rtw.c revision 1.131
1/* $NetBSD: rtw.c,v 1.131 2019/05/23 10:57:28 msaitoh Exp $ */
2/*-
3 * Copyright (c) 2004, 2005, 2006, 2007 David Young.  All rights
4 * reserved.
5 *
6 * Programmed for NetBSD by David Young.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
19 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
20 * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
21 * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
22 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
23 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
28 * OF SUCH DAMAGE.
29 */
30/*
31 * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
32 */
33
34#include <sys/cdefs.h>
35__KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.131 2019/05/23 10:57:28 msaitoh Exp $");
36
37
38#include <sys/param.h>
39#include <sys/sysctl.h>
40#include <sys/systm.h>
41#include <sys/callout.h>
42#include <sys/mbuf.h>
43#include <sys/malloc.h>
44#include <sys/kernel.h>
45#include <sys/time.h>
46#include <sys/types.h>
47#include <sys/device.h>
48#include <sys/sockio.h>
49
50#include <machine/endian.h>
51#include <sys/bus.h>
52#include <sys/intr.h>	/* splnet */
53
54#include <net/if.h>
55#include <net/if_media.h>
56#include <net/if_ether.h>
57
58#include <net80211/ieee80211_netbsd.h>
59#include <net80211/ieee80211_var.h>
60#include <net80211/ieee80211_radiotap.h>
61
62#include <net/bpf.h>
63
64#include <dev/ic/rtwreg.h>
65#include <dev/ic/rtwvar.h>
66#include <dev/ic/rtwphyio.h>
67#include <dev/ic/rtwphy.h>
68
69#include <dev/ic/smc93cx6var.h>
70
71static int rtw_rfprog_fallback = 0;
72static int rtw_host_rfio = 0;
73
74#ifdef RTW_DEBUG
75int rtw_debug = 0;
76static int rtw_rxbufs_limit = RTW_RXQLEN;
77#endif /* RTW_DEBUG */
78
79#define NEXT_ATTACH_STATE(sc, state) do {			\
80	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
81	    ("%s: attach state %s\n", __func__, #state));	\
82	sc->sc_attach_state = state;				\
83} while (0)
84
85int rtw_dwelltime = 200;	/* milliseconds */
86static struct ieee80211_cipher rtw_cipher_wep;
87
88static void rtw_disable_interrupts(struct rtw_regs *);
89static void rtw_enable_interrupts(struct rtw_softc *);
90
91static int rtw_init(struct ifnet *);
92static void rtw_softintr(void *);
93
94static void rtw_start(struct ifnet *);
95static void rtw_reset_oactive(struct rtw_softc *);
96static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
97    struct ieee80211_node *);
98static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
99
100static void rtw_io_enable(struct rtw_softc *, uint8_t, int);
101static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
102static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
103    const uint8_t[IEEE80211_ADDR_LEN]);
104static void rtw_key_update_end(struct ieee80211com *);
105static void rtw_key_update_begin(struct ieee80211com *);
106static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
107static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
108
109static void rtw_led_attach(struct rtw_led_state *, void *);
110static void rtw_led_detach(struct rtw_led_state *);
111static void rtw_led_init(struct rtw_regs *);
112static void rtw_led_slowblink(void *);
113static void rtw_led_fastblink(void *);
114static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
115
116static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
117static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
118#ifdef RTW_DEBUG
119static void rtw_dump_rings(struct rtw_softc *sc);
120static void rtw_print_txdesc(struct rtw_softc *, const char *,
121    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
122static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
123static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
124#endif /* RTW_DEBUG */
125#ifdef RTW_DIAG
126static void rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln);
127#endif /* RTW_DIAG */
128
129/*
130 * Setup sysctl(3) MIB, hw.rtw.*
131 *
132 * TBD condition CTLFLAG_PERMANENT on being a module or not
133 */
134SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
135{
136	int rc;
137	const struct sysctlnode *cnode, *rnode;
138
139	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
140	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
141	    "Realtek RTL818x 802.11 controls",
142	    NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL)) != 0)
143		goto err;
144
145#ifdef RTW_DEBUG
146	/* control debugging printfs */
147	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
148	    CTLFLAG_PERMANENT | CTLFLAG_READWRITE, CTLTYPE_INT,
149	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
150	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
151	    CTL_CREATE, CTL_EOL)) != 0)
152		goto err;
153
154	/* Limit rx buffers, for simulating resource exhaustion. */
155	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
156	    CTLFLAG_PERMANENT | CTLFLAG_READWRITE, CTLTYPE_INT,
157	    "rxbufs_limit",
158	    SYSCTL_DESCR("Set rx buffers limit"),
159	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
160	    CTL_CREATE, CTL_EOL)) != 0)
161		goto err;
162
163#endif /* RTW_DEBUG */
164	/* set fallback RF programming method */
165	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
166	    CTLFLAG_PERMANENT | CTLFLAG_READWRITE, CTLTYPE_INT,
167	    "rfprog_fallback",
168	    SYSCTL_DESCR("Set fallback RF programming method"),
169	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
170	    CTL_CREATE, CTL_EOL)) != 0)
171		goto err;
172
173	/* force host to control RF I/O bus */
174	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
175	    CTLFLAG_PERMANENT | CTLFLAG_READWRITE, CTLTYPE_INT,
176	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
177	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
178	    CTL_CREATE, CTL_EOL)) != 0)
179		goto err;
180
181	return;
182err:
183	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
184}
185
186static int
187rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
188{
189	int error, t;
190	struct sysctlnode node;
191
192	node = *rnode;
193	t = *(int*)rnode->sysctl_data;
194	node.sysctl_data = &t;
195	error = sysctl_lookup(SYSCTLFN_CALL(&node));
196	if (error || newp == NULL)
197		return (error);
198
199	if (t < lower || t > upper)
200		return (EINVAL);
201
202	*(int*)rnode->sysctl_data = t;
203
204	return (0);
205}
206
207static int
208rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
209{
210	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
211	    __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
212}
213
214static int
215rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
216{
217	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
218}
219
220#ifdef RTW_DEBUG
221static int
222rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
223{
224	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
225	    0, RTW_DEBUG_MAX);
226}
227
228static int
229rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
230{
231	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
232	    0, RTW_RXQLEN);
233}
234
235static void
236rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
237{
238#define PRINTREG32(sc, reg)				\
239	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
240	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
241	    dvname, reg, RTW_READ(regs, reg)))
242
243#define PRINTREG16(sc, reg)				\
244	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
245	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
246	    dvname, reg, RTW_READ16(regs, reg)))
247
248#define PRINTREG8(sc, reg)				\
249	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
250	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
251	    dvname, reg, RTW_READ8(regs, reg)))
252
253	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
254
255	PRINTREG32(regs, RTW_IDR0);
256	PRINTREG32(regs, RTW_IDR1);
257	PRINTREG32(regs, RTW_MAR0);
258	PRINTREG32(regs, RTW_MAR1);
259	PRINTREG32(regs, RTW_TSFTRL);
260	PRINTREG32(regs, RTW_TSFTRH);
261	PRINTREG32(regs, RTW_TLPDA);
262	PRINTREG32(regs, RTW_TNPDA);
263	PRINTREG32(regs, RTW_THPDA);
264	PRINTREG32(regs, RTW_TCR);
265	PRINTREG32(regs, RTW_RCR);
266	PRINTREG32(regs, RTW_TINT);
267	PRINTREG32(regs, RTW_TBDA);
268	PRINTREG32(regs, RTW_ANAPARM);
269	PRINTREG32(regs, RTW_BB);
270	PRINTREG32(regs, RTW_PHYCFG);
271	PRINTREG32(regs, RTW_WAKEUP0L);
272	PRINTREG32(regs, RTW_WAKEUP0H);
273	PRINTREG32(regs, RTW_WAKEUP1L);
274	PRINTREG32(regs, RTW_WAKEUP1H);
275	PRINTREG32(regs, RTW_WAKEUP2LL);
276	PRINTREG32(regs, RTW_WAKEUP2LH);
277	PRINTREG32(regs, RTW_WAKEUP2HL);
278	PRINTREG32(regs, RTW_WAKEUP2HH);
279	PRINTREG32(regs, RTW_WAKEUP3LL);
280	PRINTREG32(regs, RTW_WAKEUP3LH);
281	PRINTREG32(regs, RTW_WAKEUP3HL);
282	PRINTREG32(regs, RTW_WAKEUP3HH);
283	PRINTREG32(regs, RTW_WAKEUP4LL);
284	PRINTREG32(regs, RTW_WAKEUP4LH);
285	PRINTREG32(regs, RTW_WAKEUP4HL);
286	PRINTREG32(regs, RTW_WAKEUP4HH);
287	PRINTREG32(regs, RTW_DK0);
288	PRINTREG32(regs, RTW_DK1);
289	PRINTREG32(regs, RTW_DK2);
290	PRINTREG32(regs, RTW_DK3);
291	PRINTREG32(regs, RTW_RETRYCTR);
292	PRINTREG32(regs, RTW_RDSAR);
293	PRINTREG32(regs, RTW_FER);
294	PRINTREG32(regs, RTW_FEMR);
295	PRINTREG32(regs, RTW_FPSR);
296	PRINTREG32(regs, RTW_FFER);
297
298	/* 16-bit registers */
299	PRINTREG16(regs, RTW_BRSR);
300	PRINTREG16(regs, RTW_IMR);
301	PRINTREG16(regs, RTW_ISR);
302	PRINTREG16(regs, RTW_BCNITV);
303	PRINTREG16(regs, RTW_ATIMWND);
304	PRINTREG16(regs, RTW_BINTRITV);
305	PRINTREG16(regs, RTW_ATIMTRITV);
306	PRINTREG16(regs, RTW_CRC16ERR);
307	PRINTREG16(regs, RTW_CRC0);
308	PRINTREG16(regs, RTW_CRC1);
309	PRINTREG16(regs, RTW_CRC2);
310	PRINTREG16(regs, RTW_CRC3);
311	PRINTREG16(regs, RTW_CRC4);
312	PRINTREG16(regs, RTW_CWR);
313
314	/* 8-bit registers */
315	PRINTREG8(regs, RTW_CR);
316	PRINTREG8(regs, RTW_9346CR);
317	PRINTREG8(regs, RTW_CONFIG0);
318	PRINTREG8(regs, RTW_CONFIG1);
319	PRINTREG8(regs, RTW_CONFIG2);
320	PRINTREG8(regs, RTW_MSR);
321	PRINTREG8(regs, RTW_CONFIG3);
322	PRINTREG8(regs, RTW_CONFIG4);
323	PRINTREG8(regs, RTW_TESTR);
324	PRINTREG8(regs, RTW_PSR);
325	PRINTREG8(regs, RTW_SCR);
326	PRINTREG8(regs, RTW_PHYDELAY);
327	PRINTREG8(regs, RTW_CRCOUNT);
328	PRINTREG8(regs, RTW_PHYADDR);
329	PRINTREG8(regs, RTW_PHYDATAW);
330	PRINTREG8(regs, RTW_PHYDATAR);
331	PRINTREG8(regs, RTW_CONFIG5);
332	PRINTREG8(regs, RTW_TPPOLL);
333
334	PRINTREG16(regs, RTW_BSSID16);
335	PRINTREG32(regs, RTW_BSSID32);
336#undef PRINTREG32
337#undef PRINTREG16
338#undef PRINTREG8
339}
340#endif /* RTW_DEBUG */
341
342void
343rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
344{
345	struct rtw_regs *regs = &sc->sc_regs;
346
347	uint32_t tcr;
348	tcr = RTW_READ(regs, RTW_TCR);
349	tcr &= ~RTW_TCR_LBK_MASK;
350	if (enable)
351		tcr |= RTW_TCR_LBK_CONT;
352	else
353		tcr |= RTW_TCR_LBK_NORMAL;
354	RTW_WRITE(regs, RTW_TCR, tcr);
355	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
356	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
357	rtw_txdac_enable(sc, !enable);
358	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
359	rtw_set_access(regs, RTW_ACCESS_NONE);
360}
361
362#ifdef RTW_DEBUG
363static const char *
364rtw_access_string(enum rtw_access access)
365{
366	switch (access) {
367	case RTW_ACCESS_NONE:
368		return "none";
369	case RTW_ACCESS_CONFIG:
370		return "config";
371	case RTW_ACCESS_ANAPARM:
372		return "anaparm";
373	default:
374		return "unknown";
375	}
376}
377#endif /* RTW_DEBUG */
378
379static void
380rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
381{
382	KASSERT(/* naccess >= RTW_ACCESS_NONE && */
383	    naccess <= RTW_ACCESS_ANAPARM);
384	KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
385	    regs->r_access <= RTW_ACCESS_ANAPARM);
386
387	if (naccess == regs->r_access)
388		return;
389
390	switch (naccess) {
391	case RTW_ACCESS_NONE:
392		switch (regs->r_access) {
393		case RTW_ACCESS_ANAPARM:
394			rtw_anaparm_enable(regs, 0);
395			/*FALLTHROUGH*/
396		case RTW_ACCESS_CONFIG:
397			rtw_config0123_enable(regs, 0);
398			/*FALLTHROUGH*/
399		case RTW_ACCESS_NONE:
400			break;
401		}
402		break;
403	case RTW_ACCESS_CONFIG:
404		switch (regs->r_access) {
405		case RTW_ACCESS_NONE:
406			rtw_config0123_enable(regs, 1);
407			/*FALLTHROUGH*/
408		case RTW_ACCESS_CONFIG:
409			break;
410		case RTW_ACCESS_ANAPARM:
411			rtw_anaparm_enable(regs, 0);
412			break;
413		}
414		break;
415	case RTW_ACCESS_ANAPARM:
416		switch (regs->r_access) {
417		case RTW_ACCESS_NONE:
418			rtw_config0123_enable(regs, 1);
419			/*FALLTHROUGH*/
420		case RTW_ACCESS_CONFIG:
421			rtw_anaparm_enable(regs, 1);
422			/*FALLTHROUGH*/
423		case RTW_ACCESS_ANAPARM:
424			break;
425		}
426		break;
427	}
428}
429
430void
431rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
432{
433	rtw_set_access1(regs, access);
434	RTW_DPRINTF(RTW_DEBUG_ACCESS,
435	    ("%s: access %s -> %s\n", __func__,
436	    rtw_access_string(regs->r_access),
437	    rtw_access_string(access)));
438	regs->r_access = access;
439}
440
441/*
442 * Enable registers, switch register banks.
