xref: /netbsd-src/sys/dev/ic/atw.c (revision b1c86f5f087524e68db12794ee9c3e3da1ab17a0)
1 /*	$NetBSD: atw.c,v 1.151 2010/04/05 07:19:33 joerg Exp $  */
2 
3 /*-
4  * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
34  */
35 
36 #include <sys/cdefs.h>
37 __KERNEL_RCSID(0, "$NetBSD: atw.c,v 1.151 2010/04/05 07:19:33 joerg Exp $");
38 
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/callout.h>
43 #include <sys/mbuf.h>
44 #include <sys/malloc.h>
45 #include <sys/kernel.h>
46 #include <sys/socket.h>
47 #include <sys/ioctl.h>
48 #include <sys/errno.h>
49 #include <sys/device.h>
50 #include <sys/kauth.h>
51 #include <sys/time.h>
52 #include <lib/libkern/libkern.h>
53 
54 #include <machine/endian.h>
55 
56 #include <uvm/uvm_extern.h>
57 
58 #include <net/if.h>
59 #include <net/if_dl.h>
60 #include <net/if_media.h>
61 #include <net/if_ether.h>
62 
63 #include <net80211/ieee80211_netbsd.h>
64 #include <net80211/ieee80211_var.h>
65 #include <net80211/ieee80211_radiotap.h>
66 
67 #include <net/bpf.h>
68 
69 #include <sys/bus.h>
70 #include <sys/intr.h>
71 
72 #include <dev/ic/atwreg.h>
73 #include <dev/ic/rf3000reg.h>
74 #include <dev/ic/si4136reg.h>
75 #include <dev/ic/atwvar.h>
76 #include <dev/ic/smc93cx6var.h>
77 
78 /* XXX TBD open questions
79  *
80  *
81  * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
82  * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
83  * handle this for me?
84  *
85  */
86 /* device attachment
87  *
88  *    print TOFS[012]
89  *
90  * device initialization
91  *
92  *    clear ATW_FRCTL_MAXPSP to disable max power saving
93  *    set ATW_TXBR_ALCUPDATE to enable ALC
94  *    set TOFS[012]? (hope not)
95  *    disable rx/tx
96  *    set ATW_PAR_SWR (software reset)
97  *    wait for ATW_PAR_SWR clear
98  *    disable interrupts
99  *    ack status register
100  *    enable interrupts
101  *
102  * rx/tx initialization
103  *
104  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
105  *    allocate and init descriptor rings
106  *    write ATW_PAR_DSL (descriptor skip length)
107  *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
108  *    write ATW_NAR_SQ for one/both transmit descriptor rings
109  *    write ATW_NAR_SQ for one/both transmit descriptor rings
110  *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
111  *
112  * rx/tx end
113  *
114  *    stop DMA
115  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
116  *    flush tx w/ ATW_NAR_HF
117  *
118  * scan
119  *
120  *    initialize rx/tx
121  *
122  * BSS join: (re)association response
123  *
124  *    set ATW_FRCTL_AID
125  *
126  * optimizations ???
127  *
128  */
129 
130 #define ATW_REFSLAVE	/* slavishly do what the reference driver does */
131 
132 int atw_pseudo_milli = 1;
133 int atw_magic_delay1 = 100 * 1000;
134 int atw_magic_delay2 = 100 * 1000;
135 /* more magic multi-millisecond delays (units: microseconds) */
136 int atw_nar_delay = 20 * 1000;
137 int atw_magic_delay4 = 10 * 1000;
138 int atw_rf_delay1 = 10 * 1000;
139 int atw_rf_delay2 = 5 * 1000;
140 int atw_plcphd_delay = 2 * 1000;
141 int atw_bbp_io_enable_delay = 20 * 1000;
142 int atw_bbp_io_disable_delay = 2 * 1000;
143 int atw_writewep_delay = 1000;
144 int atw_beacon_len_adjust = 4;
145 int atw_dwelltime = 200;
146 int atw_xindiv2 = 0;
147 
148 #ifdef ATW_DEBUG
149 int atw_debug = 0;
150 
151 #define ATW_DPRINTF(x)	if (atw_debug > 0) printf x
152 #define ATW_DPRINTF2(x)	if (atw_debug > 1) printf x
153 #define ATW_DPRINTF3(x)	if (atw_debug > 2) printf x
154 #define	DPRINTF(sc, x)	if ((sc)->sc_if.if_flags & IFF_DEBUG) printf x
155 #define	DPRINTF2(sc, x)	if ((sc)->sc_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
156 #define	DPRINTF3(sc, x)	if ((sc)->sc_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
157 
158 static void	atw_dump_pkt(struct ifnet *, struct mbuf *);
159 static void	atw_print_regs(struct atw_softc *, const char *);
160 
161 /* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
162 #	ifdef ATW_BBPDEBUG
163 static void	atw_rf3000_print(struct atw_softc *);
164 static int	atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
165 #	endif /* ATW_BBPDEBUG */
166 
167 #	ifdef ATW_SYNDEBUG
168 static void	atw_si4126_print(struct atw_softc *);
169 static int	atw_si4126_read(struct atw_softc *, u_int, u_int *);
170 #	endif /* ATW_SYNDEBUG */
171 
172 #else
173 #define ATW_DPRINTF(x)
174 #define ATW_DPRINTF2(x)
175 #define ATW_DPRINTF3(x)
176 #define	DPRINTF(sc, x)	/* nothing */
177 #define	DPRINTF2(sc, x)	/* nothing */
178 #define	DPRINTF3(sc, x)	/* nothing */
179 #endif
180 
181 /* ifnet methods */
182 int	atw_init(struct ifnet *);
183 int	atw_ioctl(struct ifnet *, u_long, void *);
184 void	atw_start(struct ifnet *);
185 void	atw_stop(struct ifnet *, int);
186 void	atw_watchdog(struct ifnet *);
187 
188 /* Device attachment */
189 void	atw_attach(struct atw_softc *);
190 int	atw_detach(struct atw_softc *);
191 static void atw_evcnt_attach(struct atw_softc *);
192 static void atw_evcnt_detach(struct atw_softc *);
193 
194 /* Rx/Tx process */
195 int	atw_add_rxbuf(struct atw_softc *, int);
196 void	atw_idle(struct atw_softc *, u_int32_t);
197 void	atw_rxdrain(struct atw_softc *);
198 void	atw_txdrain(struct atw_softc *);
199 
200 /* Device (de)activation and power state */
201 void	atw_reset(struct atw_softc *);
202 
203 /* Interrupt handlers */
204 void	atw_linkintr(struct atw_softc *, u_int32_t);
205 void	atw_rxintr(struct atw_softc *);
206 void	atw_txintr(struct atw_softc *, uint32_t);
207 
208 /* 802.11 state machine */
209 static int	atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
210 static void	atw_next_scan(void *);
211 static void	atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
212 		              struct ieee80211_node *, int, int, u_int32_t);
213 static int	atw_tune(struct atw_softc *);
214 
215 /* Device initialization */
216 static void	atw_bbp_io_init(struct atw_softc *);
217 static void	atw_cfp_init(struct atw_softc *);
218 static void	atw_cmdr_init(struct atw_softc *);
219 static void	atw_ifs_init(struct atw_softc *);
220 static void	atw_nar_init(struct atw_softc *);
221 static void	atw_response_times_init(struct atw_softc *);
222 static void	atw_rf_reset(struct atw_softc *);
223 static void	atw_test1_init(struct atw_softc *);
224 static void	atw_tofs0_init(struct atw_softc *);
225 static void	atw_tofs2_init(struct atw_softc *);
226 static void	atw_txlmt_init(struct atw_softc *);
227 static void	atw_wcsr_init(struct atw_softc *);
228 
229 /* Key management */
230 static int atw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
231 static int atw_key_set(struct ieee80211com *, const struct ieee80211_key *,
232 	const u_int8_t[IEEE80211_ADDR_LEN]);
233 static void atw_key_update_begin(struct ieee80211com *);
234 static void atw_key_update_end(struct ieee80211com *);
235 
236 /* RAM/ROM utilities */
237 static void	atw_clear_sram(struct atw_softc *);
238 static void	atw_write_sram(struct atw_softc *, u_int, u_int8_t *, u_int);
239 static int	atw_read_srom(struct atw_softc *);
240 
241 /* BSS setup */
242 static void	atw_predict_beacon(struct atw_softc *);
243 static void	atw_start_beacon(struct atw_softc *, int);
244 static void	atw_write_bssid(struct atw_softc *);
245 static void	atw_write_ssid(struct atw_softc *);
246 static void	atw_write_sup_rates(struct atw_softc *);
247 static void	atw_write_wep(struct atw_softc *);
248 
249 /* Media */
250 static int	atw_media_change(struct ifnet *);
251 
252 static void	atw_filter_setup(struct atw_softc *);
253 
254 /* 802.11 utilities */
255 static uint64_t			atw_get_tsft(struct atw_softc *);
256 static inline uint32_t	atw_last_even_tsft(uint32_t, uint32_t,
257 				                   uint32_t);
258 static struct ieee80211_node	*atw_node_alloc(struct ieee80211_node_table *);
259 static void			atw_node_free(struct ieee80211_node *);
260 
261 /*
