xref: /netbsd-src/sys/dev/ic/atw.c (revision 8a5e2a50be13e77dd4df5daf258ddceeeeb47ce6)
1 /*	$NetBSD: atw.c,v 1.89 2005/07/07 00:12:22 dyoung Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the NetBSD
21  *	Foundation, Inc. and its contributors.
22  * 4. Neither the name of The NetBSD Foundation nor the names of its
23  *    contributors may be used to endorse or promote products derived
24  *    from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36  * POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 /*
40  * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
41  */
42 
43 #include <sys/cdefs.h>
44 __KERNEL_RCSID(0, "$NetBSD: atw.c,v 1.89 2005/07/07 00:12:22 dyoung Exp $");
45 
46 #include "bpfilter.h"
47 
48 #include <sys/param.h>
49 #include <sys/systm.h>
50 #include <sys/callout.h>
51 #include <sys/mbuf.h>
52 #include <sys/malloc.h>
53 #include <sys/kernel.h>
54 #include <sys/socket.h>
55 #include <sys/ioctl.h>
56 #include <sys/errno.h>
57 #include <sys/device.h>
58 #include <sys/time.h>
59 
60 #include <machine/endian.h>
61 
62 #include <uvm/uvm_extern.h>
63 
64 #include <net/if.h>
65 #include <net/if_dl.h>
66 #include <net/if_media.h>
67 #include <net/if_ether.h>
68 
69 #include <net80211/ieee80211_netbsd.h>
70 #include <net80211/ieee80211_var.h>
71 #include <net80211/ieee80211_radiotap.h>
72 
73 #if NBPFILTER > 0
74 #include <net/bpf.h>
75 #endif
76 
77 #include <machine/bus.h>
78 #include <machine/intr.h>
79 
80 #include <dev/ic/atwreg.h>
81 #include <dev/ic/rf3000reg.h>
82 #include <dev/ic/si4136reg.h>
83 #include <dev/ic/atwvar.h>
84 #include <dev/ic/smc93cx6var.h>
85 
86 /* XXX TBD open questions
87  *
88  *
89  * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
90  * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
91  * handle this for me?
92  *
93  */
94 /* device attachment
95  *
96  *    print TOFS[012]
97  *
98  * device initialization
99  *
100  *    clear ATW_FRCTL_MAXPSP to disable max power saving
101  *    set ATW_TXBR_ALCUPDATE to enable ALC
102  *    set TOFS[012]? (hope not)
103  *    disable rx/tx
104  *    set ATW_PAR_SWR (software reset)
105  *    wait for ATW_PAR_SWR clear
106  *    disable interrupts
107  *    ack status register
108  *    enable interrupts
109  *
110  * rx/tx initialization
111  *
112  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
113  *    allocate and init descriptor rings
114  *    write ATW_PAR_DSL (descriptor skip length)
115  *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
116  *    write ATW_NAR_SQ for one/both transmit descriptor rings
117  *    write ATW_NAR_SQ for one/both transmit descriptor rings
118  *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
119  *
120  * rx/tx end
121  *
122  *    stop DMA
123  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
124  *    flush tx w/ ATW_NAR_HF
125  *
126  * scan
127  *
128  *    initialize rx/tx
129  *
130  * BSS join: (re)association response
131  *
132  *    set ATW_FRCTL_AID
133  *
134  * optimizations ???
135  *
136  */
137 
138 #define ATW_REFSLAVE	/* slavishly do what the reference driver does */
139 
140 #define	VOODOO_DUR_11_ROUNDING		0x01 /* necessary */
141 #define	VOODOO_DUR_2_4_SPECIALCASE	0x02 /* NOT necessary */
142 int atw_voodoo = VOODOO_DUR_11_ROUNDING;
143 
144 int atw_pseudo_milli = 1;
145 int atw_magic_delay1 = 100 * 1000;
146 int atw_magic_delay2 = 100 * 1000;
147 /* more magic multi-millisecond delays (units: microseconds) */
148 int atw_nar_delay = 20 * 1000;
149 int atw_magic_delay4 = 10 * 1000;
150 int atw_rf_delay1 = 10 * 1000;
151 int atw_rf_delay2 = 5 * 1000;
152 int atw_plcphd_delay = 2 * 1000;
153 int atw_bbp_io_enable_delay = 20 * 1000;
154 int atw_bbp_io_disable_delay = 2 * 1000;
155 int atw_writewep_delay = 1000;
156 int atw_beacon_len_adjust = 4;
157 int atw_dwelltime = 200;
158 int atw_xindiv2 = 0;
159 
160 #ifdef ATW_DEBUG
161 int atw_debug = 0;
162 
163 #define ATW_DPRINTF(x)	if (atw_debug > 0) printf x
164 #define ATW_DPRINTF2(x)	if (atw_debug > 1) printf x
165 #define ATW_DPRINTF3(x)	if (atw_debug > 2) printf x
166 #define	DPRINTF(sc, x)	if ((sc)->sc_if.if_flags & IFF_DEBUG) printf x
167 #define	DPRINTF2(sc, x)	if ((sc)->sc_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
168 #define	DPRINTF3(sc, x)	if ((sc)->sc_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
169 
170 static void	atw_dump_pkt(struct ifnet *, struct mbuf *);
171 static void	atw_print_regs(struct atw_softc *, const char *);
172 
173 /* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
174 #	ifdef ATW_BBPDEBUG
175 static void	atw_rf3000_print(struct atw_softc *);
176 static int	atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
177 #	endif /* ATW_BBPDEBUG */
178 
179 #	ifdef ATW_SYNDEBUG
180 static void	atw_si4126_print(struct atw_softc *);
181 static int	atw_si4126_read(struct atw_softc *, u_int, u_int *);
182 #	endif /* ATW_SYNDEBUG */
183 
184 #else
185 #define ATW_DPRINTF(x)
186 #define ATW_DPRINTF2(x)
187 #define ATW_DPRINTF3(x)
188 #define	DPRINTF(sc, x)	/* nothing */
189 #define	DPRINTF2(sc, x)	/* nothing */
190 #define	DPRINTF3(sc, x)	/* nothing */
191 #endif
192 
193 /* ifnet methods */
194 int	atw_init(struct ifnet *);
195 int	atw_ioctl(struct ifnet *, u_long, caddr_t);
196 void	atw_start(struct ifnet *);
197 void	atw_stop(struct ifnet *, int);
198 void	atw_watchdog(struct ifnet *);
199 
200 /* Device attachment */
201 void	atw_attach(struct atw_softc *);
202 int	atw_detach(struct atw_softc *);
203 
204 /* Rx/Tx process */
205 int	atw_add_rxbuf(struct atw_softc *, int);
206 void	atw_idle(struct atw_softc *, u_int32_t);
207 void	atw_rxdrain(struct atw_softc *);
208 void	atw_txdrain(struct atw_softc *);
209 
210 /* Device (de)activation and power state */
211 void	atw_disable(struct atw_softc *);
212 int	atw_enable(struct atw_softc *);
213 void	atw_power(int, void *);
214 void	atw_reset(struct atw_softc *);
215 void	atw_shutdown(void *);
216 
217 /* Interrupt handlers */
218 void	atw_linkintr(struct atw_softc *, u_int32_t);
219 void	atw_rxintr(struct atw_softc *);
220 void	atw_txintr(struct atw_softc *);
221 
222 /* 802.11 state machine */
223 static int	atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
224 static void	atw_next_scan(void *);
225 static void	atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
226 		              struct ieee80211_node *, int, int, u_int32_t);
227 static int	atw_tune(struct atw_softc *);
228 
229 /* Device initialization */
230 static void	atw_bbp_io_init(struct atw_softc *);
231 static void	atw_cfp_init(struct atw_softc *);
232 static void	atw_cmdr_init(struct atw_softc *);
233 static void	atw_ifs_init(struct atw_softc *);
234 static void	atw_nar_init(struct atw_softc *);
235 static void	atw_response_times_init(struct atw_softc *);
236 static void	atw_rf_reset(struct atw_softc *);
237 static void	atw_test1_init(struct atw_softc *);
238 static void	atw_tofs0_init(struct atw_softc *);
239 static void	atw_tofs2_init(struct atw_softc *);
240 static void	atw_txlmt_init(struct atw_softc *);
241 static void	atw_wcsr_init(struct atw_softc *);
242 
243 /* Key management */
244 static int atw_key_alloc(struct ieee80211com *, const struct ieee80211_key *);
245 static int atw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
246 static int atw_key_set(struct ieee80211com *, const struct ieee80211_key *,
247 	const u_int8_t[IEEE80211_ADDR_LEN]);
248 static void atw_key_update_begin(struct ieee80211com *);
249 static void atw_key_update_end(struct ieee80211com *);
250 
251 /* RAM/ROM utilities */
252 static void	atw_clear_sram(struct atw_softc *);
253 static void	atw_write_sram(struct atw_softc *, u_int, u_int8_t *, u_int);
254 static int	atw_read_srom(struct atw_softc *);
255 
256 /* BSS setup */
257 static void	atw_predict_beacon(struct atw_softc *);
258 static void	atw_start_beacon(struct atw_softc *, int);
259 static void	atw_write_bssid(struct atw_softc *);
260 static void	atw_write_ssid(struct atw_softc *);
261 static void	atw_write_sup_rates(struct atw_softc *);
262 static void	atw_write_wep(struct atw_softc *);
263 
264 /* Media */
265 static int	atw_media_change(struct ifnet *);
266 static void	atw_media_status(struct ifnet *, struct ifmediareq *);
267 
268 static void	atw_filter_setup(struct atw_softc *);
269 
270 /* 802.11 utilities */
271 static void			atw_frame_setdurs(struct atw_softc *,
272 				                  struct atw_frame *, int, int);
273 static uint64_t			atw_get_tsft(struct atw_softc *);
274 static __inline uint32_t	atw_last_even_tsft(uint32_t, uint32_t,
275 				                   uint32_t);
276 static struct ieee80211_node	*atw_node_alloc(struct ieee80211_node_table *);
277 static void			atw_node_free(struct ieee80211_node *);
278 static void			atw_change_ibss(struct atw_softc *);
279 
280 /*
281  * Tuner/transceiver/modem
282  */
283 static void	atw_bbp_io_enable(struct atw_softc *, int);
284 
285 /* RFMD RF3000 Baseband Processor */
286 static int	atw_rf3000_init(struct atw_softc *);
287 static int	atw_rf3000_tune(struct atw_softc *, u_int);
288 static int	atw_rf3000_write(struct atw_softc *, u_int, u_int);
289 
290 /* Silicon Laboratories Si4126 RF/IF Synthesizer */
291 static void	atw_si4126_tune(struct atw_softc *, u_int);
292 static void	atw_si4126_write(struct atw_softc *, u_int, u_int);
293 
294 const struct atw_txthresh_tab atw_txthresh_tab_lo[] = ATW_TXTHRESH_TAB_LO_RATE;
295 const struct atw_txthresh_tab atw_txthresh_tab_hi[] = ATW_TXTHRESH_TAB_HI_RATE;
296 
297 const char *atw_tx_state[] = {
298 	"STOPPED",
299 	"RUNNING - read descriptor",
300 	"RUNNING - transmitting",
301 	"RUNNING - filling fifo",	/* XXX */
302 	"SUSPENDED",
303 	"RUNNING -- write descriptor",
304 	"RUNNING -- write last descriptor",
305 	"RUNNING - fifo full"
306 };
307 
308 const char *atw_rx_state[] = {
309 	"STOPPED",
310 	"RUNNING - read descriptor",
311 	"RUNNING - check this packet, pre-fetch next",
312 	"RUNNING - wait for reception",
313 	"SUSPENDED",
314 	"RUNNING - write descriptor",
315 	"RUNNING - flush fifo",
316 	"RUNNING - fifo drain"
317 };
318 
319 int
320 atw_activate(struct device *self, enum devact act)
321 {
322 	struct atw_softc *sc = (struct atw_softc *)self;
323 	int rv = 0, s;
324 
325 	s = splnet();
326 	switch (act) {
327 	case DVACT_ACTIVATE:
328 		rv = EOPNOTSUPP;
329 		break;
330 
331 	case DVACT_DEACTIVATE:
332 		if_deactivate(&sc->sc_if);
333 		break;
334 	}
335 	splx(s);
336 	return rv;
337 }
338 
339 /*
340  * atw_enable:
341  *
342  *	Enable the ADM8211 chip.
343  */
344 int
345 atw_enable(struct atw_softc *sc)
346 {
347 
348 	if (ATW_IS_ENABLED(sc) == 0) {
349 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
350 			printf("%s: device enable failed\n",
351 			    sc->sc_dev.dv_xname);
352 			return (EIO);
353 		}
354 		sc->sc_flags |= ATWF_ENABLED;
355 	}
356 	return (0);
357 }
358 
359 /*
360  * atw_disable:
361  *
362  *	Disable the ADM8211 chip.
363  */
364 void
365 atw_disable(struct atw_softc *sc)
366 {
367 	if (!ATW_IS_ENABLED(sc))
368 		return;
369 	if (sc->sc_disable != NULL)
370 		(*sc->sc_disable)(sc);
371 	sc->sc_flags &= ~ATWF_ENABLED;
372 }
373 
374 /* Returns -1 on failure. */
375 static int
376 atw_read_srom(struct atw_softc *sc)
377 {
378 	struct seeprom_descriptor sd;
379 	uint32_t test0, fail_bits;
380 
381 	(void)memset(&sd, 0, sizeof(sd));
382 
383 	test0 = ATW_READ(sc, ATW_TEST0);
384 
385 	switch (sc->sc_rev) {
386 	case ATW_REVISION_BA:
387 	case ATW_REVISION_CA:
388 		fail_bits = ATW_TEST0_EPNE;
389 		break;
390 	default:
391 		fail_bits = ATW_TEST0_EPNE|ATW_TEST0_EPSNM;
392 		break;
393 	}
394 	if ((test0 & fail_bits) != 0) {
395 		printf("%s: bad or missing/bad SROM\n", sc->sc_dev.dv_xname);
396 		return -1;
397 	}
398 
399 	switch (test0 & ATW_TEST0_EPTYP_MASK) {
400 	case ATW_TEST0_EPTYP_93c66:
401 		ATW_DPRINTF(("%s: 93c66 SROM\n", sc->sc_dev.dv_xname));
402 		sc->sc_sromsz = 512;
403 		sd.sd_chip = C56_66;
404 		break;
405 	case ATW_TEST0_EPTYP_93c46:
406 		ATW_DPRINTF(("%s: 93c46 SROM\n", sc->sc_dev.dv_xname));
407 		sc->sc_sromsz = 128;
408 		sd.sd_chip = C46;
409 		break;
410 	default:
411 		printf("%s: unknown SROM type %d\n", sc->sc_dev.dv_xname,
412 		    MASK_AND_RSHIFT(test0, ATW_TEST0_EPTYP_MASK));
413 		return -1;
414 	}
415 
416 	sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_NOWAIT);
417 
418 	if (sc->sc_srom == NULL) {
419 		printf("%s: unable to allocate SROM buffer\n",
420 		    sc->sc_dev.dv_xname);
421 		return -1;
422 	}
423 
424 	(void)memset(sc->sc_srom, 0, sc->sc_sromsz);
425 
426 	/* ADM8211 has a single 32-bit register for controlling the
427 	 * 93cx6 SROM.  Bit SRS enables the serial port. There is no
428 	 * "ready" bit. The ADM8211 input/output sense is the reverse
429 	 * of read_seeprom's.
