rtw.c revision 1.116
1/* $NetBSD: rtw.c,v 1.116 2010/04/05 07:19:36 joerg Exp $ */
2/*-
3 * Copyright (c) 2004, 2005, 2006, 2007 David Young.  All rights
4 * reserved.
5 *
6 * Programmed for NetBSD by David Young.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
19 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
20 * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
21 * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
22 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
23 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
28 * OF SUCH DAMAGE.
29 */
30/*
31 * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
32 */
33
34#include <sys/cdefs.h>
35__KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.116 2010/04/05 07:19:36 joerg Exp $");
36
37
38#include <sys/param.h>
39#include <sys/sysctl.h>
40#include <sys/systm.h>
41#include <sys/callout.h>
42#include <sys/mbuf.h>
43#include <sys/malloc.h>
44#include <sys/kernel.h>
45#include <sys/time.h>
46#include <sys/types.h>
47#include <sys/device.h>
48
49#include <machine/endian.h>
50#include <sys/bus.h>
51#include <sys/intr.h>	/* splnet */
52
53#include <uvm/uvm_extern.h>
54
55#include <net/if.h>
56#include <net/if_media.h>
57#include <net/if_ether.h>
58
59#include <net80211/ieee80211_netbsd.h>
60#include <net80211/ieee80211_var.h>
61#include <net80211/ieee80211_radiotap.h>
62
63#include <net/bpf.h>
64
65#include <dev/ic/rtwreg.h>
66#include <dev/ic/rtwvar.h>
67#include <dev/ic/rtwphyio.h>
68#include <dev/ic/rtwphy.h>
69
70#include <dev/ic/smc93cx6var.h>
71
72static int rtw_rfprog_fallback = 0;
73static int rtw_host_rfio = 0;
74
75#ifdef RTW_DEBUG
76int rtw_debug = 0;
77static int rtw_rxbufs_limit = RTW_RXQLEN;
78#endif /* RTW_DEBUG */
79
80#define NEXT_ATTACH_STATE(sc, state) do {			\
81	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
82	    ("%s: attach state %s\n", __func__, #state));	\
83	sc->sc_attach_state = state;				\
84} while (0)
85
86int rtw_dwelltime = 200;	/* milliseconds */
87static struct ieee80211_cipher rtw_cipher_wep;
88
89static void rtw_disable_interrupts(struct rtw_regs *);
90static void rtw_enable_interrupts(struct rtw_softc *);
91
92static int rtw_init(struct ifnet *);
93
94static void rtw_start(struct ifnet *);
95static void rtw_reset_oactive(struct rtw_softc *);
96static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
97    struct ieee80211_node *);
98static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
99
100static void rtw_io_enable(struct rtw_softc *, uint8_t, int);
101static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
102static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
103    const u_int8_t[IEEE80211_ADDR_LEN]);
104static void rtw_key_update_end(struct ieee80211com *);
105static void rtw_key_update_begin(struct ieee80211com *);
106static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
107static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
108
109static void rtw_led_attach(struct rtw_led_state *, void *);
110static void rtw_led_detach(struct rtw_led_state *);
111static void rtw_led_init(struct rtw_regs *);
112static void rtw_led_slowblink(void *);
113static void rtw_led_fastblink(void *);
114static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
115
116static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
117static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
118#ifdef RTW_DEBUG
119static void rtw_dump_rings(struct rtw_softc *sc);
120static void rtw_print_txdesc(struct rtw_softc *, const char *,
121    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
122static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
123static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
124#endif /* RTW_DEBUG */
125#ifdef RTW_DIAG
126static void rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln);
127#endif /* RTW_DIAG */
128
129/*
130 * Setup sysctl(3) MIB, hw.rtw.*
131 *
132 * TBD condition CTLFLAG_PERMANENT on being a module or not
133 */
134SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
135{
136	int rc;
137	const struct sysctlnode *cnode, *rnode;
138
139	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
140	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
141	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
142		goto err;
143
144	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
145	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
146	    "Realtek RTL818x 802.11 controls",
147	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
148		goto err;
149
150#ifdef RTW_DEBUG
151	/* control debugging printfs */
152	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
153	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
154	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
155	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
156	    CTL_CREATE, CTL_EOL)) != 0)
157		goto err;
158
159	/* Limit rx buffers, for simulating resource exhaustion. */
160	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
161	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
162	    "rxbufs_limit",
163	    SYSCTL_DESCR("Set rx buffers limit"),
164	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
165	    CTL_CREATE, CTL_EOL)) != 0)
166		goto err;
167
168#endif /* RTW_DEBUG */
169	/* set fallback RF programming method */
170	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
171	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
172	    "rfprog_fallback",
173	    SYSCTL_DESCR("Set fallback RF programming method"),
174	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
175	    CTL_CREATE, CTL_EOL)) != 0)
176		goto err;
177
178	/* force host to control RF I/O bus */
179	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
180	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
181	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
182	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
183	    CTL_CREATE, CTL_EOL)) != 0)
184		goto err;
185
186	return;
187err:
188	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
189}
190
191static int
192rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
193{
194	int error, t;
195	struct sysctlnode node;
196
197	node = *rnode;
198	t = *(int*)rnode->sysctl_data;
199	node.sysctl_data = &t;
200	error = sysctl_lookup(SYSCTLFN_CALL(&node));
201	if (error || newp == NULL)
202		return (error);
203
204	if (t < lower || t > upper)
205		return (EINVAL);
206
207	*(int*)rnode->sysctl_data = t;
208
209	return (0);
210}
211
212static int
213rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
214{
215	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
216	    __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
217}
218
219static int
220rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
221{
222	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
223}
224
225#ifdef RTW_DEBUG
226static int
227rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
228{
229	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
230	    0, RTW_DEBUG_MAX);
231}
232
233static int
234rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
235{
236	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
237	    0, RTW_RXQLEN);
238}
239
240static void
241rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
242{
243#define PRINTREG32(sc, reg)				\
244	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
245	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
246	    dvname, reg, RTW_READ(regs, reg)))
247
248#define PRINTREG16(sc, reg)				\
249	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
250	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
251	    dvname, reg, RTW_READ16(regs, reg)))
252
253#define PRINTREG8(sc, reg)				\
254	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
255	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
256	    dvname, reg, RTW_READ8(regs, reg)))
257
258	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
259
260	PRINTREG32(regs, RTW_IDR0);
261	PRINTREG32(regs, RTW_IDR1);
262	PRINTREG32(regs, RTW_MAR0);
263	PRINTREG32(regs, RTW_MAR1);
264	PRINTREG32(regs, RTW_TSFTRL);
265	PRINTREG32(regs, RTW_TSFTRH);
266	PRINTREG32(regs, RTW_TLPDA);
267	PRINTREG32(regs, RTW_TNPDA);
268	PRINTREG32(regs, RTW_THPDA);
269	PRINTREG32(regs, RTW_TCR);
270	PRINTREG32(regs, RTW_RCR);
271	PRINTREG32(regs, RTW_TINT);
272	PRINTREG32(regs, RTW_TBDA);
273	PRINTREG32(regs, RTW_ANAPARM);
274	PRINTREG32(regs, RTW_BB);
275	PRINTREG32(regs, RTW_PHYCFG);
276	PRINTREG32(regs, RTW_WAKEUP0L);
277	PRINTREG32(regs, RTW_WAKEUP0H);
278	PRINTREG32(regs, RTW_WAKEUP1L);
279	PRINTREG32(regs, RTW_WAKEUP1H);
280	PRINTREG32(regs, RTW_WAKEUP2LL);
281	PRINTREG32(regs, RTW_WAKEUP2LH);
282	PRINTREG32(regs, RTW_WAKEUP2HL);
283	PRINTREG32(regs, RTW_WAKEUP2HH);
284	PRINTREG32(regs, RTW_WAKEUP3LL);
285	PRINTREG32(regs, RTW_WAKEUP3LH);
286	PRINTREG32(regs, RTW_WAKEUP3HL);
287	PRINTREG32(regs, RTW_WAKEUP3HH);
288	PRINTREG32(regs, RTW_WAKEUP4LL);
289	PRINTREG32(regs, RTW_WAKEUP4LH);
290	PRINTREG32(regs, RTW_WAKEUP4HL);
291	PRINTREG32(regs, RTW_WAKEUP4HH);
292	PRINTREG32(regs, RTW_DK0);
293	PRINTREG32(regs, RTW_DK1);
294	PRINTREG32(regs, RTW_DK2);
295	PRINTREG32(regs, RTW_DK3);
296	PRINTREG32(regs, RTW_RETRYCTR);
297	PRINTREG32(regs, RTW_RDSAR);
298	PRINTREG32(regs, RTW_FER);
299	PRINTREG32(regs, RTW_FEMR);
300	PRINTREG32(regs, RTW_FPSR);
301	PRINTREG32(regs, RTW_FFER);
302
303	/* 16-bit registers */
304	PRINTREG16(regs, RTW_BRSR);
305	PRINTREG16(regs, RTW_IMR);
306	PRINTREG16(regs, RTW_ISR);
307	PRINTREG16(regs, RTW_BCNITV);
308	PRINTREG16(regs, RTW_ATIMWND);
309	PRINTREG16(regs, RTW_BINTRITV);
310	PRINTREG16(regs, RTW_ATIMTRITV);
311	PRINTREG16(regs, RTW_CRC16ERR);
312	PRINTREG16(regs, RTW_CRC0);
313	PRINTREG16(regs, RTW_CRC1);
314	PRINTREG16(regs, RTW_CRC2);
315	PRINTREG16(regs, RTW_CRC3);
316	PRINTREG16(regs, RTW_CRC4);
317	PRINTREG16(regs, RTW_CWR);
318
319	/* 8-bit registers */
320	PRINTREG8(regs, RTW_CR);
321	PRINTREG8(regs, RTW_9346CR);
322	PRINTREG8(regs, RTW_CONFIG0);
323	PRINTREG8(regs, RTW_CONFIG1);
324	PRINTREG8(regs, RTW_CONFIG2);
325	PRINTREG8(regs, RTW_MSR);
326	PRINTREG8(regs, RTW_CONFIG3);
327	PRINTREG8(regs, RTW_CONFIG4);
328	PRINTREG8(regs, RTW_TESTR);
329	PRINTREG8(regs, RTW_PSR);
330	PRINTREG8(regs, RTW_SCR);
331	PRINTREG8(regs, RTW_PHYDELAY);
332	PRINTREG8(regs, RTW_CRCOUNT);
333	PRINTREG8(regs, RTW_PHYADDR);
334	PRINTREG8(regs, RTW_PHYDATAW);
335	PRINTREG8(regs, RTW_PHYDATAR);
336	PRINTREG8(regs, RTW_CONFIG5);
337	PRINTREG8(regs, RTW_TPPOLL);
338
339	PRINTREG16(regs, RTW_BSSID16);
340	PRINTREG32(regs, RTW_BSSID32);
341#undef PRINTREG32
342#undef PRINTREG16
343#undef PRINTREG8
344}
345#endif /* RTW_DEBUG */
346
347void
348rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
349{
350	struct rtw_regs *regs = &sc->sc_regs;
351
352	uint32_t tcr;
353	tcr = RTW_READ(regs, RTW_TCR);
354	tcr &= ~RTW_TCR_LBK_MASK;
355	if (enable)
356		tcr |= RTW_TCR_LBK_CONT;
357	else
358		tcr |= RTW_TCR_LBK_NORMAL;
359	RTW_WRITE(regs, RTW_TCR, tcr);
360	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
361	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
362	rtw_txdac_enable(sc, !enable);
363	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
364	rtw_set_access(regs, RTW_ACCESS_NONE);
365}
366
367#ifdef RTW_DEBUG
368static const char *
369rtw_access_string(enum rtw_access access)
370{
371	switch (access) {
372	case RTW_ACCESS_NONE:
373		return "none";
374	case RTW_ACCESS_CONFIG:
375		return "config";
376	case RTW_ACCESS_ANAPARM:
377		return "anaparm";
378	default:
379		return "unknown";
380	}
381}
382#endif /* RTW_DEBUG */
383
384static void
385rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
386{
387	KASSERT(/* naccess >= RTW_ACCESS_NONE && */
388	    naccess <= RTW_ACCESS_ANAPARM);
389	KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
390	    regs->r_access <= RTW_ACCESS_ANAPARM);
391
392	if (naccess == regs->r_access)
393		return;
394
395	switch (naccess) {
396	case RTW_ACCESS_NONE:
397		switch (regs->r_access) {
398		case RTW_ACCESS_ANAPARM:
399			rtw_anaparm_enable(regs, 0);
400			/*FALLTHROUGH*/
401		case RTW_ACCESS_CONFIG:
402			rtw_config0123_enable(regs, 0);
403			/*FALLTHROUGH*/
404		case RTW_ACCESS_NONE:
405			break;
406		}
407		break;
408	case RTW_ACCESS_CONFIG:
409		switch (regs->r_access) {
410		case RTW_ACCESS_NONE:
411			rtw_config0123_enable(regs, 1);
412			/*FALLTHROUGH*/
413		case RTW_ACCESS_CONFIG:
414			break;
415		case RTW_ACCESS_ANAPARM:
416			rtw_anaparm_enable(regs, 0);
417			break;
418		}
419		break;
420	case RTW_ACCESS_ANAPARM:
421		switch (regs->r_access) {
422		case RTW_ACCESS_NONE:
423			rtw_config0123_enable(regs, 1);
424			/*FALLTHROUGH*/
425		case RTW_ACCESS_CONFIG:
426			rtw_anaparm_enable(regs, 1);
427			/*FALLTHROUGH*/
428		case RTW_ACCESS_ANAPARM:
429			break;
430		}
431		break;
432	}
433}
434
435void
436rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
437{
438	rtw_set_access1(regs, access);
439	RTW_DPRINTF(RTW_DEBUG_ACCESS,
440	    ("%s: access %s -> %s\n", __func__,
441	    rtw_access_string(regs->r_access),
442	    rtw_access_string(access)));
443	regs->r_access = access;
444}
445
446/*
447 * Enable registers, switch register banks.
