atw.c revision 1.70
1/*	$NetBSD: atw.c,v 1.70 2004/07/23 07:20:44 dyoung Exp $	*/
2
3/*-
4 * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 *    must display the following acknowledgement:
20 *	This product includes software developed by the NetBSD
21 *	Foundation, Inc. and its contributors.
22 * 4. Neither the name of The NetBSD Foundation nor the names of its
23 *    contributors may be used to endorse or promote products derived
24 *    from this software without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36 * POSSIBILITY OF SUCH DAMAGE.
37 */
38
39/*
40 * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
41 */
42
43#include <sys/cdefs.h>
44__KERNEL_RCSID(0, "$NetBSD: atw.c,v 1.70 2004/07/23 07:20:44 dyoung Exp $");
45
46#include "bpfilter.h"
47
48#include <sys/param.h>
49#include <sys/systm.h>
50#include <sys/callout.h>
51#include <sys/mbuf.h>
52#include <sys/malloc.h>
53#include <sys/kernel.h>
54#include <sys/socket.h>
55#include <sys/ioctl.h>
56#include <sys/errno.h>
57#include <sys/device.h>
58#include <sys/time.h>
59
60#include <machine/endian.h>
61
62#include <uvm/uvm_extern.h>
63
64#include <net/if.h>
65#include <net/if_dl.h>
66#include <net/if_media.h>
67#include <net/if_ether.h>
68
69#include <net80211/ieee80211_var.h>
70#include <net80211/ieee80211_compat.h>
71#include <net80211/ieee80211_radiotap.h>
72
73#if NBPFILTER > 0
74#include <net/bpf.h>
75#endif
76
77#include <machine/bus.h>
78#include <machine/intr.h>
79
80#include <dev/ic/atwreg.h>
81#include <dev/ic/rf3000reg.h>
82#include <dev/ic/si4136reg.h>
83#include <dev/ic/atwvar.h>
84#include <dev/ic/smc93cx6var.h>
85
86/* XXX TBD open questions
87 *
88 *
89 * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
90 * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
91 * handle this for me?
92 *
93 */
94/* device attachment
95 *
96 *    print TOFS[012]
97 *
98 * device initialization
99 *
100 *    clear ATW_FRCTL_MAXPSP to disable max power saving
101 *    set ATW_TXBR_ALCUPDATE to enable ALC
102 *    set TOFS[012]? (hope not)
103 *    disable rx/tx
104 *    set ATW_PAR_SWR (software reset)
105 *    wait for ATW_PAR_SWR clear
106 *    disable interrupts
107 *    ack status register
108 *    enable interrupts
109 *
110 * rx/tx initialization
111 *
112 *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
113 *    allocate and init descriptor rings
114 *    write ATW_PAR_DSL (descriptor skip length)
115 *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
116 *    write ATW_NAR_SQ for one/both transmit descriptor rings
117 *    write ATW_NAR_SQ for one/both transmit descriptor rings
118 *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
119 *
120 * rx/tx end
121 *
122 *    stop DMA
123 *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
124 *    flush tx w/ ATW_NAR_HF
125 *
126 * scan
127 *
128 *    initialize rx/tx
129 *
130 * BSS join: (re)association response
131 *
132 *    set ATW_FRCTL_AID
133 *
134 * optimizations ???
135 *
136 */
137
138#define ATW_REFSLAVE	/* slavishly do what the reference driver does */
139
140#define	VOODOO_DUR_11_ROUNDING		0x01 /* necessary */
141#define	VOODOO_DUR_2_4_SPECIALCASE	0x02 /* NOT necessary */
142int atw_voodoo = VOODOO_DUR_11_ROUNDING;
143
144int atw_pseudo_milli = 1;
145int atw_magic_delay1 = 100 * 1000;
146int atw_magic_delay2 = 100 * 1000;
147/* more magic multi-millisecond delays (units: microseconds) */
148int atw_nar_delay = 20 * 1000;
149int atw_magic_delay4 = 10 * 1000;
150int atw_rf_delay1 = 10 * 1000;
151int atw_rf_delay2 = 5 * 1000;
152int atw_plcphd_delay = 2 * 1000;
153int atw_bbp_io_enable_delay = 20 * 1000;
154int atw_bbp_io_disable_delay = 2 * 1000;
155int atw_writewep_delay = 1000;
156int atw_beacon_len_adjust = 4;
157int atw_dwelltime = 200;
158int atw_xindiv2 = 0;
159
160#ifdef ATW_DEBUG
161int atw_debug = 0;
162
163#define ATW_DPRINTF(x)	if (atw_debug > 0) printf x
164#define ATW_DPRINTF2(x)	if (atw_debug > 1) printf x
165#define ATW_DPRINTF3(x)	if (atw_debug > 2) printf x
166#define	DPRINTF(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) printf x
167#define	DPRINTF2(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
168#define	DPRINTF3(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
169
170static void atw_print_regs(struct atw_softc *, const char *);
171static void atw_dump_pkt(struct ifnet *, struct mbuf *);
172
173/* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
174#	ifdef ATW_BBPDEBUG
175static int atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
176static void atw_rf3000_print(struct atw_softc *);
177#	endif /* ATW_BBPDEBUG */
178
179#	ifdef ATW_SYNDEBUG
180static int atw_si4126_read(struct atw_softc *, u_int, u_int *);
181static void atw_si4126_print(struct atw_softc *);
182#	endif /* ATW_SYNDEBUG */
183
184#else
185#define ATW_DPRINTF(x)
186#define ATW_DPRINTF2(x)
187#define ATW_DPRINTF3(x)
188#define	DPRINTF(sc, x)	/* nothing */
189#define	DPRINTF2(sc, x)	/* nothing */
190#define	DPRINTF3(sc, x)	/* nothing */
191#endif
192
193/* ifnet methods */
194void	atw_start(struct ifnet *);
195void	atw_watchdog(struct ifnet *);
196int	atw_ioctl(struct ifnet *, u_long, caddr_t);
197int	atw_init(struct ifnet *);
198void	atw_stop(struct ifnet *, int);
199
200/* Device attachment */
201void	atw_attach(struct atw_softc *);
202int	atw_detach(struct atw_softc *);
203
204/* Rx/Tx process */
205void	atw_rxdrain(struct atw_softc *);
206void	atw_txdrain(struct atw_softc *);
207int	atw_add_rxbuf(struct atw_softc *, int);
208void	atw_idle(struct atw_softc *, u_int32_t);
209
210/* Device (de)activation and power state */
211int	atw_enable(struct atw_softc *);
212void	atw_disable(struct atw_softc *);
213void	atw_power(int, void *);
214void	atw_shutdown(void *);
215void	atw_reset(struct atw_softc *);
216
217/* Interrupt handlers */
218void	atw_rxintr(struct atw_softc *);
219void	atw_txintr(struct atw_softc *);
220void	atw_linkintr(struct atw_softc *, u_int32_t);
221
222/* 802.11 state machine */
223static int	atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
224static int	atw_tune(struct atw_softc *);
225static void	atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
226		              struct ieee80211_node *, int, int, u_int32_t);
227
228/* Device initialization */
229static void	atw_wcsr_init(struct atw_softc *);
230static void	atw_cmdr_init(struct atw_softc *);
231static void	atw_tofs2_init(struct atw_softc *);
232static void	atw_txlmt_init(struct atw_softc *);
233static void	atw_test1_init(struct atw_softc *);
234static void	atw_rf_reset(struct atw_softc *);
235static void	atw_cfp_init(struct atw_softc *);
236static void	atw_tofs0_init(struct atw_softc *);
237static void	atw_ifs_init(struct atw_softc *);
238static void	atw_response_times_init(struct atw_softc *);
239static void	atw_bbp_io_init(struct atw_softc *);
240
241/* RAM/ROM utilities */
242static void	atw_clear_sram(struct atw_softc *);
243static void	atw_write_sram(struct atw_softc *, u_int, u_int8_t *, u_int);
244static int	atw_read_srom(struct atw_softc *);
245
246/* BSS setup */
247static void	atw_tsf(struct atw_softc *);
248static void	atw_start_beacon(struct atw_softc *, int);
249static void	atw_write_bssid(struct atw_softc *);
250static void	atw_write_ssid(struct atw_softc *);
251static void	atw_write_sup_rates(struct atw_softc *);
252static void	atw_write_wep(struct atw_softc *);
253
254/* Media */
255static int	atw_media_change(struct ifnet *);
256static void	atw_media_status(struct ifnet *, struct ifmediareq *);
257
258static void	atw_filter_setup(struct atw_softc *);
259
260/* 802.11 utilities */
261static void	atw_frame_setdurs(struct atw_softc *,
262		                  struct atw_frame *, int, int);
263static struct ieee80211_node	*atw_node_alloc(struct ieee80211com *);
264static void	atw_node_free(struct ieee80211com *,
265		              struct ieee80211_node *);
266static void	atw_recv_beacon(struct ieee80211com *, struct mbuf *,
267		                struct ieee80211_node *, int, int,
268		                u_int32_t);
269static __inline uint32_t	atw_last_even_tsft(uint32_t, uint32_t,
270				                   uint32_t);
271static __inline void		atw_tsft(struct atw_softc *, uint32_t *,
272				         uint32_t *);
273
274/*
275 * Tuner/transceiver/modem
276 */
277static void	atw_bbp_io_enable(struct atw_softc *, int);
278
279/* RFMD RF3000 Baseband Processor */
280static int atw_rf3000_init(struct atw_softc *);
281static int atw_rf3000_tune(struct atw_softc *, u_int);
282static int atw_rf3000_write(struct atw_softc *, u_int, u_int);
283
284/* Silicon Laboratories Si4126 RF/IF Synthesizer */
285static void atw_si4126_tune(struct atw_softc *, u_int);
286static void atw_si4126_write(struct atw_softc *, u_int, u_int);
287
288const struct atw_txthresh_tab atw_txthresh_tab_lo[] = ATW_TXTHRESH_TAB_LO_RATE;
289const struct atw_txthresh_tab atw_txthresh_tab_hi[] = ATW_TXTHRESH_TAB_HI_RATE;
290
291const char *atw_tx_state[] = {
292	"STOPPED",
293	"RUNNING - read descriptor",
294	"RUNNING - transmitting",
295	"RUNNING - filling fifo",	/* XXX */
296	"SUSPENDED",
297	"RUNNING -- write descriptor",
298	"RUNNING -- write last descriptor",
299	"RUNNING - fifo full"
300};
301
302const char *atw_rx_state[] = {
303	"STOPPED",
304	"RUNNING - read descriptor",
305	"RUNNING - check this packet, pre-fetch next",
306	"RUNNING - wait for reception",
307	"SUSPENDED",
308	"RUNNING - write descriptor",
309	"RUNNING - flush fifo",
310	"RUNNING - fifo drain"
311};
312
313int
314atw_activate(struct device *self, enum devact act)
315{
316	struct atw_softc *sc = (struct atw_softc *)self;
317	int rv = 0, s;
318
319	s = splnet();
320	switch (act) {
321	case DVACT_ACTIVATE:
322		rv = EOPNOTSUPP;
323		break;
324
325	case DVACT_DEACTIVATE:
326		if_deactivate(&sc->sc_ic.ic_if);
327		break;
328	}
329	splx(s);
330	return rv;
331}
332
333/*
334 * atw_enable:
335 *
336 *	Enable the ADM8211 chip.
337 */
338int
339atw_enable(struct atw_softc *sc)
340{
341
342	if (ATW_IS_ENABLED(sc) == 0) {
343		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
344			printf("%s: device enable failed\n",
345			    sc->sc_dev.dv_xname);
346			return (EIO);
347		}
348		sc->sc_flags |= ATWF_ENABLED;
349	}
350	return (0);
351}
352
353/*
354 * atw_disable:
355 *
356 *	Disable the ADM8211 chip.
357 */
358void
359atw_disable(struct atw_softc *sc)
360{
361	if (!ATW_IS_ENABLED(sc))
362		return;
363	if (sc->sc_disable != NULL)
364		(*sc->sc_disable)(sc);
365	sc->sc_flags &= ~ATWF_ENABLED;
366}
367
368/* Returns -1 on failure. */
369static int
370atw_read_srom(struct atw_softc *sc)
371{
372	struct seeprom_descriptor sd;
373	uint32_t test0, fail_bits;
374
375	(void)memset(&sd, 0, sizeof(sd));
376
377	test0 = ATW_READ(sc, ATW_TEST0);
378
379	switch (sc->sc_rev) {
380	case ATW_REVISION_BA:
381	case ATW_REVISION_CA:
382		fail_bits = ATW_TEST0_EPNE;
383		break;
384	default:
385		fail_bits = ATW_TEST0_EPNE|ATW_TEST0_EPSNM;
386		break;
387	}
388	if ((test0 & fail_bits) != 0) {
389		printf("%s: bad or missing/bad SROM\n", sc->sc_dev.dv_xname);
390		return -1;
391	}
392
393	switch (test0 & ATW_TEST0_EPTYP_MASK) {
394	case ATW_TEST0_EPTYP_93c66:
395		ATW_DPRINTF(("%s: 93c66 SROM\n", sc->sc_dev.dv_xname));
396		sc->sc_sromsz = 512;
397		sd.sd_chip = C56_66;
398		break;
399	case ATW_TEST0_EPTYP_93c46:
400		ATW_DPRINTF(("%s: 93c46 SROM\n", sc->sc_dev.dv_xname));
401		sc->sc_sromsz = 128;
402		sd.sd_chip = C46;
403		break;
404	default:
405		printf("%s: unknown SROM type %d\n", sc->sc_dev.dv_xname,
406		    MASK_AND_RSHIFT(test0, ATW_TEST0_EPTYP_MASK));
407		return -1;
408	}
409
410	sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_NOWAIT);
411
412	if (sc->sc_srom == NULL) {
413		printf("%s: unable to allocate SROM buffer\n",
414		    sc->sc_dev.dv_xname);
415		return -1;
416	}
417
418	(void)memset(sc->sc_srom, 0, sc->sc_sromsz);
419
420	/* ADM8211 has a single 32-bit register for controlling the
421	 * 93cx6 SROM.  Bit SRS enables the serial port. There is no
422	 * "ready" bit. The ADM8211 input/output sense is the reverse
423	 * of read_seeprom's.
424	 */
425	sd.sd_tag = sc->sc_st;
426	sd.sd_bsh = sc->sc_sh;
427	sd.sd_regsize = 4;
428	sd.sd_control_offset = ATW_SPR;
429	sd.sd_status_offset = ATW_SPR;
430	sd.sd_dataout_offset = ATW_SPR;
431	sd.sd_CK = ATW_SPR_SCLK;
432	sd.sd_CS = ATW_SPR_SCS;
433	sd.sd_DI = ATW_SPR_SDO;
434	sd.sd_DO = ATW_SPR_SDI;
435	sd.sd_MS = ATW_SPR_SRS;
436	sd.sd_RDY = 0;
437
438	if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
439		printf("%s: could not read SROM\n", sc->sc_dev.dv_xname);
440		free(sc->sc_srom, M_DEVBUF);
441		return -1;
442	}
443#ifdef ATW_DEBUG
444	{
445		int i;
446		ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
447		for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
448			if (((i % 8) == 0) && (i != 0)) {
449				ATW_DPRINTF(("\n\t"));
450			}
451			ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
452		}
453		ATW_DPRINTF(("\n"));
454	}
455#endif /* ATW_DEBUG */
456	return 0;
457}
458
459#ifdef ATW_DEBUG
460static void
461atw_print_regs(struct atw_softc *sc, const char *where)
462{
463#define PRINTREG(sc, reg) \
464	ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
465	    sc->sc_dev.dv_xname, reg, ATW_READ(sc, reg)))
466
467	ATW_DPRINTF2(("%s: %s\n", sc->sc_dev.dv_xname, where));
468
469	PRINTREG(sc, ATW_PAR);
470	PRINTREG(sc, ATW_FRCTL);
471	PRINTREG(sc, ATW_TDR);
472	PRINTREG(sc, ATW_WTDP);
473	PRINTREG(sc, ATW_RDR);
474	PRINTREG(sc, ATW_WRDP);
475	PRINTREG(sc, ATW_RDB);
476	PRINTREG(sc, ATW_CSR3A);
477	PRINTREG(sc, ATW_TDBD);
478	PRINTREG(sc, ATW_TDBP);
479	PRINTREG(sc, ATW_STSR);
480	PRINTREG(sc, ATW_CSR5A);
481	PRINTREG(sc, ATW_NAR);
482	PRINTREG(sc, ATW_CSR6A);
483	PRINTREG(sc, ATW_IER);
484	PRINTREG(sc, ATW_CSR7A);
485	PRINTREG(sc, ATW_LPC);
486	PRINTREG(sc, ATW_TEST1);
487	PRINTREG(sc, ATW_SPR);
488	PRINTREG(sc, ATW_TEST0);
489	PRINTREG(sc, ATW_WCSR);
490	PRINTREG(sc, ATW_WPDR);
491	PRINTREG(sc, ATW_GPTMR);
492	PRINTREG(sc, ATW_GPIO);
493	PRINTREG(sc, ATW_BBPCTL);
494	PRINTREG(sc, ATW_SYNCTL);
495	PRINTREG(sc, ATW_PLCPHD);
496	PRINTREG(sc, ATW_MMIWADDR);
497	PRINTREG(sc, ATW_MMIRADDR1);
498	PRINTREG(sc, ATW_MMIRADDR2);
499	PRINTREG(sc, ATW_TXBR);
500	PRINTREG(sc, ATW_CSR15A);
501	PRINTREG(sc, ATW_ALCSTAT);
502	PRINTREG(sc, ATW_TOFS2);
503	PRINTREG(sc, ATW_CMDR);
504	PRINTREG(sc, ATW_PCIC);
505	PRINTREG(sc, ATW_PMCSR);
506	PRINTREG(sc, ATW_PAR0);
507	PRINTREG(sc, ATW_PAR1);
508	PRINTREG(sc, ATW_MAR0);
509	PRINTREG(sc, ATW_MAR1);
510	PRINTREG(sc, ATW_ATIMDA0);
511	PRINTREG(sc, ATW_ABDA1);
512	PRINTREG(sc, ATW_BSSID0);
513	PRINTREG(sc, ATW_TXLMT);
514	PRINTREG(sc, ATW_MIBCNT);
515	PRINTREG(sc, ATW_BCNT);
516	PRINTREG(sc, ATW_TSFTH);
517	PRINTREG(sc, ATW_TSC);
518	PRINTREG(sc, ATW_SYNRF);
519	PRINTREG(sc, ATW_BPLI);
520	PRINTREG(sc, ATW_CAP0);
521	PRINTREG(sc, ATW_CAP1);
522	PRINTREG(sc, ATW_RMD);
523	PRINTREG(sc, ATW_CFPP);
524	PRINTREG(sc, ATW_TOFS0);
525	PRINTREG(sc, ATW_TOFS1);
526	PRINTREG(sc, ATW_IFST);
527	PRINTREG(sc, ATW_RSPT);
528	PRINTREG(sc, ATW_TSFTL);
529	PRINTREG(sc, ATW_WEPCTL);
530	PRINTREG(sc, ATW_WESK);
531	PRINTREG(sc, ATW_WEPCNT);
532	PRINTREG(sc, ATW_MACTEST);
533	PRINTREG(sc, ATW_FER);
534	PRINTREG(sc, ATW_FEMR);
535	PRINTREG(sc, ATW_FPSR);
536	PRINTREG(sc, ATW_FFER);
537#undef PRINTREG
538}
539#endif /* ATW_DEBUG */
540
541/*
542 * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
543 */
544void
545atw_attach(struct atw_softc *sc)
546{
547	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
548		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
549	};
550	struct ieee80211com *ic = &sc->sc_ic;
551	struct ifnet *ifp = &ic->ic_if;
552	int country_code, error, i, nrate, srom_major;
553	u_int32_t reg;
554	static const char *type_strings[] = {"Intersil (not supported)",
555	    "RFMD", "Marvel (not supported)"};
556
557	sc->sc_txth = atw_txthresh_tab_lo;
558
559	SIMPLEQ_INIT(&sc->sc_txfreeq);
560	SIMPLEQ_INIT(&sc->sc_txdirtyq);
561
562#ifdef ATW_DEBUG
563	atw_print_regs(sc, "atw_attach");
564#endif /* ATW_DEBUG */
565
566	/*
567	 * Allocate the control data structures, and create and load the
568	 * DMA map for it.