262  * Tuner/transceiver/modem
263  */
264 static void	atw_bbp_io_enable(struct atw_softc *, int);
265 
266 /* RFMD RF3000 Baseband Processor */
267 static int	atw_rf3000_init(struct atw_softc *);
268 static int	atw_rf3000_tune(struct atw_softc *, u_int);
269 static int	atw_rf3000_write(struct atw_softc *, u_int, u_int);
270 
271 /* Silicon Laboratories Si4126 RF/IF Synthesizer */
272 static void	atw_si4126_tune(struct atw_softc *, u_int);
273 static void	atw_si4126_write(struct atw_softc *, u_int, u_int);
274 
275 const struct atw_txthresh_tab atw_txthresh_tab_lo[] = ATW_TXTHRESH_TAB_LO_RATE;
276 const struct atw_txthresh_tab atw_txthresh_tab_hi[] = ATW_TXTHRESH_TAB_HI_RATE;
277 
278 const char *atw_tx_state[] = {
279 	"STOPPED",
280 	"RUNNING - read descriptor",
281 	"RUNNING - transmitting",
282 	"RUNNING - filling fifo",	/* XXX */
283 	"SUSPENDED",
284 	"RUNNING -- write descriptor",
285 	"RUNNING -- write last descriptor",
286 	"RUNNING - fifo full"
287 };
288 
289 const char *atw_rx_state[] = {
290 	"STOPPED",
291 	"RUNNING - read descriptor",
292 	"RUNNING - check this packet, pre-fetch next",
293 	"RUNNING - wait for reception",
294 	"SUSPENDED",
295 	"RUNNING - write descriptor",
296 	"RUNNING - flush fifo",
297 	"RUNNING - fifo drain"
298 };
299 
300 static inline int
301 is_running(struct ifnet *ifp)
302 {
303 	return (ifp->if_flags & (IFF_RUNNING|IFF_UP)) == (IFF_RUNNING|IFF_UP);
304 }
305 
306 int
307 atw_activate(device_t self, enum devact act)
308 {
309 	struct atw_softc *sc = device_private(self);
310 
311 	switch (act) {
312 	case DVACT_DEACTIVATE:
313 		if_deactivate(&sc->sc_if);
314 		return 0;
315 	default:
316 		return EOPNOTSUPP;
317 	}
318 }
319 
320 bool
321 atw_suspend(device_t self, const pmf_qual_t *qual)
322 {
323 	struct atw_softc *sc = device_private(self);
324 
325 	atw_rxdrain(sc);
326 	sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
327 
328 	return true;
329 }
330 
331 /* Returns -1 on failure. */
332 static int
333 atw_read_srom(struct atw_softc *sc)
334 {
335 	struct seeprom_descriptor sd;
336 	uint32_t test0, fail_bits;
337 
338 	(void)memset(&sd, 0, sizeof(sd));
339 
340 	test0 = ATW_READ(sc, ATW_TEST0);
341 
342 	switch (sc->sc_rev) {
343 	case ATW_REVISION_BA:
344 	case ATW_REVISION_CA:
345 		fail_bits = ATW_TEST0_EPNE;
346 		break;
347 	default:
348 		fail_bits = ATW_TEST0_EPNE|ATW_TEST0_EPSNM;
349 		break;
350 	}
351 	if ((test0 & fail_bits) != 0) {
352 		aprint_error_dev(sc->sc_dev, "bad or missing/bad SROM\n");
353 		return -1;
354 	}
355 
356 	switch (test0 & ATW_TEST0_EPTYP_MASK) {
357 	case ATW_TEST0_EPTYP_93c66:
358 		ATW_DPRINTF(("%s: 93c66 SROM\n", device_xname(sc->sc_dev)));
359 		sc->sc_sromsz = 512;
360 		sd.sd_chip = C56_66;
361 		break;
362 	case ATW_TEST0_EPTYP_93c46:
363 		ATW_DPRINTF(("%s: 93c46 SROM\n", device_xname(sc->sc_dev)));
364 		sc->sc_sromsz = 128;
365 		sd.sd_chip = C46;
366 		break;
367 	default:
368 		printf("%s: unknown SROM type %" __PRIuBITS "\n",
369 		    device_xname(sc->sc_dev),
370 		    __SHIFTOUT(test0, ATW_TEST0_EPTYP_MASK));
371 		return -1;
372 	}
373 
374 	sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_NOWAIT);
375 
376 	if (sc->sc_srom == NULL) {
377 		aprint_error_dev(sc->sc_dev, "unable to allocate SROM buffer\n");
378 		return -1;
379 	}
380 
381 	(void)memset(sc->sc_srom, 0, sc->sc_sromsz);
382 
383 	/* ADM8211 has a single 32-bit register for controlling the
384 	 * 93cx6 SROM.  Bit SRS enables the serial port. There is no
385 	 * "ready" bit. The ADM8211 input/output sense is the reverse
386 	 * of read_seeprom's.
387 	 */
388 	sd.sd_tag = sc->sc_st;
389 	sd.sd_bsh = sc->sc_sh;
390 	sd.sd_regsize = 4;
391 	sd.sd_control_offset = ATW_SPR;
392 	sd.sd_status_offset = ATW_SPR;
393 	sd.sd_dataout_offset = ATW_SPR;
394 	sd.sd_CK = ATW_SPR_SCLK;
395 	sd.sd_CS = ATW_SPR_SCS;
396 	sd.sd_DI = ATW_SPR_SDO;
397 	sd.sd_DO = ATW_SPR_SDI;
398 	sd.sd_MS = ATW_SPR_SRS;
399 	sd.sd_RDY = 0;
400 
401 	if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
402 		aprint_error_dev(sc->sc_dev, "could not read SROM\n");
403 		free(sc->sc_srom, M_DEVBUF);
404 		return -1;
405 	}
406 #ifdef ATW_DEBUG
407 	{
408 		int i;
409 		ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
410 		for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
411 			if (((i % 8) == 0) && (i != 0)) {
412 				ATW_DPRINTF(("\n\t"));
413 			}
414 			ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
415 		}
416 		ATW_DPRINTF(("\n"));
417 	}
418 #endif /* ATW_DEBUG */
419 	return 0;
420 }
421 
422 #ifdef ATW_DEBUG
423 static void
424 atw_print_regs(struct atw_softc *sc, const char *where)
425 {
426 #define PRINTREG(sc, reg) \
427 	ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
428 	    device_xname(sc->sc_dev), reg, ATW_READ(sc, reg)))
429 
430 	ATW_DPRINTF2(("%s: %s\n", device_xname(sc->sc_dev), where));
431 
432 	PRINTREG(sc, ATW_PAR);
433 	PRINTREG(sc, ATW_FRCTL);
434 	PRINTREG(sc, ATW_TDR);
435 	PRINTREG(sc, ATW_WTDP);
436 	PRINTREG(sc, ATW_RDR);
437 	PRINTREG(sc, ATW_WRDP);
438 	PRINTREG(sc, ATW_RDB);
439 	PRINTREG(sc, ATW_CSR3A);
440 	PRINTREG(sc, ATW_TDBD);
441 	PRINTREG(sc, ATW_TDBP);
442 	PRINTREG(sc, ATW_STSR);
443 	PRINTREG(sc, ATW_CSR5A);
444 	PRINTREG(sc, ATW_NAR);
445 	PRINTREG(sc, ATW_CSR6A);
446 	PRINTREG(sc, ATW_IER);
447 	PRINTREG(sc, ATW_CSR7A);
448 	PRINTREG(sc, ATW_LPC);
449 	PRINTREG(sc, ATW_TEST1);
450 	PRINTREG(sc, ATW_SPR);
451 	PRINTREG(sc, ATW_TEST0);
452 	PRINTREG(sc, ATW_WCSR);
453 	PRINTREG(sc, ATW_WPDR);
454 	PRINTREG(sc, ATW_GPTMR);
455 	PRINTREG(sc, ATW_GPIO);
456 	PRINTREG(sc, ATW_BBPCTL);
457 	PRINTREG(sc, ATW_SYNCTL);
458 	PRINTREG(sc, ATW_PLCPHD);
459 	PRINTREG(sc, ATW_MMIWADDR);
460 	PRINTREG(sc, ATW_MMIRADDR1);
461 	PRINTREG(sc, ATW_MMIRADDR2);
462 	PRINTREG(sc, ATW_TXBR);
463 	PRINTREG(sc, ATW_CSR15A);
464 	PRINTREG(sc, ATW_ALCSTAT);
465 	PRINTREG(sc, ATW_TOFS2);
466 	PRINTREG(sc, ATW_CMDR);
467 	PRINTREG(sc, ATW_PCIC);
468 	PRINTREG(sc, ATW_PMCSR);
469 	PRINTREG(sc, ATW_PAR0);
470 	PRINTREG(sc, ATW_PAR1);
471 	PRINTREG(sc, ATW_MAR0);
472 	PRINTREG(sc, ATW_MAR1);
473 	PRINTREG(sc, ATW_ATIMDA0);
474 	PRINTREG(sc, ATW_ABDA1);
475 	PRINTREG(sc, ATW_BSSID0);
476 	PRINTREG(sc, ATW_TXLMT);
477 	PRINTREG(sc, ATW_MIBCNT);
478 	PRINTREG(sc, ATW_BCNT);
479 	PRINTREG(sc, ATW_TSFTH);
480 	PRINTREG(sc, ATW_TSC);
481 	PRINTREG(sc, ATW_SYNRF);
482 	PRINTREG(sc, ATW_BPLI);
483 	PRINTREG(sc, ATW_CAP0);
484 	PRINTREG(sc, ATW_CAP1);
485 	PRINTREG(sc, ATW_RMD);
486 	PRINTREG(sc, ATW_CFPP);
487 	PRINTREG(sc, ATW_TOFS0);
488 	PRINTREG(sc, ATW_TOFS1);
489 	PRINTREG(sc, ATW_IFST);
490 	PRINTREG(sc, ATW_RSPT);
491 	PRINTREG(sc, ATW_TSFTL);
492 	PRINTREG(sc, ATW_WEPCTL);
493 	PRINTREG(sc, ATW_WESK);
494 	PRINTREG(sc, ATW_WEPCNT);
495 	PRINTREG(sc, ATW_MACTEST);
496 	PRINTREG(sc, ATW_FER);
497 	PRINTREG(sc, ATW_FEMR);
498 	PRINTREG(sc, ATW_FPSR);
499 	PRINTREG(sc, ATW_FFER);
500 #undef PRINTREG
501 }
502 #endif /* ATW_DEBUG */
503 
504 /*
505  * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
506  */
507 void
508 atw_attach(struct atw_softc *sc)
509 {
510 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
511 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
512 	};
513 	struct ieee80211com *ic = &sc->sc_ic;
514 	struct ifnet *ifp = &sc->sc_if;
515 	int country_code, error, i, nrate, srom_major;
516 	u_int32_t reg;
517 	static const char *type_strings[] = {"Intersil (not supported)",
518 	    "RFMD", "Marvel (not supported)"};
519 
520 	pmf_self_suspensor_init(sc->sc_dev, &sc->sc_suspensor, &sc->sc_qual);
521 
522 	sc->sc_txth = atw_txthresh_tab_lo;
523 
524 	SIMPLEQ_INIT(&sc->sc_txfreeq);
525 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
526 
527 #ifdef ATW_DEBUG
528 	atw_print_regs(sc, "atw_attach");
529 #endif /* ATW_DEBUG */
530 
531 	/*
532 	 * Allocate the control data structures, and create and load the
533 	 * DMA map for it.