430 	 */
431 	sd.sd_tag = sc->sc_st;
432 	sd.sd_bsh = sc->sc_sh;
433 	sd.sd_regsize = 4;
434 	sd.sd_control_offset = ATW_SPR;
435 	sd.sd_status_offset = ATW_SPR;
436 	sd.sd_dataout_offset = ATW_SPR;
437 	sd.sd_CK = ATW_SPR_SCLK;
438 	sd.sd_CS = ATW_SPR_SCS;
439 	sd.sd_DI = ATW_SPR_SDO;
440 	sd.sd_DO = ATW_SPR_SDI;
441 	sd.sd_MS = ATW_SPR_SRS;
442 	sd.sd_RDY = 0;
443 
444 	if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
445 		printf("%s: could not read SROM\n", sc->sc_dev.dv_xname);
446 		free(sc->sc_srom, M_DEVBUF);
447 		return -1;
448 	}
449 #ifdef ATW_DEBUG
450 	{
451 		int i;
452 		ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
453 		for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
454 			if (((i % 8) == 0) && (i != 0)) {
455 				ATW_DPRINTF(("\n\t"));
456 			}
457 			ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
458 		}
459 		ATW_DPRINTF(("\n"));
460 	}
461 #endif /* ATW_DEBUG */
462 	return 0;
463 }
464 
465 #ifdef ATW_DEBUG
466 static void
467 atw_print_regs(struct atw_softc *sc, const char *where)
468 {
469 #define PRINTREG(sc, reg) \
470 	ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
471 	    sc->sc_dev.dv_xname, reg, ATW_READ(sc, reg)))
472 
473 	ATW_DPRINTF2(("%s: %s\n", sc->sc_dev.dv_xname, where));
474 
475 	PRINTREG(sc, ATW_PAR);
476 	PRINTREG(sc, ATW_FRCTL);
477 	PRINTREG(sc, ATW_TDR);
478 	PRINTREG(sc, ATW_WTDP);
479 	PRINTREG(sc, ATW_RDR);
480 	PRINTREG(sc, ATW_WRDP);
481 	PRINTREG(sc, ATW_RDB);
482 	PRINTREG(sc, ATW_CSR3A);
483 	PRINTREG(sc, ATW_TDBD);
484 	PRINTREG(sc, ATW_TDBP);
485 	PRINTREG(sc, ATW_STSR);
486 	PRINTREG(sc, ATW_CSR5A);
487 	PRINTREG(sc, ATW_NAR);
488 	PRINTREG(sc, ATW_CSR6A);
489 	PRINTREG(sc, ATW_IER);
490 	PRINTREG(sc, ATW_CSR7A);
491 	PRINTREG(sc, ATW_LPC);
492 	PRINTREG(sc, ATW_TEST1);
493 	PRINTREG(sc, ATW_SPR);
494 	PRINTREG(sc, ATW_TEST0);
495 	PRINTREG(sc, ATW_WCSR);
496 	PRINTREG(sc, ATW_WPDR);
497 	PRINTREG(sc, ATW_GPTMR);
498 	PRINTREG(sc, ATW_GPIO);
499 	PRINTREG(sc, ATW_BBPCTL);
500 	PRINTREG(sc, ATW_SYNCTL);
501 	PRINTREG(sc, ATW_PLCPHD);
502 	PRINTREG(sc, ATW_MMIWADDR);
503 	PRINTREG(sc, ATW_MMIRADDR1);
504 	PRINTREG(sc, ATW_MMIRADDR2);
505 	PRINTREG(sc, ATW_TXBR);
506 	PRINTREG(sc, ATW_CSR15A);
507 	PRINTREG(sc, ATW_ALCSTAT);
508 	PRINTREG(sc, ATW_TOFS2);
509 	PRINTREG(sc, ATW_CMDR);
510 	PRINTREG(sc, ATW_PCIC);
511 	PRINTREG(sc, ATW_PMCSR);
512 	PRINTREG(sc, ATW_PAR0);
513 	PRINTREG(sc, ATW_PAR1);
514 	PRINTREG(sc, ATW_MAR0);
515 	PRINTREG(sc, ATW_MAR1);
516 	PRINTREG(sc, ATW_ATIMDA0);
517 	PRINTREG(sc, ATW_ABDA1);
518 	PRINTREG(sc, ATW_BSSID0);
519 	PRINTREG(sc, ATW_TXLMT);
520 	PRINTREG(sc, ATW_MIBCNT);
521 	PRINTREG(sc, ATW_BCNT);
522 	PRINTREG(sc, ATW_TSFTH);
523 	PRINTREG(sc, ATW_TSC);
524 	PRINTREG(sc, ATW_SYNRF);
525 	PRINTREG(sc, ATW_BPLI);
526 	PRINTREG(sc, ATW_CAP0);
527 	PRINTREG(sc, ATW_CAP1);
528 	PRINTREG(sc, ATW_RMD);
529 	PRINTREG(sc, ATW_CFPP);
530 	PRINTREG(sc, ATW_TOFS0);
531 	PRINTREG(sc, ATW_TOFS1);
532 	PRINTREG(sc, ATW_IFST);
533 	PRINTREG(sc, ATW_RSPT);
534 	PRINTREG(sc, ATW_TSFTL);
535 	PRINTREG(sc, ATW_WEPCTL);
536 	PRINTREG(sc, ATW_WESK);
537 	PRINTREG(sc, ATW_WEPCNT);
538 	PRINTREG(sc, ATW_MACTEST);
539 	PRINTREG(sc, ATW_FER);
540 	PRINTREG(sc, ATW_FEMR);
541 	PRINTREG(sc, ATW_FPSR);
542 	PRINTREG(sc, ATW_FFER);
543 #undef PRINTREG
544 }
545 #endif /* ATW_DEBUG */
546 
547 /*
548  * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
549  */
550 void
551 atw_attach(struct atw_softc *sc)
552 {
553 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
554 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
555 	};
556 	struct ieee80211com *ic = &sc->sc_ic;
557 	struct ifnet *ifp = &sc->sc_if;
558 	int country_code, error, i, nrate, srom_major;
559 	u_int32_t reg;
560 	static const char *type_strings[] = {"Intersil (not supported)",
561 	    "RFMD", "Marvel (not supported)"};
562 
563 	sc->sc_txth = atw_txthresh_tab_lo;
564 
565 	SIMPLEQ_INIT(&sc->sc_txfreeq);
566 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
567 
568 #ifdef ATW_DEBUG
569 	atw_print_regs(sc, "atw_attach");
570 #endif /* ATW_DEBUG */
571 
572 	/*
573 	 * Allocate the control data structures, and create and load the
574 	 * DMA map for it.
575 	 */
576 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
577 	    sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
578 	    1, &sc->sc_cdnseg, 0)) != 0) {
579 		printf("%s: unable to allocate control data, error = %d\n",
580 		    sc->sc_dev.dv_xname, error);
581 		goto fail_0;
582 	}
583 
584 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
585 	    sizeof(struct atw_control_data), (caddr_t *)&sc->sc_control_data,
586 	    BUS_DMA_COHERENT)) != 0) {
587 		printf("%s: unable to map control data, error = %d\n",
588 		    sc->sc_dev.dv_xname, error);
589 		goto fail_1;
590 	}
591 
592 	if ((error = bus_dmamap_create(sc->sc_dmat,
593 	    sizeof(struct atw_control_data), 1,
594 	    sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
595 		printf("%s: unable to create control data DMA map, "
596 		    "error = %d\n", sc->sc_dev.dv_xname, error);
597 		goto fail_2;
598 	}
599 
600 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
601 	    sc->sc_control_data, sizeof(struct atw_control_data), NULL,
602 	    0)) != 0) {
603 		printf("%s: unable to load control data DMA map, error = %d\n",
604 		    sc->sc_dev.dv_xname, error);
605 		goto fail_3;
606 	}
607 
608 	/*
609 	 * Create the transmit buffer DMA maps.
610 	 */
611 	sc->sc_ntxsegs = ATW_NTXSEGS;
612 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
613 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
614 		    sc->sc_ntxsegs, MCLBYTES, 0, 0,
615 		    &sc->sc_txsoft[i].txs_dmamap)) != 0) {
616 			printf("%s: unable to create tx DMA map %d, "
617 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
618 			goto fail_4;
619 		}
620 	}
621 
622 	/*
623 	 * Create the receive buffer DMA maps.
624 	 */
625 	for (i = 0; i < ATW_NRXDESC; i++) {
626 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
627 		    MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
628 			printf("%s: unable to create rx DMA map %d, "
629 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
630 			goto fail_5;
631 		}
632 	}
633 	for (i = 0; i < ATW_NRXDESC; i++) {
634 		sc->sc_rxsoft[i].rxs_mbuf = NULL;
635 	}
636 
637 	switch (sc->sc_rev) {
638 	case ATW_REVISION_AB:
639 	case ATW_REVISION_AF:
640 		sc->sc_sramlen = ATW_SRAM_A_SIZE;
641 		break;
642 	case ATW_REVISION_BA:
643 	case ATW_REVISION_CA:
644 		sc->sc_sramlen = ATW_SRAM_B_SIZE;
645 		break;
646 	}
647 
648 	/* Reset the chip to a known state. */
649 	atw_reset(sc);
650 
651 	if (atw_read_srom(sc) == -1)
652 		return;
653 
654 	sc->sc_rftype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
655 	    ATW_SR_RFTYPE_MASK);
656 
657 	sc->sc_bbptype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
658 	    ATW_SR_BBPTYPE_MASK);
659 
660 	if (sc->sc_rftype > sizeof(type_strings)/sizeof(type_strings[0])) {
661 		printf("%s: unknown RF\n", sc->sc_dev.dv_xname);
662 		return;
663 	}
664 	if (sc->sc_bbptype > sizeof(type_strings)/sizeof(type_strings[0])) {
665 		printf("%s: unknown BBP\n", sc->sc_dev.dv_xname);
666 		return;
667 	}
668 
669 	printf("%s: %s RF, %s BBP", sc->sc_dev.dv_xname,
670 	    type_strings[sc->sc_rftype], type_strings[sc->sc_bbptype]);
671 
672 	/* XXX There exists a Linux driver which seems to use RFType = 0 for
673 	 * MARVEL. My bug, or theirs?
674 	 */
675 
676 	reg = LSHIFT(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
677 
678 	switch (sc->sc_rftype) {
679 	case ATW_RFTYPE_INTERSIL:
680 		reg |= ATW_SYNCTL_CS1;
681 		break;
682 	case ATW_RFTYPE_RFMD:
683 		reg |= ATW_SYNCTL_CS0;
684 		break;
685 	case ATW_RFTYPE_MARVEL:
686 		break;
687 	}
688 
689 	sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
690 	sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
691 
692 	reg = LSHIFT(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
693 
694 	switch (sc->sc_bbptype) {
695 	case ATW_BBPTYPE_INTERSIL:
696 		reg |= ATW_BBPCTL_TWI;
697 		break;
698 	case ATW_BBPTYPE_RFMD:
699 		reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
700 		    ATW_BBPCTL_CCA_ACTLO;
701 		break;
702 	case ATW_BBPTYPE_MARVEL:
703 		break;
704 	case ATW_C_BBPTYPE_RFMD:
705 		printf("%s: ADM8211C MAC/RFMD BBP not supported yet.\n",
706 		    sc->sc_dev.dv_xname);
707 		break;
708 	}
709 
710 	sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
711 	sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
712 
713 	/*
714 	 * From this point forward, the attachment cannot fail.  A failure
715 	 * before this point releases all resources that may have been
716 	 * allocated.
717 	 */
718 	sc->sc_flags |= ATWF_ATTACHED /* | ATWF_RTSCTS */;
719 
720 	ATW_DPRINTF((" SROM MAC %04x%04x%04x",
721 	    htole16(sc->sc_srom[ATW_SR_MAC00]),
722 	    htole16(sc->sc_srom[ATW_SR_MAC01]),
723 	    htole16(sc->sc_srom[ATW_SR_MAC10])));
724 
725 	srom_major = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
726 	    ATW_SR_MAJOR_MASK);
727 
728 	if (srom_major < 2)
729 		sc->sc_rf3000_options1 = 0;
730 	else if (sc->sc_rev == ATW_REVISION_BA) {
731 		sc->sc_rf3000_options1 =
732 		    MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CR28_CR03],
733 		    ATW_SR_CR28_MASK);
734 	} else
735 		sc->sc_rf3000_options1 = 0;
736 
737 	sc->sc_rf3000_options2 = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
738 	    ATW_SR_CR29_MASK);
739 
740 	country_code = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
741 	    ATW_SR_CTRY_MASK);
742 
743 #define ADD_CHANNEL(_ic, _chan) do {					\
744 	_ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;		\
745 	_ic->ic_channels[_chan].ic_freq =				\
746 	    ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
747 } while (0)
748 
749 	/* Find available channels */
750 	switch (country_code) {
751 	case COUNTRY_MMK2:	/* 1-14 */
752 		ADD_CHANNEL(ic, 14);
753 		/*FALLTHROUGH*/
754 	case COUNTRY_ETSI:	/* 1-13 */
755 		for (i = 1; i <= 13; i++)
756 			ADD_CHANNEL(ic, i);
757 		break;
758 	case COUNTRY_FCC:	/* 1-11 */
759 	case COUNTRY_IC:	/* 1-11 */
760 		for (i = 1; i <= 11; i++)
761 			ADD_CHANNEL(ic, i);
762 		break;
763 	case COUNTRY_MMK:	/* 14 */
764 		ADD_CHANNEL(ic, 14);
765 		break;
766 	case COUNTRY_FRANCE:	/* 10-13 */
767 		for (i = 10; i <= 13; i++)
768 			ADD_CHANNEL(ic, i);
769 		break;
770 	default:	/* assume channels 10-11 */
771 	case COUNTRY_SPAIN:	/* 10-11 */
772 		for (i = 10; i <= 11; i++)
773 			ADD_CHANNEL(ic, i);
774 		break;
775 	}
776 
777 	/* Read the MAC address. */
778 	reg = ATW_READ(sc, ATW_PAR0);
779 	ic->ic_myaddr[0] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB0_MASK);
780 	ic->ic_myaddr[1] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB1_MASK);
781 	ic->ic_myaddr[2] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB2_MASK);
782 	ic->ic_myaddr[3] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB3_MASK);
783 	reg = ATW_READ(sc, ATW_PAR1);
784 	ic->ic_myaddr[4] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB4_MASK);
785 	ic->ic_myaddr[5] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB5_MASK);
786 
787 	if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
788 		printf(" could not get mac address, attach failed\n");
789 		return;
790 	}
791 
792 	printf(" 802.11 address %s\n", ether_sprintf(ic->ic_myaddr));
793 
794 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
795 	ifp->if_softc = sc;
796 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
797 	    IFF_NOTRAILERS;
798 	ifp->if_ioctl = atw_ioctl;
799 	ifp->if_start = atw_start;
800 	ifp->if_watchdog = atw_watchdog;
801 	ifp->if_init = atw_init;
802 	ifp->if_stop = atw_stop;
803 	IFQ_SET_READY(&ifp->if_snd);
804 
805 	ic->ic_ifp = ifp;
806 	ic->ic_phytype = IEEE80211_T_DS;
807 	ic->ic_opmode = IEEE80211_M_STA;
808 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
809 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
810 
811 	nrate = 0;
812 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 2;
813 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 4;
814 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
815 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
816 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
817 
818 	/*
819 	 * Call MI attach routines.
820 	 */
821 
822 	if_attach(ifp);
823 	ieee80211_ifattach(ic);
824 
825 	sc->sc_newstate = ic->ic_newstate;
826 	ic->ic_newstate = atw_newstate;
827 
828 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
829 	ic->ic_recv_mgmt = atw_recv_mgmt;
830 
831 	sc->sc_node_free = ic->ic_node_free;
832 	ic->ic_node_free = atw_node_free;
833 
834 	sc->sc_node_alloc = ic->ic_node_alloc;
835 	ic->ic_node_alloc = atw_node_alloc;
836 
837 	ic->ic_crypto.cs_key_alloc = atw_key_alloc;
838 	ic->ic_crypto.cs_key_delete = atw_key_delete;
839 	ic->ic_crypto.cs_key_set = atw_key_set;
840 	ic->ic_crypto.cs_key_update_begin = atw_key_update_begin;
841 	ic->ic_crypto.cs_key_update_end = atw_key_update_end;
842 
843 	/* possibly we should fill in our own sc_send_prresp, since
844 	 * the ADM8211 is probably sending probe responses in ad hoc
845 	 * mode.
846 	 */
847 
848 	/* complete initialization */
849 	ieee80211_media_init(ic, atw_media_change, atw_media_status);
850 	callout_init(&sc->sc_scan_ch);
851 
852 #if NBPFILTER > 0
853 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
854 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
855 #endif
856 
857 	/*
858 	 * Make sure the interface is shutdown during reboot.
859 	 */
860 	sc->sc_sdhook = shutdownhook_establish(atw_shutdown, sc);
861 	if (sc->sc_sdhook == NULL)
862 		printf("%s: WARNING: unable to establish shutdown hook\n",
863 		    sc->sc_dev.dv_xname);
864 
865 	/*
866 	 * Add a suspend hook to make sure we come back up after a
867 	 * resume.
868 	 */
869 	sc->sc_powerhook = powerhook_establish(atw_power, sc);
870 	if (sc->sc_powerhook == NULL)
871 		printf("%s: WARNING: unable to establish power hook\n",
872 		    sc->sc_dev.dv_xname);
873 
874 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
875 	sc->sc_rxtap.ar_ihdr.it_len = sizeof(sc->sc_rxtapu);
876 	sc->sc_rxtap.ar_ihdr.it_present = ATW_RX_RADIOTAP_PRESENT;
877 
878 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
879 	sc->sc_txtap.at_ihdr.it_len = sizeof(sc->sc_txtapu);
880 	sc->sc_txtap.at_ihdr.it_present = ATW_TX_RADIOTAP_PRESENT;
881 
882 	ieee80211_announce(ic);
883 	return;
884 
885 	/*
886 	 * Free any resources we've allocated during the failed attach
887 	 * attempt.  Do this in reverse order and fall through.
888 	 */
889  fail_5:
890 	for (i = 0; i < ATW_NRXDESC; i++) {
891 		if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
892 			continue;
893 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
894 	}
895  fail_4:
896 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
897 		if (sc->sc_txsoft[i].txs_dmamap == NULL)
898 			continue;
899 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
900 	}
901 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
902  fail_3:
903 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
904  fail_2:
905 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
906 	    sizeof(struct atw_control_data));
907  fail_1:
908 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
909  fail_0:
910 	return;
911 }
912 
913 static struct ieee80211_node *
914 atw_node_alloc(struct ieee80211_node_table *nt)
915 {
916 	struct atw_softc *sc = (struct atw_softc *)nt->nt_ic->ic_ifp->if_softc;
917 	struct ieee80211_node *ni = (*sc->sc_node_alloc)(nt);
918 
919 	DPRINTF(sc, ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
920 	return ni;
921 }
922 
923 static void
924 atw_node_free(struct ieee80211_node *ni)
925 {
926 	struct atw_softc *sc = (struct atw_softc *)ni->ni_ic->ic_ifp->if_softc;
927 
928 	DPRINTF(sc, ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
929 	    ether_sprintf(ni->ni_bssid)));
930 	(*sc->sc_node_free)(ni);
931 }
932 
933 
934 static void
935 atw_test1_reset(struct atw_softc *sc)
936 {
937 	switch (sc->sc_rev) {
938 	case ATW_REVISION_BA:
939 		if (1 /* XXX condition on transceiver type */) {
940 			ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
941 		}
942 		break;
943 	case ATW_REVISION_CA:
944 		ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
945 		break;
946 	default:
947 		break;
948 	}
949 }
950 
951 /*
952  * atw_reset:
953  *
954  *	Perform a soft reset on the ADM8211.
955  */
956 void
957 atw_reset(struct atw_softc *sc)
958 {
959 	int i;
960 	uint32_t lpc;
961 
962 	ATW_WRITE(sc, ATW_NAR, 0x0);
963 	DELAY(atw_nar_delay);
964 
965 	/* Reference driver has a cryptic remark indicating that this might
966 	 * power-on the chip.  I know that it turns off power-saving....
967 	 */
968 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
969 
970 	ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
971 
972 	for (i = 0; i < 50000 / atw_pseudo_milli; i++) {
973 		if (ATW_READ(sc, ATW_PAR) == 0)
974 			break;
975 		DELAY(atw_pseudo_milli);
976 	}
977 
978 	/* ... and then pause 100ms longer for good measure. */
979 	DELAY(atw_magic_delay1);
980 
981 	DPRINTF2(sc, ("%s: atw_reset %d iterations\n", sc->sc_dev.dv_xname, i));
982 
983 	if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
984 		printf("%s: reset failed to complete\n", sc->sc_dev.dv_xname);
985 
986 	atw_test1_reset(sc);
987 	/*
988 	 * Initialize the PCI Access Register.
