
 1596 
 1597         if (atw_xindiv2)
 1598                 R = 44;
 1599         else
 1600                 R = 88;
 1601 
 1602         /* Power-up RF, IF synthesizers. */
 1603         atw_si4126_write(sc, SI4126_POWER,
 1604             SI4126_POWER_PDIB|SI4126_POWER_PDRB);
 1605 
 1606         /* set LPWR, too? */
 1607         atw_si4126_write(sc, SI4126_MAIN,
 1608             (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
 1609 
 1610         /* Set the phase-locked loop gain.  If RF2 N > 2047, then
 1611          * set KP2 to 1.
 1612          *
 1613          * REFDIF This is different from the reference driver, which
 1614          * always sets SI4126_GAIN to 0.
 1615          */
 1616         gain = LSHIFT(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
 1617 
 1618         atw_si4126_write(sc, SI4126_GAIN, gain);
 1619 
 1620         /* XIN = 44MHz.
 1621          *
 1622          * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
 1623          * R = 44 so that 1496/(2 * 44) * 44MHz = 748MHz.
 1624          *
 1625          * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
 1626          * so that 1496/88 * 44MHz = 748MHz.
 1627          */
 1628         atw_si4126_write(sc, SI4126_IFN, 1496);
 1629 
 1630         atw_si4126_write(sc, SI4126_IFR, R);
 1631 
 1632 #ifndef ATW_REFSLAVE
 1633         /* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
 1634          * then RF1 becomes the active RF synthesizer, even on the Si4126,
 1635          * which has no RF1!
 1636          */
 1637         atw_si4126_write(sc, SI4126_RF1R, R);
 1638 
 1639         atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
 1640 #endif
 1641 
 1642         /* N/R * XIN = RF. XIN = 44MHz. We desire RF = mhz - IF,
 1643          * where IF = 374MHz.  Let's divide XIN to 1MHz. So R = 44.
 1644          * Now let's multiply it to mhz. So mhz - IF = N.
 1645          */
 1646         atw_si4126_write(sc, SI4126_RF2R, R);
 1647 
 1648         atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
 1649 
 1650         /* wait 100us from power-up for RF, IF to settle */
 1651         DELAY(100);
 1652 
 1653         gpio = ATW_READ(sc, ATW_GPIO);
 1654         gpio &= ~(ATW_GPIO_EN_MASK|ATW_GPIO_O_MASK|ATW_GPIO_I_MASK);
 1655         gpio |= LSHIFT(1, ATW_GPIO_EN_MASK);
 1656 
 1657         if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
 1658                 /* Set a Prism RF front-end to a special mode for channel 14?
 1659                  *
 1660                  * Apparently the SMC2635W needs this, although I don't think
 1661                  * it has a Prism RF.
 1662                  */
 1663                 gpio |= LSHIFT(1, ATW_GPIO_O_MASK);
 1664         }
 1665         ATW_WRITE(sc, ATW_GPIO, gpio);
 1666 
 1667 #ifdef ATW_SYNDEBUG
 1668         atw_si4126_print(sc);
 1669 #endif /* ATW_SYNDEBUG */
 1670 }
 1671 
 1672 /* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
 1673  * diversity.
 1674  *
 1675  * !!!
 1676  * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
 1677  * !!!
 1678  */
 1679 int
 1680 atw_rf3000_init(struct atw_softc *sc)
 1681 {
 1682         int rc = 0;
 1683 
 1684         atw_bbp_io_enable(sc, 1);
 1685 
 1686         /* CCA is acquisition sensitive */
 1687         rc = atw_rf3000_write(sc, RF3000_CCACTL,
 1688             LSHIFT(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
 1689 
 1690         if (rc != 0)
 1691                 goto out;
 1692 
 1693         /* enable diversity */
 1694         rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
 1695 
 1696         if (rc != 0)
 1697                 goto out;
 1698 
 1699         /* sensible setting from a binary-only driver */
 1700         rc = atw_rf3000_write(sc, RF3000_GAINCTL,
 1701             LSHIFT(0x1d, RF3000_GAINCTL_TXVGC_MASK));
 1702 
 1703         if (rc != 0)
 1704                 goto out;
 1705 
 1706         /* magic from a binary-only driver */
 1707         rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
 1708             LSHIFT(0x38, RF3000_LOGAINCAL_CAL_MASK));
 1709 
 1710         if (rc != 0)
 1711                 goto out;
 1712 
 1713         rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
 1714 
 1715         if (rc != 0)
 1716                 goto out;
 1717 
 1718         /*
 1719          * XXX Reference driver remarks that Abocom sets this to 50.
 1720          * Meaning 0x50, I think....  50 = 0x32, which would set a bit
 1721          * in the "reserved" area of register RF3000_OPTIONS1.
 1722          */
 1723         rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
 1724 
 1725         if (rc != 0)
 1726                 goto out;
 1727 
 1728         rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
 1729 
 1730         if (rc != 0)
 1731                 goto out;
 1732 
 1733 out:
 1734         atw_bbp_io_enable(sc, 0);
 1735         return rc;
 1736 }
 1737 
 1738 #ifdef ATW_BBPDEBUG
 1739 void
 1740 atw_rf3000_print(struct atw_softc *sc)
 1741 {
 1742         struct ifnet *ifp = &sc->sc_ic.ic_if;
 1743         u_int addr, val;
 1744 
 1745         if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
 1746                 return;
 1747 
 1748         for (addr = 0x01; addr <= 0x15; addr++) {
 1749                 printf("%s: bbp[%d] = \n", sc->sc_dev.dv_xname, addr);
 1750                 if (atw_rf3000_read(sc, addr, &val) != 0) {
 1751                         printf("<unknown> (quitting print-out)\n");
 1752                         break;
 1753                 }
 1754                 printf("%08x\n", val);
 1755         }
 1756 }
 1757 #endif /* ATW_BBPDEBUG */
 1758 
 1759 /* Set the power settings on the BBP for channel `chan'. */
 1760 int
 1761 atw_rf3000_tune(struct atw_softc *sc, u_int chan)
 1762 {
 1763         int rc = 0;
 1764         u_int32_t reg;
 1765         u_int16_t txpower, lpf_cutoff, lna_gs_thresh;
 1766 
 1767         txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
 1768         lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
 1769         lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
 1770 
 1771         /* odd channels: LSB, even channels: MSB */
 1772         if (chan % 2 == 1) {
 1773                 txpower &= 0xFF;
 1774                 lpf_cutoff &= 0xFF;
 1775                 lna_gs_thresh &= 0xFF;
 1776         } else {
 1777                 txpower >>= 8;
 1778                 lpf_cutoff >>= 8;
 1779                 lna_gs_thresh >>= 8;
 1780         }
 1781 
 1782 #ifdef ATW_BBPDEBUG
 1783         atw_rf3000_print(sc);
 1784 #endif /* ATW_BBPDEBUG */
 1785 
 1786         DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
 1787             "lna_gs_thresh %02x\n",
 1788             sc->sc_dev.dv_xname, chan, txpower, lpf_cutoff, lna_gs_thresh));
 1789 
 1790         atw_bbp_io_enable(sc, 1);
 1791 
 1792         if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
 1793             LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
 1794                 goto out;
 1795 
 1796         if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
 1797                 goto out;
 1798 
 1799         if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
 1800                 goto out;
 1801 
 1802         if ((rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0)) != 0)
 1803                 goto out;
 1804 
 1805         rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
 1806         if (rc != 0)
 1807                 goto out;
 1808 
 1809 #ifdef ATW_BBPDEBUG
 1810         atw_rf3000_print(sc);
 1811 #endif /* ATW_BBPDEBUG */
 1812 
 1813 out:
 1814         atw_bbp_io_enable(sc, 0);
 1815 
 1816         /* set beacon, rts, atim transmit power */
 1817         reg = ATW_READ(sc, ATW_PLCPHD);
 1818         reg &= ~ATW_PLCPHD_SERVICE_MASK;
 1819         reg |= LSHIFT(LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK),
 1820             ATW_PLCPHD_SERVICE_MASK);
 1821         ATW_WRITE(sc, ATW_PLCPHD, reg);
 1822         DELAY(2 * 1000);
 1823 
 1824         return rc;
 1825 }
 1826 
 1827 /* Write a register on the RF3000 baseband processor using the
 1828  * registers provided by the ADM8211 for this purpose.
 1829  *
 1830  * Return 0 on success.
 1831  */
 1832 int
 1833 atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
 1834 {
 1835         u_int32_t reg;
 1836         int i;
 1837 
 1838         reg = sc->sc_bbpctl_wr |
 1839              LSHIFT(val & 0xff, ATW_BBPCTL_DATA_MASK) |
 1840              LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
 1841 
 1842         for (i = 10; --i >= 0; ) {
 1843                 ATW_WRITE(sc, ATW_BBPCTL, reg);
 1844                 DELAY(2000);
 1845                 if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
 1846                         break;
 1847         }
 1848 
 1849         if (i < 0) {
 1850                 printf("%s: BBPCTL still busy\n", sc->sc_dev.dv_xname);
 1851                 return ETIMEDOUT;
 1852         }
 1853         return 0;
 1854 }
 1855 
 1856 /* Read a register on the RF3000 baseband processor using the registers
 1857  * the ADM8211 provides for this purpose.
 1858  *
 1859  * The 7-bit register address is addr.  Record the 8-bit data in the register
 1860  * in *val.
 1861  *
 1862  * Return 0 on success.
 1863  *
 1864  * XXX This does not seem to work. The ADM8211 must require more or
 1865  * different magic to read the chip than to write it. Possibly some
 1866  * of the magic I have derived from a binary-only driver concerns
 1867  * the "chip address" (see the RF3000 manual).
 1868  */
 1869 #ifdef ATW_BBPDEBUG
 1870 int
 1871 atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
 1872 {
 1873         u_int32_t reg;
 1874         int i;
 1875 
 1876         for (i = 1000; --i >= 0; ) {
 1877                 if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD|ATW_BBPCTL_WR) == 0)
 1878                         break;
 1879                 DELAY(100);
 1880         }
 1881 
 1882         if (i < 0) {
 1883                 printf("%s: start atw_rf3000_read, BBPCTL busy\n",
 1884                     sc->sc_dev.dv_xname);
 1885                 return ETIMEDOUT;
 1886         }
 1887 
 1888         reg = sc->sc_bbpctl_rd | LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
 1889 
 1890         ATW_WRITE(sc, ATW_BBPCTL, reg);
 1891 
 1892         for (i = 1000; --i >= 0; ) {
 1893                 DELAY(100);
 1894                 if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
 1895                         break;
 1896         }
 1897 
 1898         ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
 1899 
 1900         if (i < 0) {
 1901                 printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
 1902                     sc->sc_dev.dv_xname, reg);
 1903                 return ETIMEDOUT;
 1904         }
 1905         if (val != NULL)
 1906                 *val = MASK_AND_RSHIFT(reg, ATW_BBPCTL_DATA_MASK);
 1907         return 0;
 1908 }
 1909 #endif /* ATW_BBPDEBUG */
 1910 
 1911 /* Write a register on the Si4126 RF/IF synthesizer using the registers
 1912  * provided by the ADM8211 for that purpose.
 1913  *
 1914  * val is 18 bits of data, and val is the 4-bit address of the register.
 1915  *
 1916  * Return 0 on success.
 1917  */
 1918 void
 1919 atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
 1920 {
 1921         uint32_t bits, mask, reg;
 1922         int nbits;
 1923 
 1924         if (sc->sc_rev >= ATW_REVISION_BA) {
 1925                 nbits = 24;
 1926 
 1927                 val &= 0x3ffff;
 1928                 addr &= 0x1f;
 1929                 bits = val | (addr << 18);
 1930         } else {
 1931                 nbits = 22;
 1932 
 1933                 KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
 1934                 KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
 1935 
 1936                 bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
 1937                     LSHIFT(addr, SI4126_TWI_ADDR_MASK);
 1938         }
 1939 
 1940         reg = ATW_SYNRF_SELSYN;
 1941         /* reference driver: reset Si4126 serial bus to initial
 1942          * conditions?