534 	 */
535 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
536 	    sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
537 	    1, &sc->sc_cdnseg, 0)) != 0) {
538 		aprint_error_dev(sc->sc_dev,
539 		    "unable to allocate control data, error = %d\n",
540 		    error);
541 		goto fail_0;
542 	}
543 
544 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
545 	    sizeof(struct atw_control_data), (void **)&sc->sc_control_data,
546 	    BUS_DMA_COHERENT)) != 0) {
547 		aprint_error_dev(sc->sc_dev,
548 		    "unable to map control data, error = %d\n",
549 		    error);
550 		goto fail_1;
551 	}
552 
553 	if ((error = bus_dmamap_create(sc->sc_dmat,
554 	    sizeof(struct atw_control_data), 1,
555 	    sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
556 		aprint_error_dev(sc->sc_dev,
557 		    "unable to create control data DMA map, error = %d\n",
558 		    error);
559 		goto fail_2;
560 	}
561 
562 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
563 	    sc->sc_control_data, sizeof(struct atw_control_data), NULL,
564 	    0)) != 0) {
565 		aprint_error_dev(sc->sc_dev,
566 		    "unable to load control data DMA map, error = %d\n", error);
567 		goto fail_3;
568 	}
569 
570 	/*
571 	 * Create the transmit buffer DMA maps.
572 	 */
573 	sc->sc_ntxsegs = ATW_NTXSEGS;
574 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
575 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
576 		    sc->sc_ntxsegs, MCLBYTES, 0, 0,
577 		    &sc->sc_txsoft[i].txs_dmamap)) != 0) {
578 			aprint_error_dev(sc->sc_dev,
579 			    "unable to create tx DMA map %d, error = %d\n", i,
580 			    error);
581 			goto fail_4;
582 		}
583 	}
584 
585 	/*
586 	 * Create the receive buffer DMA maps.
587 	 */
588 	for (i = 0; i < ATW_NRXDESC; i++) {
589 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
590 		    MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
591 			aprint_error_dev(sc->sc_dev,
592 			    "unable to create rx DMA map %d, error = %d\n", i,
593 			    error);
594 			goto fail_5;
595 		}
596 	}
597 	for (i = 0; i < ATW_NRXDESC; i++) {
598 		sc->sc_rxsoft[i].rxs_mbuf = NULL;
599 	}
600 
601 	switch (sc->sc_rev) {
602 	case ATW_REVISION_AB:
603 	case ATW_REVISION_AF:
604 		sc->sc_sramlen = ATW_SRAM_A_SIZE;
605 		break;
606 	case ATW_REVISION_BA:
607 	case ATW_REVISION_CA:
608 		sc->sc_sramlen = ATW_SRAM_B_SIZE;
609 		break;
610 	}
611 
612 	/* Reset the chip to a known state. */
613 	atw_reset(sc);
614 
615 	if (atw_read_srom(sc) == -1)
616 		return;
617 
618 	sc->sc_rftype = __SHIFTOUT(sc->sc_srom[ATW_SR_CSR20],
619 	    ATW_SR_RFTYPE_MASK);
620 
621 	sc->sc_bbptype = __SHIFTOUT(sc->sc_srom[ATW_SR_CSR20],
622 	    ATW_SR_BBPTYPE_MASK);
623 
624 	if (sc->sc_rftype >= __arraycount(type_strings)) {
625 		aprint_error_dev(sc->sc_dev, "unknown RF\n");
626 		return;
627 	}
628 	if (sc->sc_bbptype >= __arraycount(type_strings)) {
629 		aprint_error_dev(sc->sc_dev, "unknown BBP\n");
630 		return;
631 	}
632 
633 	printf("%s: %s RF, %s BBP", device_xname(sc->sc_dev),
634 	    type_strings[sc->sc_rftype], type_strings[sc->sc_bbptype]);
635 
636 	/* XXX There exists a Linux driver which seems to use RFType = 0 for
637 	 * MARVEL. My bug, or theirs?
638 	 */
639 
640 	reg = __SHIFTIN(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
641 
642 	switch (sc->sc_rftype) {
643 	case ATW_RFTYPE_INTERSIL:
644 		reg |= ATW_SYNCTL_CS1;
645 		break;
646 	case ATW_RFTYPE_RFMD:
647 		reg |= ATW_SYNCTL_CS0;
648 		break;
649 	case ATW_RFTYPE_MARVEL:
650 		break;
651 	}
652 
653 	sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
654 	sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
655 
656 	reg = __SHIFTIN(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
657 
658 	switch (sc->sc_bbptype) {
659 	case ATW_BBPTYPE_INTERSIL:
660 		reg |= ATW_BBPCTL_TWI;
661 		break;
662 	case ATW_BBPTYPE_RFMD:
663 		reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
664 		    ATW_BBPCTL_CCA_ACTLO;
665 		break;
666 	case ATW_BBPTYPE_MARVEL:
667 		break;
668 	case ATW_C_BBPTYPE_RFMD:
669 		printf("%s: ADM8211C MAC/RFMD BBP not supported yet.\n",
670 		    device_xname(sc->sc_dev));
671 		break;
672 	}
673 
674 	sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
675 	sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
676 
677 	/*
678 	 * From this point forward, the attachment cannot fail.  A failure
679 	 * before this point releases all resources that may have been
680 	 * allocated.
681 	 */
682 	sc->sc_flags |= ATWF_ATTACHED;
683 
684 	ATW_DPRINTF((" SROM MAC %04x%04x%04x",
685 	    htole16(sc->sc_srom[ATW_SR_MAC00]),
686 	    htole16(sc->sc_srom[ATW_SR_MAC01]),
687 	    htole16(sc->sc_srom[ATW_SR_MAC10])));
688 
689 	srom_major = __SHIFTOUT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
690 	    ATW_SR_MAJOR_MASK);
691 
692 	if (srom_major < 2)
693 		sc->sc_rf3000_options1 = 0;
694 	else if (sc->sc_rev == ATW_REVISION_BA) {
695 		sc->sc_rf3000_options1 =
696 		    __SHIFTOUT(sc->sc_srom[ATW_SR_CR28_CR03],
697 		    ATW_SR_CR28_MASK);
698 	} else
699 		sc->sc_rf3000_options1 = 0;
700 
701 	sc->sc_rf3000_options2 = __SHIFTOUT(sc->sc_srom[ATW_SR_CTRY_CR29],
702 	    ATW_SR_CR29_MASK);
703 
704 	country_code = __SHIFTOUT(sc->sc_srom[ATW_SR_CTRY_CR29],
705 	    ATW_SR_CTRY_MASK);
706 
707 #define ADD_CHANNEL(_ic, _chan) do {					\
708 	_ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;		\
709 	_ic->ic_channels[_chan].ic_freq =				\
710 	    ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
711 } while (0)
712 
713 	/* Find available channels */
714 	switch (country_code) {
715 	case COUNTRY_MMK2:	/* 1-14 */
716 		ADD_CHANNEL(ic, 14);
717 		/*FALLTHROUGH*/
718 	case COUNTRY_ETSI:	/* 1-13 */
719 		for (i = 1; i <= 13; i++)
720 			ADD_CHANNEL(ic, i);
721 		break;
722 	case COUNTRY_FCC:	/* 1-11 */
723 	case COUNTRY_IC:	/* 1-11 */
724 		for (i = 1; i <= 11; i++)
725 			ADD_CHANNEL(ic, i);
726 		break;
727 	case COUNTRY_MMK:	/* 14 */
728 		ADD_CHANNEL(ic, 14);
729 		break;
730 	case COUNTRY_FRANCE:	/* 10-13 */
731 		for (i = 10; i <= 13; i++)
732 			ADD_CHANNEL(ic, i);
733 		break;
734 	default:	/* assume channels 10-11 */
735 	case COUNTRY_SPAIN:	/* 10-11 */
736 		for (i = 10; i <= 11; i++)
737 			ADD_CHANNEL(ic, i);
738 		break;
739 	}
740 
741 	/* Read the MAC address. */
742 	reg = ATW_READ(sc, ATW_PAR0);
743 	ic->ic_myaddr[0] = __SHIFTOUT(reg, ATW_PAR0_PAB0_MASK);
744 	ic->ic_myaddr[1] = __SHIFTOUT(reg, ATW_PAR0_PAB1_MASK);
745 	ic->ic_myaddr[2] = __SHIFTOUT(reg, ATW_PAR0_PAB2_MASK);
746 	ic->ic_myaddr[3] = __SHIFTOUT(reg, ATW_PAR0_PAB3_MASK);
747 	reg = ATW_READ(sc, ATW_PAR1);
748 	ic->ic_myaddr[4] = __SHIFTOUT(reg, ATW_PAR1_PAB4_MASK);
749 	ic->ic_myaddr[5] = __SHIFTOUT(reg, ATW_PAR1_PAB5_MASK);
750 
751 	if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
752 		printf(" could not get mac address, attach failed\n");
753 		return;
754 	}
755 
756 	printf(" 802.11 address %s\n", ether_sprintf(ic->ic_myaddr));
757 
758 	memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
759 	ifp->if_softc = sc;
760 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
761 	    IFF_NOTRAILERS;
762 	ifp->if_ioctl = atw_ioctl;
763 	ifp->if_start = atw_start;
764 	ifp->if_watchdog = atw_watchdog;
765 	ifp->if_init = atw_init;
766 	ifp->if_stop = atw_stop;
767 	IFQ_SET_READY(&ifp->if_snd);
768 
769 	ic->ic_ifp = ifp;
770 	ic->ic_phytype = IEEE80211_T_DS;
771 	ic->ic_opmode = IEEE80211_M_STA;
772 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
773 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
774 
775 	nrate = 0;
776 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 2;
777 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 4;
778 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
779 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
780 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
781 
782 	/*
783 	 * Call MI attach routines.