569	 */
570	if ((error = bus_dmamem_alloc(sc->sc_dmat,
571	    sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
572	    1, &sc->sc_cdnseg, 0)) != 0) {
573		printf("%s: unable to allocate control data, error = %d\n",
574		    sc->sc_dev.dv_xname, error);
575		goto fail_0;
576	}
577
578	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
579	    sizeof(struct atw_control_data), (caddr_t *)&sc->sc_control_data,
580	    BUS_DMA_COHERENT)) != 0) {
581		printf("%s: unable to map control data, error = %d\n",
582		    sc->sc_dev.dv_xname, error);
583		goto fail_1;
584	}
585
586	if ((error = bus_dmamap_create(sc->sc_dmat,
587	    sizeof(struct atw_control_data), 1,
588	    sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
589		printf("%s: unable to create control data DMA map, "
590		    "error = %d\n", sc->sc_dev.dv_xname, error);
591		goto fail_2;
592	}
593
594	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
595	    sc->sc_control_data, sizeof(struct atw_control_data), NULL,
596	    0)) != 0) {
597		printf("%s: unable to load control data DMA map, error = %d\n",
598		    sc->sc_dev.dv_xname, error);
599		goto fail_3;
600	}
601
602	/*
603	 * Create the transmit buffer DMA maps.
604	 */
605	sc->sc_ntxsegs = ATW_NTXSEGS;
606	for (i = 0; i < ATW_TXQUEUELEN; i++) {
607		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
608		    sc->sc_ntxsegs, MCLBYTES, 0, 0,
609		    &sc->sc_txsoft[i].txs_dmamap)) != 0) {
610			printf("%s: unable to create tx DMA map %d, "
611			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
612			goto fail_4;
613		}
614	}
615
616	/*
617	 * Create the receive buffer DMA maps.
618	 */
619	for (i = 0; i < ATW_NRXDESC; i++) {
620		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
621		    MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
622			printf("%s: unable to create rx DMA map %d, "
623			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
624			goto fail_5;
625		}
626	}
627	for (i = 0; i < ATW_NRXDESC; i++) {
628		sc->sc_rxsoft[i].rxs_mbuf = NULL;
629	}
630
631	switch (sc->sc_rev) {
632	case ATW_REVISION_AB:
633	case ATW_REVISION_AF:
634		sc->sc_sramlen = ATW_SRAM_A_SIZE;
635		break;
636	case ATW_REVISION_BA:
637	case ATW_REVISION_CA:
638		sc->sc_sramlen = ATW_SRAM_B_SIZE;
639		break;
640	}
641
642	/* Reset the chip to a known state. */
643	atw_reset(sc);
644
645	if (atw_read_srom(sc) == -1)
646		return;
647
648	sc->sc_rftype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
649	    ATW_SR_RFTYPE_MASK);
650
651	sc->sc_bbptype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
652	    ATW_SR_BBPTYPE_MASK);
653
654	if (sc->sc_rftype > sizeof(type_strings)/sizeof(type_strings[0])) {
655		printf("%s: unknown RF\n", sc->sc_dev.dv_xname);
656		return;
657	}
658	if (sc->sc_bbptype > sizeof(type_strings)/sizeof(type_strings[0])) {
659		printf("%s: unknown BBP\n", sc->sc_dev.dv_xname);
660		return;
661	}
662
663	printf("%s: %s RF, %s BBP", sc->sc_dev.dv_xname,
664	    type_strings[sc->sc_rftype], type_strings[sc->sc_bbptype]);
665
666	/* XXX There exists a Linux driver which seems to use RFType = 0 for
667	 * MARVEL. My bug, or theirs?
668	 */
669
670	reg = LSHIFT(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
671
672	switch (sc->sc_rftype) {
673	case ATW_RFTYPE_INTERSIL:
674		reg |= ATW_SYNCTL_CS1;
675		break;
676	case ATW_RFTYPE_RFMD:
677		reg |= ATW_SYNCTL_CS0;
678		break;
679	case ATW_RFTYPE_MARVEL:
680		break;
681	}
682
683	sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
684	sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
685
686	reg = LSHIFT(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
687
688	switch (sc->sc_bbptype) {
689	case ATW_BBPTYPE_INTERSIL:
690		reg |= ATW_BBPCTL_TWI;
691		break;
692	case ATW_BBPTYPE_RFMD:
693		reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
694		    ATW_BBPCTL_CCA_ACTLO;
695		break;
696	case ATW_BBPTYPE_MARVEL:
697		break;
698	case ATW_C_BBPTYPE_RFMD:
699		printf("%s: ADM8211C MAC/RFMD BBP not supported yet.\n",
700		    sc->sc_dev.dv_xname);
701		break;
702	}
703
704	sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
705	sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
706
707	/*
708	 * From this point forward, the attachment cannot fail.  A failure
709	 * before this point releases all resources that may have been
710	 * allocated.
711	 */
712	sc->sc_flags |= ATWF_ATTACHED /* | ATWF_RTSCTS */;
713
714	ATW_DPRINTF((" SROM MAC %04x%04x%04x",
715	    htole16(sc->sc_srom[ATW_SR_MAC00]),
716	    htole16(sc->sc_srom[ATW_SR_MAC01]),
717	    htole16(sc->sc_srom[ATW_SR_MAC10])));
718
719	srom_major = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
720	    ATW_SR_MAJOR_MASK);
721
722	if (srom_major < 2)
723		sc->sc_rf3000_options1 = 0;
724	else if (sc->sc_rev == ATW_REVISION_BA) {
725		sc->sc_rf3000_options1 =
726		    MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CR28_CR03],
727		    ATW_SR_CR28_MASK);
728	} else
729		sc->sc_rf3000_options1 = 0;
730
731	sc->sc_rf3000_options2 = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
732	    ATW_SR_CR29_MASK);
733
734	country_code = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
735	    ATW_SR_CTRY_MASK);
736
737#define ADD_CHANNEL(_ic, _chan) do {					\
738	_ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;		\
739	_ic->ic_channels[_chan].ic_freq =				\
740	    ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
741} while (0)
742
743	/* Find available channels */
744	switch (country_code) {
745	case COUNTRY_MMK2:	/* 1-14 */
746		ADD_CHANNEL(ic, 14);
747		/*FALLTHROUGH*/
748	case COUNTRY_ETSI:	/* 1-13 */
749		for (i = 1; i <= 13; i++)
750			ADD_CHANNEL(ic, i);
751		break;
752	case COUNTRY_FCC:	/* 1-11 */
753	case COUNTRY_IC:	/* 1-11 */
754		for (i = 1; i <= 11; i++)
755			ADD_CHANNEL(ic, i);
756		break;
757	case COUNTRY_MMK:	/* 14 */
758		ADD_CHANNEL(ic, 14);
759		break;
760	case COUNTRY_FRANCE:	/* 10-13 */
761		for (i = 10; i <= 13; i++)
762			ADD_CHANNEL(ic, i);
763		break;
764	default:	/* assume channels 10-11 */
765	case COUNTRY_SPAIN:	/* 10-11 */
766		for (i = 10; i <= 11; i++)
767			ADD_CHANNEL(ic, i);
768		break;
769	}
770
771	/* Read the MAC address. */
772	reg = ATW_READ(sc, ATW_PAR0);
773	ic->ic_myaddr[0] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB0_MASK);
774	ic->ic_myaddr[1] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB1_MASK);
775	ic->ic_myaddr[2] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB2_MASK);
776	ic->ic_myaddr[3] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB3_MASK);
777	reg = ATW_READ(sc, ATW_PAR1);
778	ic->ic_myaddr[4] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB4_MASK);
779	ic->ic_myaddr[5] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB5_MASK);
780
781	if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
782		printf(" could not get mac address, attach failed\n");
783		return;
784	}
785
786	printf(" 802.11 address %s\n", ether_sprintf(ic->ic_myaddr));
787
788	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
789	ifp->if_softc = sc;
790	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
791	    IFF_NOTRAILERS;
792	ifp->if_ioctl = atw_ioctl;
793	ifp->if_start = atw_start;
794	ifp->if_watchdog = atw_watchdog;
795	ifp->if_init = atw_init;
796	ifp->if_stop = atw_stop;
797	IFQ_SET_READY(&ifp->if_snd);
798
799	ic->ic_phytype = IEEE80211_T_DS;
800	ic->ic_opmode = IEEE80211_M_STA;
801	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
802	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
803
804	nrate = 0;
805	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 2;
806	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 4;
807	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
808	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
809	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
810
811	/*
812	 * Call MI attach routines.
813	 */
814
815	if_attach(ifp);
816	ieee80211_ifattach(ifp);
817
818	sc->sc_newstate = ic->ic_newstate;
819	ic->ic_newstate = atw_newstate;
820
821	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
822	ic->ic_recv_mgmt = atw_recv_mgmt;
823
824	sc->sc_node_free = ic->ic_node_free;
825	ic->ic_node_free = atw_node_free;
826
827	sc->sc_node_alloc = ic->ic_node_alloc;
828	ic->ic_node_alloc = atw_node_alloc;
829
830	/* possibly we should fill in our own sc_send_prresp, since
831	 * the ADM8211 is probably sending probe responses in ad hoc
832	 * mode.
833	 */
834
835	/* complete initialization */
836	ieee80211_media_init(ifp, atw_media_change, atw_media_status);
837	callout_init(&sc->sc_scan_ch);
838
839#if NBPFILTER > 0
840	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
841	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
842#endif
843
844	/*
845	 * Make sure the interface is shutdown during reboot.
846	 */
847	sc->sc_sdhook = shutdownhook_establish(atw_shutdown, sc);
848	if (sc->sc_sdhook == NULL)
849		printf("%s: WARNING: unable to establish shutdown hook\n",
850		    sc->sc_dev.dv_xname);
851
852	/*
853	 * Add a suspend hook to make sure we come back up after a
854	 * resume.
855	 */
856	sc->sc_powerhook = powerhook_establish(atw_power, sc);
857	if (sc->sc_powerhook == NULL)
858		printf("%s: WARNING: unable to establish power hook\n",
859		    sc->sc_dev.dv_xname);
860
861	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
862	sc->sc_rxtap.ar_ihdr.it_len = sizeof(sc->sc_rxtapu);
863	sc->sc_rxtap.ar_ihdr.it_present = ATW_RX_RADIOTAP_PRESENT;
864
865	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
866	sc->sc_txtap.at_ihdr.it_len = sizeof(sc->sc_txtapu);
867	sc->sc_txtap.at_ihdr.it_present = ATW_TX_RADIOTAP_PRESENT;
868
869	return;
870
871	/*
872	 * Free any resources we've allocated during the failed attach
873	 * attempt.  Do this in reverse order and fall through.
874	 */
875 fail_5:
876	for (i = 0; i < ATW_NRXDESC; i++) {
877		if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
878			continue;
879		bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
880	}
881 fail_4:
882	for (i = 0; i < ATW_TXQUEUELEN; i++) {
883		if (sc->sc_txsoft[i].txs_dmamap == NULL)
884			continue;
885		bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
886	}
887	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
888 fail_3:
889	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
890 fail_2:
891	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
892	    sizeof(struct atw_control_data));
893 fail_1:
894	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
895 fail_0:
896	return;
897}
898
899static struct ieee80211_node *
900atw_node_alloc(struct ieee80211com *ic)
901{
902	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
903	struct ieee80211_node *ni = (*sc->sc_node_alloc)(ic);
904
905	DPRINTF(sc, ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
906	return ni;
907}
908
909static void
910atw_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
911{
912	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
913
914	DPRINTF(sc, ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
915	    ether_sprintf(ni->ni_bssid)));
916	(*sc->sc_node_free)(ic, ni);
917}
918
919
920static void
921atw_test1_reset(struct atw_softc *sc)
922{
923	switch (sc->sc_rev) {
924	case ATW_REVISION_BA:
925		if (1 /* XXX condition on transceiver type */) {
926			ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
927		}
928		break;
929	case ATW_REVISION_CA:
930		ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
931		break;
932	default:
933		break;
934	}
935}
936
937/*
938 * atw_reset:
939 *
940 *	Perform a soft reset on the ADM8211.
941 */
942void
943atw_reset(struct atw_softc *sc)
944{
945	int i;
946	uint32_t lpc;
947
948	ATW_WRITE(sc, ATW_NAR, 0x0);
949	DELAY(atw_nar_delay);
950
951	/* Reference driver has a cryptic remark indicating that this might
952	 * power-on the chip.  I know that it turns off power-saving....
953	 */
954	ATW_WRITE(sc, ATW_FRCTL, 0x0);
955
956	ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
957
958	for (i = 0; i < 50000 / atw_pseudo_milli; i++) {
959		if (ATW_READ(sc, ATW_PAR) == 0)
960			break;
961		DELAY(atw_pseudo_milli);
962	}
963
964	/* ... and then pause 100ms longer for good measure. */
965	DELAY(atw_magic_delay1);
966
967	DPRINTF2(sc, ("%s: atw_reset %d iterations\n", sc->sc_dev.dv_xname, i));
968
969	if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
970		printf("%s: reset failed to complete\n", sc->sc_dev.dv_xname);
971
972	atw_test1_reset(sc);
973	/*
974	 * Initialize the PCI Access Register.
975	 */
976	sc->sc_busmode = ATW_PAR_PBL_8DW;
977
978	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
979	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
980	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
981
982	/* Turn off maximum power saving, etc.
983	 *
984	 * XXX Following example of reference driver, should I set
985	 * an AID of 1?  It didn't seem to help....
986	 */
987	ATW_WRITE(sc, ATW_FRCTL, 0x0);
988
989	DELAY(atw_magic_delay2);
990
991	/* Recall EEPROM. */
992	ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
993
994	DELAY(atw_magic_delay4);
995
996	lpc = ATW_READ(sc, ATW_LPC);
997
998	DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
999
1000	/* A reset seems to affect the SRAM contents, so put them into
1001	 * a known state.
1002	 */
1003	atw_clear_sram(sc);
1004
1005	memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
1006}
1007
1008static void
1009atw_clear_sram(struct atw_softc *sc)
1010{
1011	memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
1012	/* XXX not for revision 0x20. */
1013	atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
1014}
1015
1016/* TBD atw_init
1017 *
1018 * set MAC based on ic->ic_bss->myaddr
1019 * write WEP keys
1020 * set TX rate
1021 */
1022
1023/* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
1024 * without receiving a beacon with the preferred BSSID & SSID.