989 	 */
990 	sc->sc_busmode = ATW_PAR_PBL_8DW;
991 
992 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
993 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
994 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
995 
996 	/* Turn off maximum power saving, etc.
997 	 *
998 	 * XXX Following example of reference driver, should I set
999 	 * an AID of 1?  It didn't seem to help....
1000 	 */
1001 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
1002 
1003 	DELAY(atw_magic_delay2);
1004 
1005 	/* Recall EEPROM. */
1006 	ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
1007 
1008 	DELAY(atw_magic_delay4);
1009 
1010 	lpc = ATW_READ(sc, ATW_LPC);
1011 
1012 	DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
1013 
1014 	/* A reset seems to affect the SRAM contents, so put them into
1015 	 * a known state.
1016 	 */
1017 	atw_clear_sram(sc);
1018 
1019 	memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
1020 }
1021 
1022 static void
1023 atw_clear_sram(struct atw_softc *sc)
1024 {
1025 	memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
1026 	sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
1027 	/* XXX not for revision 0x20. */
1028 	atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
1029 }
1030 
1031 /* TBD atw_init
1032  *
1033  * set MAC based on ic->ic_bss->myaddr
1034  * write WEP keys
1035  * set TX rate
1036  */
1037 
1038 /* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
1039  * without receiving a beacon with the preferred BSSID & SSID.
1040  * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
1041  */
1042 static void
1043 atw_wcsr_init(struct atw_softc *sc)
1044 {
1045 	uint32_t wcsr;
1046 
1047 	wcsr = ATW_READ(sc, ATW_WCSR);
1048 	wcsr &= ~(ATW_WCSR_BLN_MASK|ATW_WCSR_LSOE|ATW_WCSR_MPRE|ATW_WCSR_LSOE);
1049 	wcsr |= LSHIFT(7, ATW_WCSR_BLN_MASK);
1050 	ATW_WRITE(sc, ATW_WCSR, wcsr);	/* XXX resets wake-up status bits */
1051 
1052 	DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
1053 	    sc->sc_dev.dv_xname, __func__, ATW_READ(sc, ATW_WCSR)));
1054 }
1055 
1056 /* Turn off power management.  Set Rx store-and-forward mode. */
1057 static void
1058 atw_cmdr_init(struct atw_softc *sc)
1059 {
1060 	uint32_t cmdr;
1061 	cmdr = ATW_READ(sc, ATW_CMDR);
1062 	cmdr &= ~ATW_CMDR_APM;
1063 	cmdr |= ATW_CMDR_RTE;
1064 	cmdr &= ~ATW_CMDR_DRT_MASK;
1065 	cmdr |= ATW_CMDR_DRT_SF;
1066 
1067 	ATW_WRITE(sc, ATW_CMDR, cmdr);
1068 }
1069 
1070 static void
1071 atw_tofs2_init(struct atw_softc *sc)
1072 {
1073 	uint32_t tofs2;
1074 	/* XXX this magic can probably be figured out from the RFMD docs */
1075 #ifndef ATW_REFSLAVE
1076 	tofs2 = LSHIFT(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1077 	      LSHIFT(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1078 	      LSHIFT(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1079 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1080 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1081 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1082 	      LSHIFT(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1083 	      LSHIFT(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1084 #else
1085 	/* XXX new magic from reference driver source */
1086 	tofs2 = LSHIFT(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1087 	      LSHIFT(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1088 	      LSHIFT(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1089 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1090 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1091 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1092 	      LSHIFT(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1093 	      LSHIFT(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1094 #endif
1095 	ATW_WRITE(sc, ATW_TOFS2, tofs2);
1096 }
1097 
1098 static void
1099 atw_nar_init(struct atw_softc *sc)
1100 {
1101 	ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF|ATW_NAR_PB);
1102 }
1103 
1104 static void
1105 atw_txlmt_init(struct atw_softc *sc)
1106 {
1107 	ATW_WRITE(sc, ATW_TXLMT, LSHIFT(512, ATW_TXLMT_MTMLT_MASK) |
1108 	                         LSHIFT(1, ATW_TXLMT_SRTYLIM_MASK));
1109 }
1110 
1111 static void
1112 atw_test1_init(struct atw_softc *sc)
1113 {
1114 	uint32_t test1;
1115 
1116 	test1 = ATW_READ(sc, ATW_TEST1);
1117 	test1 &= ~(ATW_TEST1_DBGREAD_MASK|ATW_TEST1_CONTROL);
1118 	/* XXX magic 0x1 */
1119 	test1 |= LSHIFT(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
1120 	ATW_WRITE(sc, ATW_TEST1, test1);
1121 }
1122 
1123 static void
1124 atw_rf_reset(struct atw_softc *sc)
1125 {
1126 	/* XXX this resets an Intersil RF front-end? */
1127 	/* TBD condition on Intersil RFType? */
1128 	ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
1129 	DELAY(atw_rf_delay1);
1130 	ATW_WRITE(sc, ATW_SYNRF, 0);
1131 	DELAY(atw_rf_delay2);
1132 }
1133 
1134 /* Set 16 TU max duration for the contention-free period (CFP). */
1135 static void
1136 atw_cfp_init(struct atw_softc *sc)
1137 {
1138 	uint32_t cfpp;
1139 
1140 	cfpp = ATW_READ(sc, ATW_CFPP);
1141 	cfpp &= ~ATW_CFPP_CFPMD;
1142 	cfpp |= LSHIFT(16, ATW_CFPP_CFPMD);
1143 	ATW_WRITE(sc, ATW_CFPP, cfpp);
1144 }
1145 
1146 static void
1147 atw_tofs0_init(struct atw_softc *sc)
1148 {
1149 	/* XXX I guess that the Cardbus clock is 22MHz?
1150 	 * I am assuming that the role of ATW_TOFS0_USCNT is
1151 	 * to divide the bus clock to get a 1MHz clock---the datasheet is not
1152 	 * very clear on this point. It says in the datasheet that it is
1153 	 * possible for the ADM8211 to accomodate bus speeds between 22MHz
1154 	 * and 33MHz; maybe this is the way? I see a binary-only driver write
1155 	 * these values. These values are also the power-on default.
1156 	 */
1157 	ATW_WRITE(sc, ATW_TOFS0,
1158 	    LSHIFT(22, ATW_TOFS0_USCNT_MASK) |
1159 	    ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
1160 }
1161 
1162 /* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
1163 static void
1164 atw_ifs_init(struct atw_softc *sc)
1165 {
1166 	uint32_t ifst;
1167 	/* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
1168 	 * Go figure.
1169 	 */
1170 	ifst = LSHIFT(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
1171 	      LSHIFT(22 * 5 /* IEEE80211_DUR_DS_SIFS */ /* # of 22MHz cycles */,
1172 	             ATW_IFST_SIFS_MASK) |
1173 	      LSHIFT(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
1174 	      LSHIFT(0x64 /* IEEE80211_DUR_DS_EIFS */, ATW_IFST_EIFS_MASK);
1175 
1176 	ATW_WRITE(sc, ATW_IFST, ifst);
1177 }
1178 
1179 static void
1180 atw_response_times_init(struct atw_softc *sc)
1181 {
1182 	/* XXX More magic. Relates to ACK timing?  The datasheet seems to
1183 	 * indicate that the MAC expects at least SIFS + MIRT microseconds
1184 	 * to pass after it transmits a frame that requires a response;
1185 	 * it waits at most SIFS + MART microseconds for the response.
1186 	 * Surely this is not the ACK timeout?
1187 	 */
1188 	ATW_WRITE(sc, ATW_RSPT, LSHIFT(0xffff, ATW_RSPT_MART_MASK) |
1189 	    LSHIFT(0xff, ATW_RSPT_MIRT_MASK));
1190 }
1191 
1192 /* Set up the MMI read/write addresses for the baseband. The Tx/Rx
1193  * engines read and write baseband registers after Rx and before
1194  * Tx, respectively.
1195  */
1196 static void
1197 atw_bbp_io_init(struct atw_softc *sc)
1198 {
1199 	uint32_t mmiraddr2;
1200 
1201 	/* XXX The reference driver does this, but is it *really*
1202 	 * necessary?
1203 	 */
1204 	switch (sc->sc_rev) {
1205 	case ATW_REVISION_AB:
1206 	case ATW_REVISION_AF:
1207 		mmiraddr2 = 0x0;
1208 		break;
1209 	default:
1210 		mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
1211 		mmiraddr2 &=
1212 		    ~(ATW_MMIRADDR2_PROREXT|ATW_MMIRADDR2_PRORLEN_MASK);
1213 		break;
1214 	}
1215 
1216 	switch (sc->sc_bbptype) {
1217 	case ATW_BBPTYPE_INTERSIL:
1218 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
1219 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
1220 		mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
1221 		break;
1222 	case ATW_BBPTYPE_MARVEL:
1223 		/* TBD find out the Marvel settings. */
1224 		break;
1225 	case ATW_BBPTYPE_RFMD:
1226 	default:
1227 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
1228 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
1229 		mmiraddr2 |= ATW_MMIRADDR2_RFMD;
1230 		break;
1231 	}
1232 	ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
1233 	ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
1234 }
1235 
1236 /*
1237  * atw_init:		[ ifnet interface function ]
1238  *
1239  *	Initialize the interface.  Must be called at splnet().
1240  */
1241 int
1242 atw_init(struct ifnet *ifp)
1243 {
1244 	struct atw_softc *sc = ifp->if_softc;
1245 	struct ieee80211com *ic = &sc->sc_ic;
1246 	struct atw_txsoft *txs;
1247 	struct atw_rxsoft *rxs;
1248 	int i, error = 0;
1249 
1250 	if ((error = atw_enable(sc)) != 0)
1251 		goto out;
1252 
1253 	/*
1254 	 * Cancel any pending I/O. This also resets.
1255 	 */
1256 	atw_stop(ifp, 0);
1257 
1258 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1259 	DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
1260 	    __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
1261 	    ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
1262 
1263 	atw_wcsr_init(sc);
1264 
1265 	atw_cmdr_init(sc);
1266 
1267 	/* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
1268 	 *
1269 	 * XXX Set transmit power for ATIM, RTS, Beacon.
1270 	 */
1271 	ATW_WRITE(sc, ATW_PLCPHD, LSHIFT(10, ATW_PLCPHD_SIGNAL_MASK) |
1272 	    LSHIFT(0xb0, ATW_PLCPHD_SERVICE_MASK));
1273 
1274 	atw_tofs2_init(sc);
1275 
1276 	atw_nar_init(sc);
1277 
1278 	atw_txlmt_init(sc);
1279 
1280 	atw_test1_init(sc);
1281 
1282 	atw_rf_reset(sc);
1283 
1284 	atw_cfp_init(sc);
1285 
1286 	atw_tofs0_init(sc);
1287 
1288 	atw_ifs_init(sc);
1289 
1290 	/* XXX Fall asleep after one second of inactivity.
1291 	 * XXX A frame may only dribble in for 65536us.
1292 	 */
1293 	ATW_WRITE(sc, ATW_RMD,
1294 	    LSHIFT(1, ATW_RMD_PCNT) | LSHIFT(0xffff, ATW_RMD_RMRD_MASK));
1295 
1296 	atw_response_times_init(sc);
1297 
1298 	atw_bbp_io_init(sc);
1299 
1300 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1301 
1302 	if ((error = atw_rf3000_init(sc)) != 0)
1303 		goto out;
1304 
1305 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
1306 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
1307 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
1308 
1309 	/*
1310 	 * Initialize the transmit descriptor ring.
1311 	 */
1312 	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
1313 	for (i = 0; i < ATW_NTXDESC; i++) {
1314 		sc->sc_txdescs[i].at_ctl = 0;
1315 		/* no transmit chaining */
1316 		sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
1317 		sc->sc_txdescs[i].at_buf2 =
1318 		    htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
1319 	}
1320 	/* use ring mode */
1321 	sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
1322 	ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
1323 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1324 	sc->sc_txfree = ATW_NTXDESC;
1325 	sc->sc_txnext = 0;
1326 
1327 	/*
1328 	 * Initialize the transmit job descriptors.
1329 	 */
1330 	SIMPLEQ_INIT(&sc->sc_txfreeq);
1331 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
1332 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
1333 		txs = &sc->sc_txsoft[i];
1334 		txs->txs_mbuf = NULL;
1335 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
1336 	}
1337 
1338 	/*
1339 	 * Initialize the receive descriptor and receive job
1340 	 * descriptor rings.
1341 	 */
1342 	for (i = 0; i < ATW_NRXDESC; i++) {
1343 		rxs = &sc->sc_rxsoft[i];
1344 		if (rxs->rxs_mbuf == NULL) {
1345 			if ((error = atw_add_rxbuf(sc, i)) != 0) {
1346 				printf("%s: unable to allocate or map rx "
1347 				    "buffer %d, error = %d\n",
1348 				    sc->sc_dev.dv_xname, i, error);
1349 				/*
1350 				 * XXX Should attempt to run with fewer receive
1351 				 * XXX buffers instead of just failing.
1352 				 */
1353 				atw_rxdrain(sc);
1354 				goto out;
1355 			}
1356 		} else
1357 			ATW_INIT_RXDESC(sc, i);
1358 	}
1359 	sc->sc_rxptr = 0;
1360 
1361 	/*
1362 	 * Initialize the interrupt mask and enable interrupts.
1363 	 */
1364 	/* normal interrupts */
1365 	sc->sc_inten =  ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
1366 	    ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
1367 
1368 	/* abnormal interrupts */
1369 	sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
1370 	    ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
1371 	    ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1372 
1373 	sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
1374 	    ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1375 	sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
1376 	sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
1377 	    ATW_INTR_TRT;
1378 
1379 	sc->sc_linkint_mask &= sc->sc_inten;
1380 	sc->sc_rxint_mask &= sc->sc_inten;
1381 	sc->sc_txint_mask &= sc->sc_inten;
1382 
1383 	ATW_WRITE(sc, ATW_IER, sc->sc_inten);
1384 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1385 
1386 	DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
1387 	    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_IER), sc->sc_inten));
1388 
1389 	/*
1390 	 * Give the transmit and receive rings to the ADM8211.
1391 	 */
1392 	ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
1393 	ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
1394 
1395 	sc->sc_txthresh = 0;
1396 	sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
1397 	    sc->sc_txth[sc->sc_txthresh].txth_opmode;
1398 
1399 	/* common 802.11 configuration */
1400 	ic->ic_flags &= ~IEEE80211_F_IBSSON;
1401 	switch (ic->ic_opmode) {
1402 	case IEEE80211_M_STA:
1403 		break;
1404 	case IEEE80211_M_AHDEMO: /* XXX */
1405 	case IEEE80211_M_IBSS:
1406 		ic->ic_flags |= IEEE80211_F_IBSSON;
1407 		/*FALLTHROUGH*/
1408 	case IEEE80211_M_HOSTAP: /* XXX */
1409 		break;
1410 	case IEEE80211_M_MONITOR: /* XXX */
1411 		break;
1412 	}
1413 
1414 	switch (ic->ic_opmode) {
1415 	case IEEE80211_M_AHDEMO:
1416 	case IEEE80211_M_HOSTAP:
1417 #ifndef IEEE80211_NO_HOSTAP
1418 		ic->ic_bss->ni_intval = ic->ic_lintval;
1419 		ic->ic_bss->ni_rssi = 0;
1420 		ic->ic_bss->ni_rstamp = 0;
1421 #endif /* !IEEE80211_NO_HOSTAP */
1422 		break;
1423 	default:					/* XXX */
1424 		break;
1425 	}
1426 
1427 	sc->sc_wepctl = 0;
1428 
1429 	atw_write_ssid(sc);
1430 	atw_write_sup_rates(sc);
1431 	if (ic->ic_caps & IEEE80211_C_WEP)
1432 		atw_write_wep(sc);
1433 
1434 	ic->ic_state = IEEE80211_S_INIT;
1435 
1436 	/*
1437 	 * Set the receive filter.  This will start the transmit and
1438 	 * receive processes.
1439 	 */
1440 	atw_filter_setup(sc);
1441 
1442 	/*
1443 	 * Start the receive process.
1444 	 */
1445 	ATW_WRITE(sc, ATW_RDR, 0x1);
1446 
1447 	/*
1448 	 * Note that the interface is now running.
1449 	 */
1450 	ifp->if_flags |= IFF_RUNNING;
1451 	ifp->if_flags &= ~IFF_OACTIVE;
1452 
1453 	/* send no beacons, yet. */
1454 	atw_start_beacon(sc, 0);
1455 
1456 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
1457 		error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1458 	else
1459 		error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1460  out:
1461 	if (error) {
1462 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1463 		ifp->if_timer = 0;
1464 		printf("%s: interface not running\n", sc->sc_dev.dv_xname);
1465 	}
1466 #ifdef ATW_DEBUG
1467 	atw_print_regs(sc, "end of init");
1468 #endif /* ATW_DEBUG */
1469 
1470 	return (error);
1471 }
1472 
1473 /* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
1474  *           0: MAC control of RF3000/Si4126.
1475  *
1476  * Applies power, or selects RF front-end? Sets reset condition.
1477  *
1478  * TBD support non-RFMD BBP, non-SiLabs synth.
