rtw.c revision 1.102
1/* $NetBSD: rtw.c,v 1.102 2008/03/14 23:04:42 dyoung Exp $ */
2/*-
3 * Copyright (c) 2004, 2005, 2006, 2007 David Young.  All rights
4 * reserved.
5 *
6 * Programmed for NetBSD by David Young.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 3. The name of David Young may not be used to endorse or promote
17 *    products derived from this software without specific prior
18 *    written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
21 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
23 * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
24 * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
25 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
26 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
31 * OF SUCH DAMAGE.
32 */
33/*
34 * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
35 */
36
37#include <sys/cdefs.h>
38__KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.102 2008/03/14 23:04:42 dyoung Exp $");
39
40#include "bpfilter.h"
41
42#include <sys/param.h>
43#include <sys/sysctl.h>
44#include <sys/systm.h>
45#include <sys/callout.h>
46#include <sys/mbuf.h>
47#include <sys/malloc.h>
48#include <sys/kernel.h>
49#include <sys/time.h>
50#include <sys/types.h>
51#include <sys/device.h>
52
53#include <machine/endian.h>
54#include <sys/bus.h>
55#include <sys/intr.h>	/* splnet */
56
57#include <uvm/uvm_extern.h>
58
59#include <net/if.h>
60#include <net/if_media.h>
61#include <net/if_ether.h>
62
63#include <net80211/ieee80211_netbsd.h>
64#include <net80211/ieee80211_var.h>
65#include <net80211/ieee80211_radiotap.h>
66
67#if NBPFILTER > 0
68#include <net/bpf.h>
69#endif
70
71#include <dev/ic/rtwreg.h>
72#include <dev/ic/rtwvar.h>
73#include <dev/ic/rtwphyio.h>
74#include <dev/ic/rtwphy.h>
75
76#include <dev/ic/smc93cx6var.h>
77
78static int rtw_rfprog_fallback = 0;
79static int rtw_host_rfio = 0;
80
81#ifdef RTW_DEBUG
82int rtw_debug = 0;
83static int rtw_rxbufs_limit = RTW_RXQLEN;
84#endif /* RTW_DEBUG */
85
86#define NEXT_ATTACH_STATE(sc, state) do {			\
87	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
88	    ("%s: attach state %s\n", __func__, #state));	\
89	sc->sc_attach_state = state;				\
90} while (0)
91
92int rtw_dwelltime = 200;	/* milliseconds */
93static struct ieee80211_cipher rtw_cipher_wep;
94
95static void rtw_disable_interrupts(struct rtw_regs *);
96static void rtw_enable_interrupts(struct rtw_softc *);
97
98static int rtw_init(struct ifnet *);
99
100static void rtw_start(struct ifnet *);
101static void rtw_reset_oactive(struct rtw_softc *);
102static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
103    struct ieee80211_node *);
104static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
105
106static void rtw_io_enable(struct rtw_softc *, uint8_t, int);
107static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
108static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
109    const u_int8_t[IEEE80211_ADDR_LEN]);
110static void rtw_key_update_end(struct ieee80211com *);
111static void rtw_key_update_begin(struct ieee80211com *);
112static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
113static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
114
115static void rtw_led_attach(struct rtw_led_state *, void *);
116static void rtw_led_detach(struct rtw_led_state *);
117static void rtw_led_init(struct rtw_regs *);
118static void rtw_led_slowblink(void *);
119static void rtw_led_fastblink(void *);
120static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
121
122static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
123static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
124#ifdef RTW_DEBUG
125static void rtw_dump_rings(struct rtw_softc *sc);
126static void rtw_print_txdesc(struct rtw_softc *, const char *,
127    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
128static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
129static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
130#endif /* RTW_DEBUG */
131#ifdef RTW_DIAG
132static void rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln);
133#endif /* RTW_DIAG */
134
135/*
136 * Setup sysctl(3) MIB, hw.rtw.*
137 *
138 * TBD condition CTLFLAG_PERMANENT on being an LKM or not
139 */
140SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
141{
142	int rc;
143	const struct sysctlnode *cnode, *rnode;
144
145	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
146	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
147	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
148		goto err;
149
150	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
151	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
152	    "Realtek RTL818x 802.11 controls",
153	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
154		goto err;
155
156#ifdef RTW_DEBUG
157	/* control debugging printfs */
158	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
159	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
160	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
161	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
162	    CTL_CREATE, CTL_EOL)) != 0)
163		goto err;
164
165	/* Limit rx buffers, for simulating resource exhaustion. */
166	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
167	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
168	    "rxbufs_limit",
169	    SYSCTL_DESCR("Set rx buffers limit"),
170	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
171	    CTL_CREATE, CTL_EOL)) != 0)
172		goto err;
173
174#endif /* RTW_DEBUG */
175	/* set fallback RF programming method */
176	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
177	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
178	    "rfprog_fallback",
179	    SYSCTL_DESCR("Set fallback RF programming method"),
180	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
181	    CTL_CREATE, CTL_EOL)) != 0)
182		goto err;
183
184	/* force host to control RF I/O bus */
185	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
186	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
187	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
188	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
189	    CTL_CREATE, CTL_EOL)) != 0)
190		goto err;
191
192	return;
193err:
194	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
195}
196
197static int
198rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
199{
200	int error, t;
201	struct sysctlnode node;
202
203	node = *rnode;
204	t = *(int*)rnode->sysctl_data;
205	node.sysctl_data = &t;
206	error = sysctl_lookup(SYSCTLFN_CALL(&node));
207	if (error || newp == NULL)
208		return (error);
209
210	if (t < lower || t > upper)
211		return (EINVAL);
212
213	*(int*)rnode->sysctl_data = t;
214
215	return (0);
216}
217
218static int
219rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
220{
221	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
222	    __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
223}
224
225static int
226rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
227{
228	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
229}
230
231#ifdef RTW_DEBUG
232static int
233rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
234{
235	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
236	    0, RTW_DEBUG_MAX);
237}
238
239static int
240rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
241{
242	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
243	    0, RTW_RXQLEN);
244}
245
246static void
247rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
248{
249#define PRINTREG32(sc, reg)				\
250	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
251	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
252	    dvname, reg, RTW_READ(regs, reg)))
253
254#define PRINTREG16(sc, reg)				\
255	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
256	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
257	    dvname, reg, RTW_READ16(regs, reg)))
258
259#define PRINTREG8(sc, reg)				\
260	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
261	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
262	    dvname, reg, RTW_READ8(regs, reg)))
263
264	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
265
266	PRINTREG32(regs, RTW_IDR0);
267	PRINTREG32(regs, RTW_IDR1);
268	PRINTREG32(regs, RTW_MAR0);
269	PRINTREG32(regs, RTW_MAR1);
270	PRINTREG32(regs, RTW_TSFTRL);
271	PRINTREG32(regs, RTW_TSFTRH);
272	PRINTREG32(regs, RTW_TLPDA);
273	PRINTREG32(regs, RTW_TNPDA);
274	PRINTREG32(regs, RTW_THPDA);
275	PRINTREG32(regs, RTW_TCR);
276	PRINTREG32(regs, RTW_RCR);
277	PRINTREG32(regs, RTW_TINT);
278	PRINTREG32(regs, RTW_TBDA);
279	PRINTREG32(regs, RTW_ANAPARM);
280	PRINTREG32(regs, RTW_BB);
281	PRINTREG32(regs, RTW_PHYCFG);
282	PRINTREG32(regs, RTW_WAKEUP0L);
283	PRINTREG32(regs, RTW_WAKEUP0H);
284	PRINTREG32(regs, RTW_WAKEUP1L);
285	PRINTREG32(regs, RTW_WAKEUP1H);
286	PRINTREG32(regs, RTW_WAKEUP2LL);
287	PRINTREG32(regs, RTW_WAKEUP2LH);
288	PRINTREG32(regs, RTW_WAKEUP2HL);
289	PRINTREG32(regs, RTW_WAKEUP2HH);
290	PRINTREG32(regs, RTW_WAKEUP3LL);
291	PRINTREG32(regs, RTW_WAKEUP3LH);
292	PRINTREG32(regs, RTW_WAKEUP3HL);
293	PRINTREG32(regs, RTW_WAKEUP3HH);
294	PRINTREG32(regs, RTW_WAKEUP4LL);
295	PRINTREG32(regs, RTW_WAKEUP4LH);
296	PRINTREG32(regs, RTW_WAKEUP4HL);
297	PRINTREG32(regs, RTW_WAKEUP4HH);
298	PRINTREG32(regs, RTW_DK0);
299	PRINTREG32(regs, RTW_DK1);
300	PRINTREG32(regs, RTW_DK2);
301	PRINTREG32(regs, RTW_DK3);
302	PRINTREG32(regs, RTW_RETRYCTR);
303	PRINTREG32(regs, RTW_RDSAR);
304	PRINTREG32(regs, RTW_FER);
305	PRINTREG32(regs, RTW_FEMR);
306	PRINTREG32(regs, RTW_FPSR);
307	PRINTREG32(regs, RTW_FFER);
308
309	/* 16-bit registers */
310	PRINTREG16(regs, RTW_BRSR);
311	PRINTREG16(regs, RTW_IMR);
312	PRINTREG16(regs, RTW_ISR);
313	PRINTREG16(regs, RTW_BCNITV);
314	PRINTREG16(regs, RTW_ATIMWND);
315	PRINTREG16(regs, RTW_BINTRITV);
316	PRINTREG16(regs, RTW_ATIMTRITV);
317	PRINTREG16(regs, RTW_CRC16ERR);
318	PRINTREG16(regs, RTW_CRC0);
319	PRINTREG16(regs, RTW_CRC1);
320	PRINTREG16(regs, RTW_CRC2);
321	PRINTREG16(regs, RTW_CRC3);
322	PRINTREG16(regs, RTW_CRC4);
323	PRINTREG16(regs, RTW_CWR);
324
325	/* 8-bit registers */
326	PRINTREG8(regs, RTW_CR);
327	PRINTREG8(regs, RTW_9346CR);
328	PRINTREG8(regs, RTW_CONFIG0);
329	PRINTREG8(regs, RTW_CONFIG1);
330	PRINTREG8(regs, RTW_CONFIG2);
331	PRINTREG8(regs, RTW_MSR);
332	PRINTREG8(regs, RTW_CONFIG3);
333	PRINTREG8(regs, RTW_CONFIG4);
334	PRINTREG8(regs, RTW_TESTR);
335	PRINTREG8(regs, RTW_PSR);
336	PRINTREG8(regs, RTW_SCR);
337	PRINTREG8(regs, RTW_PHYDELAY);
338	PRINTREG8(regs, RTW_CRCOUNT);
339	PRINTREG8(regs, RTW_PHYADDR);
340	PRINTREG8(regs, RTW_PHYDATAW);
341	PRINTREG8(regs, RTW_PHYDATAR);
342	PRINTREG8(regs, RTW_CONFIG5);
343	PRINTREG8(regs, RTW_TPPOLL);
344
345	PRINTREG16(regs, RTW_BSSID16);
346	PRINTREG32(regs, RTW_BSSID32);
347#undef PRINTREG32
348#undef PRINTREG16
349#undef PRINTREG8
350}
351#endif /* RTW_DEBUG */
352
353void
354rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
355{
356	struct rtw_regs *regs = &sc->sc_regs;
357
358	uint32_t tcr;
359	tcr = RTW_READ(regs, RTW_TCR);
360	tcr &= ~RTW_TCR_LBK_MASK;
361	if (enable)
362		tcr |= RTW_TCR_LBK_CONT;
363	else
364		tcr |= RTW_TCR_LBK_NORMAL;
365	RTW_WRITE(regs, RTW_TCR, tcr);
366	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
367	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
368	rtw_txdac_enable(sc, !enable);
369	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
370	rtw_set_access(regs, RTW_ACCESS_NONE);
371}
372
373#ifdef RTW_DEBUG
374static const char *
375rtw_access_string(enum rtw_access access)
376{
377	switch (access) {
378	case RTW_ACCESS_NONE:
379		return "none";
380	case RTW_ACCESS_CONFIG:
381		return "config";
382	case RTW_ACCESS_ANAPARM:
383		return "anaparm";
384	default:
385		return "unknown";
386	}
387}
388#endif /* RTW_DEBUG */
389
390static void
391rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
392{
393	KASSERT(/* naccess >= RTW_ACCESS_NONE && */
394	    naccess <= RTW_ACCESS_ANAPARM);
395	KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
396	    regs->r_access <= RTW_ACCESS_ANAPARM);
397
398	if (naccess == regs->r_access)
399		return;
400
401	switch (naccess) {
402	case RTW_ACCESS_NONE:
403		switch (regs->r_access) {
404		case RTW_ACCESS_ANAPARM:
405			rtw_anaparm_enable(regs, 0);
406			/*FALLTHROUGH*/
407		case RTW_ACCESS_CONFIG:
408			rtw_config0123_enable(regs, 0);
409			/*FALLTHROUGH*/
410		case RTW_ACCESS_NONE:
411			break;
412		}
413		break;
414	case RTW_ACCESS_CONFIG:
415		switch (regs->r_access) {
416		case RTW_ACCESS_NONE:
417			rtw_config0123_enable(regs, 1);
418			/*FALLTHROUGH*/
419		case RTW_ACCESS_CONFIG:
420			break;
421		case RTW_ACCESS_ANAPARM:
422			rtw_anaparm_enable(regs, 0);
423			break;
424		}
425		break;
426	case RTW_ACCESS_ANAPARM:
427		switch (regs->r_access) {
428		case RTW_ACCESS_NONE:
429			rtw_config0123_enable(regs, 1);
430			/*FALLTHROUGH*/
431		case RTW_ACCESS_CONFIG:
432			rtw_anaparm_enable(regs, 1);
433			/*FALLTHROUGH*/
434		case RTW_ACCESS_ANAPARM:
435			break;
436		}
437		break;
438	}
439}
440
441void
442rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
443{
444	rtw_set_access1(regs, access);
445	RTW_DPRINTF(RTW_DEBUG_ACCESS,
446	    ("%s: access %s -> %s\n", __func__,
447	    rtw_access_string(regs->r_access),
448	    rtw_access_string(access)));
449	regs->r_access = access;
450}
451
452/*
453 * Enable registers, switch register banks.