443 */
444void
445rtw_config0123_enable(struct rtw_regs *regs, int enable)
446{
447	uint8_t ecr;
448	ecr = RTW_READ8(regs, RTW_9346CR);
449	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
450	if (enable)
451		ecr |= RTW_9346CR_EEM_CONFIG;
452	else {
453		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
454		ecr |= RTW_9346CR_EEM_NORMAL;
455	}
456	RTW_WRITE8(regs, RTW_9346CR, ecr);
457	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
458}
459
460/* requires rtw_config0123_enable(, 1) */
461void
462rtw_anaparm_enable(struct rtw_regs *regs, int enable)
463{
464	uint8_t cfg3;
465
466	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
467	cfg3 |= RTW_CONFIG3_CLKRUNEN;
468	if (enable)
469		cfg3 |= RTW_CONFIG3_PARMEN;
470	else
471		cfg3 &= ~RTW_CONFIG3_PARMEN;
472	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
473	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
474}
475
476/* requires rtw_anaparm_enable(, 1) */
477void
478rtw_txdac_enable(struct rtw_softc *sc, int enable)
479{
480	uint32_t anaparm;
481	struct rtw_regs *regs = &sc->sc_regs;
482
483	anaparm = RTW_READ(regs, RTW_ANAPARM);
484	if (enable)
485		anaparm &= ~RTW_ANAPARM_TXDACOFF;
486	else
487		anaparm |= RTW_ANAPARM_TXDACOFF;
488	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
489	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
490}
491
492static inline int
493rtw_chip_reset1(struct rtw_regs *regs, device_t dev)
494{
495	uint8_t cr;
496	int i;
497
498	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
499
500	RTW_WBR(regs, RTW_CR, RTW_CR);
501
502	for (i = 0; i < 1000; i++) {
503		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
504			RTW_DPRINTF(RTW_DEBUG_RESET,
505			    ("%s: reset in %dus\n", device_xname(dev), i));
506			return 0;
507		}
508		RTW_RBR(regs, RTW_CR, RTW_CR);
509		DELAY(10); /* 10us */
510	}
511
512	aprint_error_dev(dev, "reset failed\n");
513	return ETIMEDOUT;
514}
515
516static inline int
517rtw_chip_reset(struct rtw_regs *regs, device_t dev)
518{
519	uint32_t tcr;
520
521	/* from Linux driver */
522	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
523	      __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
524
525	RTW_WRITE(regs, RTW_TCR, tcr);
526
527	RTW_WBW(regs, RTW_CR, RTW_TCR);
528
529	return rtw_chip_reset1(regs, dev);
530}
531
532static int
533rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
534{
535	struct ieee80211_key keycopy;
536
537	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
538
539	keycopy = *k;
540	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
541
542	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
543}
544
545static int
546rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
547{
548	struct rtw_softc *sc = ic->ic_ifp->if_softc;
549
550	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__,
551	    k->wk_keyix));
552
553	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
554
555	if (k->wk_keylen != 0 &&
556	    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP)
557		sc->sc_flags &= ~RTW_F_DK_VALID;
558
559	return 1;
560}
561
562static int
563rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
564    const uint8_t mac[IEEE80211_ADDR_LEN])
565{
566	struct rtw_softc *sc = ic->ic_ifp->if_softc;
567
568	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
569
570	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
571
572	sc->sc_flags &= ~RTW_F_DK_VALID;
573
574	return 1;
575}
576
577static void
578rtw_key_update_begin(struct ieee80211com *ic)
579{
580#ifdef RTW_DEBUG
581	struct ifnet *ifp = ic->ic_ifp;
582	struct rtw_softc *sc = ifp->if_softc;
583#endif
584
585	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
586}
587
588static void
589rtw_tx_kick(struct rtw_regs *regs, uint8_t ringsel)
590{
591	uint8_t tppoll;
592
593	tppoll = RTW_READ8(regs, RTW_TPPOLL);
594	tppoll &= ~RTW_TPPOLL_SALL;
595	tppoll |= ringsel & RTW_TPPOLL_ALL;
596	RTW_WRITE8(regs, RTW_TPPOLL, tppoll);
597	RTW_SYNC(regs, RTW_TPPOLL, RTW_TPPOLL);
598}
599
600static void
601rtw_key_update_end(struct ieee80211com *ic)
602{
603	struct ifnet *ifp = ic->ic_ifp;
604	struct rtw_softc *sc = ifp->if_softc;
605
606	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
607
608	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
609	    !device_is_active(sc->sc_dev))
610		return;
611
612	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
613	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
614	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
615	    (ifp->if_flags & IFF_RUNNING) != 0);
616}
617
618static bool
619rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
620{
621	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
622		return false;
623
624	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
625		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
626}
627
628static void
629rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
630{
631	uint8_t psr, scr;
632	int i, keylen = 0;
633	struct rtw_regs *regs;
634	union rtw_keys *rk;
635
636	regs = &sc->sc_regs;
637	rk = &sc->sc_keys;
638
639	(void)memset(rk, 0, sizeof(*rk));
640
641	/* Temporarily use software crypto for all keys. */
642	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
643		if (wk[i].wk_cipher == &rtw_cipher_wep)
644			wk[i].wk_cipher = &ieee80211_cipher_wep;
645	}
646
647	rtw_set_access(regs, RTW_ACCESS_CONFIG);
648
649	psr = RTW_READ8(regs, RTW_PSR);
650	scr = RTW_READ8(regs, RTW_SCR);
651	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
652
653	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
654		goto out;
655
656	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
657		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
658			continue;
659		if (i == txkey) {
660			keylen = wk[i].wk_keylen;
661			break;
662		}
663		keylen = MAX(keylen, wk[i].wk_keylen);
664	}
665
666	if (keylen == 5)
667		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
668	else if (keylen == 13)
669		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
670
671	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
672		if (wk[i].wk_keylen != keylen ||
673		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
674			continue;
675		/* h/w will decrypt, s/w still strips headers */
676		wk[i].wk_cipher = &rtw_cipher_wep;
677		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
678	}
679
680out:
681	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
682
683	bus_space_write_region_stream_4(regs->r_bt, regs->r_bh,
684	    RTW_DK0, rk->rk_words, __arraycount(rk->rk_words));
685
686	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
687	    BUS_SPACE_BARRIER_READ | BUS_SPACE_BARRIER_WRITE);
688
689	RTW_DPRINTF(RTW_DEBUG_KEY,
690	    ("%s.%d: scr %02" PRIx8 ", keylen %d\n", __func__, __LINE__, scr,
691	     keylen));
692
693	RTW_WBW(regs, RTW_DK0, RTW_PSR);
694	RTW_WRITE8(regs, RTW_PSR, psr);
695	RTW_WBW(regs, RTW_PSR, RTW_SCR);
696	RTW_WRITE8(regs, RTW_SCR, scr);
697	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
698	rtw_set_access(regs, RTW_ACCESS_NONE);
699	sc->sc_flags |= RTW_F_DK_VALID;
700}
701
702static inline int
703rtw_recall_eeprom(struct rtw_regs *regs, device_t dev)
704{
705	int i;
706	uint8_t ecr;
707
708	ecr = RTW_READ8(regs, RTW_9346CR);
709	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
710	RTW_WRITE8(regs, RTW_9346CR, ecr);
711
712	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
713
714	/* wait 25ms for completion */
715	for (i = 0; i < 250; i++) {
716		ecr = RTW_READ8(regs, RTW_9346CR);
717		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
718			RTW_DPRINTF(RTW_DEBUG_RESET,
719			    ("%s: recall EEPROM in %dus\n", device_xname(dev),
720			    i * 100));
721			return 0;
722		}
723		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
724		DELAY(100);
725	}
726	aprint_error_dev(dev, "recall EEPROM failed\n");
727	return ETIMEDOUT;
728}
729
730static inline int
731rtw_reset(struct rtw_softc *sc)
732{
733	int rc;
734	uint8_t config1;
735
736	sc->sc_flags &= ~RTW_F_DK_VALID;
737
738	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev)) != 0)
739		return rc;
740
741	rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev);
742
743	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
744	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
745	/* TBD turn off maximum power saving? */
746
747	return 0;
748}
749
750static inline int
751rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
752    u_int ndescs)
753{
754	int i, rc = 0;
755	for (i = 0; i < ndescs; i++) {
756		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
757		    0, 0, &descs[i].ts_dmamap);
758		if (rc != 0)
759			break;
760	}
761	return rc;
762}
763
764static inline int
765rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
766    u_int ndescs)
767{
768	int i, rc = 0;
769	for (i = 0; i < ndescs; i++) {
770		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
771		    &descs[i].rs_dmamap);
772		if (rc != 0)
773			break;
774	}
775	return rc;
776}
777
778static inline void
779rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
780    u_int ndescs)
781{
782	int i;
783	for (i = 0; i < ndescs; i++) {
784		if (descs[i].rs_dmamap != NULL)
785			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
786	}
787}
788
789static inline void
790rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
791    u_int ndescs)
792{
793	int i;
794	for (i = 0; i < ndescs; i++) {
795		if (descs[i].ts_dmamap != NULL)
796			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
797	}
798}
799
800static inline void
801rtw_srom_free(struct rtw_srom *sr)
802{
803	sr->sr_size = 0;
804	if (sr->sr_content == NULL)
805		return;
806	free(sr->sr_content, M_DEVBUF);
807	sr->sr_content = NULL;
808}
809
810static void
811rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
812    uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
813{
814	*flags |= (RTW_F_DIGPHY | RTW_F_ANTDIV);
815	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
816	*rcr |= RTW_RCR_ENCS1;
817	*rfchipid = RTW_RFCHIPID_PHILIPS;
818}
819
820static int
821rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
822    enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
823    device_t dev)
824{
825	int i;
826	const char *rfname, *paname;
827	char scratch[sizeof("unknown 0xXX")];
828	uint16_t srom_version;
829
830	*flags &= ~(RTW_F_DIGPHY | RTW_F_DFLANTB | RTW_F_ANTDIV);
831	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
832
833	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
834
835	if (srom_version <= 0x0101) {
836		aprint_error_dev(dev,
837		    "SROM version %d.%d is not understood, "
838		    "limping along with defaults\n",
839		    srom_version >> 8, srom_version & 0xff);
840		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
841		return 0;
842	} else {
843		aprint_verbose_dev(dev, "SROM version %d.%d\n",
844		    srom_version >> 8, srom_version & 0xff);
845	}
846
847	uint8_t mac[IEEE80211_ADDR_LEN];
848	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
849		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
850	__USE(mac);
851
852	RTW_DPRINTF(RTW_DEBUG_ATTACH,
853	    ("%s: EEPROM MAC %s\n", device_xname(dev), ether_sprintf(mac)));
854
855	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
856
857	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
858		*flags |= RTW_F_ANTDIV;
859
860	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
861	 * to be reversed.
862	 */
863	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
864		*flags |= RTW_F_DIGPHY;
865	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
866		*flags |= RTW_F_DFLANTB;
867
868	*rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
869	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
870
871	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
872		*flags |= RTW_C_RXWEP_104;
873
874	*flags |= RTW_C_RXWEP_40;	/* XXX */
875
876	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
877	switch (*rfchipid) {
878	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
879		rfname = "GCT GRF5101";
880		paname = "Winspring WS9901";
881		break;
882	case RTW_RFCHIPID_MAXIM:
883		rfname = "Maxim MAX2820";	/* guess */
884		paname = "Maxim MAX2422";	/* guess */
885		break;
886	case RTW_RFCHIPID_INTERSIL:
887		rfname = "Intersil HFA3873";	/* guess */
888		paname = "Intersil <unknown>";
889		break;
890	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
891		rfname = "Philips SA2400A";
892		paname = "Philips SA2411";
893		break;
894	case RTW_RFCHIPID_RFMD:
895		/* this is the same front-end as an atw(4)! */
896		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
897			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
898			 "SYN: Silicon Labs Si4126";	/* inferred from
899			 				 * reference driver
900							 */
901		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
902		break;
903	case RTW_RFCHIPID_RESERVED:
904		rfname = paname = "reserved";
905		break;
906	default:
907		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
908		rfname = paname = scratch;
909	}
910	aprint_normal_dev(dev, "RF: %s, PA: %s\n", rfname, paname);
911
912	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
913	case RTW_CONFIG0_GL_USA:
914	case _RTW_CONFIG0_GL_USA:
915		*locale = RTW_LOCALE_USA;
916		break;
917	case RTW_CONFIG0_GL_EUROPE:
918		*locale = RTW_LOCALE_EUROPE;
919		break;
920	case RTW_CONFIG0_GL_JAPAN:
921		*locale = RTW_LOCALE_JAPAN;
922		break;
923	default:
924		*locale = RTW_LOCALE_UNKNOWN;
925		break;
926	}
927	return 0;
928}
929
930/* Returns -1 on failure. */
931static int
932rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
933    device_t dev)
934{
935	int rc;
936	struct seeprom_descriptor sd;
937	uint8_t ecr;
938
939	(void)memset(&sd, 0, sizeof(sd));
940
941	ecr = RTW_READ8(regs, RTW_9346CR);
942
943	if ((flags & RTW_F_9356SROM) != 0) {
944		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n",
945		    device_xname(dev)));
946		sr->sr_size = 256;
947		sd.sd_chip = C56_66;
948	} else {
949		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n",
950		    device_xname(dev)));
951		sr->sr_size = 128;
952		sd.sd_chip = C46;
953	}
954
955	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
956	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
957	ecr |= RTW_9346CR_EEM_PROGRAM;
958
959	RTW_WRITE8(regs, RTW_9346CR, ecr);
960
961	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
962
963	if (sr->sr_content == NULL) {
964		aprint_error_dev(dev, "unable to allocate SROM buffer\n");
965		return ENOMEM;
966	}
967
968	(void)memset(sr->sr_content, 0, sr->sr_size);
969
970	/* RTL8180 has a single 8-bit register for controlling the
971	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
972	 * input/output sense is the reverse of read_seeprom's.
