The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ic/rtw.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /* $NetBSD: rtw.c,v 1.81 2006/11/16 01:32:52 christos Exp $ */
    2 /*-
    3  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
    4  *
    5  * Programmed for NetBSD by David Young.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  * 3. The name of David Young may not be used to endorse or promote
   16  *    products derived from this software without specific prior
   17  *    written permission.
   18  *
   19  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
   20  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
   21  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
   22  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
   23  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
   24  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
   25  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
   27  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
   28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
   30  * OF SUCH DAMAGE.
   31  */
   32 /*
   33  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
   34  */
   35 
   36 #include <sys/cdefs.h>
   37 __KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.81 2006/11/16 01:32:52 christos Exp $");
   38 
   39 #include "bpfilter.h"
   40 
   41 #include <sys/param.h>
   42 #include <sys/sysctl.h>
   43 #include <sys/systm.h>
   44 #include <sys/callout.h>
   45 #include <sys/mbuf.h>
   46 #include <sys/malloc.h>
   47 #include <sys/kernel.h>
   48 #include <sys/time.h>
   49 #include <sys/types.h>
   50 
   51 #include <machine/endian.h>
   52 #include <machine/bus.h>
   53 #include <machine/intr.h>       /* splnet */
   54 
   55 #include <uvm/uvm_extern.h>
   56 
   57 #include <net/if.h>
   58 #include <net/if_media.h>
   59 #include <net/if_ether.h>
   60 
   61 #include <net80211/ieee80211_netbsd.h>
   62 #include <net80211/ieee80211_var.h>
   63 #include <net80211/ieee80211_radiotap.h>
   64 
   65 #if NBPFILTER > 0
   66 #include <net/bpf.h>
   67 #endif
   68 
   69 #include <dev/ic/rtwreg.h>
   70 #include <dev/ic/rtwvar.h>
   71 #include <dev/ic/rtwphyio.h>
   72 #include <dev/ic/rtwphy.h>
   73 
   74 #include <dev/ic/smc93cx6var.h>
   75 
   76 #define KASSERT2(__cond, __msg)         \
   77         do {                            \
   78                 if (!(__cond))          \
   79                         panic __msg ;   \
   80         } while (0)
   81 
   82 static int rtw_rfprog_fallback = 0;
   83 static int rtw_host_rfio = 0;
   84 
   85 #ifdef RTW_DEBUG
   86 int rtw_debug = 0;
   87 static int rtw_rxbufs_limit = RTW_RXQLEN;
   88 #endif /* RTW_DEBUG */
   89 
   90 #define NEXT_ATTACH_STATE(sc, state) do {                       \
   91         DPRINTF(sc, RTW_DEBUG_ATTACH,                           \
   92             ("%s: attach state %s\n", __func__, #state));       \
   93         sc->sc_attach_state = state;                            \
   94 } while (0)
   95 
   96 static int rtw_xmtr_restart = 0;
   97 static int rtw_do_chip_reset = 0;
   98 static int rtw_ring_reset = 0;
   99 
  100 int rtw_dwelltime = 200;        /* milliseconds */
  101 static struct ieee80211_cipher rtw_cipher_wep;
  102 
  103 static void rtw_start(struct ifnet *);
  104 static void rtw_reset_oactive(struct rtw_softc *);
  105 static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
  106     struct ieee80211_node *);
  107 static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
  108 
  109 static void rtw_io_enable(struct rtw_regs *, uint8_t, int);
  110 static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
  111 static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
  112     const u_int8_t[IEEE80211_ADDR_LEN]);
  113 static void rtw_key_update_end(struct ieee80211com *);
  114 static void rtw_key_update_begin(struct ieee80211com *);
  115 static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
  116 static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
  117 
  118 static void rtw_led_attach(struct rtw_led_state *, void *);
  119 static void rtw_led_init(struct rtw_regs *);
  120 static void rtw_led_slowblink(void *);
  121 static void rtw_led_fastblink(void *);
  122 static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
  123 
  124 static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
  125 static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
  126 #ifdef RTW_DEBUG
  127 static void rtw_print_txdesc(struct rtw_softc *, const char *,
  128     struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
  129 static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
  130 static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
  131 #endif /* RTW_DEBUG */
  132 
  133 /*
  134  * Setup sysctl(3) MIB, hw.rtw.*
  135  *
  136  * TBD condition CTLFLAG_PERMANENT on being an LKM or not
  137  */
  138 SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
  139 {
  140         int rc;
  141         const struct sysctlnode *cnode, *rnode;
  142 
  143         if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
  144             CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
  145             NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
  146                 goto err;
  147 
  148         if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
  149             CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
  150             "Realtek RTL818x 802.11 controls",
  151             NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
  152                 goto err;
  153 
  154         if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
  155             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  156             "chip_reset", SYSCTL_DESCR("Gratuitously reset chip on rcvr error"),
  157             NULL, 0, &rtw_do_chip_reset, 0,
  158             CTL_CREATE, CTL_EOL)) != 0)
  159                 goto err;
  160 
  161         if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
  162             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  163             "ring_reset", SYSCTL_DESCR("Reset ring pointers on rcvr error"),
  164             NULL, 0, &rtw_ring_reset, 0,
  165             CTL_CREATE, CTL_EOL)) != 0)
  166                 goto err;
  167 
  168         if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
  169             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  170             "xmtr_restart",
  171             SYSCTL_DESCR("Gratuitously reset xmtr on rcvr error"),
  172             NULL, 0, &rtw_xmtr_restart, 0,
  173             CTL_CREATE, CTL_EOL)) != 0)
  174                 goto err;
  175 
  176 #ifdef RTW_DEBUG
  177         /* control debugging printfs */
  178         if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
  179             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  180             "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
  181             rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
  182             CTL_CREATE, CTL_EOL)) != 0)
  183                 goto err;
  184 
  185         /* Limit rx buffers, for simulating resource exhaustion. */
  186         if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
  187             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  188             "rxbufs_limit",
  189             SYSCTL_DESCR("Set rx buffers limit"),
  190             rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
  191             CTL_CREATE, CTL_EOL)) != 0)
  192                 goto err;
  193 
  194 #endif /* RTW_DEBUG */
  195         /* set fallback RF programming method */
  196         if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
  197             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  198             "rfprog_fallback",
  199             SYSCTL_DESCR("Set fallback RF programming method"),
  200             rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
  201             CTL_CREATE, CTL_EOL)) != 0)
  202                 goto err;
  203 
  204         /* force host to control RF I/O bus */
  205         if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
  206             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  207             "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
  208             rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
  209             CTL_CREATE, CTL_EOL)) != 0)
  210                 goto err;
  211 
  212         return;
  213 err:
  214         printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
  215 }
  216 
  217 static int
  218 rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
  219 {
  220         int error, t;
  221         struct sysctlnode node;
  222 
  223         node = *rnode;
  224         t = *(int*)rnode->sysctl_data;
  225         node.sysctl_data = &t;
  226         error = sysctl_lookup(SYSCTLFN_CALL(&node));
  227         if (error || newp == NULL)
  228                 return (error);
  229 
  230         if (t < lower || t > upper)
  231                 return (EINVAL);
  232 
  233         *(int*)rnode->sysctl_data = t;
  234 
  235         return (0);
  236 }
  237 
  238 static int
  239 rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
  240 {
  241         return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
  242             __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
  243 }
  244 
  245 static int
  246 rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
  247 {
  248         return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
  249 }
  250 
  251 #ifdef RTW_DEBUG
  252 static int
  253 rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
  254 {
  255         return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
  256             0, RTW_DEBUG_MAX);
  257 }
  258 
  259 static int
  260 rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
  261 {
  262         return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
  263             0, RTW_RXQLEN);
  264 }
  265 
  266 static void
  267 rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
  268 {
  269 #define PRINTREG32(sc, reg)                             \
  270         RTW_DPRINTF(RTW_DEBUG_REGDUMP,                  \
  271             ("%s: reg[ " #reg " / %03x ] = %08x\n",     \
  272             dvname, reg, RTW_READ(regs, reg)))
  273 
  274 #define PRINTREG16(sc, reg)                             \
  275         RTW_DPRINTF(RTW_DEBUG_REGDUMP,                  \
  276             ("%s: reg[ " #reg " / %03x ] = %04x\n",     \
  277             dvname, reg, RTW_READ16(regs, reg)))
  278 
  279 #define PRINTREG8(sc, reg)                              \
  280         RTW_DPRINTF(RTW_DEBUG_REGDUMP,                  \
  281             ("%s: reg[ " #reg " / %03x ] = %02x\n",     \
  282             dvname, reg, RTW_READ8(regs, reg)))
  283 
  284         RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
  285 
  286         PRINTREG32(regs, RTW_IDR0);
  287         PRINTREG32(regs, RTW_IDR1);
  288         PRINTREG32(regs, RTW_MAR0);
  289         PRINTREG32(regs, RTW_MAR1);
  290         PRINTREG32(regs, RTW_TSFTRL);
  291         PRINTREG32(regs, RTW_TSFTRH);
  292         PRINTREG32(regs, RTW_TLPDA);
  293         PRINTREG32(regs, RTW_TNPDA);
  294         PRINTREG32(regs, RTW_THPDA);
  295         PRINTREG32(regs, RTW_TCR);
  296         PRINTREG32(regs, RTW_RCR);
  297         PRINTREG32(regs, RTW_TINT);
  298         PRINTREG32(regs, RTW_TBDA);
  299         PRINTREG32(regs, RTW_ANAPARM);
  300         PRINTREG32(regs, RTW_BB);
  301         PRINTREG32(regs, RTW_PHYCFG);
  302         PRINTREG32(regs, RTW_WAKEUP0L);
  303         PRINTREG32(regs, RTW_WAKEUP0H);
  304         PRINTREG32(regs, RTW_WAKEUP1L);
  305         PRINTREG32(regs, RTW_WAKEUP1H);
  306         PRINTREG32(regs, RTW_WAKEUP2LL);
  307         PRINTREG32(regs, RTW_WAKEUP2LH);
  308         PRINTREG32(regs, RTW_WAKEUP2HL);
  309         PRINTREG32(regs, RTW_WAKEUP2HH);
  310         PRINTREG32(regs, RTW_WAKEUP3LL);
  311         PRINTREG32(regs, RTW_WAKEUP3LH);
  312         PRINTREG32(regs, RTW_WAKEUP3HL);
  313         PRINTREG32(regs, RTW_WAKEUP3HH);
  314         PRINTREG32(regs, RTW_WAKEUP4LL);
  315         PRINTREG32(regs, RTW_WAKEUP4LH);
  316         PRINTREG32(regs, RTW_WAKEUP4HL);
  317         PRINTREG32(regs, RTW_WAKEUP4HH);
  318         PRINTREG32(regs, RTW_DK0);
  319         PRINTREG32(regs, RTW_DK1);
  320         PRINTREG32(regs, RTW_DK2);
  321         PRINTREG32(regs, RTW_DK3);
  322         PRINTREG32(regs, RTW_RETRYCTR);
  323         PRINTREG32(regs, RTW_RDSAR);
  324         PRINTREG32(regs, RTW_FER);
  325         PRINTREG32(regs, RTW_FEMR);
  326         PRINTREG32(regs, RTW_FPSR);
  327         PRINTREG32(regs, RTW_FFER);
  328 
  329         /* 16-bit registers */
  330         PRINTREG16(regs, RTW_BRSR);
  331         PRINTREG16(regs, RTW_IMR);
  332         PRINTREG16(regs, RTW_ISR);
  333         PRINTREG16(regs, RTW_BCNITV);
  334         PRINTREG16(regs, RTW_ATIMWND);
  335         PRINTREG16(regs, RTW_BINTRITV);
  336         PRINTREG16(regs, RTW_ATIMTRITV);
  337         PRINTREG16(regs, RTW_CRC16ERR);
  338         PRINTREG16(regs, RTW_CRC0);
  339         PRINTREG16(regs, RTW_CRC1);
  340         PRINTREG16(regs, RTW_CRC2);
  341         PRINTREG16(regs, RTW_CRC3);
  342         PRINTREG16(regs, RTW_CRC4);
  343         PRINTREG16(regs, RTW_CWR);
  344 
  345         /* 8-bit registers */
  346         PRINTREG8(regs, RTW_CR);
  347         PRINTREG8(regs, RTW_9346CR);
  348         PRINTREG8(regs, RTW_CONFIG0);
  349         PRINTREG8(regs, RTW_CONFIG1);
  350         PRINTREG8(regs, RTW_CONFIG2);
  351         PRINTREG8(regs, RTW_MSR);
  352         PRINTREG8(regs, RTW_CONFIG3);
  353         PRINTREG8(regs, RTW_CONFIG4);
  354         PRINTREG8(regs, RTW_TESTR);
  355         PRINTREG8(regs, RTW_PSR);
  356         PRINTREG8(regs, RTW_SCR);
  357         PRINTREG8(regs, RTW_PHYDELAY);
  358         PRINTREG8(regs, RTW_CRCOUNT);
  359         PRINTREG8(regs, RTW_PHYADDR);
  360         PRINTREG8(regs, RTW_PHYDATAW);
  361         PRINTREG8(regs, RTW_PHYDATAR);
  362         PRINTREG8(regs, RTW_CONFIG5);
  363         PRINTREG8(regs, RTW_TPPOLL);
  364 
  365         PRINTREG16(regs, RTW_BSSID16);
  366         PRINTREG32(regs, RTW_BSSID32);
  367 #undef PRINTREG32
  368 #undef PRINTREG16
  369 #undef PRINTREG8
  370 }
  371 #endif /* RTW_DEBUG */
  372 
  373 void
  374 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
  375 {
  376         struct rtw_regs *regs = &sc->sc_regs;
  377 
  378         uint32_t tcr;
  379         tcr = RTW_READ(regs, RTW_TCR);
  380         tcr &= ~RTW_TCR_LBK_MASK;
  381         if (enable)
  382                 tcr |= RTW_TCR_LBK_CONT;
  383         else
  384                 tcr |= RTW_TCR_LBK_NORMAL;
  385         RTW_WRITE(regs, RTW_TCR, tcr);
  386         RTW_SYNC(regs, RTW_TCR, RTW_TCR);
  387         rtw_set_access(regs, RTW_ACCESS_ANAPARM);
  388         rtw_txdac_enable(sc, !enable);
  389         rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
  390         rtw_set_access(regs, RTW_ACCESS_NONE);
  391 }
  392 
  393 #ifdef RTW_DEBUG
  394 static const char *
  395 rtw_access_string(enum rtw_access access)
  396 {
  397         switch (access) {
  398         case RTW_ACCESS_NONE:
  399                 return "none";
  400         case RTW_ACCESS_CONFIG:
  401                 return "config";
  402         case RTW_ACCESS_ANAPARM:
  403                 return "anaparm";
  404         default:
  405                 return "unknown";
  406         }
  407 }
  408 #endif /* RTW_DEBUG */
  409 
  410 static void
  411 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
  412 {
  413         KASSERT(/* naccess >= RTW_ACCESS_NONE && */
  414             naccess <= RTW_ACCESS_ANAPARM);
  415         KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
  416             regs->r_access <= RTW_ACCESS_ANAPARM);
  417 
  418         if (naccess == regs->r_access)
  419                 return;
  420 
  421         switch (naccess) {
  422         case RTW_ACCESS_NONE:
  423                 switch (regs->r_access) {
  424                 case RTW_ACCESS_ANAPARM:
  425                         rtw_anaparm_enable(regs, 0);
  426                         /*FALLTHROUGH*/
  427                 case RTW_ACCESS_CONFIG:
  428                         rtw_config0123_enable(regs, 0);
  429                         /*FALLTHROUGH*/
  430                 case RTW_ACCESS_NONE:
  431                         break;
  432                 }
  433                 break;
  434         case RTW_ACCESS_CONFIG:
  435                 switch (regs->r_access) {
  436                 case RTW_ACCESS_NONE:
  437                         rtw_config0123_enable(regs, 1);
  438                         /*FALLTHROUGH*/
  439                 case RTW_ACCESS_CONFIG:
  440                         break;
  441                 case RTW_ACCESS_ANAPARM:
  442                         rtw_anaparm_enable(regs, 0);
  443                         break;
  444                 }
  445                 break;
  446         case RTW_ACCESS_ANAPARM:
  447                 switch (regs->r_access) {
  448                 case RTW_ACCESS_NONE:
  449                         rtw_config0123_enable(regs, 1);
  450                         /*FALLTHROUGH*/
  451                 case RTW_ACCESS_CONFIG:
  452                         rtw_anaparm_enable(regs, 1);
  453                         /*FALLTHROUGH*/
  454                 case RTW_ACCESS_ANAPARM:
  455                         break;
  456                 }
  457                 break;
  458         }
  459 }
  460 
  461 void
  462 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
  463 {
  464         rtw_set_access1(regs, access);
  465         RTW_DPRINTF(RTW_DEBUG_ACCESS,
  466             ("%s: access %s -> %s\n", __func__,
  467             rtw_access_string(regs->r_access),
  468             rtw_access_string(access)));
  469         regs->r_access = access;
  470 }
  471 
  472 /*
  473  * Enable registers, switch register banks.
