rtw.c revision 1.125
1/* $NetBSD: rtw.c,v 1.125 2017/02/02 10:05:35 nonaka Exp $ */
2/*-
3 * Copyright (c) 2004, 2005, 2006, 2007 David Young.  All rights
4 * reserved.
5 *
6 * Programmed for NetBSD by David Young.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
19 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
20 * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
21 * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
22 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
23 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
28 * OF SUCH DAMAGE.
29 */
30/*
31 * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
32 */
33
34#include <sys/cdefs.h>
35__KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.125 2017/02/02 10:05:35 nonaka Exp $");
36
37
38#include <sys/param.h>
39#include <sys/sysctl.h>
40#include <sys/systm.h>
41#include <sys/callout.h>
42#include <sys/mbuf.h>
43#include <sys/malloc.h>
44#include <sys/kernel.h>
45#include <sys/time.h>
46#include <sys/types.h>
47#include <sys/device.h>
48#include <sys/sockio.h>
49
50#include <machine/endian.h>
51#include <sys/bus.h>
52#include <sys/intr.h>	/* splnet */
53
54#include <net/if.h>
55#include <net/if_media.h>
56#include <net/if_ether.h>
57
58#include <net80211/ieee80211_netbsd.h>
59#include <net80211/ieee80211_var.h>
60#include <net80211/ieee80211_radiotap.h>
61
62#include <net/bpf.h>
63
64#include <dev/ic/rtwreg.h>
65#include <dev/ic/rtwvar.h>
66#include <dev/ic/rtwphyio.h>
67#include <dev/ic/rtwphy.h>
68
69#include <dev/ic/smc93cx6var.h>
70
71static int rtw_rfprog_fallback = 0;
72static int rtw_host_rfio = 0;
73
74#ifdef RTW_DEBUG
75int rtw_debug = 0;
76static int rtw_rxbufs_limit = RTW_RXQLEN;
77#endif /* RTW_DEBUG */
78
79#define NEXT_ATTACH_STATE(sc, state) do {			\
80	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
81	    ("%s: attach state %s\n", __func__, #state));	\
82	sc->sc_attach_state = state;				\
83} while (0)
84
85int rtw_dwelltime = 200;	/* milliseconds */
86static struct ieee80211_cipher rtw_cipher_wep;
87
88static void rtw_disable_interrupts(struct rtw_regs *);
89static void rtw_enable_interrupts(struct rtw_softc *);
90
91static int rtw_init(struct ifnet *);
92static void rtw_softintr(void *);
93
94static void rtw_start(struct ifnet *);
95static void rtw_reset_oactive(struct rtw_softc *);
96static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
97    struct ieee80211_node *);
98static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
99
100static void rtw_io_enable(struct rtw_softc *, uint8_t, int);
101static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
102static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
103    const u_int8_t[IEEE80211_ADDR_LEN]);
104static void rtw_key_update_end(struct ieee80211com *);
105static void rtw_key_update_begin(struct ieee80211com *);
106static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
107static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
108
109static void rtw_led_attach(struct rtw_led_state *, void *);
110static void rtw_led_detach(struct rtw_led_state *);
111static void rtw_led_init(struct rtw_regs *);
112static void rtw_led_slowblink(void *);
113static void rtw_led_fastblink(void *);
114static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
115
116static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
117static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
118#ifdef RTW_DEBUG
119static void rtw_dump_rings(struct rtw_softc *sc);
120static void rtw_print_txdesc(struct rtw_softc *, const char *,
121    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
122static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
123static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
124#endif /* RTW_DEBUG */
125#ifdef RTW_DIAG
126static void rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln);
127#endif /* RTW_DIAG */
128
129/*
130 * Setup sysctl(3) MIB, hw.rtw.*
131 *
132 * TBD condition CTLFLAG_PERMANENT on being a module or not
133 */
134SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
135{
136	int rc;
137	const struct sysctlnode *cnode, *rnode;
138
139	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
140	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
141	    "Realtek RTL818x 802.11 controls",
142	    NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL)) != 0)
143		goto err;
144
145#ifdef RTW_DEBUG
146	/* control debugging printfs */
147	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
148	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
149	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
150	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
151	    CTL_CREATE, CTL_EOL)) != 0)
152		goto err;
153
154	/* Limit rx buffers, for simulating resource exhaustion. */
155	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
156	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
157	    "rxbufs_limit",
158	    SYSCTL_DESCR("Set rx buffers limit"),
159	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
160	    CTL_CREATE, CTL_EOL)) != 0)
161		goto err;
162
163#endif /* RTW_DEBUG */
164	/* set fallback RF programming method */
165	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
166	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
167	    "rfprog_fallback",
168	    SYSCTL_DESCR("Set fallback RF programming method"),
169	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
170	    CTL_CREATE, CTL_EOL)) != 0)
171		goto err;
172
173	/* force host to control RF I/O bus */
174	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
175	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
176	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
177	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
178	    CTL_CREATE, CTL_EOL)) != 0)
179		goto err;
180
181	return;
182err:
183	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
184}
185
186static int
187rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
188{
189	int error, t;
190	struct sysctlnode node;
191
192	node = *rnode;
193	t = *(int*)rnode->sysctl_data;
194	node.sysctl_data = &t;
195	error = sysctl_lookup(SYSCTLFN_CALL(&node));
196	if (error || newp == NULL)
197		return (error);
198
199	if (t < lower || t > upper)
200		return (EINVAL);
201
202	*(int*)rnode->sysctl_data = t;
203
204	return (0);
205}
206
207static int
208rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
209{
210	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
211	    __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
212}
213
214static int
215rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
216{
217	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
218}
219
220#ifdef RTW_DEBUG
221static int
222rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
223{
224	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
225	    0, RTW_DEBUG_MAX);
226}
227
228static int
229rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
230{
231	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
232	    0, RTW_RXQLEN);
233}
234
235static void
236rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
237{
238#define PRINTREG32(sc, reg)				\
239	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
240	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
241	    dvname, reg, RTW_READ(regs, reg)))
242
243#define PRINTREG16(sc, reg)				\
244	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
245	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
246	    dvname, reg, RTW_READ16(regs, reg)))
247
248#define PRINTREG8(sc, reg)				\
249	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
250	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
251	    dvname, reg, RTW_READ8(regs, reg)))
252
253	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
254
255	PRINTREG32(regs, RTW_IDR0);
256	PRINTREG32(regs, RTW_IDR1);
257	PRINTREG32(regs, RTW_MAR0);
258	PRINTREG32(regs, RTW_MAR1);
259	PRINTREG32(regs, RTW_TSFTRL);
260	PRINTREG32(regs, RTW_TSFTRH);
261	PRINTREG32(regs, RTW_TLPDA);
262	PRINTREG32(regs, RTW_TNPDA);
263	PRINTREG32(regs, RTW_THPDA);
264	PRINTREG32(regs, RTW_TCR);
265	PRINTREG32(regs, RTW_RCR);
266	PRINTREG32(regs, RTW_TINT);
267	PRINTREG32(regs, RTW_TBDA);
268	PRINTREG32(regs, RTW_ANAPARM);
269	PRINTREG32(regs, RTW_BB);
270	PRINTREG32(regs, RTW_PHYCFG);
271	PRINTREG32(regs, RTW_WAKEUP0L);
272	PRINTREG32(regs, RTW_WAKEUP0H);
273	PRINTREG32(regs, RTW_WAKEUP1L);
274	PRINTREG32(regs, RTW_WAKEUP1H);
275	PRINTREG32(regs, RTW_WAKEUP2LL);
276	PRINTREG32(regs, RTW_WAKEUP2LH);
277	PRINTREG32(regs, RTW_WAKEUP2HL);
278	PRINTREG32(regs, RTW_WAKEUP2HH);
279	PRINTREG32(regs, RTW_WAKEUP3LL);
280	PRINTREG32(regs, RTW_WAKEUP3LH);
281	PRINTREG32(regs, RTW_WAKEUP3HL);
282	PRINTREG32(regs, RTW_WAKEUP3HH);
283	PRINTREG32(regs, RTW_WAKEUP4LL);
284	PRINTREG32(regs, RTW_WAKEUP4LH);
285	PRINTREG32(regs, RTW_WAKEUP4HL);
286	PRINTREG32(regs, RTW_WAKEUP4HH);
287	PRINTREG32(regs, RTW_DK0);
288	PRINTREG32(regs, RTW_DK1);
289	PRINTREG32(regs, RTW_DK2);
290	PRINTREG32(regs, RTW_DK3);
291	PRINTREG32(regs, RTW_RETRYCTR);
292	PRINTREG32(regs, RTW_RDSAR);
293	PRINTREG32(regs, RTW_FER);
294	PRINTREG32(regs, RTW_FEMR);
295	PRINTREG32(regs, RTW_FPSR);
296	PRINTREG32(regs, RTW_FFER);
297
298	/* 16-bit registers */
299	PRINTREG16(regs, RTW_BRSR);
300	PRINTREG16(regs, RTW_IMR);
301	PRINTREG16(regs, RTW_ISR);
302	PRINTREG16(regs, RTW_BCNITV);
303	PRINTREG16(regs, RTW_ATIMWND);
304	PRINTREG16(regs, RTW_BINTRITV);
305	PRINTREG16(regs, RTW_ATIMTRITV);
306	PRINTREG16(regs, RTW_CRC16ERR);
307	PRINTREG16(regs, RTW_CRC0);
308	PRINTREG16(regs, RTW_CRC1);
309	PRINTREG16(regs, RTW_CRC2);
310	PRINTREG16(regs, RTW_CRC3);
311	PRINTREG16(regs, RTW_CRC4);
312	PRINTREG16(regs, RTW_CWR);
313
314	/* 8-bit registers */
315	PRINTREG8(regs, RTW_CR);
316	PRINTREG8(regs, RTW_9346CR);
317	PRINTREG8(regs, RTW_CONFIG0);
318	PRINTREG8(regs, RTW_CONFIG1);
319	PRINTREG8(regs, RTW_CONFIG2);
320	PRINTREG8(regs, RTW_MSR);
321	PRINTREG8(regs, RTW_CONFIG3);
322	PRINTREG8(regs, RTW_CONFIG4);
323	PRINTREG8(regs, RTW_TESTR);
324	PRINTREG8(regs, RTW_PSR);
325	PRINTREG8(regs, RTW_SCR);
326	PRINTREG8(regs, RTW_PHYDELAY);
327	PRINTREG8(regs, RTW_CRCOUNT);
328	PRINTREG8(regs, RTW_PHYADDR);
329	PRINTREG8(regs, RTW_PHYDATAW);
330	PRINTREG8(regs, RTW_PHYDATAR);
331	PRINTREG8(regs, RTW_CONFIG5);
332	PRINTREG8(regs, RTW_TPPOLL);
333
334	PRINTREG16(regs, RTW_BSSID16);
335	PRINTREG32(regs, RTW_BSSID32);
336#undef PRINTREG32
337#undef PRINTREG16
338#undef PRINTREG8
339}
340#endif /* RTW_DEBUG */
341
342void
343rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
344{
345	struct rtw_regs *regs = &sc->sc_regs;
346
347	uint32_t tcr;
348	tcr = RTW_READ(regs, RTW_TCR);
349	tcr &= ~RTW_TCR_LBK_MASK;
350	if (enable)
351		tcr |= RTW_TCR_LBK_CONT;
352	else
353		tcr |= RTW_TCR_LBK_NORMAL;
354	RTW_WRITE(regs, RTW_TCR, tcr);
355	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
356	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
357	rtw_txdac_enable(sc, !enable);
358	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
359	rtw_set_access(regs, RTW_ACCESS_NONE);
360}
361
362#ifdef RTW_DEBUG
363static const char *
364rtw_access_string(enum rtw_access access)
365{
366	switch (access) {
367	case RTW_ACCESS_NONE:
368		return "none";
369	case RTW_ACCESS_CONFIG:
370		return "config";
371	case RTW_ACCESS_ANAPARM:
372		return "anaparm";
373	default:
374		return "unknown";
375	}
376}
377#endif /* RTW_DEBUG */
378
379static void
380rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
381{
382	KASSERT(/* naccess >= RTW_ACCESS_NONE && */
383	    naccess <= RTW_ACCESS_ANAPARM);
384	KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
385	    regs->r_access <= RTW_ACCESS_ANAPARM);
386
387	if (naccess == regs->r_access)
388		return;
389
390	switch (naccess) {
391	case RTW_ACCESS_NONE:
392		switch (regs->r_access) {
393		case RTW_ACCESS_ANAPARM:
394			rtw_anaparm_enable(regs, 0);
395			/*FALLTHROUGH*/
396		case RTW_ACCESS_CONFIG:
397			rtw_config0123_enable(regs, 0);
398			/*FALLTHROUGH*/
399		case RTW_ACCESS_NONE:
400			break;
401		}
402		break;
403	case RTW_ACCESS_CONFIG:
404		switch (regs->r_access) {
405		case RTW_ACCESS_NONE:
406			rtw_config0123_enable(regs, 1);
407			/*FALLTHROUGH*/
408		case RTW_ACCESS_CONFIG:
409			break;
410		case RTW_ACCESS_ANAPARM:
411			rtw_anaparm_enable(regs, 0);
412			break;
413		}
414		break;
415	case RTW_ACCESS_ANAPARM:
416		switch (regs->r_access) {
417		case RTW_ACCESS_NONE:
418			rtw_config0123_enable(regs, 1);
419			/*FALLTHROUGH*/
420		case RTW_ACCESS_CONFIG:
421			rtw_anaparm_enable(regs, 1);
422			/*FALLTHROUGH*/
423		case RTW_ACCESS_ANAPARM:
424			break;
425		}
426		break;
427	}
428}
429
430void
431rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
432{
433	rtw_set_access1(regs, access);
434	RTW_DPRINTF(RTW_DEBUG_ACCESS,
435	    ("%s: access %s -> %s\n", __func__,
436	    rtw_access_string(regs->r_access),
437	    rtw_access_string(access)));
438	regs->r_access = access;
439}
440
441/*
442 * Enable registers, switch register banks.