973	 */
974	sd.sd_tag = regs->r_bt;
975	sd.sd_bsh = regs->r_bh;
976	sd.sd_regsize = 1;
977	sd.sd_control_offset = RTW_9346CR;
978	sd.sd_status_offset = RTW_9346CR;
979	sd.sd_dataout_offset = RTW_9346CR;
980	sd.sd_CK = RTW_9346CR_EESK;
981	sd.sd_CS = RTW_9346CR_EECS;
982	sd.sd_DI = RTW_9346CR_EEDO;
983	sd.sd_DO = RTW_9346CR_EEDI;
984	/* make read_seeprom enter EEPROM read/write mode */
985	sd.sd_MS = ecr;
986	sd.sd_RDY = 0;
987
988	/* TBD bus barriers */
989	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
990		aprint_error_dev(dev, "could not read SROM\n");
991		free(sr->sr_content, M_DEVBUF);
992		sr->sr_content = NULL;
993		return -1;	/* XXX */
994	}
995
996	/* end EEPROM read/write mode */
997	RTW_WRITE8(regs, RTW_9346CR,
998	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
999	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
1000
1001	if ((rc = rtw_recall_eeprom(regs, dev)) != 0)
1002		return rc;
1003
1004#ifdef RTW_DEBUG
1005	{
1006		int i;
1007		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1008		    ("\n%s: serial ROM:\n\t", device_xname(dev)));
1009		for (i = 0; i < sr->sr_size/2; i++) {
1010			if (((i % 8) == 0) && (i != 0))
1011				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1012			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1013			    (" %04x", sr->sr_content[i]));
1014		}
1015		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1016	}
1017#endif /* RTW_DEBUG */
1018	return 0;
1019}
1020
1021static void
1022rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1023    device_t dev)
1024{
1025	uint8_t cfg4;
1026	const char *method;
1027
1028	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1029
1030	switch (rfchipid) {
1031	default:
1032		cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1033		method = "fallback";
1034		break;
1035	case RTW_RFCHIPID_INTERSIL:
1036		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1037		method = "Intersil";
1038		break;
1039	case RTW_RFCHIPID_PHILIPS:
1040		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1041		method = "Philips";
1042		break;
1043	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1044	case RTW_RFCHIPID_RFMD:
1045		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1046		method = "RFMD";
1047		break;
1048	}
1049
1050	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1051
1052	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1053
1054#ifdef RTW_DEBUG
1055	RTW_DPRINTF(RTW_DEBUG_INIT,
1056	    ("%s: %s RF programming method, %#02x\n", device_xname(dev), method,
1057	    RTW_READ8(regs, RTW_CONFIG4)));
1058#else
1059	__USE(method);
1060#endif
1061}
1062
1063static inline void
1064rtw_init_channels(enum rtw_locale locale,
1065    struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1], device_t dev)
1066{
1067	int i;
1068	const char *name = NULL;
1069#define ADD_CHANNEL(_chans, _chan) do {			\
1070	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1071	(*_chans)[_chan].ic_freq =				\
1072	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1073} while (0)
1074
1075	switch (locale) {
1076	case RTW_LOCALE_USA:	/* 1-11 */
1077		name = "USA";
1078		for (i = 1; i <= 11; i++)
1079			ADD_CHANNEL(chans, i);
1080		break;
1081	case RTW_LOCALE_JAPAN:	/* 1-14 */
1082		name = "Japan";
1083		ADD_CHANNEL(chans, 14);
1084		for (i = 1; i <= 14; i++)
1085			ADD_CHANNEL(chans, i);
1086		break;
1087	case RTW_LOCALE_EUROPE:	/* 1-13 */
1088		name = "Europe";
1089		for (i = 1; i <= 13; i++)
1090			ADD_CHANNEL(chans, i);
1091		break;
1092	default:			/* 10-11 allowed by most countries */
1093		name = "<unknown>";
1094		for (i = 10; i <= 11; i++)
1095			ADD_CHANNEL(chans, i);
1096		break;
1097	}
1098	aprint_normal_dev(dev, "Geographic Location %s\n", name);
1099#undef ADD_CHANNEL
1100}
1101
1102
1103static inline void
1104rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1105{
1106	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1107
1108	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1109	case RTW_CONFIG0_GL_USA:
1110	case _RTW_CONFIG0_GL_USA:
1111		*locale = RTW_LOCALE_USA;
1112		break;
1113	case RTW_CONFIG0_GL_JAPAN:
1114		*locale = RTW_LOCALE_JAPAN;
1115		break;
1116	case RTW_CONFIG0_GL_EUROPE:
1117		*locale = RTW_LOCALE_EUROPE;
1118		break;
1119	default:
1120		*locale = RTW_LOCALE_UNKNOWN;
1121		break;
1122	}
1123}
1124
1125static inline int
1126rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1127    device_t dev)
1128{
1129	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1130		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1131	};
1132	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1133	          idr1 = RTW_READ(regs, RTW_IDR1);
1134
1135	(*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1136	(*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1137	(*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1138	(*addr)[3] = __SHIFTOUT(idr0, __BITS(24, 31));
1139
1140	(*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1141	(*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1142
1143	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1144		aprint_error_dev(dev,
1145		    "could not get mac address, attach failed\n");
1146		return ENXIO;
1147	}
1148
1149	aprint_normal_dev(dev, "802.11 address %s\n", ether_sprintf(*addr));
1150
1151	return 0;
1152}
1153
1154static uint8_t
1155rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1156    struct ieee80211_channel *chan)
1157{
1158	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1159	KASSERT(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14);
1160	return RTW_SR_GET(sr, idx);
1161}
1162
1163static void
1164rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1165{
1166	int pri;
1167	/* nfree: the number of free descriptors in each ring.
1168	 * The beacon ring is a special case: I do not let the
1169	 * driver use all of the descriptors on the beacon ring.
1170	 * The reasons are two-fold:
1171	 *
1172	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1173	 * updated, so the driver cannot easily know if the descriptor
1174	 * belongs to it, or if it is racing the NIC.  If the NIC
1175	 * does not OWN every descriptor, then the driver can safely
1176	 * update the descriptors when RTW_TBDA points at tdb_next.
1177	 *
1178	 * (2) I hope that the NIC will process more than one BEACON
1179	 * descriptor in a single beacon interval, since that will
1180	 * enable multiple-BSS support.  Since the NIC does not
1181	 * clear the OWN bit, there is no natural place for it to
1182	 * stop processing BEACON desciptors.  Maybe it will *not*
1183	 * stop processing them!  I do not want to chance the NIC
1184	 * looping around and around a saturated beacon ring, so
1185	 * I will leave one descriptor unOWNed at all times.
1186	 */
1187	u_int nfree[RTW_NTXPRI] =
1188	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1189	     RTW_NTXDESCBCN - 1};
1190
1191	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1192		tdb[pri].tdb_nfree = nfree[pri];
1193		tdb[pri].tdb_next = 0;
1194	}
1195}
1196
1197static int
1198rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1199{
1200	int i;
1201	struct rtw_txsoft *ts;
1202
1203	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1204	SIMPLEQ_INIT(&tsb->tsb_freeq);
1205	for (i = 0; i < tsb->tsb_ndesc; i++) {
1206		ts = &tsb->tsb_desc[i];
1207		ts->ts_mbuf = NULL;
1208		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1209	}
1210	tsb->tsb_tx_timer = 0;
1211	return 0;
1212}
1213
1214static void
1215rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1216{
1217	int pri;
1218	for (pri = 0; pri < RTW_NTXPRI; pri++)
1219		rtw_txsoft_blk_init(&tsb[pri]);
1220}
1221
1222static inline void
1223rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1224{
1225	KASSERT(nsync <= rdb->rdb_ndesc);
1226	/* sync to end of ring */
1227	if (desc0 + nsync > rdb->rdb_ndesc) {
1228		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1229		    offsetof(struct rtw_descs, hd_rx[desc0]),
1230		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1231		nsync -= (rdb->rdb_ndesc - desc0);
1232		desc0 = 0;
1233	}
1234
1235	KASSERT(desc0 < rdb->rdb_ndesc);
1236	KASSERT(nsync <= rdb->rdb_ndesc);
1237	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1238
1239	/* sync what remains */
1240	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1241	    offsetof(struct rtw_descs, hd_rx[desc0]),
1242	    sizeof(struct rtw_rxdesc) * nsync, ops);
1243}
1244
1245static void
1246rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1247{
1248	/* sync to end of ring */
1249	if (desc0 + nsync > tdb->tdb_ndesc) {
1250		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1251		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1252		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1253		    ops);
1254		nsync -= (tdb->tdb_ndesc - desc0);
1255		desc0 = 0;
1256	}
1257
1258	/* sync what remains */
1259	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1260	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1261	    sizeof(struct rtw_txdesc) * nsync, ops);
1262}
1263
1264static void
1265rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1266{
1267	int pri;
1268	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1269		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1270		    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1271	}
1272}
1273
1274static void
1275rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1276{
1277	int i;
1278	struct rtw_rxsoft *rs;
1279
1280	for (i = 0; i < RTW_RXQLEN; i++) {
1281		rs = &desc[i];
1282		if (rs->rs_mbuf == NULL)
1283			continue;
1284		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1285		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1286		bus_dmamap_unload(dmat, rs->rs_dmamap);
1287		m_freem(rs->rs_mbuf);
1288		rs->rs_mbuf = NULL;
1289	}
1290}
1291
1292static inline int
1293rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1294{
1295	int rc;
1296	struct mbuf *m;
1297
1298	MGETHDR(m, M_DONTWAIT, MT_DATA);
1299	if (m == NULL)
1300		return ENOBUFS;
1301
1302	MCLGET(m, M_DONTWAIT);
1303	if ((m->m_flags & M_EXT) == 0) {
1304		m_freem(m);
1305		return ENOBUFS;
1306	}
1307
1308	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1309
1310	if (rs->rs_mbuf != NULL)
1311		bus_dmamap_unload(dmat, rs->rs_dmamap);
1312
1313	rs->rs_mbuf = NULL;
1314
1315	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1316	if (rc != 0) {
1317		m_freem(m);
1318		return -1;
1319	}
1320
1321	rs->rs_mbuf = m;
1322
1323	return 0;
1324}
1325
1326static int
1327rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1328    int *ndesc, device_t dev)
1329{
1330	int i, rc = 0;
1331	struct rtw_rxsoft *rs;
1332
1333	for (i = 0; i < RTW_RXQLEN; i++) {
1334		rs = &desc[i];
1335		/* we're in rtw_init, so there should be no mbufs allocated */
1336		KASSERT(rs->rs_mbuf == NULL);
1337#ifdef RTW_DEBUG
1338		if (i == rtw_rxbufs_limit) {
1339			aprint_error_dev(dev, "TEST hit %d-buffer limit\n", i);
1340			rc = ENOBUFS;
1341			break;
1342		}
1343#endif /* RTW_DEBUG */
1344		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1345			aprint_error_dev(dev,
1346			    "rtw_rxsoft_alloc failed, %d buffers, rc %d\n",
1347			    i, rc);
1348			break;
1349		}
1350	}
1351	*ndesc = i;
1352	return rc;
1353}
1354
1355static inline void
1356rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1357    int idx, int kick)
1358{
1359	int is_last = (idx == rdb->rdb_ndesc - 1);
1360	uint32_t ctl, octl, obuf;
1361	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1362
1363	/* sync the mbuf before the descriptor */
1364	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1365	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1366
1367	obuf = rd->rd_buf;
1368	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1369
1370	ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1371	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1372
1373	if (is_last)
1374		ctl |= RTW_RXCTL_EOR;
1375
1376	octl = rd->rd_ctl;
1377	rd->rd_ctl = htole32(ctl);
1378
1379#ifdef RTW_DEBUG
1380	RTW_DPRINTF(
1381	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1382	         : RTW_DEBUG_RECV_DESC,
1383	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1384	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1385	     le32toh(rd->rd_ctl)));
1386#else
1387	__USE(octl);
1388	__USE(obuf);
1389#endif
1390
1391	/* sync the descriptor */
1392	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1393	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1394	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1395}
1396
1397static void
1398rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1399{
1400	int i;
1401	struct rtw_rxsoft *rs;
1402
1403	for (i = 0; i < rdb->rdb_ndesc; i++) {
1404		rs = &ctl[i];
1405		rtw_rxdesc_init(rdb, rs, i, kick);
1406	}
1407}
1408
1409static void
1410rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1411{
1412	struct rtw_regs *regs = &sc->sc_regs;
1413	uint8_t cr;
1414
1415	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1416	    enable ? "enable" : "disable", flags));
1417
1418	cr = RTW_READ8(regs, RTW_CR);
1419
1420	/* XXX reference source does not enable MULRW */
1421	/* enable PCI Read/Write Multiple */
1422	cr |= RTW_CR_MULRW;
1423
1424	/* The receive engine will always start at RDSAR.  */
1425	if (enable && (flags & ~cr & RTW_CR_RE)) {
1426		struct rtw_rxdesc_blk *rdb;
1427		rdb = &sc->sc_rxdesc_blk;
1428		rdb->rdb_next = 0;
1429	}
1430
1431	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1432	if (enable)
1433		cr |= flags;
1434	else
1435		cr &= ~flags;
1436	RTW_WRITE8(regs, RTW_CR, cr);
1437	RTW_SYNC(regs, RTW_CR, RTW_CR);
1438
1439#ifdef RTW_DIAG
1440	if (cr & RTW_CR_TE)
1441		rtw_txring_fixup(sc, __func__, __LINE__);
1442#endif
1443	if (cr & RTW_CR_TE) {
1444		rtw_tx_kick(&sc->sc_regs,
1445		    RTW_TPPOLL_HPQ | RTW_TPPOLL_NPQ | RTW_TPPOLL_LPQ);
1446	}
1447}
1448
1449static void
1450rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1451{
1452#define	IS_BEACON(__fc0)						\
1453    ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1454     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1455
1456	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1457							 * hardware -> net80211
1458							 */
1459	u_int next, nproc = 0;
1460	int hwrate, len, rate, rssi, sq, s;
1461	uint32_t hrssi, hstat, htsfth, htsftl;
1462	struct rtw_rxdesc *rd;
1463	struct rtw_rxsoft *rs;
1464	struct rtw_rxdesc_blk *rdb;
1465	struct mbuf *m;
1466	struct ifnet *ifp = &sc->sc_if;
1467
1468	struct ieee80211_node *ni;
1469	struct ieee80211_frame_min *wh;
1470
1471	rdb = &sc->sc_rxdesc_blk;
1472
1473	for (next = rdb->rdb_next; ; next = rdb->rdb_next) {
1474		KASSERT(next < rdb->rdb_ndesc);
1475
1476		rtw_rxdescs_sync(rdb, next, 1,
1477		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1478		rd = &rdb->rdb_desc[next];
1479		rs = &sc->sc_rxsoft[next];
1480
1481		hstat = le32toh(rd->rd_stat);
1482		hrssi = le32toh(rd->rd_rssi);
1483		htsfth = le32toh(rd->rd_tsfth);
1484		htsftl = le32toh(rd->rd_tsftl);
1485
1486		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1487		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1488		    __func__, next, hstat, hrssi, htsfth, htsftl));
1489
1490		++nproc;
1491
1492		/* still belongs to NIC */
1493		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1494			rtw_rxdescs_sync(rdb, next, 1, BUS_DMASYNC_PREREAD);
1495			break;
1496		}
1497
1498                /* ieee80211_input() might reset the receive engine
1499                 * (e.g. by indirectly calling rtw_tune()), so save
1500                 * the next pointer here and retrieve it again on
1501                 * the next round.
1502		 */
1503		rdb->rdb_next = (next + 1) % rdb->rdb_ndesc;
1504
1505#ifdef RTW_DEBUG
1506#define PRINTSTAT(flag) do { \
1507	if ((hstat & flag) != 0) { \
1508		printf("%s" #flag, delim); \
1509		delim = ","; \
1510	} \
1511} while (0)
1512		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1513			const char *delim = "<";
1514			printf("%s: ", device_xname(sc->sc_dev));
1515			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1516				printf("status %08x", hstat);
1517				PRINTSTAT(RTW_RXSTAT_SPLCP);
1518				PRINTSTAT(RTW_RXSTAT_MAR);
1519				PRINTSTAT(RTW_RXSTAT_PAR);
1520				PRINTSTAT(RTW_RXSTAT_BAR);
1521				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1522				PRINTSTAT(RTW_RXSTAT_CRC32);
1523				PRINTSTAT(RTW_RXSTAT_ICV);
1524				printf(">, ");
1525			}
1526		}
1527#endif /* RTW_DEBUG */
1528
1529		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1530			aprint_error_dev(sc->sc_dev,
1531			    "DMA error/FIFO overflow %08" PRIx32 ", "
1532			    "rx descriptor %d\n", hstat, next);
1533			ifp->if_ierrors++;
1534			goto next;
1535		}
1536
1537		len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1538		if (len < IEEE80211_MIN_LEN) {
1539			sc->sc_ic.ic_stats.is_rx_tooshort++;
1540			goto next;
1541		}
1542		if (len > rs->rs_mbuf->m_len) {
1543			aprint_error_dev(sc->sc_dev,
1544			    "rx frame too long, %d > %d, %08" PRIx32
1545			    ", desc %d\n",
1546			    len, rs->rs_mbuf->m_len, hstat, next);
1547			ifp->if_ierrors++;
1548			goto next;
1549		}
1550
1551		hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1552		if (hwrate >= __arraycount(ratetbl)) {
1553			aprint_error_dev(sc->sc_dev,
1554			    "unknown rate #%" __PRIuBITS "\n",
1555			    __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1556			ifp->if_ierrors++;
1557			goto next;
1558		}
1559		rate = ratetbl[hwrate];
1560
1561#ifdef RTW_DEBUG
1562		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1563		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1564		     (rate * 5) % 10, htsfth, htsftl));
1565#endif /* RTW_DEBUG */
1566
1567		/* if bad flags, skip descriptor */
1568		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1569			aprint_error_dev(sc->sc_dev, "too many rx segments, "
1570			    "next=%d, %08" PRIx32 "\n", next, hstat);
1571			goto next;
1572		}
1573
1574		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1575		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1576
1577		m = rs->rs_mbuf;
1578
1579		/* if temporarily out of memory, re-use mbuf */
1580		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1581		case 0:
1582			break;
1583		case ENOBUFS:
1584			aprint_error_dev(sc->sc_dev,
1585			    "rtw_rxsoft_alloc(, %d) failed, dropping packet\n",
1586			    next);
1587			goto next;
1588		default:
1589			/* XXX shorten rx ring, instead? */
1590			aprint_error_dev(sc->sc_dev,
1591			    "could not load DMA map\n");
1592		}
1593
1594		sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1595
1596		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1597			rssi = UINT8_MAX - sq;
1598		else {
1599			rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1600			/* TBD find out each front-end's LNA gain in the
1601			 * front-end's units
1602			 */
1603			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1604				rssi |= 0x80;
1605		}
1606
1607		/* Note well: now we cannot recycle the rs_mbuf unless
1608		 * we restore its original length.