1025 * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
1026 */
1027static void
1028atw_wcsr_init(struct atw_softc *sc)
1029{
1030	uint32_t wcsr;
1031
1032	wcsr = ATW_READ(sc, ATW_WCSR);
1033	wcsr &= ~(ATW_WCSR_BLN_MASK|ATW_WCSR_LSOE|ATW_WCSR_MPRE|ATW_WCSR_LSOE);
1034	wcsr |= LSHIFT(7, ATW_WCSR_BLN_MASK);
1035	ATW_WRITE(sc, ATW_WCSR, wcsr);	/* XXX resets wake-up status bits */
1036
1037	DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
1038	    sc->sc_dev.dv_xname, __func__, ATW_READ(sc, ATW_WCSR)));
1039}
1040
1041/* Turn off power management.  Set Rx store-and-forward mode. */
1042static void
1043atw_cmdr_init(struct atw_softc *sc)
1044{
1045	uint32_t cmdr;
1046	cmdr = ATW_READ(sc, ATW_CMDR);
1047	cmdr &= ~ATW_CMDR_APM;
1048	cmdr |= ATW_CMDR_RTE;
1049	cmdr &= ~ATW_CMDR_DRT_MASK;
1050	cmdr |= ATW_CMDR_DRT_SF;
1051
1052	ATW_WRITE(sc, ATW_CMDR, cmdr);
1053}
1054
1055static void
1056atw_tofs2_init(struct atw_softc *sc)
1057{
1058	uint32_t tofs2;
1059	/* XXX this magic can probably be figured out from the RFMD docs */
1060#ifndef ATW_REFSLAVE
1061	tofs2 = LSHIFT(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1062	      LSHIFT(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1063	      LSHIFT(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1064	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1065	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1066	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1067	      LSHIFT(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1068	      LSHIFT(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1069#else
1070	/* XXX new magic from reference driver source */
1071	tofs2 = LSHIFT(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1072	      LSHIFT(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1073	      LSHIFT(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1074	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1075	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1076	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1077	      LSHIFT(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1078	      LSHIFT(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1079#endif
1080	ATW_WRITE(sc, ATW_TOFS2, tofs2);
1081}
1082
1083static void
1084atw_nar_init(struct atw_softc *sc)
1085{
1086	ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF|ATW_NAR_PB);
1087}
1088
1089static void
1090atw_txlmt_init(struct atw_softc *sc)
1091{
1092	ATW_WRITE(sc, ATW_TXLMT, LSHIFT(512, ATW_TXLMT_MTMLT_MASK) |
1093	                         LSHIFT(1, ATW_TXLMT_SRTYLIM_MASK));
1094}
1095
1096static void
1097atw_test1_init(struct atw_softc *sc)
1098{
1099	uint32_t test1;
1100
1101	test1 = ATW_READ(sc, ATW_TEST1);
1102	test1 &= ~(ATW_TEST1_DBGREAD_MASK|ATW_TEST1_CONTROL);
1103	/* XXX magic 0x1 */
1104	test1 |= LSHIFT(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
1105	ATW_WRITE(sc, ATW_TEST1, test1);
1106}
1107
1108static void
1109atw_rf_reset(struct atw_softc *sc)
1110{
1111	/* XXX this resets an Intersil RF front-end? */
1112	/* TBD condition on Intersil RFType? */
1113	ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
1114	DELAY(atw_rf_delay1);
1115	ATW_WRITE(sc, ATW_SYNRF, 0);
1116	DELAY(atw_rf_delay2);
1117}
1118
1119/* Set 16 TU max duration for the contention-free period (CFP). */
1120static void
1121atw_cfp_init(struct atw_softc *sc)
1122{
1123	uint32_t cfpp;
1124
1125	cfpp = ATW_READ(sc, ATW_CFPP);
1126	cfpp &= ~ATW_CFPP_CFPMD;
1127	cfpp |= LSHIFT(16, ATW_CFPP_CFPMD);
1128	ATW_WRITE(sc, ATW_CFPP, cfpp);
1129}
1130
1131static void
1132atw_tofs0_init(struct atw_softc *sc)
1133{
1134	/* XXX I guess that the Cardbus clock is 22MHz?
1135	 * I am assuming that the role of ATW_TOFS0_USCNT is
1136	 * to divide the bus clock to get a 1MHz clock---the datasheet is not
1137	 * very clear on this point. It says in the datasheet that it is
1138	 * possible for the ADM8211 to accomodate bus speeds between 22MHz
1139	 * and 33MHz; maybe this is the way? I see a binary-only driver write
1140	 * these values. These values are also the power-on default.
1141	 */
1142	ATW_WRITE(sc, ATW_TOFS0,
1143	    LSHIFT(22, ATW_TOFS0_USCNT_MASK) |
1144	    ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
1145}
1146
1147/* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
1148static void
1149atw_ifs_init(struct atw_softc *sc)
1150{
1151	uint32_t ifst;
1152	/* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
1153	 * Go figure.
1154	 */
1155	ifst = LSHIFT(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
1156	      LSHIFT(22 * 5 /* IEEE80211_DUR_DS_SIFS */ /* # of 22MHz cycles */,
1157	             ATW_IFST_SIFS_MASK) |
1158	      LSHIFT(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
1159	      LSHIFT(0x64 /* IEEE80211_DUR_DS_EIFS */, ATW_IFST_EIFS_MASK);
1160
1161	ATW_WRITE(sc, ATW_IFST, ifst);
1162}
1163
1164static void
1165atw_response_times_init(struct atw_softc *sc)
1166{
1167	/* XXX More magic. Relates to ACK timing?  The datasheet seems to
1168	 * indicate that the MAC expects at least SIFS + MIRT microseconds
1169	 * to pass after it transmits a frame that requires a response;
1170	 * it waits at most SIFS + MART microseconds for the response.
1171	 * Surely this is not the ACK timeout?
1172	 */
1173	ATW_WRITE(sc, ATW_RSPT, LSHIFT(0xffff, ATW_RSPT_MART_MASK) |
1174	    LSHIFT(0xff, ATW_RSPT_MIRT_MASK));
1175}
1176
1177/* Set up the MMI read/write addresses for the baseband. The Tx/Rx
1178 * engines read and write baseband registers after Rx and before
1179 * Tx, respectively.
1180 */
1181static void
1182atw_bbp_io_init(struct atw_softc *sc)
1183{
1184	uint32_t mmiraddr2;
1185
1186	/* XXX The reference driver does this, but is it *really*
1187	 * necessary?
1188	 */
1189	switch (sc->sc_rev) {
1190	case ATW_REVISION_AB:
1191	case ATW_REVISION_AF:
1192		mmiraddr2 = 0x0;
1193		break;
1194	default:
1195		mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
1196		mmiraddr2 &=
1197		    ~(ATW_MMIRADDR2_PROREXT|ATW_MMIRADDR2_PRORLEN_MASK);
1198		break;
1199	}
1200
1201	switch (sc->sc_bbptype) {
1202	case ATW_BBPTYPE_INTERSIL:
1203		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
1204		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
1205		mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
1206		break;
1207	case ATW_BBPTYPE_MARVEL:
1208		/* TBD find out the Marvel settings. */
1209		break;
1210	case ATW_BBPTYPE_RFMD:
1211	default:
1212		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
1213		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
1214		mmiraddr2 |= ATW_MMIRADDR2_RFMD;
1215		break;
1216	}
1217	ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
1218	ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
1219}
1220
1221/*
1222 * atw_init:		[ ifnet interface function ]
1223 *
1224 *	Initialize the interface.  Must be called at splnet().
1225 */
1226int
1227atw_init(struct ifnet *ifp)
1228{
1229	struct atw_softc *sc = ifp->if_softc;
1230	struct ieee80211com *ic = &sc->sc_ic;
1231	struct atw_txsoft *txs;
1232	struct atw_rxsoft *rxs;
1233	int i, error = 0;
1234
1235	if ((error = atw_enable(sc)) != 0)
1236		goto out;
1237
1238	/*
1239	 * Cancel any pending I/O. This also resets.
1240	 */
1241	atw_stop(ifp, 0);
1242
1243	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1244	DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
1245	    __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
1246	    ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
1247
1248	atw_wcsr_init(sc);
1249
1250	atw_cmdr_init(sc);
1251
1252	/* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
1253	 *
1254	 * XXX Set transmit power for ATIM, RTS, Beacon.
1255	 */
1256	ATW_WRITE(sc, ATW_PLCPHD, LSHIFT(10, ATW_PLCPHD_SIGNAL_MASK) |
1257	    LSHIFT(0xb0, ATW_PLCPHD_SERVICE_MASK));
1258
1259	atw_tofs2_init(sc);
1260
1261	atw_nar_init(sc);
1262
1263	atw_txlmt_init(sc);
1264
1265	atw_test1_init(sc);
1266
1267	atw_rf_reset(sc);
1268
1269	atw_cfp_init(sc);
1270
1271	atw_tofs0_init(sc);
1272
1273	atw_ifs_init(sc);
1274
1275	/* XXX Fall asleep after one second of inactivity.
1276	 * XXX A frame may only dribble in for 65536us.
1277	 */
1278	ATW_WRITE(sc, ATW_RMD,
1279	    LSHIFT(1, ATW_RMD_PCNT) | LSHIFT(0xffff, ATW_RMD_RMRD_MASK));
1280
1281	atw_response_times_init(sc);
1282
1283	atw_bbp_io_init(sc);
1284
1285	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1286
1287	if ((error = atw_rf3000_init(sc)) != 0)
1288		goto out;
1289
1290	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
1291	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
1292	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
1293
1294	/*
1295	 * Initialize the transmit descriptor ring.
1296	 */
1297	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
1298	for (i = 0; i < ATW_NTXDESC; i++) {
1299		sc->sc_txdescs[i].at_ctl = 0;
1300		/* no transmit chaining */
1301		sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
1302		sc->sc_txdescs[i].at_buf2 =
1303		    htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
1304	}
1305	/* use ring mode */
1306	sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
1307	ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
1308	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1309	sc->sc_txfree = ATW_NTXDESC;
1310	sc->sc_txnext = 0;
1311
1312	/*
1313	 * Initialize the transmit job descriptors.
1314	 */
1315	SIMPLEQ_INIT(&sc->sc_txfreeq);
1316	SIMPLEQ_INIT(&sc->sc_txdirtyq);
1317	for (i = 0; i < ATW_TXQUEUELEN; i++) {
1318		txs = &sc->sc_txsoft[i];
1319		txs->txs_mbuf = NULL;
1320		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
1321	}
1322
1323	/*
1324	 * Initialize the receive descriptor and receive job
1325	 * descriptor rings.
1326	 */
1327	for (i = 0; i < ATW_NRXDESC; i++) {
1328		rxs = &sc->sc_rxsoft[i];
1329		if (rxs->rxs_mbuf == NULL) {
1330			if ((error = atw_add_rxbuf(sc, i)) != 0) {
1331				printf("%s: unable to allocate or map rx "
1332				    "buffer %d, error = %d\n",
1333				    sc->sc_dev.dv_xname, i, error);
1334				/*
1335				 * XXX Should attempt to run with fewer receive
1336				 * XXX buffers instead of just failing.
1337				 */
1338				atw_rxdrain(sc);
1339				goto out;
1340			}
1341		} else
1342			ATW_INIT_RXDESC(sc, i);
1343	}
1344	sc->sc_rxptr = 0;
1345
1346	/*
1347	 * Initialize the interrupt mask and enable interrupts.
1348	 */
1349	/* normal interrupts */
1350	sc->sc_inten =  ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
1351	    ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
1352
1353	/* abnormal interrupts */
1354	sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
1355	    ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
1356	    ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1357
1358	sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
1359	    ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1360	sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
1361	sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
1362	    ATW_INTR_TRT;
1363
1364	sc->sc_linkint_mask &= sc->sc_inten;
1365	sc->sc_rxint_mask &= sc->sc_inten;
1366	sc->sc_txint_mask &= sc->sc_inten;
1367
1368	ATW_WRITE(sc, ATW_IER, sc->sc_inten);
1369	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1370
1371	DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
1372	    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_IER), sc->sc_inten));
1373
1374	/*
1375	 * Give the transmit and receive rings to the ADM8211.
1376	 */
1377	ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
1378	ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
1379
1380	sc->sc_txthresh = 0;
1381	sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
1382	    sc->sc_txth[sc->sc_txthresh].txth_opmode;
1383
1384	/* common 802.11 configuration */
1385	ic->ic_flags &= ~IEEE80211_F_IBSSON;
1386	switch (ic->ic_opmode) {
1387	case IEEE80211_M_STA:
1388		break;
1389	case IEEE80211_M_AHDEMO: /* XXX */
1390	case IEEE80211_M_IBSS:
1391		ic->ic_flags |= IEEE80211_F_IBSSON;
1392		/*FALLTHROUGH*/
1393	case IEEE80211_M_HOSTAP: /* XXX */
1394		break;
1395	case IEEE80211_M_MONITOR: /* XXX */
1396		break;
1397	}
1398
1399	switch (ic->ic_opmode) {
1400	case IEEE80211_M_AHDEMO:
1401	case IEEE80211_M_HOSTAP:
1402		ic->ic_bss->ni_intval = ic->ic_lintval;
1403		ic->ic_bss->ni_rssi = 0;
1404		ic->ic_bss->ni_rstamp = 0;
1405		break;
1406	default:					/* XXX */
1407		break;
1408	}
1409
1410	sc->sc_wepctl = 0;
1411
1412	atw_write_ssid(sc);
1413	atw_write_sup_rates(sc);
1414	if (ic->ic_caps & IEEE80211_C_WEP)
1415		atw_write_wep(sc);
1416
1417	ic->ic_state = IEEE80211_S_INIT;
1418
1419	/*
1420	 * Set the receive filter.  This will start the transmit and
1421	 * receive processes.
1422	 */
1423	atw_filter_setup(sc);
1424
1425	/*
1426	 * Start the receive process.
1427	 */
1428	ATW_WRITE(sc, ATW_RDR, 0x1);
1429
1430	/*
1431	 * Note that the interface is now running.
1432	 */
1433	ifp->if_flags |= IFF_RUNNING;
1434	ifp->if_flags &= ~IFF_OACTIVE;
1435
1436	/* send no beacons, yet. */
1437	atw_start_beacon(sc, 0);
1438
1439	if (ic->ic_opmode == IEEE80211_M_MONITOR)
1440		error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1441	else
1442		error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1443 out:
1444	if (error) {
1445		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1446		ifp->if_timer = 0;
1447		printf("%s: interface not running\n", sc->sc_dev.dv_xname);
1448	}
1449#ifdef ATW_DEBUG
1450	atw_print_regs(sc, "end of init");
1451#endif /* ATW_DEBUG */
1452
1453	return (error);
1454}
1455
1456/* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
1457 *           0: MAC control of RF3000/Si4126.
1458 *
1459 * Applies power, or selects RF front-end? Sets reset condition.
1460 *
1461 * TBD support non-RFMD BBP, non-SiLabs synth.
1462 */
1463static void
1464atw_bbp_io_enable(struct atw_softc *sc, int enable)
1465{
1466	if (enable) {
1467		ATW_WRITE(sc, ATW_SYNRF,
1468		    ATW_SYNRF_SELRF|ATW_SYNRF_PE1|ATW_SYNRF_PHYRST);
1469		DELAY(atw_bbp_io_enable_delay);
1470	} else {
1471		ATW_WRITE(sc, ATW_SYNRF, 0);
1472		DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
1473	}
1474}
1475
1476static int
1477atw_tune(struct atw_softc *sc)
1478{
1479	int rc;
1480	u_int chan;
1481	struct ieee80211com *ic = &sc->sc_ic;
1482
1483	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1484	if (chan == IEEE80211_CHAN_ANY)
1485		panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
1486
1487	if (chan == sc->sc_cur_chan)
1488		return 0;
1489
1490	DPRINTF(sc, ("%s: chan %d -> %d\n", sc->sc_dev.dv_xname,
1491	    sc->sc_cur_chan, chan));
1492
1493	atw_idle(sc, ATW_NAR_SR|ATW_NAR_ST);
1494
1495	atw_si4126_tune(sc, chan);
1496	if ((rc = atw_rf3000_tune(sc, chan)) != 0)
1497		printf("%s: failed to tune channel %d\n", sc->sc_dev.dv_xname,
1498		    chan);
1499
1500	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
1501	DELAY(atw_nar_delay);
1502	ATW_WRITE(sc, ATW_RDR, 0x1);
1503
1504	if (rc == 0)
1505		sc->sc_cur_chan = chan;
1506
1507	return rc;
1508}
1509
1510#ifdef ATW_SYNDEBUG
1511static void
1512atw_si4126_print(struct atw_softc *sc)
1513{
1514	struct ifnet *ifp = &sc->sc_ic.ic_if;
1515	u_int addr, val;
1516
1517	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1518		return;
1519
1520	for (addr = 0; addr <= 8; addr++) {
1521		printf("%s: synth[%d] = ", sc->sc_dev.dv_xname, addr);
1522		if (atw_si4126_read(sc, addr, &val) == 0) {
1523			printf("<unknown> (quitting print-out)\n");
1524			break;
1525		}
1526		printf("%05x\n", val);
1527	}
1528}
1529#endif /* ATW_SYNDEBUG */
1530
1531/* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
1532 *
1533 * The RF/IF synthesizer produces two reference frequencies for
1534 * the RF2948B transceiver.  The first frequency the RF2948B requires
1535 * is two times the so-called "intermediate frequency" (IF). Since
1536 * a SAW filter on the radio fixes the IF at 374MHz, I program the
1537 * Si4126 to generate IF LO = 374MHz x 2 = 748MHz.  The second
1538 * frequency required by the transceiver is the radio frequency
1539 * (RF). This is a superheterodyne transceiver; for f(chan) the
1540 * center frequency of the channel we are tuning, RF = f(chan) -
1541 * IF.