443 */
444void
445rtw_config0123_enable(struct rtw_regs *regs, int enable)
446{
447	uint8_t ecr;
448	ecr = RTW_READ8(regs, RTW_9346CR);
449	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
450	if (enable)
451		ecr |= RTW_9346CR_EEM_CONFIG;
452	else {
453		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
454		ecr |= RTW_9346CR_EEM_NORMAL;
455	}
456	RTW_WRITE8(regs, RTW_9346CR, ecr);
457	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
458}
459
460/* requires rtw_config0123_enable(, 1) */
461void
462rtw_anaparm_enable(struct rtw_regs *regs, int enable)
463{
464	uint8_t cfg3;
465
466	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
467	cfg3 |= RTW_CONFIG3_CLKRUNEN;
468	if (enable)
469		cfg3 |= RTW_CONFIG3_PARMEN;
470	else
471		cfg3 &= ~RTW_CONFIG3_PARMEN;
472	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
473	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
474}
475
476/* requires rtw_anaparm_enable(, 1) */
477void
478rtw_txdac_enable(struct rtw_softc *sc, int enable)
479{
480	uint32_t anaparm;
481	struct rtw_regs *regs = &sc->sc_regs;
482
483	anaparm = RTW_READ(regs, RTW_ANAPARM);
484	if (enable)
485		anaparm &= ~RTW_ANAPARM_TXDACOFF;
486	else
487		anaparm |= RTW_ANAPARM_TXDACOFF;
488	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
489	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
490}
491
492static inline int
493rtw_chip_reset1(struct rtw_regs *regs, device_t dev)
494{
495	uint8_t cr;
496	int i;
497
498	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
499
500	RTW_WBR(regs, RTW_CR, RTW_CR);
501
502	for (i = 0; i < 1000; i++) {
503		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
504			RTW_DPRINTF(RTW_DEBUG_RESET,
505			    ("%s: reset in %dus\n", device_xname(dev), i));
506			return 0;
507		}
508		RTW_RBR(regs, RTW_CR, RTW_CR);
509		DELAY(10); /* 10us */
510	}
511
512	aprint_error_dev(dev, "reset failed\n");
513	return ETIMEDOUT;
514}
515
516static inline int
517rtw_chip_reset(struct rtw_regs *regs, device_t dev)
518{
519	uint32_t tcr;
520
521	/* from Linux driver */
522	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
523	      __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
524
525	RTW_WRITE(regs, RTW_TCR, tcr);
526
527	RTW_WBW(regs, RTW_CR, RTW_TCR);
528
529	return rtw_chip_reset1(regs, dev);
530}
531
532static int
533rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
534{
535	struct ieee80211_key keycopy;
536
537	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
538
539	keycopy = *k;
540	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
541
542	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
543}
544
545static int
546rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
547{
548	struct rtw_softc *sc = ic->ic_ifp->if_softc;
549
550	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__,
551	    k->wk_keyix));
552
553	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
554
555	if (k->wk_keylen != 0 &&
556	    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP)
557		sc->sc_flags &= ~RTW_F_DK_VALID;
558
559	return 1;
560}
561
562static int
563rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
564    const u_int8_t mac[IEEE80211_ADDR_LEN])
565{
566	struct rtw_softc *sc = ic->ic_ifp->if_softc;
567
568	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
569
570	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
571
572	sc->sc_flags &= ~RTW_F_DK_VALID;
573
574	return 1;
575}
576
577static void
578rtw_key_update_begin(struct ieee80211com *ic)
579{
580#ifdef RTW_DEBUG
581	struct ifnet *ifp = ic->ic_ifp;
582	struct rtw_softc *sc = ifp->if_softc;
583#endif
584
585	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
586}
587
588static void
589rtw_tx_kick(struct rtw_regs *regs, uint8_t ringsel)
590{
591	uint8_t tppoll;
592
593	tppoll = RTW_READ8(regs, RTW_TPPOLL);
594	tppoll &= ~RTW_TPPOLL_SALL;
595	tppoll |= ringsel & RTW_TPPOLL_ALL;
596	RTW_WRITE8(regs, RTW_TPPOLL, tppoll);
597	RTW_SYNC(regs, RTW_TPPOLL, RTW_TPPOLL);
598}
599
600static void
601rtw_key_update_end(struct ieee80211com *ic)
602{
603	struct ifnet *ifp = ic->ic_ifp;
604	struct rtw_softc *sc = ifp->if_softc;
605
606	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
607
608	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
609	    !device_is_active(sc->sc_dev))
610		return;
611
612	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
613	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
614	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
615	    (ifp->if_flags & IFF_RUNNING) != 0);
616}
617
618static bool
619rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
620{
621	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
622		return false;
623
624	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
625		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
626}
627
628static void
629rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
630{
631	uint8_t psr, scr;
632	int i, keylen = 0;
633	struct rtw_regs *regs;
634	union rtw_keys *rk;
635
636	regs = &sc->sc_regs;
637	rk = &sc->sc_keys;
638
639	(void)memset(rk, 0, sizeof(*rk));
640
641	/* Temporarily use software crypto for all keys. */
642	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
643		if (wk[i].wk_cipher == &rtw_cipher_wep)
644			wk[i].wk_cipher = &ieee80211_cipher_wep;
645	}
646
647	rtw_set_access(regs, RTW_ACCESS_CONFIG);
648
649	psr = RTW_READ8(regs, RTW_PSR);
650	scr = RTW_READ8(regs, RTW_SCR);
651	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
652
653	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
654		goto out;
655
656	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
657		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
658			continue;
659		if (i == txkey) {
660			keylen = wk[i].wk_keylen;
661			break;
662		}
663		keylen = MAX(keylen, wk[i].wk_keylen);
664	}
665
666	if (keylen == 5)
667		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
668	else if (keylen == 13)
669		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
670
671	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
672		if (wk[i].wk_keylen != keylen ||
673		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
674			continue;
675		/* h/w will decrypt, s/w still strips headers */
676		wk[i].wk_cipher = &rtw_cipher_wep;
677		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
678	}
679
680out:
681	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
682
683	bus_space_write_region_stream_4(regs->r_bt, regs->r_bh,
684	    RTW_DK0, rk->rk_words, __arraycount(rk->rk_words));
685
686	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
687	    BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
688
689	RTW_DPRINTF(RTW_DEBUG_KEY,
690	    ("%s.%d: scr %02" PRIx8 ", keylen %d\n", __func__, __LINE__, scr,
691	     keylen));
692
693	RTW_WBW(regs, RTW_DK0, RTW_PSR);
694	RTW_WRITE8(regs, RTW_PSR, psr);
695	RTW_WBW(regs, RTW_PSR, RTW_SCR);
696	RTW_WRITE8(regs, RTW_SCR, scr);
697	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
698	rtw_set_access(regs, RTW_ACCESS_NONE);
699	sc->sc_flags |= RTW_F_DK_VALID;
700}
701
702static inline int
703rtw_recall_eeprom(struct rtw_regs *regs, device_t dev)
704{
705	int i;
706	uint8_t ecr;
707
708	ecr = RTW_READ8(regs, RTW_9346CR);
709	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
710	RTW_WRITE8(regs, RTW_9346CR, ecr);
711
712	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
713
714	/* wait 25ms for completion */
715	for (i = 0; i < 250; i++) {
716		ecr = RTW_READ8(regs, RTW_9346CR);
717		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
718			RTW_DPRINTF(RTW_DEBUG_RESET,
719			    ("%s: recall EEPROM in %dus\n", device_xname(dev),
720			    i * 100));
721			return 0;
722		}
723		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
724		DELAY(100);
725	}
726	aprint_error_dev(dev, "recall EEPROM failed\n");
727	return ETIMEDOUT;
728}
729
730static inline int
731rtw_reset(struct rtw_softc *sc)
732{
733	int rc;
734	uint8_t config1;
735
736	sc->sc_flags &= ~RTW_F_DK_VALID;
737
738	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev)) != 0)
739		return rc;
740
741	rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev);
742
743	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
744	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
745	/* TBD turn off maximum power saving? */
746
747	return 0;
748}
749
750static inline int
751rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
752    u_int ndescs)
753{
754	int i, rc = 0;
755	for (i = 0; i < ndescs; i++) {
756		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
757		    0, 0, &descs[i].ts_dmamap);
758		if (rc != 0)
759			break;
760	}
761	return rc;
762}
763
764static inline int
765rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
766    u_int ndescs)
767{
768	int i, rc = 0;
769	for (i = 0; i < ndescs; i++) {
770		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
771		    &descs[i].rs_dmamap);
772		if (rc != 0)
773			break;
774	}
775	return rc;
776}
777
778static inline void
779rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
780    u_int ndescs)
781{
782	int i;
783	for (i = 0; i < ndescs; i++) {
784		if (descs[i].rs_dmamap != NULL)
785			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
786	}
787}
788
789static inline void
790rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
791    u_int ndescs)
792{
793	int i;
794	for (i = 0; i < ndescs; i++) {
795		if (descs[i].ts_dmamap != NULL)
796			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
797	}
798}
799
800static inline void
801rtw_srom_free(struct rtw_srom *sr)
802{
803	sr->sr_size = 0;
804	if (sr->sr_content == NULL)
805		return;
806	free(sr->sr_content, M_DEVBUF);
807	sr->sr_content = NULL;
808}
809
810static void
811rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
812    uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
813{
814	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
815	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
816	*rcr |= RTW_RCR_ENCS1;
817	*rfchipid = RTW_RFCHIPID_PHILIPS;
818}
819
820static int
821rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
822    enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
823    device_t dev)
824{
825	int i;
826	const char *rfname, *paname;
827	char scratch[sizeof("unknown 0xXX")];
828	uint16_t srom_version;
829
830	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
831	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
832
833	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
834
835	if (srom_version <= 0x0101) {
836		aprint_error_dev(dev,
837		    "SROM version %d.%d is not understood, "
838		    "limping along with defaults\n",
839		    srom_version >> 8, srom_version & 0xff);
840		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
841		return 0;
842	} else {
843		aprint_verbose_dev(dev, "SROM version %d.%d\n",
844		    srom_version >> 8, srom_version & 0xff);
845	}
846
847	uint8_t mac[IEEE80211_ADDR_LEN];
848	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
849		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
850	__USE(mac);
851
852	RTW_DPRINTF(RTW_DEBUG_ATTACH,
853	    ("%s: EEPROM MAC %s\n", device_xname(dev), ether_sprintf(mac)));
854
855	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
856
857	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
858		*flags |= RTW_F_ANTDIV;
859
860	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
861	 * to be reversed.
862	 */
863	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
864		*flags |= RTW_F_DIGPHY;
865	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
866		*flags |= RTW_F_DFLANTB;
867
868	*rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
869	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
870
871	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
872		*flags |= RTW_C_RXWEP_104;
873
874	*flags |= RTW_C_RXWEP_40;	/* XXX */
875
876	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
877	switch (*rfchipid) {
878	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
879		rfname = "GCT GRF5101";
880		paname = "Winspring WS9901";
881		break;
882	case RTW_RFCHIPID_MAXIM:
883		rfname = "Maxim MAX2820";	/* guess */
884		paname = "Maxim MAX2422";	/* guess */
885		break;
886	case RTW_RFCHIPID_INTERSIL:
887		rfname = "Intersil HFA3873";	/* guess */
888		paname = "Intersil <unknown>";
889		break;
890	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
891		rfname = "Philips SA2400A";
892		paname = "Philips SA2411";
893		break;
894	case RTW_RFCHIPID_RFMD:
895		/* this is the same front-end as an atw(4)! */
896		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
897			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
898			 "SYN: Silicon Labs Si4126";	/* inferred from
899			 				 * reference driver
900							 */
901		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
902		break;
903	case RTW_RFCHIPID_RESERVED:
904		rfname = paname = "reserved";
905		break;
906	default:
907		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
908		rfname = paname = scratch;
909	}
910	aprint_normal_dev(dev, "RF: %s, PA: %s\n", rfname, paname);
911
912	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
913	case RTW_CONFIG0_GL_USA:
914	case _RTW_CONFIG0_GL_USA:
915		*locale = RTW_LOCALE_USA;
916		break;
917	case RTW_CONFIG0_GL_EUROPE:
918		*locale = RTW_LOCALE_EUROPE;
919		break;
920	case RTW_CONFIG0_GL_JAPAN:
921		*locale = RTW_LOCALE_JAPAN;
922		break;
923	default:
924		*locale = RTW_LOCALE_UNKNOWN;
925		break;
926	}
927	return 0;
928}
929
930/* Returns -1 on failure. */
931static int
932rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
933    device_t dev)
934{
935	int rc;
936	struct seeprom_descriptor sd;
937	uint8_t ecr;
938
939	(void)memset(&sd, 0, sizeof(sd));
940
941	ecr = RTW_READ8(regs, RTW_9346CR);
942
943	if ((flags & RTW_F_9356SROM) != 0) {
944		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n",
945		    device_xname(dev)));
946		sr->sr_size = 256;
947		sd.sd_chip = C56_66;
948	} else {
949		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n",
950		    device_xname(dev)));
951		sr->sr_size = 128;
952		sd.sd_chip = C46;
953	}
954
955	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
956	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
957	ecr |= RTW_9346CR_EEM_PROGRAM;
958
959	RTW_WRITE8(regs, RTW_9346CR, ecr);
960
961	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
962
963	if (sr->sr_content == NULL) {
964		aprint_error_dev(dev, "unable to allocate SROM buffer\n");
965		return ENOMEM;
966	}
967
968	(void)memset(sr->sr_content, 0, sr->sr_size);
969
970	/* RTL8180 has a single 8-bit register for controlling the
971	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
972	 * input/output sense is the reverse of read_seeprom's.