454 */
455void
456rtw_config0123_enable(struct rtw_regs *regs, int enable)
457{
458	uint8_t ecr;
459	ecr = RTW_READ8(regs, RTW_9346CR);
460	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
461	if (enable)
462		ecr |= RTW_9346CR_EEM_CONFIG;
463	else {
464		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
465		ecr |= RTW_9346CR_EEM_NORMAL;
466	}
467	RTW_WRITE8(regs, RTW_9346CR, ecr);
468	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
469}
470
471/* requires rtw_config0123_enable(, 1) */
472void
473rtw_anaparm_enable(struct rtw_regs *regs, int enable)
474{
475	uint8_t cfg3;
476
477	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
478	cfg3 |= RTW_CONFIG3_CLKRUNEN;
479	if (enable)
480		cfg3 |= RTW_CONFIG3_PARMEN;
481	else
482		cfg3 &= ~RTW_CONFIG3_PARMEN;
483	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
484	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
485}
486
487/* requires rtw_anaparm_enable(, 1) */
488void
489rtw_txdac_enable(struct rtw_softc *sc, int enable)
490{
491	uint32_t anaparm;
492	struct rtw_regs *regs = &sc->sc_regs;
493
494	anaparm = RTW_READ(regs, RTW_ANAPARM);
495	if (enable)
496		anaparm &= ~RTW_ANAPARM_TXDACOFF;
497	else
498		anaparm |= RTW_ANAPARM_TXDACOFF;
499	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
500	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
501}
502
503static inline int
504rtw_chip_reset1(struct rtw_regs *regs, device_t dev)
505{
506	uint8_t cr;
507	int i;
508
509	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
510
511	RTW_WBR(regs, RTW_CR, RTW_CR);
512
513	for (i = 0; i < 1000; i++) {
514		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
515			RTW_DPRINTF(RTW_DEBUG_RESET,
516			    ("%s: reset in %dus\n", device_xname(dev), i));
517			return 0;
518		}
519		RTW_RBR(regs, RTW_CR, RTW_CR);
520		DELAY(10); /* 10us */
521	}
522
523	aprint_error_dev(dev, "reset failed\n");
524	return ETIMEDOUT;
525}
526
527static inline int
528rtw_chip_reset(struct rtw_regs *regs, device_t dev)
529{
530	uint32_t tcr;
531
532	/* from Linux driver */
533	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
534	      __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
535
536	RTW_WRITE(regs, RTW_TCR, tcr);
537
538	RTW_WBW(regs, RTW_CR, RTW_TCR);
539
540	return rtw_chip_reset1(regs, dev);
541}
542
543static int
544rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
545{
546	struct ieee80211_key keycopy;
547
548	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
549
550	keycopy = *k;
551	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
552
553	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
554}
555
556static int
557rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
558{
559	struct rtw_softc *sc = ic->ic_ifp->if_softc;
560
561	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__,
562	    k->wk_keyix));
563
564	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
565
566	if (k->wk_keylen != 0 &&
567	    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP)
568		sc->sc_flags &= ~RTW_F_DK_VALID;
569
570	return 1;
571}
572
573static int
574rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
575    const u_int8_t mac[IEEE80211_ADDR_LEN])
576{
577	struct rtw_softc *sc = ic->ic_ifp->if_softc;
578
579	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
580
581	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
582
583	sc->sc_flags &= ~RTW_F_DK_VALID;
584
585	return 1;
586}
587
588static void
589rtw_key_update_begin(struct ieee80211com *ic)
590{
591#ifdef RTW_DEBUG
592	struct ifnet *ifp = ic->ic_ifp;
593	struct rtw_softc *sc = ifp->if_softc;
594#endif
595
596	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
597}
598
599static void
600rtw_key_update_end(struct ieee80211com *ic)
601{
602	struct ifnet *ifp = ic->ic_ifp;
603	struct rtw_softc *sc = ifp->if_softc;
604
605	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
606
607	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
608	    !device_is_active(sc->sc_dev))
609		return;
610
611	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
612	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
613	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
614	    (ifp->if_flags & IFF_RUNNING) != 0);
615}
616
617static inline int
618rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
619{
620	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
621		return 0;
622
623	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
624		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
625}
626
627static void
628rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
629{
630	uint8_t psr, scr;
631	int i, keylen;
632	struct rtw_regs *regs;
633	union rtw_keys *rk;
634
635	regs = &sc->sc_regs;
636	rk = &sc->sc_keys;
637
638	(void)memset(rk, 0, sizeof(rk));
639
640	/* Temporarily use software crypto for all keys. */
641	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
642		if (wk[i].wk_cipher == &rtw_cipher_wep)
643			wk[i].wk_cipher = &ieee80211_cipher_wep;
644	}
645
646	rtw_set_access(regs, RTW_ACCESS_CONFIG);
647
648	psr = RTW_READ8(regs, RTW_PSR);
649	scr = RTW_READ8(regs, RTW_SCR);
650	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
651
652	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
653		goto out;
654
655	for (keylen = i = 0; i < IEEE80211_WEP_NKID; i++) {
656		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
657			continue;
658		if (i == txkey) {
659			keylen = wk[i].wk_keylen;
660			break;
661		}
662		keylen = MAX(keylen, wk[i].wk_keylen);
663	}
664
665	if (keylen == 5)
666		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
667	else if (keylen == 13)
668		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
669
670	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
671		if (wk[i].wk_keylen != keylen ||
672		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
673			continue;
674		/* h/w will decrypt, s/w still strips headers */
675		wk[i].wk_cipher = &rtw_cipher_wep;
676		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
677	}
678
679out:
680	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
681
682	bus_space_write_region_stream_4(regs->r_bt, regs->r_bh,
683	    RTW_DK0, rk->rk_words, __arraycount(rk->rk_words));
684
685	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
686	    BUS_SPACE_BARRIER_SYNC);
687
688	RTW_WBW(regs, RTW_DK0, RTW_PSR);
689	RTW_WRITE8(regs, RTW_PSR, psr);
690	RTW_WBW(regs, RTW_PSR, RTW_SCR);
691	RTW_WRITE8(regs, RTW_SCR, scr);
692	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
693	rtw_set_access(regs, RTW_ACCESS_NONE);
694	sc->sc_flags |= RTW_F_DK_VALID;
695}
696
697static inline int
698rtw_recall_eeprom(struct rtw_regs *regs, device_t dev)
699{
700	int i;
701	uint8_t ecr;
702
703	ecr = RTW_READ8(regs, RTW_9346CR);
704	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
705	RTW_WRITE8(regs, RTW_9346CR, ecr);
706
707	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
708
709	/* wait 25ms for completion */
710	for (i = 0; i < 250; i++) {
711		ecr = RTW_READ8(regs, RTW_9346CR);
712		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
713			RTW_DPRINTF(RTW_DEBUG_RESET,
714			    ("%s: recall EEPROM in %dus\n", device_xname(dev),
715			    i * 100));
716			return 0;
717		}
718		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
719		DELAY(100);
720	}
721	aprint_error_dev(dev, "recall EEPROM failed\n");
722	return ETIMEDOUT;
723}
724
725static inline int
726rtw_reset(struct rtw_softc *sc)
727{
728	int rc;
729	uint8_t config1;
730
731	sc->sc_flags &= ~RTW_F_DK_VALID;
732
733	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev)) != 0)
734		return rc;
735
736	rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev);
737
738	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
739	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
740	/* TBD turn off maximum power saving? */
741
742	return 0;
743}
744
745static inline int
746rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
747    u_int ndescs)
748{
749	int i, rc = 0;
750	for (i = 0; i < ndescs; i++) {
751		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
752		    0, 0, &descs[i].ts_dmamap);
753		if (rc != 0)
754			break;
755	}
756	return rc;
757}
758
759static inline int
760rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
761    u_int ndescs)
762{
763	int i, rc = 0;
764	for (i = 0; i < ndescs; i++) {
765		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
766		    &descs[i].rs_dmamap);
767		if (rc != 0)
768			break;
769	}
770	return rc;
771}
772
773static inline void
774rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
775    u_int ndescs)
776{
777	int i;
778	for (i = 0; i < ndescs; i++) {
779		if (descs[i].rs_dmamap != NULL)
780			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
781	}
782}
783
784static inline void
785rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
786    u_int ndescs)
787{
788	int i;
789	for (i = 0; i < ndescs; i++) {
790		if (descs[i].ts_dmamap != NULL)
791			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
792	}
793}
794
795static inline void
796rtw_srom_free(struct rtw_srom *sr)
797{
798	sr->sr_size = 0;
799	if (sr->sr_content == NULL)
800		return;
801	free(sr->sr_content, M_DEVBUF);
802	sr->sr_content = NULL;
803}
804
805static void
806rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
807    uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
808{
809	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
810	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
811	*rcr |= RTW_RCR_ENCS1;
812	*rfchipid = RTW_RFCHIPID_PHILIPS;
813}
814
815static int
816rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
817    enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
818    device_t dev)
819{
820	int i;
821	const char *rfname, *paname;
822	char scratch[sizeof("unknown 0xXX")];
823	uint16_t srom_version;
824	uint8_t mac[IEEE80211_ADDR_LEN];
825
826	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
827	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
828
829	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
830
831	if (srom_version <= 0x0101) {
832		aprint_error_dev(dev,
833		    "SROM version %d.%d is not understood, "
834		    "limping along with defaults\n",
835		    srom_version >> 8, srom_version & 0xff);
836		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
837		return 0;
838	} else {
839		aprint_verbose_dev(dev, "SROM version %d.%d",
840		    srom_version >> 8, srom_version & 0xff);
841	}
842
843	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
844		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
845
846	RTW_DPRINTF(RTW_DEBUG_ATTACH,
847	    ("%s: EEPROM MAC %s\n", device_xname(dev), ether_sprintf(mac)));
848
849	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
850
851	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
852		*flags |= RTW_F_ANTDIV;
853
854	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
855	 * to be reversed.
856	 */
857	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
858		*flags |= RTW_F_DIGPHY;
859	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
860		*flags |= RTW_F_DFLANTB;
861
862	*rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
863	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
864
865	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
866		*flags |= RTW_C_RXWEP_104;
867
868	*flags |= RTW_C_RXWEP_40;	/* XXX */
869
870	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
871	switch (*rfchipid) {
872	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
873		rfname = "GCT GRF5101";
874		paname = "Winspring WS9901";
875		break;
876	case RTW_RFCHIPID_MAXIM:
877		rfname = "Maxim MAX2820";	/* guess */
878		paname = "Maxim MAX2422";	/* guess */
879		break;
880	case RTW_RFCHIPID_INTERSIL:
881		rfname = "Intersil HFA3873";	/* guess */
882		paname = "Intersil <unknown>";
883		break;
884	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
885		rfname = "Philips SA2400A";
886		paname = "Philips SA2411";
887		break;
888	case RTW_RFCHIPID_RFMD:
889		/* this is the same front-end as an atw(4)! */
890		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
891			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
892			 "SYN: Silicon Labs Si4126";	/* inferred from
893			 				 * reference driver
894							 */
895		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
896		break;
897	case RTW_RFCHIPID_RESERVED:
898		rfname = paname = "reserved";
899		break;
900	default:
901		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
902		rfname = paname = scratch;
903	}
904	aprint_normal_dev(dev, "RF: %s, PA: %s\n", rfname, paname);
905
906	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
907	case RTW_CONFIG0_GL_USA:
908	case _RTW_CONFIG0_GL_USA:
909		*locale = RTW_LOCALE_USA;
910		break;
911	case RTW_CONFIG0_GL_EUROPE:
912		*locale = RTW_LOCALE_EUROPE;
913		break;
914	case RTW_CONFIG0_GL_JAPAN:
915		*locale = RTW_LOCALE_JAPAN;
916		break;
917	default:
918		*locale = RTW_LOCALE_UNKNOWN;
919		break;
920	}
921	return 0;
922}
923
924/* Returns -1 on failure. */
925static int
926rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
927    device_t dev)
928{
929	int rc;
930	struct seeprom_descriptor sd;
931	uint8_t ecr;
932
933	(void)memset(&sd, 0, sizeof(sd));
934
935	ecr = RTW_READ8(regs, RTW_9346CR);
936
937	if ((flags & RTW_F_9356SROM) != 0) {
938		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n",
939		    device_xname(dev)));
940		sr->sr_size = 256;
941		sd.sd_chip = C56_66;
942	} else {
943		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n",
944		    device_xname(dev)));
945		sr->sr_size = 128;
946		sd.sd_chip = C46;
947	}
948
949	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
950	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
951	ecr |= RTW_9346CR_EEM_PROGRAM;
952
953	RTW_WRITE8(regs, RTW_9346CR, ecr);
954
955	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
956
957	if (sr->sr_content == NULL) {
958		aprint_error_dev(dev, "unable to allocate SROM buffer\n");
959		return ENOMEM;
960	}
961
962	(void)memset(sr->sr_content, 0, sr->sr_size);
963
964	/* RTL8180 has a single 8-bit register for controlling the
965	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
966	 * input/output sense is the reverse of read_seeprom's.