784 	 */
785 
786 	if_attach(ifp);
787 	ieee80211_ifattach(ic);
788 
789 	atw_evcnt_attach(sc);
790 
791 	sc->sc_newstate = ic->ic_newstate;
792 	ic->ic_newstate = atw_newstate;
793 
794 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
795 	ic->ic_recv_mgmt = atw_recv_mgmt;
796 
797 	sc->sc_node_free = ic->ic_node_free;
798 	ic->ic_node_free = atw_node_free;
799 
800 	sc->sc_node_alloc = ic->ic_node_alloc;
801 	ic->ic_node_alloc = atw_node_alloc;
802 
803 	ic->ic_crypto.cs_key_delete = atw_key_delete;
804 	ic->ic_crypto.cs_key_set = atw_key_set;
805 	ic->ic_crypto.cs_key_update_begin = atw_key_update_begin;
806 	ic->ic_crypto.cs_key_update_end = atw_key_update_end;
807 
808 	/* possibly we should fill in our own sc_send_prresp, since
809 	 * the ADM8211 is probably sending probe responses in ad hoc
810 	 * mode.
811 	 */
812 
813 	/* complete initialization */
814 	ieee80211_media_init(ic, atw_media_change, ieee80211_media_status);
815 	callout_init(&sc->sc_scan_ch, 0);
816 
817 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
818 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
819 
820 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
821 	sc->sc_rxtap.ar_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
822 	sc->sc_rxtap.ar_ihdr.it_present = htole32(ATW_RX_RADIOTAP_PRESENT);
823 
824 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
825 	sc->sc_txtap.at_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
826 	sc->sc_txtap.at_ihdr.it_present = htole32(ATW_TX_RADIOTAP_PRESENT);
827 
828 	ieee80211_announce(ic);
829 	return;
830 
831 	/*
832 	 * Free any resources we've allocated during the failed attach
833 	 * attempt.  Do this in reverse order and fall through.
834 	 */
835  fail_5:
836 	for (i = 0; i < ATW_NRXDESC; i++) {
837 		if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
838 			continue;
839 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
840 	}
841  fail_4:
842 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
843 		if (sc->sc_txsoft[i].txs_dmamap == NULL)
844 			continue;
845 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
846 	}
847 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
848  fail_3:
849 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
850  fail_2:
851 	bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_control_data,
852 	    sizeof(struct atw_control_data));
853  fail_1:
854 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
855  fail_0:
856 	return;
857 }
858 
859 static struct ieee80211_node *
860 atw_node_alloc(struct ieee80211_node_table *nt)
861 {
862 	struct atw_softc *sc = (struct atw_softc *)nt->nt_ic->ic_ifp->if_softc;
863 	struct ieee80211_node *ni = (*sc->sc_node_alloc)(nt);
864 
865 	DPRINTF(sc, ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
866 	return ni;
867 }
868 
869 static void
870 atw_node_free(struct ieee80211_node *ni)
871 {
872 	struct atw_softc *sc = (struct atw_softc *)ni->ni_ic->ic_ifp->if_softc;
873 
874 	DPRINTF(sc, ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
875 	    ether_sprintf(ni->ni_bssid)));
876 	(*sc->sc_node_free)(ni);
877 }
878 
879 
880 static void
881 atw_test1_reset(struct atw_softc *sc)
882 {
883 	switch (sc->sc_rev) {
884 	case ATW_REVISION_BA:
885 		if (1 /* XXX condition on transceiver type */) {
886 			ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
887 		}
888 		break;
889 	case ATW_REVISION_CA:
890 		ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
891 		break;
892 	default:
893 		break;
894 	}
895 }
896 
897 /*
898  * atw_reset:
899  *
900  *	Perform a soft reset on the ADM8211.
901  */
902 void
903 atw_reset(struct atw_softc *sc)
904 {
905 	int i;
906 	uint32_t lpc;
907 
908 	ATW_WRITE(sc, ATW_NAR, 0x0);
909 	DELAY(atw_nar_delay);
910 
911 	/* Reference driver has a cryptic remark indicating that this might
912 	 * power-on the chip.  I know that it turns off power-saving....
913 	 */
914 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
915 
916 	ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
917 
918 	for (i = 0; i < 50000 / atw_pseudo_milli; i++) {
919 		if ((ATW_READ(sc, ATW_PAR) & ATW_PAR_SWR) == 0)
920 			break;
921 		DELAY(atw_pseudo_milli);
922 	}
923 
924 	/* ... and then pause 100ms longer for good measure. */
925 	DELAY(atw_magic_delay1);
926 
927 	DPRINTF2(sc, ("%s: atw_reset %d iterations\n", device_xname(sc->sc_dev), i));
928 
929 	if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
930 		aprint_error_dev(sc->sc_dev, "reset failed to complete\n");
931 
932 	/*
933 	 * Initialize the PCI Access Register.
934 	 */
935 	sc->sc_busmode = ATW_PAR_PBL_8DW;
936 
937 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
938 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", device_xname(sc->sc_dev),
939 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
940 
941 	atw_test1_reset(sc);
942 
943 	/* Turn off maximum power saving, etc. */
944 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
945 
946 	DELAY(atw_magic_delay2);
947 
948 	/* Recall EEPROM. */
949 	ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
950 
951 	DELAY(atw_magic_delay4);
952 
953 	lpc = ATW_READ(sc, ATW_LPC);
954 
955 	DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
956 
957 	/* A reset seems to affect the SRAM contents, so put them into
958 	 * a known state.
959 	 */
960 	atw_clear_sram(sc);
961 
962 	memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
963 }
964 
965 static void
966 atw_clear_sram(struct atw_softc *sc)
967 {
968 	memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
969 	sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
970 	/* XXX not for revision 0x20. */
971 	atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
972 }
973 
974 /* TBD atw_init
975  *
976  * set MAC based on ic->ic_bss->myaddr
977  * write WEP keys
978  * set TX rate
979  */
980 
981 /* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
982  * without receiving a beacon with the preferred BSSID & SSID.
983  * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
984  */
985 static void
986 atw_wcsr_init(struct atw_softc *sc)
987 {
988 	uint32_t wcsr;
989 
990 	wcsr = ATW_READ(sc, ATW_WCSR);
991 	wcsr &= ~(ATW_WCSR_BLN_MASK|ATW_WCSR_LSOE|ATW_WCSR_MPRE|ATW_WCSR_LSOE);
992 	wcsr |= __SHIFTIN(7, ATW_WCSR_BLN_MASK);
993 	ATW_WRITE(sc, ATW_WCSR, wcsr);	/* XXX resets wake-up status bits */
994 
995 	DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
996 	    device_xname(sc->sc_dev), __func__, ATW_READ(sc, ATW_WCSR)));
997 }
998 
999 /* Turn off power management.  Set Rx store-and-forward mode. */
1000 static void
1001 atw_cmdr_init(struct atw_softc *sc)
1002 {
1003 	uint32_t cmdr;
1004 	cmdr = ATW_READ(sc, ATW_CMDR);
1005 	cmdr &= ~ATW_CMDR_APM;
1006 	cmdr |= ATW_CMDR_RTE;
1007 	cmdr &= ~ATW_CMDR_DRT_MASK;
1008 	cmdr |= ATW_CMDR_DRT_SF;
1009 
1010 	ATW_WRITE(sc, ATW_CMDR, cmdr);
1011 }
1012 
1013 static void
1014 atw_tofs2_init(struct atw_softc *sc)
1015 {
1016 	uint32_t tofs2;
1017 	/* XXX this magic can probably be figured out from the RFMD docs */
1018 #ifndef ATW_REFSLAVE
1019 	tofs2 = __SHIFTIN(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1020 	      __SHIFTIN(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1021 	      __SHIFTIN(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1022 	      __SHIFTIN(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1023 	      __SHIFTIN(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1024 	      __SHIFTIN(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1025 	      __SHIFTIN(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1026 	      __SHIFTIN(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1027 #else
1028 	/* XXX new magic from reference driver source */
1029 	tofs2 = __SHIFTIN(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1030 	      __SHIFTIN(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 8 us */
1031 	      __SHIFTIN(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 1 us */
1032 	      __SHIFTIN(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1033 	      __SHIFTIN(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1034 	      __SHIFTIN(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1035 	      __SHIFTIN(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 1 us */
1036 	      __SHIFTIN(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 8 us */
1037 #endif
1038 	ATW_WRITE(sc, ATW_TOFS2, tofs2);
1039 }
1040 
1041 static void
1042 atw_nar_init(struct atw_softc *sc)
1043 {
1044 	ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF|ATW_NAR_PB);
1045 }
1046 
1047 static void
1048 atw_txlmt_init(struct atw_softc *sc)
1049 {
1050 	ATW_WRITE(sc, ATW_TXLMT, __SHIFTIN(512, ATW_TXLMT_MTMLT_MASK) |
1051 	                         __SHIFTIN(1, ATW_TXLMT_SRTYLIM_MASK));
1052 }
1053 
1054 static void
1055 atw_test1_init(struct atw_softc *sc)
1056 {
1057 	uint32_t test1;
1058 
1059 	test1 = ATW_READ(sc, ATW_TEST1);
1060 	test1 &= ~(ATW_TEST1_DBGREAD_MASK|ATW_TEST1_CONTROL);
1061 	/* XXX magic 0x1 */
1062 	test1 |= __SHIFTIN(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
1063 	ATW_WRITE(sc, ATW_TEST1, test1);
1064 }
1065 
1066 static void
1067 atw_rf_reset(struct atw_softc *sc)
1068 {
1069 	/* XXX this resets an Intersil RF front-end? */
1070 	/* TBD condition on Intersil RFType? */
1071 	ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
1072 	DELAY(atw_rf_delay1);
1073 	ATW_WRITE(sc, ATW_SYNRF, 0);
1074 	DELAY(atw_rf_delay2);
1075 }
1076 
1077 /* Set 16 TU max duration for the contention-free period (CFP). */
1078 static void
1079 atw_cfp_init(struct atw_softc *sc)
1080 {
1081 	uint32_t cfpp;
1082 
1083 	cfpp = ATW_READ(sc, ATW_CFPP);
1084 	cfpp &= ~ATW_CFPP_CFPMD;
1085 	cfpp |= __SHIFTIN(16, ATW_CFPP_CFPMD);
1086 	ATW_WRITE(sc, ATW_CFPP, cfpp);
1087 }
1088 
1089 static void
1090 atw_tofs0_init(struct atw_softc *sc)
1091 {
1092 	/* XXX I guess that the Cardbus clock is 22 MHz?