973	 */
974	sd.sd_tag = regs->r_bt;
975	sd.sd_bsh = regs->r_bh;
976	sd.sd_regsize = 1;
977	sd.sd_control_offset = RTW_9346CR;
978	sd.sd_status_offset = RTW_9346CR;
979	sd.sd_dataout_offset = RTW_9346CR;
980	sd.sd_CK = RTW_9346CR_EESK;
981	sd.sd_CS = RTW_9346CR_EECS;
982	sd.sd_DI = RTW_9346CR_EEDO;
983	sd.sd_DO = RTW_9346CR_EEDI;
984	/* make read_seeprom enter EEPROM read/write mode */
985	sd.sd_MS = ecr;
986	sd.sd_RDY = 0;
987
988	/* TBD bus barriers */
989	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
990		aprint_error_dev(dev, "could not read SROM\n");
991		free(sr->sr_content, M_DEVBUF);
992		sr->sr_content = NULL;
993		return -1;	/* XXX */
994	}
995
996	/* end EEPROM read/write mode */
997	RTW_WRITE8(regs, RTW_9346CR,
998	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
999	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
1000
1001	if ((rc = rtw_recall_eeprom(regs, dev)) != 0)
1002		return rc;
1003
1004#ifdef RTW_DEBUG
1005	{
1006		int i;
1007		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1008		    ("\n%s: serial ROM:\n\t", device_xname(dev)));
1009		for (i = 0; i < sr->sr_size/2; i++) {
1010			if (((i % 8) == 0) && (i != 0))
1011				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1012			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1013			    (" %04x", sr->sr_content[i]));
1014		}
1015		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1016	}
1017#endif /* RTW_DEBUG */
1018	return 0;
1019}
1020
1021static void
1022rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1023    device_t dev)
1024{
1025	uint8_t cfg4;
1026	const char *method;
1027
1028	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1029
1030	switch (rfchipid) {
1031	default:
1032		cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1033		method = "fallback";
1034		break;
1035	case RTW_RFCHIPID_INTERSIL:
1036		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1037		method = "Intersil";
1038		break;
1039	case RTW_RFCHIPID_PHILIPS:
1040		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1041		method = "Philips";
1042		break;
1043	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1044	case RTW_RFCHIPID_RFMD:
1045		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1046		method = "RFMD";
1047		break;
1048	}
1049
1050	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1051
1052	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1053
1054#ifdef RTW_DEBUG
1055	RTW_DPRINTF(RTW_DEBUG_INIT,
1056	    ("%s: %s RF programming method, %#02x\n", device_xname(dev), method,
1057	    RTW_READ8(regs, RTW_CONFIG4)));
1058#else
1059	__USE(method);
1060#endif
1061}
1062
1063static inline void
1064rtw_init_channels(enum rtw_locale locale,
1065    struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1], device_t dev)
1066{
1067	int i;
1068	const char *name = NULL;
1069#define ADD_CHANNEL(_chans, _chan) do {			\
1070	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1071	(*_chans)[_chan].ic_freq =				\
1072	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1073} while (0)
1074
1075	switch (locale) {
1076	case RTW_LOCALE_USA:	/* 1-11 */
1077		name = "USA";
1078		for (i = 1; i <= 11; i++)
1079			ADD_CHANNEL(chans, i);
1080		break;
1081	case RTW_LOCALE_JAPAN:	/* 1-14 */
1082		name = "Japan";
1083		ADD_CHANNEL(chans, 14);
1084		for (i = 1; i <= 14; i++)
1085			ADD_CHANNEL(chans, i);
1086		break;
1087	case RTW_LOCALE_EUROPE:	/* 1-13 */
1088		name = "Europe";
1089		for (i = 1; i <= 13; i++)
1090			ADD_CHANNEL(chans, i);
1091		break;
1092	default:			/* 10-11 allowed by most countries */
1093		name = "<unknown>";
1094		for (i = 10; i <= 11; i++)
1095			ADD_CHANNEL(chans, i);
1096		break;
1097	}
1098	aprint_normal_dev(dev, "Geographic Location %s\n", name);
1099#undef ADD_CHANNEL
1100}
1101
1102
1103static inline void
1104rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1105{
1106	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1107
1108	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1109	case RTW_CONFIG0_GL_USA:
1110	case _RTW_CONFIG0_GL_USA:
1111		*locale = RTW_LOCALE_USA;
1112		break;
1113	case RTW_CONFIG0_GL_JAPAN:
1114		*locale = RTW_LOCALE_JAPAN;
1115		break;
1116	case RTW_CONFIG0_GL_EUROPE:
1117		*locale = RTW_LOCALE_EUROPE;
1118		break;
1119	default:
1120		*locale = RTW_LOCALE_UNKNOWN;
1121		break;
1122	}
1123}
1124
1125static inline int
1126rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1127    device_t dev)
1128{
1129	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1130		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1131	};
1132	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1133	          idr1 = RTW_READ(regs, RTW_IDR1);
1134
1135	(*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1136	(*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1137	(*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1138	(*addr)[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
1139
1140	(*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1141	(*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1142
1143	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1144		aprint_error_dev(dev,
1145		    "could not get mac address, attach failed\n");
1146		return ENXIO;
1147	}
1148
1149	aprint_normal_dev(dev, "802.11 address %s\n", ether_sprintf(*addr));
1150
1151	return 0;
1152}
1153
1154static uint8_t
1155rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1156    struct ieee80211_channel *chan)
1157{
1158	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1159	KASSERT(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14);
1160	return RTW_SR_GET(sr, idx);
1161}
1162
1163static void
1164rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1165{
1166	int pri;
1167	/* nfree: the number of free descriptors in each ring.
1168	 * The beacon ring is a special case: I do not let the
1169	 * driver use all of the descriptors on the beacon ring.
1170	 * The reasons are two-fold:
1171	 *
1172	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1173	 * updated, so the driver cannot easily know if the descriptor
1174	 * belongs to it, or if it is racing the NIC.  If the NIC
1175	 * does not OWN every descriptor, then the driver can safely
1176	 * update the descriptors when RTW_TBDA points at tdb_next.
1177	 *
1178	 * (2) I hope that the NIC will process more than one BEACON
1179	 * descriptor in a single beacon interval, since that will
1180	 * enable multiple-BSS support.  Since the NIC does not
1181	 * clear the OWN bit, there is no natural place for it to
1182	 * stop processing BEACON desciptors.  Maybe it will *not*
1183	 * stop processing them!  I do not want to chance the NIC
1184	 * looping around and around a saturated beacon ring, so
1185	 * I will leave one descriptor unOWNed at all times.
1186	 */
1187	u_int nfree[RTW_NTXPRI] =
1188	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1189	     RTW_NTXDESCBCN - 1};
1190
1191	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1192		tdb[pri].tdb_nfree = nfree[pri];
1193		tdb[pri].tdb_next = 0;
1194	}
1195}
1196
1197static int
1198rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1199{
1200	int i;
1201	struct rtw_txsoft *ts;
1202
1203	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1204	SIMPLEQ_INIT(&tsb->tsb_freeq);
1205	for (i = 0; i < tsb->tsb_ndesc; i++) {
1206		ts = &tsb->tsb_desc[i];
1207		ts->ts_mbuf = NULL;
1208		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1209	}
1210	tsb->tsb_tx_timer = 0;
1211	return 0;
1212}
1213
1214static void
1215rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1216{
1217	int pri;
1218	for (pri = 0; pri < RTW_NTXPRI; pri++)
1219		rtw_txsoft_blk_init(&tsb[pri]);
1220}
1221
1222static inline void
1223rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1224{
1225	KASSERT(nsync <= rdb->rdb_ndesc);
1226	/* sync to end of ring */
1227	if (desc0 + nsync > rdb->rdb_ndesc) {
1228		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1229		    offsetof(struct rtw_descs, hd_rx[desc0]),
1230		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1231		nsync -= (rdb->rdb_ndesc - desc0);
1232		desc0 = 0;
1233	}
1234
1235	KASSERT(desc0 < rdb->rdb_ndesc);
1236	KASSERT(nsync <= rdb->rdb_ndesc);
1237	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1238
1239	/* sync what remains */
1240	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1241	    offsetof(struct rtw_descs, hd_rx[desc0]),
1242	    sizeof(struct rtw_rxdesc) * nsync, ops);
1243}
1244
1245static void
1246rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1247{
1248	/* sync to end of ring */
1249	if (desc0 + nsync > tdb->tdb_ndesc) {
1250		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1251		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1252		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1253		    ops);
1254		nsync -= (tdb->tdb_ndesc - desc0);
1255		desc0 = 0;
1256	}
1257
1258	/* sync what remains */
1259	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1260	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1261	    sizeof(struct rtw_txdesc) * nsync, ops);
1262}
1263
1264static void
1265rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1266{
1267	int pri;
1268	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1269		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1270		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1271	}
1272}
1273
1274static void
1275rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1276{
1277	int i;
1278	struct rtw_rxsoft *rs;
1279
1280	for (i = 0; i < RTW_RXQLEN; i++) {
1281		rs = &desc[i];
1282		if (rs->rs_mbuf == NULL)
1283			continue;
1284		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1285		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1286		bus_dmamap_unload(dmat, rs->rs_dmamap);
1287		m_freem(rs->rs_mbuf);
1288		rs->rs_mbuf = NULL;
1289	}
1290}
1291
1292static inline int
1293rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1294{
1295	int rc;
1296	struct mbuf *m;
1297
1298	MGETHDR(m, M_DONTWAIT, MT_DATA);
1299	if (m == NULL)
1300		return ENOBUFS;
1301
1302	MCLGET(m, M_DONTWAIT);
1303	if ((m->m_flags & M_EXT) == 0) {
1304		m_freem(m);
1305		return ENOBUFS;
1306	}
1307
1308	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1309
1310	if (rs->rs_mbuf != NULL)
1311		bus_dmamap_unload(dmat, rs->rs_dmamap);
1312
1313	rs->rs_mbuf = NULL;
1314
1315	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1316	if (rc != 0) {
1317		m_freem(m);
1318		return -1;
1319	}
1320
1321	rs->rs_mbuf = m;
1322
1323	return 0;
1324}
1325
1326static int
1327rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1328    int *ndesc, device_t dev)
1329{
1330	int i, rc = 0;
1331	struct rtw_rxsoft *rs;
1332
1333	for (i = 0; i < RTW_RXQLEN; i++) {
1334		rs = &desc[i];
1335		/* we're in rtw_init, so there should be no mbufs allocated */
1336		KASSERT(rs->rs_mbuf == NULL);
1337#ifdef RTW_DEBUG
1338		if (i == rtw_rxbufs_limit) {
1339			aprint_error_dev(dev, "TEST hit %d-buffer limit\n", i);
1340			rc = ENOBUFS;
1341			break;
1342		}
1343#endif /* RTW_DEBUG */
1344		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1345			aprint_error_dev(dev,
1346			    "rtw_rxsoft_alloc failed, %d buffers, rc %d\n",
1347			    i, rc);
1348			break;
1349		}
1350	}
1351	*ndesc = i;
1352	return rc;
1353}
1354
1355static inline void
1356rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1357    int idx, int kick)
1358{
1359	int is_last = (idx == rdb->rdb_ndesc - 1);
1360	uint32_t ctl, octl, obuf;
1361	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1362
1363	/* sync the mbuf before the descriptor */
1364	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1365	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1366
1367	obuf = rd->rd_buf;
1368	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1369
1370	ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1371	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1372
1373	if (is_last)
1374		ctl |= RTW_RXCTL_EOR;
1375
1376	octl = rd->rd_ctl;
1377	rd->rd_ctl = htole32(ctl);
1378
1379#ifdef RTW_DEBUG
1380	RTW_DPRINTF(
1381	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1382	         : RTW_DEBUG_RECV_DESC,
1383	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1384	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1385	     le32toh(rd->rd_ctl)));
1386#else
1387	__USE(octl);
1388	__USE(obuf);
1389#endif
1390
1391	/* sync the descriptor */
1392	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1393	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1394	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1395}
1396
1397static void
1398rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1399{
1400	int i;
1401	struct rtw_rxsoft *rs;
1402
1403	for (i = 0; i < rdb->rdb_ndesc; i++) {
1404		rs = &ctl[i];
1405		rtw_rxdesc_init(rdb, rs, i, kick);
1406	}
1407}
1408
1409static void
1410rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1411{
1412	struct rtw_regs *regs = &sc->sc_regs;
1413	uint8_t cr;
1414
1415	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1416	    enable ? "enable" : "disable", flags));
1417
1418	cr = RTW_READ8(regs, RTW_CR);
1419
1420	/* XXX reference source does not enable MULRW */
1421	/* enable PCI Read/Write Multiple */
1422	cr |= RTW_CR_MULRW;
1423
1424	/* The receive engine will always start at RDSAR.  */
1425	if (enable && (flags & ~cr & RTW_CR_RE)) {
1426		struct rtw_rxdesc_blk *rdb;
1427		rdb = &sc->sc_rxdesc_blk;
1428		rdb->rdb_next = 0;
1429	}
1430
1431	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1432	if (enable)
1433		cr |= flags;
1434	else
1435		cr &= ~flags;
1436	RTW_WRITE8(regs, RTW_CR, cr);
1437	RTW_SYNC(regs, RTW_CR, RTW_CR);
1438
1439#ifdef RTW_DIAG
1440	if (cr & RTW_CR_TE)
1441		rtw_txring_fixup(sc, __func__, __LINE__);
1442#endif
1443	if (cr & RTW_CR_TE) {
1444		rtw_tx_kick(&sc->sc_regs,
1445		    RTW_TPPOLL_HPQ | RTW_TPPOLL_NPQ | RTW_TPPOLL_LPQ);
1446	}
1447}
1448
1449static void
1450rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1451{
1452#define	IS_BEACON(__fc0)						\
1453    ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1454     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1455
1456	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1457							 * hardware -> net80211
1458							 */
1459	u_int next, nproc = 0;
1460	int hwrate, len, rate, rssi, sq, s;
1461	uint32_t hrssi, hstat, htsfth, htsftl;
1462	struct rtw_rxdesc *rd;
1463	struct rtw_rxsoft *rs;
1464	struct rtw_rxdesc_blk *rdb;
1465	struct mbuf *m;
1466	struct ifnet *ifp = &sc->sc_if;
1467
1468	struct ieee80211_node *ni;
1469	struct ieee80211_frame_min *wh;
1470
1471	rdb = &sc->sc_rxdesc_blk;
1472
1473	for (next = rdb->rdb_next; ; next = rdb->rdb_next) {
1474		KASSERT(next < rdb->rdb_ndesc);
1475
1476		rtw_rxdescs_sync(rdb, next, 1,
1477		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1478		rd = &rdb->rdb_desc[next];
1479		rs = &sc->sc_rxsoft[next];
1480
1481		hstat = le32toh(rd->rd_stat);
1482		hrssi = le32toh(rd->rd_rssi);
1483		htsfth = le32toh(rd->rd_tsfth);
1484		htsftl = le32toh(rd->rd_tsftl);
1485
1486		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1487		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1488		    __func__, next, hstat, hrssi, htsfth, htsftl));
1489
1490		++nproc;
1491
1492		/* still belongs to NIC */
1493		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1494			rtw_rxdescs_sync(rdb, next, 1, BUS_DMASYNC_PREREAD);
1495			break;
1496		}
1497
1498                /* ieee80211_input() might reset the receive engine
1499                 * (e.g. by indirectly calling rtw_tune()), so save
1500                 * the next pointer here and retrieve it again on
1501                 * the next round.
1502		 */
1503		rdb->rdb_next = (next + 1) % rdb->rdb_ndesc;
1504
1505#ifdef RTW_DEBUG
1506#define PRINTSTAT(flag) do { \
1507	if ((hstat & flag) != 0) { \
1508		printf("%s" #flag, delim); \
1509		delim = ","; \
1510	} \
1511} while (0)
1512		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1513			const char *delim = "<";
1514			printf("%s: ", device_xname(sc->sc_dev));
1515			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1516				printf("status %08x", hstat);
1517				PRINTSTAT(RTW_RXSTAT_SPLCP);
1518				PRINTSTAT(RTW_RXSTAT_MAR);
1519				PRINTSTAT(RTW_RXSTAT_PAR);
1520				PRINTSTAT(RTW_RXSTAT_BAR);
1521				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1522				PRINTSTAT(RTW_RXSTAT_CRC32);
1523				PRINTSTAT(RTW_RXSTAT_ICV);
1524				printf(">, ");
1525			}
1526		}
1527#endif /* RTW_DEBUG */
1528
1529		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1530			aprint_error_dev(sc->sc_dev,
1531			    "DMA error/FIFO overflow %08" PRIx32 ", "
1532			    "rx descriptor %d\n", hstat, next);
1533			ifp->if_ierrors++;
1534			goto next;
1535		}
1536
1537		len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1538		if (len < IEEE80211_MIN_LEN) {
1539			sc->sc_ic.ic_stats.is_rx_tooshort++;
1540			goto next;
1541		}
1542		if (len > rs->rs_mbuf->m_len) {
1543			aprint_error_dev(sc->sc_dev,
1544			    "rx frame too long, %d > %d, %08" PRIx32
1545			    ", desc %d\n",
1546			    len, rs->rs_mbuf->m_len, hstat, next);
1547			ifp->if_ierrors++;
1548			goto next;
1549		}
1550
1551		hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1552		if (hwrate >= __arraycount(ratetbl)) {
1553			aprint_error_dev(sc->sc_dev,
1554			    "unknown rate #%" __PRIuBITS "\n",
1555			    __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1556			ifp->if_ierrors++;
1557			goto next;
1558		}
1559		rate = ratetbl[hwrate];
1560
1561#ifdef RTW_DEBUG
1562		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1563		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1564		     (rate * 5) % 10, htsfth, htsftl));
1565#endif /* RTW_DEBUG */
1566
1567		/* if bad flags, skip descriptor */
1568		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1569			aprint_error_dev(sc->sc_dev, "too many rx segments, "
1570			    "next=%d, %08" PRIx32 "\n", next, hstat);
1571			goto next;
1572		}
1573
1574		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1575		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1576
1577		m = rs->rs_mbuf;
1578
1579		/* if temporarily out of memory, re-use mbuf */
1580		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1581		case 0:
1582			break;
1583		case ENOBUFS:
1584			aprint_error_dev(sc->sc_dev,
1585			    "rtw_rxsoft_alloc(, %d) failed, dropping packet\n",
1586			    next);
1587			goto next;
1588		default:
1589			/* XXX shorten rx ring, instead? */
1590			aprint_error_dev(sc->sc_dev,
1591			    "could not load DMA map\n");
1592		}
1593
1594		sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1595
1596		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1597			rssi = UINT8_MAX - sq;
1598		else {
1599			rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1600			/* TBD find out each front-end's LNA gain in the
1601			 * front-end's units
1602			 */
1603			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1604				rssi |= 0x80;
1605		}
1606
1607		/* Note well: now we cannot recycle the rs_mbuf unless
1608		 * we restore its original length.