967	 */
968	sd.sd_tag = regs->r_bt;
969	sd.sd_bsh = regs->r_bh;
970	sd.sd_regsize = 1;
971	sd.sd_control_offset = RTW_9346CR;
972	sd.sd_status_offset = RTW_9346CR;
973	sd.sd_dataout_offset = RTW_9346CR;
974	sd.sd_CK = RTW_9346CR_EESK;
975	sd.sd_CS = RTW_9346CR_EECS;
976	sd.sd_DI = RTW_9346CR_EEDO;
977	sd.sd_DO = RTW_9346CR_EEDI;
978	/* make read_seeprom enter EEPROM read/write mode */
979	sd.sd_MS = ecr;
980	sd.sd_RDY = 0;
981
982	/* TBD bus barriers */
983	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
984		aprint_error_dev(dev, "could not read SROM\n");
985		free(sr->sr_content, M_DEVBUF);
986		sr->sr_content = NULL;
987		return -1;	/* XXX */
988	}
989
990	/* end EEPROM read/write mode */
991	RTW_WRITE8(regs, RTW_9346CR,
992	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
993	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
994
995	if ((rc = rtw_recall_eeprom(regs, dev)) != 0)
996		return rc;
997
998#ifdef RTW_DEBUG
999	{
1000		int i;
1001		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1002		    ("\n%s: serial ROM:\n\t", device_xname(dev)));
1003		for (i = 0; i < sr->sr_size/2; i++) {
1004			if (((i % 8) == 0) && (i != 0))
1005				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1006			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1007			    (" %04x", sr->sr_content[i]));
1008		}
1009		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1010	}
1011#endif /* RTW_DEBUG */
1012	return 0;
1013}
1014
1015static void
1016rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1017    device_t dev)
1018{
1019	uint8_t cfg4;
1020	const char *method;
1021
1022	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1023
1024	switch (rfchipid) {
1025	default:
1026		cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1027		method = "fallback";
1028		break;
1029	case RTW_RFCHIPID_INTERSIL:
1030		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1031		method = "Intersil";
1032		break;
1033	case RTW_RFCHIPID_PHILIPS:
1034		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1035		method = "Philips";
1036		break;
1037	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1038	case RTW_RFCHIPID_RFMD:
1039		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1040		method = "RFMD";
1041		break;
1042	}
1043
1044	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1045
1046	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1047
1048	RTW_DPRINTF(RTW_DEBUG_INIT,
1049	    ("%s: %s RF programming method, %#02x\n", device_xname(dev), method,
1050	    RTW_READ8(regs, RTW_CONFIG4)));
1051}
1052
1053static inline void
1054rtw_init_channels(enum rtw_locale locale,
1055    struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1], device_t dev)
1056{
1057	int i;
1058	const char *name = NULL;
1059#define ADD_CHANNEL(_chans, _chan) do {			\
1060	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1061	(*_chans)[_chan].ic_freq =				\
1062	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1063} while (0)
1064
1065	switch (locale) {
1066	case RTW_LOCALE_USA:	/* 1-11 */
1067		name = "USA";
1068		for (i = 1; i <= 11; i++)
1069			ADD_CHANNEL(chans, i);
1070		break;
1071	case RTW_LOCALE_JAPAN:	/* 1-14 */
1072		name = "Japan";
1073		ADD_CHANNEL(chans, 14);
1074		for (i = 1; i <= 14; i++)
1075			ADD_CHANNEL(chans, i);
1076		break;
1077	case RTW_LOCALE_EUROPE:	/* 1-13 */
1078		name = "Europe";
1079		for (i = 1; i <= 13; i++)
1080			ADD_CHANNEL(chans, i);
1081		break;
1082	default:			/* 10-11 allowed by most countries */
1083		name = "<unknown>";
1084		for (i = 10; i <= 11; i++)
1085			ADD_CHANNEL(chans, i);
1086		break;
1087	}
1088	aprint_normal_dev(dev, "Geographic Location %s\n", name);
1089#undef ADD_CHANNEL
1090}
1091
1092
1093static inline void
1094rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1095{
1096	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1097
1098	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1099	case RTW_CONFIG0_GL_USA:
1100	case _RTW_CONFIG0_GL_USA:
1101		*locale = RTW_LOCALE_USA;
1102		break;
1103	case RTW_CONFIG0_GL_JAPAN:
1104		*locale = RTW_LOCALE_JAPAN;
1105		break;
1106	case RTW_CONFIG0_GL_EUROPE:
1107		*locale = RTW_LOCALE_EUROPE;
1108		break;
1109	default:
1110		*locale = RTW_LOCALE_UNKNOWN;
1111		break;
1112	}
1113}
1114
1115static inline int
1116rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1117    device_t dev)
1118{
1119	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1120		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1121	};
1122	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1123	          idr1 = RTW_READ(regs, RTW_IDR1);
1124
1125	(*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1126	(*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1127	(*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1128	(*addr)[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
1129
1130	(*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1131	(*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1132
1133	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1134		aprint_error_dev(dev,
1135		    "could not get mac address, attach failed\n");
1136		return ENXIO;
1137	}
1138
1139	aprint_normal_dev(dev, "802.11 address %s\n", ether_sprintf(*addr));
1140
1141	return 0;
1142}
1143
1144static uint8_t
1145rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1146    struct ieee80211_channel *chan)
1147{
1148	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1149	KASSERT(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14);
1150	return RTW_SR_GET(sr, idx);
1151}
1152
1153static void
1154rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1155{
1156	int pri;
1157	/* nfree: the number of free descriptors in each ring.
1158	 * The beacon ring is a special case: I do not let the
1159	 * driver use all of the descriptors on the beacon ring.
1160	 * The reasons are two-fold:
1161	 *
1162	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1163	 * updated, so the driver cannot easily know if the descriptor
1164	 * belongs to it, or if it is racing the NIC.  If the NIC
1165	 * does not OWN every descriptor, then the driver can safely
1166	 * update the descriptors when RTW_TBDA points at tdb_next.
1167	 *
1168	 * (2) I hope that the NIC will process more than one BEACON
1169	 * descriptor in a single beacon interval, since that will
1170	 * enable multiple-BSS support.  Since the NIC does not
1171	 * clear the OWN bit, there is no natural place for it to
1172	 * stop processing BEACON desciptors.  Maybe it will *not*
1173	 * stop processing them!  I do not want to chance the NIC
1174	 * looping around and around a saturated beacon ring, so
1175	 * I will leave one descriptor unOWNed at all times.
1176	 */
1177	u_int nfree[RTW_NTXPRI] =
1178	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1179	     RTW_NTXDESCBCN - 1};
1180
1181	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1182		tdb[pri].tdb_nfree = nfree[pri];
1183		tdb[pri].tdb_next = 0;
1184	}
1185}
1186
1187static int
1188rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1189{
1190	int i;
1191	struct rtw_txsoft *ts;
1192
1193	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1194	SIMPLEQ_INIT(&tsb->tsb_freeq);
1195	for (i = 0; i < tsb->tsb_ndesc; i++) {
1196		ts = &tsb->tsb_desc[i];
1197		ts->ts_mbuf = NULL;
1198		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1199	}
1200	tsb->tsb_tx_timer = 0;
1201	return 0;
1202}
1203
1204static void
1205rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1206{
1207	int pri;
1208	for (pri = 0; pri < RTW_NTXPRI; pri++)
1209		rtw_txsoft_blk_init(&tsb[pri]);
1210}
1211
1212static inline void
1213rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1214{
1215	KASSERT(nsync <= rdb->rdb_ndesc);
1216	/* sync to end of ring */
1217	if (desc0 + nsync > rdb->rdb_ndesc) {
1218		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1219		    offsetof(struct rtw_descs, hd_rx[desc0]),
1220		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1221		nsync -= (rdb->rdb_ndesc - desc0);
1222		desc0 = 0;
1223	}
1224
1225	KASSERT(desc0 < rdb->rdb_ndesc);
1226	KASSERT(nsync <= rdb->rdb_ndesc);
1227	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1228
1229	/* sync what remains */
1230	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1231	    offsetof(struct rtw_descs, hd_rx[desc0]),
1232	    sizeof(struct rtw_rxdesc) * nsync, ops);
1233}
1234
1235static void
1236rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1237{
1238	/* sync to end of ring */
1239	if (desc0 + nsync > tdb->tdb_ndesc) {
1240		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1241		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1242		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1243		    ops);
1244		nsync -= (tdb->tdb_ndesc - desc0);
1245		desc0 = 0;
1246	}
1247
1248	/* sync what remains */
1249	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1250	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1251	    sizeof(struct rtw_txdesc) * nsync, ops);
1252}
1253
1254static void
1255rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1256{
1257	int pri;
1258	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1259		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1260		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1261	}
1262}
1263
1264static void
1265rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1266{
1267	int i;
1268	struct rtw_rxsoft *rs;
1269
1270	for (i = 0; i < RTW_RXQLEN; i++) {
1271		rs = &desc[i];
1272		if (rs->rs_mbuf == NULL)
1273			continue;
1274		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1275		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1276		bus_dmamap_unload(dmat, rs->rs_dmamap);
1277		m_freem(rs->rs_mbuf);
1278		rs->rs_mbuf = NULL;
1279	}
1280}
1281
1282static inline int
1283rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1284{
1285	int rc;
1286	struct mbuf *m;
1287
1288	MGETHDR(m, M_DONTWAIT, MT_DATA);
1289	if (m == NULL)
1290		return ENOBUFS;
1291
1292	MCLGET(m, M_DONTWAIT);
1293	if ((m->m_flags & M_EXT) == 0) {
1294		m_freem(m);
1295		return ENOBUFS;
1296	}
1297
1298	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1299
1300	if (rs->rs_mbuf != NULL)
1301		bus_dmamap_unload(dmat, rs->rs_dmamap);
1302
1303	rs->rs_mbuf = NULL;
1304
1305	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1306	if (rc != 0) {
1307		m_freem(m);
1308		return -1;
1309	}
1310
1311	rs->rs_mbuf = m;
1312
1313	return 0;
1314}
1315
1316static int
1317rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1318    int *ndesc, device_t dev)
1319{
1320	int i, rc = 0;
1321	struct rtw_rxsoft *rs;
1322
1323	for (i = 0; i < RTW_RXQLEN; i++) {
1324		rs = &desc[i];
1325		/* we're in rtw_init, so there should be no mbufs allocated */
1326		KASSERT(rs->rs_mbuf == NULL);
1327#ifdef RTW_DEBUG
1328		if (i == rtw_rxbufs_limit) {
1329			aprint_error_dev(dev, "TEST hit %d-buffer limit\n", i);
1330			rc = ENOBUFS;
1331			break;
1332		}
1333#endif /* RTW_DEBUG */
1334		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1335			aprint_error_dev(dev,
1336			    "rtw_rxsoft_alloc failed, %d buffers, rc %d\n",
1337			    i, rc);
1338			break;
1339		}
1340	}
1341	*ndesc = i;
1342	return rc;
1343}
1344
1345static inline void
1346rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1347    int idx, int kick)
1348{
1349	int is_last = (idx == rdb->rdb_ndesc - 1);
1350	uint32_t ctl, octl, obuf;
1351	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1352
1353	/* sync the mbuf before the descriptor */
1354	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1355	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1356
1357	obuf = rd->rd_buf;
1358	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1359
1360	ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1361	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1362
1363	if (is_last)
1364		ctl |= RTW_RXCTL_EOR;
1365
1366	octl = rd->rd_ctl;
1367	rd->rd_ctl = htole32(ctl);
1368
1369	RTW_DPRINTF(
1370	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1371	         : RTW_DEBUG_RECV_DESC,
1372	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1373	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1374	     le32toh(rd->rd_ctl)));
1375
1376	/* sync the descriptor */
1377	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1378	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1379	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1380}
1381
1382static void
1383rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1384{
1385	int i;
1386	struct rtw_rxdesc *rd;
1387	struct rtw_rxsoft *rs;
1388
1389	for (i = 0; i < rdb->rdb_ndesc; i++) {
1390		rd = &rdb->rdb_desc[i];
1391		rs = &ctl[i];
1392		rtw_rxdesc_init(rdb, rs, i, kick);
1393	}
1394}
1395
1396static void
1397rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1398{
1399	struct rtw_regs *regs = &sc->sc_regs;
1400	uint8_t cr;
1401
1402	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1403	    enable ? "enable" : "disable", flags));
1404
1405	cr = RTW_READ8(regs, RTW_CR);
1406
1407	/* XXX reference source does not enable MULRW */
1408	/* enable PCI Read/Write Multiple */
1409	cr |= RTW_CR_MULRW;
1410
1411	/* The receive engine will always start at RDSAR.  */
1412	if (enable && (flags & ~cr & RTW_CR_RE)) {
1413		struct rtw_rxdesc_blk *rdb;
1414		rdb = &sc->sc_rxdesc_blk;
1415		rdb->rdb_next = 0;
1416	}
1417
1418	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1419	if (enable)
1420		cr |= flags;
1421	else
1422		cr &= ~flags;
1423	RTW_WRITE8(regs, RTW_CR, cr);
1424	RTW_SYNC(regs, RTW_CR, RTW_CR);
1425
1426#ifdef RTW_DIAG
1427	if (cr & RTW_CR_TE)
1428		rtw_txring_fixup(sc, __func__, __LINE__);
1429#endif
1430}
1431
1432static void
1433rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1434{
1435#define	IS_BEACON(__fc0)						\
1436    ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1437     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1438
1439	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1440							 * hardware -> net80211
1441							 */
1442	u_int next, nproc = 0;
1443	int hwrate, len, rate, rssi, sq;
1444	uint32_t hrssi, hstat, htsfth, htsftl;
1445	struct rtw_rxdesc *rd;
1446	struct rtw_rxsoft *rs;
1447	struct rtw_rxdesc_blk *rdb;
1448	struct mbuf *m;
1449	struct ifnet *ifp = &sc->sc_if;
1450
1451	struct ieee80211_node *ni;
1452	struct ieee80211_frame_min *wh;
1453
1454	rdb = &sc->sc_rxdesc_blk;
1455
1456	for (next = rdb->rdb_next; ; next = rdb->rdb_next) {
1457		KASSERT(next < rdb->rdb_ndesc);
1458
1459		rtw_rxdescs_sync(rdb, next, 1,
1460		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1461		rd = &rdb->rdb_desc[next];
1462		rs = &sc->sc_rxsoft[next];
1463
1464		hstat = le32toh(rd->rd_stat);
1465		hrssi = le32toh(rd->rd_rssi);
1466		htsfth = le32toh(rd->rd_tsfth);
1467		htsftl = le32toh(rd->rd_tsftl);
1468
1469		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1470		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1471		    __func__, next, hstat, hrssi, htsfth, htsftl));
1472
1473		++nproc;
1474
1475		/* still belongs to NIC */
1476		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1477			rtw_rxdescs_sync(rdb, next, 1, BUS_DMASYNC_PREREAD);
1478			break;
1479		}
1480
1481                /* ieee80211_input() might reset the receive engine
1482                 * (e.g. by indirectly calling rtw_tune()), so save
1483                 * the next pointer here and retrieve it again on
1484                 * the next round.
1485		 */
1486		rdb->rdb_next = (next + 1) % rdb->rdb_ndesc;
1487
1488#ifdef RTW_DEBUG
1489#define PRINTSTAT(flag) do { \
1490	if ((hstat & flag) != 0) { \
1491		printf("%s" #flag, delim); \
1492		delim = ","; \
1493	} \
1494} while (0)
1495		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1496			const char *delim = "<";
1497			printf("%s: ", device_xname(sc->sc_dev));
1498			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1499				printf("status %08x", hstat);
1500				PRINTSTAT(RTW_RXSTAT_SPLCP);
1501				PRINTSTAT(RTW_RXSTAT_MAR);
1502				PRINTSTAT(RTW_RXSTAT_PAR);
1503				PRINTSTAT(RTW_RXSTAT_BAR);
1504				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1505				PRINTSTAT(RTW_RXSTAT_CRC32);
1506				PRINTSTAT(RTW_RXSTAT_ICV);
1507				printf(">, ");
1508			}
1509		}
1510#endif /* RTW_DEBUG */
1511
1512		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1513			aprint_error_dev(sc->sc_dev,
1514			    "DMA error/FIFO overflow %08" PRIx32 ", "
1515			    "rx descriptor %d\n", hstat, next);
1516			ifp->if_ierrors++;
1517			goto next;
1518		}
1519
1520		len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1521		if (len < IEEE80211_MIN_LEN) {
1522			sc->sc_ic.ic_stats.is_rx_tooshort++;
1523			goto next;
1524		}
1525		if (len > rs->rs_mbuf->m_len) {
1526			aprint_error_dev(sc->sc_dev,
1527			    "rx frame too long, %d > %d, %08" PRIx32
1528			    ", desc %d\n",
1529			    len, rs->rs_mbuf->m_len, hstat, next);
1530			ifp->if_ierrors++;
1531			goto next;
1532		}
1533
1534		hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1535		if (hwrate >= __arraycount(ratetbl)) {
1536			aprint_error_dev(sc->sc_dev,
1537			    "unknown rate #%" __PRIuBITS "\n",
1538			    __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1539			ifp->if_ierrors++;
1540			goto next;
1541		}
1542		rate = ratetbl[hwrate];
1543
1544#ifdef RTW_DEBUG
1545		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1546		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1547		     (rate * 5) % 10, htsfth, htsftl));
1548#endif /* RTW_DEBUG */
1549
1550		/* if bad flags, skip descriptor */
1551		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1552			aprint_error_dev(sc->sc_dev, "too many rx segments, "
1553			    "next=%d, %08" PRIx32 "\n", next, hstat);
1554			goto next;
1555		}
1556
1557		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1558		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1559
1560		m = rs->rs_mbuf;
1561
1562		/* if temporarily out of memory, re-use mbuf */
1563		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1564		case 0:
1565			break;
1566		case ENOBUFS:
1567			aprint_error_dev(sc->sc_dev,
1568			    "rtw_rxsoft_alloc(, %d) failed, dropping packet\n",
1569			    next);
1570			goto next;
1571		default:
1572			/* XXX shorten rx ring, instead? */
1573			aprint_error_dev(sc->sc_dev,
1574			    "could not load DMA map\n");
1575		}
1576
1577		sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1578
1579		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1580			rssi = UINT8_MAX - sq;
1581		else {
1582			rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1583			/* TBD find out each front-end's LNA gain in the
1584			 * front-end's units
1585			 */
1586			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1587				rssi |= 0x80;
1588		}
1589
1590		/* Note well: now we cannot recycle the rs_mbuf unless
1591		 * we restore its original length.