1542 *
1543 * XXX I am told by SiLabs that the Si4126 will accept a broader range
1544 * of XIN than the 2-25MHz mentioned by the datasheet, even *without*
1545 * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
1546 * works, but I have still programmed for XINDIV2 = 1 to be safe.
1547 */
1548static void
1549atw_si4126_tune(struct atw_softc *sc, u_int chan)
1550{
1551	u_int mhz;
1552	u_int R;
1553	u_int32_t gpio;
1554	u_int16_t gain;
1555
1556#ifdef ATW_SYNDEBUG
1557	atw_si4126_print(sc);
1558#endif /* ATW_SYNDEBUG */
1559
1560	if (chan == 14)
1561		mhz = 2484;
1562	else
1563		mhz = 2412 + 5 * (chan - 1);
1564
1565	/* Tune IF to 748MHz to suit the IF LO input of the
1566	 * RF2494B, which is 2 x IF. No need to set an IF divider
1567         * because an IF in 526MHz - 952MHz is allowed.
1568	 *
1569	 * XIN is 44.000MHz, so divide it by two to get allowable
1570	 * range of 2-25MHz. SiLabs tells me that this is not
1571	 * strictly necessary.
1572	 */
1573
1574	if (atw_xindiv2)
1575		R = 44;
1576	else
1577		R = 88;
1578
1579	/* Power-up RF, IF synthesizers. */
1580	atw_si4126_write(sc, SI4126_POWER,
1581	    SI4126_POWER_PDIB|SI4126_POWER_PDRB);
1582
1583	/* set LPWR, too? */
1584	atw_si4126_write(sc, SI4126_MAIN,
1585	    (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
1586
1587	/* Set the phase-locked loop gain.  If RF2 N > 2047, then
1588	 * set KP2 to 1.
1589	 *
1590	 * REFDIF This is different from the reference driver, which
1591	 * always sets SI4126_GAIN to 0.
1592	 */
1593	gain = LSHIFT(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
1594
1595	atw_si4126_write(sc, SI4126_GAIN, gain);
1596
1597	/* XIN = 44MHz.
1598	 *
1599	 * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
1600	 * R = 44 so that 1496/(2 * 44) * 44MHz = 748MHz.
1601	 *
1602	 * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
1603	 * so that 1496/88 * 44MHz = 748MHz.
1604	 */
1605	atw_si4126_write(sc, SI4126_IFN, 1496);
1606
1607	atw_si4126_write(sc, SI4126_IFR, R);
1608
1609#ifndef ATW_REFSLAVE
1610	/* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
1611	 * then RF1 becomes the active RF synthesizer, even on the Si4126,
1612	 * which has no RF1!
1613	 */
1614	atw_si4126_write(sc, SI4126_RF1R, R);
1615
1616	atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
1617#endif
1618
1619	/* N/R * XIN = RF. XIN = 44MHz. We desire RF = mhz - IF,
1620	 * where IF = 374MHz.  Let's divide XIN to 1MHz. So R = 44.
1621	 * Now let's multiply it to mhz. So mhz - IF = N.
1622	 */
1623	atw_si4126_write(sc, SI4126_RF2R, R);
1624
1625	atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
1626
1627	/* wait 100us from power-up for RF, IF to settle */
1628	DELAY(100);
1629
1630	gpio = ATW_READ(sc, ATW_GPIO);
1631	gpio &= ~(ATW_GPIO_EN_MASK|ATW_GPIO_O_MASK|ATW_GPIO_I_MASK);
1632	gpio |= LSHIFT(1, ATW_GPIO_EN_MASK);
1633
1634	if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
1635		/* Set a Prism RF front-end to a special mode for channel 14?
1636		 *
1637		 * Apparently the SMC2635W needs this, although I don't think
1638		 * it has a Prism RF.
1639		 */
1640		gpio |= LSHIFT(1, ATW_GPIO_O_MASK);
1641	}
1642	ATW_WRITE(sc, ATW_GPIO, gpio);
1643
1644#ifdef ATW_SYNDEBUG
1645	atw_si4126_print(sc);
1646#endif /* ATW_SYNDEBUG */
1647}
1648
1649/* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
1650 * diversity.
1651 *
1652 * !!!
1653 * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
1654 * !!!
1655 */
1656static int
1657atw_rf3000_init(struct atw_softc *sc)
1658{
1659	int rc = 0;
1660
1661	atw_bbp_io_enable(sc, 1);
1662
1663	/* CCA is acquisition sensitive */
1664	rc = atw_rf3000_write(sc, RF3000_CCACTL,
1665	    LSHIFT(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
1666
1667	if (rc != 0)
1668		goto out;
1669
1670	/* enable diversity */
1671	rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
1672
1673	if (rc != 0)
1674		goto out;
1675
1676	/* sensible setting from a binary-only driver */
1677	rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1678	    LSHIFT(0x1d, RF3000_GAINCTL_TXVGC_MASK));
1679
1680	if (rc != 0)
1681		goto out;
1682
1683	/* magic from a binary-only driver */
1684	rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
1685	    LSHIFT(0x38, RF3000_LOGAINCAL_CAL_MASK));
1686
1687	if (rc != 0)
1688		goto out;
1689
1690	rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
1691
1692	if (rc != 0)
1693		goto out;
1694
1695	/* XXX Reference driver remarks that Abocom sets this to 50.
1696	 * Meaning 0x50, I think....  50 = 0x32, which would set a bit
1697	 * in the "reserved" area of register RF3000_OPTIONS1.
1698	 */
1699	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
1700
1701	if (rc != 0)
1702		goto out;
1703
1704	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
1705
1706	if (rc != 0)
1707		goto out;
1708
1709out:
1710	atw_bbp_io_enable(sc, 0);
1711	return rc;
1712}
1713
1714#ifdef ATW_BBPDEBUG
1715static void
1716atw_rf3000_print(struct atw_softc *sc)
1717{
1718	struct ifnet *ifp = &sc->sc_ic.ic_if;
1719	u_int addr, val;
1720
1721	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1722		return;
1723
1724	for (addr = 0x01; addr <= 0x15; addr++) {
1725		printf("%s: bbp[%d] = \n", sc->sc_dev.dv_xname, addr);
1726		if (atw_rf3000_read(sc, addr, &val) != 0) {
1727			printf("<unknown> (quitting print-out)\n");
1728			break;
1729		}
1730		printf("%08x\n", val);
1731	}
1732}
1733#endif /* ATW_BBPDEBUG */
1734
1735/* Set the power settings on the BBP for channel `chan'. */
1736static int
1737atw_rf3000_tune(struct atw_softc *sc, u_int chan)
1738{
1739	int rc = 0;
1740	u_int32_t reg;
1741	u_int16_t txpower, lpf_cutoff, lna_gs_thresh;
1742
1743	txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
1744	lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
1745	lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
1746
1747	/* odd channels: LSB, even channels: MSB */
1748	if (chan % 2 == 1) {
1749		txpower &= 0xFF;
1750		lpf_cutoff &= 0xFF;
1751		lna_gs_thresh &= 0xFF;
1752	} else {
1753		txpower >>= 8;
1754		lpf_cutoff >>= 8;
1755		lna_gs_thresh >>= 8;
1756	}
1757
1758#ifdef ATW_BBPDEBUG
1759	atw_rf3000_print(sc);
1760#endif /* ATW_BBPDEBUG */
1761
1762	DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
1763	    "lna_gs_thresh %02x\n",
1764	    sc->sc_dev.dv_xname, chan, txpower, lpf_cutoff, lna_gs_thresh));
1765
1766	atw_bbp_io_enable(sc, 1);
1767
1768	if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1769	    LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
1770		goto out;
1771
1772	if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
1773		goto out;
1774
1775	if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
1776		goto out;
1777
1778	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0);
1779
1780	if (rc != 0)
1781		goto out;
1782
1783	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
1784
1785	if (rc != 0)
1786		goto out;
1787
1788#ifdef ATW_BBPDEBUG
1789	atw_rf3000_print(sc);
1790#endif /* ATW_BBPDEBUG */
1791
1792out:
1793	atw_bbp_io_enable(sc, 0);
1794
1795	/* set beacon, rts, atim transmit power */
1796	reg = ATW_READ(sc, ATW_PLCPHD);
1797	reg &= ~ATW_PLCPHD_SERVICE_MASK;
1798	reg |= LSHIFT(LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK),
1799	    ATW_PLCPHD_SERVICE_MASK);
1800	ATW_WRITE(sc, ATW_PLCPHD, reg);
1801	DELAY(atw_plcphd_delay);
1802
1803	return rc;
1804}
1805
1806/* Write a register on the RF3000 baseband processor using the
1807 * registers provided by the ADM8211 for this purpose.
1808 *
1809 * Return 0 on success.
1810 */
1811static int
1812atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
1813{
1814	u_int32_t reg;
1815	int i;
1816
1817	reg = sc->sc_bbpctl_wr |
1818	     LSHIFT(val & 0xff, ATW_BBPCTL_DATA_MASK) |
1819	     LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1820
1821	for (i = 20000 / atw_pseudo_milli; --i >= 0; ) {
1822		ATW_WRITE(sc, ATW_BBPCTL, reg);
1823		DELAY(2 * atw_pseudo_milli);
1824		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
1825			break;
1826	}
1827
1828	if (i < 0) {
1829		printf("%s: BBPCTL still busy\n", sc->sc_dev.dv_xname);
1830		return ETIMEDOUT;
1831	}
1832	return 0;
1833}
1834
1835/* Read a register on the RF3000 baseband processor using the registers
1836 * the ADM8211 provides for this purpose.
1837 *
1838 * The 7-bit register address is addr.  Record the 8-bit data in the register
1839 * in *val.
1840 *
1841 * Return 0 on success.
1842 *
1843 * XXX This does not seem to work. The ADM8211 must require more or
1844 * different magic to read the chip than to write it. Possibly some
1845 * of the magic I have derived from a binary-only driver concerns
1846 * the "chip address" (see the RF3000 manual).
1847 */
1848#ifdef ATW_BBPDEBUG
1849static int
1850atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
1851{
1852	u_int32_t reg;
1853	int i;
1854
1855	for (i = 1000; --i >= 0; ) {
1856		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD|ATW_BBPCTL_WR) == 0)
1857			break;
1858		DELAY(100);
1859	}
1860
1861	if (i < 0) {
1862		printf("%s: start atw_rf3000_read, BBPCTL busy\n",
1863		    sc->sc_dev.dv_xname);
1864		return ETIMEDOUT;
1865	}
1866
1867	reg = sc->sc_bbpctl_rd | LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1868
1869	ATW_WRITE(sc, ATW_BBPCTL, reg);
1870
1871	for (i = 1000; --i >= 0; ) {
1872		DELAY(100);
1873		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
1874			break;
1875	}
1876
1877	ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
1878
1879	if (i < 0) {
1880		printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
1881		    sc->sc_dev.dv_xname, reg);
1882		return ETIMEDOUT;
1883	}
1884	if (val != NULL)
1885		*val = MASK_AND_RSHIFT(reg, ATW_BBPCTL_DATA_MASK);
1886	return 0;
1887}
1888#endif /* ATW_BBPDEBUG */
1889
1890/* Write a register on the Si4126 RF/IF synthesizer using the registers
1891 * provided by the ADM8211 for that purpose.
1892 *
1893 * val is 18 bits of data, and val is the 4-bit address of the register.
1894 *
1895 * Return 0 on success.
1896 */
1897static void
1898atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
1899{
1900	uint32_t bits, mask, reg;
1901	const int nbits = 22;
1902
1903	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1904	KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
1905
1906	bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
1907	       LSHIFT(addr, SI4126_TWI_ADDR_MASK);
1908
1909	reg = ATW_SYNRF_SELSYN;
1910	/* reference driver: reset Si4126 serial bus to initial
1911	 * conditions?
1912	 */
1913	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1914	ATW_WRITE(sc, ATW_SYNRF, reg);
1915
1916	for (mask = BIT(nbits - 1); mask != 0; mask >>= 1) {
1917		if ((bits & mask) != 0)
1918			reg |= ATW_SYNRF_SYNDATA;
1919		else
1920			reg &= ~ATW_SYNRF_SYNDATA;
1921		ATW_WRITE(sc, ATW_SYNRF, reg);
1922		ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
1923		ATW_WRITE(sc, ATW_SYNRF, reg);
1924	}
1925	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1926	ATW_WRITE(sc, ATW_SYNRF, 0x0);
1927}
1928
1929/* Read 18-bit data from the 4-bit address addr in Si4126
1930 * RF synthesizer and write the data to *val. Return 0 on success.
1931 *
1932 * XXX This does not seem to work. The ADM8211 must require more or
1933 * different magic to read the chip than to write it.
1934 */
1935#ifdef ATW_SYNDEBUG
1936static int
1937atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
1938{
1939	u_int32_t reg;
1940	int i;
1941
1942	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1943
1944	for (i = 1000; --i >= 0; ) {
1945		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD|ATW_SYNCTL_WR) == 0)
1946			break;
1947		DELAY(100);
1948	}
1949
1950	if (i < 0) {
1951		printf("%s: start atw_si4126_read, SYNCTL busy\n",
1952		    sc->sc_dev.dv_xname);
1953		return ETIMEDOUT;
1954	}
1955
1956	reg = sc->sc_synctl_rd | LSHIFT(addr, ATW_SYNCTL_DATA_MASK);
1957
1958	ATW_WRITE(sc, ATW_SYNCTL, reg);
1959
1960	for (i = 1000; --i >= 0; ) {
1961		DELAY(100);
1962		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
1963			break;
1964	}
1965
1966	ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
1967
1968	if (i < 0) {
1969		printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
1970		    sc->sc_dev.dv_xname, reg);
1971		return ETIMEDOUT;
1972	}
1973	if (val != NULL)
1974		*val = MASK_AND_RSHIFT(ATW_READ(sc, ATW_SYNCTL),
1975		                       ATW_SYNCTL_DATA_MASK);
1976	return 0;
1977}
1978#endif /* ATW_SYNDEBUG */
1979
1980/* XXX is the endianness correct? test. */
1981#define	atw_calchash(addr) \
1982	(ether_crc32_le((addr), IEEE80211_ADDR_LEN) & BITS(5, 0))
1983
1984/*
1985 * atw_filter_setup:
1986 *
1987 *	Set the ADM8211's receive filter.
1988 */
1989static void
1990atw_filter_setup(struct atw_softc *sc)
1991{
1992	struct ieee80211com *ic = &sc->sc_ic;
1993	struct ethercom *ec = &ic->ic_ec;
1994	struct ifnet *ifp = &sc->sc_ic.ic_if;
1995	int hash;
1996	u_int32_t hashes[2];
1997	struct ether_multi *enm;
1998	struct ether_multistep step;
1999
2000	/* According to comments in tlp_al981_filter_setup
2001	 * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
2002	 * multicast filter to be set while it is running.  Hopefully
2003	 * the ADM8211 is not the same!
2004	 */
2005	if ((ifp->if_flags & IFF_RUNNING) != 0)
2006		atw_idle(sc, ATW_NAR_SR);
2007
2008	sc->sc_opmode &= ~(ATW_NAR_PR|ATW_NAR_MM);
2009
2010	/* XXX in scan mode, do not filter packets.  Maybe this is
2011	 * unnecessary.
2012	 */
2013	if (ic->ic_state == IEEE80211_S_SCAN ||
2014	    (ifp->if_flags & IFF_PROMISC) != 0) {
2015		sc->sc_opmode |= ATW_NAR_PR;
2016		goto allmulti;
2017	}
2018
2019	hashes[0] = hashes[1] = 0x0;
2020
2021	/*
2022	 * Program the 64-bit multicast hash filter.
2023	 */
2024	ETHER_FIRST_MULTI(step, ec, enm);
2025	while (enm != NULL) {
2026		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2027		    ETHER_ADDR_LEN) != 0)
2028			goto allmulti;
2029
2030		hash = atw_calchash(enm->enm_addrlo);
2031		hashes[hash >> 5] |= 1 << (hash & 0x1f);
2032		ETHER_NEXT_MULTI(step, enm);
2033	}
2034	ifp->if_flags &= ~IFF_ALLMULTI;
2035	goto setit;
2036
2037allmulti:
2038	ifp->if_flags |= IFF_ALLMULTI;
2039	hashes[0] = hashes[1] = 0xffffffff;
2040
2041setit:
2042	ATW_WRITE(sc, ATW_MAR0, hashes[0]);
2043	ATW_WRITE(sc, ATW_MAR1, hashes[1]);
2044	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2045	DELAY(atw_nar_delay);
2046
2047	DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", sc->sc_dev.dv_xname,
2048	    ATW_READ(sc, ATW_NAR), sc->sc_opmode));
2049}
2050
2051/* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
2052 * a beacon's BSSID and SSID against the preferred BSSID and SSID
2053 * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
2054 * no beacon with the preferred BSSID and SSID in the number of
2055 * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
2056 */
2057static void
2058atw_write_bssid(struct atw_softc *sc)
2059{
2060	struct ieee80211com *ic = &sc->sc_ic;
2061	u_int8_t *bssid;
2062
2063	bssid = ic->ic_bss->ni_bssid;
2064
2065	ATW_WRITE(sc, ATW_BSSID0,
2066	    LSHIFT(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
2067	    LSHIFT(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
2068	    LSHIFT(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
2069	    LSHIFT(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
2070
2071	ATW_WRITE(sc, ATW_ABDA1,
2072	    (ATW_READ(sc, ATW_ABDA1) &
2073	    ~(ATW_ABDA1_BSSIDB4_MASK|ATW_ABDA1_BSSIDB5_MASK)) |
2074	    LSHIFT(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
2075	    LSHIFT(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
2076
2077	DPRINTF(sc, ("%s: BSSID %s -> ", sc->sc_dev.dv_xname,
2078	    ether_sprintf(sc->sc_bssid)));
2079	DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
2080
2081	memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
2082}
2083
2084/* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
2085 * 16-bit word.