1609		 */
1610		m_set_rcvif(m, ifp);
1611		m->m_pkthdr.len = m->m_len = len;
1612
1613		wh = mtod(m, struct ieee80211_frame_min *);
1614
1615		s = splnet();
1616
1617		if (!IS_BEACON(wh->i_fc[0]))
1618			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1619
1620		sc->sc_tsfth = htsfth;
1621
1622#ifdef RTW_DEBUG
1623		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1624		    (IFF_DEBUG|IFF_LINK2)) {
1625			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1626			    rate, rssi);
1627		}
1628#endif /* RTW_DEBUG */
1629
1630		if (sc->sc_radiobpf != NULL) {
1631			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1632
1633			rr->rr_tsft =
1634			    htole64(((uint64_t)htsfth << 32) | htsftl);
1635
1636			rr->rr_flags = IEEE80211_RADIOTAP_F_FCS;
1637
1638			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1639				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1640			if ((hstat & RTW_RXSTAT_CRC32) != 0)
1641				rr->rr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1642
1643			rr->rr_rate = rate;
1644
1645			if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1646				rr->rr_u.u_philips.p_antsignal = rssi;
1647			else {
1648				rr->rr_u.u_other.o_antsignal = rssi;
1649				rr->rr_u.u_other.o_barker_lock =
1650				    htole16(UINT8_MAX - sq);
1651			}
1652
1653			bpf_mtap2(sc->sc_radiobpf,
1654			    rr, sizeof(sc->sc_rxtapu), m);
1655		}
1656
1657		if ((hstat & RTW_RXSTAT_RES) != 0) {
1658			m_freem(m);
1659			splx(s);
1660			goto next;
1661		}
1662
1663		/* CRC is included with the packet; trim it off. */
1664		m_adj(m, -IEEE80211_CRC_LEN);
1665
1666		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1667		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1668		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1669		ieee80211_free_node(ni);
1670		splx(s);
1671next:
1672		rtw_rxdesc_init(rdb, rs, next, 0);
1673	}
1674#undef IS_BEACON
1675}
1676
1677static void
1678rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1679    struct rtw_txsoft *ts)
1680{
1681	struct mbuf *m;
1682	struct ieee80211_node *ni;
1683
1684	m = ts->ts_mbuf;
1685	ni = ts->ts_ni;
1686	KASSERT(m != NULL);
1687	KASSERT(ni != NULL);
1688	ts->ts_mbuf = NULL;
1689	ts->ts_ni = NULL;
1690
1691	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1692	    BUS_DMASYNC_POSTWRITE);
1693	bus_dmamap_unload(dmat, ts->ts_dmamap);
1694	m_freem(m);
1695	ieee80211_free_node(ni);
1696}
1697
1698static void
1699rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1700    struct rtw_txsoft_blk *tsb)
1701{
1702	struct rtw_txsoft *ts;
1703
1704	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1705		rtw_txsoft_release(dmat, ic, ts);
1706		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1707		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1708	}
1709	tsb->tsb_tx_timer = 0;
1710}
1711
1712static inline void
1713rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1714    struct rtw_txsoft *ts, int ndesc)
1715{
1716	uint32_t hstat;
1717	int data_retry, rts_retry;
1718	struct rtw_txdesc *tdn;
1719	const char *condstring;
1720	struct ifnet *ifp = &sc->sc_if;
1721
1722	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1723
1724	tdb->tdb_nfree += ndesc;
1725
1726	tdn = &tdb->tdb_desc[ts->ts_last];
1727
1728	hstat = le32toh(tdn->td_stat);
1729	rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1730	data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1731
1732	ifp->if_collisions += rts_retry + data_retry;
1733
1734	if ((hstat & RTW_TXSTAT_TOK) != 0)
1735		condstring = "ok";
1736	else {
1737		ifp->if_oerrors++;
1738		condstring = "error";
1739	}
1740
1741#ifdef RTW_DEBUG
1742	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1743	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1744	    device_xname(sc->sc_dev), ts, ts->ts_first, ts->ts_last,
1745	    condstring, rts_retry, data_retry));
1746#else
1747	__USE(condstring);
1748#endif
1749}
1750
1751static void
1752rtw_reset_oactive(struct rtw_softc *sc)
1753{
1754	short oflags;
1755	int pri;
1756	struct rtw_txsoft_blk *tsb;
1757	struct rtw_txdesc_blk *tdb;
1758	oflags = sc->sc_if.if_flags;
1759	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1760		tsb = &sc->sc_txsoft_blk[pri];
1761		tdb = &sc->sc_txdesc_blk[pri];
1762		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1763			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1764	}
1765	if (oflags != sc->sc_if.if_flags) {
1766		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1767		    ("%s: reset OACTIVE\n", __func__));
1768	}
1769}
1770
1771/* Collect transmitted packets. */
1772static bool
1773rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1774    struct rtw_txdesc_blk *tdb, int force)
1775{
1776	bool collected = false;
1777	int ndesc;
1778	struct rtw_txsoft *ts;
1779
1780#ifdef RTW_DEBUG
1781	rtw_dump_rings(sc);
1782#endif
1783
1784	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1785		/* If we're clearing a failed transmission, only clear
1786		   up to the last packet the hardware has processed.  */
1787		if (ts->ts_first == rtw_txring_next(&sc->sc_regs, tdb))
1788			break;
1789
1790		ndesc = 1 + ts->ts_last - ts->ts_first;
1791		if (ts->ts_last < ts->ts_first)
1792			ndesc += tdb->tdb_ndesc;
1793
1794		KASSERT(ndesc > 0);
1795
1796		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1797		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1798
1799		if (force) {
1800			int next;
1801#ifdef RTW_DIAG
1802			printf("%s: clearing packet, stats", __func__);
1803#endif
1804			for (next = ts->ts_first; ;
1805			    next = RTW_NEXT_IDX(tdb, next)) {
1806#ifdef RTW_DIAG
1807				printf(" %" PRIx32 "/%" PRIx32 "/%" PRIx32 "/%" PRIu32 "/%" PRIx32, le32toh(tdb->tdb_desc[next].td_stat), le32toh(tdb->tdb_desc[next].td_ctl1), le32toh(tdb->tdb_desc[next].td_buf), le32toh(tdb->tdb_desc[next].td_len), le32toh(tdb->tdb_desc[next].td_next));
1808#endif
1809				tdb->tdb_desc[next].td_stat &=
1810				    ~htole32(RTW_TXSTAT_OWN);
1811				if (next == ts->ts_last)
1812					break;
1813			}
1814			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1815			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1816#ifdef RTW_DIAG
1817			next = RTW_NEXT_IDX(tdb, next);
1818			printf(" -> end %u stat %" PRIx32 ", was %u\n", next,
1819			    le32toh(tdb->tdb_desc[next].td_stat),
1820			    rtw_txring_next(&sc->sc_regs, tdb));
1821#endif
1822		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1823		    htole32(RTW_TXSTAT_OWN)) != 0) {
1824			rtw_txdescs_sync(tdb, ts->ts_last, 1,
1825			    BUS_DMASYNC_PREREAD);
1826			break;
1827		}
1828
1829		collected = true;
1830
1831		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1832		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1833		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1834	}
1835
1836	/* no more pending transmissions, cancel watchdog */
1837	if (ts == NULL)
1838		tsb->tsb_tx_timer = 0;
1839	rtw_reset_oactive(sc);
1840
1841	return collected;
1842}
1843
1844static void
1845rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1846{
1847	int pri, s;
1848	struct rtw_txsoft_blk	*tsb;
1849	struct rtw_txdesc_blk	*tdb;
1850	struct ifnet *ifp = &sc->sc_if;
1851
1852	s = splnet();
1853
1854	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1855		tsb = &sc->sc_txsoft_blk[pri];
1856		tdb = &sc->sc_txdesc_blk[pri];
1857		rtw_collect_txring(sc, tsb, tdb, 0);
1858	}
1859
1860	if ((isr & RTW_INTR_TX) != 0)
1861		rtw_start(ifp);
1862
1863	splx(s);
1864}
1865
1866static void
1867rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1868{
1869	u_int next;
1870	uint32_t tsfth, tsftl;
1871	struct ieee80211com *ic;
1872	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1873	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1874	struct mbuf *m;
1875	int s;
1876
1877	s = splnet();
1878
1879	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1880	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1881
1882	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1883		next = rtw_txring_next(&sc->sc_regs, tdb);
1884#ifdef RTW_DEBUG
1885		RTW_DPRINTF(RTW_DEBUG_BEACON,
1886		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1887		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1888		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1889		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1890#else
1891		__USE(next);
1892		__USE(tsfth);
1893		__USE(tsftl);
1894#endif
1895		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0)
1896			rtw_collect_txring(sc, tsb, tdb, 1);
1897	}
1898	/* Start beacon transmission. */
1899
1900	if ((isr & RTW_INTR_BCNINT) != 0 &&
1901	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1902	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1903		RTW_DPRINTF(RTW_DEBUG_BEACON,
1904		    ("%s: beacon prep. time, isr = %#04" PRIx16
1905		     ", %16" PRIu64 "\n", __func__, isr,
1906		     (uint64_t)tsfth << 32 | tsftl));
1907		ic = &sc->sc_ic;
1908		m = rtw_beacon_alloc(sc, ic->ic_bss);
1909
1910		if (m == NULL) {
1911			aprint_error_dev(sc->sc_dev,
1912			    "could not allocate beacon\n");
1913			splx(s);
1914			return;
1915		}
1916		M_SETCTX(m, ieee80211_ref_node(ic->ic_bss));
1917		IF_ENQUEUE(&sc->sc_beaconq, m);
1918		rtw_start(&sc->sc_if);
1919	}
1920
1921	splx(s);
1922}
1923
1924static void
1925rtw_intr_atim(struct rtw_softc *sc)
1926{
1927	/* TBD */
1928	return;
1929}
1930
1931#ifdef RTW_DEBUG
1932static void
1933rtw_dump_rings(struct rtw_softc *sc)
1934{
1935	struct rtw_txdesc_blk *tdb;
1936	struct rtw_rxdesc *rd;
1937	struct rtw_rxdesc_blk *rdb;
1938	int desc, pri;
1939
1940	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1941		return;
1942
1943	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1944		tdb = &sc->sc_txdesc_blk[pri];
1945		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1946		    tdb->tdb_ndesc, tdb->tdb_nfree);
1947		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1948			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1949	}
1950
1951	rdb = &sc->sc_rxdesc_blk;
1952
1953	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1954		rd = &rdb->rdb_desc[desc];
1955		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1956		    "rsvd1/tsfth %08x\n", __func__,
1957		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1958		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1959		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1960	}
1961}
1962#endif /* RTW_DEBUG */
1963
1964static void
1965rtw_hwring_setup(struct rtw_softc *sc)
1966{
1967	int pri;
1968	struct rtw_regs *regs = &sc->sc_regs;
1969	struct rtw_txdesc_blk *tdb;
1970
1971	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1972	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1973	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1974	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1975	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1976	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1977	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1978	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1979
1980	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1981		tdb = &sc->sc_txdesc_blk[pri];
1982		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1983		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1984		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1985		     (uintptr_t)tdb->tdb_base));
1986	}
1987
1988	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1989
1990	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1991	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1992	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1993
1994	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1995
1996}
1997
1998static int
1999rtw_swring_setup(struct rtw_softc *sc)
2000{
2001	int rc;
2002	struct rtw_rxdesc_blk *rdb;
2003
2004	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
2005
2006	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
2007
2008	rdb = &sc->sc_rxdesc_blk;
2009	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
2010	     sc->sc_dev)) != 0 && rdb->rdb_ndesc == 0) {
2011		aprint_error_dev(sc->sc_dev, "could not allocate rx buffers\n");
2012		return rc;
2013	}
2014
2015	rdb = &sc->sc_rxdesc_blk;
2016	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
2017	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
2018	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
2019	rdb->rdb_next = 0;
2020
2021	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
2022	return 0;
2023}
2024
2025static void
2026rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
2027{
2028	int i;
2029
2030	(void)memset(tdb->tdb_desc, 0,
2031	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
2032	for (i = 0; i < tdb->tdb_ndesc; i++)
2033		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
2034}
2035
2036static u_int
2037rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
2038{
2039	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
2040	    sizeof(struct rtw_txdesc);
2041}
2042
2043#ifdef RTW_DIAG
2044static void
2045rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln)
2046{
2047	int pri;
2048	u_int next;
2049	struct rtw_txdesc_blk *tdb;
2050	struct rtw_regs *regs = &sc->sc_regs;
2051
2052	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2053		int i;
2054		tdb = &sc->sc_txdesc_blk[pri];
2055		next = rtw_txring_next(regs, tdb);
2056		if (tdb->tdb_next == next)
2057			continue;
2058		for (i = 0; next != tdb->tdb_next;
2059		    next = RTW_NEXT_IDX(tdb, next), i++) {
2060			if ((tdb->tdb_desc[next].td_stat & htole32(RTW_TXSTAT_OWN)) == 0)
2061				break;
2062		}
2063		printf("%s:%d: tx-ring %d expected next %u, read %u+%d -> %s\n", fn,
2064		    ln, pri, tdb->tdb_next, next, i, tdb->tdb_next == next ? "okay" : "BAD");
2065		if (tdb->tdb_next == next)
2066			continue;
2067		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
2068	}
2069}
2070#endif
2071
2072static void
2073rtw_txdescs_reset(struct rtw_softc *sc)
2074{
2075	int pri;
2076	struct rtw_txsoft_blk	*tsb;
2077	struct rtw_txdesc_blk	*tdb;
2078
2079	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2080		tsb = &sc->sc_txsoft_blk[pri];
2081		tdb = &sc->sc_txdesc_blk[pri];
2082		rtw_collect_txring(sc, tsb, tdb, 1);
2083#ifdef RTW_DIAG
2084		if (!SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
2085			printf("%s: packets left in ring %d\n", __func__, pri);
2086#endif
2087	}
2088}
2089
2090static void
2091rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2092{
2093	int s;
2094
2095	aprint_error_dev(sc->sc_dev, "tx fifo underflow\n");
2096
2097	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: cleaning up xmit, isr %" PRIx16
2098	    "\n", device_xname(sc->sc_dev), isr));
2099
2100	s = splnet();
2101
2102#ifdef RTW_DEBUG
2103	rtw_dump_rings(sc);
2104#endif /* RTW_DEBUG */
2105
2106	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2107	 * timeouts.