1592		 */
1593		m->m_pkthdr.rcvif = ifp;
1594		m->m_pkthdr.len = m->m_len = len;
1595
1596		wh = mtod(m, struct ieee80211_frame_min *);
1597
1598		if (!IS_BEACON(wh->i_fc[0]))
1599			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1600
1601		sc->sc_tsfth = htsfth;
1602
1603#ifdef RTW_DEBUG
1604		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1605		    (IFF_DEBUG|IFF_LINK2)) {
1606			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1607			    rate, rssi);
1608		}
1609#endif /* RTW_DEBUG */
1610
1611#if NBPFILTER > 0
1612		if (sc->sc_radiobpf != NULL) {
1613			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1614
1615			rr->rr_tsft =
1616			    htole64(((uint64_t)htsfth << 32) | htsftl);
1617
1618			rr->rr_flags = IEEE80211_RADIOTAP_F_FCS;
1619
1620			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1621				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1622			if ((hstat & RTW_RXSTAT_CRC32) != 0)
1623				rr->rr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1624
1625			rr->rr_rate = rate;
1626
1627			if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1628				rr->rr_u.u_philips.p_antsignal = rssi;
1629			else {
1630				rr->rr_u.u_other.o_antsignal = rssi;
1631				rr->rr_u.u_other.o_barker_lock =
1632				    htole16(UINT8_MAX - sq);
1633			}
1634
1635			bpf_mtap2(sc->sc_radiobpf, rr,
1636			    sizeof(sc->sc_rxtapu), m);
1637		}
1638#endif /* NBPFILTER > 0 */
1639
1640		if ((hstat & RTW_RXSTAT_RES) != 0) {
1641			m_freem(m);
1642			goto next;
1643		}
1644
1645		/* CRC is included with the packet; trim it off. */
1646		m_adj(m, -IEEE80211_CRC_LEN);
1647
1648		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1649		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1650		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1651		ieee80211_free_node(ni);
1652next:
1653		rtw_rxdesc_init(rdb, rs, next, 0);
1654	}
1655#undef IS_BEACON
1656}
1657
1658static void
1659rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1660    struct rtw_txsoft *ts)
1661{
1662	struct mbuf *m;
1663	struct ieee80211_node *ni;
1664
1665	m = ts->ts_mbuf;
1666	ni = ts->ts_ni;
1667	KASSERT(m != NULL);
1668	KASSERT(ni != NULL);
1669	ts->ts_mbuf = NULL;
1670	ts->ts_ni = NULL;
1671
1672	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1673	    BUS_DMASYNC_POSTWRITE);
1674	bus_dmamap_unload(dmat, ts->ts_dmamap);
1675	m_freem(m);
1676	ieee80211_free_node(ni);
1677}
1678
1679static void
1680rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1681    struct rtw_txsoft_blk *tsb)
1682{
1683	struct rtw_txsoft *ts;
1684
1685	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1686		rtw_txsoft_release(dmat, ic, ts);
1687		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1688		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1689	}
1690	tsb->tsb_tx_timer = 0;
1691}
1692
1693static inline void
1694rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1695    struct rtw_txsoft *ts, int ndesc)
1696{
1697	uint32_t hstat;
1698	int data_retry, rts_retry;
1699	struct rtw_txdesc *tdn;
1700	const char *condstring;
1701	struct ifnet *ifp = &sc->sc_if;
1702
1703	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1704
1705	tdb->tdb_nfree += ndesc;
1706
1707	tdn = &tdb->tdb_desc[ts->ts_last];
1708
1709	hstat = le32toh(tdn->td_stat);
1710	rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1711	data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1712
1713	ifp->if_collisions += rts_retry + data_retry;
1714
1715	if ((hstat & RTW_TXSTAT_TOK) != 0)
1716		condstring = "ok";
1717	else {
1718		ifp->if_oerrors++;
1719		condstring = "error";
1720	}
1721
1722	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1723	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1724	    device_xname(sc->sc_dev), ts, ts->ts_first, ts->ts_last,
1725	    condstring, rts_retry, data_retry));
1726}
1727
1728static void
1729rtw_reset_oactive(struct rtw_softc *sc)
1730{
1731	short oflags;
1732	int pri;
1733	struct rtw_txsoft_blk *tsb;
1734	struct rtw_txdesc_blk *tdb;
1735	oflags = sc->sc_if.if_flags;
1736	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1737		tsb = &sc->sc_txsoft_blk[pri];
1738		tdb = &sc->sc_txdesc_blk[pri];
1739		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1740			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1741	}
1742	if (oflags != sc->sc_if.if_flags) {
1743		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1744		    ("%s: reset OACTIVE\n", __func__));
1745	}
1746}
1747
1748/* Collect transmitted packets. */
1749static void
1750rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1751    struct rtw_txdesc_blk *tdb, int force)
1752{
1753	int ndesc;
1754	struct rtw_txsoft *ts;
1755
1756#ifdef RTW_DEBUG
1757	rtw_dump_rings(sc);
1758#endif
1759
1760	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1761		/* If we're clearing a failed transmission, only clear
1762		   up to the last packet the hardware has processed.  */
1763		if (ts->ts_first == rtw_txring_next(&sc->sc_regs, tdb))
1764			break;
1765
1766		ndesc = 1 + ts->ts_last - ts->ts_first;
1767		if (ts->ts_last < ts->ts_first)
1768			ndesc += tdb->tdb_ndesc;
1769
1770		KASSERT(ndesc > 0);
1771
1772		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1773		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1774
1775		if (force) {
1776			int next;
1777#ifdef RTW_DIAG
1778			printf("%s: clearing packet, stats", __func__);
1779#endif
1780			for (next = ts->ts_first; ;
1781			    next = RTW_NEXT_IDX(tdb, next)) {
1782#ifdef RTW_DIAG
1783				printf(" %" PRIx32 "/%" PRIx32 "/%" PRIx32 "/%" PRIu32 "/%" PRIx32, le32toh(tdb->tdb_desc[next].td_stat), le32toh(tdb->tdb_desc[next].td_ctl1), le32toh(tdb->tdb_desc[next].td_buf), le32toh(tdb->tdb_desc[next].td_len), le32toh(tdb->tdb_desc[next].td_next));
1784#endif
1785				tdb->tdb_desc[next].td_stat &=
1786				    ~htole32(RTW_TXSTAT_OWN);
1787				if (next == ts->ts_last)
1788					break;
1789			}
1790			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1791			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1792#ifdef RTW_DIAG
1793			next = RTW_NEXT_IDX(tdb, next);
1794			printf(" -> end %u stat %" PRIx32 ", was %u\n", next,
1795			    le32toh(tdb->tdb_desc[next].td_stat),
1796			    rtw_txring_next(&sc->sc_regs, tdb));
1797#endif
1798		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1799		    htole32(RTW_TXSTAT_OWN)) != 0) {
1800			rtw_txdescs_sync(tdb, ts->ts_last, 1,
1801			    BUS_DMASYNC_PREREAD);
1802			break;
1803		}
1804
1805		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1806		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1807		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1808	}
1809
1810	/* no more pending transmissions, cancel watchdog */
1811	if (ts == NULL)
1812		tsb->tsb_tx_timer = 0;
1813	rtw_reset_oactive(sc);
1814}
1815
1816static void
1817rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1818{
1819	int pri;
1820	struct rtw_txsoft_blk	*tsb;
1821	struct rtw_txdesc_blk	*tdb;
1822	struct ifnet *ifp = &sc->sc_if;
1823
1824	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1825		tsb = &sc->sc_txsoft_blk[pri];
1826		tdb = &sc->sc_txdesc_blk[pri];
1827		rtw_collect_txring(sc, tsb, tdb, 0);
1828	}
1829
1830	if ((isr & RTW_INTR_TX) != 0)
1831		rtw_start(ifp);
1832
1833	return;
1834}
1835
1836static void
1837rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1838{
1839	u_int next;
1840	uint32_t tsfth, tsftl;
1841	struct ieee80211com *ic;
1842	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1843	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1844	struct mbuf *m;
1845
1846	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1847	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1848
1849	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1850		next = rtw_txring_next(&sc->sc_regs, tdb);
1851		RTW_DPRINTF(RTW_DEBUG_BEACON,
1852		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1853		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1854		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1855		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1856		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0)
1857			rtw_collect_txring(sc, tsb, tdb, 1);
1858	}
1859	/* Start beacon transmission. */
1860
1861	if ((isr & RTW_INTR_BCNINT) != 0 &&
1862	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1863	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1864		RTW_DPRINTF(RTW_DEBUG_BEACON,
1865		    ("%s: beacon prep. time, isr = %#04" PRIx16
1866		     ", %16" PRIu64 "\n", __func__, isr,
1867		     (uint64_t)tsfth << 32 | tsftl));
1868		ic = &sc->sc_ic;
1869		m = rtw_beacon_alloc(sc, ic->ic_bss);
1870
1871		if (m == NULL) {
1872			aprint_error_dev(sc->sc_dev,
1873			    "could not allocate beacon\n");
1874			return;
1875		}
1876		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1877		IF_ENQUEUE(&sc->sc_beaconq, m);
1878		rtw_start(&sc->sc_if);
1879	}
1880}
1881
1882static void
1883rtw_intr_atim(struct rtw_softc *sc)
1884{
1885	/* TBD */
1886	return;
1887}
1888
1889#ifdef RTW_DEBUG
1890static void
1891rtw_dump_rings(struct rtw_softc *sc)
1892{
1893	struct rtw_txdesc_blk *tdb;
1894	struct rtw_rxdesc *rd;
1895	struct rtw_rxdesc_blk *rdb;
1896	int desc, pri;
1897
1898	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1899		return;
1900
1901	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1902		tdb = &sc->sc_txdesc_blk[pri];
1903		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1904		    tdb->tdb_ndesc, tdb->tdb_nfree);
1905		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1906			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1907	}
1908
1909	rdb = &sc->sc_rxdesc_blk;
1910
1911	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1912		rd = &rdb->rdb_desc[desc];
1913		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1914		    "rsvd1/tsfth %08x\n", __func__,
1915		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1916		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1917		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1918	}
1919}
1920#endif /* RTW_DEBUG */
1921
1922static void
1923rtw_hwring_setup(struct rtw_softc *sc)
1924{
1925	int pri;
1926	struct rtw_regs *regs = &sc->sc_regs;
1927	struct rtw_txdesc_blk *tdb;
1928
1929	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1930	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1931	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1932	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1933	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1934	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1935	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1936	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1937
1938	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1939		tdb = &sc->sc_txdesc_blk[pri];
1940		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1941		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1942		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1943		     (uintptr_t)tdb->tdb_base));
1944	}
1945
1946	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1947
1948	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1949	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1950	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1951
1952	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1953
1954}
1955
1956static int
1957rtw_swring_setup(struct rtw_softc *sc)
1958{
1959	int rc;
1960	struct rtw_rxdesc_blk *rdb;
1961
1962	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1963
1964	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1965
1966	rdb = &sc->sc_rxdesc_blk;
1967	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
1968	     sc->sc_dev)) != 0 && rdb->rdb_ndesc == 0) {
1969		aprint_error_dev(sc->sc_dev, "could not allocate rx buffers\n");
1970		return rc;
1971	}
1972
1973	rdb = &sc->sc_rxdesc_blk;
1974	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
1975	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1976	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
1977	rdb->rdb_next = 0;
1978
1979	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
1980	return 0;
1981}
1982
1983static void
1984rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
1985{
1986	int i;
1987
1988	(void)memset(tdb->tdb_desc, 0,
1989	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
1990	for (i = 0; i < tdb->tdb_ndesc; i++)
1991		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
1992}
1993
1994static u_int
1995rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
1996{
1997	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
1998	    sizeof(struct rtw_txdesc);
1999}
2000
2001#ifdef RTW_DIAG
2002static void
2003rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln)
2004{
2005	int pri;
2006	u_int next;
2007	struct rtw_txdesc_blk *tdb;
2008	struct rtw_regs *regs = &sc->sc_regs;
2009
2010	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2011		int i;
2012		tdb = &sc->sc_txdesc_blk[pri];
2013		next = rtw_txring_next(regs, tdb);
2014		if (tdb->tdb_next == next)
2015			continue;
2016		for (i = 0; next != tdb->tdb_next;
2017		    next = RTW_NEXT_IDX(tdb, next), i++) {
2018			if ((tdb->tdb_desc[next].td_stat & htole32(RTW_TXSTAT_OWN)) == 0)
2019				break;
2020		}
2021		printf("%s:%d: tx-ring %d expected next %u, read %u+%d -> %s\n", fn,
2022		    ln, pri, tdb->tdb_next, next, i, tdb->tdb_next == next ? "okay" : "BAD");
2023		if (tdb->tdb_next == next)
2024			continue;
2025		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
2026	}
2027}
2028#endif
2029
2030static void
2031rtw_txdescs_reset(struct rtw_softc *sc)
2032{
2033	int pri;
2034	struct rtw_txsoft_blk	*tsb;
2035	struct rtw_txdesc_blk	*tdb;
2036
2037	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2038		tsb = &sc->sc_txsoft_blk[pri];
2039		tdb = &sc->sc_txdesc_blk[pri];
2040		rtw_collect_txring(sc, tsb, tdb, 1);
2041#ifdef RTW_DIAG
2042		if (!SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
2043			printf("%s: packets left in ring %d\n", __func__, pri);
2044#endif
2045	}
2046}
2047
2048static void
2049rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2050{
2051	aprint_error_dev(sc->sc_dev, "tx fifo underflow\n");
2052
2053	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: cleaning up xmit, isr %" PRIx16
2054	    "\n", device_xname(sc->sc_dev), isr));
2055
2056#ifdef RTW_DEBUG
2057	rtw_dump_rings(sc);
2058#endif /* RTW_DEBUG */
2059
2060	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2061	 * timeouts.