2086 */
2087static void
2088atw_write_sram(struct atw_softc *sc, u_int ofs, u_int8_t *buf, u_int buflen)
2089{
2090	u_int i;
2091	u_int8_t *ptr;
2092
2093	memcpy(&sc->sc_sram[ofs], buf, buflen);
2094
2095	KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
2096
2097	KASSERT(buflen + ofs <= sc->sc_sramlen);
2098
2099	ptr = &sc->sc_sram[ofs];
2100
2101	for (i = 0; i < buflen; i += 2) {
2102		ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
2103		    LSHIFT((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
2104		DELAY(atw_writewep_delay);
2105
2106		ATW_WRITE(sc, ATW_WESK,
2107		    LSHIFT((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
2108		DELAY(atw_writewep_delay);
2109	}
2110	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
2111
2112	if (sc->sc_if.if_flags & IFF_DEBUG) {
2113		int n_octets = 0;
2114		printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
2115		    sc->sc_dev.dv_xname, buflen, ofs, sc->sc_wepctl);
2116		for (i = 0; i < buflen; i++) {
2117			printf(" %02x", ptr[i]);
2118			if (++n_octets % 24 == 0)
2119				printf("\n");
2120		}
2121		if (n_octets % 24 != 0)
2122			printf("\n");
2123	}
2124}
2125
2126/* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
2127static void
2128atw_write_wep(struct atw_softc *sc)
2129{
2130	struct ieee80211com *ic = &sc->sc_ic;
2131	/* SRAM shared-key record format: key0 flags key1 ... key12 */
2132	u_int8_t buf[IEEE80211_WEP_NKID]
2133	            [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
2134	u_int32_t reg;
2135	int i;
2136
2137	sc->sc_wepctl = 0;
2138	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
2139
2140	if ((ic->ic_flags & IEEE80211_F_WEPON) == 0)
2141		return;
2142
2143	memset(&buf[0][0], 0, sizeof(buf));
2144
2145	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2146		if (ic->ic_nw_keys[i].wk_len > 5) {
2147			buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
2148		} else if (ic->ic_nw_keys[i].wk_len != 0) {
2149			buf[i][1] = ATW_WEP_ENABLED;
2150		} else {
2151			buf[i][1] = 0;
2152			continue;
2153		}
2154		buf[i][0] = ic->ic_nw_keys[i].wk_key[0];
2155		memcpy(&buf[i][2], &ic->ic_nw_keys[i].wk_key[1],
2156		    ic->ic_nw_keys[i].wk_len - 1);
2157	}
2158
2159	reg = ATW_READ(sc, ATW_MACTEST);
2160	reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
2161	reg &= ~ATW_MACTEST_KEYID_MASK;
2162	reg |= LSHIFT(ic->ic_wep_txkey, ATW_MACTEST_KEYID_MASK);
2163	ATW_WRITE(sc, ATW_MACTEST, reg);
2164
2165	sc->sc_wepctl = ATW_WEPCTL_WEPENABLE;
2166
2167	switch (sc->sc_rev) {
2168	case ATW_REVISION_AB:
2169	case ATW_REVISION_AF:
2170		/* Bypass WEP on Rx. */
2171		sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
2172		break;
2173	default:
2174		break;
2175	}
2176
2177	atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (u_int8_t*)&buf[0][0],
2178	    sizeof(buf));
2179}
2180
2181const struct timeval atw_beacon_mininterval = {.tv_sec = 1, .tv_usec = 0};
2182
2183static void
2184atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
2185    struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
2186{
2187	struct atw_softc *sc = (struct atw_softc*)ic->ic_softc;
2188
2189	switch (subtype) {
2190	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2191		/* do nothing: hardware answers probe request */
2192		break;
2193	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2194	case IEEE80211_FC0_SUBTYPE_BEACON:
2195		atw_recv_beacon(ic, m, ni, subtype, rssi, rstamp);
2196		break;
2197	default:
2198		(*sc->sc_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
2199		break;
2200	}
2201	return;
2202}
2203
2204static int
2205do_slow_print(struct atw_softc *sc, int *did_print)
2206{
2207	if ((sc->sc_if.if_flags & IFF_LINK0) == 0)
2208		return 0;
2209	if (!*did_print && (sc->sc_if.if_flags & IFF_DEBUG) == 0 &&
2210	    !ratecheck(&sc->sc_last_beacon, &atw_beacon_mininterval))
2211		return 0;
2212
2213	*did_print = 1;
2214	return 1;
2215}
2216
2217/* In ad hoc mode, atw_recv_beacon is responsible for the coalescence
2218 * of IBSSs with like SSID/channel but different BSSID. It joins the
2219 * oldest IBSS (i.e., with greatest TSF time), since that is the WECA
2220 * convention. Possibly the ADMtek chip does this for us; I will have
2221 * to test to find out.
2222 *
2223 * XXX we should add the duration field of the received beacon to
2224 * the TSF time it contains before comparing it with the ADM8211's
2225 * TSF.
2226 */
2227static void
2228atw_recv_beacon(struct ieee80211com *ic, struct mbuf *m0,
2229    struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
2230{
2231	struct atw_softc *sc;
2232	struct ieee80211_frame *wh;
2233	uint32_t tsftl, tsfth;
2234	uint32_t bcn_tsftl, bcn_tsfth;
2235	int did_print = 0, sign;
2236	union {
2237		uint32_t	words[2];
2238		uint8_t		tstamp[8];
2239	} u;
2240
2241	sc = (struct atw_softc*)ic->ic_if.if_softc;
2242
2243	(*sc->sc_recv_mgmt)(ic, m0, ni, subtype, rssi, rstamp);
2244
2245	if (ic->ic_state != IEEE80211_S_RUN)
2246		return;
2247
2248	atw_tsft(sc, &tsfth, &tsftl);
2249
2250	(void)memcpy(&u, &ni->ni_tstamp[0], sizeof(u));
2251	bcn_tsftl = le32toh(u.words[0]);
2252	bcn_tsfth = le32toh(u.words[1]);
2253
2254	/* we are faster, let the other guy catch up */
2255	if (bcn_tsfth < tsfth)
2256		sign = -1;
2257	else if (bcn_tsfth == tsfth && bcn_tsftl < tsftl)
2258		sign = -1;
2259	else
2260		sign = 1;
2261
2262	if (memcmp(ni->ni_bssid, ic->ic_bss->ni_bssid,
2263	    IEEE80211_ADDR_LEN) == 0) {
2264		if (!do_slow_print(sc, &did_print))
2265			return;
2266		printf("%s: tsft offset %s%" PRIu64 "\n", sc->sc_dev.dv_xname,
2267		    (sign < 0) ? "-" : "",
2268		    (sign < 0)
2269			? ((((uint64_t)tsfth << 32) | tsftl) -
2270			   (((uint64_t)bcn_tsfth << 32) | bcn_tsftl))
2271			: ((((uint64_t)bcn_tsfth << 32) | bcn_tsftl) -
2272			   (((uint64_t)tsfth << 32) | tsftl)));
2273		return;
2274	}
2275
2276	if (sign < 0)
2277		return;
2278
2279	if (ieee80211_match_bss(ic, ni) != 0)
2280		return;
2281
2282	if (do_slow_print(sc, &did_print)) {
2283		printf("%s: atw_recv_beacon: bssid mismatch %s\n",
2284		    sc->sc_dev.dv_xname, ether_sprintf(ni->ni_bssid));
2285	}
2286
2287	if (ic->ic_opmode != IEEE80211_M_IBSS)
2288		return;
2289
2290	if (do_slow_print(sc, &did_print)) {
2291		printf("%s: my tsft %" PRIu64 " beacon tsft %" PRIu64 "\n",
2292		    sc->sc_dev.dv_xname, ((uint64_t)tsfth << 32) | tsftl,
2293		    ((uint64_t)bcn_tsfth << 32) | bcn_tsftl);
2294	}
2295
2296	wh = mtod(m0, struct ieee80211_frame *);
2297
2298	if (do_slow_print(sc, &did_print)) {
2299		printf("%s: sync TSF with %s\n",
2300		    sc->sc_dev.dv_xname, ether_sprintf(wh->i_addr2));
2301	}
2302
2303	ic->ic_flags &= ~IEEE80211_F_SIBSS;
2304
2305	(void)memcpy(&ic->ic_bss->ni_tstamp[0], &u, sizeof(u));
2306
2307	atw_tsf(sc);
2308
2309	/* negotiate rates with new IBSS */
2310	ieee80211_fix_rate(ic, ni, IEEE80211_F_DOFRATE |
2311	    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2312	if (ni->ni_rates.rs_nrates == 0) {
2313		if (do_slow_print(sc, &did_print)) {
2314			printf("%s: rates mismatch, BSSID %s\n",
2315			    sc->sc_dev.dv_xname, ether_sprintf(ni->ni_bssid));
2316		}
2317		return;
2318	}
2319
2320	if (do_slow_print(sc, &did_print)) {
2321		printf("%s: sync BSSID %s -> ",
2322		    sc->sc_dev.dv_xname, ether_sprintf(ic->ic_bss->ni_bssid));
2323		printf("%s ", ether_sprintf(ni->ni_bssid));
2324		printf("(from %s)\n", ether_sprintf(wh->i_addr2));
2325	}
2326
2327	(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
2328
2329	atw_write_bssid(sc);
2330	atw_start_beacon(sc, 1);
2331}
2332
2333/* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
2334 * In ad hoc mode, the SSID is written to the beacons sent by the
2335 * ADM8211. In both ad hoc and infrastructure mode, beacons received
2336 * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
2337 * indications.
2338 */
2339static void
2340atw_write_ssid(struct atw_softc *sc)
2341{
2342	struct ieee80211com *ic = &sc->sc_ic;
2343	/* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
2344	 * it only expects the element length, not its ID.
2345	 */
2346	u_int8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
2347
2348	memset(buf, 0, sizeof(buf));
2349	buf[0] = ic->ic_bss->ni_esslen;
2350	memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
2351
2352	atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
2353	    roundup(1 + ic->ic_bss->ni_esslen, 2));
2354}
2355
2356/* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
2357 * In ad hoc mode, the supported rates are written to beacons sent by the
2358 * ADM8211.
2359 */
2360static void
2361atw_write_sup_rates(struct atw_softc *sc)
2362{
2363	struct ieee80211com *ic = &sc->sc_ic;
2364	/* 14 bytes are probably (XXX) reserved in the ADM8211 SRAM for
2365	 * supported rates
2366	 */
2367	u_int8_t buf[roundup(1 /* length */ + IEEE80211_RATE_SIZE, 2)];
2368
2369	memset(buf, 0, sizeof(buf));
2370
2371	buf[0] = ic->ic_bss->ni_rates.rs_nrates;
2372
2373	memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates,
2374	    ic->ic_bss->ni_rates.rs_nrates);
2375
2376	atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
2377}
2378
2379/* Start/stop sending beacons. */
2380void
2381atw_start_beacon(struct atw_softc *sc, int start)
2382{
2383	struct ieee80211com *ic = &sc->sc_ic;
2384	uint16_t chan;
2385	uint32_t bcnt, bpli, cap0, cap1, capinfo;
2386	size_t len;
2387
2388	if (ATW_IS_ENABLED(sc) == 0)
2389		return;
2390
2391	/* start beacons */
2392	len = sizeof(struct ieee80211_frame) +
2393	    8 /* timestamp */ + 2 /* beacon interval */ +
2394	    2 /* capability info */ +
2395	    2 + ic->ic_bss->ni_esslen /* SSID element */ +
2396	    2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
2397	    3 /* DS parameters */ +
2398	    IEEE80211_CRC_LEN;
2399
2400	bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
2401	cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
2402	cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
2403
2404	ATW_WRITE(sc, ATW_BCNT, bcnt);
2405	ATW_WRITE(sc, ATW_CAP1, cap1);
2406
2407	if (!start)
2408		return;
2409
2410	/* TBD use ni_capinfo */
2411
2412	capinfo = 0;
2413	if (sc->sc_flags & ATWF_SHORT_PREAMBLE)
2414		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2415	if (ic->ic_flags & IEEE80211_F_WEPON)
2416		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2417
2418	switch (ic->ic_opmode) {
2419	case IEEE80211_M_IBSS:
2420		len += 4; /* IBSS parameters */
2421		capinfo |= IEEE80211_CAPINFO_IBSS;
2422		break;
2423	case IEEE80211_M_HOSTAP:
2424		/* XXX 6-byte minimum TIM */
2425		len += atw_beacon_len_adjust;
2426		capinfo |= IEEE80211_CAPINFO_ESS;
2427		break;
2428	default:
2429		return;
2430	}
2431
2432	/* set listen interval
2433	 * XXX do software units agree w/ hardware?
2434	 */
2435	bpli = LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2436	    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
2437
2438	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
2439
2440	bcnt |= LSHIFT(len, ATW_BCNT_BCNT_MASK);
2441	cap0 |= LSHIFT(chan, ATW_CAP0_CHN_MASK);
2442	cap1 |= LSHIFT(capinfo, ATW_CAP1_CAPI_MASK);
2443
2444	ATW_WRITE(sc, ATW_BCNT, bcnt);
2445	ATW_WRITE(sc, ATW_BPLI, bpli);
2446	ATW_WRITE(sc, ATW_CAP0, cap0);
2447	ATW_WRITE(sc, ATW_CAP1, cap1);
2448
2449	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
2450	    sc->sc_dev.dv_xname, bcnt));
2451
2452	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
2453	    sc->sc_dev.dv_xname, cap1));
2454}
2455
2456/* Return the 32 lsb of the last TSFT divisible by ival. */
2457static __inline uint32_t
2458atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
2459{
2460	/* Following the reference driver's lead, I compute
2461	 *
2462	 *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
2463	 *
2464	 * without using 64-bit arithmetic, using the following
2465	 * relationship:
2466	 *
2467	 *     (0x100000000 * H + L) % m
2468	 *   = ((0x100000000 % m) * H + L) % m
2469	 *   = (((0xffffffff + 1) % m) * H + L) % m
2470	 *   = ((0xffffffff % m + 1 % m) * H + L) % m
2471	 *   = ((0xffffffff % m + 1) * H + L) % m
2472	 */
2473	return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
2474}
2475
2476static __inline void
2477atw_tsft(struct atw_softc *sc, uint32_t *tsfth, uint32_t *tsftl)
2478{
2479	int i;
2480	for (i = 0; i < 2; i++) {
2481		*tsfth = ATW_READ(sc, ATW_TSFTH);
2482		*tsftl = ATW_READ(sc, ATW_TSFTL);
2483		if (ATW_READ(sc, ATW_TSFTH) == *tsfth)
2484			break;
2485	}
2486}
2487
2488/* If we've created an IBSS, write the TSF time in the ADM8211 to
2489 * the ieee80211com.
2490 *
2491 * Predict the next target beacon transmission time (TBTT) and
2492 * write it to the ADM8211.
2493 */
2494static void
2495atw_tsf(struct atw_softc *sc)
2496{
2497#define TBTTOFS 20 /* TU */
2498
2499	struct ieee80211com *ic = &sc->sc_ic;
2500	uint32_t ival, past_even, tbtt, tsfth, tsftl;
2501	union {
2502		uint32_t	words[2];
2503		uint8_t		tstamp[8];
2504	} u;
2505
2506	if ((ic->ic_opmode == IEEE80211_M_HOSTAP) ||
2507	    ((ic->ic_opmode == IEEE80211_M_IBSS) &&
2508	     (ic->ic_flags & IEEE80211_F_SIBSS))) {
2509		atw_tsft(sc, &tsfth, &tsftl);
2510		u.words[0] = htole32(tsftl);
2511		u.words[1] = htole32(tsfth);
2512		(void)memcpy(&ic->ic_bss->ni_tstamp[0], &u,
2513		    sizeof(ic->ic_bss->ni_tstamp));
2514	} else {
2515		(void)memcpy(&u, &ic->ic_bss->ni_tstamp[0], sizeof(u));
2516		tsftl = le32toh(u.words[0]);
2517		tsfth = le32toh(u.words[1]);
2518	}
2519
2520	ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
2521
2522	/* We sent/received the last beacon `past' microseconds
2523	 * after the interval divided the TSF timer.
2524	 */
2525	past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
2526
2527	/* Skip ten beacons so that the TBTT cannot pass before
2528	 * we've programmed it.  Ten is an arbitrary number.