1479  */
1480 static void
1481 atw_bbp_io_enable(struct atw_softc *sc, int enable)
1482 {
1483 	if (enable) {
1484 		ATW_WRITE(sc, ATW_SYNRF,
1485 		    ATW_SYNRF_SELRF|ATW_SYNRF_PE1|ATW_SYNRF_PHYRST);
1486 		DELAY(atw_bbp_io_enable_delay);
1487 	} else {
1488 		ATW_WRITE(sc, ATW_SYNRF, 0);
1489 		DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
1490 	}
1491 }
1492 
1493 static int
1494 atw_tune(struct atw_softc *sc)
1495 {
1496 	int rc;
1497 	u_int chan;
1498 	struct ieee80211com *ic = &sc->sc_ic;
1499 
1500 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1501 	if (chan == IEEE80211_CHAN_ANY)
1502 		panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
1503 
1504 	if (chan == sc->sc_cur_chan)
1505 		return 0;
1506 
1507 	DPRINTF(sc, ("%s: chan %d -> %d\n", sc->sc_dev.dv_xname,
1508 	    sc->sc_cur_chan, chan));
1509 
1510 	atw_idle(sc, ATW_NAR_SR|ATW_NAR_ST);
1511 
1512 	atw_si4126_tune(sc, chan);
1513 	if ((rc = atw_rf3000_tune(sc, chan)) != 0)
1514 		printf("%s: failed to tune channel %d\n", sc->sc_dev.dv_xname,
1515 		    chan);
1516 
1517 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
1518 	DELAY(atw_nar_delay);
1519 	ATW_WRITE(sc, ATW_RDR, 0x1);
1520 
1521 	if (rc == 0)
1522 		sc->sc_cur_chan = chan;
1523 
1524 	return rc;
1525 }
1526 
1527 #ifdef ATW_SYNDEBUG
1528 static void
1529 atw_si4126_print(struct atw_softc *sc)
1530 {
1531 	struct ifnet *ifp = &sc->sc_if;
1532 	u_int addr, val;
1533 
1534 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1535 		return;
1536 
1537 	for (addr = 0; addr <= 8; addr++) {
1538 		printf("%s: synth[%d] = ", sc->sc_dev.dv_xname, addr);
1539 		if (atw_si4126_read(sc, addr, &val) == 0) {
1540 			printf("<unknown> (quitting print-out)\n");
1541 			break;
1542 		}
1543 		printf("%05x\n", val);
1544 	}
1545 }
1546 #endif /* ATW_SYNDEBUG */
1547 
1548 /* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
1549  *
1550  * The RF/IF synthesizer produces two reference frequencies for
1551  * the RF2948B transceiver.  The first frequency the RF2948B requires
1552  * is two times the so-called "intermediate frequency" (IF). Since
1553  * a SAW filter on the radio fixes the IF at 374MHz, I program the
1554  * Si4126 to generate IF LO = 374MHz x 2 = 748MHz.  The second
1555  * frequency required by the transceiver is the radio frequency
1556  * (RF). This is a superheterodyne transceiver; for f(chan) the
1557  * center frequency of the channel we are tuning, RF = f(chan) -
1558  * IF.
1559  *
1560  * XXX I am told by SiLabs that the Si4126 will accept a broader range
1561  * of XIN than the 2-25MHz mentioned by the datasheet, even *without*
1562  * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
1563  * works, but I have still programmed for XINDIV2 = 1 to be safe.
1564  */
1565 static void
1566 atw_si4126_tune(struct atw_softc *sc, u_int chan)
1567 {
1568 	u_int mhz;
1569 	u_int R;
1570 	u_int32_t gpio;
1571 	u_int16_t gain;
1572 
1573 #ifdef ATW_SYNDEBUG
1574 	atw_si4126_print(sc);
1575 #endif /* ATW_SYNDEBUG */
1576 
1577 	if (chan == 14)
1578 		mhz = 2484;
1579 	else
1580 		mhz = 2412 + 5 * (chan - 1);
1581 
1582 	/* Tune IF to 748MHz to suit the IF LO input of the
1583 	 * RF2494B, which is 2 x IF. No need to set an IF divider
1584          * because an IF in 526MHz - 952MHz is allowed.
1585 	 *
1586 	 * XIN is 44.000MHz, so divide it by two to get allowable
1587 	 * range of 2-25MHz. SiLabs tells me that this is not
1588 	 * strictly necessary.
1589 	 */
1590 
1591 	if (atw_xindiv2)
1592 		R = 44;
1593 	else
1594 		R = 88;
1595 
1596 	/* Power-up RF, IF synthesizers. */
1597 	atw_si4126_write(sc, SI4126_POWER,
1598 	    SI4126_POWER_PDIB|SI4126_POWER_PDRB);
1599 
1600 	/* set LPWR, too? */
1601 	atw_si4126_write(sc, SI4126_MAIN,
1602 	    (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
1603 
1604 	/* Set the phase-locked loop gain.  If RF2 N > 2047, then
1605 	 * set KP2 to 1.
1606 	 *
1607 	 * REFDIF This is different from the reference driver, which
1608 	 * always sets SI4126_GAIN to 0.
1609 	 */
1610 	gain = LSHIFT(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
1611 
1612 	atw_si4126_write(sc, SI4126_GAIN, gain);
1613 
1614 	/* XIN = 44MHz.
1615 	 *
1616 	 * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
1617 	 * R = 44 so that 1496/(2 * 44) * 44MHz = 748MHz.
1618 	 *
1619 	 * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
1620 	 * so that 1496/88 * 44MHz = 748MHz.
1621 	 */
1622 	atw_si4126_write(sc, SI4126_IFN, 1496);
1623 
1624 	atw_si4126_write(sc, SI4126_IFR, R);
1625 
1626 #ifndef ATW_REFSLAVE
1627 	/* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
1628 	 * then RF1 becomes the active RF synthesizer, even on the Si4126,
1629 	 * which has no RF1!
1630 	 */
1631 	atw_si4126_write(sc, SI4126_RF1R, R);
1632 
1633 	atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
1634 #endif
1635 
1636 	/* N/R * XIN = RF. XIN = 44MHz. We desire RF = mhz - IF,
1637 	 * where IF = 374MHz.  Let's divide XIN to 1MHz. So R = 44.
1638 	 * Now let's multiply it to mhz. So mhz - IF = N.
1639 	 */
1640 	atw_si4126_write(sc, SI4126_RF2R, R);
1641 
1642 	atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
1643 
1644 	/* wait 100us from power-up for RF, IF to settle */
1645 	DELAY(100);
1646 
1647 	gpio = ATW_READ(sc, ATW_GPIO);
1648 	gpio &= ~(ATW_GPIO_EN_MASK|ATW_GPIO_O_MASK|ATW_GPIO_I_MASK);
1649 	gpio |= LSHIFT(1, ATW_GPIO_EN_MASK);
1650 
1651 	if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
1652 		/* Set a Prism RF front-end to a special mode for channel 14?
1653 		 *
1654 		 * Apparently the SMC2635W needs this, although I don't think
1655 		 * it has a Prism RF.
1656 		 */
1657 		gpio |= LSHIFT(1, ATW_GPIO_O_MASK);
1658 	}
1659 	ATW_WRITE(sc, ATW_GPIO, gpio);
1660 
1661 #ifdef ATW_SYNDEBUG
1662 	atw_si4126_print(sc);
1663 #endif /* ATW_SYNDEBUG */
1664 }
1665 
1666 /* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
1667  * diversity.
1668  *
1669  * !!!
1670  * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
1671  * !!!
1672  */
1673 static int
1674 atw_rf3000_init(struct atw_softc *sc)
1675 {
1676 	int rc = 0;
1677 
1678 	atw_bbp_io_enable(sc, 1);
1679 
1680 	/* CCA is acquisition sensitive */
1681 	rc = atw_rf3000_write(sc, RF3000_CCACTL,
1682 	    LSHIFT(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
1683 
1684 	if (rc != 0)
1685 		goto out;
1686 
1687 	/* enable diversity */
1688 	rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
1689 
1690 	if (rc != 0)
1691 		goto out;
1692 
1693 	/* sensible setting from a binary-only driver */
1694 	rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1695 	    LSHIFT(0x1d, RF3000_GAINCTL_TXVGC_MASK));
1696 
1697 	if (rc != 0)
1698 		goto out;
1699 
1700 	/* magic from a binary-only driver */
1701 	rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
1702 	    LSHIFT(0x38, RF3000_LOGAINCAL_CAL_MASK));
1703 
1704 	if (rc != 0)
1705 		goto out;
1706 
1707 	rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
1708 
1709 	if (rc != 0)
1710 		goto out;
1711 
1712 	/* XXX Reference driver remarks that Abocom sets this to 50.
1713 	 * Meaning 0x50, I think....  50 = 0x32, which would set a bit
1714 	 * in the "reserved" area of register RF3000_OPTIONS1.
1715 	 */
1716 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
1717 
1718 	if (rc != 0)
1719 		goto out;
1720 
1721 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
1722 
1723 	if (rc != 0)
1724 		goto out;
1725 
1726 out:
1727 	atw_bbp_io_enable(sc, 0);
1728 	return rc;
1729 }
1730 
1731 #ifdef ATW_BBPDEBUG
1732 static void
1733 atw_rf3000_print(struct atw_softc *sc)
1734 {
1735 	struct ifnet *ifp = &sc->sc_if;
1736 	u_int addr, val;
1737 
1738 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1739 		return;
1740 
1741 	for (addr = 0x01; addr <= 0x15; addr++) {
1742 		printf("%s: bbp[%d] = \n", sc->sc_dev.dv_xname, addr);
1743 		if (atw_rf3000_read(sc, addr, &val) != 0) {
1744 			printf("<unknown> (quitting print-out)\n");
1745 			break;
1746 		}
1747 		printf("%08x\n", val);
1748 	}
1749 }
1750 #endif /* ATW_BBPDEBUG */
1751 
1752 /* Set the power settings on the BBP for channel `chan'. */
1753 static int
1754 atw_rf3000_tune(struct atw_softc *sc, u_int chan)
1755 {
1756 	int rc = 0;
1757 	u_int32_t reg;
1758 	u_int16_t txpower, lpf_cutoff, lna_gs_thresh;
1759 
1760 	txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
1761 	lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
1762 	lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
1763 
1764 	/* odd channels: LSB, even channels: MSB */
1765 	if (chan % 2 == 1) {
1766 		txpower &= 0xFF;
1767 		lpf_cutoff &= 0xFF;
1768 		lna_gs_thresh &= 0xFF;
1769 	} else {
1770 		txpower >>= 8;
1771 		lpf_cutoff >>= 8;
1772 		lna_gs_thresh >>= 8;
1773 	}
1774 
1775 #ifdef ATW_BBPDEBUG
1776 	atw_rf3000_print(sc);
1777 #endif /* ATW_BBPDEBUG */
1778 
1779 	DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
1780 	    "lna_gs_thresh %02x\n",
1781 	    sc->sc_dev.dv_xname, chan, txpower, lpf_cutoff, lna_gs_thresh));
1782 
1783 	atw_bbp_io_enable(sc, 1);
1784 
1785 	if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1786 	    LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
1787 		goto out;
1788 
1789 	if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
1790 		goto out;
1791 
1792 	if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
1793 		goto out;
1794 
1795 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0);
1796 
1797 	if (rc != 0)
1798 		goto out;
1799 
1800 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
1801 
1802 	if (rc != 0)
1803 		goto out;
1804 
1805 #ifdef ATW_BBPDEBUG
1806 	atw_rf3000_print(sc);
1807 #endif /* ATW_BBPDEBUG */
1808 
1809 out:
1810 	atw_bbp_io_enable(sc, 0);
1811 
1812 	/* set beacon, rts, atim transmit power */
1813 	reg = ATW_READ(sc, ATW_PLCPHD);
1814 	reg &= ~ATW_PLCPHD_SERVICE_MASK;
1815 	reg |= LSHIFT(LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK),
1816 	    ATW_PLCPHD_SERVICE_MASK);
1817 	ATW_WRITE(sc, ATW_PLCPHD, reg);
1818 	DELAY(atw_plcphd_delay);
1819 
1820 	return rc;
1821 }
1822 
1823 /* Write a register on the RF3000 baseband processor using the
1824  * registers provided by the ADM8211 for this purpose.
1825  *
1826  * Return 0 on success.
1827  */
1828 static int
1829 atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
1830 {
1831 	u_int32_t reg;
1832 	int i;
1833 
1834 	reg = sc->sc_bbpctl_wr |
1835 	     LSHIFT(val & 0xff, ATW_BBPCTL_DATA_MASK) |
1836 	     LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1837 
1838 	for (i = 20000 / atw_pseudo_milli; --i >= 0; ) {
1839 		ATW_WRITE(sc, ATW_BBPCTL, reg);
1840 		DELAY(2 * atw_pseudo_milli);
1841 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
1842 			break;
1843 	}
1844 
1845 	if (i < 0) {
1846 		printf("%s: BBPCTL still busy\n", sc->sc_dev.dv_xname);
1847 		return ETIMEDOUT;
1848 	}
1849 	return 0;
1850 }
1851 
1852 /* Read a register on the RF3000 baseband processor using the registers
1853  * the ADM8211 provides for this purpose.
1854  *
1855  * The 7-bit register address is addr.  Record the 8-bit data in the register
1856  * in *val.
1857  *
1858  * Return 0 on success.
1859  *
1860  * XXX This does not seem to work. The ADM8211 must require more or
1861  * different magic to read the chip than to write it. Possibly some
1862  * of the magic I have derived from a binary-only driver concerns
1863  * the "chip address" (see the RF3000 manual).
1864  */
1865 #ifdef ATW_BBPDEBUG
1866 static int
1867 atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
1868 {
1869 	u_int32_t reg;
1870 	int i;
1871 
1872 	for (i = 1000; --i >= 0; ) {
1873 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD|ATW_BBPCTL_WR) == 0)
1874 			break;
1875 		DELAY(100);
1876 	}
1877 
1878 	if (i < 0) {
1879 		printf("%s: start atw_rf3000_read, BBPCTL busy\n",
1880 		    sc->sc_dev.dv_xname);
1881 		return ETIMEDOUT;
1882 	}
1883 
1884 	reg = sc->sc_bbpctl_rd | LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1885 
1886 	ATW_WRITE(sc, ATW_BBPCTL, reg);
1887 
1888 	for (i = 1000; --i >= 0; ) {
1889 		DELAY(100);
1890 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
1891 			break;
1892 	}
1893 
1894 	ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
1895 
1896 	if (i < 0) {
1897 		printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
1898 		    sc->sc_dev.dv_xname, reg);
1899 		return ETIMEDOUT;
1900 	}
1901 	if (val != NULL)
1902 		*val = MASK_AND_RSHIFT(reg, ATW_BBPCTL_DATA_MASK);
1903 	return 0;
1904 }
1905 #endif /* ATW_BBPDEBUG */
1906 
1907 /* Write a register on the Si4126 RF/IF synthesizer using the registers
1908  * provided by the ADM8211 for that purpose.
1909  *
1910  * val is 18 bits of data, and val is the 4-bit address of the register.
1911  *
1912  * Return 0 on success.
1913  */
1914 static void
1915 atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
1916 {
1917 	uint32_t bits, mask, reg;
1918 	const int nbits = 22;
1919 
1920 	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1921 	KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
1922 
1923 	bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
1924 	       LSHIFT(addr, SI4126_TWI_ADDR_MASK);
1925 
1926 	reg = ATW_SYNRF_SELSYN;
1927 	/* reference driver: reset Si4126 serial bus to initial
1928 	 * conditions?
1929 	 */
1930 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1931 	ATW_WRITE(sc, ATW_SYNRF, reg);
1932 
1933 	for (mask = BIT(nbits - 1); mask != 0; mask >>= 1) {
1934 		if ((bits & mask) != 0)
1935 			reg |= ATW_SYNRF_SYNDATA;
1936 		else
1937 			reg &= ~ATW_SYNRF_SYNDATA;
1938 		ATW_WRITE(sc, ATW_SYNRF, reg);
1939 		ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
1940 		ATW_WRITE(sc, ATW_SYNRF, reg);
1941 	}
1942 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1943 	ATW_WRITE(sc, ATW_SYNRF, 0x0);
1944 }
1945 
1946 /* Read 18-bit data from the 4-bit address addr in Si4126
1947  * RF synthesizer and write the data to *val. Return 0 on success.
1948  *
1949  * XXX This does not seem to work. The ADM8211 must require more or
1950  * different magic to read the chip than to write it.
1951  */
1952 #ifdef ATW_SYNDEBUG
1953 static int
1954 atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
1955 {
1956 	u_int32_t reg;
1957 	int i;
1958 
1959 	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1960 
1961 	for (i = 1000; --i >= 0; ) {
1962 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD|ATW_SYNCTL_WR) == 0)
1963 			break;
1964 		DELAY(100);
1965 	}
1966 
1967 	if (i < 0) {
1968 		printf("%s: start atw_si4126_read, SYNCTL busy\n",
1969 		    sc->sc_dev.dv_xname);
1970 		return ETIMEDOUT;
1971 	}
1972 
1973 	reg = sc->sc_synctl_rd | LSHIFT(addr, ATW_SYNCTL_DATA_MASK);
1974 
1975 	ATW_WRITE(sc, ATW_SYNCTL, reg);
1976 
1977 	for (i = 1000; --i >= 0; ) {
1978 		DELAY(100);
1979 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
1980 			break;
1981 	}
1982 
1983 	ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
1984 
1985 	if (i < 0) {
1986 		printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
1987 		    sc->sc_dev.dv_xname, reg);
1988 		return ETIMEDOUT;
1989 	}
1990 	if (val != NULL)
1991 		*val = MASK_AND_RSHIFT(ATW_READ(sc, ATW_SYNCTL),
1992 		                       ATW_SYNCTL_DATA_MASK);
1993 	return 0;
1994 }
1995 #endif /* ATW_SYNDEBUG */
1996 
1997 /* XXX is the endianness correct? test. */
1998 #define	atw_calchash(addr) \
1999 	(ether_crc32_le((addr), IEEE80211_ADDR_LEN) & BITS(5, 0))
2000 
2001 /*
2002  * atw_filter_setup:
2003  *
2004  *	Set the ADM8211's receive filter.
2005  */
2006 static void
2007 atw_filter_setup(struct atw_softc *sc)
2008 {
2009 	struct ieee80211com *ic = &sc->sc_ic;
2010 	struct ethercom *ec = &sc->sc_ec;
2011 	struct ifnet *ifp = &sc->sc_if;
2012 	int hash;
2013 	u_int32_t hashes[2];
2014 	struct ether_multi *enm;
2015 	struct ether_multistep step;
2016 
2017 	/* According to comments in tlp_al981_filter_setup
2018 	 * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
2019 	 * multicast filter to be set while it is running.  Hopefully
2020 	 * the ADM8211 is not the same!
2021 	 */
2022 	if ((ifp->if_flags & IFF_RUNNING) != 0)
2023 		atw_idle(sc, ATW_NAR_SR);
2024 
2025 	sc->sc_opmode &= ~(ATW_NAR_PR|ATW_NAR_MM);
2026 
2027 	/* XXX in scan mode, do not filter packets.  Maybe this is
2028 	 * unnecessary.