 1943          */
 1944         ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
 1945         ATW_WRITE(sc, ATW_SYNRF, reg);
 1946 
 1947         for (mask = (1 << (nbits - 1)); mask != 0; mask >>= 1) {
 1948                 if ((bits & mask) != 0)
 1949                         reg |= ATW_SYNRF_SYNDATA;
 1950                 else
 1951                         reg &= ~ATW_SYNRF_SYNDATA;
 1952                 ATW_WRITE(sc, ATW_SYNRF, reg);
 1953                 ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
 1954                 ATW_WRITE(sc, ATW_SYNRF, reg);
 1955         }
 1956         ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
 1957         ATW_WRITE(sc, ATW_SYNRF, 0x0);
 1958 }
 1959 
 1960 /* Read 18-bit data from the 4-bit address addr in Si4126
 1961  * RF synthesizer and write the data to *val. Return 0 on success.
 1962  *
 1963  * XXX This does not seem to work. The ADM8211 must require more or
 1964  * different magic to read the chip than to write it.
 1965  */
 1966 #ifdef ATW_SYNDEBUG
 1967 int
 1968 atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
 1969 {
 1970         u_int32_t reg;
 1971         int i;
 1972 
 1973         KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
 1974 
 1975         for (i = 1000; --i >= 0; ) {
 1976                 if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD|ATW_SYNCTL_WR) == 0)
 1977                         break;
 1978                 DELAY(100);
 1979         }
 1980 
 1981         if (i < 0) {
 1982                 printf("%s: start atw_si4126_read, SYNCTL busy\n",
 1983                     sc->sc_dev.dv_xname);
 1984                 return ETIMEDOUT;
 1985         }
 1986 
 1987         reg = sc->sc_synctl_rd | LSHIFT(addr, ATW_SYNCTL_DATA_MASK);
 1988 
 1989         ATW_WRITE(sc, ATW_SYNCTL, reg);
 1990 
 1991         for (i = 1000; --i >= 0; ) {
 1992                 DELAY(100);
 1993                 if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
 1994                         break;
 1995         }
 1996 
 1997         ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
 1998 
 1999         if (i < 0) {
 2000                 printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
 2001                     sc->sc_dev.dv_xname, reg);
 2002                 return ETIMEDOUT;
 2003         }
 2004         if (val != NULL)
 2005                 *val = MASK_AND_RSHIFT(ATW_READ(sc, ATW_SYNCTL),
 2006                                        ATW_SYNCTL_DATA_MASK);
 2007         return 0;
 2008 }
 2009 #endif /* ATW_SYNDEBUG */
 2010 
 2011 /* XXX is the endianness correct? test. */
 2012 #define atw_calchash(addr) \
 2013         (ether_crc32_le((addr), IEEE80211_ADDR_LEN) & 0x3f)
 2014 
 2015 /*
 2016  * atw_filter_setup:
 2017  *
 2018  *      Set the ADM8211's receive filter.
 2019  */
 2020 void
 2021 atw_filter_setup(struct atw_softc *sc)
 2022 {
 2023         struct ieee80211com *ic = &sc->sc_ic;
 2024         struct arpcom *ac = &ic->ic_ac;
 2025         struct ifnet *ifp = &sc->sc_ic.ic_if;
 2026         int hash;
 2027         u_int32_t hashes[2];
 2028         struct ether_multi *enm;
 2029         struct ether_multistep step;
 2030 
 2031         /* According to comments in tlp_al981_filter_setup
 2032          * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
 2033          * multicast filter to be set while it is running.  Hopefully
 2034          * the ADM8211 is not the same!
 2035          */
 2036         if ((ifp->if_flags & IFF_RUNNING) != 0)
 2037                 atw_idle(sc, ATW_NAR_SR);
 2038 
 2039         sc->sc_opmode &= ~(ATW_NAR_PR|ATW_NAR_MM);
 2040 
 2041         /* XXX in scan mode, do not filter packets.  Maybe this is
 2042          * unnecessary.
 2043          */
 2044         if (ic->ic_state == IEEE80211_S_SCAN ||
 2045             (ifp->if_flags & IFF_PROMISC) != 0) {
 2046                 sc->sc_opmode |= ATW_NAR_PR;
 2047                 goto allmulti;
 2048         }
 2049 
 2050         hashes[0] = hashes[1] = 0x0;
 2051 
 2052         if (ac->ac_multirangecnt > 0)
 2053                 goto allmulti;
 2054 
 2055         /*
 2056          * Program the 64-bit multicast hash filter.
 2057          */
 2058         ETHER_FIRST_MULTI(step, ac, enm);
 2059         while (enm != NULL) {
 2060                 hash = atw_calchash(enm->enm_addrlo);
 2061                 hashes[hash >> 5] |= 1 << (hash & 0x1f);
 2062                 ETHER_NEXT_MULTI(step, enm);
 2063                 sc->sc_opmode |= ATW_NAR_MM;
 2064         }
 2065         ifp->if_flags &= ~IFF_ALLMULTI;
 2066         goto setit;
 2067 
 2068 allmulti:
 2069         sc->sc_opmode |= ATW_NAR_MM;
 2070         ifp->if_flags |= IFF_ALLMULTI;
 2071         hashes[0] = hashes[1] = 0xffffffff;
 2072 
 2073 setit:
 2074         ATW_WRITE(sc, ATW_MAR0, hashes[0]);
 2075         ATW_WRITE(sc, ATW_MAR1, hashes[1]);
 2076         ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
 2077         DELAY(20 * 1000);
 2078         ATW_WRITE(sc, ATW_RDR, 0x1);
 2079 
 2080         DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", sc->sc_dev.dv_xname,
 2081             ATW_READ(sc, ATW_NAR), sc->sc_opmode));
 2082 }
 2083 
 2084 /* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
 2085  * a beacon's BSSID and SSID against the preferred BSSID and SSID
 2086  * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
 2087  * no beacon with the preferred BSSID and SSID in the number of
 2088  * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
 2089  */
 2090 void
 2091 atw_write_bssid(struct atw_softc *sc)
 2092 {
 2093         struct ieee80211com *ic = &sc->sc_ic;
 2094         u_int8_t *bssid;
 2095 
 2096         bssid = ic->ic_bss->ni_bssid;
 2097 
 2098         ATW_WRITE(sc, ATW_BSSID0,
 2099             LSHIFT(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
 2100             LSHIFT(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
 2101             LSHIFT(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
 2102             LSHIFT(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
 2103 
 2104         ATW_WRITE(sc, ATW_ABDA1,
 2105             (ATW_READ(sc, ATW_ABDA1) &
 2106             ~(ATW_ABDA1_BSSIDB4_MASK|ATW_ABDA1_BSSIDB5_MASK)) |
 2107             LSHIFT(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
 2108             LSHIFT(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
 2109 
 2110         DPRINTF(sc, ("%s: BSSID %s -> ", sc->sc_dev.dv_xname,
 2111             ether_sprintf(sc->sc_bssid)));
 2112         DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
 2113 
 2114         memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
 2115 }
 2116 
 2117 /* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
 2118  * 16-bit word.
 2119  */
 2120 void
 2121 atw_write_sram(struct atw_softc *sc, u_int ofs, u_int8_t *buf, u_int buflen)
 2122 {
 2123         u_int i;
 2124         u_int8_t *ptr;
 2125 
 2126         memcpy(&sc->sc_sram[ofs], buf, buflen);
 2127 
 2128         KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
 2129 
 2130         KASSERT(buflen + ofs <= sc->sc_sramlen);
 2131 
 2132         ptr = &sc->sc_sram[ofs];
 2133 
 2134         for (i = 0; i < buflen; i += 2) {
 2135                 ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
 2136                     LSHIFT((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
 2137                 DELAY(atw_writewep_delay);
 2138 
 2139                 ATW_WRITE(sc, ATW_WESK,
 2140                     LSHIFT((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
 2141                 DELAY(atw_writewep_delay);
 2142         }
 2143         ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
 2144 
 2145         if (sc->sc_if.if_flags & IFF_DEBUG) {
 2146                 int n_octets = 0;
 2147                 printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
 2148                     sc->sc_dev.dv_xname, buflen, ofs, sc->sc_wepctl);
 2149                 for (i = 0; i < buflen; i++) {
 2150                         printf(" %02x", ptr[i]);
 2151                         if (++n_octets % 24 == 0)
 2152                                 printf("\n");
 2153                 }
 2154                 if (n_octets % 24 != 0)
 2155                         printf("\n");
 2156         }
 2157 }
 2158 
 2159 /* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
 2160 void
 2161 atw_write_wep(struct atw_softc *sc)
 2162 {
 2163         struct ieee80211com *ic = &sc->sc_ic;
 2164 #if 0
 2165         u_int32_t reg;
 2166         int i;
 2167 #endif
 2168         /* SRAM shared-key record format: key0 flags key1 ... key12 */
 2169         u_int8_t buf[IEEE80211_WEP_NKID]
 2170                     [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
 2171 
 2172         sc->sc_wepctl = 0;
 2173         ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
 2174 
 2175         if ((ic->ic_flags & IEEE80211_F_WEPON) == 0)
 2176                 return;
 2177 
 2178         memset(&buf[0][0], 0, sizeof(buf));
 2179 
 2180 #if 0
 2181         for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 2182                 if (ic->ic_nw_keys[i].k_len > 5) {
 2183                         buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
 2184                 } else if (ic->ic_nw_keys[i].k_len != 0) {
 2185                         buf[i][1] = ATW_WEP_ENABLED;
 2186                 } else {
 2187                         buf[i][1] = 0;
 2188                         continue;
 2189                 }
 2190                 buf[i][0] = ic->ic_nw_keys[i].k_key[0];
 2191                 memcpy(&buf[i][2], &ic->ic_nw_keys[i].k_key[1],
 2192                     ic->ic_nw_keys[i].k_len - 1);
 2193         }
 2194 
 2195         reg = ATW_READ(sc, ATW_MACTEST);
 2196         reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
 2197         reg &= ~ATW_MACTEST_KEYID_MASK;
 2198         reg |= LSHIFT(ic->ic_wep_txkey, ATW_MACTEST_KEYID_MASK);
 2199         ATW_WRITE(sc, ATW_MACTEST, reg);
 2200 
 2201         sc->sc_wepctl = ATW_WEPCTL_WEPENABLE;
 2202 
 2203         switch (sc->sc_rev) {
 2204         case ATW_REVISION_AB:
 2205         case ATW_REVISION_AF:
 2206                 /* Bypass WEP on Rx. */
 2207                 sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
 2208                 break;
 2209         default:
 2210                 break;
 2211         }
 2212 #endif
 2213 
 2214         atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (u_int8_t*)&buf[0][0],
 2215             sizeof(buf));
 2216 }
 2217 
 2218 void
 2219 atw_change_ibss(struct atw_softc *sc)
 2220 {
 2221         atw_predict_beacon(sc);
 2222         atw_write_bssid(sc);
 2223         atw_start_beacon(sc, 1);
 2224 }
 2225 
 2226 #ifndef IEEE80211_STA_ONLY
 2227 void
 2228 atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
 2229     struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, int subtype)
 2230 {
 2231         struct atw_softc *sc = (struct atw_softc*)ic->ic_softc;
 2232 
 2233         /* The ADM8211A answers probe requests. */
 2234         if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_REQ &&
 2235             sc->sc_rev < ATW_REVISION_BA)
 2236                 return;
 2237 
 2238         (*sc->sc_recv_mgmt)(ic, m, ni, rxi, subtype);
 2239 
 2240         switch (subtype) {
 2241         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 2242         case IEEE80211_FC0_SUBTYPE_BEACON:
 2243                 if (ic->ic_opmode != IEEE80211_M_IBSS ||
 2244                     ic->ic_state != IEEE80211_S_RUN)
 2245                         break;
 2246                 if (ieee80211_ibss_merge(ic, ni, atw_get_tsft(sc)) == ENETRESET)
 2247                         atw_change_ibss(sc);
 2248                 break;
 2249         default:
 2250                 break;
 2251         }
 2252         return;
 2253 }
 2254 #endif
 2255 
 2256 /* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
 2257  * In ad hoc mode, the SSID is written to the beacons sent by the
 2258  * ADM8211. In both ad hoc and infrastructure mode, beacons received
 2259  * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
 2260  * indications.