2529	 */
2530	tbtt = past_even + ival * 10;
2531
2532	ATW_WRITE(sc, ATW_TOFS1,
2533	    LSHIFT(1, ATW_TOFS1_TSFTOFSR_MASK) |
2534	    LSHIFT(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
2535	    LSHIFT(MASK_AND_RSHIFT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
2536	        ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
2537#undef TBTTOFS
2538}
2539
2540static void
2541atw_next_scan(void *arg)
2542{
2543	struct atw_softc *sc = arg;
2544	struct ieee80211com *ic = &sc->sc_ic;
2545	struct ifnet *ifp = &ic->ic_if;
2546	int s;
2547
2548	/* don't call atw_start w/o network interrupts blocked */
2549	s = splnet();
2550	if (ic->ic_state == IEEE80211_S_SCAN)
2551		ieee80211_next_scan(ifp);
2552	splx(s);
2553}
2554
2555/* Synchronize the hardware state with the software state. */
2556static int
2557atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2558{
2559	struct ifnet *ifp = &ic->ic_if;
2560	struct atw_softc *sc = ifp->if_softc;
2561	enum ieee80211_state ostate;
2562	int error;
2563
2564	ostate = ic->ic_state;
2565
2566	if (nstate == IEEE80211_S_INIT) {
2567		callout_stop(&sc->sc_scan_ch);
2568		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
2569		atw_start_beacon(sc, 0);
2570		return (*sc->sc_newstate)(ic, nstate, arg);
2571	}
2572
2573	if ((error = atw_tune(sc)) != 0)
2574		return error;
2575
2576	switch (nstate) {
2577	case IEEE80211_S_ASSOC:
2578		break;
2579	case IEEE80211_S_INIT:
2580		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
2581		break;
2582	case IEEE80211_S_SCAN:
2583		callout_reset(&sc->sc_scan_ch, atw_dwelltime * hz / 1000,
2584		    atw_next_scan, sc);
2585
2586		break;
2587	case IEEE80211_S_RUN:
2588		if (ic->ic_opmode == IEEE80211_M_STA)
2589			break;
2590		/*FALLTHROUGH*/
2591	case IEEE80211_S_AUTH:
2592		atw_write_bssid(sc);
2593		atw_write_ssid(sc);
2594		atw_write_sup_rates(sc);
2595
2596		if (ic->ic_opmode == IEEE80211_M_AHDEMO ||
2597		    ic->ic_opmode == IEEE80211_M_MONITOR)
2598			break;
2599
2600		/* set listen interval
2601		 * XXX do software units agree w/ hardware?
2602		 */
2603		ATW_WRITE(sc, ATW_BPLI,
2604		    LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2605		    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval,
2606			   ATW_BPLI_LI_MASK));
2607
2608		DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n",
2609		    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_BPLI)));
2610
2611		atw_tsf(sc);
2612		break;
2613	}
2614
2615	if (nstate != IEEE80211_S_SCAN)
2616		callout_stop(&sc->sc_scan_ch);
2617
2618	if (nstate == IEEE80211_S_RUN &&
2619	    (ic->ic_opmode == IEEE80211_M_HOSTAP ||
2620	     ic->ic_opmode == IEEE80211_M_IBSS))
2621		atw_start_beacon(sc, 1);
2622	else
2623		atw_start_beacon(sc, 0);
2624
2625	error = (*sc->sc_newstate)(ic, nstate, arg);
2626
2627	if (ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_SCAN)
2628		atw_write_bssid(sc);
2629
2630	return error;
2631}
2632
2633/*
2634 * atw_add_rxbuf:
2635 *
2636 *	Add a receive buffer to the indicated descriptor.
2637 */
2638int
2639atw_add_rxbuf(struct atw_softc *sc, int idx)
2640{
2641	struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
2642	struct mbuf *m;
2643	int error;
2644
2645	MGETHDR(m, M_DONTWAIT, MT_DATA);
2646	if (m == NULL)
2647		return (ENOBUFS);
2648
2649	MCLGET(m, M_DONTWAIT);
2650	if ((m->m_flags & M_EXT) == 0) {
2651		m_freem(m);
2652		return (ENOBUFS);
2653	}
2654
2655	if (rxs->rxs_mbuf != NULL)
2656		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2657
2658	rxs->rxs_mbuf = m;
2659
2660	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
2661	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
2662	    BUS_DMA_READ|BUS_DMA_NOWAIT);
2663	if (error) {
2664		printf("%s: can't load rx DMA map %d, error = %d\n",
2665		    sc->sc_dev.dv_xname, idx, error);
2666		panic("atw_add_rxbuf");	/* XXX */
2667	}
2668
2669	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
2670	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
2671
2672	ATW_INIT_RXDESC(sc, idx);
2673
2674	return (0);
2675}
2676
2677/*
2678 * Release any queued transmit buffers.
2679 */
2680void
2681atw_txdrain(struct atw_softc *sc)
2682{
2683	struct atw_txsoft *txs;
2684
2685	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
2686		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
2687		if (txs->txs_mbuf != NULL) {
2688			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2689			m_freem(txs->txs_mbuf);
2690			txs->txs_mbuf = NULL;
2691		}
2692		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
2693	}
2694	sc->sc_tx_timer = 0;
2695}
2696
2697/*
2698 * atw_stop:		[ ifnet interface function ]
2699 *
2700 *	Stop transmission on the interface.
2701 */
2702void
2703atw_stop(struct ifnet *ifp, int disable)
2704{
2705	struct atw_softc *sc = ifp->if_softc;
2706	struct ieee80211com *ic = &sc->sc_ic;
2707
2708	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2709
2710	/* Disable interrupts. */
2711	ATW_WRITE(sc, ATW_IER, 0);
2712
2713	/* Stop the transmit and receive processes. */
2714	sc->sc_opmode = 0;
2715	ATW_WRITE(sc, ATW_NAR, 0);
2716	DELAY(atw_nar_delay);
2717	ATW_WRITE(sc, ATW_TDBD, 0);
2718	ATW_WRITE(sc, ATW_TDBP, 0);
2719	ATW_WRITE(sc, ATW_RDB, 0);
2720
2721	atw_txdrain(sc);
2722
2723	if (disable) {
2724		atw_rxdrain(sc);
2725		atw_disable(sc);
2726	}
2727
2728	/*
2729	 * Mark the interface down and cancel the watchdog timer.
2730	 */
2731	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2732	ifp->if_timer = 0;
2733
2734	if (!disable)
2735		atw_reset(sc);
2736}
2737
2738/*
2739 * atw_rxdrain:
2740 *
2741 *	Drain the receive queue.
2742 */
2743void
2744atw_rxdrain(struct atw_softc *sc)
2745{
2746	struct atw_rxsoft *rxs;
2747	int i;
2748
2749	for (i = 0; i < ATW_NRXDESC; i++) {
2750		rxs = &sc->sc_rxsoft[i];
2751		if (rxs->rxs_mbuf == NULL)
2752			continue;
2753		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2754		m_freem(rxs->rxs_mbuf);
2755		rxs->rxs_mbuf = NULL;
2756	}
2757}
2758
2759/*
2760 * atw_detach:
2761 *
2762 *	Detach an ADM8211 interface.
2763 */
2764int
2765atw_detach(struct atw_softc *sc)
2766{
2767	struct ifnet *ifp = &sc->sc_ic.ic_if;
2768	struct atw_rxsoft *rxs;
2769	struct atw_txsoft *txs;
2770	int i;
2771
2772	/*
2773	 * Succeed now if there isn't any work to do.
2774	 */
2775	if ((sc->sc_flags & ATWF_ATTACHED) == 0)
2776		return (0);
2777
2778	ieee80211_ifdetach(ifp);
2779	if_detach(ifp);
2780
2781	for (i = 0; i < ATW_NRXDESC; i++) {
2782		rxs = &sc->sc_rxsoft[i];
2783		if (rxs->rxs_mbuf != NULL) {
2784			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2785			m_freem(rxs->rxs_mbuf);
2786			rxs->rxs_mbuf = NULL;
2787		}
2788		bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
2789	}
2790	for (i = 0; i < ATW_TXQUEUELEN; i++) {
2791		txs = &sc->sc_txsoft[i];
2792		if (txs->txs_mbuf != NULL) {
2793			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2794			m_freem(txs->txs_mbuf);
2795			txs->txs_mbuf = NULL;
2796		}
2797		bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
2798	}
2799	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
2800	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
2801	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
2802	    sizeof(struct atw_control_data));
2803	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
2804
2805	shutdownhook_disestablish(sc->sc_sdhook);
2806	powerhook_disestablish(sc->sc_powerhook);
2807
2808	if (sc->sc_srom)
2809		free(sc->sc_srom, M_DEVBUF);
2810
2811	return (0);
2812}
2813
2814/* atw_shutdown: make sure the interface is stopped at reboot time. */
2815void
2816atw_shutdown(void *arg)
2817{
2818	struct atw_softc *sc = arg;
2819
2820	atw_stop(&sc->sc_ic.ic_if, 1);
2821}
2822
2823int
2824atw_intr(void *arg)
2825{
2826	struct atw_softc *sc = arg;
2827	struct ifnet *ifp = &sc->sc_ic.ic_if;
2828	u_int32_t status, rxstatus, txstatus, linkstatus;
2829	int handled = 0, txthresh;
2830
2831#ifdef DEBUG
2832	if (ATW_IS_ENABLED(sc) == 0)
2833		panic("%s: atw_intr: not enabled", sc->sc_dev.dv_xname);
2834#endif
2835
2836	/*
2837	 * If the interface isn't running, the interrupt couldn't
2838	 * possibly have come from us.
2839	 */
2840	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2841	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
2842		return (0);
2843
2844	for (;;) {
2845		status = ATW_READ(sc, ATW_STSR);
2846
2847		if (status)
2848			ATW_WRITE(sc, ATW_STSR, status);
2849
2850#ifdef ATW_DEBUG
2851#define PRINTINTR(flag) do { \
2852	if ((status & flag) != 0) { \
2853		printf("%s" #flag, delim); \
2854		delim = ","; \
2855	} \
2856} while (0)
2857
2858		if (atw_debug > 1 && status) {
2859			const char *delim = "<";
2860
2861			printf("%s: reg[STSR] = %x",
2862			    sc->sc_dev.dv_xname, status);
2863
2864			PRINTINTR(ATW_INTR_FBE);
2865			PRINTINTR(ATW_INTR_LINKOFF);
2866			PRINTINTR(ATW_INTR_LINKON);
2867			PRINTINTR(ATW_INTR_RCI);
2868			PRINTINTR(ATW_INTR_RDU);
2869			PRINTINTR(ATW_INTR_REIS);
2870			PRINTINTR(ATW_INTR_RPS);
2871			PRINTINTR(ATW_INTR_TCI);
2872			PRINTINTR(ATW_INTR_TDU);
2873			PRINTINTR(ATW_INTR_TLT);
2874			PRINTINTR(ATW_INTR_TPS);
2875			PRINTINTR(ATW_INTR_TRT);
2876			PRINTINTR(ATW_INTR_TUF);
2877			PRINTINTR(ATW_INTR_BCNTC);
2878			PRINTINTR(ATW_INTR_ATIME);
2879			PRINTINTR(ATW_INTR_TBTT);
2880			PRINTINTR(ATW_INTR_TSCZ);
2881			PRINTINTR(ATW_INTR_TSFTF);
2882			printf(">\n");
2883		}
2884#undef PRINTINTR
2885#endif /* ATW_DEBUG */
2886
2887		if ((status & sc->sc_inten) == 0)
2888			break;
2889
2890		handled = 1;
2891
2892		rxstatus = status & sc->sc_rxint_mask;
2893		txstatus = status & sc->sc_txint_mask;
2894		linkstatus = status & sc->sc_linkint_mask;
2895
2896		if (linkstatus) {
2897			atw_linkintr(sc, linkstatus);
2898		}
2899
2900		if (rxstatus) {
2901			/* Grab any new packets. */
2902			atw_rxintr(sc);
2903
2904			if (rxstatus & ATW_INTR_RDU) {
2905				printf("%s: receive ring overrun\n",
2906				    sc->sc_dev.dv_xname);
2907				/* Get the receive process going again. */
2908				ATW_WRITE(sc, ATW_RDR, 0x1);
2909				break;
2910			}
2911		}
2912
2913		if (txstatus) {
2914			/* Sweep up transmit descriptors. */
2915			atw_txintr(sc);
2916
2917			if (txstatus & ATW_INTR_TLT)
2918				DPRINTF(sc, ("%s: tx lifetime exceeded\n",
2919				    sc->sc_dev.dv_xname));
2920
2921			if (txstatus & ATW_INTR_TRT)
2922				DPRINTF(sc, ("%s: tx retry limit exceeded\n",
2923				    sc->sc_dev.dv_xname));
2924
2925			/* If Tx under-run, increase our transmit threshold
2926			 * if another is available.
2927			 */
2928			txthresh = sc->sc_txthresh + 1;
2929			if ((txstatus & ATW_INTR_TUF) &&
2930			    sc->sc_txth[txthresh].txth_name != NULL) {
2931				/* Idle the transmit process. */
2932				atw_idle(sc, ATW_NAR_ST);
2933
2934				sc->sc_txthresh = txthresh;
2935				sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
2936				sc->sc_opmode |=
2937				    sc->sc_txth[txthresh].txth_opmode;
2938				printf("%s: transmit underrun; new "
2939				    "threshold: %s\n", sc->sc_dev.dv_xname,
2940				    sc->sc_txth[txthresh].txth_name);
2941
2942				/* Set the new threshold and restart
2943				 * the transmit process.
2944				 */
2945				ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2946				DELAY(atw_nar_delay);
2947				ATW_WRITE(sc, ATW_RDR, 0x1);
2948				/* XXX Log every Nth underrun from
2949				 * XXX now on?
2950				 */
2951			}
2952		}
2953
2954		if (status & (ATW_INTR_TPS|ATW_INTR_RPS)) {
2955			if (status & ATW_INTR_TPS)
2956				printf("%s: transmit process stopped\n",
2957				    sc->sc_dev.dv_xname);
2958			if (status & ATW_INTR_RPS)
2959				printf("%s: receive process stopped\n",
2960				    sc->sc_dev.dv_xname);
2961			(void)atw_init(ifp);
2962			break;
2963		}
2964
2965		if (status & ATW_INTR_FBE) {
2966			printf("%s: fatal bus error\n", sc->sc_dev.dv_xname);
2967			(void)atw_init(ifp);
2968			break;
2969		}
2970
2971		/*
2972		 * Not handled:
2973		 *
2974		 *	Transmit buffer unavailable -- normal
2975		 *	condition, nothing to do, really.
2976		 *
2977		 *	Early receive interrupt -- not available on
2978		 *	all chips, we just use RI.  We also only
2979		 *	use single-segment receive DMA, so this
2980		 *	is mostly useless.
2981		 *
2982		 *      TBD others
2983		 */
2984	}
2985
2986	/* Try to get more packets going. */
2987	atw_start(ifp);
2988
2989	return (handled);
2990}
2991
2992/*
2993 * atw_idle:
2994 *
2995 *	Cause the transmit and/or receive processes to go idle.
2996 *
2997 *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
2998 *	process in STSR if I clear SR or ST after the process has already
2999 *	ceased. Fair enough. But the Rx process status bits in ATW_TEST0
3000 *      do not seem to be too reliable. Perhaps I have the sense of the
3001 *	Rx bits switched with the Tx bits?
3002 */
3003void
3004atw_idle(struct atw_softc *sc, u_int32_t bits)
3005{
3006	u_int32_t ackmask = 0, opmode, stsr, test0;
3007	int i, s;
3008
3009	s = splnet();
3010
3011	opmode = sc->sc_opmode & ~bits;
3012
3013	if (bits & ATW_NAR_SR)
3014		ackmask |= ATW_INTR_RPS;
3015
3016	if (bits & ATW_NAR_ST) {
3017		ackmask |= ATW_INTR_TPS;
3018		/* set ATW_NAR_HF to flush TX FIFO. */
3019		opmode |= ATW_NAR_HF;
3020	}
3021
3022	ATW_WRITE(sc, ATW_NAR, opmode);
3023	DELAY(atw_nar_delay);
3024
3025	for (i = 0; i < 1000; i++) {
3026		stsr = ATW_READ(sc, ATW_STSR);
3027		if ((stsr & ackmask) == ackmask)
3028			break;
3029		DELAY(10);
3030	}
3031
3032	ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
3033
3034	if ((stsr & ackmask) == ackmask)
3035		goto out;
3036
3037	test0 = ATW_READ(sc, ATW_TEST0);
3038
3039	if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
3040	    (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
3041		printf("%s: transmit process not idle [%s]\n",
3042		    sc->sc_dev.dv_xname,
3043		    atw_tx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_TS_MASK)]);
3044		printf("%s: bits %08x test0 %08x stsr %08x\n",
3045		    sc->sc_dev.dv_xname, bits, test0, stsr);
3046	}
3047
3048	if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
3049	    (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
3050		DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
3051		    sc->sc_dev.dv_xname,
3052		    atw_rx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_RS_MASK)]));
3053		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
3054		    sc->sc_dev.dv_xname, bits, test0, stsr));
3055	}
3056out:
3057	if ((bits & ATW_NAR_ST) != 0)
3058		atw_txdrain(sc);
3059	splx(s);
3060	return;
3061}
3062
3063/*
3064 * atw_linkintr:
3065 *
3066 *	Helper; handle link-status interrupts.