1609		 */
1610		m_set_rcvif(m, ifp);
1611		m->m_pkthdr.len = m->m_len = len;
1612
1613		wh = mtod(m, struct ieee80211_frame_min *);
1614
1615		s = splnet();
1616
1617		if (!IS_BEACON(wh->i_fc[0]))
1618			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1619
1620		sc->sc_tsfth = htsfth;
1621
1622#ifdef RTW_DEBUG
1623		if ((ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==
1624		    (IFF_DEBUG | IFF_LINK2)) {
1625			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1626			    rate, rssi);
1627		}
1628#endif /* RTW_DEBUG */
1629
1630		if (sc->sc_radiobpf != NULL) {
1631			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1632
1633			rr->rr_tsft =
1634			    htole64(((uint64_t)htsfth << 32) | htsftl);
1635
1636			rr->rr_flags = IEEE80211_RADIOTAP_F_FCS;
1637
1638			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1639				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1640			if ((hstat & RTW_RXSTAT_CRC32) != 0)
1641				rr->rr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1642
1643			rr->rr_rate = rate;
1644
1645			if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1646				rr->rr_u.u_philips.p_antsignal = rssi;
1647			else {
1648				rr->rr_u.u_other.o_antsignal = rssi;
1649				rr->rr_u.u_other.o_barker_lock =
1650				    htole16(UINT8_MAX - sq);
1651			}
1652
1653			bpf_mtap2(sc->sc_radiobpf,
1654			    rr, sizeof(sc->sc_rxtapu), m, BPF_D_IN);
1655		}
1656
1657		if ((hstat & RTW_RXSTAT_RES) != 0) {
1658			m_freem(m);
1659			splx(s);
1660			goto next;
1661		}
1662
1663		/* CRC is included with the packet; trim it off. */
1664		m_adj(m, -IEEE80211_CRC_LEN);
1665
1666		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1667		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1668		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1669		ieee80211_free_node(ni);
1670		splx(s);
1671next:
1672		rtw_rxdesc_init(rdb, rs, next, 0);
1673	}
1674#undef IS_BEACON
1675}
1676
1677static void
1678rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1679    struct rtw_txsoft *ts)
1680{
1681	struct mbuf *m;
1682	struct ieee80211_node *ni;
1683
1684	m = ts->ts_mbuf;
1685	ni = ts->ts_ni;
1686	KASSERT(m != NULL);
1687	KASSERT(ni != NULL);
1688	ts->ts_mbuf = NULL;
1689	ts->ts_ni = NULL;
1690
1691	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1692	    BUS_DMASYNC_POSTWRITE);
1693	bus_dmamap_unload(dmat, ts->ts_dmamap);
1694	m_freem(m);
1695	ieee80211_free_node(ni);
1696}
1697
1698static void
1699rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1700    struct rtw_txsoft_blk *tsb)
1701{
1702	struct rtw_txsoft *ts;
1703
1704	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1705		rtw_txsoft_release(dmat, ic, ts);
1706		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1707		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1708	}
1709	tsb->tsb_tx_timer = 0;
1710}
1711
1712static inline void
1713rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1714    struct rtw_txsoft *ts, int ndesc)
1715{
1716	uint32_t hstat;
1717	int data_retry, rts_retry;
1718	struct rtw_txdesc *tdn;
1719	const char *condstring;
1720	struct ifnet *ifp = &sc->sc_if;
1721
1722	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1723
1724	tdb->tdb_nfree += ndesc;
1725
1726	tdn = &tdb->tdb_desc[ts->ts_last];
1727
1728	hstat = le32toh(tdn->td_stat);
1729	rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1730	data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1731
1732	ifp->if_collisions += rts_retry + data_retry;
1733
1734	if ((hstat & RTW_TXSTAT_TOK) != 0)
1735		condstring = "ok";
1736	else {
1737		ifp->if_oerrors++;
1738		condstring = "error";
1739	}
1740
1741#ifdef RTW_DEBUG
1742	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1743	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1744	    device_xname(sc->sc_dev), ts, ts->ts_first, ts->ts_last,
1745	    condstring, rts_retry, data_retry));
1746#else
1747	__USE(condstring);
1748#endif
1749}
1750
1751static void
1752rtw_reset_oactive(struct rtw_softc *sc)
1753{
1754	short oflags;
1755	int pri;
1756	struct rtw_txsoft_blk *tsb;
1757	struct rtw_txdesc_blk *tdb;
1758	oflags = sc->sc_if.if_flags;
1759	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1760		tsb = &sc->sc_txsoft_blk[pri];
1761		tdb = &sc->sc_txdesc_blk[pri];
1762		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1763			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1764	}
1765	if (oflags != sc->sc_if.if_flags) {
1766		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1767		    ("%s: reset OACTIVE\n", __func__));
1768	}
1769}
1770
1771/* Collect transmitted packets. */
1772static bool
1773rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1774    struct rtw_txdesc_blk *tdb, int force)
1775{
1776	bool collected = false;
1777	int ndesc;
1778	struct rtw_txsoft *ts;
1779
1780#ifdef RTW_DEBUG
1781	rtw_dump_rings(sc);
1782#endif
1783
1784	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1785		/* If we're clearing a failed transmission, only clear
1786		   up to the last packet the hardware has processed.  */
1787		if (ts->ts_first == rtw_txring_next(&sc->sc_regs, tdb))
1788			break;
1789
1790		ndesc = 1 + ts->ts_last - ts->ts_first;
1791		if (ts->ts_last < ts->ts_first)
1792			ndesc += tdb->tdb_ndesc;
1793
1794		KASSERT(ndesc > 0);
1795
1796		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1797		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1798
1799		if (force) {
1800			int next;
1801#ifdef RTW_DIAG
1802			printf("%s: clearing packet, stats", __func__);
1803#endif
1804			for (next = ts->ts_first; ;
1805			    next = RTW_NEXT_IDX(tdb, next)) {
1806#ifdef RTW_DIAG
1807				printf(" %" PRIx32 "/%" PRIx32 "/%" PRIx32 "/%" PRIu32 "/%" PRIx32, le32toh(tdb->tdb_desc[next].td_stat), le32toh(tdb->tdb_desc[next].td_ctl1), le32toh(tdb->tdb_desc[next].td_buf), le32toh(tdb->tdb_desc[next].td_len), le32toh(tdb->tdb_desc[next].td_next));
1808#endif
1809				tdb->tdb_desc[next].td_stat &=
1810				    ~htole32(RTW_TXSTAT_OWN);
1811				if (next == ts->ts_last)
1812					break;
1813			}
1814			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1815			    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1816#ifdef RTW_DIAG
1817			next = RTW_NEXT_IDX(tdb, next);
1818			printf(" -> end %u stat %" PRIx32 ", was %u\n", next,
1819			    le32toh(tdb->tdb_desc[next].td_stat),
1820			    rtw_txring_next(&sc->sc_regs, tdb));
1821#endif
1822		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1823		    htole32(RTW_TXSTAT_OWN)) != 0) {
1824			rtw_txdescs_sync(tdb, ts->ts_last, 1,
1825			    BUS_DMASYNC_PREREAD);
1826			break;
1827		}
1828
1829		collected = true;
1830
1831		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1832		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1833		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1834	}
1835
1836	/* no more pending transmissions, cancel watchdog */
1837	if (ts == NULL)
1838		tsb->tsb_tx_timer = 0;
1839	rtw_reset_oactive(sc);
1840
1841	return collected;
1842}
1843
1844static void
1845rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1846{
1847	int pri, s;
1848	struct rtw_txsoft_blk	*tsb;
1849	struct rtw_txdesc_blk	*tdb;
1850	struct ifnet *ifp = &sc->sc_if;
1851
1852	s = splnet();
1853
1854	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1855		tsb = &sc->sc_txsoft_blk[pri];
1856		tdb = &sc->sc_txdesc_blk[pri];
1857		rtw_collect_txring(sc, tsb, tdb, 0);
1858	}
1859
1860	if ((isr & RTW_INTR_TX) != 0)
1861		rtw_start(ifp); /* in softint */
1862
1863	splx(s);
1864}
1865
1866static void
1867rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1868{
1869	u_int next;
1870	uint32_t tsfth, tsftl;
1871	struct ieee80211com *ic;
1872	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1873	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1874	struct mbuf *m;
1875	int s;
1876
1877	s = splnet();
1878
1879	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1880	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1881
1882	if ((isr & (RTW_INTR_TBDOK | RTW_INTR_TBDER)) != 0) {
1883		next = rtw_txring_next(&sc->sc_regs, tdb);
1884#ifdef RTW_DEBUG
1885		RTW_DPRINTF(RTW_DEBUG_BEACON,
1886		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1887		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1888		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1889		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1890#else
1891		__USE(next);
1892		__USE(tsfth);
1893		__USE(tsftl);
1894#endif
1895		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0)
1896			rtw_collect_txring(sc, tsb, tdb, 1);
1897	}
1898	/* Start beacon transmission. */
1899
1900	if ((isr & RTW_INTR_BCNINT) != 0 &&
1901	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1902	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1903		RTW_DPRINTF(RTW_DEBUG_BEACON,
1904		    ("%s: beacon prep. time, isr = %#04" PRIx16
1905		     ", %16" PRIu64 "\n", __func__, isr,
1906		     (uint64_t)tsfth << 32 | tsftl));
1907		ic = &sc->sc_ic;
1908		m = rtw_beacon_alloc(sc, ic->ic_bss);
1909
1910		if (m == NULL) {
1911			aprint_error_dev(sc->sc_dev,
1912			    "could not allocate beacon\n");
1913			splx(s);
1914			return;
1915		}
1916		M_SETCTX(m, ieee80211_ref_node(ic->ic_bss));
1917		IF_ENQUEUE(&sc->sc_beaconq, m);
1918		rtw_start(&sc->sc_if); /* in softint */
1919	}
1920
1921	splx(s);
1922}
1923
1924static void
1925rtw_intr_atim(struct rtw_softc *sc)
1926{
1927	/* TBD */
1928	return;
1929}
1930
1931#ifdef RTW_DEBUG
1932static void
1933rtw_dump_rings(struct rtw_softc *sc)
1934{
1935	struct rtw_txdesc_blk *tdb;
1936	struct rtw_rxdesc *rd;
1937	struct rtw_rxdesc_blk *rdb;
1938	int desc, pri;
1939
1940	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1941		return;
1942
1943	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1944		tdb = &sc->sc_txdesc_blk[pri];
1945		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1946		    tdb->tdb_ndesc, tdb->tdb_nfree);
1947		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1948			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1949	}
1950
1951	rdb = &sc->sc_rxdesc_blk;
1952
1953	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1954		rd = &rdb->rdb_desc[desc];
1955		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1956		    "rsvd1/tsfth %08x\n", __func__,
1957		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1958		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1959		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1960	}
1961}
1962#endif /* RTW_DEBUG */
1963
1964static void
1965rtw_hwring_setup(struct rtw_softc *sc)
1966{
1967	int pri;
1968	struct rtw_regs *regs = &sc->sc_regs;
1969	struct rtw_txdesc_blk *tdb;
1970
1971	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1972	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1973	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1974	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1975	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1976	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1977	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1978	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1979
1980	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1981		tdb = &sc->sc_txdesc_blk[pri];
1982		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1983		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1984		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1985		     (uintptr_t)tdb->tdb_base));
1986	}
1987
1988	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1989
1990	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1991	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1992	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1993
1994	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1995
1996}
1997
1998static int
1999rtw_swring_setup(struct rtw_softc *sc)
2000{
2001	int rc;
2002	struct rtw_rxdesc_blk *rdb;
2003
2004	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
2005
2006	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
2007
2008	rdb = &sc->sc_rxdesc_blk;
2009	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
2010	     sc->sc_dev)) != 0 && rdb->rdb_ndesc == 0) {
2011		aprint_error_dev(sc->sc_dev, "could not allocate rx buffers\n");
2012		return rc;
2013	}
2014
2015	rdb = &sc->sc_rxdesc_blk;
2016	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
2017	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
2018	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
2019	rdb->rdb_next = 0;
2020
2021	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
2022	return 0;
2023}
2024
2025static void
2026rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
2027{
2028	int i;
2029
2030	(void)memset(tdb->tdb_desc, 0,
2031	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
2032	for (i = 0; i < tdb->tdb_ndesc; i++)
2033		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
2034}
2035
2036static u_int
2037rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
2038{
2039	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
2040	    sizeof(struct rtw_txdesc);
2041}
2042
2043#ifdef RTW_DIAG
2044static void
2045rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln)
2046{
2047	int pri;
2048	u_int next;
2049	struct rtw_txdesc_blk *tdb;
2050	struct rtw_regs *regs = &sc->sc_regs;
2051
2052	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2053		int i;
2054		tdb = &sc->sc_txdesc_blk[pri];
2055		next = rtw_txring_next(regs, tdb);
2056		if (tdb->tdb_next == next)
2057			continue;
2058		for (i = 0; next != tdb->tdb_next;
2059		    next = RTW_NEXT_IDX(tdb, next), i++) {
2060			if ((tdb->tdb_desc[next].td_stat & htole32(RTW_TXSTAT_OWN)) == 0)
2061				break;
2062		}
2063		printf("%s:%d: tx-ring %d expected next %u, read %u+%d -> %s\n", fn,
2064		    ln, pri, tdb->tdb_next, next, i, tdb->tdb_next == next ? "okay" : "BAD");
2065		if (tdb->tdb_next == next)
2066			continue;
2067		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
2068	}
2069}
2070#endif
2071
2072static void
2073rtw_txdescs_reset(struct rtw_softc *sc)
2074{
2075	int pri;
2076	struct rtw_txsoft_blk	*tsb;
2077	struct rtw_txdesc_blk	*tdb;
2078
2079	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2080		tsb = &sc->sc_txsoft_blk[pri];
2081		tdb = &sc->sc_txdesc_blk[pri];
2082		rtw_collect_txring(sc, tsb, tdb, 1);
2083#ifdef RTW_DIAG
2084		if (!SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
2085			printf("%s: packets left in ring %d\n", __func__, pri);
2086#endif
2087	}
2088}
2089
2090static void
2091rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2092{
2093	int s;
2094
2095	aprint_error_dev(sc->sc_dev, "tx fifo underflow\n");
2096
2097	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: cleaning up xmit, isr %" PRIx16
2098	    "\n", device_xname(sc->sc_dev), isr));
2099
2100	s = splnet();
2101
2102#ifdef RTW_DEBUG
2103	rtw_dump_rings(sc);
2104#endif /* RTW_DEBUG */
2105
2106	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2107	 * timeouts.