2108	 */
2109	rtw_txdescs_reset(sc);
2110
2111#ifdef RTW_DEBUG
2112	rtw_dump_rings(sc);
2113#endif /* RTW_DEBUG */
2114
2115	splx(s);
2116}
2117
2118static inline void
2119rtw_suspend_ticks(struct rtw_softc *sc)
2120{
2121	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2122	    ("%s: suspending ticks\n", device_xname(sc->sc_dev)));
2123	sc->sc_do_tick = 0;
2124}
2125
2126static inline void
2127rtw_resume_ticks(struct rtw_softc *sc)
2128{
2129	uint32_t tsftrl0, tsftrl1, next_tint;
2130
2131	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2132
2133	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2134	next_tint = tsftrl1 + 1000000;
2135	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tint);
2136
2137	sc->sc_do_tick = 1;
2138
2139#ifdef RTW_DEBUG
2140	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2141	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2142	    device_xname(sc->sc_dev), tsftrl1 - tsftrl0, tsftrl1, next_tint));
2143#else
2144	__USE(tsftrl0);
2145#endif
2146}
2147
2148static void
2149rtw_intr_timeout(struct rtw_softc *sc)
2150{
2151	int s;
2152
2153	s = splnet();
2154	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", device_xname(sc->sc_dev)));
2155	if (sc->sc_do_tick)
2156		rtw_resume_ticks(sc);
2157	splx(s);
2158}
2159
2160int
2161rtw_intr(void *arg)
2162{
2163	struct rtw_softc *sc = arg;
2164	struct rtw_regs *regs = &sc->sc_regs;
2165	uint16_t isr;
2166	struct ifnet *ifp = &sc->sc_if;
2167
2168	/*
2169	 * If the interface isn't running, the interrupt couldn't
2170	 * possibly have come from us.
2171	 */
2172	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2173	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER)) {
2174		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2175		    device_xname(sc->sc_dev)));
2176		return (0);
2177	}
2178
2179	isr = RTW_READ16(regs, RTW_ISR);
2180	if (isr == 0)
2181		return (0);
2182
2183	/* Disable interrupts. */
2184	RTW_WRITE16(regs, RTW_IMR, 0);
2185	RTW_WBW(regs, RTW_IMR, RTW_IMR);
2186
2187	softint_schedule(sc->sc_soft_ih);
2188	return (1);
2189}
2190
2191static void
2192rtw_softintr(void *arg)
2193{
2194	int i;
2195	struct rtw_softc *sc = arg;
2196	struct rtw_regs *regs = &sc->sc_regs;
2197	uint16_t isr;
2198	struct ifnet *ifp = &sc->sc_if;
2199
2200	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2201	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER)) {
2202		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2203		    device_xname(sc->sc_dev)));
2204		return;
2205	}
2206
2207	for (i = 0; i < 10; i++) {
2208		isr = RTW_READ16(regs, RTW_ISR);
2209
2210		RTW_WRITE16(regs, RTW_ISR, isr);
2211		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2212
2213		if (sc->sc_intr_ack != NULL)
2214			(*sc->sc_intr_ack)(regs);
2215
2216		if (isr == 0)
2217			break;
2218
2219#ifdef RTW_DEBUG
2220#define PRINTINTR(flag) do { \
2221	if ((isr & flag) != 0) { \
2222		printf("%s" #flag, delim); \
2223		delim = ","; \
2224	} \
2225} while (0)
2226
2227		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2228			const char *delim = "<";
2229
2230			printf("%s: reg[ISR] = %x", device_xname(sc->sc_dev),
2231			    isr);
2232
2233			PRINTINTR(RTW_INTR_TXFOVW);
2234			PRINTINTR(RTW_INTR_TIMEOUT);
2235			PRINTINTR(RTW_INTR_BCNINT);
2236			PRINTINTR(RTW_INTR_ATIMINT);
2237			PRINTINTR(RTW_INTR_TBDER);
2238			PRINTINTR(RTW_INTR_TBDOK);
2239			PRINTINTR(RTW_INTR_THPDER);
2240			PRINTINTR(RTW_INTR_THPDOK);
2241			PRINTINTR(RTW_INTR_TNPDER);
2242			PRINTINTR(RTW_INTR_TNPDOK);
2243			PRINTINTR(RTW_INTR_RXFOVW);
2244			PRINTINTR(RTW_INTR_RDU);
2245			PRINTINTR(RTW_INTR_TLPDER);
2246			PRINTINTR(RTW_INTR_TLPDOK);
2247			PRINTINTR(RTW_INTR_RER);
2248			PRINTINTR(RTW_INTR_ROK);
2249
2250			printf(">\n");
2251		}
2252#undef PRINTINTR
2253#endif /* RTW_DEBUG */
2254
2255		if ((isr & RTW_INTR_RX) != 0)
2256			rtw_intr_rx(sc, isr);
2257		if ((isr & RTW_INTR_TX) != 0)
2258			rtw_intr_tx(sc, isr);
2259		if ((isr & RTW_INTR_BEACON) != 0)
2260			rtw_intr_beacon(sc, isr);
2261		if ((isr & RTW_INTR_ATIMINT) != 0)
2262			rtw_intr_atim(sc);
2263		if ((isr & RTW_INTR_IOERROR) != 0)
2264			rtw_intr_ioerror(sc, isr);
2265		if ((isr & RTW_INTR_TIMEOUT) != 0)
2266			rtw_intr_timeout(sc);
2267	}
2268	if (i == 10)
2269		softint_schedule(sc->sc_soft_ih);
2270
2271	/* Re-enable interrupts */
2272	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2273	RTW_WBW(regs, RTW_IMR, RTW_IMR);
2274}
2275
2276/* Must be called at splnet. */
2277static void
2278rtw_stop(struct ifnet *ifp, int disable)
2279{
2280	int pri;
2281	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2282	struct ieee80211com *ic = &sc->sc_ic;
2283	struct rtw_regs *regs = &sc->sc_regs;
2284
2285	rtw_suspend_ticks(sc);
2286
2287	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2288
2289	if (device_has_power(sc->sc_dev)) {
2290		/* Disable interrupts. */
2291		RTW_WRITE16(regs, RTW_IMR, 0);
2292
2293		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2294
2295		/* Stop the transmit and receive processes. First stop DMA,
2296		 * then disable receiver and transmitter.
2297		 */
2298		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2299
2300		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2301
2302		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2303	}
2304
2305	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2306		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2307		    &sc->sc_txsoft_blk[pri]);
2308	}
2309
2310	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2311
2312	/* Mark the interface as not running.  Cancel the watchdog timer. */
2313	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2314	ifp->if_timer = 0;
2315
2316	if (disable)
2317		pmf_device_suspend(sc->sc_dev, &sc->sc_qual);
2318
2319	return;
2320}
2321
2322const char *
2323rtw_pwrstate_string(enum rtw_pwrstate power)
2324{
2325	switch (power) {
2326	case RTW_ON:
2327		return "on";
2328	case RTW_SLEEP:
2329		return "sleep";
2330	case RTW_OFF:
2331		return "off";
2332	default:
2333		return "unknown";
2334	}
2335}
2336
2337/* XXX For Maxim, I am using the RFMD settings gleaned from the
2338 * reference driver, plus a magic Maxim "ON" value that comes from
2339 * the Realtek document "Windows PG for Rtl8180."
2340 */
2341static void
2342rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2343    int before_rf, int digphy)
2344{
2345	uint32_t anaparm;
2346
2347	anaparm = RTW_READ(regs, RTW_ANAPARM);
2348	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2349
2350	switch (power) {
2351	case RTW_OFF:
2352		if (before_rf)
2353			return;
2354		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2355		anaparm |= RTW_ANAPARM_TXDACOFF;
2356		break;
2357	case RTW_SLEEP:
2358		if (!before_rf)
2359			return;
2360		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2361		anaparm |= RTW_ANAPARM_TXDACOFF;
2362		break;
2363	case RTW_ON:
2364		if (!before_rf)
2365			return;
2366		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2367		break;
2368	}
2369	RTW_DPRINTF(RTW_DEBUG_PWR,
2370	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2371	    __func__, rtw_pwrstate_string(power),
2372	    (before_rf) ? "before" : "after", anaparm));
2373
2374	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2375	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2376}
2377
2378/* XXX I am using the RFMD settings gleaned from the reference
2379 * driver.  They agree
2380 */
2381static void
2382rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2383    int before_rf, int digphy)
2384{
2385	uint32_t anaparm;
2386
2387	anaparm = RTW_READ(regs, RTW_ANAPARM);
2388	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2389
2390	switch (power) {
2391	case RTW_OFF:
2392		if (before_rf)
2393			return;
2394		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2395		anaparm |= RTW_ANAPARM_TXDACOFF;
2396		break;
2397	case RTW_SLEEP:
2398		if (!before_rf)
2399			return;
2400		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2401		anaparm |= RTW_ANAPARM_TXDACOFF;
2402		break;
2403	case RTW_ON:
2404		if (!before_rf)
2405			return;
2406		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2407		break;
2408	}
2409	RTW_DPRINTF(RTW_DEBUG_PWR,
2410	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2411	    __func__, rtw_pwrstate_string(power),
2412	    (before_rf) ? "before" : "after", anaparm));
2413
2414	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2415	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2416}
2417
2418static void
2419rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2420    int before_rf, int digphy)
2421{
2422	uint32_t anaparm;
2423
2424	anaparm = RTW_READ(regs, RTW_ANAPARM);
2425	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2426
2427	switch (power) {
2428	case RTW_OFF:
2429		if (before_rf)
2430			return;
2431		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2432		anaparm |= RTW_ANAPARM_TXDACOFF;
2433		break;
2434	case RTW_SLEEP:
2435		if (!before_rf)
2436			return;
2437		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2438		anaparm |= RTW_ANAPARM_TXDACOFF;
2439		break;
2440	case RTW_ON:
2441		if (!before_rf)
2442			return;
2443		if (digphy) {
2444			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2445			/* XXX guess */
2446			anaparm |= RTW_ANAPARM_TXDACOFF;
2447		} else
2448			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2449		break;
2450	}
2451	RTW_DPRINTF(RTW_DEBUG_PWR,
2452	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2453	    __func__, rtw_pwrstate_string(power),
2454	    (before_rf) ? "before" : "after", anaparm));
2455
2456	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2457	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2458}
2459
2460static void
2461rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2462    int digphy)
2463{
2464	struct rtw_regs *regs = &sc->sc_regs;
2465
2466	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2467
2468	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2469
2470	rtw_set_access(regs, RTW_ACCESS_NONE);
2471
2472	return;
2473}
2474
2475static int
2476rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2477{
2478	int rc;
2479
2480	RTW_DPRINTF(RTW_DEBUG_PWR,
2481	    ("%s: %s->%s\n", __func__,
2482	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2483
2484	if (sc->sc_pwrstate == power)
2485		return 0;
2486
2487	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2488	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2489	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2490
2491	switch (power) {
2492	case RTW_ON:
2493		/* TBD set LEDs */
2494		break;
2495	case RTW_SLEEP:
2496		/* TBD */
2497		break;
2498	case RTW_OFF:
2499		/* TBD */
2500		break;
2501	}
2502	if (rc == 0)
2503		sc->sc_pwrstate = power;
2504	else
2505		sc->sc_pwrstate = RTW_OFF;
2506	return rc;
2507}
2508
2509static int
2510rtw_tune(struct rtw_softc *sc)
2511{
2512	struct ieee80211com *ic = &sc->sc_ic;
2513	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2514	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2515	u_int chan;
2516	int rc;
2517	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2518	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2519
2520	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2521	KASSERT(chan != IEEE80211_CHAN_ANY);
2522
2523	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2524	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2525
2526	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2527	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2528
2529	if (chan == sc->sc_cur_chan) {
2530		RTW_DPRINTF(RTW_DEBUG_TUNE,
2531		    ("%s: already tuned chan #%d\n", __func__, chan));
2532		return 0;
2533	}
2534
2535	rtw_suspend_ticks(sc);
2536
2537	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2538
2539	/* TBD wait for Tx to complete */
2540
2541	KASSERT(device_has_power(sc->sc_dev));
2542
2543	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2544	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2545	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2546		/* XXX condition on powersaving */
2547		aprint_error_dev(sc->sc_dev, "phy init failed\n");
2548	}
2549
2550	sc->sc_cur_chan = chan;
2551
2552	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2553
2554	rtw_resume_ticks(sc);
2555
2556	return rc;
2557}
2558
2559bool
2560rtw_suspend(device_t self, const pmf_qual_t *qual)
2561{
2562	int rc;
2563	struct rtw_softc *sc = device_private(self);
2564
2565	sc->sc_flags &= ~RTW_F_DK_VALID;
2566
2567	if (!device_has_power(self))
2568		return false;
2569
2570	/* turn off PHY */
2571	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2572		aprint_error_dev(self, "failed to turn off PHY (%d)\n", rc);
2573		return false;
2574	}
2575
2576	rtw_disable_interrupts(&sc->sc_regs);
2577
2578	return true;
2579}
2580
2581bool
2582rtw_resume(device_t self, const pmf_qual_t *qual)
2583{
2584	struct rtw_softc *sc = device_private(self);
2585
2586	/* Power may have been removed, resetting WEP keys.
2587	 */
2588	sc->sc_flags &= ~RTW_F_DK_VALID;
2589	rtw_enable_interrupts(sc);
2590
2591	return true;
2592}
2593
2594static void
2595rtw_transmit_config(struct rtw_regs *regs)
2596{
2597	uint32_t tcr;
2598
2599	tcr = RTW_READ(regs, RTW_TCR);
2600
2601	tcr |= RTW_TCR_CWMIN;
2602	tcr &= ~RTW_TCR_MXDMA_MASK;
2603	tcr |= RTW_TCR_MXDMA_256;
2604	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2605	tcr &= ~RTW_TCR_LBK_MASK;
2606	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2607
2608	/* set short/long retry limits */
2609	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2610	tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2611
2612	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2613
2614	RTW_WRITE(regs, RTW_TCR, tcr);
2615	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2616}
2617
2618static void
2619rtw_disable_interrupts(struct rtw_regs *regs)
2620{
2621	RTW_WRITE16(regs, RTW_IMR, 0);
2622	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2623	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2624	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2625}
2626
2627static void
2628rtw_enable_interrupts(struct rtw_softc *sc)
2629{
2630	struct rtw_regs *regs = &sc->sc_regs;
2631
2632	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2633	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2634
2635	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2636	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2637	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2638	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2639
2640	/* XXX necessary? */
2641	if (sc->sc_intr_ack != NULL)
2642		(*sc->sc_intr_ack)(regs);
2643}
2644
2645static void
2646rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2647{
2648	uint8_t msr;
2649
2650	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2651	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2652
2653	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2654
2655	switch (opmode) {
2656	case IEEE80211_M_AHDEMO:
2657	case IEEE80211_M_IBSS:
2658		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2659		break;
2660	case IEEE80211_M_HOSTAP:
2661		msr |= RTW_MSR_NETYPE_AP_OK;
2662		break;
2663	case IEEE80211_M_MONITOR:
2664		/* XXX */
2665		msr |= RTW_MSR_NETYPE_NOLINK;
2666		break;
2667	case IEEE80211_M_STA:
2668		msr |= RTW_MSR_NETYPE_INFRA_OK;
2669		break;
2670	}
2671	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2672
2673	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2674}
2675
2676#define	rtw_calchash(addr) \
2677	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2678
2679static void
2680rtw_pktfilt_load(struct rtw_softc *sc)
2681{
2682	struct rtw_regs *regs = &sc->sc_regs;
2683	struct ieee80211com *ic = &sc->sc_ic;
2684	struct ethercom *ec = &sc->sc_ec;
2685	struct ifnet *ifp = &sc->sc_if;
2686	int hash;
2687	uint32_t hashes[2] = { 0, 0 };
2688	struct ether_multi *enm;
2689	struct ether_multistep step;
2690
2691	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2692
2693	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2694	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2695
2696	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2697	/* MAC auto-reset PHY (huh?) */
2698	sc->sc_rcr |= RTW_RCR_ENMARP;
2699	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2700	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2701
2702	switch (ic->ic_opmode) {
2703	case IEEE80211_M_MONITOR:
2704		sc->sc_rcr |= RTW_RCR_MONITOR;
2705		break;
2706	case IEEE80211_M_AHDEMO:
2707	case IEEE80211_M_IBSS:
2708		/* receive broadcasts in our BSS */
2709		sc->sc_rcr |= RTW_RCR_ADD3;
2710		break;
2711	default:
2712		break;
2713	}
2714
2715	ifp->if_flags &= ~IFF_ALLMULTI;
2716
2717	/*
2718	 * Program the 64-bit multicast hash filter.