3067 */
3068void
3069atw_linkintr(struct atw_softc *sc, u_int32_t linkstatus)
3070{
3071	struct ieee80211com *ic = &sc->sc_ic;
3072
3073	if (ic->ic_state != IEEE80211_S_RUN)
3074		return;
3075
3076	if (linkstatus & ATW_INTR_LINKON) {
3077		DPRINTF(sc, ("%s: link on\n", sc->sc_dev.dv_xname));
3078		sc->sc_rescan_timer = 0;
3079	} else if (linkstatus & ATW_INTR_LINKOFF) {
3080		DPRINTF(sc, ("%s: link off\n", sc->sc_dev.dv_xname));
3081		if (ic->ic_opmode != IEEE80211_M_STA)
3082			return;
3083		sc->sc_rescan_timer = 3;
3084		ic->ic_if.if_timer = 1;
3085	}
3086}
3087
3088static __inline int
3089atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame *wh)
3090{
3091	if ((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) == 0)
3092		return 0;
3093	if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
3094		return 0;
3095	return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
3096}
3097
3098/*
3099 * atw_rxintr:
3100 *
3101 *	Helper; handle receive interrupts.
3102 */
3103void
3104atw_rxintr(struct atw_softc *sc)
3105{
3106	static int rate_tbl[] = {2, 4, 11, 22, 44};
3107	struct ieee80211com *ic = &sc->sc_ic;
3108	struct ieee80211_node *ni;
3109	struct ieee80211_frame *wh;
3110	struct ifnet *ifp = &ic->ic_if;
3111	struct atw_rxsoft *rxs;
3112	struct mbuf *m;
3113	u_int32_t rxstat;
3114	int i, len, rate, rate0;
3115	u_int32_t rssi, rssi0;
3116
3117	for (i = sc->sc_rxptr;; i = ATW_NEXTRX(i)) {
3118		rxs = &sc->sc_rxsoft[i];
3119
3120		ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3121
3122		rxstat = le32toh(sc->sc_rxdescs[i].ar_stat);
3123		rssi0 = le32toh(sc->sc_rxdescs[i].ar_rssi);
3124		rate0 = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_RXDR_MASK);
3125
3126		if (rxstat & ATW_RXSTAT_OWN)
3127			break; /* We have processed all receive buffers. */
3128
3129		DPRINTF3(sc,
3130		    ("%s: rx stat %08x rssi0 %08x buf1 %08x buf2 %08x\n",
3131		    sc->sc_dev.dv_xname,
3132		    rxstat, rssi0,
3133		    le32toh(sc->sc_rxdescs[i].ar_buf1),
3134		    le32toh(sc->sc_rxdescs[i].ar_buf2)));
3135
3136		/*
3137		 * Make sure the packet fits in one buffer.  This should
3138		 * always be the case.
3139		 */
3140		if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=
3141		    (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {
3142			printf("%s: incoming packet spilled, resetting\n",
3143			    sc->sc_dev.dv_xname);
3144			(void)atw_init(ifp);
3145			return;
3146		}
3147
3148		/*
3149		 * If an error occurred, update stats, clear the status
3150		 * word, and leave the packet buffer in place.  It will
3151		 * simply be reused the next time the ring comes around.
3152	 	 * If 802.1Q VLAN MTU is enabled, ignore the Frame Too Long
3153		 * error.
3154		 */
3155
3156		if ((rxstat & ATW_RXSTAT_ES) != 0 &&
3157		    ((sc->sc_ic.ic_ec.ec_capenable & ETHERCAP_VLAN_MTU) == 0 ||
3158		     (rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_SFDE |
3159		                ATW_RXSTAT_SIGE | ATW_RXSTAT_CRC16E |
3160				ATW_RXSTAT_RXTOE | ATW_RXSTAT_CRC32E |
3161				ATW_RXSTAT_ICVE)) != 0)) {
3162#define	PRINTERR(bit, str)						\
3163			if (rxstat & (bit))				\
3164				printf("%s: receive error: %s\n",	\
3165				    sc->sc_dev.dv_xname, str)
3166			ifp->if_ierrors++;
3167			PRINTERR(ATW_RXSTAT_DE, "descriptor error");
3168			PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
3169			PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
3170			PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
3171			PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
3172			PRINTERR(ATW_RXSTAT_CRC32E, "FCS error");
3173			PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
3174#undef PRINTERR
3175			ATW_INIT_RXDESC(sc, i);
3176			continue;
3177		}
3178
3179		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3180		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
3181
3182		/*
3183		 * No errors; receive the packet.  Note the ADM8211
3184		 * includes the CRC in promiscuous mode.
3185		 */
3186		len = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_FL_MASK);
3187
3188		/*
3189		 * Allocate a new mbuf cluster.  If that fails, we are
3190		 * out of memory, and must drop the packet and recycle
3191		 * the buffer that's already attached to this descriptor.
3192		 */
3193		m = rxs->rxs_mbuf;
3194		if (atw_add_rxbuf(sc, i) != 0) {
3195			ifp->if_ierrors++;
3196			ATW_INIT_RXDESC(sc, i);
3197			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3198			    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
3199			continue;
3200		}
3201
3202		ifp->if_ipackets++;
3203		if (sc->sc_opmode & ATW_NAR_PR)
3204			m->m_flags |= M_HASFCS;
3205		m->m_pkthdr.rcvif = ifp;
3206		m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
3207
3208		if (rate0 >= sizeof(rate_tbl) / sizeof(rate_tbl[0]))
3209			rate = 0;
3210		else
3211			rate = rate_tbl[rate0];
3212
3213		/* The RSSI comes straight from a register in the
3214		 * baseband processor.  I know that for the RF3000,
3215		 * the RSSI register also contains the antenna-selection
3216		 * bits.  Mask those off.
3217		 *
3218		 * TBD Treat other basebands.
3219		 */
3220		if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
3221			rssi = rssi0 & RF3000_RSSI_MASK;
3222		else
3223			rssi = rssi0;
3224
3225 #if NBPFILTER > 0
3226		/* Pass this up to any BPF listeners. */
3227		if (sc->sc_radiobpf != NULL) {
3228			struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
3229
3230			tap->ar_rate = rate;
3231			tap->ar_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3232			tap->ar_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3233
3234			/* TBD verify units are dB */
3235			tap->ar_antsignal = (int)rssi;
3236			/* TBD tap->ar_flags */
3237
3238			bpf_mtap2(sc->sc_radiobpf, (caddr_t)tap,
3239			    tap->ar_ihdr.it_len, m);
3240 		}
3241 #endif /* NPBFILTER > 0 */
3242
3243		wh = mtod(m, struct ieee80211_frame *);
3244		ni = ieee80211_find_rxnode(ic, wh);
3245		if (atw_hw_decrypted(sc, wh))
3246			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
3247		ieee80211_input(ifp, m, ni, (int)rssi, 0);
3248		/*
3249		 * The frame may have caused the node to be marked for
3250		 * reclamation (e.g. in response to a DEAUTH message)
3251		 * so use free_node here instead of unref_node.
3252		 */
3253		if (ni == ic->ic_bss)
3254			ieee80211_unref_node(&ni);
3255		else
3256			ieee80211_free_node(ic, ni);
3257	}
3258
3259	/* Update the receive pointer. */
3260	sc->sc_rxptr = i;
3261}
3262
3263/*
3264 * atw_txintr:
3265 *
3266 *	Helper; handle transmit interrupts.
3267 */
3268void
3269atw_txintr(struct atw_softc *sc)
3270{
3271#define TXSTAT_ERRMASK (ATW_TXSTAT_TUF | ATW_TXSTAT_TLT | ATW_TXSTAT_TRT | \
3272    ATW_TXSTAT_TRO | ATW_TXSTAT_SOFBR)
3273#define TXSTAT_FMT "\20\31ATW_TXSTAT_SOFBR\32ATW_TXSTAT_TRO\33ATW_TXSTAT_TUF" \
3274    "\34ATW_TXSTAT_TRT\35ATW_TXSTAT_TLT"
3275
3276	static char txstat_buf[sizeof("ffffffff<>" TXSTAT_FMT)];
3277	struct ifnet *ifp = &sc->sc_ic.ic_if;
3278	struct atw_txsoft *txs;
3279	u_int32_t txstat;
3280
3281	DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
3282	    sc->sc_dev.dv_xname, sc->sc_flags));
3283
3284	ifp->if_flags &= ~IFF_OACTIVE;
3285
3286	/*
3287	 * Go through our Tx list and free mbufs for those
3288	 * frames that have been transmitted.
3289	 */
3290	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
3291		ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
3292		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3293
3294#ifdef ATW_DEBUG
3295		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3296			int i;
3297			printf("    txsoft %p transmit chain:\n", txs);
3298			ATW_CDTXSYNC(sc, txs->txs_firstdesc,
3299			    txs->txs_ndescs - 1,
3300			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3301			for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
3302				printf("     descriptor %d:\n", i);
3303				printf("       at_status:   0x%08x\n",
3304				    le32toh(sc->sc_txdescs[i].at_stat));
3305				printf("       at_flags:      0x%08x\n",
3306				    le32toh(sc->sc_txdescs[i].at_flags));
3307				printf("       at_buf1: 0x%08x\n",
3308				    le32toh(sc->sc_txdescs[i].at_buf1));
3309				printf("       at_buf2: 0x%08x\n",
3310				    le32toh(sc->sc_txdescs[i].at_buf2));
3311				if (i == txs->txs_lastdesc)
3312					break;
3313			}
3314		}
3315#endif
3316
3317		txstat = le32toh(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
3318		if (txstat & ATW_TXSTAT_OWN)
3319			break;
3320
3321		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
3322
3323		sc->sc_txfree += txs->txs_ndescs;
3324
3325		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
3326		    0, txs->txs_dmamap->dm_mapsize,
3327		    BUS_DMASYNC_POSTWRITE);
3328		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
3329		m_freem(txs->txs_mbuf);
3330		txs->txs_mbuf = NULL;
3331
3332		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
3333
3334		if ((ifp->if_flags & IFF_DEBUG) != 0 &&
3335		    (txstat & TXSTAT_ERRMASK) != 0) {
3336			bitmask_snprintf(txstat & TXSTAT_ERRMASK, TXSTAT_FMT,
3337			    txstat_buf, sizeof(txstat_buf));
3338			printf("%s: txstat %s %d\n", sc->sc_dev.dv_xname,
3339			    txstat_buf,
3340			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK));
3341		}
3342
3343		/*
3344		 * Check for errors and collisions.
3345		 */
3346		if (txstat & ATW_TXSTAT_TUF)
3347			sc->sc_stats.ts_tx_tuf++;
3348		if (txstat & ATW_TXSTAT_TLT)
3349			sc->sc_stats.ts_tx_tlt++;
3350		if (txstat & ATW_TXSTAT_TRT)
3351			sc->sc_stats.ts_tx_trt++;
3352		if (txstat & ATW_TXSTAT_TRO)
3353			sc->sc_stats.ts_tx_tro++;
3354		if (txstat & ATW_TXSTAT_SOFBR) {
3355			sc->sc_stats.ts_tx_sofbr++;
3356		}
3357
3358		if ((txstat & ATW_TXSTAT_ES) == 0)
3359			ifp->if_collisions +=
3360			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK);
3361		else
3362			ifp->if_oerrors++;
3363
3364		ifp->if_opackets++;
3365	}
3366
3367	/*
3368	 * If there are no more pending transmissions, cancel the watchdog
3369	 * timer.
3370	 */
3371	if (txs == NULL)
3372		sc->sc_tx_timer = 0;
3373#undef TXSTAT_ERRMASK
3374#undef TXSTAT_FMT
3375}
3376
3377/*
3378 * atw_watchdog:	[ifnet interface function]
3379 *
3380 *	Watchdog timer handler.
3381 */
3382void
3383atw_watchdog(struct ifnet *ifp)
3384{
3385	struct atw_softc *sc = ifp->if_softc;
3386	struct ieee80211com *ic = &sc->sc_ic;
3387
3388	ifp->if_timer = 0;
3389	if (ATW_IS_ENABLED(sc) == 0)
3390		return;
3391
3392	if (sc->sc_rescan_timer) {
3393		if (--sc->sc_rescan_timer == 0)
3394			(void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3395	}
3396	if (sc->sc_tx_timer) {
3397		if (--sc->sc_tx_timer == 0 &&
3398		    !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
3399			printf("%s: transmit timeout\n", ifp->if_xname);
3400			ifp->if_oerrors++;
3401			(void)atw_init(ifp);
3402			atw_start(ifp);
3403		}
3404	}
3405	if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
3406		ifp->if_timer = 1;
3407	ieee80211_watchdog(ifp);
3408}
3409
3410/* Compute the 802.11 Duration field and the PLCP Length fields for
3411 * a len-byte frame (HEADER + PAYLOAD + FCS) sent at rate * 500Kbps.
3412 * Write the fields to the ADM8211 Tx header, frm.
3413 *
3414 * TBD use the fragmentation threshold to find the right duration for
3415 * the first & last fragments.
3416 *
3417 * TBD make certain of the duration fields applied by the ADM8211 to each
3418 * fragment. I think that the ADM8211 knows how to subtract the CTS
3419 * duration when ATW_HDRCTL_RTSCTS is clear; that is why I add it regardless.
3420 * I also think that the ADM8211 does *some* arithmetic for us, because
3421 * otherwise I think we would have to set a first duration for CTS/first
3422 * fragment, a second duration for fragments between the first and the
3423 * last, and a third duration for the last fragment.
3424 *
3425 * TBD make certain that duration fields reflect addition of FCS/WEP
3426 * and correct duration arithmetic as necessary.
3427 */
3428static void
3429atw_frame_setdurs(struct atw_softc *sc, struct atw_frame *frm, int rate,
3430    int len)
3431{
3432	int remainder;
3433
3434	/* deal also with encrypted fragments */
3435	if (frm->atw_hdrctl & htole16(ATW_HDRCTL_WEP)) {
3436		DPRINTF2(sc, ("%s: atw_frame_setdurs len += 8\n",
3437		    sc->sc_dev.dv_xname));
3438		len += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
3439		       IEEE80211_WEP_CRCLEN;
3440	}
3441
3442	/* 802.11 Duration Field for CTS/Data/ACK sequence minus FCS & WEP
3443	 * duration (XXX added by MAC?).
3444	 */
3445	frm->atw_head_dur = (16 * (len - IEEE80211_CRC_LEN)) / rate;
3446	remainder = (16 * (len - IEEE80211_CRC_LEN)) % rate;
3447
3448	if (rate <= 4)
3449		/* 1-2Mbps WLAN: send ACK/CTS at 1Mbps */
3450		frm->atw_head_dur += 3 * (IEEE80211_DUR_DS_SIFS +
3451		    IEEE80211_DUR_DS_SHORT_PREAMBLE +
3452		    IEEE80211_DUR_DS_FAST_PLCPHDR) +
3453		    IEEE80211_DUR_DS_SLOW_CTS + IEEE80211_DUR_DS_SLOW_ACK;
3454	else
3455		/* 5-11Mbps WLAN: send ACK/CTS at 2Mbps */
3456		frm->atw_head_dur += 3 * (IEEE80211_DUR_DS_SIFS +
3457		    IEEE80211_DUR_DS_SHORT_PREAMBLE +
3458		    IEEE80211_DUR_DS_FAST_PLCPHDR) +
3459		    IEEE80211_DUR_DS_FAST_CTS + IEEE80211_DUR_DS_FAST_ACK;
3460
3461	/* lengthen duration if long preamble */
3462	if ((sc->sc_flags & ATWF_SHORT_PREAMBLE) == 0)
3463		frm->atw_head_dur +=
3464		    3 * (IEEE80211_DUR_DS_LONG_PREAMBLE -
3465		         IEEE80211_DUR_DS_SHORT_PREAMBLE) +
3466		    3 * (IEEE80211_DUR_DS_SLOW_PLCPHDR -
3467		         IEEE80211_DUR_DS_FAST_PLCPHDR);
3468
3469	if (remainder != 0)
3470		frm->atw_head_dur++;
3471
3472	if ((atw_voodoo & VOODOO_DUR_2_4_SPECIALCASE) &&
3473	    (rate == 2 || rate == 4)) {
3474		/* derived from Linux: how could this be right? */
3475		frm->atw_head_plcplen = frm->atw_head_dur;
3476	} else {
3477		frm->atw_head_plcplen = (16 * len) / rate;
3478		remainder = (80 * len) % (rate * 5);
3479
3480		if (remainder != 0) {
3481			frm->atw_head_plcplen++;
3482
3483			/* XXX magic */
3484			if ((atw_voodoo & VOODOO_DUR_11_ROUNDING) &&
3485			    rate == 22 && remainder <= 30)
3486				frm->atw_head_plcplen |= 0x8000;
3487		}
3488	}
3489	frm->atw_tail_plcplen = frm->atw_head_plcplen =
3490	    htole16(frm->atw_head_plcplen);
3491	frm->atw_tail_dur = frm->atw_head_dur = htole16(frm->atw_head_dur);
3492}
3493
3494#ifdef ATW_DEBUG
3495static void
3496atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
3497{
3498	struct atw_softc *sc = ifp->if_softc;
3499	struct mbuf *m;
3500	int i, noctets = 0;
3501
3502	printf("%s: %d-byte packet\n", sc->sc_dev.dv_xname,
3503	    m0->m_pkthdr.len);
3504
3505	for (m = m0; m; m = m->m_next) {
3506		if (m->m_len == 0)
3507			continue;
3508		for (i = 0; i < m->m_len; i++) {
3509			printf(" %02x", ((u_int8_t*)m->m_data)[i]);
3510			if (++noctets % 24 == 0)
3511				printf("\n");
3512		}
3513	}
3514	printf("%s%s: %d bytes emitted\n",
3515	    (noctets % 24 != 0) ? "\n" : "", sc->sc_dev.dv_xname, noctets);
3516}
3517#endif /* ATW_DEBUG */
3518
3519/*
3520 * atw_start:		[ifnet interface function]
3521 *
3522 *	Start packet transmission on the interface.