  474  */
  475 void
  476 rtw_config0123_enable(struct rtw_regs *regs, int enable)
  477 {
  478         uint8_t ecr;
  479         ecr = RTW_READ8(regs, RTW_9346CR);
  480         ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
  481         if (enable)
  482                 ecr |= RTW_9346CR_EEM_CONFIG;
  483         else {
  484                 RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
  485                 ecr |= RTW_9346CR_EEM_NORMAL;
  486         }
  487         RTW_WRITE8(regs, RTW_9346CR, ecr);
  488         RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
  489 }
  490 
  491 /* requires rtw_config0123_enable(, 1) */
  492 void
  493 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
  494 {
  495         uint8_t cfg3;
  496 
  497         cfg3 = RTW_READ8(regs, RTW_CONFIG3);
  498         cfg3 |= RTW_CONFIG3_CLKRUNEN;
  499         if (enable)
  500                 cfg3 |= RTW_CONFIG3_PARMEN;
  501         else
  502                 cfg3 &= ~RTW_CONFIG3_PARMEN;
  503         RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
  504         RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
  505 }
  506 
  507 /* requires rtw_anaparm_enable(, 1) */
  508 void
  509 rtw_txdac_enable(struct rtw_softc *sc, int enable)
  510 {
  511         uint32_t anaparm;
  512         struct rtw_regs *regs = &sc->sc_regs;
  513 
  514         anaparm = RTW_READ(regs, RTW_ANAPARM);
  515         if (enable)
  516                 anaparm &= ~RTW_ANAPARM_TXDACOFF;
  517         else
  518                 anaparm |= RTW_ANAPARM_TXDACOFF;
  519         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
  520         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
  521 }
  522 
  523 static inline int
  524 rtw_chip_reset1(struct rtw_regs *regs, const char *dvname)
  525 {
  526         uint8_t cr;
  527         int i;
  528 
  529         RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
  530 
  531         RTW_WBR(regs, RTW_CR, RTW_CR);
  532 
  533         for (i = 0; i < 1000; i++) {
  534                 if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
  535                         RTW_DPRINTF(RTW_DEBUG_RESET,
  536                             ("%s: reset in %dus\n", dvname, i));
  537                         return 0;
  538                 }
  539                 RTW_RBR(regs, RTW_CR, RTW_CR);
  540                 DELAY(10); /* 10us */
  541         }
  542 
  543         printf("%s: reset failed\n", dvname);
  544         return ETIMEDOUT;
  545 }
  546 
  547 static inline int
  548 rtw_chip_reset(struct rtw_regs *regs, const char *dvname)
  549 {
  550         uint32_t tcr;
  551 
  552         /* from Linux driver */
  553         tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
  554               __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
  555 
  556         RTW_WRITE(regs, RTW_TCR, tcr);
  557 
  558         RTW_WBW(regs, RTW_CR, RTW_TCR);
  559 
  560         return rtw_chip_reset1(regs, dvname);
  561 }
  562 
  563 static int
  564 rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
  565 {
  566         struct ieee80211_key keycopy;
  567 
  568         RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
  569 
  570         keycopy = *k;
  571         keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
  572 
  573         return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
  574 }
  575 
  576 static int
  577 rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
  578 {
  579         struct rtw_softc *sc = ic->ic_ifp->if_softc;
  580         u_int keyix = k->wk_keyix;
  581 
  582         DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__, keyix));
  583 
  584         if (keyix >= IEEE80211_WEP_NKID)
  585                 return 0;
  586         if (k->wk_keylen != 0)
  587                 sc->sc_flags &= ~RTW_F_DK_VALID;
  588 
  589         return 1;
  590 }
  591 
  592 static int
  593 rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
  594     const u_int8_t mac[IEEE80211_ADDR_LEN])
  595 {
  596         struct rtw_softc *sc = ic->ic_ifp->if_softc;
  597 
  598         DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
  599 
  600         if (k->wk_keyix >= IEEE80211_WEP_NKID)
  601                 return 0;
  602 
  603         sc->sc_flags &= ~RTW_F_DK_VALID;
  604 
  605         return 1;
  606 }
  607 
  608 static void
  609 rtw_key_update_begin(struct ieee80211com *ic)
  610 {
  611 #ifdef RTW_DEBUG
  612         struct ifnet *ifp = ic->ic_ifp;
  613         struct rtw_softc *sc = ifp->if_softc;
  614 #endif
  615 
  616         DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
  617 }
  618 
  619 static void
  620 rtw_key_update_end(struct ieee80211com *ic)
  621 {
  622         struct ifnet *ifp = ic->ic_ifp;
  623         struct rtw_softc *sc = ifp->if_softc;
  624 
  625         DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
  626 
  627         if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
  628             (sc->sc_flags & RTW_F_ENABLED) == 0 ||
  629             (sc->sc_flags & RTW_F_INVALID) != 0)
  630                 return;
  631 
  632         rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
  633         rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
  634         rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE,
  635             (ifp->if_flags & IFF_RUNNING) != 0);
  636 }
  637 
  638 static inline int
  639 rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
  640 {
  641         if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
  642                 return 0;
  643 
  644         return  ((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
  645                 ((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
  646 }
  647 
  648 static void
  649 rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
  650 {
  651         uint8_t psr, scr;
  652         int i, keylen;
  653         struct rtw_regs *regs;
  654         union rtw_keys *rk;
  655 
  656         regs = &sc->sc_regs;
  657         rk = &sc->sc_keys;
  658 
  659         (void)memset(rk->rk_keys, 0, sizeof(rk->rk_keys));
  660 
  661         /* Temporarily use software crypto for all keys. */
  662         for (i = 0; i < IEEE80211_WEP_NKID; i++) {
  663                 if (wk[i].wk_cipher == &rtw_cipher_wep)
  664                         wk[i].wk_cipher = &ieee80211_cipher_wep;
  665         }
  666 
  667         rtw_set_access(regs, RTW_ACCESS_CONFIG);
  668 
  669         psr = RTW_READ8(regs, RTW_PSR);
  670         scr = RTW_READ8(regs, RTW_SCR);
  671         scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
  672 
  673         if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
  674                 goto out;
  675 
  676         for (keylen = i = 0; i < IEEE80211_WEP_NKID; i++) {
  677                 if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
  678                         continue;
  679                 if (i == txkey) {
  680                         keylen = wk[i].wk_keylen;
  681                         break;
  682                 }
  683                 keylen = MAX(keylen, wk[i].wk_keylen);
  684         }
  685 
  686         if (keylen == 5)
  687                 scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
  688         else if (keylen == 13)
  689                 scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
  690 
  691         for (i = 0; i < IEEE80211_WEP_NKID; i++) {
  692                 if (wk[i].wk_keylen != keylen ||
  693                     wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
  694                         continue;
  695                 /* h/w will decrypt, s/w still strips headers */
  696                 wk[i].wk_cipher = &rtw_cipher_wep;
  697                 (void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
  698         }
  699 
  700 out:
  701         RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
  702 
  703         bus_space_write_region_4(regs->r_bt, regs->r_bh,
  704             RTW_DK0, rk->rk_words,
  705             sizeof(rk->rk_words) / sizeof(rk->rk_words[0]));
  706 
  707         bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
  708             BUS_SPACE_BARRIER_SYNC);
  709 
  710         RTW_WBW(regs, RTW_DK0, RTW_PSR);
  711         RTW_WRITE8(regs, RTW_PSR, psr);
  712         RTW_WBW(regs, RTW_PSR, RTW_SCR);
  713         RTW_WRITE8(regs, RTW_SCR, scr);
  714         RTW_SYNC(regs, RTW_SCR, RTW_SCR);
  715         rtw_set_access(regs, RTW_ACCESS_NONE);
  716         sc->sc_flags |= RTW_F_DK_VALID;
  717 }
  718 
  719 static inline int
  720 rtw_recall_eeprom(struct rtw_regs *regs, const char *dvname)
  721 {
  722         int i;
  723         uint8_t ecr;
  724 
  725         ecr = RTW_READ8(regs, RTW_9346CR);
  726         ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
  727         RTW_WRITE8(regs, RTW_9346CR, ecr);
  728 
  729         RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
  730 
  731         /* wait 25ms for completion */
  732         for (i = 0; i < 250; i++) {
  733                 ecr = RTW_READ8(regs, RTW_9346CR);
  734                 if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
  735                         RTW_DPRINTF(RTW_DEBUG_RESET,
  736                             ("%s: recall EEPROM in %dus\n", dvname, i * 100));
  737                         return 0;
  738                 }
  739                 RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
  740                 DELAY(100);
  741         }
  742         printf("%s: recall EEPROM failed\n", dvname);
  743         return ETIMEDOUT;
  744 }
  745 
  746 static inline int
  747 rtw_reset(struct rtw_softc *sc)
  748 {
  749         int rc;
  750         uint8_t config1;
  751 
  752         sc->sc_flags &= ~RTW_F_DK_VALID;
  753 
  754         if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
  755                 return rc;
  756 
  757         rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev.dv_xname);
  758 
  759         config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
  760         RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
  761         /* TBD turn off maximum power saving? */
  762 
  763         return 0;
  764 }
  765 
  766 static inline int
  767 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
  768     u_int ndescs)
  769 {
  770         int i, rc = 0;
  771         for (i = 0; i < ndescs; i++) {
  772                 rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
  773                     0, 0, &descs[i].ts_dmamap);
  774                 if (rc != 0)
  775                         break;
  776         }
  777         return rc;
  778 }
  779 
  780 static inline int
  781 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
  782     u_int ndescs)
  783 {
  784         int i, rc = 0;
  785         for (i = 0; i < ndescs; i++) {
  786                 rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
  787                     &descs[i].rs_dmamap);
  788                 if (rc != 0)
  789                         break;
  790         }
  791         return rc;
  792 }
  793 
  794 static inline void
  795 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
  796     u_int ndescs)
  797 {
  798         int i;
  799         for (i = 0; i < ndescs; i++) {
  800                 if (descs[i].rs_dmamap != NULL)
  801                         bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
  802         }
  803 }
  804 
  805 static inline void
  806 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
  807     u_int ndescs)
  808 {
  809         int i;
  810         for (i = 0; i < ndescs; i++) {
  811                 if (descs[i].ts_dmamap != NULL)
  812                         bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
  813         }
  814 }
  815 
  816 static inline void
  817 rtw_srom_free(struct rtw_srom *sr)
  818 {
  819         sr->sr_size = 0;
  820         if (sr->sr_content == NULL)
  821                 return;
  822         free(sr->sr_content, M_DEVBUF);
  823         sr->sr_content = NULL;
  824 }
  825 
  826 static void
  827 rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
  828     uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
  829 {
  830         *flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
  831         *cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
  832         *rcr |= RTW_RCR_ENCS1;
  833         *rfchipid = RTW_RFCHIPID_PHILIPS;
  834 }
  835 
  836 static int
  837 rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
  838     enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
  839     const char *dvname)
  840 {
  841         int i;
  842         const char *rfname, *paname;
  843         char scratch[sizeof("unknown 0xXX")];
  844         uint16_t srom_version;
  845         uint8_t mac[IEEE80211_ADDR_LEN];
  846 
  847         *flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
  848         *rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
  849 
  850         srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
  851         printf("%s: SROM version %d.%d", dvname,
  852             srom_version >> 8, srom_version & 0xff);
  853 
  854         if (srom_version <= 0x0101) {
  855                 printf(" is not understood, limping along with defaults\n");
  856                 rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
  857                 return 0;
  858         }
  859         printf("\n");
  860 
  861         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
  862                 mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
  863 
  864         RTW_DPRINTF(RTW_DEBUG_ATTACH,
  865             ("%s: EEPROM MAC %s\n", dvname, ether_sprintf(mac)));
  866 
  867         *cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
  868 
  869         if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
  870                 *flags |= RTW_F_ANTDIV;
  871 
  872         /* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
  873          * to be reversed.
  874          */
  875         if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
  876                 *flags |= RTW_F_DIGPHY;
  877         if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
  878                 *flags |= RTW_F_DFLANTB;
  879 
  880         *rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
  881             RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
  882 
  883         if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
  884                 *flags |= RTW_C_RXWEP_104;
  885 
  886         *flags |= RTW_C_RXWEP_40;       /* XXX */
  887 
  888         *rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
  889         switch (*rfchipid) {
  890         case RTW_RFCHIPID_GCT:          /* this combo seen in the wild */
  891                 rfname = "GCT GRF5101";
  892                 paname = "Winspring WS9901";
  893                 break;
  894         case RTW_RFCHIPID_MAXIM:
  895                 rfname = "Maxim MAX2820";       /* guess */
  896                 paname = "Maxim MAX2422";       /* guess */
  897                 break;
  898         case RTW_RFCHIPID_INTERSIL:
  899                 rfname = "Intersil HFA3873";    /* guess */
  900                 paname = "Intersil <unknown>";
  901                 break;
  902         case RTW_RFCHIPID_PHILIPS:      /* this combo seen in the wild */
  903                 rfname = "Philips SA2400A";
  904                 paname = "Philips SA2411";
  905                 break;
  906         case RTW_RFCHIPID_RFMD:
  907                 /* this is the same front-end as an atw(4)! */
  908                 rfname = "RFMD RF2948B, "       /* mentioned in Realtek docs */
  909                          "LNA: RFMD RF2494, "   /* mentioned in Realtek docs */
  910                          "SYN: Silicon Labs Si4126";    /* inferred from
  911                                                          * reference driver
  912                                                          */
  913                 paname = "RFMD RF2189";         /* mentioned in Realtek docs */
  914                 break;
  915         case RTW_RFCHIPID_RESERVED:
  916                 rfname = paname = "reserved";
  917                 break;
  918         default:
  919                 snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
  920                 rfname = paname = scratch;
  921         }
  922         printf("%s: RF: %s, PA: %s\n", dvname, rfname, paname);
  923 
  924         switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
  925         case RTW_CONFIG0_GL_USA:
  926         case _RTW_CONFIG0_GL_USA:
  927                 *locale = RTW_LOCALE_USA;
  928                 break;
  929         case RTW_CONFIG0_GL_EUROPE:
  930                 *locale = RTW_LOCALE_EUROPE;
  931                 break;
  932         case RTW_CONFIG0_GL_JAPAN:
  933                 *locale = RTW_LOCALE_JAPAN;
  934                 break;
  935         default:
  936                 *locale = RTW_LOCALE_UNKNOWN;
  937                 break;
  938         }
  939         return 0;
  940 }
  941 
  942 /* Returns -1 on failure. */
  943 static int
  944 rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
  945     const char *dvname)
  946 {
  947         int rc;
  948         struct seeprom_descriptor sd;
  949         uint8_t ecr;
  950 
  951         (void)memset(&sd, 0, sizeof(sd));
  952 
  953         ecr = RTW_READ8(regs, RTW_9346CR);
  954 
  955         if ((flags & RTW_F_9356SROM) != 0) {
  956                 RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n", dvname));
  957                 sr->sr_size = 256;
  958                 sd.sd_chip = C56_66;
  959         } else {
  960                 RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n", dvname));
  961                 sr->sr_size = 128;
  962                 sd.sd_chip = C46;
  963         }
  964 
  965         ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
  966             RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
  967         ecr |= RTW_9346CR_EEM_PROGRAM;
  968 
  969         RTW_WRITE8(regs, RTW_9346CR, ecr);
  970 
  971         sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
  972 
  973         if (sr->sr_content == NULL) {
  974                 printf("%s: unable to allocate SROM buffer\n", dvname);
  975                 return ENOMEM;
  976         }
  977 
  978         (void)memset(sr->sr_content, 0, sr->sr_size);
  979 
  980         /* RTL8180 has a single 8-bit register for controlling the
  981          * 93cx6 SROM.  There is no "ready" bit. The RTL8180
  982          * input/output sense is the reverse of read_seeprom's.
  983          */
  984         sd.sd_tag = regs->r_bt;
  985         sd.sd_bsh = regs->r_bh;
  986         sd.sd_regsize = 1;
  987         sd.sd_control_offset = RTW_9346CR;
  988         sd.sd_status_offset = RTW_9346CR;
  989         sd.sd_dataout_offset = RTW_9346CR;
  990         sd.sd_CK = RTW_9346CR_EESK;
  991         sd.sd_CS = RTW_9346CR_EECS;
  992         sd.sd_DI = RTW_9346CR_EEDO;
  993         sd.sd_DO = RTW_9346CR_EEDI;
  994         /* make read_seeprom enter EEPROM read/write mode */
  995         sd.sd_MS = ecr;
  996         sd.sd_RDY = 0;
  997 
  998         /* TBD bus barriers */
  999         if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
 1000                 printf("%s: could not read SROM\n", dvname);
 1001                 free(sr->sr_content, M_DEVBUF);
 1002                 sr->sr_content = NULL;
 1003                 return -1;      /* XXX */
 1004         }
 1005 
 1006         /* end EEPROM read/write mode */
 1007         RTW_WRITE8(regs, RTW_9346CR,
 1008             (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
 1009         RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
 1010 
 1011         if ((rc = rtw_recall_eeprom(regs, dvname)) != 0)
 1012                 return rc;
 1013 
 1014 #ifdef RTW_DEBUG
 1015         {
 1016                 int i;
 1017                 RTW_DPRINTF(RTW_DEBUG_ATTACH,
 1018                     ("\n%s: serial ROM:\n\t", dvname));
 1019                 for (i = 0; i < sr->sr_size/2; i++) {
 1020                         if (((i % 8) == 0) && (i != 0))
 1021                                 RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
 1022                         RTW_DPRINTF(RTW_DEBUG_ATTACH,
 1023                             (" %04x", sr->sr_content[i]));
 1024                 }
 1025                 RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
 1026         }
 1027 #endif /* RTW_DEBUG */
 1028         return 0;
 1029 }
 1030 
 1031 static void
 1032 rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
 1033     const char *dvname)
 1034 {
 1035         uint8_t cfg4;
 1036         const char *method;
 1037 
 1038         cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
 1039 
 1040         switch (rfchipid) {
 1041         default:
 1042                 cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
 1043                 method = "fallback";
 1044                 break;
 1045         case RTW_RFCHIPID_INTERSIL:
 1046                 cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
 1047                 method = "Intersil";
 1048                 break;
 1049         case RTW_RFCHIPID_PHILIPS:
 1050                 cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
 1051                 method = "Philips";
 1052                 break;
 1053         case RTW_RFCHIPID_GCT:  /* XXX a guess */
 1054         case RTW_RFCHIPID_RFMD:
 1055                 cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
 1056                 method = "RFMD";
 1057                 break;
 1058         }
 1059 
 1060         RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
 1061 
 1062         RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
 1063 
 1064         RTW_DPRINTF(RTW_DEBUG_INIT,
 1065             ("%s: %s RF programming method, %#02x\n", dvname, method,
 1066             RTW_READ8(regs, RTW_CONFIG4)));
 1067 }
 1068 
 1069 static inline void
 1070 rtw_init_channels(enum rtw_locale locale,
 1071     struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1],
 1072     const char *dvname)
 1073 {
 1074         int i;
 1075         const char *name = NULL;
 1076 #define ADD_CHANNEL(_chans, _chan) do {                 \
 1077         (*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;           \
 1078         (*_chans)[_chan].ic_freq =                              \
 1079             ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
 1080 } while (0)
 1081 
 1082         switch (locale) {
 1083         case RTW_LOCALE_USA:    /* 1-11 */
 1084                 name = "USA";
 1085                 for (i = 1; i <= 11; i++)
 1086                         ADD_CHANNEL(chans, i);
 1087                 break;
 1088         case RTW_LOCALE_JAPAN:  /* 1-14 */
 1089                 name = "Japan";
 1090                 ADD_CHANNEL(chans, 14);
 1091                 for (i = 1; i <= 14; i++)
 1092                         ADD_CHANNEL(chans, i);
 1093                 break;
 1094         case RTW_LOCALE_EUROPE: /* 1-13 */
 1095                 name = "Europe";
 1096                 for (i = 1; i <= 13; i++)
 1097                         ADD_CHANNEL(chans, i);
 1098                 break;
 1099         default:                        /* 10-11 allowed by most countries */
 1100                 name = "<unknown>";
 1101                 for (i = 10; i <= 11; i++)
 1102                         ADD_CHANNEL(chans, i);
 1103                 break;
 1104         }
 1105         printf("%s: Geographic Location %s\n", dvname, name);
 1106 #undef ADD_CHANNEL
 1107 }
 1108 
 1109 
 1110 static inline void
 1111 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
 1112 {
 1113         uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
 1114 
 1115         switch (cfg0 & RTW_CONFIG0_GL_MASK) {
 1116         case RTW_CONFIG0_GL_USA:
 1117         case _RTW_CONFIG0_GL_USA:
 1118                 *locale = RTW_LOCALE_USA;
 1119                 break;
 1120         case RTW_CONFIG0_GL_JAPAN:
 1121                 *locale = RTW_LOCALE_JAPAN;
 1122                 break;
 1123         case RTW_CONFIG0_GL_EUROPE:
 1124                 *locale = RTW_LOCALE_EUROPE;
 1125                 break;
 1126         default:
 1127                 *locale = RTW_LOCALE_UNKNOWN;
 1128                 break;
 1129         }
 1130 }
 1131 
 1132 static inline int
 1133 rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
 1134     const char *dvname)
 1135 {
 1136         static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
 1137                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 1138         };
 1139         uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
 1140                   idr1 = RTW_READ(regs, RTW_IDR1);
 1141 
 1142         (*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
 1143         (*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
 1144         (*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
 1145         (*addr)[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
 1146 
 1147         (*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
 1148         (*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
 1149 
 1150         if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
 1151                 printf("%s: could not get mac address, attach failed\n",
 1152                     dvname);
 1153                 return ENXIO;
 1154         }
 1155 
 1156         printf("%s: 802.11 address %s\n", dvname, ether_sprintf(*addr));
 1157 
 1158         return 0;
 1159 }
 1160 
 1161 static uint8_t
 1162 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
 1163     struct ieee80211_channel *chan)
 1164 {
 1165         u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
 1166         KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
 1167             ("%s: channel %d out of range", __func__,
 1168              idx - RTW_SR_TXPOWER1 + 1));
 1169         return RTW_SR_GET(sr, idx);
 1170 }
 1171 
 1172 static void
 1173 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
 1174 {
 1175         int pri;
 1176         /* nfree: the number of free descriptors in each ring.