1093 	 * I am assuming that the role of ATW_TOFS0_USCNT is
1094 	 * to divide the bus clock to get a 1 MHz clock---the datasheet is not
1095 	 * very clear on this point. It says in the datasheet that it is
1096 	 * possible for the ADM8211 to accommodate bus speeds between 22 MHz
1097 	 * and 33 MHz; maybe this is the way? I see a binary-only driver write
1098 	 * these values. These values are also the power-on default.
1099 	 */
1100 	ATW_WRITE(sc, ATW_TOFS0,
1101 	    __SHIFTIN(22, ATW_TOFS0_USCNT_MASK) |
1102 	    ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
1103 }
1104 
1105 /* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
1106 static void
1107 atw_ifs_init(struct atw_softc *sc)
1108 {
1109 	uint32_t ifst;
1110 	/* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
1111 	 * Go figure.
1112 	 */
1113 	ifst = __SHIFTIN(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
1114 	      __SHIFTIN(22 * 10 /* IEEE80211_DUR_DS_SIFS */ /* # of 22 MHz cycles */,
1115 	             ATW_IFST_SIFS_MASK) |
1116 	      __SHIFTIN(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
1117 	      __SHIFTIN(IEEE80211_DUR_DS_EIFS, ATW_IFST_EIFS_MASK);
1118 
1119 	ATW_WRITE(sc, ATW_IFST, ifst);
1120 }
1121 
1122 static void
1123 atw_response_times_init(struct atw_softc *sc)
1124 {
1125 	/* XXX More magic. Relates to ACK timing?  The datasheet seems to
1126 	 * indicate that the MAC expects at least SIFS + MIRT microseconds
1127 	 * to pass after it transmits a frame that requires a response;
1128 	 * it waits at most SIFS + MART microseconds for the response.
1129 	 * Surely this is not the ACK timeout?
1130 	 */
1131 	ATW_WRITE(sc, ATW_RSPT, __SHIFTIN(0xffff, ATW_RSPT_MART_MASK) |
1132 	    __SHIFTIN(0xff, ATW_RSPT_MIRT_MASK));
1133 }
1134 
1135 /* Set up the MMI read/write addresses for the baseband. The Tx/Rx
1136  * engines read and write baseband registers after Rx and before
1137  * Tx, respectively.
1138  */
1139 static void
1140 atw_bbp_io_init(struct atw_softc *sc)
1141 {
1142 	uint32_t mmiraddr2;
1143 
1144 	/* XXX The reference driver does this, but is it *really*
1145 	 * necessary?
1146 	 */
1147 	switch (sc->sc_rev) {
1148 	case ATW_REVISION_AB:
1149 	case ATW_REVISION_AF:
1150 		mmiraddr2 = 0x0;
1151 		break;
1152 	default:
1153 		mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
1154 		mmiraddr2 &=
1155 		    ~(ATW_MMIRADDR2_PROREXT|ATW_MMIRADDR2_PRORLEN_MASK);
1156 		break;
1157 	}
1158 
1159 	switch (sc->sc_bbptype) {
1160 	case ATW_BBPTYPE_INTERSIL:
1161 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
1162 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
1163 		mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
1164 		break;
1165 	case ATW_BBPTYPE_MARVEL:
1166 		/* TBD find out the Marvel settings. */
1167 		break;
1168 	case ATW_BBPTYPE_RFMD:
1169 	default:
1170 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
1171 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
1172 		mmiraddr2 |= ATW_MMIRADDR2_RFMD;
1173 		break;
1174 	}
1175 	ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
1176 	ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
1177 }
1178 
1179 /*
1180  * atw_init:		[ ifnet interface function ]
1181  *
1182  *	Initialize the interface.  Must be called at splnet().
1183  */
1184 int
1185 atw_init(struct ifnet *ifp)
1186 {
1187 	struct atw_softc *sc = ifp->if_softc;
1188 	struct ieee80211com *ic = &sc->sc_ic;
1189 	struct atw_txsoft *txs;
1190 	struct atw_rxsoft *rxs;
1191 	int i, error = 0;
1192 
1193 	if (device_is_active(sc->sc_dev)) {
1194 		/*
1195 		 * Cancel any pending I/O.
1196 		 */
1197 		atw_stop(ifp, 0);
1198 	} else if (!pmf_device_subtree_resume(sc->sc_dev, &sc->sc_qual) ||
1199 	           !device_is_active(sc->sc_dev))
1200 		return 0;
1201 
1202 	/*
1203 	 * Reset the chip to a known state.
1204 	 */
1205 	atw_reset(sc);
1206 
1207 	DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
1208 	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
1209 	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
1210 
1211 	atw_wcsr_init(sc);
1212 
1213 	atw_cmdr_init(sc);
1214 
1215 	/* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
1216 	 *
1217 	 * XXX Set transmit power for ATIM, RTS, Beacon.
1218 	 */
1219 	ATW_WRITE(sc, ATW_PLCPHD, __SHIFTIN(10, ATW_PLCPHD_SIGNAL_MASK) |
1220 	    __SHIFTIN(0xb0, ATW_PLCPHD_SERVICE_MASK));
1221 
1222 	atw_tofs2_init(sc);
1223 
1224 	atw_nar_init(sc);
1225 
1226 	atw_txlmt_init(sc);
1227 
1228 	atw_test1_init(sc);
1229 
1230 	atw_rf_reset(sc);
1231 
1232 	atw_cfp_init(sc);
1233 
1234 	atw_tofs0_init(sc);
1235 
1236 	atw_ifs_init(sc);
1237 
1238 	/* XXX Fall asleep after one second of inactivity.
1239 	 * XXX A frame may only dribble in for 65536us.
1240 	 */
1241 	ATW_WRITE(sc, ATW_RMD,
1242 	    __SHIFTIN(1, ATW_RMD_PCNT) | __SHIFTIN(0xffff, ATW_RMD_RMRD_MASK));
1243 
1244 	atw_response_times_init(sc);
1245 
1246 	atw_bbp_io_init(sc);
1247 
1248 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1249 
1250 	if ((error = atw_rf3000_init(sc)) != 0)
1251 		goto out;
1252 
1253 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
1254 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", device_xname(sc->sc_dev),
1255 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
1256 
1257 	/*
1258 	 * Initialize the transmit descriptor ring.
1259 	 */
1260 	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
1261 	for (i = 0; i < ATW_NTXDESC; i++) {
1262 		sc->sc_txdescs[i].at_ctl = 0;
1263 		/* no transmit chaining */
1264 		sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
1265 		sc->sc_txdescs[i].at_buf2 =
1266 		    htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
1267 	}
1268 	/* use ring mode */
1269 	sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
1270 	ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
1271 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1272 	sc->sc_txfree = ATW_NTXDESC;
1273 	sc->sc_txnext = 0;
1274 
1275 	/*
1276 	 * Initialize the transmit job descriptors.
1277 	 */
1278 	SIMPLEQ_INIT(&sc->sc_txfreeq);
1279 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
1280 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
1281 		txs = &sc->sc_txsoft[i];
1282 		txs->txs_mbuf = NULL;
1283 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
1284 	}
1285 
1286 	/*
1287 	 * Initialize the receive descriptor and receive job
1288 	 * descriptor rings.
1289 	 */
1290 	for (i = 0; i < ATW_NRXDESC; i++) {
1291 		rxs = &sc->sc_rxsoft[i];
1292 		if (rxs->rxs_mbuf == NULL) {
1293 			if ((error = atw_add_rxbuf(sc, i)) != 0) {
1294 				aprint_error_dev(sc->sc_dev,
1295 				    "unable to allocate or map rx buffer %d, "
1296 				    "error = %d\n", i, error);
1297 				/*
1298 				 * XXX Should attempt to run with fewer receive
1299 				 * XXX buffers instead of just failing.
1300 				 */
1301 				atw_rxdrain(sc);
1302 				goto out;
1303 			}
1304 		} else
1305 			atw_init_rxdesc(sc, i);
1306 	}
1307 	sc->sc_rxptr = 0;
1308 
1309 	/*
1310 	 * Initialize the interrupt mask and enable interrupts.
1311 	 */
1312 	/* normal interrupts */
1313 	sc->sc_inten =  ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
1314 	    ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
1315 
1316 	/* abnormal interrupts */
1317 	sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
1318 	    ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
1319 	    ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1320 
1321 	sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
1322 	    ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1323 	sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
1324 	sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
1325 	    ATW_INTR_TRT;
1326 
1327 	sc->sc_linkint_mask &= sc->sc_inten;
1328 	sc->sc_rxint_mask &= sc->sc_inten;
1329 	sc->sc_txint_mask &= sc->sc_inten;
1330 
1331 	ATW_WRITE(sc, ATW_IER, sc->sc_inten);
1332 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1333 
1334 	DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
1335 	    device_xname(sc->sc_dev), ATW_READ(sc, ATW_IER), sc->sc_inten));
1336 
1337 	/*
1338 	 * Give the transmit and receive rings to the ADM8211.
1339 	 */
1340 	ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
1341 	ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
1342 
1343 	sc->sc_txthresh = 0;
1344 	sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
1345 	    sc->sc_txth[sc->sc_txthresh].txth_opmode;
1346 
1347 	/* common 802.11 configuration */
1348 	ic->ic_flags &= ~IEEE80211_F_IBSSON;
1349 	switch (ic->ic_opmode) {
1350 	case IEEE80211_M_STA:
1351 		break;
1352 	case IEEE80211_M_AHDEMO: /* XXX */
1353 	case IEEE80211_M_IBSS:
1354 		ic->ic_flags |= IEEE80211_F_IBSSON;
1355 		/*FALLTHROUGH*/
1356 	case IEEE80211_M_HOSTAP: /* XXX */
1357 		break;
1358 	case IEEE80211_M_MONITOR: /* XXX */
1359 		break;
1360 	}
1361 
1362 	switch (ic->ic_opmode) {
1363 	case IEEE80211_M_AHDEMO:
1364 	case IEEE80211_M_HOSTAP:
1365 #ifndef IEEE80211_NO_HOSTAP
1366 		ic->ic_bss->ni_intval = ic->ic_lintval;
1367 		ic->ic_bss->ni_rssi = 0;
1368 		ic->ic_bss->ni_rstamp = 0;
1369 #endif /* !IEEE80211_NO_HOSTAP */
1370 		break;
1371 	default:					/* XXX */
1372 		break;
1373 	}
1374 
1375 	sc->sc_wepctl = 0;
1376 
1377 	atw_write_ssid(sc);
1378 	atw_write_sup_rates(sc);
1379 	atw_write_wep(sc);
1380 
1381 	ic->ic_state = IEEE80211_S_INIT;
1382 
1383 	/*
1384 	 * Set the receive filter.  This will start the transmit and
1385 	 * receive processes.