2029 	 */
2030 	if (ic->ic_state == IEEE80211_S_SCAN ||
2031 	    (ifp->if_flags & IFF_PROMISC) != 0) {
2032 		sc->sc_opmode |= ATW_NAR_PR;
2033 		goto allmulti;
2034 	}
2035 
2036 	hashes[0] = hashes[1] = 0x0;
2037 
2038 	/*
2039 	 * Program the 64-bit multicast hash filter.
2040 	 */
2041 	ETHER_FIRST_MULTI(step, ec, enm);
2042 	while (enm != NULL) {
2043 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2044 		    ETHER_ADDR_LEN) != 0)
2045 			goto allmulti;
2046 
2047 		hash = atw_calchash(enm->enm_addrlo);
2048 		hashes[hash >> 5] |= 1 << (hash & 0x1f);
2049 		ETHER_NEXT_MULTI(step, enm);
2050 		sc->sc_opmode |= ATW_NAR_MM;
2051 	}
2052 	ifp->if_flags &= ~IFF_ALLMULTI;
2053 	goto setit;
2054 
2055 allmulti:
2056 	sc->sc_opmode |= ATW_NAR_MM;
2057 	ifp->if_flags |= IFF_ALLMULTI;
2058 	hashes[0] = hashes[1] = 0xffffffff;
2059 
2060 setit:
2061 	ATW_WRITE(sc, ATW_MAR0, hashes[0]);
2062 	ATW_WRITE(sc, ATW_MAR1, hashes[1]);
2063 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2064 	DELAY(atw_nar_delay);
2065 
2066 	DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", sc->sc_dev.dv_xname,
2067 	    ATW_READ(sc, ATW_NAR), sc->sc_opmode));
2068 }
2069 
2070 /* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
2071  * a beacon's BSSID and SSID against the preferred BSSID and SSID
2072  * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
2073  * no beacon with the preferred BSSID and SSID in the number of
2074  * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
2075  */
2076 static void
2077 atw_write_bssid(struct atw_softc *sc)
2078 {
2079 	struct ieee80211com *ic = &sc->sc_ic;
2080 	u_int8_t *bssid;
2081 
2082 	bssid = ic->ic_bss->ni_bssid;
2083 
2084 	ATW_WRITE(sc, ATW_BSSID0,
2085 	    LSHIFT(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
2086 	    LSHIFT(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
2087 	    LSHIFT(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
2088 	    LSHIFT(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
2089 
2090 	ATW_WRITE(sc, ATW_ABDA1,
2091 	    (ATW_READ(sc, ATW_ABDA1) &
2092 	    ~(ATW_ABDA1_BSSIDB4_MASK|ATW_ABDA1_BSSIDB5_MASK)) |
2093 	    LSHIFT(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
2094 	    LSHIFT(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
2095 
2096 	DPRINTF(sc, ("%s: BSSID %s -> ", sc->sc_dev.dv_xname,
2097 	    ether_sprintf(sc->sc_bssid)));
2098 	DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
2099 
2100 	memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
2101 }
2102 
2103 /* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
2104  * 16-bit word.
2105  */
2106 static void
2107 atw_write_sram(struct atw_softc *sc, u_int ofs, u_int8_t *buf, u_int buflen)
2108 {
2109 	u_int i;
2110 	u_int8_t *ptr;
2111 
2112 	memcpy(&sc->sc_sram[ofs], buf, buflen);
2113 
2114 	KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
2115 
2116 	KASSERT(buflen + ofs <= sc->sc_sramlen);
2117 
2118 	ptr = &sc->sc_sram[ofs];
2119 
2120 	for (i = 0; i < buflen; i += 2) {
2121 		ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
2122 		    LSHIFT((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
2123 		DELAY(atw_writewep_delay);
2124 
2125 		ATW_WRITE(sc, ATW_WESK,
2126 		    LSHIFT((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
2127 		DELAY(atw_writewep_delay);
2128 	}
2129 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
2130 
2131 	if (sc->sc_if.if_flags & IFF_DEBUG) {
2132 		int n_octets = 0;
2133 		printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
2134 		    sc->sc_dev.dv_xname, buflen, ofs, sc->sc_wepctl);
2135 		for (i = 0; i < buflen; i++) {
2136 			printf(" %02x", ptr[i]);
2137 			if (++n_octets % 24 == 0)
2138 				printf("\n");
2139 		}
2140 		if (n_octets % 24 != 0)
2141 			printf("\n");
2142 	}
2143 }
2144 
2145 static int
2146 atw_key_alloc(struct ieee80211com *ic, const struct ieee80211_key *k)
2147 {
2148 	int keyix;
2149 #ifdef ATW_DEBUG
2150 	struct atw_softc *sc = ic->ic_ifp->if_softc;
2151 #endif
2152 
2153 	if (&ic->ic_nw_keys[0] <= k && k < &ic->ic_nw_keys[IEEE80211_WEP_NKID])
2154 		keyix = k - ic->ic_nw_keys;
2155 	else
2156 		keyix = IEEE80211_KEYIX_NONE;
2157 
2158 	DPRINTF(sc, ("%s: alloc key %u\n", __func__, keyix));
2159 
2160 	return keyix;
2161 }
2162 
2163 static int
2164 atw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
2165 {
2166 	struct atw_softc *sc = ic->ic_ifp->if_softc;
2167 	u_int keyix = k->wk_keyix;
2168 
2169 	DPRINTF(sc, ("%s: delete key %u\n", __func__, keyix));
2170 
2171 	if (keyix >= IEEE80211_WEP_NKID)
2172 		return 0;
2173 	if (k->wk_keylen != 0)
2174 		sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
2175 
2176 	return 1;
2177 }
2178 
2179 static int
2180 atw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
2181 	const u_int8_t mac[IEEE80211_ADDR_LEN])
2182 {
2183 	struct atw_softc *sc = ic->ic_ifp->if_softc;
2184 
2185 	DPRINTF(sc, ("%s: set key %u\n", __func__, k->wk_keyix));
2186 
2187 	if (k->wk_keyix >= IEEE80211_WEP_NKID)
2188 		return 0;
2189 
2190 	sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
2191 
2192 	return 1;
2193 }
2194 
2195 static void
2196 atw_key_update_begin(struct ieee80211com *ic)
2197 {
2198 #ifdef ATW_DEBUG
2199 	struct ifnet *ifp = ic->ic_ifp;
2200 	struct atw_softc *sc = ifp->if_softc;
2201 #endif
2202 
2203 	DPRINTF(sc, ("%s:\n", __func__));
2204 }
2205 
2206 static void
2207 atw_key_update_end(struct ieee80211com *ic)
2208 {
2209 	struct ifnet *ifp = ic->ic_ifp;
2210 	struct atw_softc *sc = ifp->if_softc;
2211 
2212 	DPRINTF(sc, ("%s:\n", __func__));
2213 
2214 	if ((sc->sc_flags & ATWF_WEP_SRAM_VALID) != 0)
2215 		return;
2216 	if (ATW_IS_ENABLED(sc) == 0)
2217 		return;
2218 	atw_idle(sc, ATW_NAR_SR | ATW_NAR_ST);
2219 	atw_write_wep(sc);
2220 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2221 }
2222 
2223 /* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
2224 static void
2225 atw_write_wep(struct atw_softc *sc)
2226 {
2227 	struct ieee80211com *ic = &sc->sc_ic;
2228 	/* SRAM shared-key record format: key0 flags key1 ... key12 */
2229 	u_int8_t buf[IEEE80211_WEP_NKID]
2230 	            [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
2231 	u_int32_t reg;
2232 	int i;
2233 
2234 	sc->sc_wepctl = 0;
2235 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
2236 
2237 	memset(&buf[0][0], 0, sizeof(buf));
2238 
2239 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2240 		if (ic->ic_nw_keys[i].wk_keylen > 5) {
2241 			buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
2242 		} else if (ic->ic_nw_keys[i].wk_keylen != 0) {
2243 			buf[i][1] = ATW_WEP_ENABLED;
2244 		} else {
2245 			buf[i][1] = 0;
2246 			continue;
2247 		}
2248 		buf[i][0] = ic->ic_nw_keys[i].wk_key[0];
2249 		memcpy(&buf[i][2], &ic->ic_nw_keys[i].wk_key[1],
2250 		    ic->ic_nw_keys[i].wk_keylen - 1);
2251 	}
2252 
2253 	reg = ATW_READ(sc, ATW_MACTEST);
2254 	reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
2255 	reg &= ~ATW_MACTEST_KEYID_MASK;
2256 	reg |= LSHIFT(ic->ic_def_txkey, ATW_MACTEST_KEYID_MASK);
2257 	ATW_WRITE(sc, ATW_MACTEST, reg);
2258 
2259 	if ((ic->ic_flags & IEEE80211_F_PRIVACY) != 0)
2260 		sc->sc_wepctl |= ATW_WEPCTL_WEPENABLE;
2261 
2262 	switch (sc->sc_rev) {
2263 	case ATW_REVISION_AB:
2264 	case ATW_REVISION_AF:
2265 		/* Bypass WEP on Rx. */
2266 		sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
2267 		break;
2268 	default:
2269 		break;
2270 	}
2271 
2272 	atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (u_int8_t*)&buf[0][0],
2273 	    sizeof(buf));
2274 
2275 	sc->sc_flags |= ATWF_WEP_SRAM_VALID;
2276 }
2277 
2278 static void
2279 atw_change_ibss(struct atw_softc *sc)
2280 {
2281 	atw_predict_beacon(sc);
2282 	atw_write_bssid(sc);
2283 	atw_start_beacon(sc, 1);
2284 }
2285 
2286 static void
2287 atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
2288     struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
2289 {
2290 	struct atw_softc *sc = (struct atw_softc *)ic->ic_ifp->if_softc;
2291 
2292 	/* The ADM8211A answers probe requests. TBD ADM8211B/C. */
2293 	if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_REQ)
2294 		return;
2295 
2296 	(*sc->sc_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
2297 
2298 	switch (subtype) {
2299 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2300 	case IEEE80211_FC0_SUBTYPE_BEACON:
2301 		if (ic->ic_opmode != IEEE80211_M_IBSS ||
2302 		    ic->ic_state != IEEE80211_S_RUN)
2303 			break;
2304 		if (le64toh(ni->ni_tstamp.tsf) >= atw_get_tsft(sc) &&
2305 		    ieee80211_ibss_merge(ic, ni) == ENETRESET)
2306 			atw_change_ibss(sc);
2307 		break;
2308 	default:
2309 		break;
2310 	}
2311 	return;
2312 }
2313 
2314 /* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
2315  * In ad hoc mode, the SSID is written to the beacons sent by the
2316  * ADM8211. In both ad hoc and infrastructure mode, beacons received
2317  * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
2318  * indications.
2319  */
2320 static void
2321 atw_write_ssid(struct atw_softc *sc)
2322 {
2323 	struct ieee80211com *ic = &sc->sc_ic;
2324 	/* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
2325 	 * it only expects the element length, not its ID.
2326 	 */
2327 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
2328 
2329 	memset(buf, 0, sizeof(buf));
2330 	buf[0] = ic->ic_bss->ni_esslen;
2331 	memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
2332 
2333 	atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
2334 	    roundup(1 + ic->ic_bss->ni_esslen, 2));
2335 }
2336 
2337 /* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
2338  * In ad hoc mode, the supported rates are written to beacons sent by the
2339  * ADM8211.
2340  */
2341 static void
2342 atw_write_sup_rates(struct atw_softc *sc)
2343 {
2344 	struct ieee80211com *ic = &sc->sc_ic;
2345 	/* 14 bytes are probably (XXX) reserved in the ADM8211 SRAM for
2346 	 * supported rates
2347 	 */
2348 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_RATE_SIZE, 2)];
2349 
2350 	memset(buf, 0, sizeof(buf));
2351 
2352 	buf[0] = ic->ic_bss->ni_rates.rs_nrates;
2353 
2354 	memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates,
2355 	    ic->ic_bss->ni_rates.rs_nrates);
2356 
2357 	atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
2358 }
2359 
2360 /* Start/stop sending beacons. */
2361 void
2362 atw_start_beacon(struct atw_softc *sc, int start)
2363 {
2364 	struct ieee80211com *ic = &sc->sc_ic;
2365 	uint16_t chan;
2366 	uint32_t bcnt, bpli, cap0, cap1, capinfo;
2367 	size_t len;
2368 
2369 	if (ATW_IS_ENABLED(sc) == 0)
2370 		return;
2371 
2372 	/* start beacons */
2373 	len = sizeof(struct ieee80211_frame) +
2374 	    8 /* timestamp */ + 2 /* beacon interval */ +
2375 	    2 /* capability info */ +
2376 	    2 + ic->ic_bss->ni_esslen /* SSID element */ +
2377 	    2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
2378 	    3 /* DS parameters */ +
2379 	    IEEE80211_CRC_LEN;
2380 
2381 	bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
2382 	cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
2383 	cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
2384 
2385 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2386 	ATW_WRITE(sc, ATW_CAP1, cap1);
2387 
2388 	if (!start)
2389 		return;
2390 
2391 	/* TBD use ni_capinfo */
2392 
2393 	capinfo = 0;
2394 	if (sc->sc_flags & ATWF_SHORT_PREAMBLE)
2395 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2396 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
2397 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2398 
2399 	switch (ic->ic_opmode) {
2400 	case IEEE80211_M_IBSS:
2401 		len += 4; /* IBSS parameters */
2402 		capinfo |= IEEE80211_CAPINFO_IBSS;
2403 		break;
2404 	case IEEE80211_M_HOSTAP:
2405 		/* XXX 6-byte minimum TIM */
2406 		len += atw_beacon_len_adjust;
2407 		capinfo |= IEEE80211_CAPINFO_ESS;
2408 		break;
2409 	default:
2410 		return;
2411 	}
2412 
2413 	/* set listen interval
2414 	 * XXX do software units agree w/ hardware?
2415 	 */
2416 	bpli = LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2417 	    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
2418 
2419 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
2420 
2421 	bcnt |= LSHIFT(len, ATW_BCNT_BCNT_MASK);
2422 	cap0 |= LSHIFT(chan, ATW_CAP0_CHN_MASK);
2423 	cap1 |= LSHIFT(capinfo, ATW_CAP1_CAPI_MASK);
2424 
2425 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2426 	ATW_WRITE(sc, ATW_BPLI, bpli);
2427 	ATW_WRITE(sc, ATW_CAP0, cap0);
2428 	ATW_WRITE(sc, ATW_CAP1, cap1);
2429 
2430 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
2431 	    sc->sc_dev.dv_xname, bcnt));
2432 
2433 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
2434 	    sc->sc_dev.dv_xname, cap1));
2435 }
2436 
2437 /* Return the 32 lsb of the last TSFT divisible by ival. */
2438 static __inline uint32_t
2439 atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
2440 {
2441 	/* Following the reference driver's lead, I compute
2442 	 *
2443 	 *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
2444 	 *
2445 	 * without using 64-bit arithmetic, using the following
2446 	 * relationship:
2447 	 *
2448 	 *     (0x100000000 * H + L) % m
2449 	 *   = ((0x100000000 % m) * H + L) % m
2450 	 *   = (((0xffffffff + 1) % m) * H + L) % m
2451 	 *   = ((0xffffffff % m + 1 % m) * H + L) % m
2452 	 *   = ((0xffffffff % m + 1) * H + L) % m
2453 	 */
2454 	return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
2455 }
2456 
2457 static uint64_t
2458 atw_get_tsft(struct atw_softc *sc)
2459 {
2460 	int i;
2461 	uint32_t tsfth, tsftl;
2462 	for (i = 0; i < 2; i++) {
2463 		tsfth = ATW_READ(sc, ATW_TSFTH);
2464 		tsftl = ATW_READ(sc, ATW_TSFTL);
2465 		if (ATW_READ(sc, ATW_TSFTH) == tsfth)
2466 			break;
2467 	}
2468 	return ((uint64_t)tsfth << 32) | tsftl;
2469 }
2470 
2471 /* If we've created an IBSS, write the TSF time in the ADM8211 to
2472  * the ieee80211com.
2473  *
2474  * Predict the next target beacon transmission time (TBTT) and
2475  * write it to the ADM8211.
2476  */
2477 static void
2478 atw_predict_beacon(struct atw_softc *sc)
2479 {
2480 #define TBTTOFS 20 /* TU */
2481 
2482 	struct ieee80211com *ic = &sc->sc_ic;
2483 	uint64_t tsft;
2484 	uint32_t ival, past_even, tbtt, tsfth, tsftl;
2485 	union {
2486 		uint64_t	word;
2487 		uint8_t		tstamp[8];
2488 	} u;
2489 
2490 	if ((ic->ic_opmode == IEEE80211_M_HOSTAP) ||
2491 	    ((ic->ic_opmode == IEEE80211_M_IBSS) &&
2492 	     (ic->ic_flags & IEEE80211_F_SIBSS))) {
2493 		tsft = atw_get_tsft(sc);
2494 		u.word = htole64(tsft);
2495 		(void)memcpy(&ic->ic_bss->ni_tstamp, &u.tstamp[0],
2496 		    sizeof(ic->ic_bss->ni_tstamp));
2497 	} else
2498 		tsft = le64toh(ic->ic_bss->ni_tstamp.tsf);
2499 
2500 	ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
2501 
2502 	tsftl = tsft & 0xFFFFFFFF;
2503 	tsfth = tsft >> 32;
2504 
2505 	/* We sent/received the last beacon `past' microseconds
2506 	 * after the interval divided the TSF timer.
2507 	 */
2508 	past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
2509 
2510 	/* Skip ten beacons so that the TBTT cannot pass before
2511 	 * we've programmed it.  Ten is an arbitrary number.