448 */
449void
450rtw_config0123_enable(struct rtw_regs *regs, int enable)
451{
452	uint8_t ecr;
453	ecr = RTW_READ8(regs, RTW_9346CR);
454	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
455	if (enable)
456		ecr |= RTW_9346CR_EEM_CONFIG;
457	else {
458		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
459		ecr |= RTW_9346CR_EEM_NORMAL;
460	}
461	RTW_WRITE8(regs, RTW_9346CR, ecr);
462	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
463}
464
465/* requires rtw_config0123_enable(, 1) */
466void
467rtw_anaparm_enable(struct rtw_regs *regs, int enable)
468{
469	uint8_t cfg3;
470
471	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
472	cfg3 |= RTW_CONFIG3_CLKRUNEN;
473	if (enable)
474		cfg3 |= RTW_CONFIG3_PARMEN;
475	else
476		cfg3 &= ~RTW_CONFIG3_PARMEN;
477	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
478	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
479}
480
481/* requires rtw_anaparm_enable(, 1) */
482void
483rtw_txdac_enable(struct rtw_softc *sc, int enable)
484{
485	uint32_t anaparm;
486	struct rtw_regs *regs = &sc->sc_regs;
487
488	anaparm = RTW_READ(regs, RTW_ANAPARM);
489	if (enable)
490		anaparm &= ~RTW_ANAPARM_TXDACOFF;
491	else
492		anaparm |= RTW_ANAPARM_TXDACOFF;
493	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
494	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
495}
496
497static inline int
498rtw_chip_reset1(struct rtw_regs *regs, device_t dev)
499{
500	uint8_t cr;
501	int i;
502
503	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
504
505	RTW_WBR(regs, RTW_CR, RTW_CR);
506
507	for (i = 0; i < 1000; i++) {
508		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
509			RTW_DPRINTF(RTW_DEBUG_RESET,
510			    ("%s: reset in %dus\n", device_xname(dev), i));
511			return 0;
512		}
513		RTW_RBR(regs, RTW_CR, RTW_CR);
514		DELAY(10); /* 10us */
515	}
516
517	aprint_error_dev(dev, "reset failed\n");
518	return ETIMEDOUT;
519}
520
521static inline int
522rtw_chip_reset(struct rtw_regs *regs, device_t dev)
523{
524	uint32_t tcr;
525
526	/* from Linux driver */
527	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
528	      __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
529
530	RTW_WRITE(regs, RTW_TCR, tcr);
531
532	RTW_WBW(regs, RTW_CR, RTW_TCR);
533
534	return rtw_chip_reset1(regs, dev);
535}
536
537static int
538rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
539{
540	struct ieee80211_key keycopy;
541
542	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
543
544	keycopy = *k;
545	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
546
547	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
548}
549
550static int
551rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
552{
553	struct rtw_softc *sc = ic->ic_ifp->if_softc;
554
555	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__,
556	    k->wk_keyix));
557
558	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
559
560	if (k->wk_keylen != 0 &&
561	    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP)
562		sc->sc_flags &= ~RTW_F_DK_VALID;
563
564	return 1;
565}
566
567static int
568rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
569    const u_int8_t mac[IEEE80211_ADDR_LEN])
570{
571	struct rtw_softc *sc = ic->ic_ifp->if_softc;
572
573	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
574
575	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
576
577	sc->sc_flags &= ~RTW_F_DK_VALID;
578
579	return 1;
580}
581
582static void
583rtw_key_update_begin(struct ieee80211com *ic)
584{
585#ifdef RTW_DEBUG
586	struct ifnet *ifp = ic->ic_ifp;
587	struct rtw_softc *sc = ifp->if_softc;
588#endif
589
590	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
591}
592
593static void
594rtw_tx_kick(struct rtw_regs *regs, uint8_t ringsel)
595{
596	uint8_t tppoll;
597
598	tppoll = RTW_READ8(regs, RTW_TPPOLL);
599	tppoll &= ~RTW_TPPOLL_SALL;
600	tppoll |= ringsel & RTW_TPPOLL_ALL;
601	RTW_WRITE8(regs, RTW_TPPOLL, tppoll);
602	RTW_SYNC(regs, RTW_TPPOLL, RTW_TPPOLL);
603}
604
605static void
606rtw_key_update_end(struct ieee80211com *ic)
607{
608	struct ifnet *ifp = ic->ic_ifp;
609	struct rtw_softc *sc = ifp->if_softc;
610
611	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
612
613	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
614	    !device_is_active(sc->sc_dev))
615		return;
616
617	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
618	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
619	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
620	    (ifp->if_flags & IFF_RUNNING) != 0);
621}
622
623static bool
624rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
625{
626	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
627		return false;
628
629	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
630		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
631}
632
633static void
634rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
635{
636	uint8_t psr, scr;
637	int i, keylen = 0;
638	struct rtw_regs *regs;
639	union rtw_keys *rk;
640
641	regs = &sc->sc_regs;
642	rk = &sc->sc_keys;
643
644	(void)memset(rk, 0, sizeof(rk));
645
646	/* Temporarily use software crypto for all keys. */
647	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
648		if (wk[i].wk_cipher == &rtw_cipher_wep)
649			wk[i].wk_cipher = &ieee80211_cipher_wep;
650	}
651
652	rtw_set_access(regs, RTW_ACCESS_CONFIG);
653
654	psr = RTW_READ8(regs, RTW_PSR);
655	scr = RTW_READ8(regs, RTW_SCR);
656	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
657
658	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
659		goto out;
660
661	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
662		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
663			continue;
664		if (i == txkey) {
665			keylen = wk[i].wk_keylen;
666			break;
667		}
668		keylen = MAX(keylen, wk[i].wk_keylen);
669	}
670
671	if (keylen == 5)
672		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
673	else if (keylen == 13)
674		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
675
676	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
677		if (wk[i].wk_keylen != keylen ||
678		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
679			continue;
680		/* h/w will decrypt, s/w still strips headers */
681		wk[i].wk_cipher = &rtw_cipher_wep;
682		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
683	}
684
685out:
686	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
687
688	bus_space_write_region_stream_4(regs->r_bt, regs->r_bh,
689	    RTW_DK0, rk->rk_words, __arraycount(rk->rk_words));
690
691	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
692	    BUS_SPACE_BARRIER_SYNC);
693
694	RTW_DPRINTF(RTW_DEBUG_KEY,
695	    ("%s.%d: scr %02" PRIx8 ", keylen %d\n", __func__, __LINE__, scr,
696	     keylen));
697
698	RTW_WBW(regs, RTW_DK0, RTW_PSR);
699	RTW_WRITE8(regs, RTW_PSR, psr);
700	RTW_WBW(regs, RTW_PSR, RTW_SCR);
701	RTW_WRITE8(regs, RTW_SCR, scr);
702	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
703	rtw_set_access(regs, RTW_ACCESS_NONE);
704	sc->sc_flags |= RTW_F_DK_VALID;
705}
706
707static inline int
708rtw_recall_eeprom(struct rtw_regs *regs, device_t dev)
709{
710	int i;
711	uint8_t ecr;
712
713	ecr = RTW_READ8(regs, RTW_9346CR);
714	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
715	RTW_WRITE8(regs, RTW_9346CR, ecr);
716
717	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
718
719	/* wait 25ms for completion */
720	for (i = 0; i < 250; i++) {
721		ecr = RTW_READ8(regs, RTW_9346CR);
722		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
723			RTW_DPRINTF(RTW_DEBUG_RESET,
724			    ("%s: recall EEPROM in %dus\n", device_xname(dev),
725			    i * 100));
726			return 0;
727		}
728		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
729		DELAY(100);
730	}
731	aprint_error_dev(dev, "recall EEPROM failed\n");
732	return ETIMEDOUT;
733}
734
735static inline int
736rtw_reset(struct rtw_softc *sc)
737{
738	int rc;
739	uint8_t config1;
740
741	sc->sc_flags &= ~RTW_F_DK_VALID;
742
743	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev)) != 0)
744		return rc;
745
746	rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev);
747
748	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
749	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
750	/* TBD turn off maximum power saving? */
751
752	return 0;
753}
754
755static inline int
756rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
757    u_int ndescs)
758{
759	int i, rc = 0;
760	for (i = 0; i < ndescs; i++) {
761		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
762		    0, 0, &descs[i].ts_dmamap);
763		if (rc != 0)
764			break;
765	}
766	return rc;
767}
768
769static inline int
770rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
771    u_int ndescs)
772{
773	int i, rc = 0;
774	for (i = 0; i < ndescs; i++) {
775		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
776		    &descs[i].rs_dmamap);
777		if (rc != 0)
778			break;
779	}
780	return rc;
781}
782
783static inline void
784rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
785    u_int ndescs)
786{
787	int i;
788	for (i = 0; i < ndescs; i++) {
789		if (descs[i].rs_dmamap != NULL)
790			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
791	}
792}
793
794static inline void
795rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
796    u_int ndescs)
797{
798	int i;
799	for (i = 0; i < ndescs; i++) {
800		if (descs[i].ts_dmamap != NULL)
801			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
802	}
803}
804
805static inline void
806rtw_srom_free(struct rtw_srom *sr)
807{
808	sr->sr_size = 0;
809	if (sr->sr_content == NULL)
810		return;
811	free(sr->sr_content, M_DEVBUF);
812	sr->sr_content = NULL;
813}
814
815static void
816rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
817    uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
818{
819	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
820	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
821	*rcr |= RTW_RCR_ENCS1;
822	*rfchipid = RTW_RFCHIPID_PHILIPS;
823}
824
825static int
826rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
827    enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
828    device_t dev)
829{
830	int i;
831	const char *rfname, *paname;
832	char scratch[sizeof("unknown 0xXX")];
833	uint16_t srom_version;
834	uint8_t mac[IEEE80211_ADDR_LEN];
835
836	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
837	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
838
839	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
840
841	if (srom_version <= 0x0101) {
842		aprint_error_dev(dev,
843		    "SROM version %d.%d is not understood, "
844		    "limping along with defaults\n",
845		    srom_version >> 8, srom_version & 0xff);
846		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
847		return 0;
848	} else {
849		aprint_verbose_dev(dev, "SROM version %d.%d\n",
850		    srom_version >> 8, srom_version & 0xff);
851	}
852
853	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
854		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
855
856	RTW_DPRINTF(RTW_DEBUG_ATTACH,
857	    ("%s: EEPROM MAC %s\n", device_xname(dev), ether_sprintf(mac)));
858
859	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
860
861	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
862		*flags |= RTW_F_ANTDIV;
863
864	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
865	 * to be reversed.
866	 */
867	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
868		*flags |= RTW_F_DIGPHY;
869	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
870		*flags |= RTW_F_DFLANTB;
871
872	*rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
873	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
874
875	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
876		*flags |= RTW_C_RXWEP_104;
877
878	*flags |= RTW_C_RXWEP_40;	/* XXX */
879
880	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
881	switch (*rfchipid) {
882	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
883		rfname = "GCT GRF5101";
884		paname = "Winspring WS9901";
885		break;
886	case RTW_RFCHIPID_MAXIM:
887		rfname = "Maxim MAX2820";	/* guess */
888		paname = "Maxim MAX2422";	/* guess */
889		break;
890	case RTW_RFCHIPID_INTERSIL:
891		rfname = "Intersil HFA3873";	/* guess */
892		paname = "Intersil <unknown>";
893		break;
894	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
895		rfname = "Philips SA2400A";
896		paname = "Philips SA2411";
897		break;
898	case RTW_RFCHIPID_RFMD:
899		/* this is the same front-end as an atw(4)! */
900		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
901			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
902			 "SYN: Silicon Labs Si4126";	/* inferred from
903			 				 * reference driver
904							 */
905		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
906		break;
907	case RTW_RFCHIPID_RESERVED:
908		rfname = paname = "reserved";
909		break;
910	default:
911		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
912		rfname = paname = scratch;
913	}
914	aprint_normal_dev(dev, "RF: %s, PA: %s\n", rfname, paname);
915
916	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
917	case RTW_CONFIG0_GL_USA:
918	case _RTW_CONFIG0_GL_USA:
919		*locale = RTW_LOCALE_USA;
920		break;
921	case RTW_CONFIG0_GL_EUROPE:
922		*locale = RTW_LOCALE_EUROPE;
923		break;
924	case RTW_CONFIG0_GL_JAPAN:
925		*locale = RTW_LOCALE_JAPAN;
926		break;
927	default:
928		*locale = RTW_LOCALE_UNKNOWN;
929		break;
930	}
931	return 0;
932}
933
934/* Returns -1 on failure. */
935static int
936rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
937    device_t dev)
938{
939	int rc;
940	struct seeprom_descriptor sd;
941	uint8_t ecr;
942
943	(void)memset(&sd, 0, sizeof(sd));
944
945	ecr = RTW_READ8(regs, RTW_9346CR);
946
947	if ((flags & RTW_F_9356SROM) != 0) {
948		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n",
949		    device_xname(dev)));
950		sr->sr_size = 256;
951		sd.sd_chip = C56_66;
952	} else {
953		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n",
954		    device_xname(dev)));
955		sr->sr_size = 128;
956		sd.sd_chip = C46;
957	}
958
959	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
960	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
961	ecr |= RTW_9346CR_EEM_PROGRAM;
962
963	RTW_WRITE8(regs, RTW_9346CR, ecr);
964
965	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
966
967	if (sr->sr_content == NULL) {
968		aprint_error_dev(dev, "unable to allocate SROM buffer\n");
969		return ENOMEM;
970	}
971
972	(void)memset(sr->sr_content, 0, sr->sr_size);
973
974	/* RTL8180 has a single 8-bit register for controlling the
975	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
976	 * input/output sense is the reverse of read_seeprom's.