2062	 */
2063	rtw_txdescs_reset(sc);
2064
2065#ifdef RTW_DEBUG
2066	rtw_dump_rings(sc);
2067#endif /* RTW_DEBUG */
2068}
2069
2070static inline void
2071rtw_suspend_ticks(struct rtw_softc *sc)
2072{
2073	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2074	    ("%s: suspending ticks\n", device_xname(sc->sc_dev)));
2075	sc->sc_do_tick = 0;
2076}
2077
2078static inline void
2079rtw_resume_ticks(struct rtw_softc *sc)
2080{
2081	uint32_t tsftrl0, tsftrl1, next_tick;
2082
2083	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2084
2085	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2086	next_tick = tsftrl1 + 1000000;
2087	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
2088
2089	sc->sc_do_tick = 1;
2090
2091	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2092	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2093	    device_xname(sc->sc_dev), tsftrl1 - tsftrl0, tsftrl1, next_tick));
2094}
2095
2096static void
2097rtw_intr_timeout(struct rtw_softc *sc)
2098{
2099	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", device_xname(sc->sc_dev)));
2100	if (sc->sc_do_tick)
2101		rtw_resume_ticks(sc);
2102	return;
2103}
2104
2105int
2106rtw_intr(void *arg)
2107{
2108	int i;
2109	struct rtw_softc *sc = arg;
2110	struct rtw_regs *regs = &sc->sc_regs;
2111	uint16_t isr;
2112	struct ifnet *ifp = &sc->sc_if;
2113
2114	/*
2115	 * If the interface isn't running, the interrupt couldn't
2116	 * possibly have come from us.
2117	 */
2118	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2119	    !device_is_active(sc->sc_dev)) {
2120		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2121		    device_xname(sc->sc_dev)));
2122		return (0);
2123	}
2124
2125	for (i = 0; i < 10; i++) {
2126		isr = RTW_READ16(regs, RTW_ISR);
2127
2128		RTW_WRITE16(regs, RTW_ISR, isr);
2129		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2130
2131		if (sc->sc_intr_ack != NULL)
2132			(*sc->sc_intr_ack)(regs);
2133
2134		if (isr == 0)
2135			break;
2136
2137#ifdef RTW_DEBUG
2138#define PRINTINTR(flag) do { \
2139	if ((isr & flag) != 0) { \
2140		printf("%s" #flag, delim); \
2141		delim = ","; \
2142	} \
2143} while (0)
2144
2145		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2146			const char *delim = "<";
2147
2148			printf("%s: reg[ISR] = %x", device_xname(sc->sc_dev),
2149			    isr);
2150
2151			PRINTINTR(RTW_INTR_TXFOVW);
2152			PRINTINTR(RTW_INTR_TIMEOUT);
2153			PRINTINTR(RTW_INTR_BCNINT);
2154			PRINTINTR(RTW_INTR_ATIMINT);
2155			PRINTINTR(RTW_INTR_TBDER);
2156			PRINTINTR(RTW_INTR_TBDOK);
2157			PRINTINTR(RTW_INTR_THPDER);
2158			PRINTINTR(RTW_INTR_THPDOK);
2159			PRINTINTR(RTW_INTR_TNPDER);
2160			PRINTINTR(RTW_INTR_TNPDOK);
2161			PRINTINTR(RTW_INTR_RXFOVW);
2162			PRINTINTR(RTW_INTR_RDU);
2163			PRINTINTR(RTW_INTR_TLPDER);
2164			PRINTINTR(RTW_INTR_TLPDOK);
2165			PRINTINTR(RTW_INTR_RER);
2166			PRINTINTR(RTW_INTR_ROK);
2167
2168			printf(">\n");
2169		}
2170#undef PRINTINTR
2171#endif /* RTW_DEBUG */
2172
2173		if ((isr & RTW_INTR_RX) != 0)
2174			rtw_intr_rx(sc, isr);
2175		if ((isr & RTW_INTR_TX) != 0)
2176			rtw_intr_tx(sc, isr);
2177		if ((isr & RTW_INTR_BEACON) != 0)
2178			rtw_intr_beacon(sc, isr);
2179		if ((isr & RTW_INTR_ATIMINT) != 0)
2180			rtw_intr_atim(sc);
2181		if ((isr & RTW_INTR_IOERROR) != 0)
2182			rtw_intr_ioerror(sc, isr);
2183		if ((isr & RTW_INTR_TIMEOUT) != 0)
2184			rtw_intr_timeout(sc);
2185	}
2186
2187	return 1;
2188}
2189
2190/* Must be called at splnet. */
2191static void
2192rtw_stop(struct ifnet *ifp, int disable)
2193{
2194	int pri;
2195	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2196	struct ieee80211com *ic = &sc->sc_ic;
2197	struct rtw_regs *regs = &sc->sc_regs;
2198
2199	rtw_suspend_ticks(sc);
2200
2201	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2202
2203	if (device_has_power(sc->sc_dev)) {
2204		/* Disable interrupts. */
2205		RTW_WRITE16(regs, RTW_IMR, 0);
2206
2207		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2208
2209		/* Stop the transmit and receive processes. First stop DMA,
2210		 * then disable receiver and transmitter.
2211		 */
2212		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2213
2214		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2215
2216		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2217	}
2218
2219	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2220		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2221		    &sc->sc_txsoft_blk[pri]);
2222	}
2223
2224	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2225
2226	/* Mark the interface as not running.  Cancel the watchdog timer. */
2227	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2228	ifp->if_timer = 0;
2229
2230	if (disable)
2231		pmf_device_suspend_self(sc->sc_dev);
2232
2233	return;
2234}
2235
2236const char *
2237rtw_pwrstate_string(enum rtw_pwrstate power)
2238{
2239	switch (power) {
2240	case RTW_ON:
2241		return "on";
2242	case RTW_SLEEP:
2243		return "sleep";
2244	case RTW_OFF:
2245		return "off";
2246	default:
2247		return "unknown";
2248	}
2249}
2250
2251/* XXX For Maxim, I am using the RFMD settings gleaned from the
2252 * reference driver, plus a magic Maxim "ON" value that comes from
2253 * the Realtek document "Windows PG for Rtl8180."
2254 */
2255static void
2256rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2257    int before_rf, int digphy)
2258{
2259	uint32_t anaparm;
2260
2261	anaparm = RTW_READ(regs, RTW_ANAPARM);
2262	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2263
2264	switch (power) {
2265	case RTW_OFF:
2266		if (before_rf)
2267			return;
2268		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2269		anaparm |= RTW_ANAPARM_TXDACOFF;
2270		break;
2271	case RTW_SLEEP:
2272		if (!before_rf)
2273			return;
2274		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2275		anaparm |= RTW_ANAPARM_TXDACOFF;
2276		break;
2277	case RTW_ON:
2278		if (!before_rf)
2279			return;
2280		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2281		break;
2282	}
2283	RTW_DPRINTF(RTW_DEBUG_PWR,
2284	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2285	    __func__, rtw_pwrstate_string(power),
2286	    (before_rf) ? "before" : "after", anaparm));
2287
2288	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2289	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2290}
2291
2292/* XXX I am using the RFMD settings gleaned from the reference
2293 * driver.  They agree
2294 */
2295static void
2296rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2297    int before_rf, int digphy)
2298{
2299	uint32_t anaparm;
2300
2301	anaparm = RTW_READ(regs, RTW_ANAPARM);
2302	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2303
2304	switch (power) {
2305	case RTW_OFF:
2306		if (before_rf)
2307			return;
2308		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2309		anaparm |= RTW_ANAPARM_TXDACOFF;
2310		break;
2311	case RTW_SLEEP:
2312		if (!before_rf)
2313			return;
2314		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2315		anaparm |= RTW_ANAPARM_TXDACOFF;
2316		break;
2317	case RTW_ON:
2318		if (!before_rf)
2319			return;
2320		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2321		break;
2322	}
2323	RTW_DPRINTF(RTW_DEBUG_PWR,
2324	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2325	    __func__, rtw_pwrstate_string(power),
2326	    (before_rf) ? "before" : "after", anaparm));
2327
2328	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2329	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2330}
2331
2332static void
2333rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2334    int before_rf, int digphy)
2335{
2336	uint32_t anaparm;
2337
2338	anaparm = RTW_READ(regs, RTW_ANAPARM);
2339	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2340
2341	switch (power) {
2342	case RTW_OFF:
2343		if (before_rf)
2344			return;
2345		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2346		anaparm |= RTW_ANAPARM_TXDACOFF;
2347		break;
2348	case RTW_SLEEP:
2349		if (!before_rf)
2350			return;
2351		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2352		anaparm |= RTW_ANAPARM_TXDACOFF;
2353		break;
2354	case RTW_ON:
2355		if (!before_rf)
2356			return;
2357		if (digphy) {
2358			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2359			/* XXX guess */
2360			anaparm |= RTW_ANAPARM_TXDACOFF;
2361		} else
2362			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2363		break;
2364	}
2365	RTW_DPRINTF(RTW_DEBUG_PWR,
2366	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2367	    __func__, rtw_pwrstate_string(power),
2368	    (before_rf) ? "before" : "after", anaparm));
2369
2370	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2371	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2372}
2373
2374static void
2375rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2376    int digphy)
2377{
2378	struct rtw_regs *regs = &sc->sc_regs;
2379
2380	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2381
2382	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2383
2384	rtw_set_access(regs, RTW_ACCESS_NONE);
2385
2386	return;
2387}
2388
2389static int
2390rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2391{
2392	int rc;
2393
2394	RTW_DPRINTF(RTW_DEBUG_PWR,
2395	    ("%s: %s->%s\n", __func__,
2396	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2397
2398	if (sc->sc_pwrstate == power)
2399		return 0;
2400
2401	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2402	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2403	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2404
2405	switch (power) {
2406	case RTW_ON:
2407		/* TBD set LEDs */
2408		break;
2409	case RTW_SLEEP:
2410		/* TBD */
2411		break;
2412	case RTW_OFF:
2413		/* TBD */
2414		break;
2415	}
2416	if (rc == 0)
2417		sc->sc_pwrstate = power;
2418	else
2419		sc->sc_pwrstate = RTW_OFF;
2420	return rc;
2421}
2422
2423static int
2424rtw_tune(struct rtw_softc *sc)
2425{
2426	struct ieee80211com *ic = &sc->sc_ic;
2427	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2428	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2429	u_int chan;
2430	int rc;
2431	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2432	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2433
2434	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2435	KASSERT(chan != IEEE80211_CHAN_ANY);
2436
2437	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2438	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2439
2440	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2441	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2442
2443	if (chan == sc->sc_cur_chan) {
2444		RTW_DPRINTF(RTW_DEBUG_TUNE,
2445		    ("%s: already tuned chan #%d\n", __func__, chan));
2446		return 0;
2447	}
2448
2449	rtw_suspend_ticks(sc);
2450
2451	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2452
2453	/* TBD wait for Tx to complete */
2454
2455	KASSERT(device_has_power(sc->sc_dev));
2456
2457	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2458	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2459	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2460		/* XXX condition on powersaving */
2461		aprint_error_dev(sc->sc_dev, "phy init failed\n");
2462	}
2463
2464	sc->sc_cur_chan = chan;
2465
2466	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2467
2468	rtw_resume_ticks(sc);
2469
2470	return rc;
2471}
2472
2473bool
2474rtw_suspend(device_t self PMF_FN_ARGS)
2475{
2476	int rc;
2477	struct rtw_softc *sc = device_private(self);
2478
2479	sc->sc_flags &= ~RTW_F_DK_VALID;
2480
2481	if (!device_has_power(self))
2482		return false;
2483
2484	/* turn off PHY */
2485	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2486		aprint_error_dev(self, "failed to turn off PHY (%d)\n", rc);
2487		return false;
2488	}
2489
2490	rtw_disable_interrupts(&sc->sc_regs);
2491
2492	return true;
2493}
2494
2495bool
2496rtw_resume(device_t self PMF_FN_ARGS)
2497{
2498	struct rtw_softc *sc = device_private(self);
2499
2500	/* Power may have been removed, resetting WEP keys.
2501	 */
2502	sc->sc_flags &= ~RTW_F_DK_VALID;
2503	rtw_enable_interrupts(sc);
2504
2505	return true;
2506}
2507
2508static void
2509rtw_transmit_config(struct rtw_regs *regs)
2510{
2511	uint32_t tcr;
2512
2513	tcr = RTW_READ(regs, RTW_TCR);
2514
2515	tcr |= RTW_TCR_CWMIN;
2516	tcr &= ~RTW_TCR_MXDMA_MASK;
2517	tcr |= RTW_TCR_MXDMA_256;
2518	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2519	tcr &= ~RTW_TCR_LBK_MASK;
2520	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2521
2522	/* set short/long retry limits */
2523	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2524	tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2525
2526	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2527
2528	RTW_WRITE(regs, RTW_TCR, tcr);
2529	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2530}
2531
2532static void
2533rtw_disable_interrupts(struct rtw_regs *regs)
2534{
2535	RTW_WRITE16(regs, RTW_IMR, 0);
2536	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2537	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2538	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2539}
2540
2541static void
2542rtw_enable_interrupts(struct rtw_softc *sc)
2543{
2544	struct rtw_regs *regs = &sc->sc_regs;
2545
2546	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2547	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2548
2549	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2550	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2551	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2552	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2553
2554	/* XXX necessary? */
2555	if (sc->sc_intr_ack != NULL)
2556		(*sc->sc_intr_ack)(regs);
2557}
2558
2559static void
2560rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2561{
2562	uint8_t msr;
2563
2564	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2565	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2566
2567	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2568
2569	switch (opmode) {
2570	case IEEE80211_M_AHDEMO:
2571	case IEEE80211_M_IBSS:
2572		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2573		break;
2574	case IEEE80211_M_HOSTAP:
2575		msr |= RTW_MSR_NETYPE_AP_OK;
2576		break;
2577	case IEEE80211_M_MONITOR:
2578		/* XXX */
2579		msr |= RTW_MSR_NETYPE_NOLINK;
2580		break;
2581	case IEEE80211_M_STA:
2582		msr |= RTW_MSR_NETYPE_INFRA_OK;
2583		break;
2584	}
2585	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2586
2587	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2588}
2589
2590#define	rtw_calchash(addr) \
2591	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2592
2593static void
2594rtw_pktfilt_load(struct rtw_softc *sc)
2595{
2596	struct rtw_regs *regs = &sc->sc_regs;
2597	struct ieee80211com *ic = &sc->sc_ic;
2598	struct ethercom *ec = &sc->sc_ec;
2599	struct ifnet *ifp = &sc->sc_if;
2600	int hash;
2601	uint32_t hashes[2] = { 0, 0 };
2602	struct ether_multi *enm;
2603	struct ether_multistep step;
2604
2605	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2606
2607	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2608	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2609
2610	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2611	/* MAC auto-reset PHY (huh?) */
2612	sc->sc_rcr |= RTW_RCR_ENMARP;
2613	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2614	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2615
2616	switch (ic->ic_opmode) {
2617	case IEEE80211_M_MONITOR:
2618		sc->sc_rcr |= RTW_RCR_MONITOR;
2619		break;
2620	case IEEE80211_M_AHDEMO:
2621	case IEEE80211_M_IBSS:
2622		/* receive broadcasts in our BSS */
2623		sc->sc_rcr |= RTW_RCR_ADD3;
2624		break;
2625	default:
2626		break;
2627	}
2628
2629	ifp->if_flags &= ~IFF_ALLMULTI;
2630
2631	/*
2632	 * Program the 64-bit multicast hash filter.