2512 	 */
2513 	tbtt = past_even + ival * 10;
2514 
2515 	ATW_WRITE(sc, ATW_TOFS1,
2516 	    LSHIFT(1, ATW_TOFS1_TSFTOFSR_MASK) |
2517 	    LSHIFT(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
2518 	    LSHIFT(MASK_AND_RSHIFT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
2519 	        ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
2520 #undef TBTTOFS
2521 }
2522 
2523 static void
2524 atw_next_scan(void *arg)
2525 {
2526 	struct atw_softc *sc = arg;
2527 	struct ieee80211com *ic = &sc->sc_ic;
2528 	int s;
2529 
2530 	/* don't call atw_start w/o network interrupts blocked */
2531 	s = splnet();
2532 	if (ic->ic_state == IEEE80211_S_SCAN)
2533 		ieee80211_next_scan(ic);
2534 	splx(s);
2535 }
2536 
2537 /* Synchronize the hardware state with the software state. */
2538 static int
2539 atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2540 {
2541 	struct ifnet *ifp = ic->ic_ifp;
2542 	struct atw_softc *sc = ifp->if_softc;
2543 	enum ieee80211_state ostate;
2544 	int error;
2545 
2546 	ostate = ic->ic_state;
2547 
2548 	if (nstate == IEEE80211_S_INIT) {
2549 		callout_stop(&sc->sc_scan_ch);
2550 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
2551 		atw_start_beacon(sc, 0);
2552 		return (*sc->sc_newstate)(ic, nstate, arg);
2553 	}
2554 
2555 	if ((error = atw_tune(sc)) != 0)
2556 		return error;
2557 
2558 	switch (nstate) {
2559 	case IEEE80211_S_ASSOC:
2560 		break;
2561 	case IEEE80211_S_INIT:
2562 		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
2563 		break;
2564 	case IEEE80211_S_SCAN:
2565 		callout_reset(&sc->sc_scan_ch, atw_dwelltime * hz / 1000,
2566 		    atw_next_scan, sc);
2567 
2568 		break;
2569 	case IEEE80211_S_RUN:
2570 		if (ic->ic_opmode == IEEE80211_M_STA)
2571 			break;
2572 		/*FALLTHROUGH*/
2573 	case IEEE80211_S_AUTH:
2574 		atw_write_bssid(sc);
2575 		atw_write_ssid(sc);
2576 		atw_write_sup_rates(sc);
2577 
2578 		if (ic->ic_opmode == IEEE80211_M_AHDEMO ||
2579 		    ic->ic_opmode == IEEE80211_M_MONITOR)
2580 			break;
2581 
2582 		/* set listen interval
2583 		 * XXX do software units agree w/ hardware?
2584 		 */
2585 		ATW_WRITE(sc, ATW_BPLI,
2586 		    LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2587 		    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval,
2588 			   ATW_BPLI_LI_MASK));
2589 
2590 		DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n",
2591 		    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_BPLI)));
2592 
2593 		atw_predict_beacon(sc);
2594 		break;
2595 	}
2596 
2597 	if (nstate != IEEE80211_S_SCAN)
2598 		callout_stop(&sc->sc_scan_ch);
2599 
2600 	if (nstate == IEEE80211_S_RUN &&
2601 	    (ic->ic_opmode == IEEE80211_M_HOSTAP ||
2602 	     ic->ic_opmode == IEEE80211_M_IBSS))
2603 		atw_start_beacon(sc, 1);
2604 	else
2605 		atw_start_beacon(sc, 0);
2606 
2607 	error = (*sc->sc_newstate)(ic, nstate, arg);
2608 
2609 	if (ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_SCAN)
2610 		atw_write_bssid(sc);
2611 
2612 	return error;
2613 }
2614 
2615 /*
2616  * atw_add_rxbuf:
2617  *
2618  *	Add a receive buffer to the indicated descriptor.
2619  */
2620 int
2621 atw_add_rxbuf(struct atw_softc *sc, int idx)
2622 {
2623 	struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
2624 	struct mbuf *m;
2625 	int error;
2626 
2627 	MGETHDR(m, M_DONTWAIT, MT_DATA);
2628 	if (m == NULL)
2629 		return (ENOBUFS);
2630 
2631 	MCLGET(m, M_DONTWAIT);
2632 	if ((m->m_flags & M_EXT) == 0) {
2633 		m_freem(m);
2634 		return (ENOBUFS);
2635 	}
2636 
2637 	if (rxs->rxs_mbuf != NULL)
2638 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2639 
2640 	rxs->rxs_mbuf = m;
2641 
2642 	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
2643 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
2644 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
2645 	if (error) {
2646 		printf("%s: can't load rx DMA map %d, error = %d\n",
2647 		    sc->sc_dev.dv_xname, idx, error);
2648 		panic("atw_add_rxbuf");	/* XXX */
2649 	}
2650 
2651 	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
2652 	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
2653 
2654 	ATW_INIT_RXDESC(sc, idx);
2655 
2656 	return (0);
2657 }
2658 
2659 /*
2660  * Release any queued transmit buffers.
2661  */
2662 void
2663 atw_txdrain(struct atw_softc *sc)
2664 {
2665 	struct atw_txsoft *txs;
2666 
2667 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
2668 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
2669 		if (txs->txs_mbuf != NULL) {
2670 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2671 			m_freem(txs->txs_mbuf);
2672 			txs->txs_mbuf = NULL;
2673 		}
2674 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
2675 	}
2676 	sc->sc_tx_timer = 0;
2677 }
2678 
2679 /*
2680  * atw_stop:		[ ifnet interface function ]
2681  *
2682  *	Stop transmission on the interface.
2683  */
2684 void
2685 atw_stop(struct ifnet *ifp, int disable)
2686 {
2687 	struct atw_softc *sc = ifp->if_softc;
2688 	struct ieee80211com *ic = &sc->sc_ic;
2689 
2690 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2691 
2692 	/* Disable interrupts. */
2693 	ATW_WRITE(sc, ATW_IER, 0);
2694 
2695 	/* Stop the transmit and receive processes. */
2696 	sc->sc_opmode = 0;
2697 	ATW_WRITE(sc, ATW_NAR, 0);
2698 	DELAY(atw_nar_delay);
2699 	ATW_WRITE(sc, ATW_TDBD, 0);
2700 	ATW_WRITE(sc, ATW_TDBP, 0);
2701 	ATW_WRITE(sc, ATW_RDB, 0);
2702 
2703 	atw_txdrain(sc);
2704 
2705 	if (disable) {
2706 		atw_rxdrain(sc);
2707 		atw_disable(sc);
2708 	}
2709 
2710 	/*
2711 	 * Mark the interface down and cancel the watchdog timer.
2712 	 */
2713 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2714 	ifp->if_timer = 0;
2715 
2716 	if (!disable)
2717 		atw_reset(sc);
2718 }
2719 
2720 /*
2721  * atw_rxdrain:
2722  *
2723  *	Drain the receive queue.
2724  */
2725 void
2726 atw_rxdrain(struct atw_softc *sc)
2727 {
2728 	struct atw_rxsoft *rxs;
2729 	int i;
2730 
2731 	for (i = 0; i < ATW_NRXDESC; i++) {
2732 		rxs = &sc->sc_rxsoft[i];
2733 		if (rxs->rxs_mbuf == NULL)
2734 			continue;
2735 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2736 		m_freem(rxs->rxs_mbuf);
2737 		rxs->rxs_mbuf = NULL;
2738 	}
2739 }
2740 
2741 /*
2742  * atw_detach:
2743  *
2744  *	Detach an ADM8211 interface.
2745  */
2746 int
2747 atw_detach(struct atw_softc *sc)
2748 {
2749 	struct ifnet *ifp = &sc->sc_if;
2750 	struct atw_rxsoft *rxs;
2751 	struct atw_txsoft *txs;
2752 	int i;
2753 
2754 	/*
2755 	 * Succeed now if there isn't any work to do.
2756 	 */
2757 	if ((sc->sc_flags & ATWF_ATTACHED) == 0)
2758 		return (0);
2759 
2760 	callout_stop(&sc->sc_scan_ch);
2761 
2762 	ieee80211_ifdetach(&sc->sc_ic);
2763 	if_detach(ifp);
2764 
2765 	for (i = 0; i < ATW_NRXDESC; i++) {
2766 		rxs = &sc->sc_rxsoft[i];
2767 		if (rxs->rxs_mbuf != NULL) {
2768 			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2769 			m_freem(rxs->rxs_mbuf);
2770 			rxs->rxs_mbuf = NULL;
2771 		}
2772 		bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
2773 	}
2774 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
2775 		txs = &sc->sc_txsoft[i];
2776 		if (txs->txs_mbuf != NULL) {
2777 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2778 			m_freem(txs->txs_mbuf);
2779 			txs->txs_mbuf = NULL;
2780 		}
2781 		bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
2782 	}
2783 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
2784 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
2785 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
2786 	    sizeof(struct atw_control_data));
2787 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
2788 
2789 	shutdownhook_disestablish(sc->sc_sdhook);
2790 	powerhook_disestablish(sc->sc_powerhook);
2791 
2792 	if (sc->sc_srom)
2793 		free(sc->sc_srom, M_DEVBUF);
2794 
2795 	return (0);
2796 }
2797 
2798 /* atw_shutdown: make sure the interface is stopped at reboot time. */
2799 void
2800 atw_shutdown(void *arg)
2801 {
2802 	struct atw_softc *sc = arg;
2803 
2804 	atw_stop(&sc->sc_if, 1);
2805 }
2806 
2807 int
2808 atw_intr(void *arg)
2809 {
2810 	struct atw_softc *sc = arg;
2811 	struct ifnet *ifp = &sc->sc_if;
2812 	u_int32_t status, rxstatus, txstatus, linkstatus;
2813 	int handled = 0, txthresh;
2814 
2815 #ifdef DEBUG
2816 	if (ATW_IS_ENABLED(sc) == 0)
2817 		panic("%s: atw_intr: not enabled", sc->sc_dev.dv_xname);
2818 #endif
2819 
2820 	/*
2821 	 * If the interface isn't running, the interrupt couldn't
2822 	 * possibly have come from us.
2823 	 */
2824 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2825 	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
2826 		return (0);
2827 
2828 	for (;;) {
2829 		status = ATW_READ(sc, ATW_STSR);
2830 
2831 		if (status)
2832 			ATW_WRITE(sc, ATW_STSR, status);
2833 
2834 #ifdef ATW_DEBUG
2835 #define PRINTINTR(flag) do { \
2836 	if ((status & flag) != 0) { \
2837 		printf("%s" #flag, delim); \
2838 		delim = ","; \
2839 	} \
2840 } while (0)
2841 
2842 		if (atw_debug > 1 && status) {
2843 			const char *delim = "<";
2844 
2845 			printf("%s: reg[STSR] = %x",
2846 			    sc->sc_dev.dv_xname, status);
2847 
2848 			PRINTINTR(ATW_INTR_FBE);
2849 			PRINTINTR(ATW_INTR_LINKOFF);
2850 			PRINTINTR(ATW_INTR_LINKON);
2851 			PRINTINTR(ATW_INTR_RCI);
2852 			PRINTINTR(ATW_INTR_RDU);
2853 			PRINTINTR(ATW_INTR_REIS);
2854 			PRINTINTR(ATW_INTR_RPS);
2855 			PRINTINTR(ATW_INTR_TCI);
2856 			PRINTINTR(ATW_INTR_TDU);
2857 			PRINTINTR(ATW_INTR_TLT);
2858 			PRINTINTR(ATW_INTR_TPS);
2859 			PRINTINTR(ATW_INTR_TRT);
2860 			PRINTINTR(ATW_INTR_TUF);
2861 			PRINTINTR(ATW_INTR_BCNTC);
2862 			PRINTINTR(ATW_INTR_ATIME);
2863 			PRINTINTR(ATW_INTR_TBTT);
2864 			PRINTINTR(ATW_INTR_TSCZ);
2865 			PRINTINTR(ATW_INTR_TSFTF);
2866 			printf(">\n");
2867 		}
2868 #undef PRINTINTR
2869 #endif /* ATW_DEBUG */
2870 
2871 		if ((status & sc->sc_inten) == 0)
2872 			break;
2873 
2874 		handled = 1;
2875 
2876 		rxstatus = status & sc->sc_rxint_mask;
2877 		txstatus = status & sc->sc_txint_mask;
2878 		linkstatus = status & sc->sc_linkint_mask;
2879 
2880 		if (linkstatus) {
2881 			atw_linkintr(sc, linkstatus);
2882 		}
2883 
2884 		if (rxstatus) {
2885 			/* Grab any new packets. */
2886 			atw_rxintr(sc);
2887 
2888 			if (rxstatus & ATW_INTR_RDU) {
2889 				printf("%s: receive ring overrun\n",
2890 				    sc->sc_dev.dv_xname);
2891 				/* Get the receive process going again. */
2892 				ATW_WRITE(sc, ATW_RDR, 0x1);
2893 				break;
2894 			}
2895 		}
2896 
2897 		if (txstatus) {
2898 			/* Sweep up transmit descriptors. */
2899 			atw_txintr(sc);
2900 
2901 			if (txstatus & ATW_INTR_TLT)
2902 				DPRINTF(sc, ("%s: tx lifetime exceeded\n",
2903 				    sc->sc_dev.dv_xname));
2904 
2905 			if (txstatus & ATW_INTR_TRT)
2906 				DPRINTF(sc, ("%s: tx retry limit exceeded\n",
2907 				    sc->sc_dev.dv_xname));
2908 
2909 			/* If Tx under-run, increase our transmit threshold
2910 			 * if another is available.
2911 			 */
2912 			txthresh = sc->sc_txthresh + 1;
2913 			if ((txstatus & ATW_INTR_TUF) &&
2914 			    sc->sc_txth[txthresh].txth_name != NULL) {
2915 				/* Idle the transmit process. */
2916 				atw_idle(sc, ATW_NAR_ST);
2917 
2918 				sc->sc_txthresh = txthresh;
2919 				sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
2920 				sc->sc_opmode |=
2921 				    sc->sc_txth[txthresh].txth_opmode;
2922 				printf("%s: transmit underrun; new "
2923 				    "threshold: %s\n", sc->sc_dev.dv_xname,
2924 				    sc->sc_txth[txthresh].txth_name);
2925 
2926 				/* Set the new threshold and restart
2927 				 * the transmit process.
2928 				 */
2929 				ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2930 				DELAY(atw_nar_delay);
2931 				ATW_WRITE(sc, ATW_RDR, 0x1);
2932 				/* XXX Log every Nth underrun from
2933 				 * XXX now on?
2934 				 */
2935 			}
2936 		}
2937 
2938 		if (status & (ATW_INTR_TPS|ATW_INTR_RPS)) {
2939 			if (status & ATW_INTR_TPS)
2940 				printf("%s: transmit process stopped\n",
2941 				    sc->sc_dev.dv_xname);
2942 			if (status & ATW_INTR_RPS)
2943 				printf("%s: receive process stopped\n",
2944 				    sc->sc_dev.dv_xname);
2945 			(void)atw_init(ifp);
2946 			break;
2947 		}
2948 
2949 		if (status & ATW_INTR_FBE) {
2950 			printf("%s: fatal bus error\n", sc->sc_dev.dv_xname);
2951 			(void)atw_init(ifp);
2952 			break;
2953 		}
2954 
2955 		/*
2956 		 * Not handled:
2957 		 *
2958 		 *	Transmit buffer unavailable -- normal
2959 		 *	condition, nothing to do, really.
2960 		 *
2961 		 *	Early receive interrupt -- not available on
2962 		 *	all chips, we just use RI.  We also only
2963 		 *	use single-segment receive DMA, so this
2964 		 *	is mostly useless.
2965 		 *
2966 		 *      TBD others
2967 		 */
2968 	}
2969 
2970 	/* Try to get more packets going. */
2971 	atw_start(ifp);
2972 
2973 	return (handled);
2974 }
2975 
2976 /*
2977  * atw_idle:
2978  *
2979  *	Cause the transmit and/or receive processes to go idle.
2980  *
2981  *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
2982  *	process in STSR if I clear SR or ST after the process has already
2983  *	ceased. Fair enough. But the Rx process status bits in ATW_TEST0
2984  *      do not seem to be too reliable. Perhaps I have the sense of the
2985  *	Rx bits switched with the Tx bits?
2986  */
2987 void
2988 atw_idle(struct atw_softc *sc, u_int32_t bits)
2989 {
2990 	u_int32_t ackmask = 0, opmode, stsr, test0;
2991 	int i, s;
2992 
2993 	s = splnet();
2994 
2995 	opmode = sc->sc_opmode & ~bits;
2996 
2997 	if (bits & ATW_NAR_SR)
2998 		ackmask |= ATW_INTR_RPS;
2999 
3000 	if (bits & ATW_NAR_ST) {
3001 		ackmask |= ATW_INTR_TPS;
3002 		/* set ATW_NAR_HF to flush TX FIFO. */
3003 		opmode |= ATW_NAR_HF;
3004 	}
3005 
3006 	ATW_WRITE(sc, ATW_NAR, opmode);
3007 	DELAY(atw_nar_delay);
3008 
3009 	for (i = 0; i < 1000; i++) {
3010 		stsr = ATW_READ(sc, ATW_STSR);
3011 		if ((stsr & ackmask) == ackmask)
3012 			break;
3013 		DELAY(10);
3014 	}
3015 
3016 	ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
3017 
3018 	if ((stsr & ackmask) == ackmask)
3019 		goto out;
3020 
3021 	test0 = ATW_READ(sc, ATW_TEST0);
3022 
3023 	if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
3024 	    (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
3025 		printf("%s: transmit process not idle [%s]\n",
3026 		    sc->sc_dev.dv_xname,
3027 		    atw_tx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_TS_MASK)]);
3028 		printf("%s: bits %08x test0 %08x stsr %08x\n",
3029 		    sc->sc_dev.dv_xname, bits, test0, stsr);
3030 	}
3031 
3032 	if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
3033 	    (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
3034 		DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
3035 		    sc->sc_dev.dv_xname,
3036 		    atw_rx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_RS_MASK)]));
3037 		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
3038 		    sc->sc_dev.dv_xname, bits, test0, stsr));
3039 	}
3040 out:
3041 	if ((bits & ATW_NAR_ST) != 0)
3042 		atw_txdrain(sc);
3043 	splx(s);
3044 	return;
3045 }
3046 
3047 /*
3048  * atw_linkintr:
3049  *
3050  *	Helper; handle link-status interrupts.