1386 	 */
1387 	atw_filter_setup(sc);
1388 
1389 	/*
1390 	 * Start the receive process.
1391 	 */
1392 	ATW_WRITE(sc, ATW_RDR, 0x1);
1393 
1394 	/*
1395 	 * Note that the interface is now running.
1396 	 */
1397 	ifp->if_flags |= IFF_RUNNING;
1398 
1399 	/* send no beacons, yet. */
1400 	atw_start_beacon(sc, 0);
1401 
1402 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
1403 		error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1404 	else
1405 		error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1406  out:
1407 	if (error) {
1408 		ifp->if_flags &= ~IFF_RUNNING;
1409 		sc->sc_tx_timer = 0;
1410 		ifp->if_timer = 0;
1411 		printf("%s: interface not running\n", device_xname(sc->sc_dev));
1412 	}
1413 #ifdef ATW_DEBUG
1414 	atw_print_regs(sc, "end of init");
1415 #endif /* ATW_DEBUG */
1416 
1417 	return (error);
1418 }
1419 
1420 /* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
1421  *           0: MAC control of RF3000/Si4126.
1422  *
1423  * Applies power, or selects RF front-end? Sets reset condition.
1424  *
1425  * TBD support non-RFMD BBP, non-SiLabs synth.
1426  */
1427 static void
1428 atw_bbp_io_enable(struct atw_softc *sc, int enable)
1429 {
1430 	if (enable) {
1431 		ATW_WRITE(sc, ATW_SYNRF,
1432 		    ATW_SYNRF_SELRF|ATW_SYNRF_PE1|ATW_SYNRF_PHYRST);
1433 		DELAY(atw_bbp_io_enable_delay);
1434 	} else {
1435 		ATW_WRITE(sc, ATW_SYNRF, 0);
1436 		DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
1437 	}
1438 }
1439 
1440 static int
1441 atw_tune(struct atw_softc *sc)
1442 {
1443 	int rc;
1444 	u_int chan;
1445 	struct ieee80211com *ic = &sc->sc_ic;
1446 
1447 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1448 	if (chan == IEEE80211_CHAN_ANY)
1449 		panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
1450 
1451 	if (chan == sc->sc_cur_chan)
1452 		return 0;
1453 
1454 	DPRINTF(sc, ("%s: chan %d -> %d\n", device_xname(sc->sc_dev),
1455 	    sc->sc_cur_chan, chan));
1456 
1457 	atw_idle(sc, ATW_NAR_SR|ATW_NAR_ST);
1458 
1459 	atw_si4126_tune(sc, chan);
1460 	if ((rc = atw_rf3000_tune(sc, chan)) != 0)
1461 		printf("%s: failed to tune channel %d\n", device_xname(sc->sc_dev),
1462 		    chan);
1463 
1464 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
1465 	DELAY(atw_nar_delay);
1466 	ATW_WRITE(sc, ATW_RDR, 0x1);
1467 
1468 	if (rc == 0) {
1469 		sc->sc_cur_chan = chan;
1470 		sc->sc_rxtap.ar_chan_freq = sc->sc_txtap.at_chan_freq =
1471 		    htole16(ic->ic_curchan->ic_freq);
1472 		sc->sc_rxtap.ar_chan_flags = sc->sc_txtap.at_chan_flags =
1473 		    htole16(ic->ic_curchan->ic_flags);
1474 	}
1475 
1476 	return rc;
1477 }
1478 
1479 #ifdef ATW_SYNDEBUG
1480 static void
1481 atw_si4126_print(struct atw_softc *sc)
1482 {
1483 	struct ifnet *ifp = &sc->sc_if;
1484 	u_int addr, val;
1485 
1486 	val = 0;
1487 
1488 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1489 		return;
1490 
1491 	for (addr = 0; addr <= 8; addr++) {
1492 		printf("%s: synth[%d] = ", device_xname(sc->sc_dev), addr);
1493 		if (atw_si4126_read(sc, addr, &val) == 0) {
1494 			printf("<unknown> (quitting print-out)\n");
1495 			break;
1496 		}
1497 		printf("%05x\n", val);
1498 	}
1499 }
1500 #endif /* ATW_SYNDEBUG */
1501 
1502 /* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
1503  *
1504  * The RF/IF synthesizer produces two reference frequencies for
1505  * the RF2948B transceiver.  The first frequency the RF2948B requires
1506  * is two times the so-called "intermediate frequency" (IF). Since
1507  * a SAW filter on the radio fixes the IF at 374 MHz, I program the
1508  * Si4126 to generate IF LO = 374 MHz x 2 = 748 MHz.  The second
1509  * frequency required by the transceiver is the radio frequency
1510  * (RF). This is a superheterodyne transceiver; for f(chan) the
1511  * center frequency of the channel we are tuning, RF = f(chan) -
1512  * IF.
1513  *
1514  * XXX I am told by SiLabs that the Si4126 will accept a broader range
1515  * of XIN than the 2-25 MHz mentioned by the datasheet, even *without*
1516  * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
1517  * works, but I have still programmed for XINDIV2 = 1 to be safe.
1518  */
1519 static void
1520 atw_si4126_tune(struct atw_softc *sc, u_int chan)
1521 {
1522 	u_int mhz;
1523 	u_int R;
1524 	u_int32_t gpio;
1525 	u_int16_t gain;
1526 
1527 #ifdef ATW_SYNDEBUG
1528 	atw_si4126_print(sc);
1529 #endif /* ATW_SYNDEBUG */
1530 
1531 	if (chan == 14)
1532 		mhz = 2484;
1533 	else
1534 		mhz = 2412 + 5 * (chan - 1);
1535 
1536 	/* Tune IF to 748 MHz to suit the IF LO input of the
1537 	 * RF2494B, which is 2 x IF. No need to set an IF divider
1538          * because an IF in 526 MHz - 952 MHz is allowed.
1539 	 *
1540 	 * XIN is 44.000 MHz, so divide it by two to get allowable
1541 	 * range of 2-25 MHz. SiLabs tells me that this is not
1542 	 * strictly necessary.
1543 	 */
1544 
1545 	if (atw_xindiv2)
1546 		R = 44;
1547 	else
1548 		R = 88;
1549 
1550 	/* Power-up RF, IF synthesizers. */
1551 	atw_si4126_write(sc, SI4126_POWER,
1552 	    SI4126_POWER_PDIB|SI4126_POWER_PDRB);
1553 
1554 	/* set LPWR, too? */
1555 	atw_si4126_write(sc, SI4126_MAIN,
1556 	    (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
1557 
1558 	/* Set the phase-locked loop gain.  If RF2 N > 2047, then
1559 	 * set KP2 to 1.
1560 	 *
1561 	 * REFDIF This is different from the reference driver, which
1562 	 * always sets SI4126_GAIN to 0.
1563 	 */
1564 	gain = __SHIFTIN(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
1565 
1566 	atw_si4126_write(sc, SI4126_GAIN, gain);
1567 
1568 	/* XIN = 44 MHz.
1569 	 *
1570 	 * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
1571 	 * R = 44 so that 1496/(2 * 44) * 44 MHz = 748 MHz.
1572 	 *
1573 	 * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
1574 	 * so that 1496/88 * 44 MHz = 748 MHz.
1575 	 */
1576 	atw_si4126_write(sc, SI4126_IFN, 1496);
1577 
1578 	atw_si4126_write(sc, SI4126_IFR, R);
1579 
1580 #ifndef ATW_REFSLAVE
1581 	/* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
1582 	 * then RF1 becomes the active RF synthesizer, even on the Si4126,
1583 	 * which has no RF1!
1584 	 */
1585 	atw_si4126_write(sc, SI4126_RF1R, R);
1586 
1587 	atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
1588 #endif
1589 
1590 	/* N/R * XIN = RF. XIN = 44 MHz. We desire RF = mhz - IF,
1591 	 * where IF = 374 MHz.  Let's divide XIN to 1 MHz. So R = 44.
1592 	 * Now let's multiply it to mhz. So mhz - IF = N.
1593 	 */
1594 	atw_si4126_write(sc, SI4126_RF2R, R);
1595 
1596 	atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
1597 
1598 	/* wait 100us from power-up for RF, IF to settle */
1599 	DELAY(100);
1600 
1601 	gpio = ATW_READ(sc, ATW_GPIO);
1602 	gpio &= ~(ATW_GPIO_EN_MASK|ATW_GPIO_O_MASK|ATW_GPIO_I_MASK);
1603 	gpio |= __SHIFTIN(1, ATW_GPIO_EN_MASK);
1604 
1605 	if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
1606 		/* Set a Prism RF front-end to a special mode for channel 14?
1607 		 *
1608 		 * Apparently the SMC2635W needs this, although I don't think
1609 		 * it has a Prism RF.
1610 		 */
1611 		gpio |= __SHIFTIN(1, ATW_GPIO_O_MASK);
1612 	}
1613 	ATW_WRITE(sc, ATW_GPIO, gpio);
1614 
1615 #ifdef ATW_SYNDEBUG
1616 	atw_si4126_print(sc);
1617 #endif /* ATW_SYNDEBUG */
1618 }
1619 
1620 /* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
1621  * diversity.
1622  *
1623  * !!!
1624  * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
1625  * !!!