977	 */
978	sd.sd_tag = regs->r_bt;
979	sd.sd_bsh = regs->r_bh;
980	sd.sd_regsize = 1;
981	sd.sd_control_offset = RTW_9346CR;
982	sd.sd_status_offset = RTW_9346CR;
983	sd.sd_dataout_offset = RTW_9346CR;
984	sd.sd_CK = RTW_9346CR_EESK;
985	sd.sd_CS = RTW_9346CR_EECS;
986	sd.sd_DI = RTW_9346CR_EEDO;
987	sd.sd_DO = RTW_9346CR_EEDI;
988	/* make read_seeprom enter EEPROM read/write mode */
989	sd.sd_MS = ecr;
990	sd.sd_RDY = 0;
991
992	/* TBD bus barriers */
993	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
994		aprint_error_dev(dev, "could not read SROM\n");
995		free(sr->sr_content, M_DEVBUF);
996		sr->sr_content = NULL;
997		return -1;	/* XXX */
998	}
999
1000	/* end EEPROM read/write mode */
1001	RTW_WRITE8(regs, RTW_9346CR,
1002	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
1003	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
1004
1005	if ((rc = rtw_recall_eeprom(regs, dev)) != 0)
1006		return rc;
1007
1008#ifdef RTW_DEBUG
1009	{
1010		int i;
1011		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1012		    ("\n%s: serial ROM:\n\t", device_xname(dev)));
1013		for (i = 0; i < sr->sr_size/2; i++) {
1014			if (((i % 8) == 0) && (i != 0))
1015				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1016			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1017			    (" %04x", sr->sr_content[i]));
1018		}
1019		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1020	}
1021#endif /* RTW_DEBUG */
1022	return 0;
1023}
1024
1025static void
1026rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1027    device_t dev)
1028{
1029	uint8_t cfg4;
1030	const char *method;
1031
1032	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1033
1034	switch (rfchipid) {
1035	default:
1036		cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1037		method = "fallback";
1038		break;
1039	case RTW_RFCHIPID_INTERSIL:
1040		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1041		method = "Intersil";
1042		break;
1043	case RTW_RFCHIPID_PHILIPS:
1044		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1045		method = "Philips";
1046		break;
1047	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1048	case RTW_RFCHIPID_RFMD:
1049		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1050		method = "RFMD";
1051		break;
1052	}
1053
1054	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1055
1056	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1057
1058	RTW_DPRINTF(RTW_DEBUG_INIT,
1059	    ("%s: %s RF programming method, %#02x\n", device_xname(dev), method,
1060	    RTW_READ8(regs, RTW_CONFIG4)));
1061}
1062
1063static inline void
1064rtw_init_channels(enum rtw_locale locale,
1065    struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1], device_t dev)
1066{
1067	int i;
1068	const char *name = NULL;
1069#define ADD_CHANNEL(_chans, _chan) do {			\
1070	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1071	(*_chans)[_chan].ic_freq =				\
1072	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1073} while (0)
1074
1075	switch (locale) {
1076	case RTW_LOCALE_USA:	/* 1-11 */
1077		name = "USA";
1078		for (i = 1; i <= 11; i++)
1079			ADD_CHANNEL(chans, i);
1080		break;
1081	case RTW_LOCALE_JAPAN:	/* 1-14 */
1082		name = "Japan";
1083		ADD_CHANNEL(chans, 14);
1084		for (i = 1; i <= 14; i++)
1085			ADD_CHANNEL(chans, i);
1086		break;
1087	case RTW_LOCALE_EUROPE:	/* 1-13 */
1088		name = "Europe";
1089		for (i = 1; i <= 13; i++)
1090			ADD_CHANNEL(chans, i);
1091		break;
1092	default:			/* 10-11 allowed by most countries */
1093		name = "<unknown>";
1094		for (i = 10; i <= 11; i++)
1095			ADD_CHANNEL(chans, i);
1096		break;
1097	}
1098	aprint_normal_dev(dev, "Geographic Location %s\n", name);
1099#undef ADD_CHANNEL
1100}
1101
1102
1103static inline void
1104rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1105{
1106	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1107
1108	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1109	case RTW_CONFIG0_GL_USA:
1110	case _RTW_CONFIG0_GL_USA:
1111		*locale = RTW_LOCALE_USA;
1112		break;
1113	case RTW_CONFIG0_GL_JAPAN:
1114		*locale = RTW_LOCALE_JAPAN;
1115		break;
1116	case RTW_CONFIG0_GL_EUROPE:
1117		*locale = RTW_LOCALE_EUROPE;
1118		break;
1119	default:
1120		*locale = RTW_LOCALE_UNKNOWN;
1121		break;
1122	}
1123}
1124
1125static inline int
1126rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1127    device_t dev)
1128{
1129	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1130		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1131	};
1132	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1133	          idr1 = RTW_READ(regs, RTW_IDR1);
1134
1135	(*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1136	(*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1137	(*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1138	(*addr)[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
1139
1140	(*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1141	(*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1142
1143	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1144		aprint_error_dev(dev,
1145		    "could not get mac address, attach failed\n");
1146		return ENXIO;
1147	}
1148
1149	aprint_normal_dev(dev, "802.11 address %s\n", ether_sprintf(*addr));
1150
1151	return 0;
1152}
1153
1154static uint8_t
1155rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1156    struct ieee80211_channel *chan)
1157{
1158	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1159	KASSERT(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14);
1160	return RTW_SR_GET(sr, idx);
1161}
1162
1163static void
1164rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1165{
1166	int pri;
1167	/* nfree: the number of free descriptors in each ring.
1168	 * The beacon ring is a special case: I do not let the
1169	 * driver use all of the descriptors on the beacon ring.
1170	 * The reasons are two-fold:
1171	 *
1172	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1173	 * updated, so the driver cannot easily know if the descriptor
1174	 * belongs to it, or if it is racing the NIC.  If the NIC
1175	 * does not OWN every descriptor, then the driver can safely
1176	 * update the descriptors when RTW_TBDA points at tdb_next.
1177	 *
1178	 * (2) I hope that the NIC will process more than one BEACON
1179	 * descriptor in a single beacon interval, since that will
1180	 * enable multiple-BSS support.  Since the NIC does not
1181	 * clear the OWN bit, there is no natural place for it to
1182	 * stop processing BEACON desciptors.  Maybe it will *not*
1183	 * stop processing them!  I do not want to chance the NIC
1184	 * looping around and around a saturated beacon ring, so
1185	 * I will leave one descriptor unOWNed at all times.
1186	 */
1187	u_int nfree[RTW_NTXPRI] =
1188	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1189	     RTW_NTXDESCBCN - 1};
1190
1191	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1192		tdb[pri].tdb_nfree = nfree[pri];
1193		tdb[pri].tdb_next = 0;
1194	}
1195}
1196
1197static int
1198rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1199{
1200	int i;
1201	struct rtw_txsoft *ts;
1202
1203	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1204	SIMPLEQ_INIT(&tsb->tsb_freeq);
1205	for (i = 0; i < tsb->tsb_ndesc; i++) {
1206		ts = &tsb->tsb_desc[i];
1207		ts->ts_mbuf = NULL;
1208		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1209	}
1210	tsb->tsb_tx_timer = 0;
1211	return 0;
1212}
1213
1214static void
1215rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1216{
1217	int pri;
1218	for (pri = 0; pri < RTW_NTXPRI; pri++)
1219		rtw_txsoft_blk_init(&tsb[pri]);
1220}
1221
1222static inline void
1223rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1224{
1225	KASSERT(nsync <= rdb->rdb_ndesc);
1226	/* sync to end of ring */
1227	if (desc0 + nsync > rdb->rdb_ndesc) {
1228		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1229		    offsetof(struct rtw_descs, hd_rx[desc0]),
1230		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1231		nsync -= (rdb->rdb_ndesc - desc0);
1232		desc0 = 0;
1233	}
1234
1235	KASSERT(desc0 < rdb->rdb_ndesc);
1236	KASSERT(nsync <= rdb->rdb_ndesc);
1237	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1238
1239	/* sync what remains */
1240	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1241	    offsetof(struct rtw_descs, hd_rx[desc0]),
1242	    sizeof(struct rtw_rxdesc) * nsync, ops);
1243}
1244
1245static void
1246rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1247{
1248	/* sync to end of ring */
1249	if (desc0 + nsync > tdb->tdb_ndesc) {
1250		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1251		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1252		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1253		    ops);
1254		nsync -= (tdb->tdb_ndesc - desc0);
1255		desc0 = 0;
1256	}
1257
1258	/* sync what remains */
1259	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1260	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1261	    sizeof(struct rtw_txdesc) * nsync, ops);
1262}
1263
1264static void
1265rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1266{
1267	int pri;
1268	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1269		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1270		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1271	}
1272}
1273
1274static void
1275rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1276{
1277	int i;
1278	struct rtw_rxsoft *rs;
1279
1280	for (i = 0; i < RTW_RXQLEN; i++) {
1281		rs = &desc[i];
1282		if (rs->rs_mbuf == NULL)
1283			continue;
1284		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1285		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1286		bus_dmamap_unload(dmat, rs->rs_dmamap);
1287		m_freem(rs->rs_mbuf);
1288		rs->rs_mbuf = NULL;
1289	}
1290}
1291
1292static inline int
1293rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1294{
1295	int rc;
1296	struct mbuf *m;
1297
1298	MGETHDR(m, M_DONTWAIT, MT_DATA);
1299	if (m == NULL)
1300		return ENOBUFS;
1301
1302	MCLGET(m, M_DONTWAIT);
1303	if ((m->m_flags & M_EXT) == 0) {
1304		m_freem(m);
1305		return ENOBUFS;
1306	}
1307
1308	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1309
1310	if (rs->rs_mbuf != NULL)
1311		bus_dmamap_unload(dmat, rs->rs_dmamap);
1312
1313	rs->rs_mbuf = NULL;
1314
1315	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1316	if (rc != 0) {
1317		m_freem(m);
1318		return -1;
1319	}
1320
1321	rs->rs_mbuf = m;
1322
1323	return 0;
1324}
1325
1326static int
1327rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1328    int *ndesc, device_t dev)
1329{
1330	int i, rc = 0;
1331	struct rtw_rxsoft *rs;
1332
1333	for (i = 0; i < RTW_RXQLEN; i++) {
1334		rs = &desc[i];
1335		/* we're in rtw_init, so there should be no mbufs allocated */
1336		KASSERT(rs->rs_mbuf == NULL);
1337#ifdef RTW_DEBUG
1338		if (i == rtw_rxbufs_limit) {
1339			aprint_error_dev(dev, "TEST hit %d-buffer limit\n", i);
1340			rc = ENOBUFS;
1341			break;
1342		}
1343#endif /* RTW_DEBUG */
1344		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1345			aprint_error_dev(dev,
1346			    "rtw_rxsoft_alloc failed, %d buffers, rc %d\n",
1347			    i, rc);
1348			break;
1349		}
1350	}
1351	*ndesc = i;
1352	return rc;
1353}
1354
1355static inline void
1356rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1357    int idx, int kick)
1358{
1359	int is_last = (idx == rdb->rdb_ndesc - 1);
1360	uint32_t ctl, octl, obuf;
1361	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1362
1363	/* sync the mbuf before the descriptor */
1364	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1365	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1366
1367	obuf = rd->rd_buf;
1368	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1369
1370	ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1371	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1372
1373	if (is_last)
1374		ctl |= RTW_RXCTL_EOR;
1375
1376	octl = rd->rd_ctl;
1377	rd->rd_ctl = htole32(ctl);
1378
1379	RTW_DPRINTF(
1380	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1381	         : RTW_DEBUG_RECV_DESC,
1382	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1383	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1384	     le32toh(rd->rd_ctl)));
1385
1386	/* sync the descriptor */
1387	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1388	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1389	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1390}
1391
1392static void
1393rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1394{
1395	int i;
1396	struct rtw_rxdesc *rd;
1397	struct rtw_rxsoft *rs;
1398
1399	for (i = 0; i < rdb->rdb_ndesc; i++) {
1400		rd = &rdb->rdb_desc[i];
1401		rs = &ctl[i];
1402		rtw_rxdesc_init(rdb, rs, i, kick);
1403	}
1404}
1405
1406static void
1407rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1408{
1409	struct rtw_regs *regs = &sc->sc_regs;
1410	uint8_t cr;
1411
1412	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1413	    enable ? "enable" : "disable", flags));
1414
1415	cr = RTW_READ8(regs, RTW_CR);
1416
1417	/* XXX reference source does not enable MULRW */
1418	/* enable PCI Read/Write Multiple */
1419	cr |= RTW_CR_MULRW;
1420
1421	/* The receive engine will always start at RDSAR.  */
1422	if (enable && (flags & ~cr & RTW_CR_RE)) {
1423		struct rtw_rxdesc_blk *rdb;
1424		rdb = &sc->sc_rxdesc_blk;
1425		rdb->rdb_next = 0;
1426	}
1427
1428	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1429	if (enable)
1430		cr |= flags;
1431	else
1432		cr &= ~flags;
1433	RTW_WRITE8(regs, RTW_CR, cr);
1434	RTW_SYNC(regs, RTW_CR, RTW_CR);
1435
1436#ifdef RTW_DIAG
1437	if (cr & RTW_CR_TE)
1438		rtw_txring_fixup(sc, __func__, __LINE__);
1439#endif
1440	if (cr & RTW_CR_TE) {
1441		rtw_tx_kick(&sc->sc_regs,
1442		    RTW_TPPOLL_HPQ | RTW_TPPOLL_NPQ | RTW_TPPOLL_LPQ);
1443	}
1444}
1445
1446static void
1447rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1448{
1449#define	IS_BEACON(__fc0)						\
1450    ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1451     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1452
1453	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1454							 * hardware -> net80211
1455							 */
1456	u_int next, nproc = 0;
1457	int hwrate, len, rate, rssi, sq;
1458	uint32_t hrssi, hstat, htsfth, htsftl;
1459	struct rtw_rxdesc *rd;
1460	struct rtw_rxsoft *rs;
1461	struct rtw_rxdesc_blk *rdb;
1462	struct mbuf *m;
1463	struct ifnet *ifp = &sc->sc_if;
1464
1465	struct ieee80211_node *ni;
1466	struct ieee80211_frame_min *wh;
1467
1468	rdb = &sc->sc_rxdesc_blk;
1469
1470	for (next = rdb->rdb_next; ; next = rdb->rdb_next) {
1471		KASSERT(next < rdb->rdb_ndesc);
1472
1473		rtw_rxdescs_sync(rdb, next, 1,
1474		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1475		rd = &rdb->rdb_desc[next];
1476		rs = &sc->sc_rxsoft[next];
1477
1478		hstat = le32toh(rd->rd_stat);
1479		hrssi = le32toh(rd->rd_rssi);
1480		htsfth = le32toh(rd->rd_tsfth);
1481		htsftl = le32toh(rd->rd_tsftl);
1482
1483		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1484		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1485		    __func__, next, hstat, hrssi, htsfth, htsftl));
1486
1487		++nproc;
1488
1489		/* still belongs to NIC */
1490		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1491			rtw_rxdescs_sync(rdb, next, 1, BUS_DMASYNC_PREREAD);
1492			break;
1493		}
1494
1495                /* ieee80211_input() might reset the receive engine
1496                 * (e.g. by indirectly calling rtw_tune()), so save
1497                 * the next pointer here and retrieve it again on
1498                 * the next round.