2633	 */
2634	ETHER_FIRST_MULTI(step, ec, enm);
2635	while (enm != NULL) {
2636		/* XXX */
2637		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2638		    ETHER_ADDR_LEN) != 0) {
2639			ifp->if_flags |= IFF_ALLMULTI;
2640			break;
2641		}
2642
2643		hash = rtw_calchash(enm->enm_addrlo);
2644		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2645		ETHER_NEXT_MULTI(step, enm);
2646	}
2647
2648	/* XXX accept all broadcast if scanning */
2649	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2650		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2651
2652	if (ifp->if_flags & IFF_PROMISC) {
2653		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2654		sc->sc_rcr |= RTW_RCR_ACRC32;	/* accept frames failing CRC */
2655		sc->sc_rcr |= RTW_RCR_AICV;	/* accept frames failing ICV */
2656		ifp->if_flags |= IFF_ALLMULTI;
2657	}
2658
2659	if (ifp->if_flags & IFF_ALLMULTI)
2660		hashes[0] = hashes[1] = 0xffffffff;
2661
2662	if ((hashes[0] | hashes[1]) != 0)
2663		sc->sc_rcr |= RTW_RCR_AM;	/* accept multicast */
2664
2665	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2666	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2667	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2668	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2669
2670	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2671	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2672	    device_xname(sc->sc_dev), RTW_READ(regs, RTW_MAR0),
2673	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2674}
2675
2676static struct mbuf *
2677rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2678{
2679	struct ieee80211com *ic = &sc->sc_ic;
2680	struct mbuf *m;
2681	struct ieee80211_beacon_offsets	boff;
2682
2683	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2684		RTW_DPRINTF(RTW_DEBUG_BEACON,
2685		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2686	}
2687	return m;
2688}
2689
2690/* Must be called at splnet. */
2691static int
2692rtw_init(struct ifnet *ifp)
2693{
2694	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2695	struct ieee80211com *ic = &sc->sc_ic;
2696	struct rtw_regs *regs = &sc->sc_regs;
2697	int rc;
2698
2699	if (device_is_active(sc->sc_dev)) {
2700		/* Cancel pending I/O and reset. */
2701		rtw_stop(ifp, 0);
2702	} else if (!pmf_device_resume_self(sc->sc_dev))
2703		return 0;	/* XXX error? */
2704
2705	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2706	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2707	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2708
2709	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2710		goto out;
2711
2712	if ((rc = rtw_swring_setup(sc)) != 0)
2713		goto out;
2714
2715	rtw_transmit_config(regs);
2716
2717	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2718
2719	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2720	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2721
2722	/* long PLCP header, 1Mb/2Mb basic rate */
2723	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2724	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2725
2726	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2727	rtw_set_access(regs, RTW_ACCESS_NONE);
2728
2729	/* XXX from reference sources */
2730	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2731	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2732
2733	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev);
2734
2735	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2736	/* from Linux driver */
2737	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2738
2739	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2740
2741	rtw_enable_interrupts(sc);
2742
2743	rtw_pktfilt_load(sc);
2744
2745	rtw_hwring_setup(sc);
2746
2747	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2748
2749	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2750
2751	ifp->if_flags |= IFF_RUNNING;
2752	ic->ic_state = IEEE80211_S_INIT;
2753
2754	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2755	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2756
2757	rtw_resume_ticks(sc);
2758
2759	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2760
2761	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2762		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2763	else
2764		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2765
2766out:
2767	aprint_error_dev(sc->sc_dev, "interface not running\n");
2768	return rc;
2769}
2770
2771static inline void
2772rtw_led_init(struct rtw_regs *regs)
2773{
2774	uint8_t cfg0, cfg1;
2775
2776	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2777
2778	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2779	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2780	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2781
2782	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2783	RTW_DPRINTF(RTW_DEBUG_LED,
2784	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2785
2786	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2787	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2788	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2789
2790	rtw_set_access(regs, RTW_ACCESS_NONE);
2791}
2792
2793/*
2794 * IEEE80211_S_INIT: 		LED1 off
2795 *
2796 * IEEE80211_S_AUTH,
2797 * IEEE80211_S_ASSOC,
2798 * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2799 *
2800 * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2801 */
2802static void
2803rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2804{
2805	struct rtw_led_state *ls;
2806
2807	ls = &sc->sc_led_state;
2808
2809	switch (nstate) {
2810	case IEEE80211_S_INIT:
2811		rtw_led_init(&sc->sc_regs);
2812		aprint_debug_dev(sc->sc_dev, "stopping blink\n");
2813		callout_stop(&ls->ls_slow_ch);
2814		callout_stop(&ls->ls_fast_ch);
2815		ls->ls_slowblink = 0;
2816		ls->ls_actblink = 0;
2817		ls->ls_default = 0;
2818		break;
2819	case IEEE80211_S_SCAN:
2820		aprint_debug_dev(sc->sc_dev, "scheduling blink\n");
2821		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2822		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2823		/*FALLTHROUGH*/
2824	case IEEE80211_S_AUTH:
2825	case IEEE80211_S_ASSOC:
2826		ls->ls_default = RTW_LED1;
2827		ls->ls_actblink = RTW_LED1;
2828		ls->ls_slowblink = RTW_LED1;
2829		break;
2830	case IEEE80211_S_RUN:
2831		ls->ls_slowblink = 0;
2832		break;
2833	}
2834	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2835}
2836
2837static void
2838rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2839{
2840	uint8_t led_condition;
2841	bus_size_t ofs;
2842	uint8_t mask, newval, val;
2843
2844	led_condition = ls->ls_default;
2845
2846	if (ls->ls_state & RTW_LED_S_SLOW)
2847		led_condition ^= ls->ls_slowblink;
2848	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2849		led_condition ^= ls->ls_actblink;
2850
2851	RTW_DPRINTF(RTW_DEBUG_LED,
2852	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2853
2854	switch (hwverid) {
2855	default:
2856	case 'F':
2857		ofs = RTW_PSR;
2858		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2859		if (led_condition & RTW_LED0)
2860			newval &= ~RTW_PSR_LEDGPO0;
2861		if (led_condition & RTW_LED1)
2862			newval &= ~RTW_PSR_LEDGPO1;
2863		break;
2864	case 'D':
2865		ofs = RTW_9346CR;
2866		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2867		newval = RTW_9346CR_EEM_PROGRAM;
2868		if (led_condition & RTW_LED0)
2869			newval |= RTW_9346CR_EEDI;
2870		if (led_condition & RTW_LED1)
2871			newval |= RTW_9346CR_EECS;
2872		break;
2873	}
2874	val = RTW_READ8(regs, ofs);
2875	RTW_DPRINTF(RTW_DEBUG_LED,
2876	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2877	     (uintptr_t)ofs));
2878	val &= ~mask;
2879	val |= newval;
2880	RTW_WRITE8(regs, ofs, val);
2881	RTW_DPRINTF(RTW_DEBUG_LED,
2882	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2883	     (uintptr_t)ofs));
2884	RTW_SYNC(regs, ofs, ofs);
2885}
2886
2887static void
2888rtw_led_fastblink(void *arg)
2889{
2890	int ostate, s;
2891	struct rtw_softc *sc = (struct rtw_softc *)arg;
2892	struct rtw_led_state *ls = &sc->sc_led_state;
2893
2894	s = splnet();
2895	ostate = ls->ls_state;
2896	ls->ls_state ^= ls->ls_event;
2897
2898	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2899		ls->ls_state &= ~RTW_LED_S_TX;
2900
2901	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2902		ls->ls_state &= ~RTW_LED_S_RX;
2903
2904	ls->ls_event = 0;
2905
2906	if (ostate != ls->ls_state)
2907		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2908	splx(s);
2909
2910	aprint_debug_dev(sc->sc_dev, "scheduling fast blink\n");
2911	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2912}
2913
2914static void
2915rtw_led_slowblink(void *arg)
2916{
2917	int s;
2918	struct rtw_softc *sc = (struct rtw_softc *)arg;
2919	struct rtw_led_state *ls = &sc->sc_led_state;
2920
2921	s = splnet();
2922	ls->ls_state ^= RTW_LED_S_SLOW;
2923	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2924	splx(s);
2925	aprint_debug_dev(sc->sc_dev, "scheduling slow blink\n");
2926	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2927}
2928
2929static void
2930rtw_led_detach(struct rtw_led_state *ls)
2931{
2932	callout_destroy(&ls->ls_fast_ch);
2933	callout_destroy(&ls->ls_slow_ch);
2934}
2935
2936static void
2937rtw_led_attach(struct rtw_led_state *ls, void *arg)
2938{
2939	callout_init(&ls->ls_fast_ch, 0);
2940	callout_init(&ls->ls_slow_ch, 0);
2941	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2942	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2943}
2944
2945static int
2946rtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2947{
2948	int rc = 0, s;
2949	struct rtw_softc *sc = ifp->if_softc;
2950
2951	s = splnet();
2952	if (cmd == SIOCSIFFLAGS) {
2953		if ((ifp->if_flags & IFF_UP) != 0) {
2954			if (device_is_active(sc->sc_dev))
2955				rtw_pktfilt_load(sc);
2956			else
2957				rc = rtw_init(ifp);
2958			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2959		} else if (device_is_active(sc->sc_dev)) {
2960			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2961			rtw_stop(ifp, 1);
2962		}
2963	} else if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
2964		;	/* nothing to do */
2965	else if (cmd == SIOCADDMULTI || cmd == SIOCDELMULTI) {
2966		/* reload packet filter if running */
2967		if (ifp->if_flags & IFF_RUNNING)
2968			rtw_pktfilt_load(sc);
2969		rc = 0;
2970	} else if ((ifp->if_flags & IFF_UP) != 0)
2971		rc = rtw_init(ifp);
2972	else
2973		rc = 0;
2974	splx(s);
2975	return rc;
2976}
2977
2978/* Select a transmit ring with at least one h/w and s/w descriptor free.
2979 * Return 0 on success, -1 on failure.
2980 */
2981static inline int
2982rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
2983    struct rtw_txdesc_blk **tdbp, int pri)
2984{
2985	struct rtw_txsoft_blk *tsb;
2986	struct rtw_txdesc_blk *tdb;
2987
2988	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
2989
2990	tsb = &sc->sc_txsoft_blk[pri];
2991	tdb = &sc->sc_txdesc_blk[pri];
2992
2993	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
2994		if (tsb->tsb_tx_timer == 0)
2995			tsb->tsb_tx_timer = 5;
2996		*tsbp = NULL;
2997		*tdbp = NULL;
2998		return -1;
2999	}
3000	*tsbp = tsb;
3001	*tdbp = tdb;
3002	return 0;
3003}
3004
3005static inline struct mbuf *
3006rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3007    struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3008    struct ieee80211_node **nip, short *if_flagsp)
3009{
3010	struct mbuf *m;
3011
3012	if (IF_IS_EMPTY(ifq))
3013		return NULL;
3014	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3015		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3016		    __func__, pri));
3017		*if_flagsp |= IFF_OACTIVE;
3018		sc->sc_if.if_timer = 1;
3019		return NULL;
3020	}
3021	IF_DEQUEUE(ifq, m);
3022	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3023	m->m_pkthdr.rcvif = NULL;
3024	KASSERT(*nip != NULL);
3025	return m;
3026}
3027
3028/* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3029 * at the driver's selection of transmit control block for the packet.
3030 */
3031static inline int
3032rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3033    struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3034    struct ieee80211_node **nip)
3035{
3036	int pri;
3037	struct ether_header *eh;
3038	struct mbuf *m0;
3039	struct rtw_softc *sc;
3040	short *if_flagsp;
3041
3042	*mp = NULL;
3043
3044	sc = (struct rtw_softc *)ifp->if_softc;
3045
3046	DPRINTF(sc, RTW_DEBUG_XMIT,
3047	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3048
3049	if_flagsp = &ifp->if_flags;
3050
3051	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3052	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3053		                     tdbp, nip, if_flagsp)) != NULL) {
3054		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3055		    __func__));
3056		return 0;
3057	}
3058
3059	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3060		                     tdbp, nip, if_flagsp)) != NULL) {
3061		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3062		    __func__));
3063		return 0;
3064	}
3065
3066	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3067		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3068		return 0;
3069	}
3070
3071	IFQ_POLL(&ifp->if_snd, m0);
3072	if (m0 == NULL) {
3073		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3074		    __func__));
3075		return 0;
3076	}
3077
3078	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3079
3080	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3081		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3082		    __func__, pri));
3083		*if_flagsp |= IFF_OACTIVE;
3084		sc->sc_if.if_timer = 1;
3085		return 0;
3086	}
3087
3088	IFQ_DEQUEUE(&ifp->if_snd, m0);
3089	if (m0 == NULL) {
3090		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3091		    __func__));
3092		return 0;
3093	}
3094	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3095	ifp->if_opackets++;
3096#if NBPFILTER > 0
3097	if (ifp->if_bpf)
3098		bpf_mtap(ifp->if_bpf, m0);
3099#endif
3100	eh = mtod(m0, struct ether_header *);
3101	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3102	if (*nip == NULL) {
3103		/* NB: ieee80211_find_txnode does stat+msg */
3104		m_freem(m0);
3105		return -1;
3106	}
3107	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3108		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3109		ifp->if_oerrors++;
3110		return -1;
3111	}
3112	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3113	*mp = m0;
3114	return 0;
3115}
3116
3117static int
3118rtw_seg_too_short(bus_dmamap_t dmamap)
3119{
3120	int i;
3121	for (i = 0; i < dmamap->dm_nsegs; i++) {
3122		if (dmamap->dm_segs[i].ds_len < 4)
3123			return 1;
3124	}
3125	return 0;
3126}
3127
3128/* TBD factor with atw_start */
3129static struct mbuf *
3130rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3131    u_int ndescfree, device_t dev)
3132{
3133	int first, rc;
3134	struct mbuf *m, *m0;
3135
3136	m0 = chain;
3137
3138	/*
3139	 * Load the DMA map.  Copy and try (once) again if the packet
3140	 * didn't fit in the alloted number of segments.