3051  */
3052 void
3053 atw_linkintr(struct atw_softc *sc, u_int32_t linkstatus)
3054 {
3055 	struct ieee80211com *ic = &sc->sc_ic;
3056 
3057 	if (ic->ic_state != IEEE80211_S_RUN)
3058 		return;
3059 
3060 	if (linkstatus & ATW_INTR_LINKON) {
3061 		DPRINTF(sc, ("%s: link on\n", sc->sc_dev.dv_xname));
3062 		sc->sc_rescan_timer = 0;
3063 	} else if (linkstatus & ATW_INTR_LINKOFF) {
3064 		DPRINTF(sc, ("%s: link off\n", sc->sc_dev.dv_xname));
3065 		if (ic->ic_opmode != IEEE80211_M_STA)
3066 			return;
3067 		sc->sc_rescan_timer = 3;
3068 		sc->sc_if.if_timer = 1;
3069 	}
3070 }
3071 
3072 static __inline int
3073 atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame_min *wh)
3074 {
3075 	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
3076 		return 0;
3077 	if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
3078 		return 0;
3079 	return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
3080 }
3081 
3082 /*
3083  * atw_rxintr:
3084  *
3085  *	Helper; handle receive interrupts.
3086  */
3087 void
3088 atw_rxintr(struct atw_softc *sc)
3089 {
3090 	static int rate_tbl[] = {2, 4, 11, 22, 44};
3091 	struct ieee80211com *ic = &sc->sc_ic;
3092 	struct ieee80211_node *ni;
3093 	struct ieee80211_frame_min *wh;
3094 	struct ifnet *ifp = &sc->sc_if;
3095 	struct atw_rxsoft *rxs;
3096 	struct mbuf *m;
3097 	u_int32_t rxstat;
3098 	int i, len, rate, rate0;
3099 	u_int32_t rssi, rssi0;
3100 
3101 	for (i = sc->sc_rxptr;; i = ATW_NEXTRX(i)) {
3102 		rxs = &sc->sc_rxsoft[i];
3103 
3104 		ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3105 
3106 		rxstat = le32toh(sc->sc_rxdescs[i].ar_stat);
3107 		rssi0 = le32toh(sc->sc_rxdescs[i].ar_rssi);
3108 		rate0 = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_RXDR_MASK);
3109 
3110 		if (rxstat & ATW_RXSTAT_OWN)
3111 			break; /* We have processed all receive buffers. */
3112 
3113 		DPRINTF3(sc,
3114 		    ("%s: rx stat %08x rssi0 %08x buf1 %08x buf2 %08x\n",
3115 		    sc->sc_dev.dv_xname,
3116 		    rxstat, rssi0,
3117 		    le32toh(sc->sc_rxdescs[i].ar_buf1),
3118 		    le32toh(sc->sc_rxdescs[i].ar_buf2)));
3119 
3120 		/*
3121 		 * Make sure the packet fits in one buffer.  This should
3122 		 * always be the case.
3123 		 */
3124 		if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=
3125 		    (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {
3126 			printf("%s: incoming packet spilled, resetting\n",
3127 			    sc->sc_dev.dv_xname);
3128 			(void)atw_init(ifp);
3129 			return;
3130 		}
3131 
3132 		/*
3133 		 * If an error occurred, update stats, clear the status
3134 		 * word, and leave the packet buffer in place.  It will
3135 		 * simply be reused the next time the ring comes around.
3136 	 	 * If 802.1Q VLAN MTU is enabled, ignore the Frame Too Long
3137 		 * error.
3138 		 */
3139 
3140 		if ((rxstat & ATW_RXSTAT_ES) != 0 &&
3141 		    ((sc->sc_ec.ec_capenable & ETHERCAP_VLAN_MTU) == 0 ||
3142 		     (rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_SFDE |
3143 		                ATW_RXSTAT_SIGE | ATW_RXSTAT_CRC16E |
3144 				ATW_RXSTAT_RXTOE | ATW_RXSTAT_CRC32E |
3145 				ATW_RXSTAT_ICVE)) != 0)) {
3146 #define	PRINTERR(bit, str)						\
3147 			if (rxstat & (bit))				\
3148 				printf("%s: receive error: %s\n",	\
3149 				    sc->sc_dev.dv_xname, str)
3150 			ifp->if_ierrors++;
3151 			PRINTERR(ATW_RXSTAT_DE, "descriptor error");
3152 			PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
3153 			PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
3154 			PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
3155 			PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
3156 			PRINTERR(ATW_RXSTAT_CRC32E, "FCS error");
3157 			PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
3158 #undef PRINTERR
3159 			ATW_INIT_RXDESC(sc, i);
3160 			continue;
3161 		}
3162 
3163 		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3164 		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
3165 
3166 		/*
3167 		 * No errors; receive the packet.  Note the ADM8211
3168 		 * includes the CRC in promiscuous mode.
3169 		 */
3170 		len = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_FL_MASK);
3171 
3172 		/*
3173 		 * Allocate a new mbuf cluster.  If that fails, we are
3174 		 * out of memory, and must drop the packet and recycle
3175 		 * the buffer that's already attached to this descriptor.
3176 		 */
3177 		m = rxs->rxs_mbuf;
3178 		if (atw_add_rxbuf(sc, i) != 0) {
3179 			ifp->if_ierrors++;
3180 			ATW_INIT_RXDESC(sc, i);
3181 			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3182 			    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
3183 			continue;
3184 		}
3185 
3186 		ifp->if_ipackets++;
3187 		if (sc->sc_opmode & ATW_NAR_PR)
3188 			len -= IEEE80211_CRC_LEN;
3189 		m->m_pkthdr.rcvif = ifp;
3190 		m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
3191 
3192 		if (rate0 >= sizeof(rate_tbl) / sizeof(rate_tbl[0]))
3193 			rate = 0;
3194 		else
3195 			rate = rate_tbl[rate0];
3196 
3197 		/* The RSSI comes straight from a register in the
3198 		 * baseband processor.  I know that for the RF3000,
3199 		 * the RSSI register also contains the antenna-selection
3200 		 * bits.  Mask those off.
3201 		 *
3202 		 * TBD Treat other basebands.
3203 		 */
3204 		if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
3205 			rssi = rssi0 & RF3000_RSSI_MASK;
3206 		else
3207 			rssi = rssi0;
3208 
3209  #if NBPFILTER > 0
3210 		/* Pass this up to any BPF listeners. */
3211 		if (sc->sc_radiobpf != NULL) {
3212 			struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
3213 
3214 			tap->ar_rate = rate;
3215 			tap->ar_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3216 			tap->ar_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3217 
3218 			/* TBD verify units are dB */
3219 			tap->ar_antsignal = (int)rssi;
3220 			/* TBD tap->ar_flags */
3221 
3222 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)tap,
3223 			    tap->ar_ihdr.it_len, m);
3224  		}
3225  #endif /* NPBFILTER > 0 */
3226 
3227 		wh = mtod(m, struct ieee80211_frame_min *);
3228 		ni = ieee80211_find_rxnode(ic, wh);
3229 		if (atw_hw_decrypted(sc, wh)) {
3230 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
3231 			DPRINTF(sc, ("%s: hw decrypted\n", __func__));
3232 		}
3233 		ieee80211_input(ic, m, ni, (int)rssi, 0);
3234 		ieee80211_free_node(ni);
3235 	}
3236 
3237 	/* Update the receive pointer. */
3238 	sc->sc_rxptr = i;
3239 }
3240 
3241 /*
3242  * atw_txintr:
3243  *
3244  *	Helper; handle transmit interrupts.
3245  */
3246 void
3247 atw_txintr(struct atw_softc *sc)
3248 {
3249 #define TXSTAT_ERRMASK (ATW_TXSTAT_TUF | ATW_TXSTAT_TLT | ATW_TXSTAT_TRT | \
3250     ATW_TXSTAT_TRO | ATW_TXSTAT_SOFBR)
3251 #define TXSTAT_FMT "\20\31ATW_TXSTAT_SOFBR\32ATW_TXSTAT_TRO\33ATW_TXSTAT_TUF" \
3252     "\34ATW_TXSTAT_TRT\35ATW_TXSTAT_TLT"
3253 
3254 	static char txstat_buf[sizeof("ffffffff<>" TXSTAT_FMT)];
3255 	struct ifnet *ifp = &sc->sc_if;
3256 	struct atw_txsoft *txs;
3257 	u_int32_t txstat;
3258 
3259 	DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
3260 	    sc->sc_dev.dv_xname, sc->sc_flags));
3261 
3262 	ifp->if_flags &= ~IFF_OACTIVE;
3263 
3264 	/*
3265 	 * Go through our Tx list and free mbufs for those
3266 	 * frames that have been transmitted.
3267 	 */
3268 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
3269 		ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
3270 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3271 
3272 #ifdef ATW_DEBUG
3273 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3274 			int i;
3275 			printf("    txsoft %p transmit chain:\n", txs);
3276 			ATW_CDTXSYNC(sc, txs->txs_firstdesc,
3277 			    txs->txs_ndescs - 1,
3278 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3279 			for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
3280 				printf("     descriptor %d:\n", i);
3281 				printf("       at_status:   0x%08x\n",
3282 				    le32toh(sc->sc_txdescs[i].at_stat));
3283 				printf("       at_flags:      0x%08x\n",
3284 				    le32toh(sc->sc_txdescs[i].at_flags));
3285 				printf("       at_buf1: 0x%08x\n",
3286 				    le32toh(sc->sc_txdescs[i].at_buf1));
3287 				printf("       at_buf2: 0x%08x\n",
3288 				    le32toh(sc->sc_txdescs[i].at_buf2));
3289 				if (i == txs->txs_lastdesc)
3290 					break;
3291 			}
3292 		}
3293 #endif
3294 
3295 		txstat = le32toh(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
3296 		if (txstat & ATW_TXSTAT_OWN)
3297 			break;
3298 
3299 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
3300 
3301 		sc->sc_txfree += txs->txs_ndescs;
3302 
3303 		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
3304 		    0, txs->txs_dmamap->dm_mapsize,
3305 		    BUS_DMASYNC_POSTWRITE);
3306 		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
3307 		m_freem(txs->txs_mbuf);
3308 		txs->txs_mbuf = NULL;
3309 
3310 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
3311 
3312 		if ((ifp->if_flags & IFF_DEBUG) != 0 &&
3313 		    (txstat & TXSTAT_ERRMASK) != 0) {
3314 			bitmask_snprintf(txstat & TXSTAT_ERRMASK, TXSTAT_FMT,
3315 			    txstat_buf, sizeof(txstat_buf));
3316 			printf("%s: txstat %s %d\n", sc->sc_dev.dv_xname,
3317 			    txstat_buf,
3318 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK));
3319 		}
3320 
3321 		/*
3322 		 * Check for errors and collisions.
3323 		 */
3324 		if (txstat & ATW_TXSTAT_TUF)
3325 			sc->sc_stats.ts_tx_tuf++;
3326 		if (txstat & ATW_TXSTAT_TLT)
3327 			sc->sc_stats.ts_tx_tlt++;
3328 		if (txstat & ATW_TXSTAT_TRT)
3329 			sc->sc_stats.ts_tx_trt++;
3330 		if (txstat & ATW_TXSTAT_TRO)
3331 			sc->sc_stats.ts_tx_tro++;
3332 		if (txstat & ATW_TXSTAT_SOFBR) {
3333 			sc->sc_stats.ts_tx_sofbr++;
3334 		}
3335 
3336 		if ((txstat & ATW_TXSTAT_ES) == 0)
3337 			ifp->if_collisions +=
3338 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK);
3339 		else
3340 			ifp->if_oerrors++;
3341 
3342 		ifp->if_opackets++;
3343 	}
3344 
3345 	/*
3346 	 * If there are no more pending transmissions, cancel the watchdog
3347 	 * timer.
3348 	 */
3349 	if (txs == NULL)
3350 		sc->sc_tx_timer = 0;
3351 #undef TXSTAT_ERRMASK
3352 #undef TXSTAT_FMT
3353 }
3354 
3355 /*
3356  * atw_watchdog:	[ifnet interface function]
3357  *
3358  *	Watchdog timer handler.
3359  */
3360 void
3361 atw_watchdog(struct ifnet *ifp)
3362 {
3363 	struct atw_softc *sc = ifp->if_softc;
3364 	struct ieee80211com *ic = &sc->sc_ic;
3365 
3366 	ifp->if_timer = 0;
3367 	if (ATW_IS_ENABLED(sc) == 0)
3368 		return;
3369 
3370 	if (sc->sc_rescan_timer) {
3371 		if (--sc->sc_rescan_timer == 0)
3372 			(void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3373 	}
3374 	if (sc->sc_tx_timer) {
3375 		if (--sc->sc_tx_timer == 0 &&
3376 		    !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
3377 			printf("%s: transmit timeout\n", ifp->if_xname);
3378 			ifp->if_oerrors++;
3379 			(void)atw_init(ifp);
3380 			atw_start(ifp);
3381 		}
3382 	}
3383 	if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
3384 		ifp->if_timer = 1;
3385 	ieee80211_watchdog(ic);
3386 }
3387 
3388 /* Compute the 802.11 Duration field and the PLCP Length fields for
3389  * a len-byte frame (HEADER + PAYLOAD + FCS) sent at rate * 500Kbps.
3390  * Write the fields to the ADM8211 Tx header, frm.
3391  *
3392  * TBD use the fragmentation threshold to find the right duration for
3393  * the first & last fragments.
3394  *
3395  * TBD make certain of the duration fields applied by the ADM8211 to each
3396  * fragment. I think that the ADM8211 knows how to subtract the CTS
3397  * duration when ATW_HDRCTL_RTSCTS is clear; that is why I add it regardless.
3398  * I also think that the ADM8211 does *some* arithmetic for us, because
3399  * otherwise I think we would have to set a first duration for CTS/first
3400  * fragment, a second duration for fragments between the first and the
3401  * last, and a third duration for the last fragment.
3402  *
3403  * TBD make certain that duration fields reflect addition of FCS/WEP
3404  * and correct duration arithmetic as necessary.
3405  */
3406 static void
3407 atw_frame_setdurs(struct atw_softc *sc, struct atw_frame *frm, int rate,
3408     int len)
3409 {
3410 	int remainder;
3411 
3412 	/* deal also with encrypted fragments */
3413 	if (frm->atw_hdrctl & htole16(ATW_HDRCTL_WEP)) {
3414 		DPRINTF2(sc, ("%s: atw_frame_setdurs len += 8\n",
3415 		    sc->sc_dev.dv_xname));
3416 		len += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
3417 		       IEEE80211_WEP_CRCLEN;
3418 	}
3419 
3420 	/* 802.11 Duration Field for CTS/Data/ACK sequence minus FCS & WEP
3421 	 * duration (XXX added by MAC?).
3422 	 */
3423 	frm->atw_head_dur = (16 * (len - IEEE80211_CRC_LEN)) / rate;
3424 	remainder = (16 * (len - IEEE80211_CRC_LEN)) % rate;
3425 
3426 	if (rate <= 4)
3427 		/* 1-2Mbps WLAN: send ACK/CTS at 1Mbps */
3428 		frm->atw_head_dur += 3 * (IEEE80211_DUR_DS_SIFS +
3429 		    IEEE80211_DUR_DS_SHORT_PREAMBLE +
3430 		    IEEE80211_DUR_DS_FAST_PLCPHDR) +
3431 		    IEEE80211_DUR_DS_SLOW_CTS + IEEE80211_DUR_DS_SLOW_ACK;
3432 	else
3433 		/* 5-11Mbps WLAN: send ACK/CTS at 2Mbps */
3434 		frm->atw_head_dur += 3 * (IEEE80211_DUR_DS_SIFS +
3435 		    IEEE80211_DUR_DS_SHORT_PREAMBLE +
3436 		    IEEE80211_DUR_DS_FAST_PLCPHDR) +
3437 		    IEEE80211_DUR_DS_FAST_CTS + IEEE80211_DUR_DS_FAST_ACK;
3438 
3439 	/* lengthen duration if long preamble */
3440 	if ((sc->sc_flags & ATWF_SHORT_PREAMBLE) == 0)
3441 		frm->atw_head_dur +=
3442 		    3 * (IEEE80211_DUR_DS_LONG_PREAMBLE -
3443 		         IEEE80211_DUR_DS_SHORT_PREAMBLE) +
3444 		    3 * (IEEE80211_DUR_DS_SLOW_PLCPHDR -
3445 		         IEEE80211_DUR_DS_FAST_PLCPHDR);
3446 
3447 	if (remainder != 0)
3448 		frm->atw_head_dur++;
3449 
3450 	if ((atw_voodoo & VOODOO_DUR_2_4_SPECIALCASE) &&
3451 	    (rate == 2 || rate == 4)) {
3452 		/* derived from Linux: how could this be right? */
3453 		frm->atw_head_plcplen = frm->atw_head_dur;
3454 	} else {
3455 		frm->atw_head_plcplen = (16 * len) / rate;
3456 		remainder = (80 * len) % (rate * 5);
3457 
3458 		if (remainder != 0) {
3459 			frm->atw_head_plcplen++;
3460 
3461 			/* XXX magic */
3462 			if ((atw_voodoo & VOODOO_DUR_11_ROUNDING) &&
3463 			    rate == 22 && remainder <= 30)
3464 				frm->atw_head_plcplen |= 0x8000;
3465 		}
3466 	}
3467 	frm->atw_tail_plcplen = frm->atw_head_plcplen =
3468 	    htole16(frm->atw_head_plcplen);
3469 	frm->atw_tail_dur = frm->atw_head_dur = htole16(frm->atw_head_dur);
3470 }
3471 
3472 #ifdef ATW_DEBUG
3473 static void
3474 atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
3475 {
3476 	struct atw_softc *sc = ifp->if_softc;
3477 	struct mbuf *m;
3478 	int i, noctets = 0;
3479 
3480 	printf("%s: %d-byte packet\n", sc->sc_dev.dv_xname,
3481 	    m0->m_pkthdr.len);
3482 
3483 	for (m = m0; m; m = m->m_next) {
3484 		if (m->m_len == 0)
3485 			continue;
3486 		for (i = 0; i < m->m_len; i++) {
3487 			printf(" %02x", ((u_int8_t*)m->m_data)[i]);
3488 			if (++noctets % 24 == 0)
3489 				printf("\n");
3490 		}
3491 	}
3492 	printf("%s%s: %d bytes emitted\n",
3493 	    (noctets % 24 != 0) ? "\n" : "", sc->sc_dev.dv_xname, noctets);
3494 }
3495 #endif /* ATW_DEBUG */
3496 
3497 /*
3498  * atw_start:		[ifnet interface function]
3499  *
3500  *	Start packet transmission on the interface.