1499		 */
1500		rdb->rdb_next = (next + 1) % rdb->rdb_ndesc;
1501
1502#ifdef RTW_DEBUG
1503#define PRINTSTAT(flag) do { \
1504	if ((hstat & flag) != 0) { \
1505		printf("%s" #flag, delim); \
1506		delim = ","; \
1507	} \
1508} while (0)
1509		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1510			const char *delim = "<";
1511			printf("%s: ", device_xname(sc->sc_dev));
1512			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1513				printf("status %08x", hstat);
1514				PRINTSTAT(RTW_RXSTAT_SPLCP);
1515				PRINTSTAT(RTW_RXSTAT_MAR);
1516				PRINTSTAT(RTW_RXSTAT_PAR);
1517				PRINTSTAT(RTW_RXSTAT_BAR);
1518				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1519				PRINTSTAT(RTW_RXSTAT_CRC32);
1520				PRINTSTAT(RTW_RXSTAT_ICV);
1521				printf(">, ");
1522			}
1523		}
1524#endif /* RTW_DEBUG */
1525
1526		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1527			aprint_error_dev(sc->sc_dev,
1528			    "DMA error/FIFO overflow %08" PRIx32 ", "
1529			    "rx descriptor %d\n", hstat, next);
1530			ifp->if_ierrors++;
1531			goto next;
1532		}
1533
1534		len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1535		if (len < IEEE80211_MIN_LEN) {
1536			sc->sc_ic.ic_stats.is_rx_tooshort++;
1537			goto next;
1538		}
1539		if (len > rs->rs_mbuf->m_len) {
1540			aprint_error_dev(sc->sc_dev,
1541			    "rx frame too long, %d > %d, %08" PRIx32
1542			    ", desc %d\n",
1543			    len, rs->rs_mbuf->m_len, hstat, next);
1544			ifp->if_ierrors++;
1545			goto next;
1546		}
1547
1548		hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1549		if (hwrate >= __arraycount(ratetbl)) {
1550			aprint_error_dev(sc->sc_dev,
1551			    "unknown rate #%" __PRIuBITS "\n",
1552			    __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1553			ifp->if_ierrors++;
1554			goto next;
1555		}
1556		rate = ratetbl[hwrate];
1557
1558#ifdef RTW_DEBUG
1559		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1560		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1561		     (rate * 5) % 10, htsfth, htsftl));
1562#endif /* RTW_DEBUG */
1563
1564		/* if bad flags, skip descriptor */
1565		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1566			aprint_error_dev(sc->sc_dev, "too many rx segments, "
1567			    "next=%d, %08" PRIx32 "\n", next, hstat);
1568			goto next;
1569		}
1570
1571		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1572		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1573
1574		m = rs->rs_mbuf;
1575
1576		/* if temporarily out of memory, re-use mbuf */
1577		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1578		case 0:
1579			break;
1580		case ENOBUFS:
1581			aprint_error_dev(sc->sc_dev,
1582			    "rtw_rxsoft_alloc(, %d) failed, dropping packet\n",
1583			    next);
1584			goto next;
1585		default:
1586			/* XXX shorten rx ring, instead? */
1587			aprint_error_dev(sc->sc_dev,
1588			    "could not load DMA map\n");
1589		}
1590
1591		sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1592
1593		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1594			rssi = UINT8_MAX - sq;
1595		else {
1596			rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1597			/* TBD find out each front-end's LNA gain in the
1598			 * front-end's units
1599			 */
1600			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1601				rssi |= 0x80;
1602		}
1603
1604		/* Note well: now we cannot recycle the rs_mbuf unless
1605		 * we restore its original length.
1606		 */
1607		m->m_pkthdr.rcvif = ifp;
1608		m->m_pkthdr.len = m->m_len = len;
1609
1610		wh = mtod(m, struct ieee80211_frame_min *);
1611
1612		if (!IS_BEACON(wh->i_fc[0]))
1613			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1614
1615		sc->sc_tsfth = htsfth;
1616
1617#ifdef RTW_DEBUG
1618		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1619		    (IFF_DEBUG|IFF_LINK2)) {
1620			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1621			    rate, rssi);
1622		}
1623#endif /* RTW_DEBUG */
1624
1625		if (sc->sc_radiobpf != NULL) {
1626			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1627
1628			rr->rr_tsft =
1629			    htole64(((uint64_t)htsfth << 32) | htsftl);
1630
1631			rr->rr_flags = IEEE80211_RADIOTAP_F_FCS;
1632
1633			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1634				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1635			if ((hstat & RTW_RXSTAT_CRC32) != 0)
1636				rr->rr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1637
1638			rr->rr_rate = rate;
1639
1640			if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1641				rr->rr_u.u_philips.p_antsignal = rssi;
1642			else {
1643				rr->rr_u.u_other.o_antsignal = rssi;
1644				rr->rr_u.u_other.o_barker_lock =
1645				    htole16(UINT8_MAX - sq);
1646			}
1647
1648			bpf_mtap2(sc->sc_radiobpf,
1649			    rr, sizeof(sc->sc_rxtapu), m);
1650		}
1651
1652		if ((hstat & RTW_RXSTAT_RES) != 0) {
1653			m_freem(m);
1654			goto next;
1655		}
1656
1657		/* CRC is included with the packet; trim it off. */
1658		m_adj(m, -IEEE80211_CRC_LEN);
1659
1660		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1661		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1662		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1663		ieee80211_free_node(ni);
1664next:
1665		rtw_rxdesc_init(rdb, rs, next, 0);
1666	}
1667#undef IS_BEACON
1668}
1669
1670static void
1671rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1672    struct rtw_txsoft *ts)
1673{
1674	struct mbuf *m;
1675	struct ieee80211_node *ni;
1676
1677	m = ts->ts_mbuf;
1678	ni = ts->ts_ni;
1679	KASSERT(m != NULL);
1680	KASSERT(ni != NULL);
1681	ts->ts_mbuf = NULL;
1682	ts->ts_ni = NULL;
1683
1684	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1685	    BUS_DMASYNC_POSTWRITE);
1686	bus_dmamap_unload(dmat, ts->ts_dmamap);
1687	m_freem(m);
1688	ieee80211_free_node(ni);
1689}
1690
1691static void
1692rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1693    struct rtw_txsoft_blk *tsb)
1694{
1695	struct rtw_txsoft *ts;
1696
1697	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1698		rtw_txsoft_release(dmat, ic, ts);
1699		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1700		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1701	}
1702	tsb->tsb_tx_timer = 0;
1703}
1704
1705static inline void
1706rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1707    struct rtw_txsoft *ts, int ndesc)
1708{
1709	uint32_t hstat;
1710	int data_retry, rts_retry;
1711	struct rtw_txdesc *tdn;
1712	const char *condstring;
1713	struct ifnet *ifp = &sc->sc_if;
1714
1715	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1716
1717	tdb->tdb_nfree += ndesc;
1718
1719	tdn = &tdb->tdb_desc[ts->ts_last];
1720
1721	hstat = le32toh(tdn->td_stat);
1722	rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1723	data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1724
1725	ifp->if_collisions += rts_retry + data_retry;
1726
1727	if ((hstat & RTW_TXSTAT_TOK) != 0)
1728		condstring = "ok";
1729	else {
1730		ifp->if_oerrors++;
1731		condstring = "error";
1732	}
1733
1734	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1735	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1736	    device_xname(sc->sc_dev), ts, ts->ts_first, ts->ts_last,
1737	    condstring, rts_retry, data_retry));
1738}
1739
1740static void
1741rtw_reset_oactive(struct rtw_softc *sc)
1742{
1743	short oflags;
1744	int pri;
1745	struct rtw_txsoft_blk *tsb;
1746	struct rtw_txdesc_blk *tdb;
1747	oflags = sc->sc_if.if_flags;
1748	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1749		tsb = &sc->sc_txsoft_blk[pri];
1750		tdb = &sc->sc_txdesc_blk[pri];
1751		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1752			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1753	}
1754	if (oflags != sc->sc_if.if_flags) {
1755		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1756		    ("%s: reset OACTIVE\n", __func__));
1757	}
1758}
1759
1760/* Collect transmitted packets. */
1761static bool
1762rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1763    struct rtw_txdesc_blk *tdb, int force)
1764{
1765	bool collected = false;
1766	int ndesc;
1767	struct rtw_txsoft *ts;
1768
1769#ifdef RTW_DEBUG
1770	rtw_dump_rings(sc);
1771#endif
1772
1773	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1774		/* If we're clearing a failed transmission, only clear
1775		   up to the last packet the hardware has processed.  */
1776		if (ts->ts_first == rtw_txring_next(&sc->sc_regs, tdb))
1777			break;
1778
1779		ndesc = 1 + ts->ts_last - ts->ts_first;
1780		if (ts->ts_last < ts->ts_first)
1781			ndesc += tdb->tdb_ndesc;
1782
1783		KASSERT(ndesc > 0);
1784
1785		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1786		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1787
1788		if (force) {
1789			int next;
1790#ifdef RTW_DIAG
1791			printf("%s: clearing packet, stats", __func__);
1792#endif
1793			for (next = ts->ts_first; ;
1794			    next = RTW_NEXT_IDX(tdb, next)) {
1795#ifdef RTW_DIAG
1796				printf(" %" PRIx32 "/%" PRIx32 "/%" PRIx32 "/%" PRIu32 "/%" PRIx32, le32toh(tdb->tdb_desc[next].td_stat), le32toh(tdb->tdb_desc[next].td_ctl1), le32toh(tdb->tdb_desc[next].td_buf), le32toh(tdb->tdb_desc[next].td_len), le32toh(tdb->tdb_desc[next].td_next));
1797#endif
1798				tdb->tdb_desc[next].td_stat &=
1799				    ~htole32(RTW_TXSTAT_OWN);
1800				if (next == ts->ts_last)
1801					break;
1802			}
1803			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1804			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1805#ifdef RTW_DIAG
1806			next = RTW_NEXT_IDX(tdb, next);
1807			printf(" -> end %u stat %" PRIx32 ", was %u\n", next,
1808			    le32toh(tdb->tdb_desc[next].td_stat),
1809			    rtw_txring_next(&sc->sc_regs, tdb));
1810#endif
1811		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1812		    htole32(RTW_TXSTAT_OWN)) != 0) {
1813			rtw_txdescs_sync(tdb, ts->ts_last, 1,
1814			    BUS_DMASYNC_PREREAD);
1815			break;
1816		}
1817
1818		collected = true;
1819
1820		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1821		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1822		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1823	}
1824
1825	/* no more pending transmissions, cancel watchdog */
1826	if (ts == NULL)
1827		tsb->tsb_tx_timer = 0;
1828	rtw_reset_oactive(sc);
1829
1830	return collected;
1831}
1832
1833static void
1834rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1835{
1836	int pri;
1837	struct rtw_txsoft_blk	*tsb;
1838	struct rtw_txdesc_blk	*tdb;
1839	struct ifnet *ifp = &sc->sc_if;
1840
1841	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1842		tsb = &sc->sc_txsoft_blk[pri];
1843		tdb = &sc->sc_txdesc_blk[pri];
1844		rtw_collect_txring(sc, tsb, tdb, 0);
1845	}
1846
1847	if ((isr & RTW_INTR_TX) != 0)
1848		rtw_start(ifp);
1849
1850	return;
1851}
1852
1853static void
1854rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1855{
1856	u_int next;
1857	uint32_t tsfth, tsftl;
1858	struct ieee80211com *ic;
1859	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1860	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1861	struct mbuf *m;
1862
1863	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1864	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1865
1866	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1867		next = rtw_txring_next(&sc->sc_regs, tdb);
1868		RTW_DPRINTF(RTW_DEBUG_BEACON,
1869		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1870		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1871		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1872		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1873		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0)
1874			rtw_collect_txring(sc, tsb, tdb, 1);
1875	}
1876	/* Start beacon transmission. */
1877
1878	if ((isr & RTW_INTR_BCNINT) != 0 &&
1879	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1880	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1881		RTW_DPRINTF(RTW_DEBUG_BEACON,
1882		    ("%s: beacon prep. time, isr = %#04" PRIx16
1883		     ", %16" PRIu64 "\n", __func__, isr,
1884		     (uint64_t)tsfth << 32 | tsftl));
1885		ic = &sc->sc_ic;
1886		m = rtw_beacon_alloc(sc, ic->ic_bss);
1887
1888		if (m == NULL) {
1889			aprint_error_dev(sc->sc_dev,
1890			    "could not allocate beacon\n");
1891			return;
1892		}
1893		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1894		IF_ENQUEUE(&sc->sc_beaconq, m);
1895		rtw_start(&sc->sc_if);
1896	}
1897}
1898
1899static void
1900rtw_intr_atim(struct rtw_softc *sc)
1901{
1902	/* TBD */
1903	return;
1904}
1905
1906#ifdef RTW_DEBUG
1907static void
1908rtw_dump_rings(struct rtw_softc *sc)
1909{
1910	struct rtw_txdesc_blk *tdb;
1911	struct rtw_rxdesc *rd;
1912	struct rtw_rxdesc_blk *rdb;
1913	int desc, pri;
1914
1915	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1916		return;
1917
1918	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1919		tdb = &sc->sc_txdesc_blk[pri];
1920		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1921		    tdb->tdb_ndesc, tdb->tdb_nfree);
1922		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1923			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1924	}
1925
1926	rdb = &sc->sc_rxdesc_blk;
1927
1928	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1929		rd = &rdb->rdb_desc[desc];
1930		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1931		    "rsvd1/tsfth %08x\n", __func__,
1932		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1933		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1934		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1935	}
1936}
1937#endif /* RTW_DEBUG */
1938
1939static void
1940rtw_hwring_setup(struct rtw_softc *sc)
1941{
1942	int pri;
1943	struct rtw_regs *regs = &sc->sc_regs;
1944	struct rtw_txdesc_blk *tdb;
1945
1946	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1947	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1948	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1949	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1950	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1951	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1952	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1953	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1954
1955	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1956		tdb = &sc->sc_txdesc_blk[pri];
1957		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1958		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1959		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1960		     (uintptr_t)tdb->tdb_base));
1961	}
1962
1963	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1964
1965	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1966	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1967	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1968
1969	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1970
1971}
1972
1973static int
1974rtw_swring_setup(struct rtw_softc *sc)
1975{
1976	int rc;
1977	struct rtw_rxdesc_blk *rdb;
1978
1979	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1980
1981	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1982
1983	rdb = &sc->sc_rxdesc_blk;
1984	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
1985	     sc->sc_dev)) != 0 && rdb->rdb_ndesc == 0) {
1986		aprint_error_dev(sc->sc_dev, "could not allocate rx buffers\n");
1987		return rc;
1988	}
1989
1990	rdb = &sc->sc_rxdesc_blk;
1991	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
1992	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1993	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
1994	rdb->rdb_next = 0;
1995
1996	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
1997	return 0;
1998}
1999
2000static void
2001rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
2002{
2003	int i;
2004
2005	(void)memset(tdb->tdb_desc, 0,
2006	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
2007	for (i = 0; i < tdb->tdb_ndesc; i++)
2008		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
2009}
2010
2011static u_int
2012rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
2013{
2014	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
2015	    sizeof(struct rtw_txdesc);
2016}
2017
2018#ifdef RTW_DIAG
2019static void
2020rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln)
2021{
2022	int pri;
2023	u_int next;
2024	struct rtw_txdesc_blk *tdb;
2025	struct rtw_regs *regs = &sc->sc_regs;
2026
2027	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2028		int i;
2029		tdb = &sc->sc_txdesc_blk[pri];
2030		next = rtw_txring_next(regs, tdb);
2031		if (tdb->tdb_next == next)
2032			continue;
2033		for (i = 0; next != tdb->tdb_next;
2034		    next = RTW_NEXT_IDX(tdb, next), i++) {
2035			if ((tdb->tdb_desc[next].td_stat & htole32(RTW_TXSTAT_OWN)) == 0)
2036				break;
2037		}
2038		printf("%s:%d: tx-ring %d expected next %u, read %u+%d -> %s\n", fn,
2039		    ln, pri, tdb->tdb_next, next, i, tdb->tdb_next == next ? "okay" : "BAD");
2040		if (tdb->tdb_next == next)
2041			continue;
2042		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
2043	}
2044}
2045#endif
2046
2047static void
2048rtw_txdescs_reset(struct rtw_softc *sc)
2049{
2050	int pri;
2051	struct rtw_txsoft_blk	*tsb;
2052	struct rtw_txdesc_blk	*tdb;
2053
2054	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2055		tsb = &sc->sc_txsoft_blk[pri];
2056		tdb = &sc->sc_txdesc_blk[pri];
2057		rtw_collect_txring(sc, tsb, tdb, 1);
2058#ifdef RTW_DIAG
2059		if (!SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
2060			printf("%s: packets left in ring %d\n", __func__, pri);
2061#endif
2062	}
2063}
2064
2065static void
2066rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2067{
2068	aprint_error_dev(sc->sc_dev, "tx fifo underflow\n");
2069
2070	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: cleaning up xmit, isr %" PRIx16
2071	    "\n", device_xname(sc->sc_dev), isr));
2072
2073#ifdef RTW_DEBUG
2074	rtw_dump_rings(sc);
2075#endif /* RTW_DEBUG */
2076
2077	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2078	 * timeouts.