3523 */
3524void
3525atw_start(struct ifnet *ifp)
3526{
3527	struct atw_softc *sc = ifp->if_softc;
3528	struct ieee80211com *ic = &sc->sc_ic;
3529	struct ieee80211_node *ni;
3530	struct ieee80211_frame *wh;
3531	struct atw_frame *hh;
3532	struct mbuf *m0, *m;
3533	struct atw_txsoft *txs, *last_txs;
3534	struct atw_txdesc *txd;
3535	int do_encrypt, rate;
3536	bus_dmamap_t dmamap;
3537	int ctl, error, firsttx, nexttx, lasttx = -1, first, ofree, seg;
3538
3539	DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
3540	    sc->sc_dev.dv_xname, sc->sc_flags, ifp->if_flags));
3541
3542	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3543		return;
3544
3545	/*
3546	 * Remember the previous number of free descriptors and
3547	 * the first descriptor we'll use.
3548	 */
3549	ofree = sc->sc_txfree;
3550	firsttx = sc->sc_txnext;
3551
3552	DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
3553	    sc->sc_dev.dv_xname, ofree, firsttx));
3554
3555	/*
3556	 * Loop through the send queue, setting up transmit descriptors
3557	 * until we drain the queue, or use up all available transmit
3558	 * descriptors.
3559	 */
3560	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
3561	       sc->sc_txfree != 0) {
3562
3563		/*
3564		 * Grab a packet off the management queue, if it
3565		 * is not empty. Otherwise, from the data queue.
3566		 */
3567		IF_DEQUEUE(&ic->ic_mgtq, m0);
3568		if (m0 != NULL) {
3569			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
3570			m0->m_pkthdr.rcvif = NULL;
3571		} else {
3572			/* send no data packets until we are associated */
3573			if (ic->ic_state != IEEE80211_S_RUN)
3574				break;
3575			IFQ_DEQUEUE(&ifp->if_snd, m0);
3576			if (m0 == NULL)
3577				break;
3578#if NBPFILTER > 0
3579			if (ifp->if_bpf != NULL)
3580				bpf_mtap(ifp->if_bpf, m0);
3581#endif /* NBPFILTER > 0 */
3582			if ((m0 = ieee80211_encap(ifp, m0, &ni)) == NULL) {
3583				ifp->if_oerrors++;
3584				break;
3585			}
3586		}
3587
3588		rate = MAX(ieee80211_get_rate(ic), 2);
3589
3590#if NBPFILTER > 0
3591		/*
3592		 * Pass the packet to any BPF listeners.
3593		 */
3594		if (ic->ic_rawbpf != NULL)
3595			bpf_mtap((caddr_t)ic->ic_rawbpf, m0);
3596
3597		if (sc->sc_radiobpf != NULL) {
3598			struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
3599
3600			tap->at_rate = rate;
3601			tap->at_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3602			tap->at_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3603
3604			/* TBD tap->at_flags */
3605
3606			bpf_mtap2(sc->sc_radiobpf, (caddr_t)tap,
3607			    tap->at_ihdr.it_len, m0);
3608		}
3609#endif /* NBPFILTER > 0 */
3610
3611		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
3612
3613		if (ni != NULL && ni != ic->ic_bss)
3614			ieee80211_free_node(ic, ni);
3615
3616		if (m0 == NULL) {
3617			ifp->if_oerrors++;
3618			break;
3619		}
3620
3621		/* just to make sure. */
3622		m0 = m_pullup(m0, sizeof(struct atw_frame));
3623
3624		if (m0 == NULL) {
3625			ifp->if_oerrors++;
3626			break;
3627		}
3628
3629		hh = mtod(m0, struct atw_frame *);
3630		wh = &hh->atw_ihdr;
3631
3632		do_encrypt = ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0) ? 1 : 0;
3633
3634		/* Copy everything we need from the 802.11 header:
3635		 * Frame Control; address 1, address 3, or addresses
3636		 * 3 and 4. NIC fills in BSSID, SA.
3637		 */
3638		if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
3639			if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
3640				panic("%s: illegal WDS frame",
3641				    sc->sc_dev.dv_xname);
3642			memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
3643		} else
3644			memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
3645
3646		*(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;
3647
3648		/* initialize remaining Tx parameters */
3649		memset(&hh->u, 0, sizeof(hh->u));
3650
3651		hh->atw_rate = rate * 5;
3652		/* XXX this could be incorrect if M_FCS. _encap should
3653		 * probably strip FCS just in case it sticks around in
3654		 * bridged packets.
3655		 */
3656		hh->atw_service = IEEE80211_PLCP_SERVICE; /* XXX guess */
3657		hh->atw_paylen = htole16(m0->m_pkthdr.len -
3658		    sizeof(struct atw_frame));
3659
3660		hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3661		hh->atw_rtylmt = 3;
3662		hh->atw_hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
3663		if (do_encrypt) {
3664			hh->atw_hdrctl |= htole16(ATW_HDRCTL_WEP);
3665			hh->atw_keyid = ic->ic_wep_txkey;
3666		}
3667
3668		/* TBD 4-addr frames */
3669		atw_frame_setdurs(sc, hh, rate,
3670		    m0->m_pkthdr.len - sizeof(struct atw_frame) +
3671		    sizeof(struct ieee80211_frame) + IEEE80211_CRC_LEN);
3672
3673		/* never fragment multicast frames */
3674		if (IEEE80211_IS_MULTICAST(hh->atw_dst)) {
3675			hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3676		} else if (sc->sc_flags & ATWF_RTSCTS) {
3677			hh->atw_hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
3678		}
3679
3680#ifdef ATW_DEBUG
3681		hh->atw_fragnum = 0;
3682
3683		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3684			printf("%s: dst = %s, rate = 0x%02x, "
3685			    "service = 0x%02x, paylen = 0x%04x\n",
3686			    sc->sc_dev.dv_xname, ether_sprintf(hh->atw_dst),
3687			    hh->atw_rate, hh->atw_service, hh->atw_paylen);
3688
3689			printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
3690			    "dur1 = 0x%04x, dur2 = 0x%04x, "
3691			    "dur3 = 0x%04x, rts_dur = 0x%04x\n",
3692			    sc->sc_dev.dv_xname, hh->atw_fc[0], hh->atw_fc[1],
3693			    hh->atw_tail_plcplen, hh->atw_head_plcplen,
3694			    hh->atw_tail_dur, hh->atw_head_dur);
3695
3696			printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
3697			    "fragnum = 0x%02x, rtylmt = 0x%04x\n",
3698			    sc->sc_dev.dv_xname, hh->atw_hdrctl,
3699			    hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
3700
3701			printf("%s: keyid = %d\n",
3702			    sc->sc_dev.dv_xname, hh->atw_keyid);
3703
3704			atw_dump_pkt(ifp, m0);
3705		}
3706#endif /* ATW_DEBUG */
3707
3708		dmamap = txs->txs_dmamap;
3709
3710		/*
3711		 * Load the DMA map.  Copy and try (once) again if the packet
3712		 * didn't fit in the alloted number of segments.
3713		 */
3714		for (first = 1;
3715		     (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
3716		                  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;
3717		     first = 0) {
3718			MGETHDR(m, M_DONTWAIT, MT_DATA);
3719			if (m == NULL) {
3720				printf("%s: unable to allocate Tx mbuf\n",
3721				    sc->sc_dev.dv_xname);
3722				break;
3723			}
3724			if (m0->m_pkthdr.len > MHLEN) {
3725				MCLGET(m, M_DONTWAIT);
3726				if ((m->m_flags & M_EXT) == 0) {
3727					printf("%s: unable to allocate Tx "
3728					    "cluster\n", sc->sc_dev.dv_xname);
3729					m_freem(m);
3730					break;
3731				}
3732			}
3733			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
3734			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3735			m_freem(m0);
3736			m0 = m;
3737			m = NULL;
3738		}
3739		if (error != 0) {
3740			printf("%s: unable to load Tx buffer, "
3741			    "error = %d\n", sc->sc_dev.dv_xname, error);
3742			m_freem(m0);
3743			break;
3744		}
3745
3746		/*
3747		 * Ensure we have enough descriptors free to describe
3748		 * the packet.
3749		 */
3750		if (dmamap->dm_nsegs > sc->sc_txfree) {
3751			/*
3752			 * Not enough free descriptors to transmit
3753			 * this packet.  Unload the DMA map and
3754			 * drop the packet.  Notify the upper layer
3755			 * that there are no more slots left.
3756			 *
3757			 * XXX We could allocate an mbuf and copy, but
3758			 * XXX it is worth it?
3759			 */
3760			ifp->if_flags |= IFF_OACTIVE;
3761			bus_dmamap_unload(sc->sc_dmat, dmamap);
3762			m_freem(m0);
3763			break;
3764		}
3765
3766		/*
3767		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
3768		 */
3769
3770		/* Sync the DMA map. */
3771		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
3772		    BUS_DMASYNC_PREWRITE);
3773
3774		/* XXX arbitrary retry limit; 8 because I have seen it in
3775		 * use already and maybe 0 means "no tries" !
3776		 */
3777		ctl = htole32(LSHIFT(8, ATW_TXCTL_TL_MASK));
3778
3779		DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
3780		    sc->sc_dev.dv_xname, rate * 5));
3781		ctl |= htole32(LSHIFT(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
3782
3783		/*
3784		 * Initialize the transmit descriptors.
3785		 */
3786		for (nexttx = sc->sc_txnext, seg = 0;
3787		     seg < dmamap->dm_nsegs;
3788		     seg++, nexttx = ATW_NEXTTX(nexttx)) {
3789			/*
3790			 * If this is the first descriptor we're
3791			 * enqueueing, don't set the OWN bit just
3792			 * yet.  That could cause a race condition.
3793			 * We'll do it below.
3794			 */
3795			txd = &sc->sc_txdescs[nexttx];
3796			txd->at_ctl = ctl |
3797			    ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
3798
3799			txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
3800			txd->at_flags =
3801			    htole32(LSHIFT(dmamap->dm_segs[seg].ds_len,
3802			                   ATW_TXFLAG_TBS1_MASK)) |
3803			    ((nexttx == (ATW_NTXDESC - 1))
3804			        ? htole32(ATW_TXFLAG_TER) : 0);
3805			lasttx = nexttx;
3806		}
3807
3808		IASSERT(lasttx != -1, ("bad lastx"));
3809		/* Set `first segment' and `last segment' appropriately. */
3810		sc->sc_txdescs[sc->sc_txnext].at_flags |=
3811		    htole32(ATW_TXFLAG_FS);
3812		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
3813
3814#ifdef ATW_DEBUG
3815		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3816			printf("     txsoft %p transmit chain:\n", txs);
3817			for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
3818				printf("     descriptor %d:\n", seg);
3819				printf("       at_ctl:   0x%08x\n",
3820				    le32toh(sc->sc_txdescs[seg].at_ctl));
3821				printf("       at_flags:      0x%08x\n",
3822				    le32toh(sc->sc_txdescs[seg].at_flags));
3823				printf("       at_buf1: 0x%08x\n",
3824				    le32toh(sc->sc_txdescs[seg].at_buf1));
3825				printf("       at_buf2: 0x%08x\n",
3826				    le32toh(sc->sc_txdescs[seg].at_buf2));
3827				if (seg == lasttx)
3828					break;
3829			}
3830		}
3831#endif
3832
3833		/* Sync the descriptors we're using. */
3834		ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
3835		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3836
3837		/*
3838		 * Store a pointer to the packet so we can free it later,
3839		 * and remember what txdirty will be once the packet is
3840		 * done.
3841		 */
3842		txs->txs_mbuf = m0;
3843		txs->txs_firstdesc = sc->sc_txnext;
3844		txs->txs_lastdesc = lasttx;
3845		txs->txs_ndescs = dmamap->dm_nsegs;
3846
3847		/* Advance the tx pointer. */
3848		sc->sc_txfree -= dmamap->dm_nsegs;
3849		sc->sc_txnext = nexttx;
3850
3851		SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
3852		SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
3853
3854		last_txs = txs;
3855	}
3856
3857	if (txs == NULL || sc->sc_txfree == 0) {
3858		/* No more slots left; notify upper layer. */
3859		ifp->if_flags |= IFF_OACTIVE;
3860	}
3861
3862	if (sc->sc_txfree != ofree) {
3863		DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
3864		    sc->sc_dev.dv_xname, lasttx, firsttx));
3865		/*
3866		 * Cause a transmit interrupt to happen on the
3867		 * last packet we enqueued.
3868		 */
3869		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
3870		ATW_CDTXSYNC(sc, lasttx, 1,
3871		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3872
3873		/*
3874		 * The entire packet chain is set up.  Give the
3875		 * first descriptor to the chip now.
3876		 */
3877		sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
3878		ATW_CDTXSYNC(sc, firsttx, 1,
3879		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3880
3881		/* Wake up the transmitter. */
3882		ATW_WRITE(sc, ATW_TDR, 0x1);
3883
3884		/* Set a watchdog timer in case the chip flakes out. */
3885		sc->sc_tx_timer = 5;
3886		ifp->if_timer = 1;
3887	}
3888}
3889
3890/*
3891 * atw_power:
3892 *
3893 *	Power management (suspend/resume) hook.
3894 */
3895void
3896atw_power(int why, void *arg)
3897{
3898	struct atw_softc *sc = arg;
3899	struct ifnet *ifp = &sc->sc_ic.ic_if;
3900	int s;
3901
3902	DPRINTF(sc, ("%s: atw_power(%d,)\n", sc->sc_dev.dv_xname, why));
3903
3904	s = splnet();
3905	switch (why) {
3906	case PWR_STANDBY:
3907		/* XXX do nothing. */
3908		break;
3909	case PWR_SUSPEND:
3910		atw_stop(ifp, 0);
3911		if (sc->sc_power != NULL)
3912			(*sc->sc_power)(sc, why);
3913		break;
3914	case PWR_RESUME:
3915		if (ifp->if_flags & IFF_UP) {
3916			if (sc->sc_power != NULL)
3917				(*sc->sc_power)(sc, why);
3918			atw_init(ifp);
3919		}
3920		break;
3921	case PWR_SOFTSUSPEND:
3922	case PWR_SOFTSTANDBY:
3923	case PWR_SOFTRESUME:
3924		break;
3925	}
3926	splx(s);
3927}
3928
3929/*
3930 * atw_ioctl:		[ifnet interface function]
3931 *
3932 *	Handle control requests from the operator.
3933 */
3934int
3935atw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
3936{
3937	struct atw_softc *sc = ifp->if_softc;
3938	struct ifreq *ifr = (struct ifreq *)data;
3939	int s, error = 0;
3940
3941	/* XXX monkey see, monkey do. comes from wi_ioctl. */
3942	if ((sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
3943		return ENXIO;
3944
3945	s = splnet();
3946
3947	switch (cmd) {
3948	case SIOCSIFFLAGS:
3949		if (ifp->if_flags & IFF_UP) {
3950			if (ATW_IS_ENABLED(sc)) {
3951				/*
3952				 * To avoid rescanning another access point,
3953				 * do not call atw_init() here.  Instead,
3954				 * only reflect media settings.
3955				 */
3956				atw_filter_setup(sc);
3957			} else
3958				error = atw_init(ifp);
3959		} else if (ATW_IS_ENABLED(sc))
3960			atw_stop(ifp, 1);
3961		break;
3962	case SIOCADDMULTI:
3963	case SIOCDELMULTI:
3964		error = (cmd == SIOCADDMULTI) ?
3965		    ether_addmulti(ifr, &sc->sc_ic.ic_ec) :
3966		    ether_delmulti(ifr, &sc->sc_ic.ic_ec);
3967		if (error == ENETRESET) {
3968			if (ATW_IS_ENABLED(sc))
3969				atw_filter_setup(sc); /* do not rescan */
3970			error = 0;
3971		}
3972		break;
3973	default:
3974		error = ieee80211_ioctl(ifp, cmd, data);
3975		if (error == ENETRESET) {
3976			if (ATW_IS_ENABLED(sc))
3977				error = atw_init(ifp);
3978			else
3979				error = 0;
3980		}
3981		break;
3982	}
3983
3984	/* Try to get more packets going. */
3985	if (ATW_IS_ENABLED(sc))
3986		atw_start(ifp);
3987
3988	splx(s);
3989	return (error);
3990}
3991
3992static int
3993atw_media_change(struct ifnet *ifp)
3994{
3995	int error;
3996
3997	error = ieee80211_media_change(ifp);
3998	if (error == ENETRESET) {
3999		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
4000		    (IFF_RUNNING|IFF_UP))
4001			atw_init(ifp);		/* XXX lose error */
4002		error = 0;
4003	}
4004	return error;
4005}
4006
4007static void
4008atw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
4009{
4010	struct atw_softc *sc = ifp->if_softc;
4011
4012	if (ATW_IS_ENABLED(sc) == 0) {
4013		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
4014		imr->ifm_status = 0;
4015		return;
4016	}
4017	ieee80211_media_status(ifp, imr);
4018}
4019