 2261  */
 2262 void
 2263 atw_write_ssid(struct atw_softc *sc)
 2264 {
 2265         struct ieee80211com *ic = &sc->sc_ic;
 2266         /* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
 2267          * it only expects the element length, not its ID.
 2268          */
 2269         u_int8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
 2270 
 2271         memset(buf, 0, sizeof(buf));
 2272         buf[0] = ic->ic_bss->ni_esslen;
 2273         memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
 2274 
 2275         atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
 2276             roundup(1 + ic->ic_bss->ni_esslen, 2));
 2277 }
 2278 
 2279 /* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
 2280  * In ad hoc mode, the supported rates are written to beacons sent by the
 2281  * ADM8211.
 2282  */
 2283 void
 2284 atw_write_sup_rates(struct atw_softc *sc)
 2285 {
 2286         struct ieee80211com *ic = &sc->sc_ic;
 2287         /*
 2288          * There is not enough space in the ADM8211 SRAM for the
 2289          * full IEEE80211_RATE_MAXSIZE
 2290          */
 2291         u_int8_t buf[12];
 2292         u_int8_t nrates;
 2293 
 2294         memset(buf, 0, sizeof(buf));
 2295         if (ic->ic_bss->ni_rates.rs_nrates > sizeof(buf) - 1)
 2296                 nrates = sizeof(buf) - 1;
 2297         else
 2298                 nrates = ic->ic_bss->ni_rates.rs_nrates;
 2299         buf[0] = nrates;
 2300         memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates, nrates);
 2301 
 2302         /* XXX deal with rev BA bug linux driver talks of? */
 2303 
 2304         atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
 2305 }
 2306 
 2307 /* Start/stop sending beacons. */
 2308 void
 2309 atw_start_beacon(struct atw_softc *sc, int start)
 2310 {
 2311         struct ieee80211com *ic = &sc->sc_ic;
 2312 #ifndef IEEE80211_STA_ONLY
 2313         uint16_t chan;
 2314         uint32_t bpli;
 2315 #endif
 2316         uint32_t bcnt, cap0, cap1, capinfo;
 2317         size_t len;
 2318 
 2319         if (ATW_IS_ENABLED(sc) == 0)
 2320                 return;
 2321 
 2322         /* start beacons */
 2323         len = sizeof(struct ieee80211_frame) +
 2324             8 /* timestamp */ + 2 /* beacon interval */ +
 2325             2 /* capability info */ +
 2326             2 + ic->ic_bss->ni_esslen /* SSID element */ +
 2327             2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
 2328             3 /* DS parameters */ +
 2329             IEEE80211_CRC_LEN;
 2330 
 2331         bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
 2332         cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
 2333         cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
 2334 
 2335         ATW_WRITE(sc, ATW_BCNT, bcnt);
 2336         ATW_WRITE(sc, ATW_CAP1, cap1);
 2337 
 2338         if (!start)
 2339                 return;
 2340 
 2341         /* TBD use ni_capinfo */
 2342 
 2343         capinfo = 0;
 2344         if (sc->sc_flags & ATWF_SHORT_PREAMBLE)
 2345                 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
 2346         if (ic->ic_flags & IEEE80211_F_WEPON)
 2347                 capinfo |= IEEE80211_CAPINFO_PRIVACY;
 2348 
 2349 #ifndef IEEE80211_STA_ONLY
 2350         switch (ic->ic_opmode) {
 2351         case IEEE80211_M_IBSS:
 2352                 len += 4; /* IBSS parameters */
 2353                 capinfo |= IEEE80211_CAPINFO_IBSS;
 2354                 break;
 2355         default:
 2356                 return;
 2357         }
 2358 
 2359         /* set listen interval
 2360          * XXX do software units agree w/ hardware?
 2361          */
 2362         bpli = LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
 2363             LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
 2364 
 2365         chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 2366 
 2367         bcnt |= LSHIFT(len, ATW_BCNT_BCNT_MASK);
 2368         cap0 |= LSHIFT(chan, ATW_CAP0_CHN_MASK);
 2369         cap1 |= LSHIFT(capinfo, ATW_CAP1_CAPI_MASK);
 2370 
 2371         ATW_WRITE(sc, ATW_BCNT, bcnt);
 2372         ATW_WRITE(sc, ATW_BPLI, bpli);
 2373         ATW_WRITE(sc, ATW_CAP0, cap0);
 2374         ATW_WRITE(sc, ATW_CAP1, cap1);
 2375 
 2376         DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
 2377             sc->sc_dev.dv_xname, bcnt));
 2378         DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
 2379             sc->sc_dev.dv_xname, cap1));
 2380 #endif
 2381 }
 2382 
 2383 /* Return the 32 lsb of the last TSFT divisible by ival. */
 2384 static __inline uint32_t
 2385 atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
 2386 {
 2387         /* Following the reference driver's lead, I compute
 2388          *
 2389          *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
 2390          *
 2391          * without using 64-bit arithmetic, using the following
 2392          * relationship:
 2393          *
 2394          *     (0x100000000 * H + L) % m
 2395          *   = ((0x100000000 % m) * H + L) % m
 2396          *   = (((0xffffffff + 1) % m) * H + L) % m
 2397          *   = ((0xffffffff % m + 1 % m) * H + L) % m
 2398          *   = ((0xffffffff % m + 1) * H + L) % m
 2399          */
 2400         return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
 2401 }
 2402 
 2403 uint64_t
 2404 atw_get_tsft(struct atw_softc *sc)
 2405 {
 2406         int i;
 2407         uint32_t tsfth, tsftl;
 2408         for (i = 0; i < 2; i++) {
 2409                 tsfth = ATW_READ(sc, ATW_TSFTH);
 2410                 tsftl = ATW_READ(sc, ATW_TSFTL);
 2411                 if (ATW_READ(sc, ATW_TSFTH) == tsfth)
 2412                         break;
 2413         }
 2414         return ((uint64_t)tsfth << 32) | tsftl;
 2415 }
 2416 
 2417 /* If we've created an IBSS, write the TSF time in the ADM8211 to
 2418  * the ieee80211com.
 2419  *
 2420  * Predict the next target beacon transmission time (TBTT) and
 2421  * write it to the ADM8211.
 2422  */
 2423 void
 2424 atw_predict_beacon(struct atw_softc *sc)
 2425 {
 2426 #define TBTTOFS 20 /* TU */
 2427 
 2428         struct ieee80211com *ic = &sc->sc_ic;
 2429         uint64_t tsft;
 2430         uint32_t ival, past_even, tbtt, tsfth, tsftl;
 2431         union {
 2432                 uint64_t        word;
 2433                 uint8_t         tstamp[8];
 2434         } u;
 2435 
 2436 #ifndef IEEE80211_STA_ONLY
 2437         if ((ic->ic_opmode == IEEE80211_M_IBSS) &&
 2438             (ic->ic_flags & IEEE80211_F_SIBSS)) {
 2439                 tsft = atw_get_tsft(sc);
 2440                 u.word = htole64(tsft);
 2441                 (void)memcpy(&ic->ic_bss->ni_tstamp[0], &u.tstamp[0],
 2442                     sizeof(ic->ic_bss->ni_tstamp));
 2443         } else
 2444 #endif
 2445         {
 2446                 (void)memcpy(&u, &ic->ic_bss->ni_tstamp[0], sizeof(u));
 2447                 tsft = letoh64(u.word);
 2448         }
 2449 
 2450         ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
 2451 
 2452         tsftl = tsft & 0xFFFFFFFF;
 2453         tsfth = tsft >> 32;
 2454 
 2455         /* We sent/received the last beacon `past' microseconds
 2456          * after the interval divided the TSF timer.
 2457          */
 2458         past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
 2459 
 2460         /* Skip ten beacons so that the TBTT cannot pass before
 2461          * we've programmed it.  Ten is an arbitrary number.
 2462          */
 2463         tbtt = past_even + ival * 10;
 2464 
 2465         ATW_WRITE(sc, ATW_TOFS1,
 2466             LSHIFT(1, ATW_TOFS1_TSFTOFSR_MASK) |
 2467             LSHIFT(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
 2468             LSHIFT(MASK_AND_RSHIFT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
 2469                 ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
 2470 #undef TBTTOFS
 2471 }
 2472 
 2473 void
 2474 atw_next_scan(void *arg)
 2475 {
 2476         struct atw_softc *sc = arg;
 2477         struct ieee80211com *ic = &sc->sc_ic;
 2478         struct ifnet *ifp = &ic->ic_if;
 2479         int s;
 2480 
 2481         /* don't call atw_start w/o network interrupts blocked */
 2482         s = splnet();
 2483         if (ic->ic_state == IEEE80211_S_SCAN)
 2484                 ieee80211_next_scan(ifp);
 2485         splx(s);
 2486 }
 2487 
 2488 /* Synchronize the hardware state with the software state. */
 2489 int
 2490 atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 2491 {
 2492         struct ifnet *ifp = &ic->ic_if;
 2493         struct atw_softc *sc = ifp->if_softc;
 2494         enum ieee80211_state ostate = ic->ic_state;
 2495         int error;
 2496 
 2497         if (nstate == IEEE80211_S_INIT) {
 2498                 timeout_del(&sc->sc_scan_to);
 2499                 sc->sc_cur_chan = IEEE80211_CHAN_ANY;
 2500                 atw_start_beacon(sc, 0);
 2501                 return (*sc->sc_newstate)(ic, nstate, arg);
 2502         }
 2503 
 2504         if ((error = atw_tune(sc)) != 0)
 2505                 return error;
 2506 
 2507         switch (nstate) {
 2508         case IEEE80211_S_ASSOC:
 2509                 break;
 2510         case IEEE80211_S_INIT:
 2511                 panic("%s: unexpected state IEEE80211_S_INIT", __func__);
 2512                 break;
 2513         case IEEE80211_S_SCAN:
 2514                 timeout_add_msec(&sc->sc_scan_to, atw_dwelltime);
 2515                 break;
 2516         case IEEE80211_S_RUN:
 2517                 if (ic->ic_opmode == IEEE80211_M_STA)
 2518                         break;
 2519                 /*FALLTHROUGH*/
 2520         case IEEE80211_S_AUTH:
 2521                 atw_write_bssid(sc);
 2522                 atw_write_ssid(sc);
 2523                 atw_write_sup_rates(sc);
 2524 
 2525                 if (
 2526 #ifndef IEEE80211_STA_ONLY
 2527                     ic->ic_opmode == IEEE80211_M_AHDEMO ||
 2528 #endif
 2529                     ic->ic_opmode == IEEE80211_M_MONITOR)
 2530                         break;
 2531 
 2532                 /* set listen interval
 2533                  * XXX do software units agree w/ hardware?
 2534                  */
 2535                 ATW_WRITE(sc, ATW_BPLI,
 2536                     LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
 2537                     LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval,
 2538                            ATW_BPLI_LI_MASK));
 2539 
 2540                 DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n",
 2541                     sc->sc_dev.dv_xname, ATW_READ(sc, ATW_BPLI)));
 2542 
 2543                 atw_predict_beacon(sc);
 2544                 break;
 2545         }
 2546 
 2547         if (nstate != IEEE80211_S_SCAN)
 2548                 timeout_del(&sc->sc_scan_to);
 2549 
 2550 #ifndef IEEE80211_STA_ONLY
 2551         if (nstate == IEEE80211_S_RUN &&
 2552             ic->ic_opmode == IEEE80211_M_IBSS)
 2553                 atw_start_beacon(sc, 1);
 2554         else
 2555 #endif
 2556                 atw_start_beacon(sc, 0);
 2557 
 2558         error = (*sc->sc_newstate)(ic, nstate, arg);
 2559 
 2560         if (ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_SCAN)
 2561                 atw_write_bssid(sc);
 2562 
 2563         return error;
 2564 }
 2565 
 2566 /*
 2567  * atw_add_rxbuf:
 2568  *
 2569  *      Add a receive buffer to the indicated descriptor.