2719	 */
2720	ETHER_FIRST_MULTI(step, ec, enm);
2721	while (enm != NULL) {
2722		/* XXX */
2723		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2724		    ETHER_ADDR_LEN) != 0) {
2725			ifp->if_flags |= IFF_ALLMULTI;
2726			break;
2727		}
2728
2729		hash = rtw_calchash(enm->enm_addrlo);
2730		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2731		ETHER_NEXT_MULTI(step, enm);
2732	}
2733
2734	/* XXX accept all broadcast if scanning */
2735	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2736		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2737
2738	if (ifp->if_flags & IFF_PROMISC) {
2739		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2740		sc->sc_rcr |= RTW_RCR_ACRC32;	/* accept frames failing CRC */
2741		sc->sc_rcr |= RTW_RCR_AICV;	/* accept frames failing ICV */
2742		ifp->if_flags |= IFF_ALLMULTI;
2743	}
2744
2745	if (ifp->if_flags & IFF_ALLMULTI)
2746		hashes[0] = hashes[1] = 0xffffffff;
2747
2748	if ((hashes[0] | hashes[1]) != 0)
2749		sc->sc_rcr |= RTW_RCR_AM;	/* accept multicast */
2750
2751	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2752	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2753	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2754	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2755
2756	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2757	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2758	    device_xname(sc->sc_dev), RTW_READ(regs, RTW_MAR0),
2759	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2760}
2761
2762static struct mbuf *
2763rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2764{
2765	struct ieee80211com *ic = &sc->sc_ic;
2766	struct mbuf *m;
2767	struct ieee80211_beacon_offsets	boff;
2768
2769	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2770		RTW_DPRINTF(RTW_DEBUG_BEACON,
2771		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2772	}
2773	return m;
2774}
2775
2776/* Must be called at splnet. */
2777static int
2778rtw_init(struct ifnet *ifp)
2779{
2780	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2781	struct ieee80211com *ic = &sc->sc_ic;
2782	struct rtw_regs *regs = &sc->sc_regs;
2783	int rc;
2784
2785	if (device_is_active(sc->sc_dev)) {
2786		/* Cancel pending I/O and reset. */
2787		rtw_stop(ifp, 0);
2788	} else if (!pmf_device_resume(sc->sc_dev, &sc->sc_qual) ||
2789	           !device_is_active(sc->sc_dev))
2790		return 0;
2791
2792	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2793	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2794	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2795
2796	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2797		goto out;
2798
2799	if ((rc = rtw_swring_setup(sc)) != 0)
2800		goto out;
2801
2802	rtw_transmit_config(regs);
2803
2804	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2805
2806	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2807	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2808
2809	/* long PLCP header, 1Mb/2Mb basic rate */
2810	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2811	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2812
2813	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2814	rtw_set_access(regs, RTW_ACCESS_NONE);
2815
2816	/* XXX from reference sources */
2817	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2818	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2819
2820	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev);
2821
2822	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2823	/* from Linux driver */
2824	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2825
2826	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2827
2828	rtw_enable_interrupts(sc);
2829
2830	rtw_pktfilt_load(sc);
2831
2832	rtw_hwring_setup(sc);
2833
2834	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2835
2836	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2837
2838	ifp->if_flags |= IFF_RUNNING;
2839	ic->ic_state = IEEE80211_S_INIT;
2840
2841	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2842	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2843
2844	rtw_resume_ticks(sc);
2845
2846	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2847
2848	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2849		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2850	else
2851		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2852
2853out:
2854	aprint_error_dev(sc->sc_dev, "interface not running\n");
2855	return rc;
2856}
2857
2858static inline void
2859rtw_led_init(struct rtw_regs *regs)
2860{
2861	uint8_t cfg0, cfg1;
2862
2863	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2864
2865	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2866	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2867	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2868
2869	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2870	RTW_DPRINTF(RTW_DEBUG_LED,
2871	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2872
2873	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2874	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2875	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2876
2877	rtw_set_access(regs, RTW_ACCESS_NONE);
2878}
2879
2880/*
2881 * IEEE80211_S_INIT: 		LED1 off
2882 *
2883 * IEEE80211_S_AUTH,
2884 * IEEE80211_S_ASSOC,
2885 * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2886 *
2887 * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2888 */
2889static void
2890rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2891{
2892	struct rtw_led_state *ls;
2893
2894	ls = &sc->sc_led_state;
2895
2896	switch (nstate) {
2897	case IEEE80211_S_INIT:
2898		rtw_led_init(&sc->sc_regs);
2899		aprint_debug_dev(sc->sc_dev, "stopping blink\n");
2900		callout_stop(&ls->ls_slow_ch);
2901		callout_stop(&ls->ls_fast_ch);
2902		ls->ls_slowblink = 0;
2903		ls->ls_actblink = 0;
2904		ls->ls_default = 0;
2905		break;
2906	case IEEE80211_S_SCAN:
2907		aprint_debug_dev(sc->sc_dev, "scheduling blink\n");
2908		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2909		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2910		/*FALLTHROUGH*/
2911	case IEEE80211_S_AUTH:
2912	case IEEE80211_S_ASSOC:
2913		ls->ls_default = RTW_LED1;
2914		ls->ls_actblink = RTW_LED1;
2915		ls->ls_slowblink = RTW_LED1;
2916		break;
2917	case IEEE80211_S_RUN:
2918		ls->ls_slowblink = 0;
2919		break;
2920	}
2921	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2922}
2923
2924static void
2925rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2926{
2927	uint8_t led_condition;
2928	bus_size_t ofs;
2929	uint8_t mask, newval, val;
2930
2931	led_condition = ls->ls_default;
2932
2933	if (ls->ls_state & RTW_LED_S_SLOW)
2934		led_condition ^= ls->ls_slowblink;
2935	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2936		led_condition ^= ls->ls_actblink;
2937
2938	RTW_DPRINTF(RTW_DEBUG_LED,
2939	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2940
2941	switch (hwverid) {
2942	default:
2943	case 'F':
2944		ofs = RTW_PSR;
2945		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2946		if (led_condition & RTW_LED0)
2947			newval &= ~RTW_PSR_LEDGPO0;
2948		if (led_condition & RTW_LED1)
2949			newval &= ~RTW_PSR_LEDGPO1;
2950		break;
2951	case 'D':
2952		ofs = RTW_9346CR;
2953		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2954		newval = RTW_9346CR_EEM_PROGRAM;
2955		if (led_condition & RTW_LED0)
2956			newval |= RTW_9346CR_EEDI;
2957		if (led_condition & RTW_LED1)
2958			newval |= RTW_9346CR_EECS;
2959		break;
2960	}
2961	val = RTW_READ8(regs, ofs);
2962	RTW_DPRINTF(RTW_DEBUG_LED,
2963	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2964	     (uintptr_t)ofs));
2965	val &= ~mask;
2966	val |= newval;
2967	RTW_WRITE8(regs, ofs, val);
2968	RTW_DPRINTF(RTW_DEBUG_LED,
2969	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2970	     (uintptr_t)ofs));
2971	RTW_SYNC(regs, ofs, ofs);
2972}
2973
2974static void
2975rtw_led_fastblink(void *arg)
2976{
2977	int ostate, s;
2978	struct rtw_softc *sc = (struct rtw_softc *)arg;
2979	struct rtw_led_state *ls = &sc->sc_led_state;
2980
2981	s = splnet();
2982	ostate = ls->ls_state;
2983	ls->ls_state ^= ls->ls_event;
2984
2985	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2986		ls->ls_state &= ~RTW_LED_S_TX;
2987
2988	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2989		ls->ls_state &= ~RTW_LED_S_RX;
2990
2991	ls->ls_event = 0;
2992
2993	if (ostate != ls->ls_state)
2994		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2995	splx(s);
2996
2997	aprint_debug_dev(sc->sc_dev, "scheduling fast blink\n");
2998	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2999}
3000
3001static void
3002rtw_led_slowblink(void *arg)
3003{
3004	int s;
3005	struct rtw_softc *sc = (struct rtw_softc *)arg;
3006	struct rtw_led_state *ls = &sc->sc_led_state;
3007
3008	s = splnet();
3009	ls->ls_state ^= RTW_LED_S_SLOW;
3010	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
3011	splx(s);
3012	aprint_debug_dev(sc->sc_dev, "scheduling slow blink\n");
3013	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
3014}
3015
3016static void
3017rtw_led_detach(struct rtw_led_state *ls)
3018{
3019	callout_destroy(&ls->ls_fast_ch);
3020	callout_destroy(&ls->ls_slow_ch);
3021}
3022
3023static void
3024rtw_led_attach(struct rtw_led_state *ls, void *arg)
3025{
3026	callout_init(&ls->ls_fast_ch, 0);
3027	callout_init(&ls->ls_slow_ch, 0);
3028	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
3029	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
3030}
3031
3032static int
3033rtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
3034{
3035	int rc = 0, s;
3036	struct rtw_softc *sc = ifp->if_softc;
3037
3038	s = splnet();
3039	if (cmd == SIOCSIFFLAGS) {
3040		if ((rc = ifioctl_common(ifp, cmd, data)) != 0)
3041			;
3042		else switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
3043		case IFF_UP:
3044			rc = rtw_init(ifp);
3045			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3046			break;
3047		case IFF_UP|IFF_RUNNING:
3048			if (device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
3049				rtw_pktfilt_load(sc);
3050			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3051			break;
3052		case IFF_RUNNING:
3053			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3054			rtw_stop(ifp, 1);
3055			break;
3056		default:
3057			break;
3058		}
3059	} else if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
3060		;	/* nothing to do */
3061	else if (cmd == SIOCADDMULTI || cmd == SIOCDELMULTI) {
3062		/* reload packet filter if running */
3063		if (ifp->if_flags & IFF_RUNNING)
3064			rtw_pktfilt_load(sc);
3065		rc = 0;
3066	} else if ((ifp->if_flags & IFF_UP) != 0)
3067		rc = rtw_init(ifp);
3068	else
3069		rc = 0;
3070	splx(s);
3071	return rc;
3072}
3073
3074/* Select a transmit ring with at least one h/w and s/w descriptor free.
3075 * Return 0 on success, -1 on failure.
3076 */
3077static inline int
3078rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
3079    struct rtw_txdesc_blk **tdbp, int pri)
3080{
3081	struct rtw_txsoft_blk *tsb;
3082	struct rtw_txdesc_blk *tdb;
3083
3084	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
3085
3086	tsb = &sc->sc_txsoft_blk[pri];
3087	tdb = &sc->sc_txdesc_blk[pri];
3088
3089	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
3090		if (tsb->tsb_tx_timer == 0)
3091			tsb->tsb_tx_timer = 5;
3092		*tsbp = NULL;
3093		*tdbp = NULL;
3094		return -1;
3095	}
3096	*tsbp = tsb;
3097	*tdbp = tdb;
3098	return 0;
3099}
3100
3101static inline struct mbuf *
3102rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3103    struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3104    struct ieee80211_node **nip, short *if_flagsp)
3105{
3106	struct mbuf *m;
3107
3108	if (IF_IS_EMPTY(ifq))
3109		return NULL;
3110	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3111		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3112		    __func__, pri));
3113		*if_flagsp |= IFF_OACTIVE;
3114		sc->sc_if.if_timer = 1;
3115		return NULL;
3116	}
3117	IF_DEQUEUE(ifq, m);
3118	*nip = M_GETCTX(m, struct ieee80211_node *);
3119	M_SETCTX(m, NULL);
3120	KASSERT(*nip != NULL);
3121	return m;
3122}
3123
3124/* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3125 * at the driver's selection of transmit control block for the packet.
3126 */
3127static inline int
3128rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3129    struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3130    struct ieee80211_node **nip)
3131{
3132	int pri;
3133	struct ether_header *eh;
3134	struct mbuf *m0;
3135	struct rtw_softc *sc;
3136	short *if_flagsp;
3137
3138	*mp = NULL;
3139
3140	sc = (struct rtw_softc *)ifp->if_softc;
3141
3142	DPRINTF(sc, RTW_DEBUG_XMIT,
3143	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3144
3145	if_flagsp = &ifp->if_flags;
3146
3147	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3148	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3149		                     tdbp, nip, if_flagsp)) != NULL) {
3150		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3151		    __func__));
3152		return 0;
3153	}
3154
3155	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3156		                     tdbp, nip, if_flagsp)) != NULL) {
3157		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3158		    __func__));
3159		return 0;
3160	}
3161
3162	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3163		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3164		return 0;
3165	}
3166
3167	IFQ_POLL(&ifp->if_snd, m0);
3168	if (m0 == NULL) {
3169		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3170		    __func__));
3171		return 0;
3172	}
3173
3174	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3175
3176	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3177		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3178		    __func__, pri));
3179		*if_flagsp |= IFF_OACTIVE;
3180		sc->sc_if.if_timer = 1;
3181		return 0;
3182	}
3183
3184	IFQ_DEQUEUE(&ifp->if_snd, m0);
3185	if (m0 == NULL) {
3186		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3187		    __func__));
3188		return 0;
3189	}
3190	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3191	ifp->if_opackets++;
3192	bpf_mtap(ifp, m0);
3193	eh = mtod(m0, struct ether_header *);
3194	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3195	if (*nip == NULL) {
3196		/* NB: ieee80211_find_txnode does stat+msg */
3197		m_freem(m0);
3198		return -1;
3199	}
3200	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3201		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3202		ifp->if_oerrors++;
3203		return -1;
3204	}
3205	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3206	*mp = m0;
3207	return 0;
3208}
3209
3210static int
3211rtw_seg_too_short(bus_dmamap_t dmamap)
3212{
3213	int i;
3214	for (i = 0; i < dmamap->dm_nsegs; i++) {
3215		if (dmamap->dm_segs[i].ds_len < 4)
3216			return 1;
3217	}
3218	return 0;
3219}
3220
3221/* TBD factor with atw_start */
3222static struct mbuf *
3223rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3224    u_int ndescfree, device_t dev)
3225{
3226	int first, rc;
3227	struct mbuf *m, *m0;
3228
3229	m0 = chain;
3230
3231	/*
3232	 * Load the DMA map.  Copy and try (once) again if the packet
3233	 * didn't fit in the alloted number of segments.