2108	 */
2109	rtw_txdescs_reset(sc);
2110
2111#ifdef RTW_DEBUG
2112	rtw_dump_rings(sc);
2113#endif /* RTW_DEBUG */
2114
2115	splx(s);
2116}
2117
2118static inline void
2119rtw_suspend_ticks(struct rtw_softc *sc)
2120{
2121	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2122	    ("%s: suspending ticks\n", device_xname(sc->sc_dev)));
2123	sc->sc_do_tick = 0;
2124}
2125
2126static inline void
2127rtw_resume_ticks(struct rtw_softc *sc)
2128{
2129	uint32_t tsftrl0, tsftrl1, next_tint;
2130
2131	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2132
2133	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2134	next_tint = tsftrl1 + 1000000;
2135	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tint);
2136
2137	sc->sc_do_tick = 1;
2138
2139#ifdef RTW_DEBUG
2140	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2141	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2142	    device_xname(sc->sc_dev), tsftrl1 - tsftrl0, tsftrl1, next_tint));
2143#else
2144	__USE(tsftrl0);
2145#endif
2146}
2147
2148static void
2149rtw_intr_timeout(struct rtw_softc *sc)
2150{
2151	int s;
2152
2153	s = splnet();
2154	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", device_xname(sc->sc_dev)));
2155	if (sc->sc_do_tick)
2156		rtw_resume_ticks(sc);
2157	splx(s);
2158}
2159
2160int
2161rtw_intr(void *arg)
2162{
2163	struct rtw_softc *sc = arg;
2164	struct rtw_regs *regs = &sc->sc_regs;
2165	uint16_t isr;
2166	struct ifnet *ifp = &sc->sc_if;
2167
2168	/*
2169	 * If the interface isn't running, the interrupt couldn't
2170	 * possibly have come from us.
2171	 */
2172	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2173	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER)) {
2174		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2175		    device_xname(sc->sc_dev)));
2176		return (0);
2177	}
2178
2179	isr = RTW_READ16(regs, RTW_ISR);
2180	if (isr == 0)
2181		return (0);
2182
2183	/* Disable interrupts. */
2184	RTW_WRITE16(regs, RTW_IMR, 0);
2185	RTW_WBW(regs, RTW_IMR, RTW_IMR);
2186
2187	softint_schedule(sc->sc_soft_ih);
2188	return (1);
2189}
2190
2191static void
2192rtw_softintr(void *arg)
2193{
2194	int i;
2195	struct rtw_softc *sc = arg;
2196	struct rtw_regs *regs = &sc->sc_regs;
2197	uint16_t isr;
2198	struct ifnet *ifp = &sc->sc_if;
2199
2200	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2201	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER)) {
2202		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2203		    device_xname(sc->sc_dev)));
2204		return;
2205	}
2206
2207	for (i = 0; i < 10; i++) {
2208		isr = RTW_READ16(regs, RTW_ISR);
2209
2210		RTW_WRITE16(regs, RTW_ISR, isr);
2211		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2212
2213		if (sc->sc_intr_ack != NULL)
2214			(*sc->sc_intr_ack)(regs);
2215
2216		if (isr == 0)
2217			break;
2218
2219#ifdef RTW_DEBUG
2220#define PRINTINTR(flag) do { \
2221	if ((isr & flag) != 0) { \
2222		printf("%s" #flag, delim); \
2223		delim = ","; \
2224	} \
2225} while (0)
2226
2227		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2228			const char *delim = "<";
2229
2230			printf("%s: reg[ISR] = %x", device_xname(sc->sc_dev),
2231			    isr);
2232
2233			PRINTINTR(RTW_INTR_TXFOVW);
2234			PRINTINTR(RTW_INTR_TIMEOUT);
2235			PRINTINTR(RTW_INTR_BCNINT);
2236			PRINTINTR(RTW_INTR_ATIMINT);
2237			PRINTINTR(RTW_INTR_TBDER);
2238			PRINTINTR(RTW_INTR_TBDOK);
2239			PRINTINTR(RTW_INTR_THPDER);
2240			PRINTINTR(RTW_INTR_THPDOK);
2241			PRINTINTR(RTW_INTR_TNPDER);
2242			PRINTINTR(RTW_INTR_TNPDOK);
2243			PRINTINTR(RTW_INTR_RXFOVW);
2244			PRINTINTR(RTW_INTR_RDU);
2245			PRINTINTR(RTW_INTR_TLPDER);
2246			PRINTINTR(RTW_INTR_TLPDOK);
2247			PRINTINTR(RTW_INTR_RER);
2248			PRINTINTR(RTW_INTR_ROK);
2249
2250			printf(">\n");
2251		}
2252#undef PRINTINTR
2253#endif /* RTW_DEBUG */
2254
2255		if ((isr & RTW_INTR_RX) != 0)
2256			rtw_intr_rx(sc, isr);
2257		if ((isr & RTW_INTR_TX) != 0)
2258			rtw_intr_tx(sc, isr);
2259		if ((isr & RTW_INTR_BEACON) != 0)
2260			rtw_intr_beacon(sc, isr);
2261		if ((isr & RTW_INTR_ATIMINT) != 0)
2262			rtw_intr_atim(sc);
2263		if ((isr & RTW_INTR_IOERROR) != 0)
2264			rtw_intr_ioerror(sc, isr);
2265		if ((isr & RTW_INTR_TIMEOUT) != 0)
2266			rtw_intr_timeout(sc);
2267	}
2268	if (i == 10)
2269		softint_schedule(sc->sc_soft_ih);
2270
2271	/* Re-enable interrupts */
2272	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2273	RTW_WBW(regs, RTW_IMR, RTW_IMR);
2274}
2275
2276/* Must be called at splnet. */
2277static void
2278rtw_stop(struct ifnet *ifp, int disable)
2279{
2280	int pri;
2281	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2282	struct ieee80211com *ic = &sc->sc_ic;
2283	struct rtw_regs *regs = &sc->sc_regs;
2284
2285	rtw_suspend_ticks(sc);
2286
2287	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2288
2289	if (device_has_power(sc->sc_dev)) {
2290		/* Disable interrupts. */
2291		RTW_WRITE16(regs, RTW_IMR, 0);
2292
2293		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2294
2295		/* Stop the transmit and receive processes. First stop DMA,
2296		 * then disable receiver and transmitter.
2297		 */
2298		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2299
2300		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2301
2302		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2303	}
2304
2305	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2306		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2307		    &sc->sc_txsoft_blk[pri]);
2308	}
2309
2310	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2311
2312	/* Mark the interface as not running.  Cancel the watchdog timer. */
2313	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2314	ifp->if_timer = 0;
2315
2316	if (disable)
2317		pmf_device_suspend(sc->sc_dev, &sc->sc_qual);
2318
2319	return;
2320}
2321
2322const char *
2323rtw_pwrstate_string(enum rtw_pwrstate power)
2324{
2325	switch (power) {
2326	case RTW_ON:
2327		return "on";
2328	case RTW_SLEEP:
2329		return "sleep";
2330	case RTW_OFF:
2331		return "off";
2332	default:
2333		return "unknown";
2334	}
2335}
2336
2337/* XXX For Maxim, I am using the RFMD settings gleaned from the
2338 * reference driver, plus a magic Maxim "ON" value that comes from
2339 * the Realtek document "Windows PG for Rtl8180."
2340 */
2341static void
2342rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2343    int before_rf, int digphy)
2344{
2345	uint32_t anaparm;
2346
2347	anaparm = RTW_READ(regs, RTW_ANAPARM);
2348	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2349
2350	switch (power) {
2351	case RTW_OFF:
2352		if (before_rf)
2353			return;
2354		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2355		anaparm |= RTW_ANAPARM_TXDACOFF;
2356		break;
2357	case RTW_SLEEP:
2358		if (!before_rf)
2359			return;
2360		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2361		anaparm |= RTW_ANAPARM_TXDACOFF;
2362		break;
2363	case RTW_ON:
2364		if (!before_rf)
2365			return;
2366		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2367		break;
2368	}
2369	RTW_DPRINTF(RTW_DEBUG_PWR,
2370	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2371	    __func__, rtw_pwrstate_string(power),
2372	    (before_rf) ? "before" : "after", anaparm));
2373
2374	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2375	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2376}
2377
2378/* XXX I am using the RFMD settings gleaned from the reference
2379 * driver.  They agree
2380 */
2381static void
2382rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2383    int before_rf, int digphy)
2384{
2385	uint32_t anaparm;
2386
2387	anaparm = RTW_READ(regs, RTW_ANAPARM);
2388	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2389
2390	switch (power) {
2391	case RTW_OFF:
2392		if (before_rf)
2393			return;
2394		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2395		anaparm |= RTW_ANAPARM_TXDACOFF;
2396		break;
2397	case RTW_SLEEP:
2398		if (!before_rf)
2399			return;
2400		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2401		anaparm |= RTW_ANAPARM_TXDACOFF;
2402		break;
2403	case RTW_ON:
2404		if (!before_rf)
2405			return;
2406		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2407		break;
2408	}
2409	RTW_DPRINTF(RTW_DEBUG_PWR,
2410	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2411	    __func__, rtw_pwrstate_string(power),
2412	    (before_rf) ? "before" : "after", anaparm));
2413
2414	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2415	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2416}
2417
2418static void
2419rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2420    int before_rf, int digphy)
2421{
2422	uint32_t anaparm;
2423
2424	anaparm = RTW_READ(regs, RTW_ANAPARM);
2425	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2426
2427	switch (power) {
2428	case RTW_OFF:
2429		if (before_rf)
2430			return;
2431		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2432		anaparm |= RTW_ANAPARM_TXDACOFF;
2433		break;
2434	case RTW_SLEEP:
2435		if (!before_rf)
2436			return;
2437		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2438		anaparm |= RTW_ANAPARM_TXDACOFF;
2439		break;
2440	case RTW_ON:
2441		if (!before_rf)
2442			return;
2443		if (digphy) {
2444			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2445			/* XXX guess */
2446			anaparm |= RTW_ANAPARM_TXDACOFF;
2447		} else
2448			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2449		break;
2450	}
2451	RTW_DPRINTF(RTW_DEBUG_PWR,
2452	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2453	    __func__, rtw_pwrstate_string(power),
2454	    (before_rf) ? "before" : "after", anaparm));
2455
2456	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2457	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2458}
2459
2460static void
2461rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2462    int digphy)
2463{
2464	struct rtw_regs *regs = &sc->sc_regs;
2465
2466	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2467
2468	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2469
2470	rtw_set_access(regs, RTW_ACCESS_NONE);
2471
2472	return;
2473}
2474
2475static int
2476rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2477{
2478	int rc;
2479
2480	RTW_DPRINTF(RTW_DEBUG_PWR,
2481	    ("%s: %s->%s\n", __func__,
2482	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2483
2484	if (sc->sc_pwrstate == power)
2485		return 0;
2486
2487	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2488	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2489	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2490
2491	switch (power) {
2492	case RTW_ON:
2493		/* TBD set LEDs */
2494		break;
2495	case RTW_SLEEP:
2496		/* TBD */
2497		break;
2498	case RTW_OFF:
2499		/* TBD */
2500		break;
2501	}
2502	if (rc == 0)
2503		sc->sc_pwrstate = power;
2504	else
2505		sc->sc_pwrstate = RTW_OFF;
2506	return rc;
2507}
2508
2509static int
2510rtw_tune(struct rtw_softc *sc)
2511{
2512	struct ieee80211com *ic = &sc->sc_ic;
2513	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2514	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2515	u_int chan;
2516	int rc;
2517	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2518	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2519
2520	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2521	KASSERT(chan != IEEE80211_CHAN_ANY);
2522
2523	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2524	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2525
2526	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2527	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2528
2529	if (chan == sc->sc_cur_chan) {
2530		RTW_DPRINTF(RTW_DEBUG_TUNE,
2531		    ("%s: already tuned chan #%d\n", __func__, chan));
2532		return 0;
2533	}
2534
2535	rtw_suspend_ticks(sc);
2536
2537	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2538
2539	/* TBD wait for Tx to complete */
2540
2541	KASSERT(device_has_power(sc->sc_dev));
2542
2543	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2544	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2545	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2546		/* XXX condition on powersaving */
2547		aprint_error_dev(sc->sc_dev, "phy init failed\n");
2548	}
2549
2550	sc->sc_cur_chan = chan;
2551
2552	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2553
2554	rtw_resume_ticks(sc);
2555
2556	return rc;
2557}
2558
2559bool
2560rtw_suspend(device_t self, const pmf_qual_t *qual)
2561{
2562	int rc;
2563	struct rtw_softc *sc = device_private(self);
2564
2565	sc->sc_flags &= ~RTW_F_DK_VALID;
2566
2567	if (!device_has_power(self))
2568		return false;
2569
2570	/* turn off PHY */
2571	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2572		aprint_error_dev(self, "failed to turn off PHY (%d)\n", rc);
2573		return false;
2574	}
2575
2576	rtw_disable_interrupts(&sc->sc_regs);
2577
2578	return true;
2579}
2580
2581bool
2582rtw_resume(device_t self, const pmf_qual_t *qual)
2583{
2584	struct rtw_softc *sc = device_private(self);
2585
2586	/* Power may have been removed, resetting WEP keys.
2587	 */
2588	sc->sc_flags &= ~RTW_F_DK_VALID;
2589	rtw_enable_interrupts(sc);
2590
2591	return true;
2592}
2593
2594static void
2595rtw_transmit_config(struct rtw_regs *regs)
2596{
2597	uint32_t tcr;
2598
2599	tcr = RTW_READ(regs, RTW_TCR);
2600
2601	tcr |= RTW_TCR_CWMIN;
2602	tcr &= ~RTW_TCR_MXDMA_MASK;
2603	tcr |= RTW_TCR_MXDMA_256;
2604	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2605	tcr &= ~RTW_TCR_LBK_MASK;
2606	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2607
2608	/* set short/long retry limits */
2609	tcr &= ~(RTW_TCR_SRL_MASK | RTW_TCR_LRL_MASK);
2610	tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2611
2612	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2613
2614	RTW_WRITE(regs, RTW_TCR, tcr);
2615	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2616}
2617
2618static void
2619rtw_disable_interrupts(struct rtw_regs *regs)
2620{
2621	RTW_WRITE16(regs, RTW_IMR, 0);
2622	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2623	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2624	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2625}
2626
2627static void
2628rtw_enable_interrupts(struct rtw_softc *sc)
2629{
2630	struct rtw_regs *regs = &sc->sc_regs;
2631
2632	sc->sc_inten = RTW_INTR_RX | RTW_INTR_TX | RTW_INTR_BEACON
2633	    | RTW_INTR_ATIMINT;
2634	sc->sc_inten |= RTW_INTR_IOERROR | RTW_INTR_TIMEOUT;
2635
2636	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2637	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2638	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2639	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2640
2641	/* XXX necessary? */
2642	if (sc->sc_intr_ack != NULL)
2643		(*sc->sc_intr_ack)(regs);
2644}
2645
2646static void
2647rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2648{
2649	uint8_t msr;
2650
2651	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2652	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2653
2654	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2655
2656	switch (opmode) {
2657	case IEEE80211_M_AHDEMO:
2658	case IEEE80211_M_IBSS:
2659		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2660		break;
2661	case IEEE80211_M_HOSTAP:
2662		msr |= RTW_MSR_NETYPE_AP_OK;
2663		break;
2664	case IEEE80211_M_MONITOR:
2665		/* XXX */
2666		msr |= RTW_MSR_NETYPE_NOLINK;
2667		break;
2668	case IEEE80211_M_STA:
2669		msr |= RTW_MSR_NETYPE_INFRA_OK;
2670		break;
2671	}
2672	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2673
2674	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2675}
2676
2677#define	rtw_calchash(addr) \
2678	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2679
2680static void
2681rtw_pktfilt_load(struct rtw_softc *sc)
2682{
2683	struct rtw_regs *regs = &sc->sc_regs;
2684	struct ieee80211com *ic = &sc->sc_ic;
2685	struct ethercom *ec = &sc->sc_ec;
2686	struct ifnet *ifp = &sc->sc_if;
2687	int hash;
2688	uint32_t hashes[2] = { 0, 0 };
2689	struct ether_multi *enm;
2690	struct ether_multistep step;
2691
2692	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2693
2694	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2695	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2696
2697	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2698	/* MAC auto-reset PHY (huh?) */
2699	sc->sc_rcr |= RTW_RCR_ENMARP;
2700	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2701	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2702
2703	switch (ic->ic_opmode) {
2704	case IEEE80211_M_MONITOR:
2705		sc->sc_rcr |= RTW_RCR_MONITOR;
2706		break;
2707	case IEEE80211_M_AHDEMO:
2708	case IEEE80211_M_IBSS:
2709		/* receive broadcasts in our BSS */
2710		sc->sc_rcr |= RTW_RCR_ADD3;
2711		break;
2712	default:
2713		break;
2714	}
2715
2716	ifp->if_flags &= ~IFF_ALLMULTI;
2717
2718	/*
2719	 * Program the 64-bit multicast hash filter.