 2570  */
 2571 int
 2572 atw_add_rxbuf(struct atw_softc *sc, int idx)
 2573 {
 2574         struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
 2575         struct mbuf *m;
 2576         int error;
 2577 
 2578         MGETHDR(m, M_DONTWAIT, MT_DATA);
 2579         if (m == NULL)
 2580                 return (ENOBUFS);
 2581 
 2582         MCLGET(m, M_DONTWAIT);
 2583         if ((m->m_flags & M_EXT) == 0) {
 2584                 m_freem(m);
 2585                 return (ENOBUFS);
 2586         }
 2587 
 2588         if (rxs->rxs_mbuf != NULL)
 2589                 bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
 2590 
 2591         rxs->rxs_mbuf = m;
 2592 
 2593         error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
 2594             m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
 2595             BUS_DMA_READ|BUS_DMA_NOWAIT);
 2596         if (error) {
 2597                 printf("%s: can't load rx DMA map %d, error = %d\n",
 2598                     sc->sc_dev.dv_xname, idx, error);
 2599                 panic("atw_add_rxbuf"); /* XXX */
 2600         }
 2601 
 2602         bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
 2603             rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
 2604 
 2605         ATW_INIT_RXDESC(sc, idx);
 2606 
 2607         return (0);
 2608 }
 2609 
 2610 /*
 2611  * Release any queued transmit buffers.
 2612  */
 2613 void
 2614 atw_txdrain(struct atw_softc *sc)
 2615 {
 2616         struct atw_txsoft *txs;
 2617 
 2618         while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
 2619                 SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
 2620                 if (txs->txs_mbuf != NULL) {
 2621                         bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
 2622                         m_freem(txs->txs_mbuf);
 2623                         txs->txs_mbuf = NULL;
 2624                 }
 2625                 SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
 2626         }
 2627         sc->sc_tx_timer = 0;
 2628 }
 2629 
 2630 /*
 2631  * atw_stop:            [ ifnet interface function ]
 2632  *
 2633  *      Stop transmission on the interface.
 2634  */
 2635 void
 2636 atw_stop(struct ifnet *ifp, int disable)
 2637 {
 2638         struct atw_softc *sc = ifp->if_softc;
 2639         struct ieee80211com *ic = &sc->sc_ic;
 2640 
 2641         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 2642 
 2643         /*
 2644          * Mark the interface down and cancel the watchdog timer.
 2645         */
 2646         ifp->if_flags &= ~IFF_RUNNING;
 2647         ifq_clr_oactive(&ifp->if_snd);
 2648         ifp->if_timer = 0;
 2649 
 2650         /* Disable interrupts. */
 2651         ATW_WRITE(sc, ATW_IER, 0);
 2652 
 2653         /* Stop the transmit and receive processes. */
 2654         sc->sc_opmode = 0;
 2655         ATW_WRITE(sc, ATW_NAR, 0);
 2656         DELAY(20 * 1000);
 2657         ATW_WRITE(sc, ATW_TDBD, 0);
 2658         ATW_WRITE(sc, ATW_TDBP, 0);
 2659         ATW_WRITE(sc, ATW_RDB, 0);
 2660 
 2661         atw_txdrain(sc);
 2662 
 2663         if (disable) {
 2664                 atw_rxdrain(sc);
 2665                 atw_disable(sc);
 2666         }
 2667 
 2668         if (!disable)
 2669                 atw_reset(sc);
 2670 }
 2671 
 2672 /*
 2673  * atw_rxdrain:
 2674  *
 2675  *      Drain the receive queue.
 2676  */
 2677 void
 2678 atw_rxdrain(struct atw_softc *sc)
 2679 {
 2680         struct atw_rxsoft *rxs;
 2681         int i;
 2682 
 2683         for (i = 0; i < ATW_NRXDESC; i++) {
 2684                 rxs = &sc->sc_rxsoft[i];
 2685                 if (rxs->rxs_mbuf == NULL)
 2686                         continue;
 2687                 bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
 2688                 m_freem(rxs->rxs_mbuf);
 2689                 rxs->rxs_mbuf = NULL;
 2690         }
 2691 }
 2692 
 2693 /*
 2694  * atw_detach:
 2695  *
 2696  *      Detach an ADM8211 interface.
 2697  */
 2698 int
 2699 atw_detach(struct atw_softc *sc)
 2700 {
 2701         struct ifnet *ifp = &sc->sc_ic.ic_if;
 2702         struct atw_rxsoft *rxs;
 2703         struct atw_txsoft *txs;
 2704         int i;
 2705 
 2706         /*
 2707          * Succeed now if there isn't any work to do.
 2708          */
 2709         if ((sc->sc_flags & ATWF_ATTACHED) == 0)
 2710                 return (0);
 2711 
 2712         timeout_del(&sc->sc_scan_to);
 2713 
 2714         ieee80211_ifdetach(ifp);
 2715         if_detach(ifp);
 2716 
 2717         for (i = 0; i < ATW_NRXDESC; i++) {
 2718                 rxs = &sc->sc_rxsoft[i];
 2719                 if (rxs->rxs_mbuf != NULL) {
 2720                         bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
 2721                         m_freem(rxs->rxs_mbuf);
 2722                         rxs->rxs_mbuf = NULL;
 2723                 }
 2724                 bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
 2725         }
 2726         for (i = 0; i < ATW_TXQUEUELEN; i++) {
 2727                 txs = &sc->sc_txsoft[i];
 2728                 if (txs->txs_mbuf != NULL) {
 2729                         bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
 2730                         m_freem(txs->txs_mbuf);
 2731                         txs->txs_mbuf = NULL;
 2732                 }
 2733                 bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
 2734         }
 2735         bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
 2736         bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
 2737         bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
 2738             sizeof(struct atw_control_data));
 2739         bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
 2740 
 2741         if (sc->sc_srom)
 2742                 free(sc->sc_srom, M_DEVBUF, sc->sc_sromsz);
 2743 
 2744         return (0);
 2745 }
 2746 
 2747 int
 2748 atw_intr(void *arg)
 2749 {
 2750         struct atw_softc *sc = arg;
 2751         struct ifnet *ifp = &sc->sc_ic.ic_if;
 2752         u_int32_t status, rxstatus, txstatus, linkstatus;
 2753         int handled = 0, txthresh;
 2754 
 2755 #ifdef DEBUG
 2756         if (ATW_IS_ENABLED(sc) == 0)
 2757                 panic("%s: atw_intr: not enabled", sc->sc_dev.dv_xname);
 2758 #endif
 2759 
 2760         /*
 2761          * If the interface isn't running, the interrupt couldn't
 2762          * possibly have come from us.
 2763          */
 2764         if ((ifp->if_flags & IFF_RUNNING) == 0 ||
 2765             (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
 2766                 return (0);
 2767 
 2768         for (;;) {
 2769                 status = ATW_READ(sc, ATW_STSR);
 2770 
 2771                 if (status)
 2772                         ATW_WRITE(sc, ATW_STSR, status);
 2773 
 2774 #ifdef ATW_DEBUG
 2775 #define PRINTINTR(flag) do { \
 2776         if ((status & flag) != 0) { \
 2777                 printf("%s" #flag, delim); \
 2778                 delim = ","; \
 2779         } \
 2780 } while (0)
 2781 
 2782                 if (atw_debug > 1 && status) {
 2783                         const char *delim = "<";
 2784 
 2785                         printf("%s: reg[STSR] = %x",
 2786                             sc->sc_dev.dv_xname, status);
 2787 
 2788                         PRINTINTR(ATW_INTR_FBE);
 2789                         PRINTINTR(ATW_INTR_LINKOFF);
 2790                         PRINTINTR(ATW_INTR_LINKON);
 2791                         PRINTINTR(ATW_INTR_RCI);
 2792                         PRINTINTR(ATW_INTR_RDU);
 2793                         PRINTINTR(ATW_INTR_REIS);
 2794                         PRINTINTR(ATW_INTR_RPS);
 2795                         PRINTINTR(ATW_INTR_TCI);
 2796                         PRINTINTR(ATW_INTR_TDU);
 2797                         PRINTINTR(ATW_INTR_TLT);
 2798                         PRINTINTR(ATW_INTR_TPS);
 2799                         PRINTINTR(ATW_INTR_TRT);
 2800                         PRINTINTR(ATW_INTR_TUF);
 2801                         PRINTINTR(ATW_INTR_BCNTC);
 2802                         PRINTINTR(ATW_INTR_ATIME);
 2803                         PRINTINTR(ATW_INTR_TBTT);
 2804                         PRINTINTR(ATW_INTR_TSCZ);
 2805                         PRINTINTR(ATW_INTR_TSFTF);
 2806                         printf(">\n");
 2807                 }
 2808 #undef PRINTINTR
 2809 #endif /* ATW_DEBUG */
 2810 
 2811                 if ((status & sc->sc_inten) == 0)
 2812                         break;
 2813 
 2814                 handled = 1;
 2815 
 2816                 rxstatus = status & sc->sc_rxint_mask;
 2817                 txstatus = status & sc->sc_txint_mask;
 2818                 linkstatus = status & sc->sc_linkint_mask;
 2819 
 2820                 if (linkstatus) {
 2821                         atw_linkintr(sc, linkstatus);
 2822                 }
 2823 
 2824                 if (rxstatus) {
 2825                         /* Grab any new packets. */
 2826                         atw_rxintr(sc);
 2827 
 2828                         if (rxstatus & ATW_INTR_RDU) {
 2829                                 printf("%s: receive ring overrun\n",
 2830                                     sc->sc_dev.dv_xname);
 2831                                 /* Get the receive process going again. */
 2832                                 ATW_WRITE(sc, ATW_RDR, 0x1);
 2833                                 break;
 2834                         }
 2835                 }
 2836 
 2837                 if (txstatus) {
 2838                         /* Sweep up transmit descriptors. */
 2839                         atw_txintr(sc);
 2840 
 2841                         if (txstatus & ATW_INTR_TLT)
 2842                                 DPRINTF(sc, ("%s: tx lifetime exceeded\n",
 2843                                     sc->sc_dev.dv_xname));
 2844 
 2845                         if (txstatus & ATW_INTR_TRT)
 2846                                 DPRINTF(sc, ("%s: tx retry limit exceeded\n",
 2847                                     sc->sc_dev.dv_xname));
 2848 
 2849                         /* If Tx under-run, increase our transmit threshold
 2850                          * if another is available.
 2851                          */
 2852                         txthresh = sc->sc_txthresh + 1;
 2853                         if ((txstatus & ATW_INTR_TUF) &&
 2854                             sc->sc_txth[txthresh].txth_name != NULL) {
 2855                                 /* Idle the transmit process. */
 2856                                 atw_idle(sc, ATW_NAR_ST);
 2857 
 2858                                 sc->sc_txthresh = txthresh;
 2859                                 sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
 2860                                 sc->sc_opmode |=
 2861                                     sc->sc_txth[txthresh].txth_opmode;
 2862                                 printf("%s: transmit underrun; new "
 2863                                     "threshold: %s\n", sc->sc_dev.dv_xname,
 2864                                     sc->sc_txth[txthresh].txth_name);
 2865 
 2866                                 /* Set the new threshold and restart
 2867                                  * the transmit process.
 2868                                  */
 2869                                 ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
 2870                                 DELAY(20 * 1000);
 2871                                 ATW_WRITE(sc, ATW_RDR, 0x1);
 2872                                 /* XXX Log every Nth underrun from
 2873                                  * XXX now on?