3141	 */
3142	for (first = 1;
3143	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3144			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3145	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3146	     first = 0) {
3147		if (rc == 0) {
3148#ifdef RTW_DIAGxxx
3149			if (rtw_seg_too_short(dmam)) {
3150				printf("%s: short segment, mbuf lengths:", __func__);
3151				for (m = m0; m; m = m->m_next)
3152					printf(" %d", m->m_len);
3153				printf("\n");
3154			}
3155#endif
3156			bus_dmamap_unload(dmat, dmam);
3157		}
3158		MGETHDR(m, M_DONTWAIT, MT_DATA);
3159		if (m == NULL) {
3160			aprint_error_dev(dev, "unable to allocate Tx mbuf\n");
3161			break;
3162		}
3163		if (m0->m_pkthdr.len > MHLEN) {
3164			MCLGET(m, M_DONTWAIT);
3165			if ((m->m_flags & M_EXT) == 0) {
3166				aprint_error_dev(dev,
3167				    "cannot allocate Tx cluster\n");
3168				m_freem(m);
3169				break;
3170			}
3171		}
3172		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3173		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3174		m_freem(m0);
3175		m0 = m;
3176		m = NULL;
3177	}
3178	if (rc != 0) {
3179		aprint_error_dev(dev, "cannot load Tx buffer, rc = %d\n", rc);
3180		m_freem(m0);
3181		return NULL;
3182	} else if (rtw_seg_too_short(dmam)) {
3183		aprint_error_dev(dev,
3184		    "cannot load Tx buffer, segment too short\n");
3185		bus_dmamap_unload(dmat, dmam);
3186		m_freem(m0);
3187		return NULL;
3188	} else if (dmam->dm_nsegs > ndescfree) {
3189		aprint_error_dev(dev, "too many tx segments\n");
3190		bus_dmamap_unload(dmat, dmam);
3191		m_freem(m0);
3192		return NULL;
3193	}
3194	return m0;
3195}
3196
3197#ifdef RTW_DEBUG
3198static void
3199rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3200    struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3201{
3202	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3203	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3204	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3205	    device_xname(sc->sc_dev), ts, action, desc,
3206	    le32toh(td->td_buf), le32toh(td->td_next),
3207	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3208	    le32toh(td->td_len)));
3209}
3210#endif /* RTW_DEBUG */
3211
3212static void
3213rtw_start(struct ifnet *ifp)
3214{
3215	uint8_t tppoll;
3216	int desc, i, lastdesc, npkt, rate;
3217	uint32_t proto_ctl0, ctl0, ctl1;
3218	bus_dmamap_t		dmamap;
3219	struct ieee80211com	*ic;
3220	struct ieee80211_duration *d0;
3221	struct ieee80211_frame_min	*wh;
3222	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3223	struct mbuf		*m0;
3224	struct rtw_softc	*sc;
3225	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3226	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3227	struct rtw_txsoft	*ts;
3228	struct rtw_txdesc	*td;
3229	struct ieee80211_key	*k;
3230
3231	sc = (struct rtw_softc *)ifp->if_softc;
3232	ic = &sc->sc_ic;
3233
3234	DPRINTF(sc, RTW_DEBUG_XMIT,
3235	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3236
3237	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3238		goto out;
3239
3240	/* XXX do real rate control */
3241	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3242
3243	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3244		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3245
3246	for (;;) {
3247		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3248			continue;
3249		if (m0 == NULL)
3250			break;
3251
3252		wh = mtod(m0, struct ieee80211_frame_min *);
3253
3254		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3255		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3256			m_freem(m0);
3257			break;
3258		} else
3259			k = NULL;
3260
3261		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3262
3263		dmamap = ts->ts_dmamap;
3264
3265		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3266		    tdb->tdb_nfree, sc->sc_dev);
3267
3268		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3269			DPRINTF(sc, RTW_DEBUG_XMIT,
3270			    ("%s: fail dmamap load\n", __func__));
3271			goto post_dequeue_err;
3272		}
3273
3274		/* Note well: rtw_dmamap_load_txbuf may have created
3275		 * a new chain, so we must find the header once
3276		 * more.
3277		 */
3278		wh = mtod(m0, struct ieee80211_frame_min *);
3279
3280		/* XXX do real rate control */
3281		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3282		    IEEE80211_FC0_TYPE_MGT)
3283			rate = 2;
3284		else
3285			rate = MAX(2, ieee80211_get_rate(ni));
3286
3287#ifdef RTW_DEBUG
3288		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3289		    (IFF_DEBUG|IFF_LINK2)) {
3290			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3291			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3292			                            : sizeof(wh),
3293			    rate, 0);
3294		}
3295#endif /* RTW_DEBUG */
3296		ctl0 = proto_ctl0 |
3297		    __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3298
3299		switch (rate) {
3300		default:
3301		case 2:
3302			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3303			break;
3304		case 4:
3305			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3306			break;
3307		case 11:
3308			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3309			break;
3310		case 22:
3311			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3312			break;
3313		}
3314		/* XXX >= ? Compare after fragmentation? */
3315		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3316			ctl0 |= RTW_TXCTL0_RTSEN;
3317
3318                /* XXX Sometimes writes a bogus keyid; h/w doesn't
3319                 * seem to care, since we don't activate h/w Tx
3320                 * encryption.
3321		 */
3322		if (k != NULL) {
3323			ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3324			    RTW_TXCTL0_KEYID_MASK;
3325		}
3326
3327		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3328		    IEEE80211_FC0_TYPE_MGT) {
3329			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3330			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3331			    IEEE80211_FC0_SUBTYPE_BEACON)
3332				ctl0 |= RTW_TXCTL0_BEACON;
3333		}
3334
3335		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3336		    ic->ic_flags, ic->ic_fragthreshold,
3337		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3338		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3339		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3340			DPRINTF(sc, RTW_DEBUG_XMIT,
3341			    ("%s: fail compute duration\n", __func__));
3342			goto post_load_err;
3343		}
3344
3345		d0 = &ts->ts_d0;
3346
3347		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3348
3349		ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3350		    __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3351
3352		if (d0->d_residue)
3353			ctl1 |= RTW_TXCTL1_LENGEXT;
3354
3355		/* TBD fragmentation */
3356
3357		ts->ts_first = tdb->tdb_next;
3358
3359		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3360		    BUS_DMASYNC_PREWRITE);
3361
3362		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3363
3364#if NBPFILTER > 0
3365		if (ic->ic_rawbpf != NULL)
3366			bpf_mtap((void *)ic->ic_rawbpf, m0);
3367
3368		if (sc->sc_radiobpf != NULL) {
3369			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3370
3371			rt->rt_rate = rate;
3372
3373			bpf_mtap2(sc->sc_radiobpf, (void *)rt,
3374			    sizeof(sc->sc_txtapu), m0);
3375		}
3376#endif /* NBPFILTER > 0 */
3377
3378		for (i = 0, lastdesc = desc = ts->ts_first;
3379		     i < dmamap->dm_nsegs;
3380		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3381			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3382				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3383				    ("%s: seg too long\n", __func__));
3384				goto post_load_err;
3385			}
3386			td = &tdb->tdb_desc[desc];
3387			td->td_ctl0 = htole32(ctl0);
3388			td->td_ctl1 = htole32(ctl1);
3389			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3390			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3391			td->td_next = htole32(RTW_NEXT_DESC(tdb, desc));
3392			if (i != 0)
3393				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3394			lastdesc = desc;
3395#ifdef RTW_DEBUG
3396			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3397#endif /* RTW_DEBUG */
3398		}
3399
3400		KASSERT(desc < tdb->tdb_ndesc);
3401
3402		ts->ts_ni = ni;
3403		KASSERT(ni != NULL);
3404		ts->ts_mbuf = m0;
3405		ts->ts_last = lastdesc;
3406		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3407		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3408		   htole32(RTW_TXCTL0_FS);
3409
3410#ifdef RTW_DEBUG
3411		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3412		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3413#endif /* RTW_DEBUG */
3414
3415		tdb->tdb_nfree -= dmamap->dm_nsegs;
3416		tdb->tdb_next = desc;
3417
3418		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3419		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3420
3421		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3422		    htole32(RTW_TXCTL0_OWN);
3423
3424#ifdef RTW_DEBUG
3425		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3426#endif /* RTW_DEBUG */
3427
3428		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3429		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3430
3431		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3432		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3433
3434		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3435			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3436		tsb->tsb_tx_timer = 5;
3437		ifp->if_timer = 1;
3438		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3439		tppoll &= ~RTW_TPPOLL_SALL;
3440		tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
3441		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3442		RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
3443	}
3444out:
3445	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3446	return;
3447post_load_err:
3448	bus_dmamap_unload(sc->sc_dmat, dmamap);
3449	m_freem(m0);
3450post_dequeue_err:
3451	ieee80211_free_node(ni);
3452	return;
3453}
3454
3455static void
3456rtw_idle(struct rtw_regs *regs)
3457{
3458	int active;
3459	uint8_t tppoll;
3460
3461	/* request stop DMA; wait for packets to stop transmitting. */
3462
3463	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3464	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3465
3466	for (active = 0; active < 300 &&
3467	     (tppoll = RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0;
3468	     active++)
3469		DELAY(10);
3470	printf("%s: transmit DMA idle in %dus, tppoll %02" PRIx8 "\n", __func__,
3471	    active * 10, tppoll);
3472}
3473
3474static void
3475rtw_watchdog(struct ifnet *ifp)
3476{
3477	int pri, tx_timeouts = 0;
3478	struct rtw_softc *sc;
3479	struct rtw_txsoft_blk *tsb;
3480
3481	sc = ifp->if_softc;
3482
3483	ifp->if_timer = 0;
3484
3485	if (!device_is_active(sc->sc_dev))
3486		return;
3487
3488	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3489		tsb = &sc->sc_txsoft_blk[pri];
3490
3491		if (tsb->tsb_tx_timer == 0)
3492			continue;
3493		else if (--tsb->tsb_tx_timer == 0) {
3494			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3495				continue;
3496			printf("%s: transmit timeout, priority %d\n",
3497			    ifp->if_xname, pri);
3498			ifp->if_oerrors++;
3499			if (pri != RTW_TXPRIBCN)
3500				tx_timeouts++;
3501		} else
3502			ifp->if_timer = 1;
3503	}
3504
3505	if (tx_timeouts > 0) {
3506		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3507		 * reset s/w tx-ring pointers, and start transmission.
3508		 *
3509		 * TBD Stop/restart just the broken rings?