2079	 */
2080	rtw_txdescs_reset(sc);
2081
2082#ifdef RTW_DEBUG
2083	rtw_dump_rings(sc);
2084#endif /* RTW_DEBUG */
2085}
2086
2087static inline void
2088rtw_suspend_ticks(struct rtw_softc *sc)
2089{
2090	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2091	    ("%s: suspending ticks\n", device_xname(sc->sc_dev)));
2092	sc->sc_do_tick = 0;
2093}
2094
2095static inline void
2096rtw_resume_ticks(struct rtw_softc *sc)
2097{
2098	uint32_t tsftrl0, tsftrl1, next_tint;
2099
2100	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2101
2102	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2103	next_tint = tsftrl1 + 1000000;
2104	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tint);
2105
2106	sc->sc_do_tick = 1;
2107
2108	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2109	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2110	    device_xname(sc->sc_dev), tsftrl1 - tsftrl0, tsftrl1, next_tint));
2111}
2112
2113static void
2114rtw_intr_timeout(struct rtw_softc *sc)
2115{
2116	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", device_xname(sc->sc_dev)));
2117	if (sc->sc_do_tick)
2118		rtw_resume_ticks(sc);
2119	return;
2120}
2121
2122int
2123rtw_intr(void *arg)
2124{
2125	int i;
2126	struct rtw_softc *sc = arg;
2127	struct rtw_regs *regs = &sc->sc_regs;
2128	uint16_t isr;
2129	struct ifnet *ifp = &sc->sc_if;
2130
2131	/*
2132	 * If the interface isn't running, the interrupt couldn't
2133	 * possibly have come from us.
2134	 */
2135	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2136	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER)) {
2137		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2138		    device_xname(sc->sc_dev)));
2139		return (0);
2140	}
2141
2142	for (i = 0; i < 10; i++) {
2143		isr = RTW_READ16(regs, RTW_ISR);
2144
2145		RTW_WRITE16(regs, RTW_ISR, isr);
2146		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2147
2148		if (sc->sc_intr_ack != NULL)
2149			(*sc->sc_intr_ack)(regs);
2150
2151		if (isr == 0)
2152			break;
2153
2154#ifdef RTW_DEBUG
2155#define PRINTINTR(flag) do { \
2156	if ((isr & flag) != 0) { \
2157		printf("%s" #flag, delim); \
2158		delim = ","; \
2159	} \
2160} while (0)
2161
2162		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2163			const char *delim = "<";
2164
2165			printf("%s: reg[ISR] = %x", device_xname(sc->sc_dev),
2166			    isr);
2167
2168			PRINTINTR(RTW_INTR_TXFOVW);
2169			PRINTINTR(RTW_INTR_TIMEOUT);
2170			PRINTINTR(RTW_INTR_BCNINT);
2171			PRINTINTR(RTW_INTR_ATIMINT);
2172			PRINTINTR(RTW_INTR_TBDER);
2173			PRINTINTR(RTW_INTR_TBDOK);
2174			PRINTINTR(RTW_INTR_THPDER);
2175			PRINTINTR(RTW_INTR_THPDOK);
2176			PRINTINTR(RTW_INTR_TNPDER);
2177			PRINTINTR(RTW_INTR_TNPDOK);
2178			PRINTINTR(RTW_INTR_RXFOVW);
2179			PRINTINTR(RTW_INTR_RDU);
2180			PRINTINTR(RTW_INTR_TLPDER);
2181			PRINTINTR(RTW_INTR_TLPDOK);
2182			PRINTINTR(RTW_INTR_RER);
2183			PRINTINTR(RTW_INTR_ROK);
2184
2185			printf(">\n");
2186		}
2187#undef PRINTINTR
2188#endif /* RTW_DEBUG */
2189
2190		if ((isr & RTW_INTR_RX) != 0)
2191			rtw_intr_rx(sc, isr);
2192		if ((isr & RTW_INTR_TX) != 0)
2193			rtw_intr_tx(sc, isr);
2194		if ((isr & RTW_INTR_BEACON) != 0)
2195			rtw_intr_beacon(sc, isr);
2196		if ((isr & RTW_INTR_ATIMINT) != 0)
2197			rtw_intr_atim(sc);
2198		if ((isr & RTW_INTR_IOERROR) != 0)
2199			rtw_intr_ioerror(sc, isr);
2200		if ((isr & RTW_INTR_TIMEOUT) != 0)
2201			rtw_intr_timeout(sc);
2202	}
2203
2204	return 1;
2205}
2206
2207/* Must be called at splnet. */
2208static void
2209rtw_stop(struct ifnet *ifp, int disable)
2210{
2211	int pri;
2212	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2213	struct ieee80211com *ic = &sc->sc_ic;
2214	struct rtw_regs *regs = &sc->sc_regs;
2215
2216	rtw_suspend_ticks(sc);
2217
2218	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2219
2220	if (device_has_power(sc->sc_dev)) {
2221		/* Disable interrupts. */
2222		RTW_WRITE16(regs, RTW_IMR, 0);
2223
2224		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2225
2226		/* Stop the transmit and receive processes. First stop DMA,
2227		 * then disable receiver and transmitter.
2228		 */
2229		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2230
2231		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2232
2233		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2234	}
2235
2236	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2237		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2238		    &sc->sc_txsoft_blk[pri]);
2239	}
2240
2241	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2242
2243	/* Mark the interface as not running.  Cancel the watchdog timer. */
2244	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2245	ifp->if_timer = 0;
2246
2247	if (disable)
2248		pmf_device_suspend(sc->sc_dev, &sc->sc_qual);
2249
2250	return;
2251}
2252
2253const char *
2254rtw_pwrstate_string(enum rtw_pwrstate power)
2255{
2256	switch (power) {
2257	case RTW_ON:
2258		return "on";
2259	case RTW_SLEEP:
2260		return "sleep";
2261	case RTW_OFF:
2262		return "off";
2263	default:
2264		return "unknown";
2265	}
2266}
2267
2268/* XXX For Maxim, I am using the RFMD settings gleaned from the
2269 * reference driver, plus a magic Maxim "ON" value that comes from
2270 * the Realtek document "Windows PG for Rtl8180."
2271 */
2272static void
2273rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2274    int before_rf, int digphy)
2275{
2276	uint32_t anaparm;
2277
2278	anaparm = RTW_READ(regs, RTW_ANAPARM);
2279	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2280
2281	switch (power) {
2282	case RTW_OFF:
2283		if (before_rf)
2284			return;
2285		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2286		anaparm |= RTW_ANAPARM_TXDACOFF;
2287		break;
2288	case RTW_SLEEP:
2289		if (!before_rf)
2290			return;
2291		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2292		anaparm |= RTW_ANAPARM_TXDACOFF;
2293		break;
2294	case RTW_ON:
2295		if (!before_rf)
2296			return;
2297		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2298		break;
2299	}
2300	RTW_DPRINTF(RTW_DEBUG_PWR,
2301	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2302	    __func__, rtw_pwrstate_string(power),
2303	    (before_rf) ? "before" : "after", anaparm));
2304
2305	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2306	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2307}
2308
2309/* XXX I am using the RFMD settings gleaned from the reference
2310 * driver.  They agree
2311 */
2312static void
2313rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2314    int before_rf, int digphy)
2315{
2316	uint32_t anaparm;
2317
2318	anaparm = RTW_READ(regs, RTW_ANAPARM);
2319	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2320
2321	switch (power) {
2322	case RTW_OFF:
2323		if (before_rf)
2324			return;
2325		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2326		anaparm |= RTW_ANAPARM_TXDACOFF;
2327		break;
2328	case RTW_SLEEP:
2329		if (!before_rf)
2330			return;
2331		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2332		anaparm |= RTW_ANAPARM_TXDACOFF;
2333		break;
2334	case RTW_ON:
2335		if (!before_rf)
2336			return;
2337		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2338		break;
2339	}
2340	RTW_DPRINTF(RTW_DEBUG_PWR,
2341	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2342	    __func__, rtw_pwrstate_string(power),
2343	    (before_rf) ? "before" : "after", anaparm));
2344
2345	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2346	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2347}
2348
2349static void
2350rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2351    int before_rf, int digphy)
2352{
2353	uint32_t anaparm;
2354
2355	anaparm = RTW_READ(regs, RTW_ANAPARM);
2356	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2357
2358	switch (power) {
2359	case RTW_OFF:
2360		if (before_rf)
2361			return;
2362		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2363		anaparm |= RTW_ANAPARM_TXDACOFF;
2364		break;
2365	case RTW_SLEEP:
2366		if (!before_rf)
2367			return;
2368		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2369		anaparm |= RTW_ANAPARM_TXDACOFF;
2370		break;
2371	case RTW_ON:
2372		if (!before_rf)
2373			return;
2374		if (digphy) {
2375			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2376			/* XXX guess */
2377			anaparm |= RTW_ANAPARM_TXDACOFF;
2378		} else
2379			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2380		break;
2381	}
2382	RTW_DPRINTF(RTW_DEBUG_PWR,
2383	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2384	    __func__, rtw_pwrstate_string(power),
2385	    (before_rf) ? "before" : "after", anaparm));
2386
2387	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2388	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2389}
2390
2391static void
2392rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2393    int digphy)
2394{
2395	struct rtw_regs *regs = &sc->sc_regs;
2396
2397	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2398
2399	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2400
2401	rtw_set_access(regs, RTW_ACCESS_NONE);
2402
2403	return;
2404}
2405
2406static int
2407rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2408{
2409	int rc;
2410
2411	RTW_DPRINTF(RTW_DEBUG_PWR,
2412	    ("%s: %s->%s\n", __func__,
2413	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2414
2415	if (sc->sc_pwrstate == power)
2416		return 0;
2417
2418	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2419	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2420	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2421
2422	switch (power) {
2423	case RTW_ON:
2424		/* TBD set LEDs */
2425		break;
2426	case RTW_SLEEP:
2427		/* TBD */
2428		break;
2429	case RTW_OFF:
2430		/* TBD */
2431		break;
2432	}
2433	if (rc == 0)
2434		sc->sc_pwrstate = power;
2435	else
2436		sc->sc_pwrstate = RTW_OFF;
2437	return rc;
2438}
2439
2440static int
2441rtw_tune(struct rtw_softc *sc)
2442{
2443	struct ieee80211com *ic = &sc->sc_ic;
2444	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2445	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2446	u_int chan;
2447	int rc;
2448	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2449	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2450
2451	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2452	KASSERT(chan != IEEE80211_CHAN_ANY);
2453
2454	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2455	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2456
2457	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2458	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2459
2460	if (chan == sc->sc_cur_chan) {
2461		RTW_DPRINTF(RTW_DEBUG_TUNE,
2462		    ("%s: already tuned chan #%d\n", __func__, chan));
2463		return 0;
2464	}
2465
2466	rtw_suspend_ticks(sc);
2467
2468	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2469
2470	/* TBD wait for Tx to complete */
2471
2472	KASSERT(device_has_power(sc->sc_dev));
2473
2474	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2475	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2476	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2477		/* XXX condition on powersaving */
2478		aprint_error_dev(sc->sc_dev, "phy init failed\n");
2479	}
2480
2481	sc->sc_cur_chan = chan;
2482
2483	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2484
2485	rtw_resume_ticks(sc);
2486
2487	return rc;
2488}
2489
2490bool
2491rtw_suspend(device_t self, const pmf_qual_t *qual)
2492{
2493	int rc;
2494	struct rtw_softc *sc = device_private(self);
2495
2496	sc->sc_flags &= ~RTW_F_DK_VALID;
2497
2498	if (!device_has_power(self))
2499		return false;
2500
2501	/* turn off PHY */
2502	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2503		aprint_error_dev(self, "failed to turn off PHY (%d)\n", rc);
2504		return false;
2505	}
2506
2507	rtw_disable_interrupts(&sc->sc_regs);
2508
2509	return true;
2510}
2511
2512bool
2513rtw_resume(device_t self, const pmf_qual_t *qual)
2514{
2515	struct rtw_softc *sc = device_private(self);
2516
2517	/* Power may have been removed, resetting WEP keys.
2518	 */
2519	sc->sc_flags &= ~RTW_F_DK_VALID;
2520	rtw_enable_interrupts(sc);
2521
2522	return true;
2523}
2524
2525static void
2526rtw_transmit_config(struct rtw_regs *regs)
2527{
2528	uint32_t tcr;
2529
2530	tcr = RTW_READ(regs, RTW_TCR);
2531
2532	tcr |= RTW_TCR_CWMIN;
2533	tcr &= ~RTW_TCR_MXDMA_MASK;
2534	tcr |= RTW_TCR_MXDMA_256;
2535	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2536	tcr &= ~RTW_TCR_LBK_MASK;
2537	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2538
2539	/* set short/long retry limits */
2540	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2541	tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2542
2543	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2544
2545	RTW_WRITE(regs, RTW_TCR, tcr);
2546	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2547}
2548
2549static void
2550rtw_disable_interrupts(struct rtw_regs *regs)
2551{
2552	RTW_WRITE16(regs, RTW_IMR, 0);
2553	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2554	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2555	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2556}
2557
2558static void
2559rtw_enable_interrupts(struct rtw_softc *sc)
2560{
2561	struct rtw_regs *regs = &sc->sc_regs;
2562
2563	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2564	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2565
2566	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2567	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2568	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2569	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2570
2571	/* XXX necessary? */
2572	if (sc->sc_intr_ack != NULL)
2573		(*sc->sc_intr_ack)(regs);
2574}
2575
2576static void
2577rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2578{
2579	uint8_t msr;
2580
2581	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2582	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2583
2584	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2585
2586	switch (opmode) {
2587	case IEEE80211_M_AHDEMO:
2588	case IEEE80211_M_IBSS:
2589		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2590		break;
2591	case IEEE80211_M_HOSTAP:
2592		msr |= RTW_MSR_NETYPE_AP_OK;
2593		break;
2594	case IEEE80211_M_MONITOR:
2595		/* XXX */
2596		msr |= RTW_MSR_NETYPE_NOLINK;
2597		break;
2598	case IEEE80211_M_STA:
2599		msr |= RTW_MSR_NETYPE_INFRA_OK;
2600		break;
2601	}
2602	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2603
2604	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2605}
2606
2607#define	rtw_calchash(addr) \
2608	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2609
2610static void
2611rtw_pktfilt_load(struct rtw_softc *sc)
2612{
2613	struct rtw_regs *regs = &sc->sc_regs;
2614	struct ieee80211com *ic = &sc->sc_ic;
2615	struct ethercom *ec = &sc->sc_ec;
2616	struct ifnet *ifp = &sc->sc_if;
2617	int hash;
2618	uint32_t hashes[2] = { 0, 0 };
2619	struct ether_multi *enm;
2620	struct ether_multistep step;
2621
2622	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2623
2624	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2625	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2626
2627	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2628	/* MAC auto-reset PHY (huh?) */
2629	sc->sc_rcr |= RTW_RCR_ENMARP;
2630	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2631	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2632
2633	switch (ic->ic_opmode) {
2634	case IEEE80211_M_MONITOR:
2635		sc->sc_rcr |= RTW_RCR_MONITOR;
2636		break;
2637	case IEEE80211_M_AHDEMO:
2638	case IEEE80211_M_IBSS:
2639		/* receive broadcasts in our BSS */
2640		sc->sc_rcr |= RTW_RCR_ADD3;
2641		break;
2642	default:
2643		break;
2644	}
2645
2646	ifp->if_flags &= ~IFF_ALLMULTI;
2647
2648	/*
2649	 * Program the 64-bit multicast hash filter.