 2874                                  */
 2875                         }
 2876                 }
 2877 
 2878                 if (status & (ATW_INTR_TPS|ATW_INTR_RPS)) {
 2879                         if (status & ATW_INTR_TPS)
 2880                                 printf("%s: transmit process stopped\n",
 2881                                     sc->sc_dev.dv_xname);
 2882                         if (status & ATW_INTR_RPS)
 2883                                 printf("%s: receive process stopped\n",
 2884                                     sc->sc_dev.dv_xname);
 2885                         (void)atw_init(ifp);
 2886                         break;
 2887                 }
 2888 
 2889                 if (status & ATW_INTR_FBE) {
 2890                         printf("%s: fatal bus error\n", sc->sc_dev.dv_xname);
 2891                         (void)atw_init(ifp);
 2892                         break;
 2893                 }
 2894 
 2895                 /*
 2896                  * Not handled:
 2897                  *
 2898                  *      Transmit buffer unavailable -- normal
 2899                  *      condition, nothing to do, really.
 2900                  *
 2901                  *      Early receive interrupt -- not available on
 2902                  *      all chips, we just use RI.  We also only
 2903                  *      use single-segment receive DMA, so this
 2904                  *      is mostly useless.
 2905                  *
 2906                  *      TBD others
 2907                  */
 2908         }
 2909 
 2910         /* Try to get more packets going. */
 2911         atw_start(ifp);
 2912 
 2913         return (handled);
 2914 }
 2915 
 2916 /*
 2917  * atw_idle:
 2918  *
 2919  *      Cause the transmit and/or receive processes to go idle.
 2920  *
 2921  *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
 2922  *      process in STSR if I clear SR or ST after the process has already
 2923  *      ceased. Fair enough. But the Rx process status bits in ATW_TEST0
 2924  *      do not seem to be too reliable. Perhaps I have the sense of the
 2925  *      Rx bits switched with the Tx bits?
 2926  */
 2927 void
 2928 atw_idle(struct atw_softc *sc, u_int32_t bits)
 2929 {
 2930         u_int32_t ackmask = 0, opmode, stsr, test0;
 2931         int i, s;
 2932 
 2933         s = splnet();
 2934 
 2935         opmode = sc->sc_opmode & ~bits;
 2936 
 2937         if (bits & ATW_NAR_SR)
 2938                 ackmask |= ATW_INTR_RPS;
 2939 
 2940         if (bits & ATW_NAR_ST) {
 2941                 ackmask |= ATW_INTR_TPS;
 2942                 /* set ATW_NAR_HF to flush TX FIFO. */
 2943                 opmode |= ATW_NAR_HF;
 2944         }
 2945 
 2946         ATW_WRITE(sc, ATW_NAR, opmode);
 2947         DELAY(20 * 1000);
 2948 
 2949         for (i = 0; i < 10; i++) {
 2950                 stsr = ATW_READ(sc, ATW_STSR);
 2951                 if ((stsr & ackmask) == ackmask)
 2952                         break;
 2953                 DELAY(1000);
 2954         }
 2955 
 2956         ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
 2957 
 2958         if ((stsr & ackmask) == ackmask)
 2959                 goto out;
 2960 
 2961         test0 = ATW_READ(sc, ATW_TEST0);
 2962 
 2963         if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
 2964             (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
 2965                 DPRINTF2(sc, ("%s: transmit process not idle [%s]\n",
 2966                     sc->sc_dev.dv_xname,
 2967                     atw_tx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_TS_MASK)]));
 2968                 DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
 2969                     sc->sc_dev.dv_xname, bits, test0, stsr));
 2970         }
 2971 
 2972         if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
 2973             (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
 2974                 DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
 2975                     sc->sc_dev.dv_xname,
 2976                     atw_rx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_RS_MASK)]));
 2977                 DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
 2978                     sc->sc_dev.dv_xname, bits, test0, stsr));
 2979         }
 2980 out:
 2981         if ((bits & ATW_NAR_ST) != 0)
 2982                 atw_txdrain(sc);
 2983         splx(s);
 2984         return;
 2985 }
 2986 
 2987 /*
 2988  * atw_linkintr:
 2989  *
 2990  *      Helper; handle link-status interrupts.
 2991  */
 2992 void
 2993 atw_linkintr(struct atw_softc *sc, u_int32_t linkstatus)
 2994 {
 2995         struct ieee80211com *ic = &sc->sc_ic;
 2996 
 2997         if (ic->ic_state != IEEE80211_S_RUN)
 2998                 return;
 2999 
 3000         if (linkstatus & ATW_INTR_LINKON) {
 3001                 DPRINTF(sc, ("%s: link on\n", sc->sc_dev.dv_xname));
 3002                 sc->sc_rescan_timer = 0;
 3003         } else if (linkstatus & ATW_INTR_LINKOFF) {
 3004                 DPRINTF(sc, ("%s: link off\n", sc->sc_dev.dv_xname));
 3005                 if (ic->ic_opmode != IEEE80211_M_STA)
 3006                         return;
 3007                 sc->sc_rescan_timer = 3;
 3008                 ic->ic_if.if_timer = 1;
 3009         }
 3010 }
 3011 
 3012 #if 0
 3013 static __inline int
 3014 atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame *wh)
 3015 {
 3016         if ((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) == 0)
 3017                 return 0;
 3018         if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
 3019                 return 0;
 3020         return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
 3021 }
 3022 #endif
 3023 
 3024 /*
 3025  * atw_rxintr:
 3026  *
 3027  *      Helper; handle receive interrupts.
 3028  */
 3029 void
 3030 atw_rxintr(struct atw_softc *sc)
 3031 {
 3032         struct mbuf_list ml = MBUF_LIST_INITIALIZER();
 3033         static int rate_tbl[] = {2, 4, 11, 22, 44};
 3034         struct ieee80211com *ic = &sc->sc_ic;
 3035         struct ieee80211_rxinfo rxi;
 3036         struct ieee80211_node *ni;
 3037         struct ieee80211_frame *wh;
 3038         struct ifnet *ifp = &ic->ic_if;
 3039         struct atw_rxsoft *rxs;
 3040         struct mbuf *m;
 3041         u_int32_t rxstat;
 3042         int i, len, rate, rate0;
 3043         u_int32_t rssi, rssi0;
 3044 
 3045         for (i = sc->sc_rxptr;; i = ATW_NEXTRX(i)) {
 3046                 rxs = &sc->sc_rxsoft[i];
 3047 
 3048                 ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
 3049 
 3050                 rxstat = letoh32(sc->sc_rxdescs[i].ar_stat);
 3051                 rssi0 = letoh32(sc->sc_rxdescs[i].ar_rssi);
 3052                 rate0 = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_RXDR_MASK);
 3053 
 3054                 if (rxstat & ATW_RXSTAT_OWN)
 3055                         break; /* We have processed all receive buffers. */
 3056 
 3057                 DPRINTF3(sc,
 3058                     ("%s: rx stat %08x rssi0 %08x buf1 %08x buf2 %08x\n",
 3059                     sc->sc_dev.dv_xname,
 3060                     rxstat, rssi0,
 3061                     letoh32(sc->sc_rxdescs[i].ar_buf1),
 3062                     letoh32(sc->sc_rxdescs[i].ar_buf2)));
 3063 
 3064                 /*
 3065                  * Make sure the packet fits in one buffer.  This should
 3066                  * always be the case.
 3067                  */
 3068                 if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=
 3069                     (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {
 3070                         printf("%s: incoming packet spilled, resetting\n",
 3071                             sc->sc_dev.dv_xname);
 3072                         (void)atw_init(ifp);
 3073                         return;
 3074                 }
 3075 
 3076                 /*
 3077                  * If an error occurred, update stats, clear the status
 3078                  * word, and leave the packet buffer in place.  It will
 3079                  * simply be reused the next time the ring comes around.
 3080                  * If 802.1Q VLAN MTU is enabled, ignore the Frame Too Long
 3081                  * error.
 3082                  */
 3083 
 3084                 if ((rxstat & ATW_RXSTAT_ES) != 0 &&
 3085                     ((sc->sc_ic.ic_if.if_capabilities & IFCAP_VLAN_MTU) == 0 ||
 3086                      (rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_SFDE |
 3087                                 ATW_RXSTAT_SIGE | ATW_RXSTAT_CRC16E |
 3088                                 ATW_RXSTAT_RXTOE | ATW_RXSTAT_CRC32E |
 3089                                 ATW_RXSTAT_ICVE)) != 0)) {
 3090 #define PRINTERR(bit, str)                                              \
 3091                         if (rxstat & (bit))                             \
 3092                                 printf("%s: receive error: %s\n",       \
 3093                                     sc->sc_dev.dv_xname, str)
 3094                         ifp->if_ierrors++;
 3095                         PRINTERR(ATW_RXSTAT_DE, "descriptor error");
 3096                         PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
 3097                         PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
 3098                         PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
 3099                         PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
 3100                         PRINTERR(ATW_RXSTAT_CRC32E, "FCS error");
 3101                         PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
 3102 #undef PRINTERR
 3103                         ATW_INIT_RXDESC(sc, i);
 3104                         continue;
 3105                 }
 3106 
 3107                 bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
 3108                     rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
 3109 
 3110                 /*
 3111                  * No errors; receive the packet.  Note the ADM8211
 3112                  * includes the CRC in promiscuous mode.
 3113                  */
 3114                 len = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_FL_MASK);
 3115 
 3116                 /*
 3117                  * Allocate a new mbuf cluster.  If that fails, we are
 3118                  * out of memory, and must drop the packet and recycle
 3119                  * the buffer that's already attached to this descriptor.
 3120                  */
 3121                 m = rxs->rxs_mbuf;
 3122                 if (atw_add_rxbuf(sc, i) != 0) {
 3123                         ifp->if_ierrors++;
 3124                         ATW_INIT_RXDESC(sc, i);
 3125                         bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
 3126                             rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
 3127                         continue;
 3128                 }
 3129 
 3130                 if (sc->sc_opmode & ATW_NAR_PR)
 3131                         len -= IEEE80211_CRC_LEN;
 3132                 m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
 3133 
 3134                 if (rate0 >= sizeof(rate_tbl) / sizeof(rate_tbl[0]))
 3135                         rate = 0;
 3136                 else
 3137                         rate = rate_tbl[rate0];
 3138 
 3139                 /* The RSSI comes straight from a register in the
 3140                  * baseband processor.  I know that for the RF3000,
 3141                  * the RSSI register also contains the antenna-selection
 3142                  * bits.  Mask those off.
 3143                  *
 3144                  * TBD Treat other basebands.
 3145                  */
 3146                 if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
 3147                         rssi = rssi0 & RF3000_RSSI_MASK;
 3148                 else
 3149                         rssi = rssi0;
 3150 
 3151 #if NBPFILTER > 0
 3152                 /* Pass this up to any BPF listeners. */
 3153                 if (sc->sc_radiobpf != NULL) {
 3154                         struct mbuf mb;
 3155 
 3156                         struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
 3157 
 3158                         tap->ar_rate = rate;
 3159                         tap->ar_chan_freq = ic->ic_bss->ni_chan->ic_freq;
 3160                         tap->ar_chan_flags = ic->ic_bss->ni_chan->ic_flags;
 3161 
 3162                         /* TBD verify units are dB */
 3163                         tap->ar_antsignal = (int)rssi;
 3164                         /* TBD tap->ar_flags */
 3165 
 3166                         mb.m_data = (caddr_t)tap;
 3167                         mb.m_len = tap->ar_ihdr.it_len;
 3168                         mb.m_next = m;
 3169                         mb.m_nextpkt = NULL;
 3170                         mb.m_type = 0;
 3171                         mb.m_flags = 0;
 3172                         bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_IN);
 3173                 }
 3174 #endif /* NBPFILTER > 0 */
 3175 
 3176                 wh = mtod(m, struct ieee80211_frame *);
 3177                 ni = ieee80211_find_rxnode(ic, wh);
 3178                 memset(&rxi, 0, sizeof(rxi));
 3179 #if 0
 3180                 if (atw_hw_decrypted(sc, wh)) {
 3181                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
 3182                         rxi.rxi_flags |= IEEE80211_RXI_HWDEC;
 3183                 }
 3184 #endif
 3185                 rxi.rxi_rssi = (int)rssi;
 3186                 ieee80211_inputm(ifp, m, ni, &rxi, &ml);
 3187                 /*
 3188                  * The frame may have caused the node to be marked for
 3189                  * reclamation (e.g. in response to a DEAUTH message)
 3190                  * so use release_node here instead of unref_node.