2720	 */
2721	ETHER_FIRST_MULTI(step, ec, enm);
2722	while (enm != NULL) {
2723		/* XXX */
2724		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2725		    ETHER_ADDR_LEN) != 0) {
2726			ifp->if_flags |= IFF_ALLMULTI;
2727			break;
2728		}
2729
2730		hash = rtw_calchash(enm->enm_addrlo);
2731		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2732		ETHER_NEXT_MULTI(step, enm);
2733	}
2734
2735	/* XXX accept all broadcast if scanning */
2736	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2737		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2738
2739	if (ifp->if_flags & IFF_PROMISC) {
2740		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2741		sc->sc_rcr |= RTW_RCR_ACRC32;	/* accept frames failing CRC */
2742		sc->sc_rcr |= RTW_RCR_AICV;	/* accept frames failing ICV */
2743		ifp->if_flags |= IFF_ALLMULTI;
2744	}
2745
2746	if (ifp->if_flags & IFF_ALLMULTI)
2747		hashes[0] = hashes[1] = 0xffffffff;
2748
2749	if ((hashes[0] | hashes[1]) != 0)
2750		sc->sc_rcr |= RTW_RCR_AM;	/* accept multicast */
2751
2752	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2753	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2754	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2755	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2756
2757	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2758	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2759	    device_xname(sc->sc_dev), RTW_READ(regs, RTW_MAR0),
2760	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2761}
2762
2763static struct mbuf *
2764rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2765{
2766	struct ieee80211com *ic = &sc->sc_ic;
2767	struct mbuf *m;
2768	struct ieee80211_beacon_offsets	boff;
2769
2770	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2771		RTW_DPRINTF(RTW_DEBUG_BEACON,
2772		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2773	}
2774	return m;
2775}
2776
2777/* Must be called at splnet. */
2778static int
2779rtw_init(struct ifnet *ifp)
2780{
2781	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2782	struct ieee80211com *ic = &sc->sc_ic;
2783	struct rtw_regs *regs = &sc->sc_regs;
2784	int rc;
2785
2786	if (device_is_active(sc->sc_dev)) {
2787		/* Cancel pending I/O and reset. */
2788		rtw_stop(ifp, 0);
2789	} else if (!pmf_device_resume(sc->sc_dev, &sc->sc_qual) ||
2790	           !device_is_active(sc->sc_dev))
2791		return 0;
2792
2793	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2794	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2795	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2796
2797	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2798		goto out;
2799
2800	if ((rc = rtw_swring_setup(sc)) != 0)
2801		goto out;
2802
2803	rtw_transmit_config(regs);
2804
2805	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2806
2807	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2808	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2809
2810	/* long PLCP header, 1Mb/2Mb basic rate */
2811	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2812	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2813
2814	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2815	rtw_set_access(regs, RTW_ACCESS_NONE);
2816
2817	/* XXX from reference sources */
2818	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2819	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2820
2821	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev);
2822
2823	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2824	/* from Linux driver */
2825	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2826
2827	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2828
2829	rtw_enable_interrupts(sc);
2830
2831	rtw_pktfilt_load(sc);
2832
2833	rtw_hwring_setup(sc);
2834
2835	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2836
2837	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2838
2839	ifp->if_flags |= IFF_RUNNING;
2840	ic->ic_state = IEEE80211_S_INIT;
2841
2842	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2843	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2844
2845	rtw_resume_ticks(sc);
2846
2847	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2848
2849	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2850		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2851	else
2852		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2853
2854out:
2855	aprint_error_dev(sc->sc_dev, "interface not running\n");
2856	return rc;
2857}
2858
2859static inline void
2860rtw_led_init(struct rtw_regs *regs)
2861{
2862	uint8_t cfg0, cfg1;
2863
2864	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2865
2866	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2867	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2868	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2869
2870	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2871	RTW_DPRINTF(RTW_DEBUG_LED,
2872	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2873
2874	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2875	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2876	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2877
2878	rtw_set_access(regs, RTW_ACCESS_NONE);
2879}
2880
2881/*
2882 * IEEE80211_S_INIT: 		LED1 off
2883 *
2884 * IEEE80211_S_AUTH,
2885 * IEEE80211_S_ASSOC,
2886 * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2887 *
2888 * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2889 */
2890static void
2891rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2892{
2893	struct rtw_led_state *ls;
2894
2895	ls = &sc->sc_led_state;
2896
2897	switch (nstate) {
2898	case IEEE80211_S_INIT:
2899		rtw_led_init(&sc->sc_regs);
2900		aprint_debug_dev(sc->sc_dev, "stopping blink\n");
2901		callout_stop(&ls->ls_slow_ch);
2902		callout_stop(&ls->ls_fast_ch);
2903		ls->ls_slowblink = 0;
2904		ls->ls_actblink = 0;
2905		ls->ls_default = 0;
2906		break;
2907	case IEEE80211_S_SCAN:
2908		aprint_debug_dev(sc->sc_dev, "scheduling blink\n");
2909		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2910		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2911		/*FALLTHROUGH*/
2912	case IEEE80211_S_AUTH:
2913	case IEEE80211_S_ASSOC:
2914		ls->ls_default = RTW_LED1;
2915		ls->ls_actblink = RTW_LED1;
2916		ls->ls_slowblink = RTW_LED1;
2917		break;
2918	case IEEE80211_S_RUN:
2919		ls->ls_slowblink = 0;
2920		break;
2921	}
2922	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2923}
2924
2925static void
2926rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2927{
2928	uint8_t led_condition;
2929	bus_size_t ofs;
2930	uint8_t mask, newval, val;
2931
2932	led_condition = ls->ls_default;
2933
2934	if (ls->ls_state & RTW_LED_S_SLOW)
2935		led_condition ^= ls->ls_slowblink;
2936	if (ls->ls_state & (RTW_LED_S_RX | RTW_LED_S_TX))
2937		led_condition ^= ls->ls_actblink;
2938
2939	RTW_DPRINTF(RTW_DEBUG_LED,
2940	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2941
2942	switch (hwverid) {
2943	default:
2944	case 'F':
2945		ofs = RTW_PSR;
2946		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2947		if (led_condition & RTW_LED0)
2948			newval &= ~RTW_PSR_LEDGPO0;
2949		if (led_condition & RTW_LED1)
2950			newval &= ~RTW_PSR_LEDGPO1;
2951		break;
2952	case 'D':
2953		ofs = RTW_9346CR;
2954		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2955		newval = RTW_9346CR_EEM_PROGRAM;
2956		if (led_condition & RTW_LED0)
2957			newval |= RTW_9346CR_EEDI;
2958		if (led_condition & RTW_LED1)
2959			newval |= RTW_9346CR_EECS;
2960		break;
2961	}
2962	val = RTW_READ8(regs, ofs);
2963	RTW_DPRINTF(RTW_DEBUG_LED,
2964	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2965	     (uintptr_t)ofs));
2966	val &= ~mask;
2967	val |= newval;
2968	RTW_WRITE8(regs, ofs, val);
2969	RTW_DPRINTF(RTW_DEBUG_LED,
2970	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2971	     (uintptr_t)ofs));
2972	RTW_SYNC(regs, ofs, ofs);
2973}
2974
2975static void
2976rtw_led_fastblink(void *arg)
2977{
2978	int ostate, s;
2979	struct rtw_softc *sc = (struct rtw_softc *)arg;
2980	struct rtw_led_state *ls = &sc->sc_led_state;
2981
2982	s = splnet();
2983	ostate = ls->ls_state;
2984	ls->ls_state ^= ls->ls_event;
2985
2986	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2987		ls->ls_state &= ~RTW_LED_S_TX;
2988
2989	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2990		ls->ls_state &= ~RTW_LED_S_RX;
2991
2992	ls->ls_event = 0;
2993
2994	if (ostate != ls->ls_state)
2995		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2996	splx(s);
2997
2998	aprint_debug_dev(sc->sc_dev, "scheduling fast blink\n");
2999	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
3000}
3001
3002static void
3003rtw_led_slowblink(void *arg)
3004{
3005	int s;
3006	struct rtw_softc *sc = (struct rtw_softc *)arg;
3007	struct rtw_led_state *ls = &sc->sc_led_state;
3008
3009	s = splnet();
3010	ls->ls_state ^= RTW_LED_S_SLOW;
3011	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
3012	splx(s);
3013	aprint_debug_dev(sc->sc_dev, "scheduling slow blink\n");
3014	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
3015}
3016
3017static void
3018rtw_led_detach(struct rtw_led_state *ls)
3019{
3020	callout_destroy(&ls->ls_fast_ch);
3021	callout_destroy(&ls->ls_slow_ch);
3022}
3023
3024static void
3025rtw_led_attach(struct rtw_led_state *ls, void *arg)
3026{
3027	callout_init(&ls->ls_fast_ch, 0);
3028	callout_init(&ls->ls_slow_ch, 0);
3029	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
3030	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
3031}
3032
3033static int
3034rtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
3035{
3036	int rc = 0, s;
3037	struct rtw_softc *sc = ifp->if_softc;
3038
3039	s = splnet();
3040	if (cmd == SIOCSIFFLAGS) {
3041		if ((rc = ifioctl_common(ifp, cmd, data)) != 0)
3042			;
3043		else switch (ifp->if_flags & (IFF_UP | IFF_RUNNING)) {
3044		case IFF_UP:
3045			rc = rtw_init(ifp);
3046			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3047			break;
3048		case IFF_UP | IFF_RUNNING:
3049			if (device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
3050				rtw_pktfilt_load(sc);
3051			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3052			break;
3053		case IFF_RUNNING:
3054			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3055			rtw_stop(ifp, 1);
3056			break;
3057		default:
3058			break;
3059		}
3060	} else if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
3061		;	/* nothing to do */
3062	else if (cmd == SIOCADDMULTI || cmd == SIOCDELMULTI) {
3063		/* reload packet filter if running */
3064		if (ifp->if_flags & IFF_RUNNING)
3065			rtw_pktfilt_load(sc);
3066		rc = 0;
3067	} else if ((ifp->if_flags & IFF_UP) != 0)
3068		rc = rtw_init(ifp);
3069	else
3070		rc = 0;
3071	splx(s);
3072	return rc;
3073}
3074
3075/* Select a transmit ring with at least one h/w and s/w descriptor free.
3076 * Return 0 on success, -1 on failure.
3077 */
3078static inline int
3079rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
3080    struct rtw_txdesc_blk **tdbp, int pri)
3081{
3082	struct rtw_txsoft_blk *tsb;
3083	struct rtw_txdesc_blk *tdb;
3084
3085	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
3086
3087	tsb = &sc->sc_txsoft_blk[pri];
3088	tdb = &sc->sc_txdesc_blk[pri];
3089
3090	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
3091		if (tsb->tsb_tx_timer == 0)
3092			tsb->tsb_tx_timer = 5;
3093		*tsbp = NULL;
3094		*tdbp = NULL;
3095		return -1;
3096	}
3097	*tsbp = tsb;
3098	*tdbp = tdb;
3099	return 0;
3100}
3101
3102static inline struct mbuf *
3103rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3104    struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3105    struct ieee80211_node **nip, short *if_flagsp)
3106{
3107	struct mbuf *m;
3108
3109	if (IF_IS_EMPTY(ifq))
3110		return NULL;
3111	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3112		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3113		    __func__, pri));
3114		*if_flagsp |= IFF_OACTIVE;
3115		sc->sc_if.if_timer = 1;
3116		return NULL;
3117	}
3118	IF_DEQUEUE(ifq, m);
3119	*nip = M_GETCTX(m, struct ieee80211_node *);
3120	M_SETCTX(m, NULL);
3121	KASSERT(*nip != NULL);
3122	return m;
3123}
3124
3125/* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3126 * at the driver's selection of transmit control block for the packet.
3127 */
3128static inline int
3129rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3130    struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3131    struct ieee80211_node **nip)
3132{
3133	int pri;
3134	struct ether_header *eh;
3135	struct mbuf *m0;
3136	struct rtw_softc *sc;
3137	short *if_flagsp;
3138
3139	*mp = NULL;
3140
3141	sc = (struct rtw_softc *)ifp->if_softc;
3142
3143	DPRINTF(sc, RTW_DEBUG_XMIT,
3144	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3145
3146	if_flagsp = &ifp->if_flags;
3147
3148	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3149	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3150		                     tdbp, nip, if_flagsp)) != NULL) {
3151		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3152		    __func__));
3153		return 0;
3154	}
3155
3156	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3157		                     tdbp, nip, if_flagsp)) != NULL) {
3158		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3159		    __func__));
3160		return 0;
3161	}
3162
3163	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3164		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3165		return 0;
3166	}
3167
3168	IFQ_POLL(&ifp->if_snd, m0);
3169	if (m0 == NULL) {
3170		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3171		    __func__));
3172		return 0;
3173	}
3174
3175	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3176
3177	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3178		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3179		    __func__, pri));
3180		*if_flagsp |= IFF_OACTIVE;
3181		sc->sc_if.if_timer = 1;
3182		return 0;
3183	}
3184
3185	IFQ_DEQUEUE(&ifp->if_snd, m0);
3186	if (m0 == NULL) {
3187		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3188		    __func__));
3189		return 0;
3190	}
3191	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3192	ifp->if_opackets++;
3193	bpf_mtap(ifp, m0, BPF_D_OUT);
3194	eh = mtod(m0, struct ether_header *);
3195	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3196	if (*nip == NULL) {
3197		/* NB: ieee80211_find_txnode does stat+msg */
3198		m_freem(m0);
3199		return -1;
3200	}
3201	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3202		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3203		ifp->if_oerrors++;
3204		return -1;
3205	}
3206	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3207	*mp = m0;
3208	return 0;
3209}
3210
3211static int
3212rtw_seg_too_short(bus_dmamap_t dmamap)
3213{
3214	int i;
3215	for (i = 0; i < dmamap->dm_nsegs; i++) {
3216		if (dmamap->dm_segs[i].ds_len < 4)
3217			return 1;
3218	}
3219	return 0;
3220}
3221
3222/* TBD factor with atw_start */
3223static struct mbuf *
3224rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3225    u_int ndescfree, device_t dev)
3226{
3227	int first, rc;
3228	struct mbuf *m, *m0;
3229
3230	m0 = chain;
3231
3232	/*
3233	 * Load the DMA map.  Copy and try (once) again if the packet
3234	 * didn't fit in the alloted number of segments.