 1177          * The beacon ring is a special case: I do not let the
 1178          * driver use all of the descriptors on the beacon ring.
 1179          * The reasons are two-fold:
 1180          *
 1181          * (1) A BEACON descriptor's OWN bit is (apparently) not
 1182          * updated, so the driver cannot easily know if the descriptor
 1183          * belongs to it, or if it is racing the NIC.  If the NIC
 1184          * does not OWN every descriptor, then the driver can safely
 1185          * update the descriptors when RTW_TBDA points at tdb_next.
 1186          *
 1187          * (2) I hope that the NIC will process more than one BEACON
 1188          * descriptor in a single beacon interval, since that will
 1189          * enable multiple-BSS support.  Since the NIC does not
 1190          * clear the OWN bit, there is no natural place for it to
 1191          * stop processing BEACON desciptors.  Maybe it will *not*
 1192          * stop processing them!  I do not want to chance the NIC
 1193          * looping around and around a saturated beacon ring, so
 1194          * I will leave one descriptor unOWNed at all times.
 1195          */
 1196         u_int nfree[RTW_NTXPRI] =
 1197             {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
 1198              RTW_NTXDESCBCN - 1};
 1199 
 1200         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 1201                 tdb[pri].tdb_nfree = nfree[pri];
 1202                 tdb[pri].tdb_next = 0;
 1203         }
 1204 }
 1205 
 1206 static int
 1207 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
 1208 {
 1209         int i;
 1210         struct rtw_txsoft *ts;
 1211 
 1212         SIMPLEQ_INIT(&tsb->tsb_dirtyq);
 1213         SIMPLEQ_INIT(&tsb->tsb_freeq);
 1214         for (i = 0; i < tsb->tsb_ndesc; i++) {
 1215                 ts = &tsb->tsb_desc[i];
 1216                 ts->ts_mbuf = NULL;
 1217                 SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
 1218         }
 1219         tsb->tsb_tx_timer = 0;
 1220         return 0;
 1221 }
 1222 
 1223 static void
 1224 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
 1225 {
 1226         int pri;
 1227         for (pri = 0; pri < RTW_NTXPRI; pri++)
 1228                 rtw_txsoft_blk_init(&tsb[pri]);
 1229 }
 1230 
 1231 static inline void
 1232 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
 1233 {
 1234         KASSERT(nsync <= rdb->rdb_ndesc);
 1235         /* sync to end of ring */
 1236         if (desc0 + nsync > rdb->rdb_ndesc) {
 1237                 bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
 1238                     offsetof(struct rtw_descs, hd_rx[desc0]),
 1239                     sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
 1240                 nsync -= (rdb->rdb_ndesc - desc0);
 1241                 desc0 = 0;
 1242         }
 1243 
 1244         KASSERT(desc0 < rdb->rdb_ndesc);
 1245         KASSERT(nsync <= rdb->rdb_ndesc);
 1246         KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
 1247 
 1248         /* sync what remains */
 1249         bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
 1250             offsetof(struct rtw_descs, hd_rx[desc0]),
 1251             sizeof(struct rtw_rxdesc) * nsync, ops);
 1252 }
 1253 
 1254 static void
 1255 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
 1256 {
 1257         /* sync to end of ring */
 1258         if (desc0 + nsync > tdb->tdb_ndesc) {
 1259                 bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
 1260                     tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
 1261                     sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
 1262                     ops);
 1263                 nsync -= (tdb->tdb_ndesc - desc0);
 1264                 desc0 = 0;
 1265         }
 1266 
 1267         /* sync what remains */
 1268         bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
 1269             tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
 1270             sizeof(struct rtw_txdesc) * nsync, ops);
 1271 }
 1272 
 1273 static void
 1274 rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
 1275 {
 1276         int pri;
 1277         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 1278                 rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
 1279                     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 1280         }
 1281 }
 1282 
 1283 static void
 1284 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
 1285 {
 1286         int i;
 1287         struct rtw_rxsoft *rs;
 1288 
 1289         for (i = 0; i < RTW_RXQLEN; i++) {
 1290                 rs = &desc[i];
 1291                 if (rs->rs_mbuf == NULL)
 1292                         continue;
 1293                 bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
 1294                     rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
 1295                 bus_dmamap_unload(dmat, rs->rs_dmamap);
 1296                 m_freem(rs->rs_mbuf);
 1297                 rs->rs_mbuf = NULL;
 1298         }
 1299 }
 1300 
 1301 static inline int
 1302 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
 1303 {
 1304         int rc;
 1305         struct mbuf *m;
 1306 
 1307         MGETHDR(m, M_DONTWAIT, MT_DATA);
 1308         if (m == NULL)
 1309                 return ENOBUFS;
 1310 
 1311         MCLGET(m, M_DONTWAIT);
 1312         if ((m->m_flags & M_EXT) == 0) {
 1313                 m_freem(m);
 1314                 return ENOBUFS;
 1315         }
 1316 
 1317         m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
 1318 
 1319         if (rs->rs_mbuf != NULL)
 1320                 bus_dmamap_unload(dmat, rs->rs_dmamap);
 1321 
 1322         rs->rs_mbuf = NULL;
 1323 
 1324         rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
 1325         if (rc != 0) {
 1326                 m_freem(m);
 1327                 return -1;
 1328         }
 1329 
 1330         rs->rs_mbuf = m;
 1331 
 1332         return 0;
 1333 }
 1334 
 1335 static int
 1336 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
 1337     int *ndesc, const char *dvname)
 1338 {
 1339         int i, rc = 0;
 1340         struct rtw_rxsoft *rs;
 1341 
 1342         for (i = 0; i < RTW_RXQLEN; i++) {
 1343                 rs = &desc[i];
 1344                 /* we're in rtw_init, so there should be no mbufs allocated */
 1345                 KASSERT(rs->rs_mbuf == NULL);
 1346 #ifdef RTW_DEBUG
 1347                 if (i == rtw_rxbufs_limit) {
 1348                         printf("%s: TEST hit %d-buffer limit\n", dvname, i);
 1349                         rc = ENOBUFS;
 1350                         break;
 1351                 }
 1352 #endif /* RTW_DEBUG */
 1353                 if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
 1354                         printf("%s: rtw_rxsoft_alloc failed, %d buffers, "
 1355                                "rc %d\n", dvname, i, rc);
 1356                         break;
 1357                 }
 1358         }
 1359         *ndesc = i;
 1360         return rc;
 1361 }
 1362 
 1363 static inline void
 1364 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
 1365     int idx, int kick)
 1366 {
 1367         int is_last = (idx == rdb->rdb_ndesc - 1);
 1368         uint32_t ctl, octl, obuf;
 1369         struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
 1370 
 1371         obuf = rd->rd_buf;
 1372         rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
 1373 
 1374         ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
 1375             RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
 1376 
 1377         if (is_last)
 1378                 ctl |= RTW_RXCTL_EOR;
 1379 
 1380         octl = rd->rd_ctl;
 1381         rd->rd_ctl = htole32(ctl);
 1382 
 1383         RTW_DPRINTF(
 1384             kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
 1385                  : RTW_DEBUG_RECV_DESC,
 1386             ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
 1387              le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
 1388              le32toh(rd->rd_ctl)));
 1389 
 1390         /* sync the mbuf */
 1391         bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
 1392             rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
 1393 
 1394         /* sync the descriptor */
 1395         bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
 1396             RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
 1397             BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 1398 }
 1399 
 1400 static void
 1401 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
 1402 {
 1403         int i;
 1404         struct rtw_rxdesc *rd;
 1405         struct rtw_rxsoft *rs;
 1406 
 1407         for (i = 0; i < rdb->rdb_ndesc; i++) {
 1408                 rd = &rdb->rdb_desc[i];
 1409                 rs = &ctl[i];
 1410                 rtw_rxdesc_init(rdb, rs, i, kick);
 1411         }
 1412 }
 1413 
 1414 static void
 1415 rtw_io_enable(struct rtw_regs *regs, uint8_t flags, int enable)
 1416 {
 1417         uint8_t cr;
 1418 
 1419         RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
 1420             enable ? "enable" : "disable", flags));
 1421 
 1422         cr = RTW_READ8(regs, RTW_CR);
 1423 
 1424         /* XXX reference source does not enable MULRW */
 1425 #if 0
 1426         /* enable PCI Read/Write Multiple */
 1427         cr |= RTW_CR_MULRW;
 1428 #endif
 1429 
 1430         RTW_RBW(regs, RTW_CR, RTW_CR);  /* XXX paranoia? */
 1431         if (enable)
 1432                 cr |= flags;
 1433         else
 1434                 cr &= ~flags;
 1435         RTW_WRITE8(regs, RTW_CR, cr);
 1436         RTW_SYNC(regs, RTW_CR, RTW_CR);
 1437 }
 1438 
 1439 static void
 1440 rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
 1441 {
 1442 #define IS_BEACON(__fc0)                                                \
 1443     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
 1444      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
 1445 
 1446         static const int ratetbl[4] = {2, 4, 11, 22};   /* convert rates:
 1447                                                          * hardware -> net80211
 1448                                                          */
 1449         u_int next, nproc = 0;
 1450         int hwrate, len, rate, rssi, sq;
 1451         uint32_t hrssi, hstat, htsfth, htsftl;
 1452         struct rtw_rxdesc *rd;
 1453         struct rtw_rxsoft *rs;
 1454         struct rtw_rxdesc_blk *rdb;
 1455         struct mbuf *m;
 1456         struct ifnet *ifp = &sc->sc_if;
 1457 
 1458         struct ieee80211_node *ni;
 1459         struct ieee80211_frame_min *wh;
 1460 
 1461         rdb = &sc->sc_rxdesc_blk;
 1462 
 1463         KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
 1464 
 1465         for (next = rdb->rdb_next; ; next = (next + 1) % rdb->rdb_ndesc) {
 1466                 rtw_rxdescs_sync(rdb, next, 1,
 1467                     BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
 1468                 rd = &rdb->rdb_desc[next];
 1469                 rs = &sc->sc_rxsoft[next];
 1470 
 1471                 hstat = le32toh(rd->rd_stat);
 1472                 hrssi = le32toh(rd->rd_rssi);
 1473                 htsfth = le32toh(rd->rd_tsfth);
 1474                 htsftl = le32toh(rd->rd_tsftl);
 1475 
 1476                 RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
 1477                     ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
 1478                     __func__, next, hstat, hrssi, htsfth, htsftl));
 1479 
 1480                 ++nproc;
 1481 
 1482                 /* still belongs to NIC */
 1483                 if ((hstat & RTW_RXSTAT_OWN) != 0) {
 1484                         if (nproc > 1)
 1485                                 break;
 1486 
 1487                         /* sometimes the NIC skips to the 0th descriptor */
 1488                         rtw_rxdescs_sync(rdb, 0, 1,
 1489                             BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
 1490                         rd = &rdb->rdb_desc[0];
 1491                         if ((rd->rd_stat & htole32(RTW_RXSTAT_OWN)) != 0)
 1492                                 break;
 1493                         RTW_DPRINTF(RTW_DEBUG_BUGS,
 1494                             ("%s: NIC skipped from rxdesc[%u] to rxdesc[0]\n",
 1495                              sc->sc_dev.dv_xname, next));
 1496                         next = rdb->rdb_ndesc - 1;
 1497                         continue;
 1498                 }
 1499 
 1500 #ifdef RTW_DEBUG
 1501 #define PRINTSTAT(flag) do { \
 1502         if ((hstat & flag) != 0) { \
 1503                 printf("%s" #flag, delim); \
 1504                 delim = ","; \
 1505         } \
 1506 } while (0)
 1507                 if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
 1508                         const char *delim = "<";
 1509                         printf("%s: ", sc->sc_dev.dv_xname);
 1510                         if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
 1511                                 printf("status %08x", hstat);
 1512                                 PRINTSTAT(RTW_RXSTAT_SPLCP);
 1513                                 PRINTSTAT(RTW_RXSTAT_MAR);
 1514                                 PRINTSTAT(RTW_RXSTAT_PAR);
 1515                                 PRINTSTAT(RTW_RXSTAT_BAR);
 1516                                 PRINTSTAT(RTW_RXSTAT_PWRMGT);
 1517                                 PRINTSTAT(RTW_RXSTAT_CRC32);
 1518                                 PRINTSTAT(RTW_RXSTAT_ICV);
 1519                                 printf(">, ");
 1520                         }
 1521                 }
 1522 #endif /* RTW_DEBUG */
 1523 
 1524                 if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
 1525                         printf("%s: DMA error/FIFO overflow %08" PRIx32 ", "
 1526                             "rx descriptor %d\n", sc->sc_dev.dv_xname,
 1527                             hstat, next);
 1528                         ifp->if_ierrors++;
 1529                         goto next;
 1530                 }
 1531 
 1532                 len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
 1533                 if (len < IEEE80211_MIN_LEN) {
 1534                         sc->sc_ic.ic_stats.is_rx_tooshort++;
 1535                         goto next;
 1536                 }
 1537 
 1538                 /* CRC is included with the packet; trim it off. */
 1539                 len -= IEEE80211_CRC_LEN;
 1540 
 1541                 hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
 1542                 if (hwrate >= sizeof(ratetbl) / sizeof(ratetbl[0])) {
 1543                         printf("%s: unknown rate #%" __PRIuBITS "\n",
 1544                             sc->sc_dev.dv_xname,
 1545                             __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
 1546                         ifp->if_ierrors++;
 1547                         goto next;
 1548                 }
 1549                 rate = ratetbl[hwrate];
 1550 
 1551 #ifdef RTW_DEBUG
 1552                 RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
 1553                     ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
 1554                      (rate * 5) % 10, htsfth, htsftl));
 1555 #endif /* RTW_DEBUG */
 1556 
 1557                 if ((hstat & RTW_RXSTAT_RES) != 0 &&
 1558                     sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
 1559                         goto next;
 1560 
 1561                 /* if bad flags, skip descriptor */
 1562                 if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
 1563                         printf("%s: too many rx segments\n",
 1564                             sc->sc_dev.dv_xname);
 1565                         goto next;
 1566                 }
 1567 
 1568                 bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
 1569                     rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
 1570 
 1571                 m = rs->rs_mbuf;
 1572 
 1573                 /* if temporarily out of memory, re-use mbuf */
 1574                 switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
 1575                 case 0:
 1576                         break;
 1577                 case ENOBUFS:
 1578                         printf("%s: rtw_rxsoft_alloc(, %d) failed, "
 1579                             "dropping packet\n", sc->sc_dev.dv_xname, next);
 1580                         goto next;
 1581                 default:
 1582                         /* XXX shorten rx ring, instead? */
 1583                         panic("%s: could not load DMA map\n",
 1584                             sc->sc_dev.dv_xname);
 1585                 }
 1586 
 1587                 if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
 1588                         rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_RSSI);
 1589                 else {
 1590                         rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
 1591                         /* TBD find out each front-end's LNA gain in the
 1592                          * front-end's units
 1593                          */
 1594                         if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
 1595                                 rssi |= 0x80;
 1596                 }
 1597                 sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
 1598 
 1599                 /* Note well: now we cannot recycle the rs_mbuf unless
 1600                  * we restore its original length.