1626  */
1627 static int
1628 atw_rf3000_init(struct atw_softc *sc)
1629 {
1630 	int rc = 0;
1631 
1632 	atw_bbp_io_enable(sc, 1);
1633 
1634 	/* CCA is acquisition sensitive */
1635 	rc = atw_rf3000_write(sc, RF3000_CCACTL,
1636 	    __SHIFTIN(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
1637 
1638 	if (rc != 0)
1639 		goto out;
1640 
1641 	/* enable diversity */
1642 	rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
1643 
1644 	if (rc != 0)
1645 		goto out;
1646 
1647 	/* sensible setting from a binary-only driver */
1648 	rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1649 	    __SHIFTIN(0x1d, RF3000_GAINCTL_TXVGC_MASK));
1650 
1651 	if (rc != 0)
1652 		goto out;
1653 
1654 	/* magic from a binary-only driver */
1655 	rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
1656 	    __SHIFTIN(0x38, RF3000_LOGAINCAL_CAL_MASK));
1657 
1658 	if (rc != 0)
1659 		goto out;
1660 
1661 	rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
1662 
1663 	if (rc != 0)
1664 		goto out;
1665 
1666 	/* XXX Reference driver remarks that Abocom sets this to 50.
1667 	 * Meaning 0x50, I think....  50 = 0x32, which would set a bit
1668 	 * in the "reserved" area of register RF3000_OPTIONS1.
1669 	 */
1670 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
1671 
1672 	if (rc != 0)
1673 		goto out;
1674 
1675 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
1676 
1677 	if (rc != 0)
1678 		goto out;
1679 
1680 out:
1681 	atw_bbp_io_enable(sc, 0);
1682 	return rc;
1683 }
1684 
1685 #ifdef ATW_BBPDEBUG
1686 static void
1687 atw_rf3000_print(struct atw_softc *sc)
1688 {
1689 	struct ifnet *ifp = &sc->sc_if;
1690 	u_int addr, val;
1691 
1692 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1693 		return;
1694 
1695 	for (addr = 0x01; addr <= 0x15; addr++) {
1696 		printf("%s: bbp[%d] = \n", device_xname(sc->sc_dev), addr);
1697 		if (atw_rf3000_read(sc, addr, &val) != 0) {
1698 			printf("<unknown> (quitting print-out)\n");
1699 			break;
1700 		}
1701 		printf("%08x\n", val);
1702 	}
1703 }
1704 #endif /* ATW_BBPDEBUG */
1705 
1706 /* Set the power settings on the BBP for channel `chan'. */
1707 static int
1708 atw_rf3000_tune(struct atw_softc *sc, u_int chan)
1709 {
1710 	int rc = 0;
1711 	u_int32_t reg;
1712 	u_int16_t txpower, lpf_cutoff, lna_gs_thresh;
1713 
1714 	txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
1715 	lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
1716 	lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
1717 
1718 	/* odd channels: LSB, even channels: MSB */
1719 	if (chan % 2 == 1) {
1720 		txpower &= 0xFF;
1721 		lpf_cutoff &= 0xFF;
1722 		lna_gs_thresh &= 0xFF;
1723 	} else {
1724 		txpower >>= 8;
1725 		lpf_cutoff >>= 8;
1726 		lna_gs_thresh >>= 8;
1727 	}
1728 
1729 #ifdef ATW_BBPDEBUG
1730 	atw_rf3000_print(sc);
1731 #endif /* ATW_BBPDEBUG */
1732 
1733 	DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
1734 	    "lna_gs_thresh %02x\n",
1735 	    device_xname(sc->sc_dev), chan, txpower, lpf_cutoff, lna_gs_thresh));
1736 
1737 	atw_bbp_io_enable(sc, 1);
1738 
1739 	if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1740 	    __SHIFTIN(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
1741 		goto out;
1742 
1743 	if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
1744 		goto out;
1745 
1746 	if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
1747 		goto out;
1748 
1749 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0);
1750 
1751 	if (rc != 0)
1752 		goto out;
1753 
1754 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
1755 
1756 	if (rc != 0)
1757 		goto out;
1758 
1759 #ifdef ATW_BBPDEBUG
1760 	atw_rf3000_print(sc);
1761 #endif /* ATW_BBPDEBUG */
1762 
1763 out:
1764 	atw_bbp_io_enable(sc, 0);
1765 
1766 	/* set beacon, rts, atim transmit power */
1767 	reg = ATW_READ(sc, ATW_PLCPHD);
1768 	reg &= ~ATW_PLCPHD_SERVICE_MASK;
1769 	reg |= __SHIFTIN(__SHIFTIN(txpower, RF3000_GAINCTL_TXVGC_MASK),
1770 	    ATW_PLCPHD_SERVICE_MASK);
1771 	ATW_WRITE(sc, ATW_PLCPHD, reg);
1772 	DELAY(atw_plcphd_delay);
1773 
1774 	return rc;
1775 }
1776 
1777 /* Write a register on the RF3000 baseband processor using the
1778  * registers provided by the ADM8211 for this purpose.
1779  *
1780  * Return 0 on success.
1781  */
1782 static int
1783 atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
1784 {
1785 	u_int32_t reg;
1786 	int i;
1787 
1788 	reg = sc->sc_bbpctl_wr |
1789 	     __SHIFTIN(val & 0xff, ATW_BBPCTL_DATA_MASK) |
1790 	     __SHIFTIN(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1791 
1792 	for (i = 20000 / atw_pseudo_milli; --i >= 0; ) {
1793 		ATW_WRITE(sc, ATW_BBPCTL, reg);
1794 		DELAY(2 * atw_pseudo_milli);
1795 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
1796 			break;
1797 	}
1798 
1799 	if (i < 0) {
1800 		printf("%s: BBPCTL still busy\n", device_xname(sc->sc_dev));
1801 		return ETIMEDOUT;
1802 	}
1803 	return 0;
1804 }
1805 
1806 /* Read a register on the RF3000 baseband processor using the registers
1807  * the ADM8211 provides for this purpose.
1808  *
1809  * The 7-bit register address is addr.  Record the 8-bit data in the register
1810  * in *val.
1811  *
1812  * Return 0 on success.
1813  *
1814  * XXX This does not seem to work. The ADM8211 must require more or
1815  * different magic to read the chip than to write it. Possibly some
1816  * of the magic I have derived from a binary-only driver concerns
1817  * the "chip address" (see the RF3000 manual).
1818  */
1819 #ifdef ATW_BBPDEBUG
1820 static int
1821 atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
1822 {
1823 	u_int32_t reg;
1824 	int i;
1825 
1826 	for (i = 1000; --i >= 0; ) {
1827 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD|ATW_BBPCTL_WR) == 0)
1828 			break;
1829 		DELAY(100);
1830 	}
1831 
1832 	if (i < 0) {
1833 		printf("%s: start atw_rf3000_read, BBPCTL busy\n",
1834 		    device_xname(sc->sc_dev));
1835 		return ETIMEDOUT;
1836 	}
1837 
1838 	reg = sc->sc_bbpctl_rd | __SHIFTIN(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1839 
1840 	ATW_WRITE(sc, ATW_BBPCTL, reg);
1841 
1842 	for (i = 1000; --i >= 0; ) {
1843 		DELAY(100);
1844 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
1845 			break;
1846 	}
1847 
1848 	ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
1849 
1850 	if (i < 0) {
1851 		printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
1852 		    device_xname(sc->sc_dev), reg);
1853 		return ETIMEDOUT;
1854 	}
1855 	if (val != NULL)
1856 		*val = __SHIFTOUT(reg, ATW_BBPCTL_DATA_MASK);
1857 	return 0;
1858 }
1859 #endif /* ATW_BBPDEBUG */
1860 
1861 /* Write a register on the Si4126 RF/IF synthesizer using the registers
1862  * provided by the ADM8211 for that purpose.
1863  *
1864  * val is 18 bits of data, and val is the 4-bit address of the register.
1865  *
1866  * Return 0 on success.
1867  */
1868 static void
1869 atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
1870 {
1871 	uint32_t bits, mask, reg;
1872 	const int nbits = 22;
1873 
1874 	KASSERT((addr & ~__SHIFTOUT_MASK(SI4126_TWI_ADDR_MASK)) == 0);
1875 	KASSERT((val & ~__SHIFTOUT_MASK(SI4126_TWI_DATA_MASK)) == 0);
1876 
1877 	bits = __SHIFTIN(val, SI4126_TWI_DATA_MASK) |
1878 	       __SHIFTIN(addr, SI4126_TWI_ADDR_MASK);
1879 
1880 	reg = ATW_SYNRF_SELSYN;
1881 	/* reference driver: reset Si4126 serial bus to initial
1882 	 * conditions?
1883 	 */
1884 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1885 	ATW_WRITE(sc, ATW_SYNRF, reg);
1886 
1887 	for (mask = __BIT(nbits - 1); mask != 0; mask >>= 1) {
1888 		if ((bits & mask) != 0)
1889 			reg |= ATW_SYNRF_SYNDATA;
1890 		else
1891 			reg &= ~ATW_SYNRF_SYNDATA;
1892 		ATW_WRITE(sc, ATW_SYNRF, reg);
1893 		ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
1894 		ATW_WRITE(sc, ATW_SYNRF, reg);
1895 	}
1896 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1897 	ATW_WRITE(sc, ATW_SYNRF, 0x0);
1898 }
1899 
1900 /* Read 18-bit data from the 4-bit address addr in Si4126
1901  * RF synthesizer and write the data to *val. Return 0 on success.
1902  *
1903  * XXX This does not seem to work. The ADM8211 must require more or
1904  * different magic to read the chip than to write it.
1905  */
1906 #ifdef ATW_SYNDEBUG
1907 static int
1908 atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
1909 {
1910 	u_int32_t reg;
1911 	int i;
1912 
1913 	KASSERT((addr & ~__SHIFTOUT_MASK(SI4126_TWI_ADDR_MASK)) == 0);
1914 
1915 	for (i = 1000; --i >= 0; ) {
1916 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD|ATW_SYNCTL_WR) == 0)
1917 			break;
1918 		DELAY(100);
1919 	}
1920 
1921 	if (i < 0) {
1922 		printf("%s: start atw_si4126_read, SYNCTL busy\n",
1923 		    device_xname(sc->sc_dev));
1924 		return ETIMEDOUT;
1925 	}
1926 
1927 	reg = sc->sc_synctl_rd | __SHIFTIN(addr, ATW_SYNCTL_DATA_MASK);
1928 
1929 	ATW_WRITE(sc, ATW_SYNCTL, reg);
1930 
1931 	for (i = 1000; --i >= 0; ) {
1932 		DELAY(100);
1933 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
1934 			break;
1935 	}
1936 
1937 	ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
1938 
1939 	if (i < 0) {
1940 		printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
1941 		    device_xname(sc->sc_dev), reg);
1942 		return ETIMEDOUT;
1943 	}
1944 	if (val != NULL)
1945 		*val = __SHIFTOUT(ATW_READ(sc, ATW_SYNCTL),
1946 		                       ATW_SYNCTL_DATA_MASK);
1947 	return 0;
1948 }
1949 #endif /* ATW_SYNDEBUG */
1950 
1951 /* XXX is the endianness correct? test. */
1952 #define	atw_calchash(addr) \
1953 	(ether_crc32_le((addr), IEEE80211_ADDR_LEN) & __BITS(5, 0))
1954 
1955 /*
1956  * atw_filter_setup:
1957  *
1958  *	Set the ADM8211's receive filter.