3235	 */
3236	for (first = 1;
3237	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3238			  BUS_DMA_WRITE | BUS_DMA_NOWAIT)) != 0 ||
3239	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3240	     first = 0) {
3241		if (rc == 0) {
3242#ifdef RTW_DIAGxxx
3243			if (rtw_seg_too_short(dmam)) {
3244				printf("%s: short segment, mbuf lengths:", __func__);
3245				for (m = m0; m; m = m->m_next)
3246					printf(" %d", m->m_len);
3247				printf("\n");
3248			}
3249#endif
3250			bus_dmamap_unload(dmat, dmam);
3251		}
3252		MGETHDR(m, M_DONTWAIT, MT_DATA);
3253		if (m == NULL) {
3254			aprint_error_dev(dev, "unable to allocate Tx mbuf\n");
3255			break;
3256		}
3257		if (m0->m_pkthdr.len > MHLEN) {
3258			MCLGET(m, M_DONTWAIT);
3259			if ((m->m_flags & M_EXT) == 0) {
3260				aprint_error_dev(dev,
3261				    "cannot allocate Tx cluster\n");
3262				m_freem(m);
3263				break;
3264			}
3265		}
3266		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3267		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3268		m_freem(m0);
3269		m0 = m;
3270		m = NULL;
3271	}
3272	if (rc != 0) {
3273		aprint_error_dev(dev, "cannot load Tx buffer, rc = %d\n", rc);
3274		m_freem(m0);
3275		return NULL;
3276	} else if (rtw_seg_too_short(dmam)) {
3277		aprint_error_dev(dev,
3278		    "cannot load Tx buffer, segment too short\n");
3279		bus_dmamap_unload(dmat, dmam);
3280		m_freem(m0);
3281		return NULL;
3282	} else if (dmam->dm_nsegs > ndescfree) {
3283		aprint_error_dev(dev, "too many tx segments\n");
3284		bus_dmamap_unload(dmat, dmam);
3285		m_freem(m0);
3286		return NULL;
3287	}
3288	return m0;
3289}
3290
3291#ifdef RTW_DEBUG
3292static void
3293rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3294    struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3295{
3296	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3297	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3298	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3299	    device_xname(sc->sc_dev), ts, action, desc,
3300	    le32toh(td->td_buf), le32toh(td->td_next),
3301	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3302	    le32toh(td->td_len)));
3303}
3304#endif /* RTW_DEBUG */
3305
3306static void
3307rtw_start(struct ifnet *ifp)
3308{
3309	int desc, i, lastdesc, npkt, rate;
3310	uint32_t proto_ctl0, ctl0, ctl1;
3311	bus_dmamap_t		dmamap;
3312	struct ieee80211com	*ic;
3313	struct ieee80211_duration *d0;
3314	struct ieee80211_frame_min	*wh;
3315	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3316	struct mbuf		*m0;
3317	struct rtw_softc	*sc;
3318	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3319	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3320	struct rtw_txsoft	*ts;
3321	struct rtw_txdesc	*td;
3322	struct ieee80211_key	*k;
3323
3324	sc = (struct rtw_softc *)ifp->if_softc;
3325	ic = &sc->sc_ic;
3326
3327	DPRINTF(sc, RTW_DEBUG_XMIT,
3328	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3329
3330	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
3331		goto out;
3332
3333	/* XXX do real rate control */
3334	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3335
3336	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3337		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3338
3339	for (;;) {
3340		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3341			continue;
3342		if (m0 == NULL)
3343			break;
3344
3345		wh = mtod(m0, struct ieee80211_frame_min *);
3346
3347		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3348		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3349			m_freem(m0);
3350			break;
3351		} else
3352			k = NULL;
3353
3354		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3355
3356		dmamap = ts->ts_dmamap;
3357
3358		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3359		    tdb->tdb_nfree, sc->sc_dev);
3360
3361		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3362			DPRINTF(sc, RTW_DEBUG_XMIT,
3363			    ("%s: fail dmamap load\n", __func__));
3364			goto post_dequeue_err;
3365		}
3366
3367		/* Note well: rtw_dmamap_load_txbuf may have created
3368		 * a new chain, so we must find the header once
3369		 * more.
3370		 */
3371		wh = mtod(m0, struct ieee80211_frame_min *);
3372
3373		/* XXX do real rate control */
3374		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3375		    IEEE80211_FC0_TYPE_MGT)
3376			rate = 2;
3377		else
3378			rate = MAX(2, ieee80211_get_rate(ni));
3379
3380#ifdef RTW_DEBUG
3381		if ((ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==
3382		    (IFF_DEBUG | IFF_LINK2)) {
3383			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3384			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3385			                            : sizeof(wh),
3386			    rate, 0);
3387		}
3388#endif /* RTW_DEBUG */
3389		ctl0 = proto_ctl0 |
3390		    __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3391
3392		switch (rate) {
3393		default:
3394		case 2:
3395			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3396			break;
3397		case 4:
3398			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3399			break;
3400		case 11:
3401			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3402			break;
3403		case 22:
3404			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3405			break;
3406		}
3407		/* XXX >= ? Compare after fragmentation? */
3408		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3409			ctl0 |= RTW_TXCTL0_RTSEN;
3410
3411                /* XXX Sometimes writes a bogus keyid; h/w doesn't
3412                 * seem to care, since we don't activate h/w Tx
3413                 * encryption.
3414		 */
3415		if (k != NULL &&
3416		    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
3417			ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3418			    RTW_TXCTL0_KEYID_MASK;
3419		}
3420
3421		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3422		    IEEE80211_FC0_TYPE_MGT) {
3423			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3424			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3425			    IEEE80211_FC0_SUBTYPE_BEACON)
3426				ctl0 |= RTW_TXCTL0_BEACON;
3427		}
3428
3429		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3430		    ic->ic_flags, ic->ic_fragthreshold,
3431		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3432		    (ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==
3433		    (IFF_DEBUG | IFF_LINK2)) == -1) {
3434			DPRINTF(sc, RTW_DEBUG_XMIT,
3435			    ("%s: fail compute duration\n", __func__));
3436			goto post_load_err;
3437		}
3438
3439		d0 = &ts->ts_d0;
3440
3441		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3442
3443		ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3444		    __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3445
3446		if (d0->d_residue)
3447			ctl1 |= RTW_TXCTL1_LENGEXT;
3448
3449		/* TBD fragmentation */
3450
3451		ts->ts_first = tdb->tdb_next;
3452
3453		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3454		    BUS_DMASYNC_PREWRITE);
3455
3456		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3457
3458		bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
3459
3460		if (sc->sc_radiobpf != NULL) {
3461			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3462
3463			rt->rt_rate = rate;
3464
3465			bpf_mtap2(sc->sc_radiobpf, rt, sizeof(sc->sc_txtapu),
3466			    m0, BPF_D_OUT);
3467		}
3468
3469		for (i = 0, lastdesc = desc = ts->ts_first;
3470		     i < dmamap->dm_nsegs;
3471		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3472			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3473				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3474				    ("%s: seg too long\n", __func__));
3475				goto post_load_err;
3476			}
3477			td = &tdb->tdb_desc[desc];
3478			td->td_ctl0 = htole32(ctl0);
3479			td->td_ctl1 = htole32(ctl1);
3480			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3481			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3482			td->td_next = htole32(RTW_NEXT_DESC(tdb, desc));
3483			if (i != 0)
3484				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3485			lastdesc = desc;
3486#ifdef RTW_DEBUG
3487			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3488#endif /* RTW_DEBUG */
3489		}
3490
3491		KASSERT(desc < tdb->tdb_ndesc);
3492
3493		ts->ts_ni = ni;
3494		KASSERT(ni != NULL);
3495		ts->ts_mbuf = m0;
3496		ts->ts_last = lastdesc;
3497		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3498		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3499		   htole32(RTW_TXCTL0_FS);
3500
3501#ifdef RTW_DEBUG
3502		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3503		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3504#endif /* RTW_DEBUG */
3505
3506		tdb->tdb_nfree -= dmamap->dm_nsegs;
3507		tdb->tdb_next = desc;
3508
3509		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3510		    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
3511
3512		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3513		    htole32(RTW_TXCTL0_OWN);
3514
3515#ifdef RTW_DEBUG
3516		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3517#endif /* RTW_DEBUG */
3518
3519		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3520		    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
3521
3522		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3523		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3524
3525		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3526			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3527		tsb->tsb_tx_timer = 5;
3528		ifp->if_timer = 1;
3529		rtw_tx_kick(&sc->sc_regs, tsb->tsb_poll);
3530	}
3531out:
3532	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3533	return;
3534post_load_err:
3535	bus_dmamap_unload(sc->sc_dmat, dmamap);
3536	m_freem(m0);
3537post_dequeue_err:
3538	ieee80211_free_node(ni);
3539	return;
3540}
3541
3542static void
3543rtw_idle(struct rtw_regs *regs)
3544{
3545	int active;
3546	uint8_t tppoll;
3547
3548	/* request stop DMA; wait for packets to stop transmitting. */
3549
3550	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3551	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3552
3553	for (active = 0; active < 300 &&
3554	     (tppoll = RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0;
3555	     active++)
3556		DELAY(10);
3557	printf("%s: transmit DMA idle in %dus, tppoll %02" PRIx8 "\n", __func__,
3558	    active * 10, tppoll);
3559}
3560
3561static void
3562rtw_watchdog(struct ifnet *ifp)
3563{
3564	int pri, tx_timeouts = 0;
3565	struct rtw_softc *sc;
3566	struct rtw_txsoft_blk *tsb;
3567
3568	sc = ifp->if_softc;
3569
3570	ifp->if_timer = 0;
3571
3572	if (!device_is_active(sc->sc_dev))
3573		return;
3574
3575	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3576		tsb = &sc->sc_txsoft_blk[pri];
3577
3578		if (tsb->tsb_tx_timer == 0)
3579			continue;
3580		else if (--tsb->tsb_tx_timer == 0) {
3581			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3582				continue;
3583			else if (rtw_collect_txring(sc, tsb,
3584			    &sc->sc_txdesc_blk[pri], 0))
3585				continue;
3586			printf("%s: transmit timeout, priority %d\n",
3587			    ifp->if_xname, pri);
3588			ifp->if_oerrors++;
3589			if (pri != RTW_TXPRIBCN)
3590				tx_timeouts++;
3591		} else
3592			ifp->if_timer = 1;
3593	}
3594
3595	if (tx_timeouts > 0) {
3596		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3597		 * reset s/w tx-ring pointers, and start transmission.
3598		 *
3599		 * TBD Stop/restart just the broken rings?