 3191                  */
 3192                 ieee80211_release_node(ic, ni);
 3193         }
 3194         if_input(ifp, &ml);
 3195 
 3196         /* Update the receive pointer. */
 3197         sc->sc_rxptr = i;
 3198 }
 3199 
 3200 /*
 3201  * atw_txintr:
 3202  *
 3203  *      Helper; handle transmit interrupts.
 3204  */
 3205 void
 3206 atw_txintr(struct atw_softc *sc)
 3207 {
 3208 #define TXSTAT_ERRMASK (ATW_TXSTAT_TUF | ATW_TXSTAT_TLT | ATW_TXSTAT_TRT | \
 3209     ATW_TXSTAT_TRO | ATW_TXSTAT_SOFBR)
 3210 #define TXSTAT_FMT "\2\31ATW_TXSTAT_SOFBR\32ATW_TXSTAT_TRO\33ATW_TXSTAT_TUF" \
 3211     "\34ATW_TXSTAT_TRT\35ATW_TXSTAT_TLT"
 3212         struct ifnet *ifp = &sc->sc_ic.ic_if;
 3213         struct atw_txsoft *txs;
 3214         u_int32_t txstat;
 3215 
 3216         DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
 3217             sc->sc_dev.dv_xname, sc->sc_flags));
 3218 
 3219         ifq_clr_oactive(&ifp->if_snd);
 3220 
 3221         /*
 3222          * Go through our Tx list and free mbufs for those
 3223          * frames that have been transmitted.
 3224          */
 3225         while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
 3226                 ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
 3227                     BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
 3228 
 3229 #ifdef ATW_DEBUG
 3230                 if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
 3231                         int i;
 3232                         printf("    txsoft %p transmit chain:\n", txs);
 3233                         ATW_CDTXSYNC(sc, txs->txs_firstdesc,
 3234                             txs->txs_ndescs - 1,
 3235                             BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
 3236                         for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
 3237                                 printf("     descriptor %d:\n", i);
 3238                                 printf("       at_status:   0x%08x\n",
 3239                                     letoh32(sc->sc_txdescs[i].at_stat));
 3240                                 printf("       at_flags:      0x%08x\n",
 3241                                     letoh32(sc->sc_txdescs[i].at_flags));
 3242                                 printf("       at_buf1: 0x%08x\n",
 3243                                     letoh32(sc->sc_txdescs[i].at_buf1));
 3244                                 printf("       at_buf2: 0x%08x\n",
 3245                                     letoh32(sc->sc_txdescs[i].at_buf2));
 3246                                 if (i == txs->txs_lastdesc)
 3247                                         break;
 3248                         }
 3249                 }
 3250 #endif
 3251 
 3252                 txstat = letoh32(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
 3253                 if (txstat & ATW_TXSTAT_OWN)
 3254                         break;
 3255 
 3256                 SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
 3257 
 3258                 sc->sc_txfree += txs->txs_ndescs;
 3259 
 3260                 bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
 3261                     0, txs->txs_dmamap->dm_mapsize,
 3262                     BUS_DMASYNC_POSTWRITE);
 3263                 bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
 3264                 m_freem(txs->txs_mbuf);
 3265                 txs->txs_mbuf = NULL;
 3266 
 3267                 SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
 3268 
 3269                 if ((ifp->if_flags & IFF_DEBUG) != 0 &&
 3270                     (txstat & TXSTAT_ERRMASK) != 0) {
 3271                         printf("%s: txstat %b %d\n", sc->sc_dev.dv_xname,
 3272                             txstat & TXSTAT_ERRMASK, TXSTAT_FMT,
 3273                             MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK));
 3274                 }
 3275 
 3276                 /*
 3277                  * Check for errors and collisions.
 3278                  */
 3279                 if (txstat & ATW_TXSTAT_TUF)
 3280                         sc->sc_stats.ts_tx_tuf++;
 3281                 if (txstat & ATW_TXSTAT_TLT)
 3282                         sc->sc_stats.ts_tx_tlt++;
 3283                 if (txstat & ATW_TXSTAT_TRT)
 3284                         sc->sc_stats.ts_tx_trt++;
 3285                 if (txstat & ATW_TXSTAT_TRO)
 3286                         sc->sc_stats.ts_tx_tro++;
 3287                 if (txstat & ATW_TXSTAT_SOFBR) {
 3288                         sc->sc_stats.ts_tx_sofbr++;
 3289                 }
 3290 
 3291                 if ((txstat & ATW_TXSTAT_ES) == 0)
 3292                         ifp->if_collisions +=
 3293                             MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK);
 3294                 else
 3295                         ifp->if_oerrors++;
 3296         }
 3297 
 3298         /*
 3299          * If there are no more pending transmissions, cancel the watchdog
 3300          * timer.
 3301          */
 3302         if (txs == NULL)
 3303                 sc->sc_tx_timer = 0;
 3304 #undef TXSTAT_ERRMASK
 3305 #undef TXSTAT_FMT
 3306 }
 3307 
 3308 /*
 3309  * atw_watchdog:        [ifnet interface function]
 3310  *
 3311  *      Watchdog timer handler.
 3312  */
 3313 void
 3314 atw_watchdog(struct ifnet *ifp)
 3315 {
 3316         struct atw_softc *sc = ifp->if_softc;
 3317         struct ieee80211com *ic = &sc->sc_ic;
 3318         uint32_t test1, rra, rwa;
 3319 
 3320         ifp->if_timer = 0;
 3321         if (ATW_IS_ENABLED(sc) == 0)
 3322                 return;
 3323 
 3324         if (sc->sc_rescan_timer) {
 3325                 if (--sc->sc_rescan_timer == 0)
 3326                         (void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 3327         }
 3328         if (sc->sc_tx_timer) {
 3329                 if (--sc->sc_tx_timer == 0 &&
 3330                     !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
 3331                         printf("%s: transmit timeout\n", ifp->if_xname);
 3332                         ifp->if_oerrors++;
 3333                         (void)atw_init(ifp);
 3334                         atw_start(ifp);
 3335                 }
 3336         }
 3337         if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
 3338                 ifp->if_timer = 1;
 3339 
 3340         /*
 3341          * ADM8211B seems to stall every so often, check for this.
 3342          * These bits are what the Linux driver checks, they don't
 3343          * seem to be documented by ADMTek/Infineon?
 3344          */
 3345         if (sc->sc_rev == ATW_REVISION_BA) {
 3346                 test1 = ATW_READ(sc, ATW_TEST1);
 3347                 rra = (test1 >> 12) & 0x1ff;
 3348                 rwa = (test1 >> 2) & 0x1ff;
 3349 
 3350                 if ((rra != rwa) && !(test1 & 0x2)) {
 3351                         atw_init(ifp);
 3352                         atw_start(ifp);
 3353                 }
 3354         }
 3355 
 3356         ieee80211_watchdog(ifp);
 3357 }
 3358 
 3359 /*
 3360  * Arguments in:
 3361  *
 3362  * paylen:  payload length (no FCS, no WEP header)
 3363  *
 3364  * hdrlen:  header length
 3365  *
 3366  * rate:    MSDU speed, units 500kb/s
 3367  *
 3368  * flags:   IEEE80211_F_SHPREAMBLE (use short preamble),
 3369  *          IEEE80211_F_SHSLOT (use short slot length)
 3370  *
 3371  * Arguments out:
 3372  *
 3373  * d:       802.11 Duration field for RTS,
 3374  *          802.11 Duration field for data frame,
 3375  *          PLCP Length for data frame,
 3376  *          residual octets at end of data slot
 3377  */
 3378 int
 3379 atw_compute_duration1(int len, int use_ack, uint32_t flags, int rate,
 3380     struct atw_duration *d)
 3381 {
 3382         int pre, ctsrate;
 3383         int ack, bitlen, data_dur, remainder;
 3384 
 3385         /* RTS reserves medium for SIFS | CTS | SIFS | (DATA) | SIFS | ACK
 3386          * DATA reserves medium for SIFS | ACK
 3387          *
 3388          * XXXMYC: no ACK on multicast/broadcast or control packets
 3389          */
 3390 
 3391         bitlen = len * 8;
 3392 
 3393         pre = IEEE80211_DUR_DS_SIFS;
 3394         if ((flags & IEEE80211_F_SHPREAMBLE) != 0)
 3395                 pre += IEEE80211_DUR_DS_SHORT_PREAMBLE +
 3396                     IEEE80211_DUR_DS_FAST_PLCPHDR;
 3397         else
 3398                 pre += IEEE80211_DUR_DS_LONG_PREAMBLE +
 3399                     IEEE80211_DUR_DS_SLOW_PLCPHDR;
 3400 
 3401         d->d_residue = 0;
 3402         data_dur = (bitlen * 2) / rate;
 3403         remainder = (bitlen * 2) % rate;
 3404         if (remainder != 0) {
 3405                 d->d_residue = (rate - remainder) / 16;
 3406                 data_dur++;
 3407         }
 3408 
 3409         switch (rate) {
 3410         case 2:         /* 1 Mb/s */
 3411         case 4:         /* 2 Mb/s */
 3412                 /* 1 - 2 Mb/s WLAN: send ACK/CTS at 1 Mb/s */
 3413                 ctsrate = 2;
 3414                 break;
 3415         case 11:        /* 5.5 Mb/s */
 3416         case 22:        /* 11  Mb/s */
 3417         case 44:        /* 22  Mb/s */
 3418                 /* 5.5 - 11 Mb/s WLAN: send ACK/CTS at 2 Mb/s */
 3419                 ctsrate = 4;
 3420                 break;
 3421         default:
 3422                 /* TBD */
 3423                 return -1;
 3424         }
 3425 
 3426         d->d_plcp_len = data_dur;
 3427 
 3428         ack = (use_ack) ? pre + (IEEE80211_DUR_DS_SLOW_ACK * 2) / ctsrate : 0;
 3429 
 3430         d->d_rts_dur =
 3431             pre + (IEEE80211_DUR_DS_SLOW_CTS * 2) / ctsrate +
 3432             pre + data_dur +
 3433             ack;
 3434 
 3435         d->d_data_dur = ack;
 3436 
 3437         return 0;
 3438 }
 3439 
 3440 /*
 3441  * Arguments in:
 3442  *
 3443  * wh:      802.11 header
 3444  *
 3445  * len: packet length 
 3446  *
 3447  * rate:    MSDU speed, units 500kb/s
 3448  *
 3449  * fraglen: fragment length, set to maximum (or higher) for no
 3450  *          fragmentation
 3451  *
 3452  * flags:   IEEE80211_F_WEPON (hardware adds WEP),
 3453  *          IEEE80211_F_SHPREAMBLE (use short preamble),
 3454  *          IEEE80211_F_SHSLOT (use short slot length)
 3455  *
 3456  * Arguments out:
 3457  *
 3458  * d0: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
 3459  *     of first/only fragment
 3460  *
 3461  * dn: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
 3462  *     of first/only fragment
 3463  */
 3464 int
 3465 atw_compute_duration(struct ieee80211_frame *wh, int len, uint32_t flags,
 3466     int fraglen, int rate, struct atw_duration *d0, struct atw_duration *dn,
 3467     int *npktp, int debug)
 3468 {
 3469         int ack, rc;
 3470         int firstlen, hdrlen, lastlen, lastlen0, npkt, overlen, paylen;
 3471 
 3472         if (ieee80211_has_addr4(wh))
 3473                 hdrlen = sizeof(struct ieee80211_frame_addr4);
 3474         else
 3475                 hdrlen = sizeof(struct ieee80211_frame);
 3476 
 3477         paylen = len - hdrlen;
 3478 
 3479         if ((flags & IEEE80211_F_WEPON) != 0)
 3480                 overlen = IEEE80211_WEP_TOTLEN + IEEE80211_CRC_LEN;
 3481         else
 3482                 overlen = IEEE80211_CRC_LEN;
 3483 
 3484         npkt = paylen / fraglen;
 3485         lastlen0 = paylen % fraglen;
 3486 
 3487         if (npkt == 0)                  /* no fragments */
 3488                 lastlen = paylen + overlen;
 3489         else if (lastlen0 != 0) {       /* a short "tail" fragment */
 3490                 lastlen = lastlen0 + overlen;
 3491                 npkt++;
 3492         } else                          /* full-length "tail" fragment */
 3493                 lastlen = fraglen + overlen;
 3494 
 3495         if (npktp != NULL)
 3496                 *npktp = npkt;
 3497 
 3498         if (npkt > 1)
 3499                 firstlen = fraglen + overlen;
 3500         else
 3501                 firstlen = paylen + overlen;
 3502 
 3503         if (debug) {
 3504                 printf("%s: npkt %d firstlen %d lastlen0 %d lastlen %d "
 3505                     "fraglen %d overlen %d len %d rate %d flags %08x\n",
 3506                     __func__, npkt, firstlen, lastlen0, lastlen, fraglen,
 3507                     overlen, len, rate, flags);
 3508         }
 3509 
 3510         ack = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 3511             (wh->i_fc[1] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL;
 3512 
 3513         rc = atw_compute_duration1(firstlen + hdrlen, ack, flags, rate, d0);
 3514         if (rc == -1)
 3515                 return rc;
 3516 
 3517         if (npkt <= 1) {
 3518                 *dn = *d0;
 3519                 return 0;
 3520         }
 3521         return atw_compute_duration1(lastlen + hdrlen, ack, flags, rate, dn);
 3522 }
 3523 
 3524 #ifdef ATW_DEBUG
 3525 void
 3526 atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
 3527 {
 3528         struct atw_softc *sc = ifp->if_softc;
 3529         struct mbuf *m;
 3530         int i, noctets = 0;
 3531 
 3532         printf("%s: %d-byte packet\n", sc->sc_dev.dv_xname,
 3533             m0->m_pkthdr.len);
 3534 
 3535         for (m = m0; m; m = m->m_next) {
 3536                 if (m->m_len == 0)
 3537                         continue;
 3538                 for (i = 0; i < m->m_len; i++) {
 3539                         printf(" %02x", ((u_int8_t*)m->m_data)[i]);
 3540                         if (++noctets % 24 == 0)
 3541                                 printf("\n");
 3542                 }
 3543         }
 3544         printf("%s%s: %d bytes emitted\n",
 3545             (noctets % 24 != 0) ? "\n" : "", sc->sc_dev.dv_xname, noctets);
 3546 }
 3547 #endif /* ATW_DEBUG */
 3548 
 3549 /*
 3550  * atw_start:           [ifnet interface function]
 3551  *
 3552  *      Start packet transmission on the interface.