 1601                  */
 1602                 m->m_pkthdr.rcvif = ifp;
 1603                 m->m_pkthdr.len = m->m_len = len;
 1604 
 1605                 wh = mtod(m, struct ieee80211_frame_min *);
 1606 
 1607                 if (!IS_BEACON(wh->i_fc[0]))
 1608                         sc->sc_led_state.ls_event |= RTW_LED_S_RX;
 1609                 /* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
 1610                 ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
 1611 
 1612                 sc->sc_tsfth = htsfth;
 1613 
 1614 #ifdef RTW_DEBUG
 1615                 if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
 1616                     (IFF_DEBUG|IFF_LINK2)) {
 1617                         ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
 1618                             rate, rssi);
 1619                 }
 1620 #endif /* RTW_DEBUG */
 1621 
 1622 #if NBPFILTER > 0
 1623                 if (sc->sc_radiobpf != NULL) {
 1624                         struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
 1625 
 1626                         rr->rr_tsft =
 1627                             htole64(((uint64_t)htsfth << 32) | htsftl);
 1628 
 1629                         if ((hstat & RTW_RXSTAT_SPLCP) != 0)
 1630                                 rr->rr_flags = IEEE80211_RADIOTAP_F_SHORTPRE;
 1631 
 1632                         rr->rr_flags = 0;
 1633                         rr->rr_rate = rate;
 1634                         rr->rr_antsignal = rssi;
 1635                         rr->rr_barker_lock = htole16(sq);
 1636 
 1637                         bpf_mtap2(sc->sc_radiobpf, (caddr_t)rr,
 1638                             sizeof(sc->sc_rxtapu), m);
 1639                 }
 1640 #endif /* NPBFILTER > 0 */
 1641 
 1642                 ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
 1643                 ieee80211_free_node(ni);
 1644 next:
 1645                 rtw_rxdesc_init(rdb, rs, next, 0);
 1646         }
 1647         rdb->rdb_next = next;
 1648 
 1649         KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
 1650 
 1651         return;
 1652 #undef IS_BEACON
 1653 }
 1654 
 1655 static void
 1656 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
 1657     struct rtw_txsoft *ts)
 1658 {
 1659         struct mbuf *m;
 1660         struct ieee80211_node *ni;
 1661 
 1662         m = ts->ts_mbuf;
 1663         ni = ts->ts_ni;
 1664         KASSERT(m != NULL);
 1665         KASSERT(ni != NULL);
 1666         ts->ts_mbuf = NULL;
 1667         ts->ts_ni = NULL;
 1668 
 1669         bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
 1670             BUS_DMASYNC_POSTWRITE);
 1671         bus_dmamap_unload(dmat, ts->ts_dmamap);
 1672         m_freem(m);
 1673         ieee80211_free_node(ni);
 1674 }
 1675 
 1676 static void
 1677 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
 1678     struct rtw_txsoft_blk *tsb)
 1679 {
 1680         struct rtw_txsoft *ts;
 1681 
 1682         while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
 1683                 rtw_txsoft_release(dmat, ic, ts);
 1684                 SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
 1685                 SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
 1686         }
 1687         tsb->tsb_tx_timer = 0;
 1688 }
 1689 
 1690 static inline void
 1691 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
 1692     struct rtw_txsoft *ts, int ndesc)
 1693 {
 1694         uint32_t hstat;
 1695         int data_retry, rts_retry;
 1696         struct rtw_txdesc *tdn;
 1697         const char *condstring;
 1698         struct ifnet *ifp = &sc->sc_if;
 1699 
 1700         rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
 1701 
 1702         tdb->tdb_nfree += ndesc;
 1703 
 1704         tdn = &tdb->tdb_desc[ts->ts_last];
 1705 
 1706         hstat = le32toh(tdn->td_stat);
 1707         rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
 1708         data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
 1709 
 1710         ifp->if_collisions += rts_retry + data_retry;
 1711 
 1712         if ((hstat & RTW_TXSTAT_TOK) != 0)
 1713                 condstring = "ok";
 1714         else {
 1715                 ifp->if_oerrors++;
 1716                 condstring = "error";
 1717         }
 1718 
 1719         DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
 1720             ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
 1721             sc->sc_dev.dv_xname, ts, ts->ts_first, ts->ts_last,
 1722             condstring, rts_retry, data_retry));
 1723 }
 1724 
 1725 static void
 1726 rtw_reset_oactive(struct rtw_softc *sc)
 1727 {
 1728         short oflags;
 1729         int pri;
 1730         struct rtw_txsoft_blk *tsb;
 1731         struct rtw_txdesc_blk *tdb;
 1732         oflags = sc->sc_if.if_flags;
 1733         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 1734                 tsb = &sc->sc_txsoft_blk[pri];
 1735                 tdb = &sc->sc_txdesc_blk[pri];
 1736                 if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
 1737                         sc->sc_if.if_flags &= ~IFF_OACTIVE;
 1738         }
 1739         if (oflags != sc->sc_if.if_flags) {
 1740                 DPRINTF(sc, RTW_DEBUG_OACTIVE,
 1741                     ("%s: reset OACTIVE\n", __func__));
 1742         }
 1743 }
 1744 
 1745 /* Collect transmitted packets. */
 1746 static inline void
 1747 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
 1748     struct rtw_txdesc_blk *tdb, int force)
 1749 {
 1750         int ndesc;
 1751         struct rtw_txsoft *ts;
 1752 
 1753         while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
 1754                 ndesc = 1 + ts->ts_last - ts->ts_first;
 1755                 if (ts->ts_last < ts->ts_first)
 1756                         ndesc += tdb->tdb_ndesc;
 1757 
 1758                 KASSERT(ndesc > 0);
 1759 
 1760                 rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
 1761                     BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
 1762 
 1763                 if (force) {
 1764                         int i;
 1765                         for (i = ts->ts_first; ; i = RTW_NEXT_IDX(tdb, i)) {
 1766                                 tdb->tdb_desc[i].td_stat &=
 1767                                     ~htole32(RTW_TXSTAT_OWN);
 1768                                 if (i == ts->ts_last)
 1769                                         break;
 1770                         }
 1771                         rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
 1772                             BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 1773                 } else if ((tdb->tdb_desc[ts->ts_last].td_stat &
 1774                     htole32(RTW_TXSTAT_OWN)) != 0)
 1775                         break;
 1776 
 1777                 rtw_collect_txpkt(sc, tdb, ts, ndesc);
 1778                 SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
 1779                 SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
 1780         }
 1781         /* no more pending transmissions, cancel watchdog */
 1782         if (ts == NULL)
 1783                 tsb->tsb_tx_timer = 0;
 1784         rtw_reset_oactive(sc);
 1785 }
 1786 
 1787 static void
 1788 rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
 1789 {
 1790         int pri;
 1791         struct rtw_txsoft_blk   *tsb;
 1792         struct rtw_txdesc_blk   *tdb;
 1793         struct ifnet *ifp = &sc->sc_if;
 1794 
 1795         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 1796                 tsb = &sc->sc_txsoft_blk[pri];
 1797                 tdb = &sc->sc_txdesc_blk[pri];
 1798 
 1799                 rtw_collect_txring(sc, tsb, tdb, 0);
 1800         }
 1801 
 1802         if ((isr & RTW_INTR_TX) != 0)
 1803                 rtw_start(ifp);
 1804 
 1805         return;
 1806 }
 1807 
 1808 static void
 1809 rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
 1810 {
 1811         u_int next;
 1812         uint32_t tsfth, tsftl;
 1813         struct ieee80211com *ic;
 1814         struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
 1815         struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
 1816         struct mbuf *m;
 1817 
 1818         tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
 1819         tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
 1820 
 1821         if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
 1822                 next = rtw_txring_next(&sc->sc_regs, tdb);
 1823                 RTW_DPRINTF(RTW_DEBUG_BEACON,
 1824                     ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
 1825                      ", next %u expected %u, %" PRIu64 "\n", __func__,
 1826                      (next == tdb->tdb_next) ? "" : "un", isr, next,
 1827                      tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
 1828                 if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0){
 1829                         rtw_collect_txring(sc, tsb, tdb, 1);
 1830                         tdb->tdb_next = 0;
 1831                 }
 1832         }
 1833         /* Start beacon transmission. */
 1834 
 1835         if ((isr & RTW_INTR_BCNINT) != 0 &&
 1836             sc->sc_ic.ic_state == IEEE80211_S_RUN &&
 1837             SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
 1838                 RTW_DPRINTF(RTW_DEBUG_BEACON,
 1839                     ("%s: beacon prep. time, isr = %#04" PRIx16
 1840                      ", %16" PRIu64 "\n", __func__, isr,
 1841                      (uint64_t)tsfth << 32 | tsftl));
 1842                 ic = &sc->sc_ic;
 1843                 m = rtw_beacon_alloc(sc, ic->ic_bss);
 1844 
 1845                 if (m == NULL) {
 1846                         printf("%s: could not allocate beacon\n",
 1847                             sc->sc_dev.dv_xname);
 1848                         return;
 1849                 }
 1850                 m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
 1851                 IF_ENQUEUE(&sc->sc_beaconq, m);
 1852                 rtw_start(&sc->sc_if);
 1853         }
 1854 }
 1855 
 1856 static void
 1857 rtw_intr_atim(struct rtw_softc *sc)
 1858 {
 1859         /* TBD */
 1860         return;
 1861 }
 1862 
 1863 #ifdef RTW_DEBUG
 1864 static void
 1865 rtw_dump_rings(struct rtw_softc *sc)
 1866 {
 1867         struct rtw_txdesc_blk *tdb;
 1868         struct rtw_rxdesc *rd;
 1869         struct rtw_rxdesc_blk *rdb;
 1870         int desc, pri;
 1871 
 1872         if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
 1873                 return;
 1874 
 1875         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 1876                 tdb = &sc->sc_txdesc_blk[pri];
 1877                 printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
 1878                     tdb->tdb_ndesc, tdb->tdb_nfree);
 1879                 for (desc = 0; desc < tdb->tdb_ndesc; desc++)
 1880                         rtw_print_txdesc(sc, ".", NULL, tdb, desc);
 1881         }
 1882 
 1883         rdb = &sc->sc_rxdesc_blk;
 1884 
 1885         for (desc = 0; desc < RTW_RXQLEN; desc++) {
 1886                 rd = &rdb->rdb_desc[desc];
 1887                 printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
 1888                     "rsvd1/tsfth %08x\n", __func__,
 1889                     (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
 1890                     le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
 1891                     le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
 1892         }
 1893 }
 1894 #endif /* RTW_DEBUG */
 1895 
 1896 static void
 1897 rtw_hwring_setup(struct rtw_softc *sc)
 1898 {
 1899         int pri;
 1900         struct rtw_regs *regs = &sc->sc_regs;
 1901         struct rtw_txdesc_blk *tdb;
 1902 
 1903         sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
 1904         sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
 1905         sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
 1906         sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
 1907         sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
 1908         sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
 1909         sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
 1910         sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
 1911 
 1912         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 1913                 tdb = &sc->sc_txdesc_blk[pri];
 1914                 RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
 1915                 RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
 1916                     ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
 1917                      (uintptr_t)tdb->tdb_base));
 1918         }
 1919 
 1920         RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
 1921 
 1922         RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
 1923             ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
 1924              (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
 1925 
 1926         RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
 1927 
 1928 }
 1929 
 1930 static int
 1931 rtw_swring_setup(struct rtw_softc *sc)
 1932 {
 1933         int rc;
 1934         struct rtw_rxdesc_blk *rdb;
 1935 
 1936         rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
 1937 
 1938         rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
 1939 
 1940         rdb = &sc->sc_rxdesc_blk;
 1941         if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
 1942              sc->sc_dev.dv_xname)) != 0 && rdb->rdb_ndesc == 0) {
 1943                 printf("%s: could not allocate rx buffers\n",
 1944                     sc->sc_dev.dv_xname);
 1945                 return rc;
 1946         }
 1947 
 1948         rdb = &sc->sc_rxdesc_blk;
 1949         rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
 1950             BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
 1951         rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
 1952         rdb->rdb_next = 0;
 1953 
 1954         rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
 1955         return 0;
 1956 }
 1957 
 1958 static void
 1959 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
 1960 {
 1961         int i;
 1962 
 1963         (void)memset(tdb->tdb_desc, 0,
 1964             sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
 1965         for (i = 0; i < tdb->tdb_ndesc; i++)
 1966                 tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
 1967 }
 1968 
 1969 static u_int
 1970 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
 1971 {
 1972         return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
 1973             sizeof(struct rtw_txdesc);
 1974 }
 1975 
 1976 static void
 1977 rtw_txring_fixup(struct rtw_softc *sc)
 1978 {
 1979         int pri;
 1980         u_int next;
 1981         struct rtw_txdesc_blk *tdb;
 1982         struct rtw_regs *regs = &sc->sc_regs;
 1983 
 1984         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 1985                 tdb = &sc->sc_txdesc_blk[pri];
 1986                 next = rtw_txring_next(regs, tdb);
 1987                 if (tdb->tdb_next == next)
 1988                         continue;
 1989                 printf("%s: tx-ring %d expected next %u, read %u\n", __func__,
 1990                     pri, tdb->tdb_next, next);
 1991                 tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
 1992         }
 1993 }
 1994 
 1995 static void
 1996 rtw_rxring_fixup(struct rtw_softc *sc)
 1997 {
 1998         u_int next;
 1999         uint32_t rdsar;
 2000         struct rtw_rxdesc_blk *rdb;
 2001 
 2002         rdsar = le32toh(RTW_READ(&sc->sc_regs, RTW_RDSAR));
 2003         next = (rdsar - RTW_RING_BASE(sc, hd_rx)) / sizeof(struct rtw_rxdesc);
 2004 
 2005         rdb = &sc->sc_rxdesc_blk;
 2006         if (rdb->rdb_next != next) {
 2007                 printf("%s: rx-ring expected next %u, read %u\n", __func__,
 2008                     rdb->rdb_next, next);
 2009                 rdb->rdb_next = MIN(next, rdb->rdb_ndesc - 1);
 2010         }
 2011 }
 2012 
 2013 static void
 2014 rtw_txdescs_reset(struct rtw_softc *sc)
 2015 {
 2016         int pri;
 2017 
 2018         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 2019                 rtw_collect_txring(sc, &sc->sc_txsoft_blk[pri],
 2020                     &sc->sc_txdesc_blk[pri], 1);
 2021         }
 2022 }
 2023 
 2024 static void
 2025 rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
 2026 {
 2027         uint8_t cr = 0;
 2028         int xmtr = 0, rcvr = 0;
 2029         struct rtw_regs *regs = &sc->sc_regs;
 2030 
 2031         if ((isr & RTW_INTR_TXFOVW) != 0) {
 2032                 printf("%s: tx fifo underflow\n", sc->sc_dev.dv_xname);
 2033                 rcvr = xmtr = 1;
 2034                 cr |= RTW_CR_TE | RTW_CR_RE;
 2035         }
 2036 
 2037         if ((isr & (RTW_INTR_RDU|RTW_INTR_RXFOVW)) != 0) {
 2038                 cr |= RTW_CR_RE;
 2039                 rcvr = 1;
 2040         }
 2041 
 2042         RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: restarting xmit/recv, isr %" PRIx16
 2043             "\n", sc->sc_dev.dv_xname, isr));
 2044 
 2045 #ifdef RTW_DEBUG
 2046         rtw_dump_rings(sc);
 2047 #endif /* RTW_DEBUG */
 2048 
 2049         rtw_io_enable(regs, cr, 0);
 2050 
 2051         /* Collect rx'd packets.  Refresh rx buffers. */
 2052         if (rcvr)
 2053                 rtw_intr_rx(sc, 0);
 2054         /* Collect tx'd packets.  XXX let's hope this stops the transmit
 2055          * timeouts.
 2056          */
 2057         if (xmtr)
 2058                 rtw_txdescs_reset(sc);
 2059 
 2060         RTW_WRITE16(regs, RTW_IMR, 0);
 2061         RTW_SYNC(regs, RTW_IMR, RTW_IMR);
 2062 
 2063         if (rtw_do_chip_reset) {
 2064                 rtw_chip_reset1(regs, sc->sc_dev.dv_xname);
 2065                 rtw_wep_setkeys(sc, sc->sc_ic.ic_nw_keys,
 2066                     sc->sc_ic.ic_def_txkey);
 2067         }
 2068 
 2069         rtw_rxdesc_init_all(&sc->sc_rxdesc_blk, &sc->sc_rxsoft[0], 1);
 2070 
 2071 #ifdef RTW_DEBUG
 2072         rtw_dump_rings(sc);
 2073 #endif /* RTW_DEBUG */
 2074 
 2075         RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
 2076         RTW_SYNC(regs, RTW_IMR, RTW_IMR);
 2077         if (rcvr)
 2078                 rtw_rxring_fixup(sc);
 2079         rtw_io_enable(regs, cr, 1);
 2080         if (xmtr)
 2081                 rtw_txring_fixup(sc);
 2082 }
 2083 
 2084 static inline void
 2085 rtw_suspend_ticks(struct rtw_softc *sc)
 2086 {
 2087         RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
 2088             ("%s: suspending ticks\n", sc->sc_dev.dv_xname));
 2089         sc->sc_do_tick = 0;
 2090 }
 2091 
 2092 static inline void
 2093 rtw_resume_ticks(struct rtw_softc *sc)
 2094 {
 2095         uint32_t tsftrl0, tsftrl1, next_tick;
 2096 
 2097         tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
 2098 
 2099         tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
 2100         next_tick = tsftrl1 + 1000000;
 2101         RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
 2102 
 2103         sc->sc_do_tick = 1;
 2104 
 2105         RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
 2106             ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
 2107             sc->sc_dev.dv_xname, tsftrl1 - tsftrl0, tsftrl1, next_tick));
 2108 }
 2109 
 2110 static void
 2111 rtw_intr_timeout(struct rtw_softc *sc)
 2112 {
 2113         RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", sc->sc_dev.dv_xname));
 2114         if (sc->sc_do_tick)
 2115                 rtw_resume_ticks(sc);
 2116         return;
 2117 }
 2118 
 2119 int
 2120 rtw_intr(void *arg)
 2121 {
 2122         int i;
 2123         struct rtw_softc *sc = arg;
 2124         struct rtw_regs *regs = &sc->sc_regs;
 2125         uint16_t isr;
 2126         struct ifnet *ifp = &sc->sc_if;
 2127 
 2128         /*
 2129          * If the interface isn't running, the interrupt couldn't
 2130          * possibly have come from us.