3600		 */
3601		rtw_idle(&sc->sc_regs);
3602		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
3603		rtw_txdescs_reset(sc);
3604		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3605		rtw_start(ifp);
3606	}
3607	ieee80211_watchdog(&sc->sc_ic);
3608	return;
3609}
3610
3611static void
3612rtw_next_scan(void *arg)
3613{
3614	struct ieee80211com *ic = arg;
3615	int s;
3616
3617	/* don't call rtw_start w/o network interrupts blocked */
3618	s = splnet();
3619	if (ic->ic_state == IEEE80211_S_SCAN)
3620		ieee80211_next_scan(ic);
3621	splx(s);
3622}
3623
3624static void
3625rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3626{
3627	uint16_t bcnitv, bintritv, intval;
3628	int i;
3629	struct rtw_regs *regs = &sc->sc_regs;
3630
3631	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3632		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3633
3634	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3635
3636	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3637
3638	intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3639
3640	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3641	bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3642	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3643	/* interrupt host 1ms before the TBTT */
3644	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3645	bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3646	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3647	/* magic from Linux */
3648	RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3649	RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3650	rtw_set_access(regs, RTW_ACCESS_NONE);
3651
3652	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3653}
3654
3655/* Synchronize the hardware state with the software state. */
3656static int
3657rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3658{
3659	struct ifnet *ifp = ic->ic_ifp;
3660	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3661	enum ieee80211_state ostate;
3662	int error;
3663
3664	ostate = ic->ic_state;
3665
3666	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3667	rtw_led_newstate(sc, nstate);
3668
3669	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3670	if (nstate == IEEE80211_S_INIT) {
3671		callout_stop(&sc->sc_scan_ch);
3672		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3673		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3674	}
3675
3676	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3677		rtw_pwrstate(sc, RTW_ON);
3678
3679	if ((error = rtw_tune(sc)) != 0)
3680		return error;
3681
3682	switch (nstate) {
3683	case IEEE80211_S_INIT:
3684		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3685		break;
3686	case IEEE80211_S_SCAN:
3687		if (ostate != IEEE80211_S_SCAN) {
3688			(void)memset(ic->ic_bss->ni_bssid, 0,
3689			    IEEE80211_ADDR_LEN);
3690			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3691		}
3692
3693		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3694		    rtw_next_scan, ic);
3695
3696		break;
3697	case IEEE80211_S_RUN:
3698		switch (ic->ic_opmode) {
3699		case IEEE80211_M_HOSTAP:
3700		case IEEE80211_M_IBSS:
3701			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3702			/*FALLTHROUGH*/
3703		case IEEE80211_M_AHDEMO:
3704		case IEEE80211_M_STA:
3705			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3706			    ic->ic_bss->ni_intval);
3707			break;
3708		case IEEE80211_M_MONITOR:
3709			break;
3710		}
3711		rtw_set_nettype(sc, ic->ic_opmode);
3712		break;
3713	case IEEE80211_S_ASSOC:
3714	case IEEE80211_S_AUTH:
3715		break;
3716	}
3717
3718	if (nstate != IEEE80211_S_SCAN)
3719		callout_stop(&sc->sc_scan_ch);
3720
3721	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3722}
3723
3724/* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3725static uint64_t
3726rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3727{
3728	uint32_t tsftl, tsfth;
3729
3730	tsfth = RTW_READ(regs, RTW_TSFTRH);
3731	tsftl = RTW_READ(regs, RTW_TSFTRL);
3732	if (tsftl < rstamp)	/* Compensate for rollover. */
3733		tsfth--;
3734	return ((uint64_t)tsfth << 32) | rstamp;
3735}
3736
3737static void
3738rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3739    struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3740{
3741	struct ifnet *ifp = ic->ic_ifp;
3742	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3743
3744	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3745
3746	switch (subtype) {
3747	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3748	case IEEE80211_FC0_SUBTYPE_BEACON:
3749		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3750		    ic->ic_state == IEEE80211_S_RUN &&
3751		    device_is_active(sc->sc_dev)) {
3752			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3753			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3754				(void)ieee80211_ibss_merge(ni);
3755		}
3756		break;
3757	default:
3758		break;
3759	}
3760	return;
3761}
3762
3763static struct ieee80211_node *
3764rtw_node_alloc(struct ieee80211_node_table *nt)
3765{
3766	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3767	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3768	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3769
3770	DPRINTF(sc, RTW_DEBUG_NODE,
3771	    ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
3772	return ni;
3773}
3774
3775static void
3776rtw_node_free(struct ieee80211_node *ni)
3777{
3778	struct ieee80211com *ic = ni->ni_ic;
3779	struct ifnet *ifp = ic->ic_ifp;
3780	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3781
3782	DPRINTF(sc, RTW_DEBUG_NODE,
3783	    ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
3784	    ether_sprintf(ni->ni_bssid)));
3785	(*sc->sc_mtbl.mt_node_free)(ni);
3786}
3787
3788static int
3789rtw_media_change(struct ifnet *ifp)
3790{
3791	int error;
3792
3793	error = ieee80211_media_change(ifp);
3794	if (error == ENETRESET) {
3795		if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
3796		    (IFF_RUNNING | IFF_UP))
3797			rtw_init(ifp);		/* XXX lose error */
3798		error = 0;
3799	}
3800	return error;
3801}
3802
3803static void
3804rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3805{
3806	struct rtw_softc *sc = ifp->if_softc;
3807
3808	if (!device_is_active(sc->sc_dev)) {
3809		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3810		imr->ifm_status = 0;
3811		return;
3812	}
3813	ieee80211_media_status(ifp, imr);
3814}
3815
3816static inline void
3817rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3818{
3819	(void)strlcpy(ifp->if_xname, dvname, IFNAMSIZ);
3820	ifp->if_softc = softc;
3821	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
3822	ifp->if_ioctl = rtw_ioctl;
3823	ifp->if_start = rtw_start;
3824	ifp->if_watchdog = rtw_watchdog;
3825	ifp->if_init = rtw_init;
3826	ifp->if_stop = rtw_stop;
3827}
3828
3829static inline void
3830rtw_set80211props(struct ieee80211com *ic)
3831{
3832	int nrate;
3833	ic->ic_phytype = IEEE80211_T_DS;
3834	ic->ic_opmode = IEEE80211_M_STA;
3835	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3836	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
3837
3838	nrate = 0;
3839	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3840	    IEEE80211_RATE_BASIC | 2;
3841	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3842	    IEEE80211_RATE_BASIC | 4;
3843	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3844	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3845	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3846}
3847
3848static inline void
3849rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3850{
3851	mtbl->mt_newstate = ic->ic_newstate;
3852	ic->ic_newstate = rtw_newstate;
3853
3854	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3855	ic->ic_recv_mgmt = rtw_recv_mgmt;
3856
3857	mtbl->mt_node_free = ic->ic_node_free;
3858	ic->ic_node_free = rtw_node_free;
3859
3860	mtbl->mt_node_alloc = ic->ic_node_alloc;
3861	ic->ic_node_alloc = rtw_node_alloc;
3862
3863	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3864	ic->ic_crypto.cs_key_set = rtw_key_set;
3865	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3866	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3867}
3868
3869static inline void
3870rtw_init_radiotap(struct rtw_softc *sc)
3871{
3872	uint32_t present;
3873
3874	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3875	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3876
3877	if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
3878		present = htole32(RTW_PHILIPS_RX_RADIOTAP_PRESENT);
3879	else
3880		present = htole32(RTW_RX_RADIOTAP_PRESENT);
3881	sc->sc_rxtap.rr_ihdr.it_present = present;
3882
3883	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3884	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3885	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3886}
3887
3888static int
3889rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3890{
3891	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3892	SIMPLEQ_INIT(&tsb->tsb_freeq);
3893	tsb->tsb_ndesc = qlen;
3894	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3895	    M_NOWAIT);
3896	if (tsb->tsb_desc == NULL)
3897		return ENOMEM;
3898	return 0;
3899}
3900
3901static void
3902rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3903{
3904	int pri;
3905	struct rtw_txsoft_blk *tsb;
3906
3907	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3908		tsb = &sc->sc_txsoft_blk[pri];
3909		free(tsb->tsb_desc, M_DEVBUF);
3910		tsb->tsb_desc = NULL;
3911	}
3912}
3913
3914static int
3915rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3916{
3917	int pri, rc = 0;
3918	int qlen[RTW_NTXPRI] =
3919	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3920	struct rtw_txsoft_blk *tsbs;
3921
3922	tsbs = sc->sc_txsoft_blk;
3923
3924	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3925		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3926		if (rc != 0)
3927			break;
3928	}
3929	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3930	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3931	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3932	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3933	return rc;
3934}
3935
3936static void
3937rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3938    u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3939{
3940	tdb->tdb_ndesc = ndesc;
3941	tdb->tdb_desc = desc;
3942	tdb->tdb_physbase = physbase;
3943	tdb->tdb_ofs = ofs;
3944
3945	(void)memset(tdb->tdb_desc, 0,
3946	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3947
3948	rtw_txdesc_blk_init(tdb);
3949	tdb->tdb_next = 0;
3950}
3951
3952static void
3953rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3954{
3955	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3956	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3957	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3958
3959	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3960	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3961	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3962
3963	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3964	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3965	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3966
3967	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3968	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3969	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3970}
3971
3972static struct rtw_rf *
3973rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3974{
3975	rtw_rf_write_t rf_write;
3976	struct rtw_rf *rf;
3977
3978	switch (rfchipid) {
3979	default:
3980		rf_write = rtw_rf_hostwrite;
3981		break;
3982	case RTW_RFCHIPID_INTERSIL:
3983	case RTW_RFCHIPID_PHILIPS:
3984	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3985	case RTW_RFCHIPID_RFMD:
3986		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3987		break;
3988	}
3989
3990	switch (rfchipid) {
3991	case RTW_RFCHIPID_GCT:
3992		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3993		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3994		break;
3995	case RTW_RFCHIPID_MAXIM:
3996		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3997		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3998		break;
3999	case RTW_RFCHIPID_PHILIPS:
4000		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
4001		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
4002		break;
4003	case RTW_RFCHIPID_RFMD:
4004		/* XXX RFMD has no RF constructor */
4005		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
4006		/*FALLTHROUGH*/
4007	default:
4008		return NULL;
4009	}
4010	rf->rf_continuous_tx_cb =
4011	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
4012	rf->rf_continuous_tx_arg = (void *)sc;
4013	return rf;
4014}
4015
4016/* Revision C and later use a different PHY delay setting than
4017 * revisions A and B.
4018 */
4019static uint8_t
4020rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
4021{
4022#define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
4023#define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
4024
4025	uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
4026
4027	RTW_WRITE(regs, RTW_RCR, REVAB);
4028	RTW_WBW(regs, RTW_RCR, RTW_RCR);
4029	RTW_WRITE(regs, RTW_RCR, REVC);
4030
4031	RTW_WBR(regs, RTW_RCR, RTW_RCR);
4032	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
4033		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
4034
4035	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
4036	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
4037
4038	return phydelay;
4039#undef REVC
4040}
4041
4042void
4043rtw_attach(struct rtw_softc *sc)
4044{
4045	struct ifnet *ifp = &sc->sc_if;
4046	struct ieee80211com *ic = &sc->sc_ic;
4047	struct rtw_txsoft_blk *tsb;
4048	int pri, rc;
4049
4050	pmf_self_suspensor_init(sc->sc_dev, &sc->sc_suspensor, &sc->sc_qual);
4051
4052	rtw_cipher_wep = ieee80211_cipher_wep;
4053	rtw_cipher_wep.ic_decap = rtw_wep_decap;
4054
4055	NEXT_ATTACH_STATE(sc, DETACHED);
4056
4057	sc->sc_soft_ih = softint_establish(SOFTINT_NET, rtw_softintr, sc);
4058	if (sc->sc_soft_ih == NULL) {
4059		aprint_error_dev(sc->sc_dev, "could not establish softint\n");
4060		goto err;
4061	}
4062
4063	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
4064	case RTW_TCR_HWVERID_F:
4065		sc->sc_hwverid = 'F';
4066		break;
4067	case RTW_TCR_HWVERID_D:
4068		sc->sc_hwverid = 'D';
4069		break;
4070	default:
4071		sc->sc_hwverid = '?';
4072		break;
4073	}
4074	aprint_verbose_dev(sc->sc_dev, "hardware version %c\n",
4075	    sc->sc_hwverid);
4076
4077	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4078	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4079	    0);
4080
4081	if (rc != 0) {
4082		aprint_error_dev(sc->sc_dev,
4083		    "could not allocate hw descriptors, error %d\n", rc);
4084		goto err;
4085	}
4086
4087	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4088
4089	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4090	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4091	    (void **)&sc->sc_descs, BUS_DMA_COHERENT);
4092
4093	if (rc != 0) {
4094		aprint_error_dev(sc->sc_dev,
4095		    "could not map hw descriptors, error %d\n", rc);
4096		goto err;
4097	}
4098	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4099
4100	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4101	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4102
4103	if (rc != 0) {
4104		aprint_error_dev(sc->sc_dev,
4105		    "could not create DMA map for hw descriptors, error %d\n",
4106		    rc);
4107		goto err;
4108	}
4109	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4110
4111	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4112	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4113
4114	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4115		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4116		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4117	}
4118
4119	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4120	    sizeof(struct rtw_descs), NULL, 0);
4121
4122	if (rc != 0) {
4123		aprint_error_dev(sc->sc_dev,
4124		    "could not load DMA map for hw descriptors, error %d\n",
4125		    rc);
4126		goto err;
4127	}
4128	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4129
4130	if (rtw_txsoft_blk_setup_all(sc) != 0)
4131		goto err;
4132	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4133
4134	rtw_txdesc_blk_setup_all(sc);
4135
4136	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4137
4138	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4139
4140	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4141		tsb = &sc->sc_txsoft_blk[pri];
4142
4143		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4144		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4145			aprint_error_dev(sc->sc_dev,
4146			    "could not load DMA map for hw tx descriptors, "
4147			    "error %d\n", rc);
4148			goto err;
4149		}
4150	}
4151
4152	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4153	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4154	                                    RTW_RXQLEN)) != 0) {
4155		aprint_error_dev(sc->sc_dev,
4156		    "could not load DMA map for hw rx descriptors, error %d\n",
4157		    rc);
4158		goto err;
4159	}
4160	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4161
4162	/* Reset the chip to a known state. */
4163	if (rtw_reset(sc) != 0)
4164		goto err;
4165	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4166
4167	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4168
4169	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4170		sc->sc_flags |= RTW_F_9356SROM;
4171
4172	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4173	    sc->sc_dev) != 0)
4174		goto err;
4175
4176	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4177
4178	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4179	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4180	    sc->sc_dev) != 0) {
4181		aprint_error_dev(sc->sc_dev,
4182		    "attach failed, malformed serial ROM\n");
4183		goto err;
4184	}
4185
4186	aprint_verbose_dev(sc->sc_dev, "%s PHY\n",
4187	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4188
4189	aprint_verbose_dev(sc->sc_dev, "carrier-sense threshold %u\n",
4190	    sc->sc_csthr);
4191
4192	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4193
4194	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4195	    sc->sc_flags & RTW_F_DIGPHY);
4196
4197	if (sc->sc_rf == NULL) {
4198		aprint_verbose_dev(sc->sc_dev,
4199		    "attach failed, could not attach RF\n");
4200		goto err;
4201	}
4202
4203	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4204
4205	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4206
4207	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4208	    ("%s: PHY delay %d\n", device_xname(sc->sc_dev), sc->sc_phydelay));
4209
4210	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4211		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4212
4213	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels, sc->sc_dev);
4214
4215	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4216	    sc->sc_dev) != 0)
4217		goto err;
4218	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4219
4220	rtw_setifprops(ifp, device_xname(sc->sc_dev), (void*)sc);
4221
4222	IFQ_SET_READY(&ifp->if_snd);
4223
4224	sc->sc_ic.ic_ifp = ifp;
4225	rtw_set80211props(&sc->sc_ic);
4226
4227	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4228	NEXT_ATTACH_STATE(sc, FINISH_LED_ATTACH);
4229
4230	/*
4231	 * Call MI attach routines.
4232	 */
4233	rc = if_initialize(ifp);
4234	if (rc != 0) {
4235		aprint_error_dev(sc->sc_dev, "if_initialize failed(%d)\n", rc);
4236		goto err;
4237	}
4238	ieee80211_ifattach(ic);
4239	/* Use common softint-based if_input */
4240	ifp->if_percpuq = if_percpuq_create(ifp);
4241	if_register(ifp);
4242
4243	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4244
4245	/* possibly we should fill in our own sc_send_prresp, since
4246	 * the RTL8180 is probably sending probe responses in ad hoc
4247	 * mode.
4248	 */
4249
4250	/* complete initialization */
4251	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4252	callout_init(&sc->sc_scan_ch, 0);
4253
4254	rtw_init_radiotap(sc);
4255
4256	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
4257	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4258
4259	NEXT_ATTACH_STATE(sc, FINISHED);
4260
4261	ieee80211_announce(ic);
4262	return;
4263err:
4264	rtw_detach(sc);
4265	return;
4266}
4267
4268int
4269rtw_detach(struct rtw_softc *sc)
4270{
4271	struct ifnet *ifp = &sc->sc_if;
4272	int pri, s;
4273
4274	s = splnet();
4275
4276	switch (sc->sc_attach_state) {
4277	case FINISHED:
4278		rtw_stop(ifp, 1);
4279
4280		pmf_device_deregister(sc->sc_dev);
4281		callout_stop(&sc->sc_scan_ch);
4282		ieee80211_ifdetach(&sc->sc_ic);
4283		if_detach(ifp);
4284		/*FALLTHROUGH*/
4285	case FINISH_LED_ATTACH:
4286		rtw_led_detach(&sc->sc_led_state);
4287		/*FALLTHROUGH*/
4288	case FINISH_ID_STA:
4289	case FINISH_RF_ATTACH:
4290		rtw_rf_destroy(sc->sc_rf);
4291		sc->sc_rf = NULL;
4292		/*FALLTHROUGH*/
4293	case FINISH_PARSE_SROM:
4294	case FINISH_READ_SROM:
4295		rtw_srom_free(&sc->sc_srom);
4296		/*FALLTHROUGH*/
4297	case FINISH_RESET:
4298	case FINISH_RXMAPS_CREATE:
4299		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4300		    RTW_RXQLEN);
4301		/*FALLTHROUGH*/
4302	case FINISH_TXMAPS_CREATE:
4303		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4304			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4305			    sc->sc_txsoft_blk[pri].tsb_desc,
4306			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4307		}
4308		/*FALLTHROUGH*/
4309	case FINISH_TXDESCBLK_SETUP:
4310	case FINISH_TXCTLBLK_SETUP:
4311		rtw_txsoft_blk_cleanup_all(sc);
4312		/*FALLTHROUGH*/
4313	case FINISH_DESCMAP_LOAD:
4314		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4315		/*FALLTHROUGH*/
4316	case FINISH_DESCMAP_CREATE:
4317		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4318		/*FALLTHROUGH*/
4319	case FINISH_DESC_MAP:
4320		bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_descs,
4321		    sizeof(struct rtw_descs));
4322		/*FALLTHROUGH*/
4323	case FINISH_DESC_ALLOC:
4324		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4325		    sc->sc_desc_nsegs);
4326		/*FALLTHROUGH*/
4327	case DETACHED:
4328		if (sc->sc_soft_ih != NULL) {
4329			softint_disestablish(sc->sc_soft_ih);
4330			sc->sc_soft_ih = NULL;
4331		}
4332		NEXT_ATTACH_STATE(sc, DETACHED);
4333		break;
4334	}
4335	splx(s);
4336	return 0;
4337}
4338