3234	 */
3235	for (first = 1;
3236	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3237			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3238	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3239	     first = 0) {
3240		if (rc == 0) {
3241#ifdef RTW_DIAGxxx
3242			if (rtw_seg_too_short(dmam)) {
3243				printf("%s: short segment, mbuf lengths:", __func__);
3244				for (m = m0; m; m = m->m_next)
3245					printf(" %d", m->m_len);
3246				printf("\n");
3247			}
3248#endif
3249			bus_dmamap_unload(dmat, dmam);
3250		}
3251		MGETHDR(m, M_DONTWAIT, MT_DATA);
3252		if (m == NULL) {
3253			aprint_error_dev(dev, "unable to allocate Tx mbuf\n");
3254			break;
3255		}
3256		if (m0->m_pkthdr.len > MHLEN) {
3257			MCLGET(m, M_DONTWAIT);
3258			if ((m->m_flags & M_EXT) == 0) {
3259				aprint_error_dev(dev,
3260				    "cannot allocate Tx cluster\n");
3261				m_freem(m);
3262				break;
3263			}
3264		}
3265		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3266		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3267		m_freem(m0);
3268		m0 = m;
3269		m = NULL;
3270	}
3271	if (rc != 0) {
3272		aprint_error_dev(dev, "cannot load Tx buffer, rc = %d\n", rc);
3273		m_freem(m0);
3274		return NULL;
3275	} else if (rtw_seg_too_short(dmam)) {
3276		aprint_error_dev(dev,
3277		    "cannot load Tx buffer, segment too short\n");
3278		bus_dmamap_unload(dmat, dmam);
3279		m_freem(m0);
3280		return NULL;
3281	} else if (dmam->dm_nsegs > ndescfree) {
3282		aprint_error_dev(dev, "too many tx segments\n");
3283		bus_dmamap_unload(dmat, dmam);
3284		m_freem(m0);
3285		return NULL;
3286	}
3287	return m0;
3288}
3289
3290#ifdef RTW_DEBUG
3291static void
3292rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3293    struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3294{
3295	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3296	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3297	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3298	    device_xname(sc->sc_dev), ts, action, desc,
3299	    le32toh(td->td_buf), le32toh(td->td_next),
3300	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3301	    le32toh(td->td_len)));
3302}
3303#endif /* RTW_DEBUG */
3304
3305static void
3306rtw_start(struct ifnet *ifp)
3307{
3308	int desc, i, lastdesc, npkt, rate;
3309	uint32_t proto_ctl0, ctl0, ctl1;
3310	bus_dmamap_t		dmamap;
3311	struct ieee80211com	*ic;
3312	struct ieee80211_duration *d0;
3313	struct ieee80211_frame_min	*wh;
3314	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3315	struct mbuf		*m0;
3316	struct rtw_softc	*sc;
3317	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3318	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3319	struct rtw_txsoft	*ts;
3320	struct rtw_txdesc	*td;
3321	struct ieee80211_key	*k;
3322
3323	sc = (struct rtw_softc *)ifp->if_softc;
3324	ic = &sc->sc_ic;
3325
3326	DPRINTF(sc, RTW_DEBUG_XMIT,
3327	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3328
3329	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3330		goto out;
3331
3332	/* XXX do real rate control */
3333	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3334
3335	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3336		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3337
3338	for (;;) {
3339		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3340			continue;
3341		if (m0 == NULL)
3342			break;
3343
3344		wh = mtod(m0, struct ieee80211_frame_min *);
3345
3346		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3347		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3348			m_freem(m0);
3349			break;
3350		} else
3351			k = NULL;
3352
3353		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3354
3355		dmamap = ts->ts_dmamap;
3356
3357		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3358		    tdb->tdb_nfree, sc->sc_dev);
3359
3360		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3361			DPRINTF(sc, RTW_DEBUG_XMIT,
3362			    ("%s: fail dmamap load\n", __func__));
3363			goto post_dequeue_err;
3364		}
3365
3366		/* Note well: rtw_dmamap_load_txbuf may have created
3367		 * a new chain, so we must find the header once
3368		 * more.
3369		 */
3370		wh = mtod(m0, struct ieee80211_frame_min *);
3371
3372		/* XXX do real rate control */
3373		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3374		    IEEE80211_FC0_TYPE_MGT)
3375			rate = 2;
3376		else
3377			rate = MAX(2, ieee80211_get_rate(ni));
3378
3379#ifdef RTW_DEBUG
3380		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3381		    (IFF_DEBUG|IFF_LINK2)) {
3382			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3383			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3384			                            : sizeof(wh),
3385			    rate, 0);
3386		}
3387#endif /* RTW_DEBUG */
3388		ctl0 = proto_ctl0 |
3389		    __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3390
3391		switch (rate) {
3392		default:
3393		case 2:
3394			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3395			break;
3396		case 4:
3397			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3398			break;
3399		case 11:
3400			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3401			break;
3402		case 22:
3403			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3404			break;
3405		}
3406		/* XXX >= ? Compare after fragmentation? */
3407		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3408			ctl0 |= RTW_TXCTL0_RTSEN;
3409
3410                /* XXX Sometimes writes a bogus keyid; h/w doesn't
3411                 * seem to care, since we don't activate h/w Tx
3412                 * encryption.
3413		 */
3414		if (k != NULL &&
3415		    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
3416			ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3417			    RTW_TXCTL0_KEYID_MASK;
3418		}
3419
3420		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3421		    IEEE80211_FC0_TYPE_MGT) {
3422			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3423			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3424			    IEEE80211_FC0_SUBTYPE_BEACON)
3425				ctl0 |= RTW_TXCTL0_BEACON;
3426		}
3427
3428		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3429		    ic->ic_flags, ic->ic_fragthreshold,
3430		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3431		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3432		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3433			DPRINTF(sc, RTW_DEBUG_XMIT,
3434			    ("%s: fail compute duration\n", __func__));
3435			goto post_load_err;
3436		}
3437
3438		d0 = &ts->ts_d0;
3439
3440		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3441
3442		ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3443		    __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3444
3445		if (d0->d_residue)
3446			ctl1 |= RTW_TXCTL1_LENGEXT;
3447
3448		/* TBD fragmentation */
3449
3450		ts->ts_first = tdb->tdb_next;
3451
3452		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3453		    BUS_DMASYNC_PREWRITE);
3454
3455		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3456
3457		bpf_mtap3(ic->ic_rawbpf, m0);
3458
3459		if (sc->sc_radiobpf != NULL) {
3460			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3461
3462			rt->rt_rate = rate;
3463
3464			bpf_mtap2(sc->sc_radiobpf, rt, sizeof(sc->sc_txtapu),
3465			    m0);
3466		}
3467
3468		for (i = 0, lastdesc = desc = ts->ts_first;
3469		     i < dmamap->dm_nsegs;
3470		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3471			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3472				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3473				    ("%s: seg too long\n", __func__));
3474				goto post_load_err;
3475			}
3476			td = &tdb->tdb_desc[desc];
3477			td->td_ctl0 = htole32(ctl0);
3478			td->td_ctl1 = htole32(ctl1);
3479			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3480			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3481			td->td_next = htole32(RTW_NEXT_DESC(tdb, desc));
3482			if (i != 0)
3483				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3484			lastdesc = desc;
3485#ifdef RTW_DEBUG
3486			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3487#endif /* RTW_DEBUG */
3488		}
3489
3490		KASSERT(desc < tdb->tdb_ndesc);
3491
3492		ts->ts_ni = ni;
3493		KASSERT(ni != NULL);
3494		ts->ts_mbuf = m0;
3495		ts->ts_last = lastdesc;
3496		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3497		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3498		   htole32(RTW_TXCTL0_FS);
3499
3500#ifdef RTW_DEBUG
3501		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3502		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3503#endif /* RTW_DEBUG */
3504
3505		tdb->tdb_nfree -= dmamap->dm_nsegs;
3506		tdb->tdb_next = desc;
3507
3508		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3509		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3510
3511		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3512		    htole32(RTW_TXCTL0_OWN);
3513
3514#ifdef RTW_DEBUG
3515		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3516#endif /* RTW_DEBUG */
3517
3518		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3519		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3520
3521		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3522		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3523
3524		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3525			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3526		tsb->tsb_tx_timer = 5;
3527		ifp->if_timer = 1;
3528		rtw_tx_kick(&sc->sc_regs, tsb->tsb_poll);
3529	}
3530out:
3531	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3532	return;
3533post_load_err:
3534	bus_dmamap_unload(sc->sc_dmat, dmamap);
3535	m_freem(m0);
3536post_dequeue_err:
3537	ieee80211_free_node(ni);
3538	return;
3539}
3540
3541static void
3542rtw_idle(struct rtw_regs *regs)
3543{
3544	int active;
3545	uint8_t tppoll;
3546
3547	/* request stop DMA; wait for packets to stop transmitting. */
3548
3549	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3550	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3551
3552	for (active = 0; active < 300 &&
3553	     (tppoll = RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0;
3554	     active++)
3555		DELAY(10);
3556	printf("%s: transmit DMA idle in %dus, tppoll %02" PRIx8 "\n", __func__,
3557	    active * 10, tppoll);
3558}
3559
3560static void
3561rtw_watchdog(struct ifnet *ifp)
3562{
3563	int pri, tx_timeouts = 0;
3564	struct rtw_softc *sc;
3565	struct rtw_txsoft_blk *tsb;
3566
3567	sc = ifp->if_softc;
3568
3569	ifp->if_timer = 0;
3570
3571	if (!device_is_active(sc->sc_dev))
3572		return;
3573
3574	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3575		tsb = &sc->sc_txsoft_blk[pri];
3576
3577		if (tsb->tsb_tx_timer == 0)
3578			continue;
3579		else if (--tsb->tsb_tx_timer == 0) {
3580			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3581				continue;
3582			else if (rtw_collect_txring(sc, tsb,
3583			    &sc->sc_txdesc_blk[pri], 0))
3584				continue;
3585			printf("%s: transmit timeout, priority %d\n",
3586			    ifp->if_xname, pri);
3587			ifp->if_oerrors++;
3588			if (pri != RTW_TXPRIBCN)
3589				tx_timeouts++;
3590		} else
3591			ifp->if_timer = 1;
3592	}
3593
3594	if (tx_timeouts > 0) {
3595		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3596		 * reset s/w tx-ring pointers, and start transmission.
3597		 *
3598		 * TBD Stop/restart just the broken rings?