 2131          */
 2132         if ((sc->sc_flags & RTW_F_ENABLED) == 0 ||
 2133             (ifp->if_flags & IFF_RUNNING) == 0 ||
 2134             !device_is_active(&sc->sc_dev)) {
 2135                 RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n", sc->sc_dev.dv_xname));
 2136                 return (0);
 2137         }
 2138 
 2139         for (i = 0; i < 10; i++) {
 2140                 isr = RTW_READ16(regs, RTW_ISR);
 2141 
 2142                 RTW_WRITE16(regs, RTW_ISR, isr);
 2143                 RTW_WBR(regs, RTW_ISR, RTW_ISR);
 2144 
 2145                 if (sc->sc_intr_ack != NULL)
 2146                         (*sc->sc_intr_ack)(regs);
 2147 
 2148                 if (isr == 0)
 2149                         break;
 2150 
 2151 #ifdef RTW_DEBUG
 2152 #define PRINTINTR(flag) do { \
 2153         if ((isr & flag) != 0) { \
 2154                 printf("%s" #flag, delim); \
 2155                 delim = ","; \
 2156         } \
 2157 } while (0)
 2158 
 2159                 if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
 2160                         const char *delim = "<";
 2161 
 2162                         printf("%s: reg[ISR] = %x", sc->sc_dev.dv_xname, isr);
 2163 
 2164                         PRINTINTR(RTW_INTR_TXFOVW);
 2165                         PRINTINTR(RTW_INTR_TIMEOUT);
 2166                         PRINTINTR(RTW_INTR_BCNINT);
 2167                         PRINTINTR(RTW_INTR_ATIMINT);
 2168                         PRINTINTR(RTW_INTR_TBDER);
 2169                         PRINTINTR(RTW_INTR_TBDOK);
 2170                         PRINTINTR(RTW_INTR_THPDER);
 2171                         PRINTINTR(RTW_INTR_THPDOK);
 2172                         PRINTINTR(RTW_INTR_TNPDER);
 2173                         PRINTINTR(RTW_INTR_TNPDOK);
 2174                         PRINTINTR(RTW_INTR_RXFOVW);
 2175                         PRINTINTR(RTW_INTR_RDU);
 2176                         PRINTINTR(RTW_INTR_TLPDER);
 2177                         PRINTINTR(RTW_INTR_TLPDOK);
 2178                         PRINTINTR(RTW_INTR_RER);
 2179                         PRINTINTR(RTW_INTR_ROK);
 2180 
 2181                         printf(">\n");
 2182                 }
 2183 #undef PRINTINTR
 2184 #endif /* RTW_DEBUG */
 2185 
 2186                 if ((isr & RTW_INTR_RX) != 0)
 2187                         rtw_intr_rx(sc, isr & RTW_INTR_RX);
 2188                 if ((isr & RTW_INTR_TX) != 0)
 2189                         rtw_intr_tx(sc, isr & RTW_INTR_TX);
 2190                 if ((isr & RTW_INTR_BEACON) != 0)
 2191                         rtw_intr_beacon(sc, isr & RTW_INTR_BEACON);
 2192                 if ((isr & RTW_INTR_ATIMINT) != 0)
 2193                         rtw_intr_atim(sc);
 2194                 if ((isr & RTW_INTR_IOERROR) != 0)
 2195                         rtw_intr_ioerror(sc, isr & RTW_INTR_IOERROR);
 2196                 if ((isr & RTW_INTR_TIMEOUT) != 0)
 2197                         rtw_intr_timeout(sc);
 2198         }
 2199 
 2200         return 1;
 2201 }
 2202 
 2203 /* Must be called at splnet. */
 2204 static void
 2205 rtw_stop(struct ifnet *ifp, int disable)
 2206 {
 2207         int pri;
 2208         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
 2209         struct ieee80211com *ic = &sc->sc_ic;
 2210         struct rtw_regs *regs = &sc->sc_regs;
 2211 
 2212         if ((sc->sc_flags & RTW_F_ENABLED) == 0)
 2213                 return;
 2214 
 2215         rtw_suspend_ticks(sc);
 2216 
 2217         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 2218 
 2219         if ((sc->sc_flags & RTW_F_INVALID) == 0) {
 2220                 /* Disable interrupts. */
 2221                 RTW_WRITE16(regs, RTW_IMR, 0);
 2222 
 2223                 RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
 2224 
 2225                 /* Stop the transmit and receive processes. First stop DMA,
 2226                  * then disable receiver and transmitter.
 2227                  */
 2228                 RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
 2229 
 2230                 RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
 2231 
 2232                 rtw_io_enable(&sc->sc_regs, RTW_CR_RE|RTW_CR_TE, 0);
 2233         }
 2234 
 2235         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 2236                 rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
 2237                     &sc->sc_txsoft_blk[pri]);
 2238         }
 2239 
 2240         rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
 2241 
 2242         if (disable)
 2243                 rtw_disable(sc);
 2244 
 2245         /* Mark the interface as not running.  Cancel the watchdog timer. */
 2246         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 2247         ifp->if_timer = 0;
 2248 
 2249         return;
 2250 }
 2251 
 2252 const char *
 2253 rtw_pwrstate_string(enum rtw_pwrstate power)
 2254 {
 2255         switch (power) {
 2256         case RTW_ON:
 2257                 return "on";
 2258         case RTW_SLEEP:
 2259                 return "sleep";
 2260         case RTW_OFF:
 2261                 return "off";
 2262         default:
 2263                 return "unknown";
 2264         }
 2265 }
 2266 
 2267 /* XXX For Maxim, I am using the RFMD settings gleaned from the
 2268  * reference driver, plus a magic Maxim "ON" value that comes from
 2269  * the Realtek document "Windows PG for Rtl8180."
 2270  */
 2271 static void
 2272 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
 2273     int before_rf, int digphy)
 2274 {
 2275         uint32_t anaparm;
 2276 
 2277         anaparm = RTW_READ(regs, RTW_ANAPARM);
 2278         anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
 2279 
 2280         switch (power) {
 2281         case RTW_OFF:
 2282                 if (before_rf)
 2283                         return;
 2284                 anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
 2285                 anaparm |= RTW_ANAPARM_TXDACOFF;
 2286                 break;
 2287         case RTW_SLEEP:
 2288                 if (!before_rf)
 2289                         return;
 2290                 anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
 2291                 anaparm |= RTW_ANAPARM_TXDACOFF;
 2292                 break;
 2293         case RTW_ON:
 2294                 if (!before_rf)
 2295                         return;
 2296                 anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
 2297                 break;
 2298         }
 2299         RTW_DPRINTF(RTW_DEBUG_PWR,
 2300             ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
 2301             __func__, rtw_pwrstate_string(power),
 2302             (before_rf) ? "before" : "after", anaparm));
 2303 
 2304         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
 2305         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
 2306 }
 2307 
 2308 /* XXX I am using the RFMD settings gleaned from the reference
 2309  * driver.  They agree
 2310  */
 2311 static void
 2312 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
 2313     int before_rf, int digphy)
 2314 {
 2315         uint32_t anaparm;
 2316 
 2317         anaparm = RTW_READ(regs, RTW_ANAPARM);
 2318         anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
 2319 
 2320         switch (power) {
 2321         case RTW_OFF:
 2322                 if (before_rf)
 2323                         return;
 2324                 anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
 2325                 anaparm |= RTW_ANAPARM_TXDACOFF;
 2326                 break;
 2327         case RTW_SLEEP:
 2328                 if (!before_rf)
 2329                         return;
 2330                 anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
 2331                 anaparm |= RTW_ANAPARM_TXDACOFF;
 2332                 break;
 2333         case RTW_ON:
 2334                 if (!before_rf)
 2335                         return;
 2336                 anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
 2337                 break;
 2338         }
 2339         RTW_DPRINTF(RTW_DEBUG_PWR,
 2340             ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
 2341             __func__, rtw_pwrstate_string(power),
 2342             (before_rf) ? "before" : "after", anaparm));
 2343 
 2344         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
 2345         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
 2346 }
 2347 
 2348 static void
 2349 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
 2350     int before_rf, int digphy)
 2351 {
 2352         uint32_t anaparm;
 2353 
 2354         anaparm = RTW_READ(regs, RTW_ANAPARM);
 2355         anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
 2356 
 2357         switch (power) {
 2358         case RTW_OFF:
 2359                 if (before_rf)
 2360                         return;
 2361                 anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
 2362                 anaparm |= RTW_ANAPARM_TXDACOFF;
 2363                 break;
 2364         case RTW_SLEEP:
 2365                 if (!before_rf)
 2366                         return;
 2367                 anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
 2368                 anaparm |= RTW_ANAPARM_TXDACOFF;
 2369                 break;
 2370         case RTW_ON:
 2371                 if (!before_rf)
 2372                         return;
 2373                 if (digphy) {
 2374                         anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
 2375                         /* XXX guess */
 2376                         anaparm |= RTW_ANAPARM_TXDACOFF;
 2377                 } else
 2378                         anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
 2379                 break;
 2380         }
 2381         RTW_DPRINTF(RTW_DEBUG_PWR,
 2382             ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
 2383             __func__, rtw_pwrstate_string(power),
 2384             (before_rf) ? "before" : "after", anaparm));
 2385 
 2386         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
 2387         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
 2388 }
 2389 
 2390 static void
 2391 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
 2392     int digphy)
 2393 {
 2394         struct rtw_regs *regs = &sc->sc_regs;
 2395 
 2396         rtw_set_access(regs, RTW_ACCESS_ANAPARM);
 2397 
 2398         (*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
 2399 
 2400         rtw_set_access(regs, RTW_ACCESS_NONE);
 2401 
 2402         return;
 2403 }
 2404 
 2405 static int
 2406 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
 2407 {
 2408         int rc;
 2409 
 2410         RTW_DPRINTF(RTW_DEBUG_PWR,
 2411             ("%s: %s->%s\n", __func__,
 2412             rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
 2413 
 2414         if (sc->sc_pwrstate == power)
 2415                 return 0;
 2416 
 2417         rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
 2418         rc = rtw_rf_pwrstate(sc->sc_rf, power);
 2419         rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
 2420 
 2421         switch (power) {
 2422         case RTW_ON:
 2423                 /* TBD set LEDs */
 2424                 break;
 2425         case RTW_SLEEP:
 2426                 /* TBD */
 2427                 break;
 2428         case RTW_OFF:
 2429                 /* TBD */
 2430                 break;
 2431         }
 2432         if (rc == 0)
 2433                 sc->sc_pwrstate = power;
 2434         else
 2435                 sc->sc_pwrstate = RTW_OFF;
 2436         return rc;
 2437 }
 2438 
 2439 static int
 2440 rtw_tune(struct rtw_softc *sc)
 2441 {
 2442         struct ieee80211com *ic = &sc->sc_ic;
 2443         struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
 2444         struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
 2445         u_int chan;
 2446         int rc;
 2447         int antdiv = sc->sc_flags & RTW_F_ANTDIV,
 2448             dflantb = sc->sc_flags & RTW_F_DFLANTB;
 2449 
 2450         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
 2451         if (chan == IEEE80211_CHAN_ANY)
 2452                 panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
 2453 
 2454         rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
 2455         rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
 2456 
 2457         rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
 2458         rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
 2459 
 2460         if (chan == sc->sc_cur_chan) {
 2461                 RTW_DPRINTF(RTW_DEBUG_TUNE,
 2462                     ("%s: already tuned chan #%d\n", __func__, chan));
 2463                 return 0;
 2464         }
 2465 
 2466         rtw_suspend_ticks(sc);
 2467 
 2468         rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
 2469 
 2470         /* TBD wait for Tx to complete */
 2471 
 2472         KASSERT((sc->sc_flags & RTW_F_ENABLED) != 0);
 2473 
 2474         if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
 2475             rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
 2476                 ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
 2477                 /* XXX condition on powersaving */
 2478                 printf("%s: phy init failed\n", sc->sc_dev.dv_xname);
 2479         }
 2480 
 2481         sc->sc_cur_chan = chan;
 2482 
 2483         rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 1);
 2484 
 2485         rtw_resume_ticks(sc);
 2486 
 2487         return rc;
 2488 }
 2489 
 2490 void
 2491 rtw_disable(struct rtw_softc *sc)
 2492 {
 2493         int rc;
 2494 
 2495         if ((sc->sc_flags & RTW_F_ENABLED) == 0)
 2496                 return;
 2497 
 2498         /* turn off PHY */
 2499         if ((sc->sc_flags & RTW_F_INVALID) == 0 &&
 2500             (rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
 2501                 printf("%s: failed to turn off PHY (%d)\n",
 2502                     sc->sc_dev.dv_xname, rc);
 2503         }
 2504 
 2505         if (sc->sc_disable != NULL)
 2506                 (*sc->sc_disable)(sc);
 2507 
 2508         sc->sc_flags &= ~RTW_F_ENABLED;
 2509 }
 2510 
 2511 int
 2512 rtw_enable(struct rtw_softc *sc)
 2513 {
 2514         if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
 2515                 if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
 2516                         printf("%s: device enable failed\n",
 2517                             sc->sc_dev.dv_xname);
 2518                         return (EIO);
 2519                 }
 2520                 sc->sc_flags |= RTW_F_ENABLED;
 2521                 /* Power may have been removed, and WEP keys thus
 2522                  * reset.
 2523                  */
 2524                 sc->sc_flags &= ~RTW_F_DK_VALID;
 2525         }
 2526         return (0);
 2527 }
 2528 
 2529 static void
 2530 rtw_transmit_config(struct rtw_regs *regs)
 2531 {
 2532         uint32_t tcr;
 2533 
 2534         tcr = RTW_READ(regs, RTW_TCR);
 2535 
 2536         tcr |= RTW_TCR_CWMIN;
 2537         tcr &= ~RTW_TCR_MXDMA_MASK;
 2538         tcr |= RTW_TCR_MXDMA_256;
 2539         tcr |= RTW_TCR_SAT;             /* send ACK as fast as possible */
 2540         tcr &= ~RTW_TCR_LBK_MASK;
 2541         tcr |= RTW_TCR_LBK_NORMAL;      /* normal operating mode */
 2542 
 2543         /* set short/long retry limits */
 2544         tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
 2545         tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
 2546 
 2547         tcr &= ~RTW_TCR_CRC;    /* NIC appends CRC32 */
 2548 
 2549         RTW_WRITE(regs, RTW_TCR, tcr);
 2550         RTW_SYNC(regs, RTW_TCR, RTW_TCR);
 2551 }
 2552 
 2553 static inline void
 2554 rtw_enable_interrupts(struct rtw_softc *sc)
 2555 {
 2556         struct rtw_regs *regs = &sc->sc_regs;
 2557 
 2558         sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
 2559         sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
 2560 
 2561         RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
 2562         RTW_WBW(regs, RTW_IMR, RTW_ISR);
 2563         RTW_WRITE16(regs, RTW_ISR, 0xffff);
 2564         RTW_SYNC(regs, RTW_IMR, RTW_ISR);
 2565 
 2566         /* XXX necessary? */
 2567         if (sc->sc_intr_ack != NULL)
 2568                 (*sc->sc_intr_ack)(regs);
 2569 }
 2570 
 2571 static void
 2572 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
 2573 {
 2574         uint8_t msr;
 2575 
 2576         /* I'm guessing that MSR is protected as CONFIG[0123] are. */
 2577         rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
 2578 
 2579         msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
 2580 
 2581         switch (opmode) {
 2582         case IEEE80211_M_AHDEMO:
 2583         case IEEE80211_M_IBSS:
 2584                 msr |= RTW_MSR_NETYPE_ADHOC_OK;
 2585                 break;
 2586         case IEEE80211_M_HOSTAP:
 2587                 msr |= RTW_MSR_NETYPE_AP_OK;
 2588                 break;
 2589         case IEEE80211_M_MONITOR:
 2590                 /* XXX */
 2591                 msr |= RTW_MSR_NETYPE_NOLINK;
 2592                 break;
 2593         case IEEE80211_M_STA:
 2594                 msr |= RTW_MSR_NETYPE_INFRA_OK;
 2595                 break;
 2596         }
 2597         RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
 2598 
 2599         rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
 2600 }
 2601 
 2602 #define rtw_calchash(addr) \
 2603         (ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
 2604 
 2605 static void
 2606 rtw_pktfilt_load(struct rtw_softc *sc)
 2607 {
 2608         struct rtw_regs *regs = &sc->sc_regs;
 2609         struct ieee80211com *ic = &sc->sc_ic;
 2610         struct ethercom *ec = &sc->sc_ec;
 2611         struct ifnet *ifp = &sc->sc_if;
 2612         int hash;
 2613         uint32_t hashes[2] = { 0, 0 };
 2614         struct ether_multi *enm;
 2615         struct ether_multistep step;
 2616 
 2617         /* XXX might be necessary to stop Rx/Tx engines while setting filters */
 2618 
 2619         sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
 2620         sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
 2621 
 2622         sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
 2623         /* MAC auto-reset PHY (huh?) */
 2624         sc->sc_rcr |= RTW_RCR_ENMARP;
 2625         /* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
 2626         sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
 2627 
 2628         switch (ic->ic_opmode) {
 2629         case IEEE80211_M_MONITOR:
 2630                 sc->sc_rcr |= RTW_RCR_MONITOR;
 2631                 break;
 2632         case IEEE80211_M_AHDEMO:
 2633         case IEEE80211_M_IBSS:
 2634                 /* receive broadcasts in our BSS */
 2635                 sc->sc_rcr |= RTW_RCR_ADD3;
 2636                 break;
 2637         default:
 2638                 break;
 2639         }
 2640 
 2641         ifp->if_flags &= ~IFF_ALLMULTI;
 2642 
 2643         /* XXX accept all broadcast if scanning */
 2644         if ((ifp->if_flags & IFF_BROADCAST) != 0)
 2645                 sc->sc_rcr |= RTW_RCR_AB;       /* accept all broadcast */
 2646 
 2647         if (ifp->if_flags & IFF_PROMISC) {
 2648                 sc->sc_rcr |= RTW_RCR_AB;       /* accept all broadcast */
 2649 allmulti:
 2650                 ifp->if_flags |= IFF_ALLMULTI;
 2651                 goto setit;
 2652         }
 2653 
 2654         /*
 2655          * Program the 64-bit multicast hash filter.