2650	 */
2651	ETHER_FIRST_MULTI(step, ec, enm);
2652	while (enm != NULL) {
2653		/* XXX */
2654		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2655		    ETHER_ADDR_LEN) != 0) {
2656			ifp->if_flags |= IFF_ALLMULTI;
2657			break;
2658		}
2659
2660		hash = rtw_calchash(enm->enm_addrlo);
2661		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2662		ETHER_NEXT_MULTI(step, enm);
2663	}
2664
2665	/* XXX accept all broadcast if scanning */
2666	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2667		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2668
2669	if (ifp->if_flags & IFF_PROMISC) {
2670		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2671		sc->sc_rcr |= RTW_RCR_ACRC32;	/* accept frames failing CRC */
2672		sc->sc_rcr |= RTW_RCR_AICV;	/* accept frames failing ICV */
2673		ifp->if_flags |= IFF_ALLMULTI;
2674	}
2675
2676	if (ifp->if_flags & IFF_ALLMULTI)
2677		hashes[0] = hashes[1] = 0xffffffff;
2678
2679	if ((hashes[0] | hashes[1]) != 0)
2680		sc->sc_rcr |= RTW_RCR_AM;	/* accept multicast */
2681
2682	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2683	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2684	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2685	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2686
2687	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2688	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2689	    device_xname(sc->sc_dev), RTW_READ(regs, RTW_MAR0),
2690	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2691}
2692
2693static struct mbuf *
2694rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2695{
2696	struct ieee80211com *ic = &sc->sc_ic;
2697	struct mbuf *m;
2698	struct ieee80211_beacon_offsets	boff;
2699
2700	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2701		RTW_DPRINTF(RTW_DEBUG_BEACON,
2702		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2703	}
2704	return m;
2705}
2706
2707/* Must be called at splnet. */
2708static int
2709rtw_init(struct ifnet *ifp)
2710{
2711	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2712	struct ieee80211com *ic = &sc->sc_ic;
2713	struct rtw_regs *regs = &sc->sc_regs;
2714	int rc;
2715
2716	if (device_is_active(sc->sc_dev)) {
2717		/* Cancel pending I/O and reset. */
2718		rtw_stop(ifp, 0);
2719	} else if (!pmf_device_resume(sc->sc_dev, &sc->sc_qual) ||
2720	           !device_is_active(sc->sc_dev))
2721		return 0;
2722
2723	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2724	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2725	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2726
2727	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2728		goto out;
2729
2730	if ((rc = rtw_swring_setup(sc)) != 0)
2731		goto out;
2732
2733	rtw_transmit_config(regs);
2734
2735	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2736
2737	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2738	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2739
2740	/* long PLCP header, 1Mb/2Mb basic rate */
2741	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2742	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2743
2744	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2745	rtw_set_access(regs, RTW_ACCESS_NONE);
2746
2747	/* XXX from reference sources */
2748	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2749	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2750
2751	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev);
2752
2753	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2754	/* from Linux driver */
2755	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2756
2757	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2758
2759	rtw_enable_interrupts(sc);
2760
2761	rtw_pktfilt_load(sc);
2762
2763	rtw_hwring_setup(sc);
2764
2765	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2766
2767	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2768
2769	ifp->if_flags |= IFF_RUNNING;
2770	ic->ic_state = IEEE80211_S_INIT;
2771
2772	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2773	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2774
2775	rtw_resume_ticks(sc);
2776
2777	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2778
2779	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2780		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2781	else
2782		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2783
2784out:
2785	aprint_error_dev(sc->sc_dev, "interface not running\n");
2786	return rc;
2787}
2788
2789static inline void
2790rtw_led_init(struct rtw_regs *regs)
2791{
2792	uint8_t cfg0, cfg1;
2793
2794	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2795
2796	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2797	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2798	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2799
2800	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2801	RTW_DPRINTF(RTW_DEBUG_LED,
2802	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2803
2804	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2805	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2806	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2807
2808	rtw_set_access(regs, RTW_ACCESS_NONE);
2809}
2810
2811/*
2812 * IEEE80211_S_INIT: 		LED1 off
2813 *
2814 * IEEE80211_S_AUTH,
2815 * IEEE80211_S_ASSOC,
2816 * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2817 *
2818 * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2819 */
2820static void
2821rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2822{
2823	struct rtw_led_state *ls;
2824
2825	ls = &sc->sc_led_state;
2826
2827	switch (nstate) {
2828	case IEEE80211_S_INIT:
2829		rtw_led_init(&sc->sc_regs);
2830		aprint_debug_dev(sc->sc_dev, "stopping blink\n");
2831		callout_stop(&ls->ls_slow_ch);
2832		callout_stop(&ls->ls_fast_ch);
2833		ls->ls_slowblink = 0;
2834		ls->ls_actblink = 0;
2835		ls->ls_default = 0;
2836		break;
2837	case IEEE80211_S_SCAN:
2838		aprint_debug_dev(sc->sc_dev, "scheduling blink\n");
2839		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2840		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2841		/*FALLTHROUGH*/
2842	case IEEE80211_S_AUTH:
2843	case IEEE80211_S_ASSOC:
2844		ls->ls_default = RTW_LED1;
2845		ls->ls_actblink = RTW_LED1;
2846		ls->ls_slowblink = RTW_LED1;
2847		break;
2848	case IEEE80211_S_RUN:
2849		ls->ls_slowblink = 0;
2850		break;
2851	}
2852	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2853}
2854
2855static void
2856rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2857{
2858	uint8_t led_condition;
2859	bus_size_t ofs;
2860	uint8_t mask, newval, val;
2861
2862	led_condition = ls->ls_default;
2863
2864	if (ls->ls_state & RTW_LED_S_SLOW)
2865		led_condition ^= ls->ls_slowblink;
2866	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2867		led_condition ^= ls->ls_actblink;
2868
2869	RTW_DPRINTF(RTW_DEBUG_LED,
2870	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2871
2872	switch (hwverid) {
2873	default:
2874	case 'F':
2875		ofs = RTW_PSR;
2876		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2877		if (led_condition & RTW_LED0)
2878			newval &= ~RTW_PSR_LEDGPO0;
2879		if (led_condition & RTW_LED1)
2880			newval &= ~RTW_PSR_LEDGPO1;
2881		break;
2882	case 'D':
2883		ofs = RTW_9346CR;
2884		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2885		newval = RTW_9346CR_EEM_PROGRAM;
2886		if (led_condition & RTW_LED0)
2887			newval |= RTW_9346CR_EEDI;
2888		if (led_condition & RTW_LED1)
2889			newval |= RTW_9346CR_EECS;
2890		break;
2891	}
2892	val = RTW_READ8(regs, ofs);
2893	RTW_DPRINTF(RTW_DEBUG_LED,
2894	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2895	     (uintptr_t)ofs));
2896	val &= ~mask;
2897	val |= newval;
2898	RTW_WRITE8(regs, ofs, val);
2899	RTW_DPRINTF(RTW_DEBUG_LED,
2900	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2901	     (uintptr_t)ofs));
2902	RTW_SYNC(regs, ofs, ofs);
2903}
2904
2905static void
2906rtw_led_fastblink(void *arg)
2907{
2908	int ostate, s;
2909	struct rtw_softc *sc = (struct rtw_softc *)arg;
2910	struct rtw_led_state *ls = &sc->sc_led_state;
2911
2912	s = splnet();
2913	ostate = ls->ls_state;
2914	ls->ls_state ^= ls->ls_event;
2915
2916	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2917		ls->ls_state &= ~RTW_LED_S_TX;
2918
2919	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2920		ls->ls_state &= ~RTW_LED_S_RX;
2921
2922	ls->ls_event = 0;
2923
2924	if (ostate != ls->ls_state)
2925		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2926	splx(s);
2927
2928	aprint_debug_dev(sc->sc_dev, "scheduling fast blink\n");
2929	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2930}
2931
2932static void
2933rtw_led_slowblink(void *arg)
2934{
2935	int s;
2936	struct rtw_softc *sc = (struct rtw_softc *)arg;
2937	struct rtw_led_state *ls = &sc->sc_led_state;
2938
2939	s = splnet();
2940	ls->ls_state ^= RTW_LED_S_SLOW;
2941	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2942	splx(s);
2943	aprint_debug_dev(sc->sc_dev, "scheduling slow blink\n");
2944	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2945}
2946
2947static void
2948rtw_led_detach(struct rtw_led_state *ls)
2949{
2950	callout_destroy(&ls->ls_fast_ch);
2951	callout_destroy(&ls->ls_slow_ch);
2952}
2953
2954static void
2955rtw_led_attach(struct rtw_led_state *ls, void *arg)
2956{
2957	callout_init(&ls->ls_fast_ch, 0);
2958	callout_init(&ls->ls_slow_ch, 0);
2959	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2960	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2961}
2962
2963static int
2964rtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2965{
2966	int rc = 0, s;
2967	struct rtw_softc *sc = ifp->if_softc;
2968
2969	s = splnet();
2970	if (cmd == SIOCSIFFLAGS) {
2971		if ((rc = ifioctl_common(ifp, cmd, data)) != 0)
2972			;
2973		else switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
2974		case IFF_UP:
2975			rc = rtw_init(ifp);
2976			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2977			break;
2978		case IFF_UP|IFF_RUNNING:
2979			if (device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
2980				rtw_pktfilt_load(sc);
2981			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2982			break;
2983		case IFF_RUNNING:
2984			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2985			rtw_stop(ifp, 1);
2986			break;
2987		default:
2988			break;
2989		}
2990	} else if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
2991		;	/* nothing to do */
2992	else if (cmd == SIOCADDMULTI || cmd == SIOCDELMULTI) {
2993		/* reload packet filter if running */
2994		if (ifp->if_flags & IFF_RUNNING)
2995			rtw_pktfilt_load(sc);
2996		rc = 0;
2997	} else if ((ifp->if_flags & IFF_UP) != 0)
2998		rc = rtw_init(ifp);
2999	else
3000		rc = 0;
3001	splx(s);
3002	return rc;
3003}
3004
3005/* Select a transmit ring with at least one h/w and s/w descriptor free.
3006 * Return 0 on success, -1 on failure.
3007 */
3008static inline int
3009rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
3010    struct rtw_txdesc_blk **tdbp, int pri)
3011{
3012	struct rtw_txsoft_blk *tsb;
3013	struct rtw_txdesc_blk *tdb;
3014
3015	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
3016
3017	tsb = &sc->sc_txsoft_blk[pri];
3018	tdb = &sc->sc_txdesc_blk[pri];
3019
3020	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
3021		if (tsb->tsb_tx_timer == 0)
3022			tsb->tsb_tx_timer = 5;
3023		*tsbp = NULL;
3024		*tdbp = NULL;
3025		return -1;
3026	}
3027	*tsbp = tsb;
3028	*tdbp = tdb;
3029	return 0;
3030}
3031
3032static inline struct mbuf *
3033rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3034    struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3035    struct ieee80211_node **nip, short *if_flagsp)
3036{
3037	struct mbuf *m;
3038
3039	if (IF_IS_EMPTY(ifq))
3040		return NULL;
3041	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3042		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3043		    __func__, pri));
3044		*if_flagsp |= IFF_OACTIVE;
3045		sc->sc_if.if_timer = 1;
3046		return NULL;
3047	}
3048	IF_DEQUEUE(ifq, m);
3049	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3050	m->m_pkthdr.rcvif = NULL;
3051	KASSERT(*nip != NULL);
3052	return m;
3053}
3054
3055/* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3056 * at the driver's selection of transmit control block for the packet.
3057 */
3058static inline int
3059rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3060    struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3061    struct ieee80211_node **nip)
3062{
3063	int pri;
3064	struct ether_header *eh;
3065	struct mbuf *m0;
3066	struct rtw_softc *sc;
3067	short *if_flagsp;
3068
3069	*mp = NULL;
3070
3071	sc = (struct rtw_softc *)ifp->if_softc;
3072
3073	DPRINTF(sc, RTW_DEBUG_XMIT,
3074	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3075
3076	if_flagsp = &ifp->if_flags;
3077
3078	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3079	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3080		                     tdbp, nip, if_flagsp)) != NULL) {
3081		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3082		    __func__));
3083		return 0;
3084	}
3085
3086	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3087		                     tdbp, nip, if_flagsp)) != NULL) {
3088		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3089		    __func__));
3090		return 0;
3091	}
3092
3093	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3094		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3095		return 0;
3096	}
3097
3098	IFQ_POLL(&ifp->if_snd, m0);
3099	if (m0 == NULL) {
3100		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3101		    __func__));
3102		return 0;
3103	}
3104
3105	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3106
3107	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3108		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3109		    __func__, pri));
3110		*if_flagsp |= IFF_OACTIVE;
3111		sc->sc_if.if_timer = 1;
3112		return 0;
3113	}
3114
3115	IFQ_DEQUEUE(&ifp->if_snd, m0);
3116	if (m0 == NULL) {
3117		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3118		    __func__));
3119		return 0;
3120	}
3121	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3122	ifp->if_opackets++;
3123	bpf_mtap(ifp, m0);
3124	eh = mtod(m0, struct ether_header *);
3125	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3126	if (*nip == NULL) {
3127		/* NB: ieee80211_find_txnode does stat+msg */
3128		m_freem(m0);
3129		return -1;
3130	}
3131	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3132		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3133		ifp->if_oerrors++;
3134		return -1;
3135	}
3136	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3137	*mp = m0;
3138	return 0;
3139}
3140
3141static int
3142rtw_seg_too_short(bus_dmamap_t dmamap)
3143{
3144	int i;
3145	for (i = 0; i < dmamap->dm_nsegs; i++) {
3146		if (dmamap->dm_segs[i].ds_len < 4)
3147			return 1;
3148	}
3149	return 0;
3150}
3151
3152/* TBD factor with atw_start */
3153static struct mbuf *
3154rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3155    u_int ndescfree, device_t dev)
3156{
3157	int first, rc;
3158	struct mbuf *m, *m0;
3159
3160	m0 = chain;
3161
3162	/*
3163	 * Load the DMA map.  Copy and try (once) again if the packet
3164	 * didn't fit in the alloted number of segments.