3510		 */
3511		rtw_idle(&sc->sc_regs);
3512		rtw_io_enable(sc, RTW_CR_TE, 0);
3513		rtw_txdescs_reset(sc);
3514		rtw_io_enable(sc, RTW_CR_TE, 1);
3515		rtw_start(ifp);
3516	}
3517	ieee80211_watchdog(&sc->sc_ic);
3518	return;
3519}
3520
3521static void
3522rtw_next_scan(void *arg)
3523{
3524	struct ieee80211com *ic = arg;
3525	int s;
3526
3527	/* don't call rtw_start w/o network interrupts blocked */
3528	s = splnet();
3529	if (ic->ic_state == IEEE80211_S_SCAN)
3530		ieee80211_next_scan(ic);
3531	splx(s);
3532}
3533
3534static void
3535rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3536{
3537	uint16_t bcnitv, bintritv, intval;
3538	int i;
3539	struct rtw_regs *regs = &sc->sc_regs;
3540
3541	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3542		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3543
3544	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3545
3546	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3547
3548	intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3549
3550	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3551	bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3552	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3553	/* interrupt host 1ms before the TBTT */
3554	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3555	bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3556	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3557	/* magic from Linux */
3558	RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3559	RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3560	rtw_set_access(regs, RTW_ACCESS_NONE);
3561
3562	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3563}
3564
3565/* Synchronize the hardware state with the software state. */
3566static int
3567rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3568{
3569	struct ifnet *ifp = ic->ic_ifp;
3570	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3571	enum ieee80211_state ostate;
3572	int error;
3573
3574	ostate = ic->ic_state;
3575
3576	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3577	rtw_led_newstate(sc, nstate);
3578
3579	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3580	if (nstate == IEEE80211_S_INIT) {
3581		callout_stop(&sc->sc_scan_ch);
3582		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3583		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3584	}
3585
3586	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3587		rtw_pwrstate(sc, RTW_ON);
3588
3589	if ((error = rtw_tune(sc)) != 0)
3590		return error;
3591
3592	switch (nstate) {
3593	case IEEE80211_S_INIT:
3594		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3595		break;
3596	case IEEE80211_S_SCAN:
3597		if (ostate != IEEE80211_S_SCAN) {
3598			(void)memset(ic->ic_bss->ni_bssid, 0,
3599			    IEEE80211_ADDR_LEN);
3600			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3601		}
3602
3603		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3604		    rtw_next_scan, ic);
3605
3606		break;
3607	case IEEE80211_S_RUN:
3608		switch (ic->ic_opmode) {
3609		case IEEE80211_M_HOSTAP:
3610		case IEEE80211_M_IBSS:
3611			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3612			/*FALLTHROUGH*/
3613		case IEEE80211_M_AHDEMO:
3614		case IEEE80211_M_STA:
3615			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3616			    ic->ic_bss->ni_intval);
3617			break;
3618		case IEEE80211_M_MONITOR:
3619			break;
3620		}
3621		rtw_set_nettype(sc, ic->ic_opmode);
3622		break;
3623	case IEEE80211_S_ASSOC:
3624	case IEEE80211_S_AUTH:
3625		break;
3626	}
3627
3628	if (nstate != IEEE80211_S_SCAN)
3629		callout_stop(&sc->sc_scan_ch);
3630
3631	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3632}
3633
3634/* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3635static uint64_t
3636rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3637{
3638	uint32_t tsftl, tsfth;
3639
3640	tsfth = RTW_READ(regs, RTW_TSFTRH);
3641	tsftl = RTW_READ(regs, RTW_TSFTRL);
3642	if (tsftl < rstamp)	/* Compensate for rollover. */
3643		tsfth--;
3644	return ((uint64_t)tsfth << 32) | rstamp;
3645}
3646
3647static void
3648rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3649    struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3650{
3651	struct ifnet *ifp = ic->ic_ifp;
3652	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3653
3654	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3655
3656	switch (subtype) {
3657	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3658	case IEEE80211_FC0_SUBTYPE_BEACON:
3659		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3660		    ic->ic_state == IEEE80211_S_RUN &&
3661		    device_is_active(sc->sc_dev)) {
3662			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3663			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3664				(void)ieee80211_ibss_merge(ni);
3665		}
3666		break;
3667	default:
3668		break;
3669	}
3670	return;
3671}
3672
3673static struct ieee80211_node *
3674rtw_node_alloc(struct ieee80211_node_table *nt)
3675{
3676	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3677	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3678	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3679
3680	DPRINTF(sc, RTW_DEBUG_NODE,
3681	    ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
3682	return ni;
3683}
3684
3685static void
3686rtw_node_free(struct ieee80211_node *ni)
3687{
3688	struct ieee80211com *ic = ni->ni_ic;
3689	struct ifnet *ifp = ic->ic_ifp;
3690	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3691
3692	DPRINTF(sc, RTW_DEBUG_NODE,
3693	    ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
3694	    ether_sprintf(ni->ni_bssid)));
3695	(*sc->sc_mtbl.mt_node_free)(ni);
3696}
3697
3698static int
3699rtw_media_change(struct ifnet *ifp)
3700{
3701	int error;
3702
3703	error = ieee80211_media_change(ifp);
3704	if (error == ENETRESET) {
3705		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3706		    (IFF_RUNNING|IFF_UP))
3707			rtw_init(ifp);		/* XXX lose error */
3708		error = 0;
3709	}
3710	return error;
3711}
3712
3713static void
3714rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3715{
3716	struct rtw_softc *sc = ifp->if_softc;
3717
3718	if (!device_is_active(sc->sc_dev)) {
3719		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3720		imr->ifm_status = 0;
3721		return;
3722	}
3723	ieee80211_media_status(ifp, imr);
3724}
3725
3726static inline void
3727rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3728{
3729	(void)strlcpy(ifp->if_xname, dvname, IFNAMSIZ);
3730	ifp->if_softc = softc;
3731	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3732	    IFF_NOTRAILERS;
3733	ifp->if_ioctl = rtw_ioctl;
3734	ifp->if_start = rtw_start;
3735	ifp->if_watchdog = rtw_watchdog;
3736	ifp->if_init = rtw_init;
3737	ifp->if_stop = rtw_stop;
3738}
3739
3740static inline void
3741rtw_set80211props(struct ieee80211com *ic)
3742{
3743	int nrate;
3744	ic->ic_phytype = IEEE80211_T_DS;
3745	ic->ic_opmode = IEEE80211_M_STA;
3746	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3747	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
3748
3749	nrate = 0;
3750	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3751	    IEEE80211_RATE_BASIC | 2;
3752	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3753	    IEEE80211_RATE_BASIC | 4;
3754	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3755	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3756	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3757}
3758
3759static inline void
3760rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3761{
3762	mtbl->mt_newstate = ic->ic_newstate;
3763	ic->ic_newstate = rtw_newstate;
3764
3765	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3766	ic->ic_recv_mgmt = rtw_recv_mgmt;
3767
3768	mtbl->mt_node_free = ic->ic_node_free;
3769	ic->ic_node_free = rtw_node_free;
3770
3771	mtbl->mt_node_alloc = ic->ic_node_alloc;
3772	ic->ic_node_alloc = rtw_node_alloc;
3773
3774	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3775	ic->ic_crypto.cs_key_set = rtw_key_set;
3776	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3777	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3778}
3779
3780static inline void
3781rtw_init_radiotap(struct rtw_softc *sc)
3782{
3783	uint32_t present;
3784
3785	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3786	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3787
3788	if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
3789		present = htole32(RTW_PHILIPS_RX_RADIOTAP_PRESENT);
3790	else
3791		present = htole32(RTW_RX_RADIOTAP_PRESENT);
3792	sc->sc_rxtap.rr_ihdr.it_present = present;
3793
3794	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3795	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3796	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3797}
3798
3799static int
3800rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3801{
3802	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3803	SIMPLEQ_INIT(&tsb->tsb_freeq);
3804	tsb->tsb_ndesc = qlen;
3805	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3806	    M_NOWAIT);
3807	if (tsb->tsb_desc == NULL)
3808		return ENOMEM;
3809	return 0;
3810}
3811
3812static void
3813rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3814{
3815	int pri;
3816	struct rtw_txsoft_blk *tsb;
3817
3818	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3819		tsb = &sc->sc_txsoft_blk[pri];
3820		free(tsb->tsb_desc, M_DEVBUF);
3821		tsb->tsb_desc = NULL;
3822	}
3823}
3824
3825static int
3826rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3827{
3828	int pri, rc = 0;
3829	int qlen[RTW_NTXPRI] =
3830	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3831	struct rtw_txsoft_blk *tsbs;
3832
3833	tsbs = sc->sc_txsoft_blk;
3834
3835	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3836		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3837		if (rc != 0)
3838			break;
3839	}
3840	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3841	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3842	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3843	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3844	return rc;
3845}
3846
3847static void
3848rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3849    u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3850{
3851	tdb->tdb_ndesc = ndesc;
3852	tdb->tdb_desc = desc;
3853	tdb->tdb_physbase = physbase;
3854	tdb->tdb_ofs = ofs;
3855
3856	(void)memset(tdb->tdb_desc, 0,
3857	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3858
3859	rtw_txdesc_blk_init(tdb);
3860	tdb->tdb_next = 0;
3861}
3862
3863static void
3864rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3865{
3866	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3867	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3868	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3869
3870	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3871	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3872	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3873
3874	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3875	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3876	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3877
3878	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3879	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3880	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3881}
3882
3883static struct rtw_rf *
3884rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3885{
3886	rtw_rf_write_t rf_write;
3887	struct rtw_rf *rf;
3888
3889	switch (rfchipid) {
3890	default:
3891		rf_write = rtw_rf_hostwrite;
3892		break;
3893	case RTW_RFCHIPID_INTERSIL:
3894	case RTW_RFCHIPID_PHILIPS:
3895	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3896	case RTW_RFCHIPID_RFMD:
3897		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3898		break;
3899	}
3900
3901	switch (rfchipid) {
3902	case RTW_RFCHIPID_GCT:
3903		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3904		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3905		break;
3906	case RTW_RFCHIPID_MAXIM:
3907		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3908		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3909		break;
3910	case RTW_RFCHIPID_PHILIPS:
3911		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
3912		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3913		break;
3914	case RTW_RFCHIPID_RFMD:
3915		/* XXX RFMD has no RF constructor */
3916		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3917		/*FALLTHROUGH*/
3918	default:
3919		return NULL;
3920	}
3921	rf->rf_continuous_tx_cb =
3922	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
3923	rf->rf_continuous_tx_arg = (void *)sc;
3924	return rf;
3925}
3926
3927/* Revision C and later use a different PHY delay setting than
3928 * revisions A and B.
3929 */
3930static uint8_t
3931rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
3932{
3933#define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
3934#define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
3935
3936	uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
3937
3938	RTW_WRITE(regs, RTW_RCR, REVAB);
3939	RTW_WBW(regs, RTW_RCR, RTW_RCR);
3940	RTW_WRITE(regs, RTW_RCR, REVC);
3941
3942	RTW_WBR(regs, RTW_RCR, RTW_RCR);
3943	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
3944		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
3945
3946	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
3947	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
3948
3949	return phydelay;
3950#undef REVC
3951}
3952
3953void
3954rtw_attach(struct rtw_softc *sc)
3955{
3956	struct ifnet *ifp = &sc->sc_if;
3957	struct ieee80211com *ic = &sc->sc_ic;
3958	struct rtw_txsoft_blk *tsb;
3959	int pri, rc;
3960
3961	rtw_cipher_wep = ieee80211_cipher_wep;
3962	rtw_cipher_wep.ic_decap = rtw_wep_decap;
3963
3964	NEXT_ATTACH_STATE(sc, DETACHED);
3965
3966	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
3967	case RTW_TCR_HWVERID_F:
3968		sc->sc_hwverid = 'F';
3969		break;
3970	case RTW_TCR_HWVERID_D:
3971		sc->sc_hwverid = 'D';
3972		break;
3973	default:
3974		sc->sc_hwverid = '?';
3975		break;
3976	}
3977	aprint_verbose_dev(sc->sc_dev, "hardware version %c\n",
3978	    sc->sc_hwverid);
3979
3980	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
3981	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
3982	    0);
3983
3984	if (rc != 0) {
3985		aprint_error_dev(sc->sc_dev,
3986		    "could not allocate hw descriptors, error %d\n", rc);
3987		goto err;
3988	}
3989
3990	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
3991
3992	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
3993	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
3994	    (void **)&sc->sc_descs, BUS_DMA_COHERENT);
3995
3996	if (rc != 0) {
3997		aprint_error_dev(sc->sc_dev,
3998		    "could not map hw descriptors, error %d\n", rc);
3999		goto err;
4000	}
4001	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4002
4003	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4004	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4005
4006	if (rc != 0) {
4007		aprint_error_dev(sc->sc_dev,
4008		    "could not create DMA map for hw descriptors, error %d\n",
4009		    rc);
4010		goto err;
4011	}
4012	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4013
4014	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4015	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4016
4017	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4018		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4019		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4020	}
4021
4022	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4023	    sizeof(struct rtw_descs), NULL, 0);
4024
4025	if (rc != 0) {
4026		aprint_error_dev(sc->sc_dev,
4027		    "could not load DMA map for hw descriptors, error %d\n",
4028		    rc);
4029		goto err;
4030	}
4031	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4032
4033	if (rtw_txsoft_blk_setup_all(sc) != 0)
4034		goto err;
4035	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4036
4037	rtw_txdesc_blk_setup_all(sc);
4038
4039	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4040
4041	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4042
4043	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4044		tsb = &sc->sc_txsoft_blk[pri];
4045
4046		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4047		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4048			aprint_error_dev(sc->sc_dev,
4049			    "could not load DMA map for hw tx descriptors, "
4050			    "error %d\n", rc);
4051			goto err;
4052		}
4053	}
4054
4055	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4056	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4057	                                    RTW_RXQLEN)) != 0) {
4058		aprint_error_dev(sc->sc_dev,
4059		    "could not load DMA map for hw rx descriptors, error %d\n",
4060		    rc);
4061		goto err;
4062	}
4063	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4064
4065	/* Reset the chip to a known state. */
4066	if (rtw_reset(sc) != 0)
4067		goto err;
4068	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4069
4070	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4071
4072	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4073		sc->sc_flags |= RTW_F_9356SROM;
4074
4075	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4076	    sc->sc_dev) != 0)
4077		goto err;
4078
4079	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4080
4081	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4082	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4083	    sc->sc_dev) != 0) {
4084		aprint_error_dev(sc->sc_dev,
4085		    "attach failed, malformed serial ROM\n");
4086		goto err;
4087	}
4088
4089	aprint_verbose_dev(sc->sc_dev, "%s PHY\n",
4090	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4091
4092	aprint_verbose_dev(sc->sc_dev, "carrier-sense threshold %u\n",
4093	    sc->sc_csthr);
4094
4095	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4096
4097	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4098	    sc->sc_flags & RTW_F_DIGPHY);
4099
4100	if (sc->sc_rf == NULL) {
4101		aprint_verbose_dev(sc->sc_dev,
4102		    "attach failed, could not attach RF\n");
4103		goto err;
4104	}
4105
4106	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4107
4108	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4109
4110	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4111	    ("%s: PHY delay %d\n", device_xname(sc->sc_dev), sc->sc_phydelay));
4112
4113	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4114		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4115
4116	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels, sc->sc_dev);
4117
4118	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4119	    sc->sc_dev) != 0)
4120		goto err;
4121	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4122
4123	rtw_setifprops(ifp, device_xname(sc->sc_dev), (void*)sc);
4124
4125	IFQ_SET_READY(&ifp->if_snd);
4126
4127	sc->sc_ic.ic_ifp = ifp;
4128	rtw_set80211props(&sc->sc_ic);
4129
4130	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4131
4132	/*
4133	 * Call MI attach routines.
4134	 */
4135	if_attach(ifp);
4136	ieee80211_ifattach(&sc->sc_ic);
4137
4138	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4139
4140	/* possibly we should fill in our own sc_send_prresp, since
4141	 * the RTL8180 is probably sending probe responses in ad hoc
4142	 * mode.
4143	 */
4144
4145	/* complete initialization */
4146	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4147	callout_init(&sc->sc_scan_ch, 0);
4148
4149	rtw_init_radiotap(sc);
4150
4151#if NBPFILTER > 0
4152	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
4153	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4154#endif
4155
4156	NEXT_ATTACH_STATE(sc, FINISHED);
4157
4158	ieee80211_announce(ic);
4159	return;
4160err:
4161	rtw_detach(sc);
4162	return;
4163}
4164
4165int
4166rtw_detach(struct rtw_softc *sc)
4167{
4168	struct ifnet *ifp = &sc->sc_if;
4169	int pri, s;
4170
4171	s = splnet();
4172
4173	switch (sc->sc_attach_state) {
4174	case FINISHED:
4175		rtw_stop(ifp, 1);
4176
4177		pmf_device_deregister(sc->sc_dev);
4178		callout_stop(&sc->sc_scan_ch);
4179		ieee80211_ifdetach(&sc->sc_ic);
4180		if_detach(ifp);
4181		rtw_led_detach(&sc->sc_led_state);
4182		/*FALLTHROUGH*/
4183	case FINISH_ID_STA:
4184	case FINISH_RF_ATTACH:
4185		rtw_rf_destroy(sc->sc_rf);
4186		sc->sc_rf = NULL;
4187		/*FALLTHROUGH*/
4188	case FINISH_PARSE_SROM:
4189	case FINISH_READ_SROM:
4190		rtw_srom_free(&sc->sc_srom);
4191		/*FALLTHROUGH*/
4192	case FINISH_RESET:
4193	case FINISH_RXMAPS_CREATE:
4194		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4195		    RTW_RXQLEN);
4196		/*FALLTHROUGH*/
4197	case FINISH_TXMAPS_CREATE:
4198		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4199			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4200			    sc->sc_txsoft_blk[pri].tsb_desc,
4201			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4202		}
4203		/*FALLTHROUGH*/
4204	case FINISH_TXDESCBLK_SETUP:
4205	case FINISH_TXCTLBLK_SETUP:
4206		rtw_txsoft_blk_cleanup_all(sc);
4207		/*FALLTHROUGH*/
4208	case FINISH_DESCMAP_LOAD:
4209		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4210		/*FALLTHROUGH*/
4211	case FINISH_DESCMAP_CREATE:
4212		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4213		/*FALLTHROUGH*/
4214	case FINISH_DESC_MAP:
4215		bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_descs,
4216		    sizeof(struct rtw_descs));
4217		/*FALLTHROUGH*/
4218	case FINISH_DESC_ALLOC:
4219		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4220		    sc->sc_desc_nsegs);
4221		/*FALLTHROUGH*/
4222	case DETACHED:
4223		NEXT_ATTACH_STATE(sc, DETACHED);
4224		break;
4225	}
4226	splx(s);
4227	return 0;
4228}
4229