3599		 */
3600		rtw_idle(&sc->sc_regs);
3601		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
3602		rtw_txdescs_reset(sc);
3603		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3604		rtw_start(ifp);
3605	}
3606	ieee80211_watchdog(&sc->sc_ic);
3607	return;
3608}
3609
3610static void
3611rtw_next_scan(void *arg)
3612{
3613	struct ieee80211com *ic = arg;
3614	int s;
3615
3616	/* don't call rtw_start w/o network interrupts blocked */
3617	s = splnet();
3618	if (ic->ic_state == IEEE80211_S_SCAN)
3619		ieee80211_next_scan(ic);
3620	splx(s);
3621}
3622
3623static void
3624rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3625{
3626	uint16_t bcnitv, bintritv, intval;
3627	int i;
3628	struct rtw_regs *regs = &sc->sc_regs;
3629
3630	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3631		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3632
3633	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3634
3635	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3636
3637	intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3638
3639	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3640	bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3641	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3642	/* interrupt host 1ms before the TBTT */
3643	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3644	bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3645	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3646	/* magic from Linux */
3647	RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3648	RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3649	rtw_set_access(regs, RTW_ACCESS_NONE);
3650
3651	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3652}
3653
3654/* Synchronize the hardware state with the software state. */
3655static int
3656rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3657{
3658	struct ifnet *ifp = ic->ic_ifp;
3659	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3660	enum ieee80211_state ostate;
3661	int error;
3662
3663	ostate = ic->ic_state;
3664
3665	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3666	rtw_led_newstate(sc, nstate);
3667
3668	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3669	if (nstate == IEEE80211_S_INIT) {
3670		callout_stop(&sc->sc_scan_ch);
3671		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3672		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3673	}
3674
3675	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3676		rtw_pwrstate(sc, RTW_ON);
3677
3678	if ((error = rtw_tune(sc)) != 0)
3679		return error;
3680
3681	switch (nstate) {
3682	case IEEE80211_S_INIT:
3683		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3684		break;
3685	case IEEE80211_S_SCAN:
3686		if (ostate != IEEE80211_S_SCAN) {
3687			(void)memset(ic->ic_bss->ni_bssid, 0,
3688			    IEEE80211_ADDR_LEN);
3689			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3690		}
3691
3692		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3693		    rtw_next_scan, ic);
3694
3695		break;
3696	case IEEE80211_S_RUN:
3697		switch (ic->ic_opmode) {
3698		case IEEE80211_M_HOSTAP:
3699		case IEEE80211_M_IBSS:
3700			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3701			/*FALLTHROUGH*/
3702		case IEEE80211_M_AHDEMO:
3703		case IEEE80211_M_STA:
3704			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3705			    ic->ic_bss->ni_intval);
3706			break;
3707		case IEEE80211_M_MONITOR:
3708			break;
3709		}
3710		rtw_set_nettype(sc, ic->ic_opmode);
3711		break;
3712	case IEEE80211_S_ASSOC:
3713	case IEEE80211_S_AUTH:
3714		break;
3715	}
3716
3717	if (nstate != IEEE80211_S_SCAN)
3718		callout_stop(&sc->sc_scan_ch);
3719
3720	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3721}
3722
3723/* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3724static uint64_t
3725rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3726{
3727	uint32_t tsftl, tsfth;
3728
3729	tsfth = RTW_READ(regs, RTW_TSFTRH);
3730	tsftl = RTW_READ(regs, RTW_TSFTRL);
3731	if (tsftl < rstamp)	/* Compensate for rollover. */
3732		tsfth--;
3733	return ((uint64_t)tsfth << 32) | rstamp;
3734}
3735
3736static void
3737rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3738    struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3739{
3740	struct ifnet *ifp = ic->ic_ifp;
3741	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3742
3743	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3744
3745	switch (subtype) {
3746	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3747	case IEEE80211_FC0_SUBTYPE_BEACON:
3748		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3749		    ic->ic_state == IEEE80211_S_RUN &&
3750		    device_is_active(sc->sc_dev)) {
3751			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3752			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3753				(void)ieee80211_ibss_merge(ni);
3754		}
3755		break;
3756	default:
3757		break;
3758	}
3759	return;
3760}
3761
3762static struct ieee80211_node *
3763rtw_node_alloc(struct ieee80211_node_table *nt)
3764{
3765	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3766	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3767	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3768
3769	DPRINTF(sc, RTW_DEBUG_NODE,
3770	    ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
3771	return ni;
3772}
3773
3774static void
3775rtw_node_free(struct ieee80211_node *ni)
3776{
3777	struct ieee80211com *ic = ni->ni_ic;
3778	struct ifnet *ifp = ic->ic_ifp;
3779	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3780
3781	DPRINTF(sc, RTW_DEBUG_NODE,
3782	    ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
3783	    ether_sprintf(ni->ni_bssid)));
3784	(*sc->sc_mtbl.mt_node_free)(ni);
3785}
3786
3787static int
3788rtw_media_change(struct ifnet *ifp)
3789{
3790	int error;
3791
3792	error = ieee80211_media_change(ifp);
3793	if (error == ENETRESET) {
3794		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3795		    (IFF_RUNNING|IFF_UP))
3796			rtw_init(ifp);		/* XXX lose error */
3797		error = 0;
3798	}
3799	return error;
3800}
3801
3802static void
3803rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3804{
3805	struct rtw_softc *sc = ifp->if_softc;
3806
3807	if (!device_is_active(sc->sc_dev)) {
3808		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3809		imr->ifm_status = 0;
3810		return;
3811	}
3812	ieee80211_media_status(ifp, imr);
3813}
3814
3815static inline void
3816rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3817{
3818	(void)strlcpy(ifp->if_xname, dvname, IFNAMSIZ);
3819	ifp->if_softc = softc;
3820	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3821	    IFF_NOTRAILERS;
3822	ifp->if_ioctl = rtw_ioctl;
3823	ifp->if_start = rtw_start;
3824	ifp->if_watchdog = rtw_watchdog;
3825	ifp->if_init = rtw_init;
3826	ifp->if_stop = rtw_stop;
3827}
3828
3829static inline void
3830rtw_set80211props(struct ieee80211com *ic)
3831{
3832	int nrate;
3833	ic->ic_phytype = IEEE80211_T_DS;
3834	ic->ic_opmode = IEEE80211_M_STA;
3835	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3836	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
3837
3838	nrate = 0;
3839	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3840	    IEEE80211_RATE_BASIC | 2;
3841	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3842	    IEEE80211_RATE_BASIC | 4;
3843	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3844	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3845	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3846}
3847
3848static inline void
3849rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3850{
3851	mtbl->mt_newstate = ic->ic_newstate;
3852	ic->ic_newstate = rtw_newstate;
3853
3854	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3855	ic->ic_recv_mgmt = rtw_recv_mgmt;
3856
3857	mtbl->mt_node_free = ic->ic_node_free;
3858	ic->ic_node_free = rtw_node_free;
3859
3860	mtbl->mt_node_alloc = ic->ic_node_alloc;
3861	ic->ic_node_alloc = rtw_node_alloc;
3862
3863	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3864	ic->ic_crypto.cs_key_set = rtw_key_set;
3865	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3866	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3867}
3868
3869static inline void
3870rtw_init_radiotap(struct rtw_softc *sc)
3871{
3872	uint32_t present;
3873
3874	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3875	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3876
3877	if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
3878		present = htole32(RTW_PHILIPS_RX_RADIOTAP_PRESENT);
3879	else
3880		present = htole32(RTW_RX_RADIOTAP_PRESENT);
3881	sc->sc_rxtap.rr_ihdr.it_present = present;
3882
3883	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3884	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3885	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3886}
3887
3888static int
3889rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3890{
3891	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3892	SIMPLEQ_INIT(&tsb->tsb_freeq);
3893	tsb->tsb_ndesc = qlen;
3894	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3895	    M_NOWAIT);
3896	if (tsb->tsb_desc == NULL)
3897		return ENOMEM;
3898	return 0;
3899}
3900
3901static void
3902rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3903{
3904	int pri;
3905	struct rtw_txsoft_blk *tsb;
3906
3907	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3908		tsb = &sc->sc_txsoft_blk[pri];
3909		free(tsb->tsb_desc, M_DEVBUF);
3910		tsb->tsb_desc = NULL;
3911	}
3912}
3913
3914static int
3915rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3916{
3917	int pri, rc = 0;
3918	int qlen[RTW_NTXPRI] =
3919	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3920	struct rtw_txsoft_blk *tsbs;
3921
3922	tsbs = sc->sc_txsoft_blk;
3923
3924	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3925		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3926		if (rc != 0)
3927			break;
3928	}
3929	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3930	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3931	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3932	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3933	return rc;
3934}
3935
3936static void
3937rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3938    u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3939{
3940	tdb->tdb_ndesc = ndesc;
3941	tdb->tdb_desc = desc;
3942	tdb->tdb_physbase = physbase;
3943	tdb->tdb_ofs = ofs;
3944
3945	(void)memset(tdb->tdb_desc, 0,
3946	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3947
3948	rtw_txdesc_blk_init(tdb);
3949	tdb->tdb_next = 0;
3950}
3951
3952static void
3953rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3954{
3955	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3956	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3957	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3958
3959	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3960	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3961	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3962
3963	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3964	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3965	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3966
3967	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3968	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3969	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3970}
3971
3972static struct rtw_rf *
3973rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3974{
3975	rtw_rf_write_t rf_write;
3976	struct rtw_rf *rf;
3977
3978	switch (rfchipid) {
3979	default:
3980		rf_write = rtw_rf_hostwrite;
3981		break;
3982	case RTW_RFCHIPID_INTERSIL:
3983	case RTW_RFCHIPID_PHILIPS:
3984	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3985	case RTW_RFCHIPID_RFMD:
3986		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3987		break;
3988	}
3989
3990	switch (rfchipid) {
3991	case RTW_RFCHIPID_GCT:
3992		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3993		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3994		break;
3995	case RTW_RFCHIPID_MAXIM:
3996		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3997		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3998		break;
3999	case RTW_RFCHIPID_PHILIPS:
4000		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
4001		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
4002		break;
4003	case RTW_RFCHIPID_RFMD:
4004		/* XXX RFMD has no RF constructor */
4005		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
4006		/*FALLTHROUGH*/
4007	default:
4008		return NULL;
4009	}
4010	rf->rf_continuous_tx_cb =
4011	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
4012	rf->rf_continuous_tx_arg = (void *)sc;
4013	return rf;
4014}
4015
4016/* Revision C and later use a different PHY delay setting than
4017 * revisions A and B.
4018 */
4019static uint8_t
4020rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
4021{
4022#define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
4023#define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
4024
4025	uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
4026
4027	RTW_WRITE(regs, RTW_RCR, REVAB);
4028	RTW_WBW(regs, RTW_RCR, RTW_RCR);
4029	RTW_WRITE(regs, RTW_RCR, REVC);
4030
4031	RTW_WBR(regs, RTW_RCR, RTW_RCR);
4032	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
4033		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
4034
4035	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
4036	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
4037
4038	return phydelay;
4039#undef REVC
4040}
4041
4042void
4043rtw_attach(struct rtw_softc *sc)
4044{
4045	struct ifnet *ifp = &sc->sc_if;
4046	struct ieee80211com *ic = &sc->sc_ic;
4047	struct rtw_txsoft_blk *tsb;
4048	int pri, rc;
4049
4050	pmf_self_suspensor_init(sc->sc_dev, &sc->sc_suspensor, &sc->sc_qual);
4051
4052	rtw_cipher_wep = ieee80211_cipher_wep;
4053	rtw_cipher_wep.ic_decap = rtw_wep_decap;
4054
4055	NEXT_ATTACH_STATE(sc, DETACHED);
4056
4057	sc->sc_soft_ih = softint_establish(SOFTINT_NET, rtw_softintr, sc);
4058	if (sc->sc_soft_ih == NULL) {
4059		aprint_error_dev(sc->sc_dev, "could not establish softint\n");
4060		goto err;
4061	}
4062
4063	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
4064	case RTW_TCR_HWVERID_F:
4065		sc->sc_hwverid = 'F';
4066		break;
4067	case RTW_TCR_HWVERID_D:
4068		sc->sc_hwverid = 'D';
4069		break;
4070	default:
4071		sc->sc_hwverid = '?';
4072		break;
4073	}
4074	aprint_verbose_dev(sc->sc_dev, "hardware version %c\n",
4075	    sc->sc_hwverid);
4076
4077	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4078	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4079	    0);
4080
4081	if (rc != 0) {
4082		aprint_error_dev(sc->sc_dev,
4083		    "could not allocate hw descriptors, error %d\n", rc);
4084		goto err;
4085	}
4086
4087	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4088
4089	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4090	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4091	    (void **)&sc->sc_descs, BUS_DMA_COHERENT);
4092
4093	if (rc != 0) {
4094		aprint_error_dev(sc->sc_dev,
4095		    "could not map hw descriptors, error %d\n", rc);
4096		goto err;
4097	}
4098	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4099
4100	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4101	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4102
4103	if (rc != 0) {
4104		aprint_error_dev(sc->sc_dev,
4105		    "could not create DMA map for hw descriptors, error %d\n",
4106		    rc);
4107		goto err;
4108	}
4109	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4110
4111	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4112	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4113
4114	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4115		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4116		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4117	}
4118
4119	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4120	    sizeof(struct rtw_descs), NULL, 0);
4121
4122	if (rc != 0) {
4123		aprint_error_dev(sc->sc_dev,
4124		    "could not load DMA map for hw descriptors, error %d\n",
4125		    rc);
4126		goto err;
4127	}
4128	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4129
4130	if (rtw_txsoft_blk_setup_all(sc) != 0)
4131		goto err;
4132	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4133
4134	rtw_txdesc_blk_setup_all(sc);
4135
4136	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4137
4138	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4139
4140	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4141		tsb = &sc->sc_txsoft_blk[pri];
4142
4143		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4144		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4145			aprint_error_dev(sc->sc_dev,
4146			    "could not load DMA map for hw tx descriptors, "
4147			    "error %d\n", rc);
4148			goto err;
4149		}
4150	}
4151
4152	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4153	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4154	                                    RTW_RXQLEN)) != 0) {
4155		aprint_error_dev(sc->sc_dev,
4156		    "could not load DMA map for hw rx descriptors, error %d\n",
4157		    rc);
4158		goto err;
4159	}
4160	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4161
4162	/* Reset the chip to a known state. */
4163	if (rtw_reset(sc) != 0)
4164		goto err;
4165	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4166
4167	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4168
4169	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4170		sc->sc_flags |= RTW_F_9356SROM;
4171
4172	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4173	    sc->sc_dev) != 0)
4174		goto err;
4175
4176	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4177
4178	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4179	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4180	    sc->sc_dev) != 0) {
4181		aprint_error_dev(sc->sc_dev,
4182		    "attach failed, malformed serial ROM\n");
4183		goto err;
4184	}
4185
4186	aprint_verbose_dev(sc->sc_dev, "%s PHY\n",
4187	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4188
4189	aprint_verbose_dev(sc->sc_dev, "carrier-sense threshold %u\n",
4190	    sc->sc_csthr);
4191
4192	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4193
4194	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4195	    sc->sc_flags & RTW_F_DIGPHY);
4196
4197	if (sc->sc_rf == NULL) {
4198		aprint_verbose_dev(sc->sc_dev,
4199		    "attach failed, could not attach RF\n");
4200		goto err;
4201	}
4202
4203	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4204
4205	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4206
4207	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4208	    ("%s: PHY delay %d\n", device_xname(sc->sc_dev), sc->sc_phydelay));
4209
4210	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4211		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4212
4213	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels, sc->sc_dev);
4214
4215	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4216	    sc->sc_dev) != 0)
4217		goto err;
4218	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4219
4220	rtw_setifprops(ifp, device_xname(sc->sc_dev), (void*)sc);
4221
4222	IFQ_SET_READY(&ifp->if_snd);
4223
4224	sc->sc_ic.ic_ifp = ifp;
4225	rtw_set80211props(&sc->sc_ic);
4226
4227	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4228
4229	/*
4230	 * Call MI attach routines.
4231	 */
4232	if_initialize(ifp);
4233	ieee80211_ifattach(ic);
4234	/* Use common softint-based if_input */
4235	ifp->if_percpuq = if_percpuq_create(ifp);
4236	if_register(ifp);
4237
4238	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4239
4240	/* possibly we should fill in our own sc_send_prresp, since
4241	 * the RTL8180 is probably sending probe responses in ad hoc
4242	 * mode.
4243	 */
4244
4245	/* complete initialization */
4246	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4247	callout_init(&sc->sc_scan_ch, 0);
4248
4249	rtw_init_radiotap(sc);
4250
4251	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
4252	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4253
4254	NEXT_ATTACH_STATE(sc, FINISHED);
4255
4256	ieee80211_announce(ic);
4257	return;
4258err:
4259	rtw_detach(sc);
4260	return;
4261}
4262
4263int
4264rtw_detach(struct rtw_softc *sc)
4265{
4266	struct ifnet *ifp = &sc->sc_if;
4267	int pri, s;
4268
4269	s = splnet();
4270
4271	switch (sc->sc_attach_state) {
4272	case FINISHED:
4273		rtw_stop(ifp, 1);
4274
4275		pmf_device_deregister(sc->sc_dev);
4276		callout_stop(&sc->sc_scan_ch);
4277		ieee80211_ifdetach(&sc->sc_ic);
4278		if_detach(ifp);
4279		rtw_led_detach(&sc->sc_led_state);
4280		/*FALLTHROUGH*/
4281	case FINISH_ID_STA:
4282	case FINISH_RF_ATTACH:
4283		rtw_rf_destroy(sc->sc_rf);
4284		sc->sc_rf = NULL;
4285		/*FALLTHROUGH*/
4286	case FINISH_PARSE_SROM:
4287	case FINISH_READ_SROM:
4288		rtw_srom_free(&sc->sc_srom);
4289		/*FALLTHROUGH*/
4290	case FINISH_RESET:
4291	case FINISH_RXMAPS_CREATE:
4292		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4293		    RTW_RXQLEN);
4294		/*FALLTHROUGH*/
4295	case FINISH_TXMAPS_CREATE:
4296		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4297			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4298			    sc->sc_txsoft_blk[pri].tsb_desc,
4299			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4300		}
4301		/*FALLTHROUGH*/
4302	case FINISH_TXDESCBLK_SETUP:
4303	case FINISH_TXCTLBLK_SETUP:
4304		rtw_txsoft_blk_cleanup_all(sc);
4305		/*FALLTHROUGH*/
4306	case FINISH_DESCMAP_LOAD:
4307		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4308		/*FALLTHROUGH*/
4309	case FINISH_DESCMAP_CREATE:
4310		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4311		/*FALLTHROUGH*/
4312	case FINISH_DESC_MAP:
4313		bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_descs,
4314		    sizeof(struct rtw_descs));
4315		/*FALLTHROUGH*/
4316	case FINISH_DESC_ALLOC:
4317		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4318		    sc->sc_desc_nsegs);
4319		/*FALLTHROUGH*/
4320	case DETACHED:
4321		if (sc->sc_soft_ih != NULL) {
4322			softint_disestablish(sc->sc_soft_ih);
4323			sc->sc_soft_ih = NULL;
4324		}
4325		NEXT_ATTACH_STATE(sc, DETACHED);
4326		break;
4327	}
4328	splx(s);
4329	return 0;
4330}
4331