 2656          */
 2657         ETHER_FIRST_MULTI(step, ec, enm);
 2658         while (enm != NULL) {
 2659                 /* XXX */
 2660                 if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
 2661                     ETHER_ADDR_LEN) != 0)
 2662                         goto allmulti;
 2663 
 2664                 hash = rtw_calchash(enm->enm_addrlo);
 2665                 hashes[hash >> 5] |= (1 << (hash & 0x1f));
 2666                 sc->sc_rcr |= RTW_RCR_AM;
 2667                 ETHER_NEXT_MULTI(step, enm);
 2668         }
 2669 
 2670         /* all bits set => hash is useless */
 2671         if (~(hashes[0] & hashes[1]) == 0)
 2672                 goto allmulti;
 2673 
 2674  setit:
 2675         if (ifp->if_flags & IFF_ALLMULTI) {
 2676                 sc->sc_rcr |= RTW_RCR_AM;       /* accept all multicast */
 2677                 hashes[0] = hashes[1] = 0xffffffff;
 2678         }
 2679 
 2680         RTW_WRITE(regs, RTW_MAR0, hashes[0]);
 2681         RTW_WRITE(regs, RTW_MAR1, hashes[1]);
 2682         RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
 2683         RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
 2684 
 2685         DPRINTF(sc, RTW_DEBUG_PKTFILT,
 2686             ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
 2687             sc->sc_dev.dv_xname, RTW_READ(regs, RTW_MAR0),
 2688             RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
 2689 
 2690         return;
 2691 }
 2692 
 2693 static struct mbuf *
 2694 rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
 2695 {
 2696         struct ieee80211com *ic = &sc->sc_ic;
 2697         struct mbuf *m;
 2698         struct ieee80211_beacon_offsets boff;
 2699 
 2700         if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
 2701                 RTW_DPRINTF(RTW_DEBUG_BEACON,
 2702                     ("%s: m %p len %u\n", __func__, m, m->m_len));
 2703         }
 2704         return m;
 2705 }
 2706 
 2707 /* Must be called at splnet. */
 2708 static int
 2709 rtw_init(struct ifnet *ifp)
 2710 {
 2711         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
 2712         struct ieee80211com *ic = &sc->sc_ic;
 2713         struct rtw_regs *regs = &sc->sc_regs;
 2714         int rc = 0;
 2715 
 2716         if ((rc = rtw_enable(sc)) != 0)
 2717                 goto out;
 2718 
 2719         /* Cancel pending I/O and reset. */
 2720         rtw_stop(ifp, 0);
 2721 
 2722         DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
 2723             __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
 2724             ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
 2725 
 2726         if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
 2727                 goto out;
 2728 
 2729         if ((rc = rtw_swring_setup(sc)) != 0)
 2730                 goto out;
 2731 
 2732         rtw_transmit_config(regs);
 2733 
 2734         rtw_set_access(regs, RTW_ACCESS_CONFIG);
 2735 
 2736         RTW_WRITE8(regs, RTW_MSR, 0x0); /* no link */
 2737         RTW_WBW(regs, RTW_MSR, RTW_BRSR);
 2738 
 2739         /* long PLCP header, 1Mb/2Mb basic rate */
 2740         RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
 2741         RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
 2742 
 2743         rtw_set_access(regs, RTW_ACCESS_ANAPARM);
 2744         rtw_set_access(regs, RTW_ACCESS_NONE);
 2745 
 2746         /* XXX from reference sources */
 2747         RTW_WRITE(regs, RTW_FEMR, 0xffff);
 2748         RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
 2749 
 2750         rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev.dv_xname);
 2751 
 2752         RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
 2753         /* from Linux driver */
 2754         RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
 2755 
 2756         RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
 2757 
 2758         rtw_enable_interrupts(sc);
 2759 
 2760         rtw_pktfilt_load(sc);
 2761 
 2762         rtw_hwring_setup(sc);
 2763 
 2764         rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
 2765 
 2766         rtw_io_enable(regs, RTW_CR_RE|RTW_CR_TE, 1);
 2767 
 2768         ifp->if_flags |= IFF_RUNNING;
 2769         ic->ic_state = IEEE80211_S_INIT;
 2770 
 2771         RTW_WRITE16(regs, RTW_BSSID16, 0x0);
 2772         RTW_WRITE(regs, RTW_BSSID32, 0x0);
 2773 
 2774         rtw_resume_ticks(sc);
 2775 
 2776         rtw_set_nettype(sc, IEEE80211_M_MONITOR);
 2777 
 2778         if (ic->ic_opmode == IEEE80211_M_MONITOR)
 2779                 return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 2780         else
 2781                 return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 2782 
 2783 out:
 2784         printf("%s: interface not running\n", sc->sc_dev.dv_xname);
 2785         return rc;
 2786 }
 2787 
 2788 static inline void
 2789 rtw_led_init(struct rtw_regs *regs)
 2790 {
 2791         uint8_t cfg0, cfg1;
 2792 
 2793         rtw_set_access(regs, RTW_ACCESS_CONFIG);
 2794 
 2795         cfg0 = RTW_READ8(regs, RTW_CONFIG0);
 2796         cfg0 |= RTW_CONFIG0_LEDGPOEN;
 2797         RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
 2798 
 2799         cfg1 = RTW_READ8(regs, RTW_CONFIG1);
 2800         RTW_DPRINTF(RTW_DEBUG_LED,
 2801             ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
 2802 
 2803         cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
 2804         cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
 2805         RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
 2806 
 2807         rtw_set_access(regs, RTW_ACCESS_NONE);
 2808 }
 2809 
 2810 /*
 2811  * IEEE80211_S_INIT:            LED1 off
 2812  *
 2813  * IEEE80211_S_AUTH,
 2814  * IEEE80211_S_ASSOC,
 2815  * IEEE80211_S_SCAN:            LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
 2816  *
 2817  * IEEE80211_S_RUN:             LED1 on, blinks @ 5Hz for tx/rx
 2818  */
 2819 static void
 2820 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
 2821 {
 2822         struct rtw_led_state *ls;
 2823 
 2824         ls = &sc->sc_led_state;
 2825 
 2826         switch (nstate) {
 2827         case IEEE80211_S_INIT:
 2828                 rtw_led_init(&sc->sc_regs);
 2829                 callout_stop(&ls->ls_slow_ch);
 2830                 callout_stop(&ls->ls_fast_ch);
 2831                 ls->ls_slowblink = 0;
 2832                 ls->ls_actblink = 0;
 2833                 ls->ls_default = 0;
 2834                 break;
 2835         case IEEE80211_S_SCAN:
 2836                 callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
 2837                 callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
 2838                 /*FALLTHROUGH*/
 2839         case IEEE80211_S_AUTH:
 2840         case IEEE80211_S_ASSOC:
 2841                 ls->ls_default = RTW_LED1;
 2842                 ls->ls_actblink = RTW_LED1;
 2843                 ls->ls_slowblink = RTW_LED1;
 2844                 break;
 2845         case IEEE80211_S_RUN:
 2846                 ls->ls_slowblink = 0;
 2847                 break;
 2848         }
 2849         rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
 2850 }
 2851 
 2852 static void
 2853 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
 2854 {
 2855         uint8_t led_condition;
 2856         bus_size_t ofs;
 2857         uint8_t mask, newval, val;
 2858 
 2859         led_condition = ls->ls_default;
 2860 
 2861         if (ls->ls_state & RTW_LED_S_SLOW)
 2862                 led_condition ^= ls->ls_slowblink;
 2863         if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
 2864                 led_condition ^= ls->ls_actblink;
 2865 
 2866         RTW_DPRINTF(RTW_DEBUG_LED,
 2867             ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
 2868 
 2869         switch (hwverid) {
 2870         default:
 2871         case 'F':
 2872                 ofs = RTW_PSR;
 2873                 newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
 2874                 if (led_condition & RTW_LED0)
 2875                         newval &= ~RTW_PSR_LEDGPO0;
 2876                 if (led_condition & RTW_LED1)
 2877                         newval &= ~RTW_PSR_LEDGPO1;
 2878                 break;
 2879         case 'D':
 2880                 ofs = RTW_9346CR;
 2881                 mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
 2882                 newval = RTW_9346CR_EEM_PROGRAM;
 2883                 if (led_condition & RTW_LED0)
 2884                         newval |= RTW_9346CR_EEDI;
 2885                 if (led_condition & RTW_LED1)
 2886                         newval |= RTW_9346CR_EECS;
 2887                 break;
 2888         }
 2889         val = RTW_READ8(regs, ofs);
 2890         RTW_DPRINTF(RTW_DEBUG_LED,
 2891             ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
 2892              (uintptr_t)ofs));
 2893         val &= ~mask;
 2894         val |= newval;
 2895         RTW_WRITE8(regs, ofs, val);
 2896         RTW_DPRINTF(RTW_DEBUG_LED,
 2897             ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
 2898              (uintptr_t)ofs));
 2899         RTW_SYNC(regs, ofs, ofs);
 2900 }
 2901 
 2902 static void
 2903 rtw_led_fastblink(void *arg)
 2904 {
 2905         int ostate, s;
 2906         struct rtw_softc *sc = (struct rtw_softc *)arg;
 2907         struct rtw_led_state *ls = &sc->sc_led_state;
 2908 
 2909         s = splnet();
 2910         ostate = ls->ls_state;
 2911         ls->ls_state ^= ls->ls_event;
 2912 
 2913         if ((ls->ls_event & RTW_LED_S_TX) == 0)
 2914                 ls->ls_state &= ~RTW_LED_S_TX;
 2915 
 2916         if ((ls->ls_event & RTW_LED_S_RX) == 0)
 2917                 ls->ls_state &= ~RTW_LED_S_RX;
 2918 
 2919         ls->ls_event = 0;
 2920 
 2921         if (ostate != ls->ls_state)
 2922                 rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
 2923         splx(s);
 2924 
 2925         callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
 2926 }
 2927 
 2928 static void
 2929 rtw_led_slowblink(void *arg)
 2930 {
 2931         int s;
 2932         struct rtw_softc *sc = (struct rtw_softc *)arg;
 2933         struct rtw_led_state *ls = &sc->sc_led_state;
 2934 
 2935         s = splnet();
 2936         ls->ls_state ^= RTW_LED_S_SLOW;
 2937         rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
 2938         splx(s);
 2939         callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
 2940 }
 2941 
 2942 static inline void
 2943 rtw_led_attach(struct rtw_led_state *ls, void *arg)
 2944 {
 2945         callout_init(&ls->ls_fast_ch);
 2946         callout_init(&ls->ls_slow_ch);
 2947         callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
 2948         callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
 2949 }
 2950 
 2951 static int
 2952 rtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 2953 {
 2954         int rc = 0, s;
 2955         struct rtw_softc *sc = ifp->if_softc;
 2956         struct ifreq *ifr = (struct ifreq *)data;
 2957 
 2958         s = splnet();
 2959         switch (cmd) {
 2960         case SIOCSIFFLAGS:
 2961                 if ((ifp->if_flags & IFF_UP) != 0) {
 2962                         if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
 2963                                 rtw_pktfilt_load(sc);
 2964                         } else
 2965                                 rc = rtw_init(ifp);
 2966                         RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
 2967                 } else if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
 2968                         RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
 2969                         rtw_stop(ifp, 1);
 2970                 }
 2971                 break;
 2972         case SIOCADDMULTI:
 2973         case SIOCDELMULTI:
 2974                 if (cmd == SIOCADDMULTI)
 2975                         rc = ether_addmulti(ifr, &sc->sc_ec);
 2976                 else
 2977                         rc = ether_delmulti(ifr, &sc->sc_ec);
 2978                 if (rc != ENETRESET)
 2979                         break;
 2980                 if (ifp->if_flags & IFF_RUNNING)
 2981                         rtw_pktfilt_load(sc);
 2982                 rc = 0;
 2983                 break;
 2984         default:
 2985                 if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
 2986                         break;
 2987                 if ((sc->sc_flags & RTW_F_ENABLED) != 0)
 2988                         rc = rtw_init(ifp);
 2989                 else
 2990                         rc = 0;
 2991                 break;
 2992         }
 2993         splx(s);
 2994         return rc;
 2995 }
 2996 
 2997 /* Select a transmit ring with at least one h/w and s/w descriptor free.
 2998  * Return 0 on success, -1 on failure.
 2999  */
 3000 static inline int
 3001 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
 3002     struct rtw_txdesc_blk **tdbp, int pri)
 3003 {
 3004         struct rtw_txsoft_blk *tsb;
 3005         struct rtw_txdesc_blk *tdb;
 3006 
 3007         KASSERT(pri >= 0 && pri < RTW_NTXPRI);
 3008 
 3009         tsb = &sc->sc_txsoft_blk[pri];
 3010         tdb = &sc->sc_txdesc_blk[pri];
 3011 
 3012         if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
 3013                 if (tsb->tsb_tx_timer == 0)
 3014                         tsb->tsb_tx_timer = 5;
 3015                 *tsbp = NULL;
 3016                 *tdbp = NULL;
 3017                 return -1;
 3018         }
 3019         *tsbp = tsb;
 3020         *tdbp = tdb;
 3021         return 0;
 3022 }
 3023 
 3024 static inline struct mbuf *
 3025 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
 3026     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
 3027     struct ieee80211_node **nip, short *if_flagsp)
 3028 {
 3029         struct mbuf *m;
 3030 
 3031         if (IF_IS_EMPTY(ifq))
 3032                 return NULL;
 3033         if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
 3034                 DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
 3035                     __func__, pri));
 3036                 *if_flagsp |= IFF_OACTIVE;
 3037                 sc->sc_if.if_timer = 1;
 3038                 return NULL;
 3039         }
 3040         IF_DEQUEUE(ifq, m);
 3041         *nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
 3042         m->m_pkthdr.rcvif = NULL;
 3043         KASSERT(*nip != NULL);
 3044         return m;
 3045 }
 3046 
 3047 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
 3048  * at the driver's selection of transmit control block for the packet.
 3049  */
 3050 static inline int
 3051 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
 3052     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
 3053     struct ieee80211_node **nip)
 3054 {
 3055         int pri;
 3056         struct ether_header *eh;
 3057         struct mbuf *m0;
 3058         struct rtw_softc *sc;
 3059         short *if_flagsp;
 3060 
 3061         sc = (struct rtw_softc *)ifp->if_softc;
 3062 
 3063         DPRINTF(sc, RTW_DEBUG_XMIT,
 3064             ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
 3065 
 3066         if_flagsp = &ifp->if_flags;
 3067 
 3068         if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
 3069             (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
 3070                                      tdbp, nip, if_flagsp)) != NULL) {
 3071                 DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
 3072                     __func__));
 3073                 return 0;
 3074         }
 3075 
 3076         if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
 3077                                      tdbp, nip, if_flagsp)) != NULL) {
 3078                 DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
 3079                     __func__));
 3080                 return 0;
 3081         }
 3082 
 3083         if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
 3084                 DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
 3085                 return 0;
 3086         }
 3087 
 3088         *mp = NULL;
 3089 
 3090         IFQ_POLL(&ifp->if_snd, m0);
 3091         if (m0 == NULL) {
 3092                 DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
 3093                     __func__));
 3094                 return 0;
 3095         }
 3096 
 3097         pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
 3098 
 3099         if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
 3100                 DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
 3101                     __func__, pri));
 3102                 *if_flagsp |= IFF_OACTIVE;
 3103                 sc->sc_if.if_timer = 1;
 3104                 return 0;
 3105         }
 3106 
 3107         IFQ_DEQUEUE(&ifp->if_snd, m0);
 3108         if (m0 == NULL) {
 3109                 DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
 3110                     __func__));
 3111                 return 0;
 3112         }
 3113         DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
 3114         ifp->if_opackets++;
 3115 #if NBPFILTER > 0
 3116         if (ifp->if_bpf)
 3117                 bpf_mtap(ifp->if_bpf, m0);
 3118 #endif
 3119         eh = mtod(m0, struct ether_header *);
 3120         *nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
 3121         if (*nip == NULL) {
 3122                 /* NB: ieee80211_find_txnode does stat+msg */
 3123                 m_freem(m0);
 3124                 return -1;
 3125         }
 3126         if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
 3127                 DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
 3128                 ifp->if_oerrors++;
 3129                 return -1;
 3130         }
 3131         DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
 3132         *mp = m0;
 3133         return 0;
 3134 }
 3135 
 3136 static int
 3137 rtw_seg_too_short(bus_dmamap_t dmamap)
 3138 {
 3139         int i;
 3140         for (i = 0; i < dmamap->dm_nsegs; i++) {
 3141                 if (dmamap->dm_segs[i].ds_len < 4) {
 3142                         printf("%s: segment too short\n", __func__);
 3143                         return 1;
 3144                 }
 3145         }
 3146         return 0;
 3147 }
 3148 
 3149 /* TBD factor with atw_start */
 3150 static struct mbuf *
 3151 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
 3152     u_int ndescfree, const char *dvname)
 3153 {
 3154         int first, rc;
 3155         struct mbuf *m, *m0;
 3156 
 3157         m0 = chain;
 3158 
 3159         /*
 3160          * Load the DMA map.  Copy and try (once) again if the packet
 3161          * didn't fit in the alloted number of segments.
 3162          */
 3163         for (first = 1;
 3164              ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
 3165                           BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
 3166               dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
 3167              first = 0) {
 3168                 if (rc == 0)
 3169                         bus_dmamap_unload(dmat, dmam);
 3170                 MGETHDR(m, M_DONTWAIT, MT_DATA);
 3171                 if (m == NULL) {
 3172                         printf("%s: unable to allocate Tx mbuf\n",
 3173                             dvname);
 3174                         break;
 3175                 }
 3176                 if (m0->m_pkthdr.len > MHLEN) {
 3177                         MCLGET(m, M_DONTWAIT);
 3178                         if ((m->m_flags & M_EXT) == 0) {
 3179                                 printf("%s: cannot allocate Tx cluster\n",
 3180                                     dvname);
 3181                                 m_freem(m);
 3182                                 break;
 3183                         }
 3184                 }
 3185                 m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
 3186                 m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
 3187                 m_freem(m0);
 3188                 m0 = m;
 3189                 m = NULL;
 3190         }
 3191         if (rc != 0) {
 3192                 printf("%s: cannot load Tx buffer, rc = %d\n", dvname, rc);
 3193                 m_freem(m0);
 3194                 return NULL;
 3195         } else if (rtw_seg_too_short(dmam)) {
 3196                 printf("%s: cannot load Tx buffer, segment too short\n",
 3197                     dvname);
 3198                 bus_dmamap_unload(dmat, dmam);
 3199                 m_freem(m0);
 3200                 return NULL;
 3201         } else if (dmam->dm_nsegs > ndescfree) {
 3202                 printf("%s: too many tx segments\n", dvname);
 3203                 bus_dmamap_unload(dmat, dmam);
 3204                 m_freem(m0);
 3205                 return NULL;
 3206         }
 3207         return m0;
 3208 }
 3209 
 3210 #ifdef RTW_DEBUG
 3211 static void
 3212 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
 3213     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
 3214 {
 3215         struct rtw_txdesc *td = &tdb->tdb_desc[desc];
 3216         DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
 3217             "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
 3218             sc->sc_dev.dv_xname, ts, action, desc,
 3219             le32toh(td->td_buf), le32toh(td->td_next),
 3220             le32toh(td->td_ctl0), le32toh(td->td_ctl1),
 3221             le32toh(td->td_len)));
 3222 }
 3223 #endif /* RTW_DEBUG */
 3224 
 3225 static void
 3226 rtw_start(struct ifnet *ifp)
 3227 {
 3228         uint8_t tppoll;
 3229         int desc, i, lastdesc, npkt, rate;
 3230         uint32_t proto_ctl0, ctl0, ctl1;
 3231         bus_dmamap_t            dmamap;
 3232         struct ieee80211com     *ic;
 3233         struct ieee80211_duration *d0;
 3234         struct ieee80211_frame_min      *wh;
 3235         struct ieee80211_node   *ni = NULL;     /* XXX: GCC */
 3236         struct mbuf             *m0;
 3237         struct rtw_softc        *sc;
 3238         struct rtw_txsoft_blk   *tsb = NULL;    /* XXX: GCC */
 3239         struct rtw_txdesc_blk   *tdb = NULL;    /* XXX: GCC */
 3240         struct rtw_txsoft       *ts;
 3241         struct rtw_txdesc       *td;
 3242         struct ieee80211_key    *k;
 3243 
 3244         sc = (struct rtw_softc *)ifp->if_softc;
 3245         ic = &sc->sc_ic;
 3246 
 3247         DPRINTF(sc, RTW_DEBUG_XMIT,
 3248             ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
 3249 
 3250         if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
 3251                 goto out;
 3252 
 3253         /* XXX do real rate control */
 3254         proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
 3255 
 3256         if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
 3257                 proto_ctl0 |= RTW_TXCTL0_SPLCP;
 3258 
 3259         for (;;) {
 3260                 if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
 3261                         continue;
 3262                 if (m0 == NULL)
 3263                         break;
 3264 
 3265                 wh = mtod(m0, struct ieee80211_frame_min *);
 3266 
 3267                 if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
 3268                     (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
 3269                         m_freem(m0);
 3270                         break;
 3271                 } else
 3272                         k = NULL;
 3273 
 3274                 ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
 3275 
 3276                 dmamap = ts->ts_dmamap;
 3277 
 3278                 m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
 3279                     tdb->tdb_nfree, sc->sc_dev.dv_xname);
 3280 
 3281                 if (m0 == NULL || dmamap->dm_nsegs == 0) {
 3282                         DPRINTF(sc, RTW_DEBUG_XMIT,
 3283                             ("%s: fail dmamap load\n", __func__));
 3284                         goto post_dequeue_err;
 3285                 }
 3286 
 3287                 /* Note well: rtw_dmamap_load_txbuf may have created
 3288                  * a new chain, so we must find the header once
 3289                  * more.