3165	 */
3166	for (first = 1;
3167	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3168			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3169	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3170	     first = 0) {
3171		if (rc == 0) {
3172#ifdef RTW_DIAGxxx
3173			if (rtw_seg_too_short(dmam)) {
3174				printf("%s: short segment, mbuf lengths:", __func__);
3175				for (m = m0; m; m = m->m_next)
3176					printf(" %d", m->m_len);
3177				printf("\n");
3178			}
3179#endif
3180			bus_dmamap_unload(dmat, dmam);
3181		}
3182		MGETHDR(m, M_DONTWAIT, MT_DATA);
3183		if (m == NULL) {
3184			aprint_error_dev(dev, "unable to allocate Tx mbuf\n");
3185			break;
3186		}
3187		if (m0->m_pkthdr.len > MHLEN) {
3188			MCLGET(m, M_DONTWAIT);
3189			if ((m->m_flags & M_EXT) == 0) {
3190				aprint_error_dev(dev,
3191				    "cannot allocate Tx cluster\n");
3192				m_freem(m);
3193				break;
3194			}
3195		}
3196		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3197		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3198		m_freem(m0);
3199		m0 = m;
3200		m = NULL;
3201	}
3202	if (rc != 0) {
3203		aprint_error_dev(dev, "cannot load Tx buffer, rc = %d\n", rc);
3204		m_freem(m0);
3205		return NULL;
3206	} else if (rtw_seg_too_short(dmam)) {
3207		aprint_error_dev(dev,
3208		    "cannot load Tx buffer, segment too short\n");
3209		bus_dmamap_unload(dmat, dmam);
3210		m_freem(m0);
3211		return NULL;
3212	} else if (dmam->dm_nsegs > ndescfree) {
3213		aprint_error_dev(dev, "too many tx segments\n");
3214		bus_dmamap_unload(dmat, dmam);
3215		m_freem(m0);
3216		return NULL;
3217	}
3218	return m0;
3219}
3220
3221#ifdef RTW_DEBUG
3222static void
3223rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3224    struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3225{
3226	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3227	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3228	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3229	    device_xname(sc->sc_dev), ts, action, desc,
3230	    le32toh(td->td_buf), le32toh(td->td_next),
3231	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3232	    le32toh(td->td_len)));
3233}
3234#endif /* RTW_DEBUG */
3235
3236static void
3237rtw_start(struct ifnet *ifp)
3238{
3239	int desc, i, lastdesc, npkt, rate;
3240	uint32_t proto_ctl0, ctl0, ctl1;
3241	bus_dmamap_t		dmamap;
3242	struct ieee80211com	*ic;
3243	struct ieee80211_duration *d0;
3244	struct ieee80211_frame_min	*wh;
3245	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3246	struct mbuf		*m0;
3247	struct rtw_softc	*sc;
3248	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3249	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3250	struct rtw_txsoft	*ts;
3251	struct rtw_txdesc	*td;
3252	struct ieee80211_key	*k;
3253
3254	sc = (struct rtw_softc *)ifp->if_softc;
3255	ic = &sc->sc_ic;
3256
3257	DPRINTF(sc, RTW_DEBUG_XMIT,
3258	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3259
3260	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3261		goto out;
3262
3263	/* XXX do real rate control */
3264	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3265
3266	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3267		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3268
3269	for (;;) {
3270		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3271			continue;
3272		if (m0 == NULL)
3273			break;
3274
3275		wh = mtod(m0, struct ieee80211_frame_min *);
3276
3277		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3278		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3279			m_freem(m0);
3280			break;
3281		} else
3282			k = NULL;
3283
3284		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3285
3286		dmamap = ts->ts_dmamap;
3287
3288		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3289		    tdb->tdb_nfree, sc->sc_dev);
3290
3291		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3292			DPRINTF(sc, RTW_DEBUG_XMIT,
3293			    ("%s: fail dmamap load\n", __func__));
3294			goto post_dequeue_err;
3295		}
3296
3297		/* Note well: rtw_dmamap_load_txbuf may have created
3298		 * a new chain, so we must find the header once
3299		 * more.
3300		 */
3301		wh = mtod(m0, struct ieee80211_frame_min *);
3302
3303		/* XXX do real rate control */
3304		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3305		    IEEE80211_FC0_TYPE_MGT)
3306			rate = 2;
3307		else
3308			rate = MAX(2, ieee80211_get_rate(ni));
3309
3310#ifdef RTW_DEBUG
3311		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3312		    (IFF_DEBUG|IFF_LINK2)) {
3313			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3314			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3315			                            : sizeof(wh),
3316			    rate, 0);
3317		}
3318#endif /* RTW_DEBUG */
3319		ctl0 = proto_ctl0 |
3320		    __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3321
3322		switch (rate) {
3323		default:
3324		case 2:
3325			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3326			break;
3327		case 4:
3328			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3329			break;
3330		case 11:
3331			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3332			break;
3333		case 22:
3334			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3335			break;
3336		}
3337		/* XXX >= ? Compare after fragmentation? */
3338		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3339			ctl0 |= RTW_TXCTL0_RTSEN;
3340
3341                /* XXX Sometimes writes a bogus keyid; h/w doesn't
3342                 * seem to care, since we don't activate h/w Tx
3343                 * encryption.
3344		 */
3345		if (k != NULL &&
3346		    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
3347			ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3348			    RTW_TXCTL0_KEYID_MASK;
3349		}
3350
3351		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3352		    IEEE80211_FC0_TYPE_MGT) {
3353			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3354			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3355			    IEEE80211_FC0_SUBTYPE_BEACON)
3356				ctl0 |= RTW_TXCTL0_BEACON;
3357		}
3358
3359		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3360		    ic->ic_flags, ic->ic_fragthreshold,
3361		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3362		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3363		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3364			DPRINTF(sc, RTW_DEBUG_XMIT,
3365			    ("%s: fail compute duration\n", __func__));
3366			goto post_load_err;
3367		}
3368
3369		d0 = &ts->ts_d0;
3370
3371		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3372
3373		ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3374		    __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3375
3376		if (d0->d_residue)
3377			ctl1 |= RTW_TXCTL1_LENGEXT;
3378
3379		/* TBD fragmentation */
3380
3381		ts->ts_first = tdb->tdb_next;
3382
3383		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3384		    BUS_DMASYNC_PREWRITE);
3385
3386		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3387
3388		bpf_mtap3(ic->ic_rawbpf, m0);
3389
3390		if (sc->sc_radiobpf != NULL) {
3391			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3392
3393			rt->rt_rate = rate;
3394
3395			bpf_mtap2(sc->sc_radiobpf, rt, sizeof(sc->sc_txtapu),
3396			    m0);
3397		}
3398
3399		for (i = 0, lastdesc = desc = ts->ts_first;
3400		     i < dmamap->dm_nsegs;
3401		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3402			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3403				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3404				    ("%s: seg too long\n", __func__));
3405				goto post_load_err;
3406			}
3407			td = &tdb->tdb_desc[desc];
3408			td->td_ctl0 = htole32(ctl0);
3409			td->td_ctl1 = htole32(ctl1);
3410			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3411			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3412			td->td_next = htole32(RTW_NEXT_DESC(tdb, desc));
3413			if (i != 0)
3414				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3415			lastdesc = desc;
3416#ifdef RTW_DEBUG
3417			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3418#endif /* RTW_DEBUG */
3419		}
3420
3421		KASSERT(desc < tdb->tdb_ndesc);
3422
3423		ts->ts_ni = ni;
3424		KASSERT(ni != NULL);
3425		ts->ts_mbuf = m0;
3426		ts->ts_last = lastdesc;
3427		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3428		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3429		   htole32(RTW_TXCTL0_FS);
3430
3431#ifdef RTW_DEBUG
3432		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3433		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3434#endif /* RTW_DEBUG */
3435
3436		tdb->tdb_nfree -= dmamap->dm_nsegs;
3437		tdb->tdb_next = desc;
3438
3439		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3440		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3441
3442		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3443		    htole32(RTW_TXCTL0_OWN);
3444
3445#ifdef RTW_DEBUG
3446		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3447#endif /* RTW_DEBUG */
3448
3449		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3450		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3451
3452		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3453		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3454
3455		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3456			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3457		tsb->tsb_tx_timer = 5;
3458		ifp->if_timer = 1;
3459		rtw_tx_kick(&sc->sc_regs, tsb->tsb_poll);
3460	}
3461out:
3462	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3463	return;
3464post_load_err:
3465	bus_dmamap_unload(sc->sc_dmat, dmamap);
3466	m_freem(m0);
3467post_dequeue_err:
3468	ieee80211_free_node(ni);
3469	return;
3470}
3471
3472static void
3473rtw_idle(struct rtw_regs *regs)
3474{
3475	int active;
3476	uint8_t tppoll;
3477
3478	/* request stop DMA; wait for packets to stop transmitting. */
3479
3480	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3481	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3482
3483	for (active = 0; active < 300 &&
3484	     (tppoll = RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0;
3485	     active++)
3486		DELAY(10);
3487	printf("%s: transmit DMA idle in %dus, tppoll %02" PRIx8 "\n", __func__,
3488	    active * 10, tppoll);
3489}
3490
3491static void
3492rtw_watchdog(struct ifnet *ifp)
3493{
3494	int pri, tx_timeouts = 0;
3495	struct rtw_softc *sc;
3496	struct rtw_txsoft_blk *tsb;
3497
3498	sc = ifp->if_softc;
3499
3500	ifp->if_timer = 0;
3501
3502	if (!device_is_active(sc->sc_dev))
3503		return;
3504
3505	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3506		tsb = &sc->sc_txsoft_blk[pri];
3507
3508		if (tsb->tsb_tx_timer == 0)
3509			continue;
3510		else if (--tsb->tsb_tx_timer == 0) {
3511			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3512				continue;
3513			else if (rtw_collect_txring(sc, tsb,
3514			    &sc->sc_txdesc_blk[pri], 0))
3515				continue;
3516			printf("%s: transmit timeout, priority %d\n",
3517			    ifp->if_xname, pri);
3518			ifp->if_oerrors++;
3519			if (pri != RTW_TXPRIBCN)
3520				tx_timeouts++;
3521		} else
3522			ifp->if_timer = 1;
3523	}
3524
3525	if (tx_timeouts > 0) {
3526		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3527		 * reset s/w tx-ring pointers, and start transmission.
3528		 *
3529		 * TBD Stop/restart just the broken rings?