 3553  */
 3554 void
 3555 atw_start(struct ifnet *ifp)
 3556 {
 3557         struct atw_softc *sc = ifp->if_softc;
 3558         struct ieee80211com *ic = &sc->sc_ic;
 3559         struct ieee80211_node *ni;
 3560         struct ieee80211_frame *wh;
 3561         struct ieee80211_key *k;
 3562         struct atw_frame *hh;
 3563         struct mbuf *m0, *m;
 3564         struct atw_txsoft *txs, *last_txs;
 3565         struct atw_txdesc *txd;
 3566         int do_encrypt, npkt, rate;
 3567         bus_dmamap_t dmamap;
 3568         int ctl, error, firsttx, nexttx, lasttx = -1, first, ofree, seg;
 3569 
 3570         DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
 3571             sc->sc_dev.dv_xname, sc->sc_flags, ifp->if_flags));
 3572 
 3573         if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
 3574                 return;
 3575 
 3576         /*
 3577          * Remember the previous number of free descriptors and
 3578          * the first descriptor we'll use.
 3579          */
 3580         ofree = sc->sc_txfree;
 3581         firsttx = sc->sc_txnext;
 3582 
 3583         DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
 3584             sc->sc_dev.dv_xname, ofree, firsttx));
 3585 
 3586         /*
 3587          * Loop through the send queue, setting up transmit descriptors
 3588          * until we drain the queue, or use up all available transmit
 3589          * descriptors.
 3590          */
 3591         while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
 3592                sc->sc_txfree != 0) {
 3593 
 3594                 /*
 3595                  * Grab a packet off the management queue, if it
 3596                  * is not empty. Otherwise, from the data queue.
 3597                  */
 3598                 m0 = mq_dequeue(&ic->ic_mgtq);
 3599                 if (m0 != NULL) {
 3600                         ni = m0->m_pkthdr.ph_cookie;
 3601                 } else {
 3602                         /* send no data packets until we are associated */
 3603                         if (ic->ic_state != IEEE80211_S_RUN)
 3604                                 break;
 3605                         m0 = ifq_dequeue(&ifp->if_snd);
 3606                         if (m0 == NULL)
 3607                                 break;
 3608 #if NBPFILTER > 0
 3609                         if (ifp->if_bpf != NULL)
 3610                                 bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
 3611 #endif /* NBPFILTER > 0 */
 3612                         if ((m0 = ieee80211_encap(ifp, m0, &ni)) == NULL) {
 3613                                 ifp->if_oerrors++;
 3614                                 break;
 3615                         }
 3616 
 3617                         if (ic->ic_flags & IEEE80211_F_WEPON) {
 3618                                 wh = mtod(m0, struct ieee80211_frame *);
 3619                                 k = ieee80211_get_txkey(ic, wh, ni);
 3620                                 m0 = ieee80211_encrypt(ic, m0, k);
 3621                                 if (m0 == NULL) {
 3622                                         ifp->if_oerrors++;
 3623                                         break;  
 3624                                 }
 3625                         }
 3626                 }
 3627 
 3628                 wh = mtod(m0, struct ieee80211_frame *);
 3629 
 3630                 /* XXX do real rate control */
 3631                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
 3632                     IEEE80211_FC0_TYPE_MGT)
 3633                         rate = 2;
 3634                 else
 3635                         rate = MAX(2, ieee80211_get_rate(ic));
 3636 
 3637                 if (atw_compute_duration(wh, m0->m_pkthdr.len,
 3638                     ic->ic_flags & ~IEEE80211_F_WEPON, ic->ic_fragthreshold,
 3639                     rate, &txs->txs_d0, &txs->txs_dn, &npkt,
 3640                     (sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
 3641                     (IFF_DEBUG|IFF_LINK2)) == -1) {
 3642                         DPRINTF2(sc, ("%s: fail compute duration\n", __func__));
 3643                         m_freem(m0);
 3644                         break;
 3645                 }
 3646 
 3647                 /*
 3648                  * XXX Misleading if fragmentation is enabled.  Better
 3649                  * to fragment in software?
 3650                  */
 3651                 *(uint16_t *)wh->i_dur = htole16(txs->txs_d0.d_rts_dur);
 3652 
 3653 #if NBPFILTER > 0
 3654                 /*
 3655                  * Pass the packet to any BPF listeners.
 3656                  */
 3657                 if (ic->ic_rawbpf != NULL)
 3658                         bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
 3659 
 3660                 if (sc->sc_radiobpf != NULL) {
 3661                         struct mbuf mb;
 3662                         struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
 3663 
 3664                         tap->at_rate = rate;
 3665                         tap->at_chan_freq = ic->ic_bss->ni_chan->ic_freq;
 3666                         tap->at_chan_flags = ic->ic_bss->ni_chan->ic_flags;
 3667 
 3668                         /* TBD tap->at_flags */
 3669 
 3670                         mb.m_data = (caddr_t)tap;
 3671                         mb.m_len = tap->at_ihdr.it_len;
 3672                         mb.m_next = m0;
 3673                         mb.m_nextpkt = NULL;
 3674                         mb.m_type = 0;
 3675                         mb.m_flags = 0;
 3676                         bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_OUT);
 3677                 }
 3678 #endif /* NBPFILTER > 0 */
 3679 
 3680                 M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
 3681 
 3682                 if (ni != NULL)
 3683                         ieee80211_release_node(ic, ni);
 3684 
 3685                 if (m0 == NULL) {
 3686                         ifp->if_oerrors++;
 3687                         break;
 3688                 }
 3689 
 3690                 /* just to make sure. */
 3691                 m0 = m_pullup(m0, sizeof(struct atw_frame));
 3692 
 3693                 if (m0 == NULL) {
 3694                         ifp->if_oerrors++;
 3695                         break;
 3696                 }
 3697 
 3698                 hh = mtod(m0, struct atw_frame *);
 3699                 wh = &hh->atw_ihdr;
 3700 
 3701                 do_encrypt = ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0) ? 1 : 0;
 3702 
 3703                 /* Copy everything we need from the 802.11 header:
 3704                  * Frame Control; address 1, address 3, or addresses
 3705                  * 3 and 4. NIC fills in BSSID, SA.
 3706                  */
 3707                 if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
 3708                         if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
 3709                                 panic("%s: illegal WDS frame",
 3710                                     sc->sc_dev.dv_xname);
 3711                         memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
 3712                 } else
 3713                         memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
 3714 
 3715                 *(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;
 3716 
 3717                 /* initialize remaining Tx parameters */
 3718                 memset(&hh->u, 0, sizeof(hh->u));
 3719 
 3720                 hh->atw_rate = rate * 5;
 3721                 /* XXX this could be incorrect if M_FCS. _encap should
 3722                  * probably strip FCS just in case it sticks around in
 3723                  * bridged packets.
 3724                  */
 3725                 hh->atw_service = IEEE80211_PLCP_SERVICE; /* XXX guess */
 3726                 hh->atw_paylen = htole16(m0->m_pkthdr.len -
 3727                     sizeof(struct atw_frame));
 3728 
 3729                 hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
 3730                 hh->atw_rtylmt = 3;
 3731                 hh->atw_hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
 3732 #if 0
 3733                 if (do_encrypt) {
 3734                         hh->atw_hdrctl |= htole16(ATW_HDRCTL_WEP);
 3735                         hh->atw_keyid = ic->ic_wep_txkey;
 3736                 }
 3737 #endif
 3738 
 3739                 hh->atw_head_plcplen = htole16(txs->txs_d0.d_plcp_len);
 3740                 hh->atw_tail_plcplen = htole16(txs->txs_dn.d_plcp_len);
 3741                 if (txs->txs_d0.d_residue)
 3742                         hh->atw_head_plcplen |= htole16(0x8000);
 3743                 if (txs->txs_dn.d_residue)
 3744                         hh->atw_tail_plcplen |= htole16(0x8000);
 3745                 hh->atw_head_dur = htole16(txs->txs_d0.d_rts_dur);
 3746                 hh->atw_tail_dur = htole16(txs->txs_dn.d_rts_dur);
 3747 
 3748                 /* never fragment multicast frames */
 3749                 if (IEEE80211_IS_MULTICAST(hh->atw_dst)) {
 3750                         hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
 3751                 } else if (sc->sc_flags & ATWF_RTSCTS) {
 3752                         hh->atw_hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
 3753                 }
 3754 
 3755 #ifdef ATW_DEBUG
 3756                 hh->atw_fragnum = 0;
 3757 
 3758                 if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
 3759                         printf("%s: dst = %s, rate = 0x%02x, "
 3760                             "service = 0x%02x, paylen = 0x%04x\n",
 3761                             sc->sc_dev.dv_xname, ether_sprintf(hh->atw_dst),
 3762                             hh->atw_rate, hh->atw_service, hh->atw_paylen);
 3763 
 3764                         printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
 3765                             "dur1 = 0x%04x, dur2 = 0x%04x, "
 3766                             "dur3 = 0x%04x, rts_dur = 0x%04x\n",
 3767                             sc->sc_dev.dv_xname, hh->atw_fc[0], hh->atw_fc[1],
 3768                             hh->atw_tail_plcplen, hh->atw_head_plcplen,
 3769                             hh->atw_tail_dur, hh->atw_head_dur);
 3770 
 3771                         printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
 3772                             "fragnum = 0x%02x, rtylmt = 0x%04x\n",
 3773                             sc->sc_dev.dv_xname, hh->atw_hdrctl,
 3774                             hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
 3775 
 3776                         printf("%s: keyid = %d\n",
 3777                             sc->sc_dev.dv_xname, hh->atw_keyid);
 3778 
 3779                         atw_dump_pkt(ifp, m0);
 3780                 }
 3781 #endif /* ATW_DEBUG */
 3782 
 3783                 dmamap = txs->txs_dmamap;
 3784 
 3785                 /*
 3786                  * Load the DMA map.  Copy and try (once) again if the packet
 3787                  * didn't fit in the allotted number of segments.