 3290                  */
 3291                 wh = mtod(m0, struct ieee80211_frame_min *);
 3292 
 3293                 /* XXX do real rate control */
 3294                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
 3295                     IEEE80211_FC0_TYPE_MGT)
 3296                         rate = 2;
 3297                 else
 3298                         rate = MAX(2, ieee80211_get_rate(ni));
 3299 
 3300 #ifdef RTW_DEBUG
 3301                 if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
 3302                     (IFF_DEBUG|IFF_LINK2)) {
 3303                         ieee80211_dump_pkt(mtod(m0, uint8_t *),
 3304                             (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
 3305                                                     : sizeof(wh),
 3306                             rate, 0);
 3307                 }
 3308 #endif /* RTW_DEBUG */
 3309                 ctl0 = proto_ctl0 |
 3310                     __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
 3311 
 3312                 switch (rate) {
 3313                 default:
 3314                 case 2:
 3315                         ctl0 |= RTW_TXCTL0_RATE_1MBPS;
 3316                         break;
 3317                 case 4:
 3318                         ctl0 |= RTW_TXCTL0_RATE_2MBPS;
 3319                         break;
 3320                 case 11:
 3321                         ctl0 |= RTW_TXCTL0_RATE_5MBPS;
 3322                         break;
 3323                 case 22:
 3324                         ctl0 |= RTW_TXCTL0_RATE_11MBPS;
 3325                         break;
 3326                 }
 3327                 /* XXX >= ? Compare after fragmentation? */
 3328                 if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
 3329                         ctl0 |= RTW_TXCTL0_RTSEN;
 3330 
 3331                 /* XXX Sometimes writes a bogus keyid; h/w doesn't
 3332                  * seem to care, since we don't activate h/w Tx
 3333                  * encryption.
 3334                  */
 3335                 if (k != NULL) {
 3336                         ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
 3337                             RTW_TXCTL0_KEYID_MASK;
 3338                 }
 3339 
 3340                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
 3341                     IEEE80211_FC0_TYPE_MGT) {
 3342                         ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
 3343                         if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
 3344                             IEEE80211_FC0_SUBTYPE_BEACON)
 3345                                 ctl0 |= RTW_TXCTL0_BEACON;
 3346                 }
 3347 
 3348                 if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
 3349                     ic->ic_flags, ic->ic_fragthreshold,
 3350                     rate, &ts->ts_d0, &ts->ts_dn, &npkt,
 3351                     (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
 3352                     (IFF_DEBUG|IFF_LINK2)) == -1) {
 3353                         DPRINTF(sc, RTW_DEBUG_XMIT,
 3354                             ("%s: fail compute duration\n", __func__));
 3355                         goto post_load_err;
 3356                 }
 3357 
 3358                 d0 = &ts->ts_d0;
 3359 
 3360                 *(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
 3361 
 3362                 ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
 3363                     __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
 3364 
 3365                 if (d0->d_residue)
 3366                         ctl1 |= RTW_TXCTL1_LENGEXT;
 3367 
 3368                 /* TBD fragmentation */
 3369 
 3370                 ts->ts_first = tdb->tdb_next;
 3371 
 3372                 rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
 3373                     BUS_DMASYNC_PREWRITE);
 3374 
 3375                 KASSERT(ts->ts_first < tdb->tdb_ndesc);
 3376 
 3377 #if NBPFILTER > 0
 3378                 if (ic->ic_rawbpf != NULL)
 3379                         bpf_mtap((caddr_t)ic->ic_rawbpf, m0);
 3380 
 3381                 if (sc->sc_radiobpf != NULL) {
 3382                         struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
 3383 
 3384                         rt->rt_flags = 0;
 3385                         rt->rt_rate = rate;
 3386 
 3387                         bpf_mtap2(sc->sc_radiobpf, (caddr_t)rt,
 3388                             sizeof(sc->sc_txtapu), m0);
 3389                 }
 3390 #endif /* NPBFILTER > 0 */
 3391 
 3392                 for (i = 0, lastdesc = desc = ts->ts_first;
 3393                      i < dmamap->dm_nsegs;
 3394                      i++, desc = RTW_NEXT_IDX(tdb, desc)) {
 3395                         if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
 3396                                 DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
 3397                                     ("%s: seg too long\n", __func__));
 3398                                 goto post_load_err;
 3399                         }
 3400                         td = &tdb->tdb_desc[desc];
 3401                         td->td_ctl0 = htole32(ctl0);
 3402                         if (i != 0)
 3403                                 td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
 3404                         td->td_ctl1 = htole32(ctl1);
 3405                         td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
 3406                         td->td_len = htole32(dmamap->dm_segs[i].ds_len);
 3407                         lastdesc = desc;
 3408 #ifdef RTW_DEBUG
 3409                         rtw_print_txdesc(sc, "load", ts, tdb, desc);
 3410 #endif /* RTW_DEBUG */
 3411                 }
 3412 
 3413                 KASSERT(desc < tdb->tdb_ndesc);
 3414 
 3415                 ts->ts_ni = ni;
 3416                 KASSERT(ni != NULL);
 3417                 ts->ts_mbuf = m0;
 3418                 ts->ts_last = lastdesc;
 3419                 tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
 3420                 tdb->tdb_desc[ts->ts_first].td_ctl0 |=
 3421                    htole32(RTW_TXCTL0_FS);
 3422 
 3423 #ifdef RTW_DEBUG
 3424                 rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
 3425                 rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
 3426 #endif /* RTW_DEBUG */
 3427 
 3428                 tdb->tdb_nfree -= dmamap->dm_nsegs;
 3429                 tdb->tdb_next = desc;
 3430 
 3431                 rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
 3432                     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 3433 
 3434                 tdb->tdb_desc[ts->ts_first].td_ctl0 |=
 3435                     htole32(RTW_TXCTL0_OWN);
 3436 
 3437 #ifdef RTW_DEBUG
 3438                 rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
 3439 #endif /* RTW_DEBUG */
 3440 
 3441                 rtw_txdescs_sync(tdb, ts->ts_first, 1,
 3442                     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
 3443 
 3444                 SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
 3445                 SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
 3446 
 3447                 if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
 3448                         sc->sc_led_state.ls_event |= RTW_LED_S_TX;
 3449                 tsb->tsb_tx_timer = 5;
 3450                 ifp->if_timer = 1;
 3451                 tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
 3452                 tppoll &= ~RTW_TPPOLL_SALL;
 3453                 tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
 3454                 RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
 3455                 RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
 3456         }
 3457 out:
 3458         DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
 3459         return;
 3460 post_load_err:
 3461         bus_dmamap_unload(sc->sc_dmat, dmamap);
 3462         m_freem(m0);
 3463 post_dequeue_err:
 3464         ieee80211_free_node(ni);
 3465         return;
 3466 }
 3467 
 3468 static void
 3469 rtw_idle(struct rtw_regs *regs)
 3470 {
 3471         int active;
 3472 
 3473         /* request stop DMA; wait for packets to stop transmitting. */
 3474 
 3475         RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
 3476         RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
 3477 
 3478         for (active = 0; active < 300 &&
 3479              (RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0; active++)
 3480                 DELAY(10);
 3481         printf("%s: transmit DMA idle in %dus\n", __func__, active * 10);
 3482 }
 3483 
 3484 static void
 3485 rtw_watchdog(struct ifnet *ifp)
 3486 {
 3487         int pri, tx_timeouts = 0;
 3488         struct rtw_softc *sc;
 3489         struct rtw_txsoft_blk *tsb;
 3490 
 3491         sc = ifp->if_softc;
 3492 
 3493         ifp->if_timer = 0;
 3494 
 3495         if ((sc->sc_flags & RTW_F_ENABLED) == 0)
 3496                 return;
 3497 
 3498         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 3499                 tsb = &sc->sc_txsoft_blk[pri];
 3500 
 3501                 if (tsb->tsb_tx_timer == 0)
 3502                         continue;
 3503                 else if (--tsb->tsb_tx_timer == 0) {
 3504                         if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
 3505                                 continue;
 3506                         printf("%s: transmit timeout, priority %d\n",
 3507                             ifp->if_xname, pri);
 3508                         ifp->if_oerrors++;
 3509                         tx_timeouts++;
 3510                 } else
 3511                         ifp->if_timer = 1;
 3512         }
 3513 
 3514         if (tx_timeouts > 0) {
 3515                 /* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
 3516                  * reset s/w tx-ring pointers, and start transmission.
 3517                  *
 3518                  * TBD Stop/restart just the broken rings?
 3519                  */
 3520                 rtw_idle(&sc->sc_regs);
 3521                 rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 0);
 3522                 rtw_txdescs_reset(sc);
 3523                 rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 1);
 3524                 rtw_txring_fixup(sc);
 3525                 rtw_start(ifp);
 3526         }
 3527         ieee80211_watchdog(&sc->sc_ic);
 3528         return;
 3529 }
 3530 
 3531 static void
 3532 rtw_next_scan(void *arg)
 3533 {
 3534         struct ieee80211com *ic = arg;
 3535         int s;
 3536 
 3537         /* don't call rtw_start w/o network interrupts blocked */
 3538         s = splnet();
 3539         if (ic->ic_state == IEEE80211_S_SCAN)
 3540                 ieee80211_next_scan(ic);
 3541         splx(s);
 3542 }
 3543 
 3544 static void
 3545 rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
 3546 {
 3547         uint16_t bcnitv, bintritv, intval;
 3548         int i;
 3549         struct rtw_regs *regs = &sc->sc_regs;
 3550 
 3551         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
 3552                 RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
 3553 
 3554         RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
 3555 
 3556         rtw_set_access(regs, RTW_ACCESS_CONFIG);
 3557 
 3558         intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
 3559 
 3560         bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
 3561         bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
 3562         RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
 3563         /* interrupt host 1ms before the TBTT */
 3564         bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
 3565         bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
 3566         RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
 3567         /* magic from Linux */
 3568         RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
 3569         RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
 3570         rtw_set_access(regs, RTW_ACCESS_NONE);
 3571 
 3572         rtw_io_enable(regs, RTW_CR_RE | RTW_CR_TE, 1);
 3573 }
 3574 
 3575 /* Synchronize the hardware state with the software state. */
 3576 static int
 3577 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 3578 {
 3579         struct ifnet *ifp = ic->ic_ifp;
 3580         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
 3581         enum ieee80211_state ostate;
 3582         int error;
 3583 
 3584         ostate = ic->ic_state;
 3585 
 3586         rtw_led_newstate(sc, nstate);
 3587 
 3588         if (nstate == IEEE80211_S_INIT) {
 3589                 callout_stop(&sc->sc_scan_ch);
 3590                 sc->sc_cur_chan = IEEE80211_CHAN_ANY;
 3591                 return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
 3592         }
 3593 
 3594         if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
 3595                 rtw_pwrstate(sc, RTW_ON);
 3596 
 3597         if ((error = rtw_tune(sc)) != 0)
 3598                 return error;
 3599 
 3600         switch (nstate) {
 3601         case IEEE80211_S_INIT:
 3602                 panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
 3603                 break;
 3604         case IEEE80211_S_SCAN:
 3605                 if (ostate != IEEE80211_S_SCAN) {
 3606                         (void)memset(ic->ic_bss->ni_bssid, 0,
 3607                             IEEE80211_ADDR_LEN);
 3608                         rtw_set_nettype(sc, IEEE80211_M_MONITOR);
 3609                 }
 3610 
 3611                 callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
 3612                     rtw_next_scan, ic);
 3613 
 3614                 break;
 3615         case IEEE80211_S_RUN:
 3616                 switch (ic->ic_opmode) {
 3617                 case IEEE80211_M_HOSTAP:
 3618                 case IEEE80211_M_IBSS:
 3619                         rtw_set_nettype(sc, IEEE80211_M_MONITOR);
 3620                         /*FALLTHROUGH*/
 3621                 case IEEE80211_M_AHDEMO:
 3622                 case IEEE80211_M_STA:
 3623                         rtw_join_bss(sc, ic->ic_bss->ni_bssid,
 3624                             ic->ic_bss->ni_intval);
 3625                         break;
 3626                 case IEEE80211_M_MONITOR:
 3627                         break;
 3628                 }
 3629                 rtw_set_nettype(sc, ic->ic_opmode);
 3630                 break;
 3631         case IEEE80211_S_ASSOC:
 3632         case IEEE80211_S_AUTH:
 3633                 break;
 3634         }
 3635 
 3636         if (nstate != IEEE80211_S_SCAN)
 3637                 callout_stop(&sc->sc_scan_ch);
 3638 
 3639         return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
 3640 }
 3641 
 3642 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
 3643 static uint64_t
 3644 rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
 3645 {
 3646         uint32_t tsftl, tsfth;
 3647 
 3648         tsfth = RTW_READ(regs, RTW_TSFTRH);
 3649         tsftl = RTW_READ(regs, RTW_TSFTRL);
 3650         if (tsftl < rstamp)     /* Compensate for rollover. */
 3651                 tsfth--;
 3652         return ((uint64_t)tsfth << 32) | rstamp;
 3653 }
 3654 
 3655 static void
 3656 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
 3657     struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
 3658 {
 3659         struct ifnet *ifp = ic->ic_ifp;
 3660         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
 3661 
 3662         (*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
 3663 
 3664         switch (subtype) {
 3665         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 3666         case IEEE80211_FC0_SUBTYPE_BEACON:
 3667                 if (ic->ic_opmode == IEEE80211_M_IBSS &&
 3668                     ic->ic_state == IEEE80211_S_RUN) {
 3669                         uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
 3670                         if (le64toh(ni->ni_tstamp.tsf) >= tsf)
 3671                                 (void)ieee80211_ibss_merge(ni);
 3672                 }
 3673                 break;
 3674         default:
 3675                 break;
 3676         }
 3677         return;
 3678 }
 3679 
 3680 static struct ieee80211_node *
 3681 rtw_node_alloc(struct ieee80211_node_table *nt)
 3682 {
 3683         struct ifnet *ifp = nt->nt_ic->ic_ifp;
 3684         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
 3685         struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
 3686 
 3687         DPRINTF(sc, RTW_DEBUG_NODE,
 3688             ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
 3689         return ni;
 3690 }
 3691 
 3692 static void
 3693 rtw_node_free(struct ieee80211_node *ni)
 3694 {
 3695         struct ieee80211com *ic = ni->ni_ic;
 3696         struct ifnet *ifp = ic->ic_ifp;
 3697         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
 3698 
 3699         DPRINTF(sc, RTW_DEBUG_NODE,
 3700             ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
 3701             ether_sprintf(ni->ni_bssid)));
 3702         (*sc->sc_mtbl.mt_node_free)(ni);
 3703 }
 3704 
 3705 static int
 3706 rtw_media_change(struct ifnet *ifp)
 3707 {
 3708         int error;
 3709 
 3710         error = ieee80211_media_change(ifp);
 3711         if (error == ENETRESET) {
 3712                 if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
 3713                     (IFF_RUNNING|IFF_UP))
 3714                         rtw_init(ifp);          /* XXX lose error */
 3715                 error = 0;
 3716         }
 3717         return error;
 3718 }
 3719 
 3720 static void
 3721 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
 3722 {
 3723         struct rtw_softc *sc = ifp->if_softc;
 3724 
 3725         if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
 3726                 imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
 3727                 imr->ifm_status = 0;
 3728                 return;
 3729         }
 3730         ieee80211_media_status(ifp, imr);
 3731 }
 3732 
 3733 void
 3734 rtw_power(int why, void *arg)
 3735 {
 3736         struct rtw_softc *sc = arg;
 3737         struct ifnet *ifp = &sc->sc_if;
 3738         int s;
 3739 
 3740         DPRINTF(sc, RTW_DEBUG_PWR,
 3741             ("%s: rtw_power(%d,)\n", sc->sc_dev.dv_xname, why));
 3742 
 3743         s = splnet();
 3744         switch (why) {
 3745         case PWR_STANDBY:
 3746                 /* XXX do nothing. */
 3747                 break;
 3748         case PWR_SUSPEND:
 3749                 rtw_stop(ifp, 0);
 3750                 if (sc->sc_power != NULL)
 3751                         (*sc->sc_power)(sc, why);
 3752                 break;
 3753         case PWR_RESUME:
 3754                 if (ifp->if_flags & IFF_UP) {
 3755                         if (sc->sc_power != NULL)
 3756                                 (*sc->sc_power)(sc, why);
 3757                         rtw_init(ifp);
 3758                 }
 3759                 break;
 3760         case PWR_SOFTSUSPEND:
 3761         case PWR_SOFTSTANDBY:
 3762         case PWR_SOFTRESUME:
 3763                 break;
 3764         }
 3765         splx(s);
 3766 }
 3767 
 3768 /* rtw_shutdown: make sure the interface is stopped at reboot time. */
 3769 void
 3770 rtw_shutdown(void *arg)
 3771 {
 3772         struct rtw_softc *sc = arg;
 3773 
 3774         rtw_stop(&sc->sc_if, 1);
 3775 }
 3776 
 3777 static inline void
 3778 rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
 3779 {
 3780         (void)memcpy(ifp->if_xname, dvname, IFNAMSIZ);
 3781         ifp->if_softc = softc;
 3782         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
 3783             IFF_NOTRAILERS;
 3784         ifp->if_ioctl = rtw_ioctl;
 3785         ifp->if_start = rtw_start;
 3786         ifp->if_watchdog = rtw_watchdog;
 3787         ifp->if_init = rtw_init;
 3788         ifp->if_stop = rtw_stop;
 3789 }
 3790 
 3791 static inline void
 3792 rtw_set80211props(struct ieee80211com *ic)
 3793 {
 3794         int nrate;
 3795         ic->ic_phytype = IEEE80211_T_DS;
 3796         ic->ic_opmode = IEEE80211_M_STA;
 3797         ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
 3798             IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
 3799 
 3800         nrate = 0;
 3801         ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
 3802             IEEE80211_RATE_BASIC | 2;
 3803         ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
 3804             IEEE80211_RATE_BASIC | 4;
 3805         ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
 3806         ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
 3807         ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
 3808 }
 3809 
 3810 static inline void
 3811 rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
 3812 {
 3813         mtbl->mt_newstate = ic->ic_newstate;
 3814         ic->ic_newstate = rtw_newstate;
 3815 
 3816         mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
 3817         ic->ic_recv_mgmt = rtw_recv_mgmt;
 3818 
 3819         mtbl->mt_node_free = ic->ic_node_free;
 3820         ic->ic_node_free = rtw_node_free;
 3821 
 3822         mtbl->mt_node_alloc = ic->ic_node_alloc;
 3823         ic->ic_node_alloc = rtw_node_alloc;
 3824 
 3825         ic->ic_crypto.cs_key_delete = rtw_key_delete;
 3826         ic->ic_crypto.cs_key_set = rtw_key_set;
 3827         ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
 3828         ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
 3829 }
 3830 
 3831 static inline void
 3832 rtw_establish_hooks(struct rtw_hooks *hooks, const char *dvname,
 3833     void *arg)
 3834 {
 3835         /*
 3836          * Make sure the interface is shutdown during reboot.