3501  */
3502 void
3503 atw_start(struct ifnet *ifp)
3504 {
3505 	struct atw_softc *sc = ifp->if_softc;
3506 	struct ieee80211com *ic = &sc->sc_ic;
3507 	struct ieee80211_node *ni;
3508 	struct ieee80211_frame *wh;
3509 	struct atw_frame *hh;
3510 	struct mbuf *m0, *m;
3511 	struct atw_txsoft *txs, *last_txs;
3512 	struct atw_txdesc *txd;
3513 	int do_encrypt, rate;
3514 	bus_dmamap_t dmamap;
3515 	int ctl, error, firsttx, nexttx, lasttx = -1, first, ofree, seg;
3516 
3517 	DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
3518 	    sc->sc_dev.dv_xname, sc->sc_flags, ifp->if_flags));
3519 
3520 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3521 		return;
3522 
3523 	/*
3524 	 * Remember the previous number of free descriptors and
3525 	 * the first descriptor we'll use.
3526 	 */
3527 	ofree = sc->sc_txfree;
3528 	firsttx = sc->sc_txnext;
3529 
3530 	DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
3531 	    sc->sc_dev.dv_xname, ofree, firsttx));
3532 
3533 	/*
3534 	 * Loop through the send queue, setting up transmit descriptors
3535 	 * until we drain the queue, or use up all available transmit
3536 	 * descriptors.
3537 	 */
3538 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
3539 	       sc->sc_txfree != 0) {
3540 
3541 		/*
3542 		 * Grab a packet off the management queue, if it
3543 		 * is not empty. Otherwise, from the data queue.
3544 		 */
3545 		IF_DEQUEUE(&ic->ic_mgtq, m0);
3546 		if (m0 != NULL) {
3547 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
3548 			m0->m_pkthdr.rcvif = NULL;
3549 		} else {
3550 			/* send no data packets until we are associated */
3551 			if (ic->ic_state != IEEE80211_S_RUN)
3552 				break;
3553 			IFQ_DEQUEUE(&ifp->if_snd, m0);
3554 			if (m0 == NULL)
3555 				break;
3556 #if NBPFILTER > 0
3557 			if (ifp->if_bpf != NULL)
3558 				bpf_mtap(ifp->if_bpf, m0);
3559 #endif /* NBPFILTER > 0 */
3560 			ni = ieee80211_find_txnode(ic,
3561 			    mtod(m0, struct ether_header *)->ether_dhost);
3562 			if (ni == NULL) {
3563 				ifp->if_oerrors++;
3564 				break;
3565 			}
3566 			if ((m0 = ieee80211_encap(ic, m0, ni)) == NULL) {
3567 				ieee80211_free_node(ni);
3568 				ifp->if_oerrors++;
3569 				break;
3570 			}
3571 		}
3572 
3573 		rate = MAX(ieee80211_get_rate(ic), 2);
3574 
3575 #if NBPFILTER > 0
3576 		/*
3577 		 * Pass the packet to any BPF listeners.
3578 		 */
3579 		if (ic->ic_rawbpf != NULL)
3580 			bpf_mtap((caddr_t)ic->ic_rawbpf, m0);
3581 
3582 		if (sc->sc_radiobpf != NULL) {
3583 			struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
3584 
3585 			tap->at_rate = rate;
3586 			tap->at_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3587 			tap->at_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3588 
3589 			/* TBD tap->at_flags */
3590 
3591 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)tap,
3592 			    tap->at_ihdr.it_len, m0);
3593 		}
3594 #endif /* NBPFILTER > 0 */
3595 
3596 		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
3597 
3598 		if (ni != NULL)
3599 			ieee80211_free_node(ni);
3600 
3601 		if (m0 == NULL) {
3602 			ifp->if_oerrors++;
3603 			break;
3604 		}
3605 
3606 		/* just to make sure. */
3607 		m0 = m_pullup(m0, sizeof(struct atw_frame));
3608 
3609 		if (m0 == NULL) {
3610 			ifp->if_oerrors++;
3611 			break;
3612 		}
3613 
3614 		hh = mtod(m0, struct atw_frame *);
3615 		wh = &hh->atw_ihdr;
3616 
3617 		do_encrypt = ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0) ? 1 : 0;
3618 
3619 		/* Copy everything we need from the 802.11 header:
3620 		 * Frame Control; address 1, address 3, or addresses
3621 		 * 3 and 4. NIC fills in BSSID, SA.
3622 		 */
3623 		if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
3624 			if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
3625 				panic("%s: illegal WDS frame",
3626 				    sc->sc_dev.dv_xname);
3627 			memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
3628 		} else
3629 			memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
3630 
3631 		*(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;
3632 
3633 		/* initialize remaining Tx parameters */
3634 		memset(&hh->u, 0, sizeof(hh->u));
3635 
3636 		hh->atw_rate = rate * 5;
3637 		/* XXX this could be incorrect if M_FCS. _encap should
3638 		 * probably strip FCS just in case it sticks around in
3639 		 * bridged packets.
3640 		 */
3641 		hh->atw_service = 0x00; /* XXX guess */
3642 		hh->atw_paylen = htole16(m0->m_pkthdr.len -
3643 		    sizeof(struct atw_frame));
3644 
3645 		hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3646 		hh->atw_rtylmt = 3;
3647 		hh->atw_hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
3648 		if (do_encrypt) {
3649 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_WEP);
3650 			hh->atw_keyid = ic->ic_def_txkey;
3651 		}
3652 
3653 		/* TBD 4-addr frames */
3654 		atw_frame_setdurs(sc, hh, rate,
3655 		    m0->m_pkthdr.len - sizeof(struct atw_frame) +
3656 		    sizeof(struct ieee80211_frame) + IEEE80211_CRC_LEN);
3657 
3658 		/* never fragment multicast frames */
3659 		if (IEEE80211_IS_MULTICAST(hh->atw_dst)) {
3660 			hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3661 		} else if (sc->sc_flags & ATWF_RTSCTS) {
3662 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
3663 		}
3664 
3665 #ifdef ATW_DEBUG
3666 		hh->atw_fragnum = 0;
3667 
3668 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3669 			printf("%s: dst = %s, rate = 0x%02x, "
3670 			    "service = 0x%02x, paylen = 0x%04x\n",
3671 			    sc->sc_dev.dv_xname, ether_sprintf(hh->atw_dst),
3672 			    hh->atw_rate, hh->atw_service, hh->atw_paylen);
3673 
3674 			printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
3675 			    "dur1 = 0x%04x, dur2 = 0x%04x, "
3676 			    "dur3 = 0x%04x, rts_dur = 0x%04x\n",
3677 			    sc->sc_dev.dv_xname, hh->atw_fc[0], hh->atw_fc[1],
3678 			    hh->atw_tail_plcplen, hh->atw_head_plcplen,
3679 			    hh->atw_tail_dur, hh->atw_head_dur);
3680 
3681 			printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
3682 			    "fragnum = 0x%02x, rtylmt = 0x%04x\n",
3683 			    sc->sc_dev.dv_xname, hh->atw_hdrctl,
3684 			    hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
3685 
3686 			printf("%s: keyid = %d\n",
3687 			    sc->sc_dev.dv_xname, hh->atw_keyid);
3688 
3689 			atw_dump_pkt(ifp, m0);
3690 		}
3691 #endif /* ATW_DEBUG */
3692 
3693 		dmamap = txs->txs_dmamap;
3694 
3695 		/*
3696 		 * Load the DMA map.  Copy and try (once) again if the packet
3697 		 * didn't fit in the alloted number of segments.
3698 		 */
3699 		for (first = 1;
3700 		     (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
3701 		                  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;
3702 		     first = 0) {
3703 			MGETHDR(m, M_DONTWAIT, MT_DATA);
3704 			if (m == NULL) {
3705 				printf("%s: unable to allocate Tx mbuf\n",
3706 				    sc->sc_dev.dv_xname);
3707 				break;
3708 			}
3709 			if (m0->m_pkthdr.len > MHLEN) {
3710 				MCLGET(m, M_DONTWAIT);
3711 				if ((m->m_flags & M_EXT) == 0) {
3712 					printf("%s: unable to allocate Tx "
3713 					    "cluster\n", sc->sc_dev.dv_xname);
3714 					m_freem(m);
3715 					break;
3716 				}
3717 			}
3718 			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
3719 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3720 			m_freem(m0);
3721 			m0 = m;
3722 			m = NULL;
3723 		}
3724 		if (error != 0) {
3725 			printf("%s: unable to load Tx buffer, "
3726 			    "error = %d\n", sc->sc_dev.dv_xname, error);
3727 			m_freem(m0);
3728 			break;
3729 		}
3730 
3731 		/*
3732 		 * Ensure we have enough descriptors free to describe
3733 		 * the packet.
3734 		 */
3735 		if (dmamap->dm_nsegs > sc->sc_txfree) {
3736 			/*
3737 			 * Not enough free descriptors to transmit
3738 			 * this packet.  Unload the DMA map and
3739 			 * drop the packet.  Notify the upper layer
3740 			 * that there are no more slots left.
3741 			 *
3742 			 * XXX We could allocate an mbuf and copy, but
3743 			 * XXX it is worth it?
3744 			 */
3745 			ifp->if_flags |= IFF_OACTIVE;
3746 			bus_dmamap_unload(sc->sc_dmat, dmamap);
3747 			m_freem(m0);
3748 			break;
3749 		}
3750 
3751 		/*
3752 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
3753 		 */
3754 
3755 		/* Sync the DMA map. */
3756 		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
3757 		    BUS_DMASYNC_PREWRITE);
3758 
3759 		/* XXX arbitrary retry limit; 8 because I have seen it in
3760 		 * use already and maybe 0 means "no tries" !
3761 		 */
3762 		ctl = htole32(LSHIFT(8, ATW_TXCTL_TL_MASK));
3763 
3764 		DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
3765 		    sc->sc_dev.dv_xname, rate * 5));
3766 		ctl |= htole32(LSHIFT(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
3767 
3768 		/*
3769 		 * Initialize the transmit descriptors.
3770 		 */
3771 		for (nexttx = sc->sc_txnext, seg = 0;
3772 		     seg < dmamap->dm_nsegs;
3773 		     seg++, nexttx = ATW_NEXTTX(nexttx)) {
3774 			/*
3775 			 * If this is the first descriptor we're
3776 			 * enqueueing, don't set the OWN bit just
3777 			 * yet.  That could cause a race condition.
3778 			 * We'll do it below.
3779 			 */
3780 			txd = &sc->sc_txdescs[nexttx];
3781 			txd->at_ctl = ctl |
3782 			    ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
3783 
3784 			txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
3785 			txd->at_flags =
3786 			    htole32(LSHIFT(dmamap->dm_segs[seg].ds_len,
3787 			                   ATW_TXFLAG_TBS1_MASK)) |
3788 			    ((nexttx == (ATW_NTXDESC - 1))
3789 			        ? htole32(ATW_TXFLAG_TER) : 0);
3790 			lasttx = nexttx;
3791 		}
3792 
3793 		IASSERT(lasttx != -1, ("bad lastx"));
3794 		/* Set `first segment' and `last segment' appropriately. */
3795 		sc->sc_txdescs[sc->sc_txnext].at_flags |=
3796 		    htole32(ATW_TXFLAG_FS);
3797 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
3798 
3799 #ifdef ATW_DEBUG
3800 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3801 			printf("     txsoft %p transmit chain:\n", txs);
3802 			for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
3803 				printf("     descriptor %d:\n", seg);
3804 				printf("       at_ctl:   0x%08x\n",
3805 				    le32toh(sc->sc_txdescs[seg].at_ctl));
3806 				printf("       at_flags:      0x%08x\n",
3807 				    le32toh(sc->sc_txdescs[seg].at_flags));
3808 				printf("       at_buf1: 0x%08x\n",
3809 				    le32toh(sc->sc_txdescs[seg].at_buf1));
3810 				printf("       at_buf2: 0x%08x\n",
3811 				    le32toh(sc->sc_txdescs[seg].at_buf2));
3812 				if (seg == lasttx)
3813 					break;
3814 			}
3815 		}
3816 #endif
3817 
3818 		/* Sync the descriptors we're using. */
3819 		ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
3820 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3821 
3822 		/*
3823 		 * Store a pointer to the packet so we can free it later,
3824 		 * and remember what txdirty will be once the packet is
3825 		 * done.
3826 		 */
3827 		txs->txs_mbuf = m0;
3828 		txs->txs_firstdesc = sc->sc_txnext;
3829 		txs->txs_lastdesc = lasttx;
3830 		txs->txs_ndescs = dmamap->dm_nsegs;
3831 
3832 		/* Advance the tx pointer. */
3833 		sc->sc_txfree -= dmamap->dm_nsegs;
3834 		sc->sc_txnext = nexttx;
3835 
3836 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
3837 		SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
3838 
3839 		last_txs = txs;
3840 	}
3841 
3842 	if (txs == NULL || sc->sc_txfree == 0) {
3843 		/* No more slots left; notify upper layer. */
3844 		ifp->if_flags |= IFF_OACTIVE;
3845 	}
3846 
3847 	if (sc->sc_txfree != ofree) {
3848 		DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
3849 		    sc->sc_dev.dv_xname, lasttx, firsttx));
3850 		/*
3851 		 * Cause a transmit interrupt to happen on the
3852 		 * last packet we enqueued.
3853 		 */
3854 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
3855 		ATW_CDTXSYNC(sc, lasttx, 1,
3856 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3857 
3858 		/*
3859 		 * The entire packet chain is set up.  Give the
3860 		 * first descriptor to the chip now.
3861 		 */
3862 		sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
3863 		ATW_CDTXSYNC(sc, firsttx, 1,
3864 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3865 
3866 		/* Wake up the transmitter. */
3867 		ATW_WRITE(sc, ATW_TDR, 0x1);
3868 
3869 		/* Set a watchdog timer in case the chip flakes out. */
3870 		sc->sc_tx_timer = 5;
3871 		ifp->if_timer = 1;
3872 	}
3873 }
3874 
3875 /*
3876  * atw_power:
3877  *
3878  *	Power management (suspend/resume) hook.
3879  */
3880 void
3881 atw_power(int why, void *arg)
3882 {
3883 	struct atw_softc *sc = arg;
3884 	struct ifnet *ifp = &sc->sc_if;
3885 	int s;
3886 
3887 	DPRINTF(sc, ("%s: atw_power(%d,)\n", sc->sc_dev.dv_xname, why));
3888 
3889 	s = splnet();
3890 	switch (why) {
3891 	case PWR_STANDBY:
3892 		/* XXX do nothing. */
3893 		break;
3894 	case PWR_SUSPEND:
3895 		atw_stop(ifp, 0);
3896 		if (sc->sc_power != NULL)
3897 			(*sc->sc_power)(sc, why);
3898 		break;
3899 	case PWR_RESUME:
3900 		if (ifp->if_flags & IFF_UP) {
3901 			if (sc->sc_power != NULL)
3902 				(*sc->sc_power)(sc, why);
3903 			atw_init(ifp);
3904 		}
3905 		break;
3906 	case PWR_SOFTSUSPEND:
3907 	case PWR_SOFTSTANDBY:
3908 	case PWR_SOFTRESUME:
3909 		break;
3910 	}
3911 	splx(s);
3912 }
3913 
3914 /*
3915  * atw_ioctl:		[ifnet interface function]
3916  *
3917  *	Handle control requests from the operator.
3918  */
3919 int
3920 atw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
3921 {
3922 	struct atw_softc *sc = ifp->if_softc;
3923 	struct ifreq *ifr = (struct ifreq *)data;
3924 	int s, error = 0;
3925 
3926 	/* XXX monkey see, monkey do. comes from wi_ioctl. */
3927 	if ((sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
3928 		return ENXIO;
3929 
3930 	s = splnet();
3931 
3932 	switch (cmd) {
3933 	case SIOCSIFFLAGS:
3934 		if (ifp->if_flags & IFF_UP) {
3935 			if (ATW_IS_ENABLED(sc)) {
3936 				/*
3937 				 * To avoid rescanning another access point,
3938 				 * do not call atw_init() here.  Instead,
3939 				 * only reflect media settings.
3940 				 */
3941 				atw_filter_setup(sc);
3942 			} else
3943 				error = atw_init(ifp);
3944 		} else if (ATW_IS_ENABLED(sc))
3945 			atw_stop(ifp, 1);
3946 		break;
3947 	case SIOCADDMULTI:
3948 	case SIOCDELMULTI:
3949 		error = (cmd == SIOCADDMULTI) ?
3950 		    ether_addmulti(ifr, &sc->sc_ec) :
3951 		    ether_delmulti(ifr, &sc->sc_ec);
3952 		if (error == ENETRESET) {
3953 			if (ifp->if_flags & IFF_RUNNING)
3954 				atw_filter_setup(sc); /* do not rescan */
3955 			error = 0;
3956 		}
3957 		break;
3958 	default:
3959 		error = ieee80211_ioctl(&sc->sc_ic, cmd, data);
3960 		if (error == ENETRESET) {
3961 			if (ATW_IS_ENABLED(sc))
3962 				error = atw_init(ifp);
3963 			else
3964 				error = 0;
3965 		}
3966 		break;
3967 	}
3968 
3969 	/* Try to get more packets going. */
3970 	if (ATW_IS_ENABLED(sc))
3971 		atw_start(ifp);
3972 
3973 	splx(s);
3974 	return (error);
3975 }
3976 
3977 static int
3978 atw_media_change(struct ifnet *ifp)
3979 {
3980 	int error;
3981 
3982 	error = ieee80211_media_change(ifp);
3983 	if (error == ENETRESET) {
3984 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3985 		    (IFF_RUNNING|IFF_UP))
3986 			atw_init(ifp);		/* XXX lose error */
3987 		error = 0;
3988 	}
3989 	return error;
3990 }
3991 
3992 static void
3993 atw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3994 {
3995 	struct atw_softc *sc = ifp->if_softc;
3996 
3997 	if (ATW_IS_ENABLED(sc) == 0) {
3998 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3999 		imr->ifm_status = 0;
4000 		return;
4001 	}
4002 	ieee80211_media_status(ifp, imr);
4003 }
4004