3530		 */
3531		rtw_idle(&sc->sc_regs);
3532		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
3533		rtw_txdescs_reset(sc);
3534		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3535		rtw_start(ifp);
3536	}
3537	ieee80211_watchdog(&sc->sc_ic);
3538	return;
3539}
3540
3541static void
3542rtw_next_scan(void *arg)
3543{
3544	struct ieee80211com *ic = arg;
3545	int s;
3546
3547	/* don't call rtw_start w/o network interrupts blocked */
3548	s = splnet();
3549	if (ic->ic_state == IEEE80211_S_SCAN)
3550		ieee80211_next_scan(ic);
3551	splx(s);
3552}
3553
3554static void
3555rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3556{
3557	uint16_t bcnitv, bintritv, intval;
3558	int i;
3559	struct rtw_regs *regs = &sc->sc_regs;
3560
3561	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3562		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3563
3564	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3565
3566	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3567
3568	intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3569
3570	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3571	bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3572	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3573	/* interrupt host 1ms before the TBTT */
3574	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3575	bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3576	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3577	/* magic from Linux */
3578	RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3579	RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3580	rtw_set_access(regs, RTW_ACCESS_NONE);
3581
3582	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3583}
3584
3585/* Synchronize the hardware state with the software state. */
3586static int
3587rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3588{
3589	struct ifnet *ifp = ic->ic_ifp;
3590	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3591	enum ieee80211_state ostate;
3592	int error;
3593
3594	ostate = ic->ic_state;
3595
3596	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3597	rtw_led_newstate(sc, nstate);
3598
3599	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3600	if (nstate == IEEE80211_S_INIT) {
3601		callout_stop(&sc->sc_scan_ch);
3602		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3603		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3604	}
3605
3606	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3607		rtw_pwrstate(sc, RTW_ON);
3608
3609	if ((error = rtw_tune(sc)) != 0)
3610		return error;
3611
3612	switch (nstate) {
3613	case IEEE80211_S_INIT:
3614		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3615		break;
3616	case IEEE80211_S_SCAN:
3617		if (ostate != IEEE80211_S_SCAN) {
3618			(void)memset(ic->ic_bss->ni_bssid, 0,
3619			    IEEE80211_ADDR_LEN);
3620			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3621		}
3622
3623		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3624		    rtw_next_scan, ic);
3625
3626		break;
3627	case IEEE80211_S_RUN:
3628		switch (ic->ic_opmode) {
3629		case IEEE80211_M_HOSTAP:
3630		case IEEE80211_M_IBSS:
3631			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3632			/*FALLTHROUGH*/
3633		case IEEE80211_M_AHDEMO:
3634		case IEEE80211_M_STA:
3635			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3636			    ic->ic_bss->ni_intval);
3637			break;
3638		case IEEE80211_M_MONITOR:
3639			break;
3640		}
3641		rtw_set_nettype(sc, ic->ic_opmode);
3642		break;
3643	case IEEE80211_S_ASSOC:
3644	case IEEE80211_S_AUTH:
3645		break;
3646	}
3647
3648	if (nstate != IEEE80211_S_SCAN)
3649		callout_stop(&sc->sc_scan_ch);
3650
3651	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3652}
3653
3654/* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3655static uint64_t
3656rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3657{
3658	uint32_t tsftl, tsfth;
3659
3660	tsfth = RTW_READ(regs, RTW_TSFTRH);
3661	tsftl = RTW_READ(regs, RTW_TSFTRL);
3662	if (tsftl < rstamp)	/* Compensate for rollover. */
3663		tsfth--;
3664	return ((uint64_t)tsfth << 32) | rstamp;
3665}
3666
3667static void
3668rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3669    struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3670{
3671	struct ifnet *ifp = ic->ic_ifp;
3672	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3673
3674	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3675
3676	switch (subtype) {
3677	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3678	case IEEE80211_FC0_SUBTYPE_BEACON:
3679		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3680		    ic->ic_state == IEEE80211_S_RUN &&
3681		    device_is_active(sc->sc_dev)) {
3682			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3683			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3684				(void)ieee80211_ibss_merge(ni);
3685		}
3686		break;
3687	default:
3688		break;
3689	}
3690	return;
3691}
3692
3693static struct ieee80211_node *
3694rtw_node_alloc(struct ieee80211_node_table *nt)
3695{
3696	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3697	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3698	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3699
3700	DPRINTF(sc, RTW_DEBUG_NODE,
3701	    ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
3702	return ni;
3703}
3704
3705static void
3706rtw_node_free(struct ieee80211_node *ni)
3707{
3708	struct ieee80211com *ic = ni->ni_ic;
3709	struct ifnet *ifp = ic->ic_ifp;
3710	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3711
3712	DPRINTF(sc, RTW_DEBUG_NODE,
3713	    ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
3714	    ether_sprintf(ni->ni_bssid)));
3715	(*sc->sc_mtbl.mt_node_free)(ni);
3716}
3717
3718static int
3719rtw_media_change(struct ifnet *ifp)
3720{
3721	int error;
3722
3723	error = ieee80211_media_change(ifp);
3724	if (error == ENETRESET) {
3725		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3726		    (IFF_RUNNING|IFF_UP))
3727			rtw_init(ifp);		/* XXX lose error */
3728		error = 0;
3729	}
3730	return error;
3731}
3732
3733static void
3734rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3735{
3736	struct rtw_softc *sc = ifp->if_softc;
3737
3738	if (!device_is_active(sc->sc_dev)) {
3739		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3740		imr->ifm_status = 0;
3741		return;
3742	}
3743	ieee80211_media_status(ifp, imr);
3744}
3745
3746static inline void
3747rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3748{
3749	(void)strlcpy(ifp->if_xname, dvname, IFNAMSIZ);
3750	ifp->if_softc = softc;
3751	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3752	    IFF_NOTRAILERS;
3753	ifp->if_ioctl = rtw_ioctl;
3754	ifp->if_start = rtw_start;
3755	ifp->if_watchdog = rtw_watchdog;
3756	ifp->if_init = rtw_init;
3757	ifp->if_stop = rtw_stop;
3758}
3759
3760static inline void
3761rtw_set80211props(struct ieee80211com *ic)
3762{
3763	int nrate;
3764	ic->ic_phytype = IEEE80211_T_DS;
3765	ic->ic_opmode = IEEE80211_M_STA;
3766	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3767	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
3768
3769	nrate = 0;
3770	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3771	    IEEE80211_RATE_BASIC | 2;
3772	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3773	    IEEE80211_RATE_BASIC | 4;
3774	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3775	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3776	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3777}
3778
3779static inline void
3780rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3781{
3782	mtbl->mt_newstate = ic->ic_newstate;
3783	ic->ic_newstate = rtw_newstate;
3784
3785	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3786	ic->ic_recv_mgmt = rtw_recv_mgmt;
3787
3788	mtbl->mt_node_free = ic->ic_node_free;
3789	ic->ic_node_free = rtw_node_free;
3790
3791	mtbl->mt_node_alloc = ic->ic_node_alloc;
3792	ic->ic_node_alloc = rtw_node_alloc;
3793
3794	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3795	ic->ic_crypto.cs_key_set = rtw_key_set;
3796	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3797	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3798}
3799
3800static inline void
3801rtw_init_radiotap(struct rtw_softc *sc)
3802{
3803	uint32_t present;
3804
3805	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3806	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3807
3808	if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
3809		present = htole32(RTW_PHILIPS_RX_RADIOTAP_PRESENT);
3810	else
3811		present = htole32(RTW_RX_RADIOTAP_PRESENT);
3812	sc->sc_rxtap.rr_ihdr.it_present = present;
3813
3814	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3815	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3816	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3817}
3818
3819static int
3820rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3821{
3822	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3823	SIMPLEQ_INIT(&tsb->tsb_freeq);
3824	tsb->tsb_ndesc = qlen;
3825	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3826	    M_NOWAIT);
3827	if (tsb->tsb_desc == NULL)
3828		return ENOMEM;
3829	return 0;
3830}
3831
3832static void
3833rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3834{
3835	int pri;
3836	struct rtw_txsoft_blk *tsb;
3837
3838	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3839		tsb = &sc->sc_txsoft_blk[pri];
3840		free(tsb->tsb_desc, M_DEVBUF);
3841		tsb->tsb_desc = NULL;
3842	}
3843}
3844
3845static int
3846rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3847{
3848	int pri, rc = 0;
3849	int qlen[RTW_NTXPRI] =
3850	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3851	struct rtw_txsoft_blk *tsbs;
3852
3853	tsbs = sc->sc_txsoft_blk;
3854
3855	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3856		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3857		if (rc != 0)
3858			break;
3859	}
3860	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3861	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3862	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3863	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3864	return rc;
3865}
3866
3867static void
3868rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3869    u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3870{
3871	tdb->tdb_ndesc = ndesc;
3872	tdb->tdb_desc = desc;
3873	tdb->tdb_physbase = physbase;
3874	tdb->tdb_ofs = ofs;
3875
3876	(void)memset(tdb->tdb_desc, 0,
3877	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3878
3879	rtw_txdesc_blk_init(tdb);
3880	tdb->tdb_next = 0;
3881}
3882
3883static void
3884rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3885{
3886	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3887	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3888	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3889
3890	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3891	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3892	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3893
3894	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3895	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3896	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3897
3898	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3899	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3900	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3901}
3902
3903static struct rtw_rf *
3904rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3905{
3906	rtw_rf_write_t rf_write;
3907	struct rtw_rf *rf;
3908
3909	switch (rfchipid) {
3910	default:
3911		rf_write = rtw_rf_hostwrite;
3912		break;
3913	case RTW_RFCHIPID_INTERSIL:
3914	case RTW_RFCHIPID_PHILIPS:
3915	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3916	case RTW_RFCHIPID_RFMD:
3917		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3918		break;
3919	}
3920
3921	switch (rfchipid) {
3922	case RTW_RFCHIPID_GCT:
3923		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3924		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3925		break;
3926	case RTW_RFCHIPID_MAXIM:
3927		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3928		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3929		break;
3930	case RTW_RFCHIPID_PHILIPS:
3931		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
3932		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3933		break;
3934	case RTW_RFCHIPID_RFMD:
3935		/* XXX RFMD has no RF constructor */
3936		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3937		/*FALLTHROUGH*/
3938	default:
3939		return NULL;
3940	}
3941	rf->rf_continuous_tx_cb =
3942	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
3943	rf->rf_continuous_tx_arg = (void *)sc;
3944	return rf;
3945}
3946
3947/* Revision C and later use a different PHY delay setting than
3948 * revisions A and B.
3949 */
3950static uint8_t
3951rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
3952{
3953#define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
3954#define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
3955
3956	uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
3957
3958	RTW_WRITE(regs, RTW_RCR, REVAB);
3959	RTW_WBW(regs, RTW_RCR, RTW_RCR);
3960	RTW_WRITE(regs, RTW_RCR, REVC);
3961
3962	RTW_WBR(regs, RTW_RCR, RTW_RCR);
3963	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
3964		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
3965
3966	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
3967	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
3968
3969	return phydelay;
3970#undef REVC
3971}
3972
3973void
3974rtw_attach(struct rtw_softc *sc)
3975{
3976	struct ifnet *ifp = &sc->sc_if;
3977	struct ieee80211com *ic = &sc->sc_ic;
3978	struct rtw_txsoft_blk *tsb;
3979	int pri, rc;
3980
3981	pmf_self_suspensor_init(sc->sc_dev, &sc->sc_suspensor, &sc->sc_qual);
3982
3983	rtw_cipher_wep = ieee80211_cipher_wep;
3984	rtw_cipher_wep.ic_decap = rtw_wep_decap;
3985
3986	NEXT_ATTACH_STATE(sc, DETACHED);
3987
3988	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
3989	case RTW_TCR_HWVERID_F:
3990		sc->sc_hwverid = 'F';
3991		break;
3992	case RTW_TCR_HWVERID_D:
3993		sc->sc_hwverid = 'D';
3994		break;
3995	default:
3996		sc->sc_hwverid = '?';
3997		break;
3998	}
3999	aprint_verbose_dev(sc->sc_dev, "hardware version %c\n",
4000	    sc->sc_hwverid);
4001
4002	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4003	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4004	    0);
4005
4006	if (rc != 0) {
4007		aprint_error_dev(sc->sc_dev,
4008		    "could not allocate hw descriptors, error %d\n", rc);
4009		goto err;
4010	}
4011
4012	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4013
4014	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4015	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4016	    (void **)&sc->sc_descs, BUS_DMA_COHERENT);
4017
4018	if (rc != 0) {
4019		aprint_error_dev(sc->sc_dev,
4020		    "could not map hw descriptors, error %d\n", rc);
4021		goto err;
4022	}
4023	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4024
4025	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4026	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4027
4028	if (rc != 0) {
4029		aprint_error_dev(sc->sc_dev,
4030		    "could not create DMA map for hw descriptors, error %d\n",
4031		    rc);
4032		goto err;
4033	}
4034	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4035
4036	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4037	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4038
4039	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4040		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4041		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4042	}
4043
4044	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4045	    sizeof(struct rtw_descs), NULL, 0);
4046
4047	if (rc != 0) {
4048		aprint_error_dev(sc->sc_dev,
4049		    "could not load DMA map for hw descriptors, error %d\n",
4050		    rc);
4051		goto err;
4052	}
4053	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4054
4055	if (rtw_txsoft_blk_setup_all(sc) != 0)
4056		goto err;
4057	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4058
4059	rtw_txdesc_blk_setup_all(sc);
4060
4061	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4062
4063	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4064
4065	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4066		tsb = &sc->sc_txsoft_blk[pri];
4067
4068		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4069		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4070			aprint_error_dev(sc->sc_dev,
4071			    "could not load DMA map for hw tx descriptors, "
4072			    "error %d\n", rc);
4073			goto err;
4074		}
4075	}
4076
4077	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4078	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4079	                                    RTW_RXQLEN)) != 0) {
4080		aprint_error_dev(sc->sc_dev,
4081		    "could not load DMA map for hw rx descriptors, error %d\n",
4082		    rc);
4083		goto err;
4084	}
4085	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4086
4087	/* Reset the chip to a known state. */
4088	if (rtw_reset(sc) != 0)
4089		goto err;
4090	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4091
4092	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4093
4094	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4095		sc->sc_flags |= RTW_F_9356SROM;
4096
4097	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4098	    sc->sc_dev) != 0)
4099		goto err;
4100
4101	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4102
4103	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4104	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4105	    sc->sc_dev) != 0) {
4106		aprint_error_dev(sc->sc_dev,
4107		    "attach failed, malformed serial ROM\n");
4108		goto err;
4109	}
4110
4111	aprint_verbose_dev(sc->sc_dev, "%s PHY\n",
4112	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4113
4114	aprint_verbose_dev(sc->sc_dev, "carrier-sense threshold %u\n",
4115	    sc->sc_csthr);
4116
4117	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4118
4119	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4120	    sc->sc_flags & RTW_F_DIGPHY);
4121
4122	if (sc->sc_rf == NULL) {
4123		aprint_verbose_dev(sc->sc_dev,
4124		    "attach failed, could not attach RF\n");
4125		goto err;
4126	}
4127
4128	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4129
4130	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4131
4132	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4133	    ("%s: PHY delay %d\n", device_xname(sc->sc_dev), sc->sc_phydelay));
4134
4135	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4136		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4137
4138	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels, sc->sc_dev);
4139
4140	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4141	    sc->sc_dev) != 0)
4142		goto err;
4143	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4144
4145	rtw_setifprops(ifp, device_xname(sc->sc_dev), (void*)sc);
4146
4147	IFQ_SET_READY(&ifp->if_snd);
4148
4149	sc->sc_ic.ic_ifp = ifp;
4150	rtw_set80211props(&sc->sc_ic);
4151
4152	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4153
4154	/*
4155	 * Call MI attach routines.
4156	 */
4157	if_attach(ifp);
4158	ieee80211_ifattach(&sc->sc_ic);
4159
4160	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4161
4162	/* possibly we should fill in our own sc_send_prresp, since
4163	 * the RTL8180 is probably sending probe responses in ad hoc
4164	 * mode.
4165	 */
4166
4167	/* complete initialization */
4168	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4169	callout_init(&sc->sc_scan_ch, 0);
4170
4171	rtw_init_radiotap(sc);
4172
4173	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
4174	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4175
4176	NEXT_ATTACH_STATE(sc, FINISHED);
4177
4178	ieee80211_announce(ic);
4179	return;
4180err:
4181	rtw_detach(sc);
4182	return;
4183}
4184
4185int
4186rtw_detach(struct rtw_softc *sc)
4187{
4188	struct ifnet *ifp = &sc->sc_if;
4189	int pri, s;
4190
4191	s = splnet();
4192
4193	switch (sc->sc_attach_state) {
4194	case FINISHED:
4195		rtw_stop(ifp, 1);
4196
4197		pmf_device_deregister(sc->sc_dev);
4198		callout_stop(&sc->sc_scan_ch);
4199		ieee80211_ifdetach(&sc->sc_ic);
4200		if_detach(ifp);
4201		rtw_led_detach(&sc->sc_led_state);
4202		/*FALLTHROUGH*/
4203	case FINISH_ID_STA:
4204	case FINISH_RF_ATTACH:
4205		rtw_rf_destroy(sc->sc_rf);
4206		sc->sc_rf = NULL;
4207		/*FALLTHROUGH*/
4208	case FINISH_PARSE_SROM:
4209	case FINISH_READ_SROM:
4210		rtw_srom_free(&sc->sc_srom);
4211		/*FALLTHROUGH*/
4212	case FINISH_RESET:
4213	case FINISH_RXMAPS_CREATE:
4214		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4215		    RTW_RXQLEN);
4216		/*FALLTHROUGH*/
4217	case FINISH_TXMAPS_CREATE:
4218		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4219			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4220			    sc->sc_txsoft_blk[pri].tsb_desc,
4221			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4222		}
4223		/*FALLTHROUGH*/
4224	case FINISH_TXDESCBLK_SETUP:
4225	case FINISH_TXCTLBLK_SETUP:
4226		rtw_txsoft_blk_cleanup_all(sc);
4227		/*FALLTHROUGH*/
4228	case FINISH_DESCMAP_LOAD:
4229		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4230		/*FALLTHROUGH*/
4231	case FINISH_DESCMAP_CREATE:
4232		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4233		/*FALLTHROUGH*/
4234	case FINISH_DESC_MAP:
4235		bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_descs,
4236		    sizeof(struct rtw_descs));
4237		/*FALLTHROUGH*/
4238	case FINISH_DESC_ALLOC:
4239		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4240		    sc->sc_desc_nsegs);
4241		/*FALLTHROUGH*/
4242	case DETACHED:
4243		NEXT_ATTACH_STATE(sc, DETACHED);
4244		break;
4245	}
4246	splx(s);
4247	return 0;
4248}
4249