 3837          */
 3838         hooks->rh_shutdown = shutdownhook_establish(rtw_shutdown, arg);
 3839         if (hooks->rh_shutdown == NULL)
 3840                 printf("%s: WARNING: unable to establish shutdown hook\n",
 3841                     dvname);
 3842 
 3843         /*
 3844          * Add a suspend hook to make sure we come back up after a
 3845          * resume.
 3846          */
 3847         hooks->rh_power = powerhook_establish(dvname, rtw_power, arg);
 3848         if (hooks->rh_power == NULL)
 3849                 printf("%s: WARNING: unable to establish power hook\n",
 3850                     dvname);
 3851 }
 3852 
 3853 static inline void
 3854 rtw_disestablish_hooks(struct rtw_hooks *hooks, const char *dvname,
 3855     void *arg)
 3856 {
 3857         if (hooks->rh_shutdown != NULL)
 3858                 shutdownhook_disestablish(hooks->rh_shutdown);
 3859 
 3860         if (hooks->rh_power != NULL)
 3861                 powerhook_disestablish(hooks->rh_power);
 3862 }
 3863 
 3864 static inline void
 3865 rtw_init_radiotap(struct rtw_softc *sc)
 3866 {
 3867         memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
 3868         sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
 3869         sc->sc_rxtap.rr_ihdr.it_present = htole32(RTW_RX_RADIOTAP_PRESENT);
 3870 
 3871         memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
 3872         sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
 3873         sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
 3874 }
 3875 
 3876 static int
 3877 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
 3878 {
 3879         SIMPLEQ_INIT(&tsb->tsb_dirtyq);
 3880         SIMPLEQ_INIT(&tsb->tsb_freeq);
 3881         tsb->tsb_ndesc = qlen;
 3882         tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
 3883             M_NOWAIT);
 3884         if (tsb->tsb_desc == NULL)
 3885                 return ENOMEM;
 3886         return 0;
 3887 }
 3888 
 3889 static void
 3890 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
 3891 {
 3892         int pri;
 3893         struct rtw_txsoft_blk *tsb;
 3894 
 3895         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 3896                 tsb = &sc->sc_txsoft_blk[pri];
 3897                 free(tsb->tsb_desc, M_DEVBUF);
 3898                 tsb->tsb_desc = NULL;
 3899         }
 3900 }
 3901 
 3902 static int
 3903 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
 3904 {
 3905         int pri, rc = 0;
 3906         int qlen[RTW_NTXPRI] =
 3907              {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
 3908         struct rtw_txsoft_blk *tsbs;
 3909 
 3910         tsbs = sc->sc_txsoft_blk;
 3911 
 3912         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 3913                 rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
 3914                 if (rc != 0)
 3915                         break;
 3916         }
 3917         tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
 3918         tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
 3919         tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
 3920         tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
 3921         return rc;
 3922 }
 3923 
 3924 static void
 3925 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
 3926     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
 3927 {
 3928         tdb->tdb_ndesc = ndesc;
 3929         tdb->tdb_desc = desc;
 3930         tdb->tdb_physbase = physbase;
 3931         tdb->tdb_ofs = ofs;
 3932 
 3933         (void)memset(tdb->tdb_desc, 0,
 3934             sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
 3935 
 3936         rtw_txdesc_blk_init(tdb);
 3937         tdb->tdb_next = 0;
 3938 }
 3939 
 3940 static void
 3941 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
 3942 {
 3943         rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
 3944             &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
 3945             RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
 3946 
 3947         rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
 3948             &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
 3949             RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
 3950 
 3951         rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
 3952             &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
 3953             RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
 3954 
 3955         rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
 3956             &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
 3957             RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
 3958 }
 3959 
 3960 static struct rtw_rf *
 3961 rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
 3962 {
 3963         rtw_rf_write_t rf_write;
 3964         struct rtw_rf *rf;
 3965 
 3966         switch (rfchipid) {
 3967         default:
 3968                 rf_write = rtw_rf_hostwrite;
 3969                 break;
 3970         case RTW_RFCHIPID_INTERSIL:
 3971         case RTW_RFCHIPID_PHILIPS:
 3972         case RTW_RFCHIPID_GCT:  /* XXX a guess */
 3973         case RTW_RFCHIPID_RFMD:
 3974                 rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
 3975                 break;
 3976         }
 3977 
 3978         switch (rfchipid) {
 3979         case RTW_RFCHIPID_GCT:
 3980                 rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
 3981                 sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
 3982                 break;
 3983         case RTW_RFCHIPID_MAXIM:
 3984                 rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
 3985                 sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
 3986                 break;
 3987         case RTW_RFCHIPID_PHILIPS:
 3988                 rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
 3989                 sc->sc_pwrstate_cb = rtw_philips_pwrstate;
 3990                 break;
 3991         case RTW_RFCHIPID_RFMD:
 3992                 /* XXX RFMD has no RF constructor */
 3993                 sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
 3994                 /*FALLTHROUGH*/
 3995         default:
 3996                 return NULL;
 3997         }
 3998         rf->rf_continuous_tx_cb =
 3999             (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
 4000         rf->rf_continuous_tx_arg = (void *)sc;
 4001         return rf;
 4002 }
 4003 
 4004 /* Revision C and later use a different PHY delay setting than
 4005  * revisions A and B.
 4006  */
 4007 static uint8_t
 4008 rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
 4009 {
 4010 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
 4011 #define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
 4012 
 4013         uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
 4014 
 4015         RTW_WRITE(regs, RTW_RCR, REVAB);
 4016         RTW_WBW(regs, RTW_RCR, RTW_RCR);
 4017         RTW_WRITE(regs, RTW_RCR, REVC);
 4018 
 4019         RTW_WBR(regs, RTW_RCR, RTW_RCR);
 4020         if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
 4021                 phydelay |= RTW_PHYDELAY_REVC_MAGIC;
 4022 
 4023         RTW_WRITE(regs, RTW_RCR, old_rcr);      /* restore RCR */
 4024         RTW_SYNC(regs, RTW_RCR, RTW_RCR);
 4025 
 4026         return phydelay;
 4027 #undef REVC
 4028 }
 4029 
 4030 void
 4031 rtw_attach(struct rtw_softc *sc)
 4032 {
 4033         struct ifnet *ifp = &sc->sc_if;
 4034         struct ieee80211com *ic = &sc->sc_ic;
 4035         struct rtw_txsoft_blk *tsb;
 4036         int pri, rc;
 4037 
 4038         rtw_cipher_wep = ieee80211_cipher_wep;
 4039         rtw_cipher_wep.ic_decap = rtw_wep_decap;
 4040 
 4041         NEXT_ATTACH_STATE(sc, DETACHED);
 4042 
 4043         switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
 4044         case RTW_TCR_HWVERID_F:
 4045                 sc->sc_hwverid = 'F';
 4046                 break;
 4047         case RTW_TCR_HWVERID_D:
 4048                 sc->sc_hwverid = 'D';
 4049                 break;
 4050         default:
 4051                 sc->sc_hwverid = '?';
 4052                 break;
 4053         }
 4054         printf("%s: hardware version %c\n", sc->sc_dev.dv_xname,
 4055             sc->sc_hwverid);
 4056 
 4057         rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
 4058             RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
 4059             0);
 4060 
 4061         if (rc != 0) {
 4062                 printf("%s: could not allocate hw descriptors, error %d\n",
 4063                      sc->sc_dev.dv_xname, rc);
 4064                 goto err;
 4065         }
 4066 
 4067         NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
 4068 
 4069         rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
 4070             sc->sc_desc_nsegs, sizeof(struct rtw_descs),
 4071             (caddr_t*)&sc->sc_descs, BUS_DMA_COHERENT);
 4072 
 4073         if (rc != 0) {
 4074                 printf("%s: could not map hw descriptors, error %d\n",
 4075                     sc->sc_dev.dv_xname, rc);
 4076                 goto err;
 4077         }
 4078         NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
 4079 
 4080         rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
 4081             sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
 4082 
 4083         if (rc != 0) {
 4084                 printf("%s: could not create DMA map for hw descriptors, "
 4085                     "error %d\n", sc->sc_dev.dv_xname, rc);
 4086                 goto err;
 4087         }
 4088         NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
 4089 
 4090         sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
 4091         sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
 4092 
 4093         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 4094                 sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
 4095                 sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
 4096         }
 4097 
 4098         rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
 4099             sizeof(struct rtw_descs), NULL, 0);
 4100 
 4101         if (rc != 0) {
 4102                 printf("%s: could not load DMA map for hw descriptors, "
 4103                     "error %d\n", sc->sc_dev.dv_xname, rc);
 4104                 goto err;
 4105         }
 4106         NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
 4107 
 4108         if (rtw_txsoft_blk_setup_all(sc) != 0)
 4109                 goto err;
 4110         NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
 4111 
 4112         rtw_txdesc_blk_setup_all(sc);
 4113 
 4114         NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
 4115 
 4116         sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
 4117 
 4118         for (pri = 0; pri < RTW_NTXPRI; pri++) {
 4119                 tsb = &sc->sc_txsoft_blk[pri];
 4120 
 4121                 if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
 4122                     &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
 4123                         printf("%s: could not load DMA map for "
 4124                             "hw tx descriptors, error %d\n",
 4125                             sc->sc_dev.dv_xname, rc);
 4126                         goto err;
 4127                 }
 4128         }
 4129 
 4130         NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
 4131         if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
 4132                                             RTW_RXQLEN)) != 0) {
 4133                 printf("%s: could not load DMA map for hw rx descriptors, "
 4134                     "error %d\n", sc->sc_dev.dv_xname, rc);
 4135                 goto err;
 4136         }
 4137         NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
 4138 
 4139         /* Reset the chip to a known state. */
 4140         if (rtw_reset(sc) != 0)
 4141                 goto err;
 4142         NEXT_ATTACH_STATE(sc, FINISH_RESET);
 4143 
 4144         sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
 4145 
 4146         if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
 4147                 sc->sc_flags |= RTW_F_9356SROM;
 4148 
 4149         if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
 4150             sc->sc_dev.dv_xname) != 0)
 4151                 goto err;
 4152 
 4153         NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
 4154 
 4155         if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
 4156             &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
 4157             sc->sc_dev.dv_xname) != 0) {
 4158                 printf("%s: attach failed, malformed serial ROM\n",
 4159                     sc->sc_dev.dv_xname);
 4160                 goto err;
 4161         }
 4162 
 4163         printf("%s: %s PHY\n", sc->sc_dev.dv_xname,
 4164             ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
 4165 
 4166         printf("%s: CS threshold %u\n", sc->sc_dev.dv_xname, sc->sc_csthr);
 4167 
 4168         NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
 4169 
 4170         sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
 4171             sc->sc_flags & RTW_F_DIGPHY);
 4172 
 4173         if (sc->sc_rf == NULL) {
 4174                 printf("%s: attach failed, could not attach RF\n",
 4175                     sc->sc_dev.dv_xname);
 4176                 goto err;
 4177         }
 4178 
 4179         NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
 4180 
 4181         sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
 4182 
 4183         RTW_DPRINTF(RTW_DEBUG_ATTACH,
 4184             ("%s: PHY delay %d\n", sc->sc_dev.dv_xname, sc->sc_phydelay));
 4185 
 4186         if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
 4187                 rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
 4188 
 4189         rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels,
 4190             sc->sc_dev.dv_xname);
 4191 
 4192         if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
 4193             sc->sc_dev.dv_xname) != 0)
 4194                 goto err;
 4195         NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
 4196 
 4197         rtw_setifprops(ifp, sc->sc_dev.dv_xname, (void*)sc);
 4198 
 4199         IFQ_SET_READY(&ifp->if_snd);
 4200 
 4201         sc->sc_ic.ic_ifp = ifp;
 4202         rtw_set80211props(&sc->sc_ic);
 4203 
 4204         rtw_led_attach(&sc->sc_led_state, (void *)sc);
 4205 
 4206         /*
 4207          * Call MI attach routines.
 4208          */
 4209         if_attach(ifp);
 4210         ieee80211_ifattach(&sc->sc_ic);
 4211 
 4212         rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
 4213 
 4214         /* possibly we should fill in our own sc_send_prresp, since
 4215          * the RTL8180 is probably sending probe responses in ad hoc
 4216          * mode.
 4217          */
 4218 
 4219         /* complete initialization */
 4220         ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
 4221         callout_init(&sc->sc_scan_ch);
 4222 
 4223         rtw_init_radiotap(sc);
 4224 
 4225 #if NBPFILTER > 0
 4226         bpfattach2(ifp, DLT_IEEE802_11_RADIO,
 4227             sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
 4228 #endif
 4229 
 4230         rtw_establish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname, (void*)sc);
 4231 
 4232         NEXT_ATTACH_STATE(sc, FINISHED);
 4233 
 4234         ieee80211_announce(ic);
 4235         return;
 4236 err:
 4237         rtw_detach(sc);
 4238         return;
 4239 }
 4240 
 4241 int
 4242 rtw_detach(struct rtw_softc *sc)
 4243 {
 4244         struct ifnet *ifp = &sc->sc_if;
 4245         int pri;
 4246 
 4247         sc->sc_flags |= RTW_F_INVALID;
 4248 
 4249         switch (sc->sc_attach_state) {
 4250         case FINISHED:
 4251                 rtw_stop(ifp, 1);
 4252 
 4253                 rtw_disestablish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname,
 4254                     (void*)sc);
 4255                 callout_stop(&sc->sc_scan_ch);
 4256                 ieee80211_ifdetach(&sc->sc_ic);
 4257                 if_detach(ifp);
 4258                 break;
 4259         case FINISH_ID_STA:
 4260         case FINISH_RF_ATTACH:
 4261                 rtw_rf_destroy(sc->sc_rf);
 4262                 sc->sc_rf = NULL;
 4263                 /*FALLTHROUGH*/
 4264         case FINISH_PARSE_SROM:
 4265         case FINISH_READ_SROM:
 4266                 rtw_srom_free(&sc->sc_srom);
 4267                 /*FALLTHROUGH*/
 4268         case FINISH_RESET:
 4269         case FINISH_RXMAPS_CREATE:
 4270                 rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
 4271                     RTW_RXQLEN);
 4272                 /*FALLTHROUGH*/
 4273         case FINISH_TXMAPS_CREATE:
 4274                 for (pri = 0; pri < RTW_NTXPRI; pri++) {
 4275                         rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
 4276                             sc->sc_txsoft_blk[pri].tsb_desc,
 4277                             sc->sc_txsoft_blk[pri].tsb_ndesc);
 4278                 }
 4279                 /*FALLTHROUGH*/
 4280         case FINISH_TXDESCBLK_SETUP:
 4281         case FINISH_TXCTLBLK_SETUP:
 4282                 rtw_txsoft_blk_cleanup_all(sc);
 4283                 /*FALLTHROUGH*/
 4284         case FINISH_DESCMAP_LOAD:
 4285                 bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
 4286                 /*FALLTHROUGH*/
 4287         case FINISH_DESCMAP_CREATE:
 4288                 bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
 4289                 /*FALLTHROUGH*/
 4290         case FINISH_DESC_MAP:
 4291                 bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_descs,
 4292                     sizeof(struct rtw_descs));
 4293                 /*FALLTHROUGH*/
 4294         case FINISH_DESC_ALLOC:
 4295                 bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
 4296                     sc->sc_desc_nsegs);
 4297                 /*FALLTHROUGH*/
 4298         case DETACHED:
 4299                 NEXT_ATTACH_STATE(sc, DETACHED);
 4300                 break;
 4301         }
 4302         return 0;
 4303 }
 4304 
 4305 int
 4306 rtw_activate(struct device *self, enum devact act)
 4307 {
 4308         struct rtw_softc *sc = (struct rtw_softc *)self;
 4309         int rc = 0, s;
 4310 
 4311         s = splnet();
 4312         switch (act) {
 4313         case DVACT_ACTIVATE:
 4314                 rc = EOPNOTSUPP;
 4315                 break;
 4316 
 4317         case DVACT_DEACTIVATE:
 4318                 if_deactivate(&sc->sc_if);
 4319                 break;
 4320         }
 4321         splx(s);
 4322         return rc;
 4323 }

Cache object: a07f225c5a3b8ef91af500b89f75a64e


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.