 3788                  */
 3789                 for (first = 1;
 3790                      (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
 3791                                   BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;
 3792                      first = 0) {
 3793                         MGETHDR(m, M_DONTWAIT, MT_DATA);
 3794                         if (m == NULL) {
 3795                                 printf("%s: unable to allocate Tx mbuf\n",
 3796                                     sc->sc_dev.dv_xname);
 3797                                 break;
 3798                         }
 3799                         if (m0->m_pkthdr.len > MHLEN) {
 3800                                 MCLGET(m, M_DONTWAIT);
 3801                                 if ((m->m_flags & M_EXT) == 0) {
 3802                                         printf("%s: unable to allocate Tx "
 3803                                             "cluster\n", sc->sc_dev.dv_xname);
 3804                                         m_freem(m);
 3805                                         break;
 3806                                 }
 3807                         }
 3808                         m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
 3809                         m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
 3810                         m_freem(m0);
 3811                         m0 = m;
 3812                         m = NULL;
 3813                 }
 3814                 if (error != 0) {
 3815                         printf("%s: unable to load Tx buffer, "
 3816                             "error = %d\n", sc->sc_dev.dv_xname, error);
 3817                         m_freem(m0);
 3818                         break;
 3819                 }
 3820 
 3821                 /*
 3822                  * Ensure we have enough descriptors free to describe
 3823                  * the packet.
 3824                  */
 3825                 if (dmamap->dm_nsegs > sc->sc_txfree) {
 3826                         /*
 3827                          * Not enough free descriptors to transmit
 3828                          * this packet.  Unload the DMA map and
 3829                          * drop the packet.  Notify the upper layer
 3830                          * that there are no more slots left.
 3831                          *
 3832                          * XXX We could allocate an mbuf and copy, but
 3833                          * XXX it is worth it?
 3834                          */
 3835                         ifq_set_oactive(&ifp->if_snd);
 3836                         bus_dmamap_unload(sc->sc_dmat, dmamap);
 3837                         m_freem(m0);
 3838                         break;
 3839                 }
 3840 
 3841                 /*
 3842                  * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
 3843                  */
 3844 
 3845                 /* Sync the DMA map. */
 3846                 bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
 3847                     BUS_DMASYNC_PREWRITE);
 3848 
 3849                 /* XXX arbitrary retry limit; 8 because I have seen it in
 3850                  * use already and maybe 0 means "no tries" !
 3851                  */
 3852                 ctl = htole32(LSHIFT(8, ATW_TXCTL_TL_MASK));
 3853 
 3854                 DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
 3855                     sc->sc_dev.dv_xname, rate * 5));
 3856                 ctl |= htole32(LSHIFT(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
 3857 
 3858                 /*
 3859                  * Initialize the transmit descriptors.
 3860                  */
 3861                 for (nexttx = sc->sc_txnext, seg = 0;
 3862                      seg < dmamap->dm_nsegs;
 3863                      seg++, nexttx = ATW_NEXTTX(nexttx)) {
 3864                         /*
 3865                          * If this is the first descriptor we're
 3866                          * enqueueing, don't set the OWN bit just
 3867                          * yet.  That could cause a race condition.
 3868                          * We'll do it below.
 3869                          */
 3870                         txd = &sc->sc_txdescs[nexttx];
 3871                         txd->at_ctl = ctl |
 3872                             ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
 3873 
 3874                         txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
 3875                         txd->at_flags =
 3876                             htole32(LSHIFT(dmamap->dm_segs[seg].ds_len,
 3877                                            ATW_TXFLAG_TBS1_MASK)) |
 3878                             ((nexttx == (ATW_NTXDESC - 1))
 3879                                 ? htole32(ATW_TXFLAG_TER) : 0);
 3880                         lasttx = nexttx;
 3881                 }
 3882 
 3883                 if (lasttx == -1)
 3884                         panic("%s: bad lastx", ifp->if_xname);
 3885                 /* Set `first segment' and `last segment' appropriately. */
 3886                 sc->sc_txdescs[sc->sc_txnext].at_flags |=
 3887                     htole32(ATW_TXFLAG_FS);
 3888                 sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
 3889 
 3890 #ifdef ATW_DEBUG
 3891                 if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
 3892                         printf("     txsoft %p transmit chain:\n", txs);
 3893                         for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
 3894                                 printf("     descriptor %d:\n", seg);
 3895                                 printf("       at_ctl:   0x%08x\n",
 3896                                     letoh32(sc->sc_txdescs[seg].at_ctl));
 3897                                 printf("       at_flags:      0x%08x\n",
 3898                                     letoh32(sc->sc_txdescs[seg].at_flags));
 3899                                 printf("       at_buf1: 0x%08x\n",
 3900                                     letoh32(sc->sc_txdescs[seg].at_buf1));
 3901                                 printf("       at_buf2: 0x%08x\n",
 3902                                     letoh32(sc->sc_txdescs[seg].at_buf2));
 3903                                 if (seg == lasttx)
 3904                                         break;
 3905                         }
 3906                 }
 3907 #endif
 3908 
 3909                 /* Sync the descriptors we're using. */
 3910                 ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
 3911                     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 3912 
 3913                 /*
 3914                  * Store a pointer to the packet so we can free it later,
 3915                  * and remember what txdirty will be once the packet is
 3916                  * done.
 3917                  */
 3918                 txs->txs_mbuf = m0;
 3919                 txs->txs_firstdesc = sc->sc_txnext;
 3920                 txs->txs_lastdesc = lasttx;
 3921                 txs->txs_ndescs = dmamap->dm_nsegs;
 3922 
 3923                 /* Advance the tx pointer. */
 3924                 sc->sc_txfree -= dmamap->dm_nsegs;
 3925                 sc->sc_txnext = nexttx;
 3926 
 3927                 SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
 3928                 SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
 3929 
 3930                 last_txs = txs;
 3931         }
 3932 
 3933         if (txs == NULL || sc->sc_txfree == 0) {
 3934                 /* No more slots left; notify upper layer. */
 3935                 ifq_set_oactive(&ifp->if_snd);
 3936         }
 3937 
 3938         if (sc->sc_txfree != ofree) {
 3939                 DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
 3940                     sc->sc_dev.dv_xname, lasttx, firsttx));
 3941                 /*
 3942                  * Cause a transmit interrupt to happen on the
 3943                  * last packet we enqueued.
 3944                  */
 3945                 sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
 3946                 ATW_CDTXSYNC(sc, lasttx, 1,
 3947                     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 3948 
 3949                 /*
 3950                  * The entire packet chain is set up.  Give the
 3951                  * first descriptor to the chip now.
 3952                  */
 3953                 sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
 3954                 ATW_CDTXSYNC(sc, firsttx, 1,
 3955                     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 3956 
 3957                 /* Wake up the transmitter. */
 3958                 ATW_WRITE(sc, ATW_TDR, 0x1);
 3959 
 3960                 /* Set a watchdog timer in case the chip flakes out. */
 3961                 sc->sc_tx_timer = 5;
 3962                 ifp->if_timer = 1;
 3963         }
 3964 }
 3965 
 3966 int
 3967 atw_activate(struct device *self, int act)
 3968 {
 3969         struct atw_softc *sc = (struct atw_softc *)self;
 3970         struct ifnet *ifp = &sc->sc_ic.ic_if;
 3971 
 3972         switch (act) {
 3973         case DVACT_SUSPEND:
 3974                 if (ifp->if_flags & IFF_RUNNING)
 3975                         atw_stop(ifp, 1);
 3976                 if (sc->sc_power != NULL)
 3977                         (*sc->sc_power)(sc, act);
 3978                 break;
 3979         case DVACT_WAKEUP:
 3980                 atw_wakeup(sc);
 3981                 break;
 3982         }
 3983         return 0;
 3984 }
 3985 
 3986 void
 3987 atw_wakeup(struct atw_softc *sc)
 3988 {
 3989         struct ifnet *ifp = &sc->sc_ic.ic_if;
 3990 
 3991         if (sc->sc_power != NULL)
 3992                 (*sc->sc_power)(sc, DVACT_RESUME);
 3993         if (ifp->if_flags & IFF_UP)
 3994                 atw_init(ifp);
 3995 }
 3996 
 3997 /*
 3998  * atw_ioctl:           [ifnet interface function]
 3999  *
 4000  *      Handle control requests from the operator.
 4001  */
 4002 int
 4003 atw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 4004 {
 4005         struct atw_softc *sc = ifp->if_softc;
 4006         struct ifreq *ifr = (struct ifreq *)data;
 4007         int s, error = 0;
 4008 
 4009         /* XXX monkey see, monkey do. comes from wi_ioctl. */
 4010         if ((sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
 4011                 return ENXIO;
 4012 
 4013         s = splnet();
 4014 
 4015         switch (cmd) {
 4016         case SIOCSIFADDR:
 4017                 ifp->if_flags |= IFF_UP;
 4018                 /* FALLTHROUGH */
 4019 
 4020         case SIOCSIFFLAGS:
 4021                 if (ifp->if_flags & IFF_UP) {
 4022                         if (ATW_IS_ENABLED(sc)) {
 4023                                 /*
 4024                                  * To avoid rescanning another access point,
 4025                                  * do not call atw_init() here.  Instead,
 4026                                  * only reflect media settings.
 4027                                  */
 4028                                 atw_filter_setup(sc);
 4029                         } else
 4030                                 error = atw_init(ifp);
 4031                 } else if (ATW_IS_ENABLED(sc))
 4032                         atw_stop(ifp, 1);
 4033                 break;
 4034 
 4035         case SIOCADDMULTI:
 4036         case SIOCDELMULTI:
 4037                 error = (cmd == SIOCADDMULTI) ?
 4038                     ether_addmulti(ifr, &sc->sc_ic.ic_ac) :
 4039                     ether_delmulti(ifr, &sc->sc_ic.ic_ac);
 4040 
 4041                 if (error == ENETRESET) {
 4042                         if (ifp->if_flags & IFF_RUNNING)
 4043                                 atw_filter_setup(sc); /* do not rescan */
 4044                         error = 0;
 4045                 }
 4046                 break;
 4047 
 4048         default:
 4049                 error = ieee80211_ioctl(ifp, cmd, data);
 4050                 if (error == ENETRESET) {
 4051                         if (ATW_IS_ENABLED(sc))
 4052                                 error = atw_init(ifp);
 4053                         else
 4054                                 error = 0;
 4055                 }
 4056                 break;
 4057         }
 4058 
 4059         /* Try to get more packets going. */
 4060         if (ATW_IS_ENABLED(sc))
 4061                 atw_start(ifp);
 4062 
 4063         splx(s);
 4064         return (error);
 4065 }
 4066 
 4067 int
 4068 atw_media_change(struct ifnet *ifp)
 4069 {
 4070         int error;
 4071 
 4072         error = ieee80211_media_change(ifp);
 4073         if (error == ENETRESET) {
 4074                 if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
 4075                     (IFF_RUNNING|IFF_UP))
 4076                         atw_init(ifp);          /* XXX lose error */
 4077                 error = 0;
 4078         }
 4079         return error;
 4080 }
 4081 
 4082 void
 4083 atw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
 4084 {
 4085         struct atw_softc *sc = ifp->if_softc;
 4086 
 4087         if (ATW_IS_ENABLED(sc) == 0) {
 4088                 imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
 4089                 imr->ifm_status = 0;
 4090                 return;
 4091         }
 4092         ieee80211_media_status(ifp, imr);
 4093 }

Cache object: 4218e00c83cded40619add49e84e7bfc


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.