1959  */
1960 static void
1961 atw_filter_setup(struct atw_softc *sc)
1962 {
1963 	struct ieee80211com *ic = &sc->sc_ic;
1964 	struct ethercom *ec = &sc->sc_ec;
1965 	struct ifnet *ifp = &sc->sc_if;
1966 	int hash;
1967 	u_int32_t hashes[2];
1968 	struct ether_multi *enm;
1969 	struct ether_multistep step;
1970 
1971 	/* According to comments in tlp_al981_filter_setup
1972 	 * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
1973 	 * multicast filter to be set while it is running.  Hopefully
1974 	 * the ADM8211 is not the same!
1975 	 */
1976 	if ((ifp->if_flags & IFF_RUNNING) != 0)
1977 		atw_idle(sc, ATW_NAR_SR);
1978 
1979 	sc->sc_opmode &= ~(ATW_NAR_PB|ATW_NAR_PR|ATW_NAR_MM);
1980 	ifp->if_flags &= ~IFF_ALLMULTI;
1981 
1982 	/* XXX in scan mode, do not filter packets.  Maybe this is
1983 	 * unnecessary.
1984 	 */
1985 	if (ic->ic_state == IEEE80211_S_SCAN ||
1986 	    (ifp->if_flags & IFF_PROMISC) != 0) {
1987 		sc->sc_opmode |= ATW_NAR_PR | ATW_NAR_PB;
1988 		goto allmulti;
1989 	}
1990 
1991 	hashes[0] = hashes[1] = 0x0;
1992 
1993 	/*
1994 	 * Program the 64-bit multicast hash filter.
1995 	 */
1996 	ETHER_FIRST_MULTI(step, ec, enm);
1997 	while (enm != NULL) {
1998 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1999 		    ETHER_ADDR_LEN) != 0)
2000 			goto allmulti;
2001 
2002 		hash = atw_calchash(enm->enm_addrlo);
2003 		hashes[hash >> 5] |= 1 << (hash & 0x1f);
2004 		ETHER_NEXT_MULTI(step, enm);
2005 		sc->sc_opmode |= ATW_NAR_MM;
2006 	}
2007 	ifp->if_flags &= ~IFF_ALLMULTI;
2008 	goto setit;
2009 
2010 allmulti:
2011 	sc->sc_opmode |= ATW_NAR_MM;
2012 	ifp->if_flags |= IFF_ALLMULTI;
2013 	hashes[0] = hashes[1] = 0xffffffff;
2014 
2015 setit:
2016 	ATW_WRITE(sc, ATW_MAR0, hashes[0]);
2017 	ATW_WRITE(sc, ATW_MAR1, hashes[1]);
2018 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2019 	DELAY(atw_nar_delay);
2020 	ATW_WRITE(sc, ATW_RDR, 0x1);
2021 
2022 	DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", device_xname(sc->sc_dev),
2023 	    ATW_READ(sc, ATW_NAR), sc->sc_opmode));
2024 }
2025 
2026 /* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
2027  * a beacon's BSSID and SSID against the preferred BSSID and SSID
2028  * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
2029  * no beacon with the preferred BSSID and SSID in the number of
2030  * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
2031  */
2032 static void
2033 atw_write_bssid(struct atw_softc *sc)
2034 {
2035 	struct ieee80211com *ic = &sc->sc_ic;
2036 	u_int8_t *bssid;
2037 
2038 	bssid = ic->ic_bss->ni_bssid;
2039 
2040 	ATW_WRITE(sc, ATW_BSSID0,
2041 	    __SHIFTIN(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
2042 	    __SHIFTIN(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
2043 	    __SHIFTIN(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
2044 	    __SHIFTIN(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
2045 
2046 	ATW_WRITE(sc, ATW_ABDA1,
2047 	    (ATW_READ(sc, ATW_ABDA1) &
2048 	    ~(ATW_ABDA1_BSSIDB4_MASK|ATW_ABDA1_BSSIDB5_MASK)) |
2049 	    __SHIFTIN(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
2050 	    __SHIFTIN(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
2051 
2052 	DPRINTF(sc, ("%s: BSSID %s -> ", device_xname(sc->sc_dev),
2053 	    ether_sprintf(sc->sc_bssid)));
2054 	DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
2055 
2056 	memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
2057 }
2058 
2059 /* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
2060  * 16-bit word.
2061  */
2062 static void
2063 atw_write_sram(struct atw_softc *sc, u_int ofs, u_int8_t *buf, u_int buflen)
2064 {
2065 	u_int i;
2066 	u_int8_t *ptr;
2067 
2068 	memcpy(&sc->sc_sram[ofs], buf, buflen);
2069 
2070 	KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
2071 
2072 	KASSERT(buflen + ofs <= sc->sc_sramlen);
2073 
2074 	ptr = &sc->sc_sram[ofs];
2075 
2076 	for (i = 0; i < buflen; i += 2) {
2077 		ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
2078 		    __SHIFTIN((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
2079 		DELAY(atw_writewep_delay);
2080 
2081 		ATW_WRITE(sc, ATW_WESK,
2082 		    __SHIFTIN((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
2083 		DELAY(atw_writewep_delay);
2084 	}
2085 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
2086 
2087 	if (sc->sc_if.if_flags & IFF_DEBUG) {
2088 		int n_octets = 0;
2089 		printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
2090 		    device_xname(sc->sc_dev), buflen, ofs, sc->sc_wepctl);
2091 		for (i = 0; i < buflen; i++) {
2092 			printf(" %02x", ptr[i]);
2093 			if (++n_octets % 24 == 0)
2094 				printf("\n");
2095 		}
2096 		if (n_octets % 24 != 0)
2097 			printf("\n");
2098 	}
2099 }
2100 
2101 static int
2102 atw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
2103 {
2104 	struct atw_softc *sc = ic->ic_ifp->if_softc;
2105 	u_int keyix = k->wk_keyix;
2106 
2107 	DPRINTF(sc, ("%s: delete key %u\n", __func__, keyix));
2108 
2109 	if (keyix >= IEEE80211_WEP_NKID)
2110 		return 0;
2111 	if (k->wk_keylen != 0)
2112 		sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
2113 
2114 	return 1;
2115 }
2116 
2117 static int
2118 atw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
2119 	const u_int8_t mac[IEEE80211_ADDR_LEN])
2120 {
2121 	struct atw_softc *sc = ic->ic_ifp->if_softc;
2122 
2123 	DPRINTF(sc, ("%s: set key %u\n", __func__, k->wk_keyix));
2124 
2125 	if (k->wk_keyix >= IEEE80211_WEP_NKID)
2126 		return 0;
2127 
2128 	sc->sc_flags &= ~ATWF_WEP_SRAM_VALID;
2129 
2130 	return 1;
2131 }
2132 
2133 static void
2134 atw_key_update_begin(struct ieee80211com *ic)
2135 {
2136 #ifdef ATW_DEBUG
2137 	struct ifnet *ifp = ic->ic_ifp;
2138 	struct atw_softc *sc = ifp->if_softc;
2139 #endif
2140 
2141 	DPRINTF(sc, ("%s:\n", __func__));
2142 }
2143 
2144 static void
2145 atw_key_update_end(struct ieee80211com *ic)
2146 {
2147 	struct ifnet *ifp = ic->ic_ifp;
2148 	struct atw_softc *sc = ifp->if_softc;
2149 
2150 	DPRINTF(sc, ("%s:\n", __func__));
2151 
2152 	if ((sc->sc_flags & ATWF_WEP_SRAM_VALID) != 0)
2153 		return;
2154 	if (!device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
2155 		return;
2156 	atw_idle(sc, ATW_NAR_SR | ATW_NAR_ST);
2157 	atw_write_wep(sc);
2158 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2159 	DELAY(atw_nar_delay);
2160 	ATW_WRITE(sc, ATW_RDR, 0x1);
2161 }
2162 
2163 /* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
2164 static void
2165 atw_write_wep(struct atw_softc *sc)
2166 {
2167 #if 0
2168 	struct ieee80211com *ic = &sc->sc_ic;
2169 	u_int32_t reg;
2170 	int i;
2171 #endif
2172 	/* SRAM shared-key record format: key0 flags key1 ... key12 */
2173 	u_int8_t buf[IEEE80211_WEP_NKID]
2174 	            [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
2175 
2176 	sc->sc_wepctl = 0;
2177 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
2178 
2179 	memset(&buf[0][0], 0, sizeof(buf));
2180 
2181 #if 0
2182 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2183 		if (ic->ic_nw_keys[i].wk_keylen > 5) {
2184 			buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
2185 		} else if (ic->ic_nw_keys[i].wk_keylen != 0) {
2186 			buf[i][1] = ATW_WEP_ENABLED;
2187 		} else {
2188 			buf[i][1] = 0;
2189 			continue;
2190 		}
2191 		buf[i][0] = ic->ic_nw_keys[i].wk_key[0];
2192 		memcpy(&buf[i][2], &ic->ic_nw_keys[i].wk_key[1],
2193 		    ic->ic_nw_keys[i].wk_keylen - 1);
2194 	}
2195 
2196 	reg = ATW_READ(sc, ATW_MACTEST);
2197 	reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
2198 	reg &= ~ATW_MACTEST_KEYID_MASK;
2199 	reg |= __SHIFTIN(ic->ic_def_txkey, ATW_MACTEST_KEYID_MASK);
2200 	ATW_WRITE(sc, ATW_MACTEST, reg);
2201 
2202 	if ((ic->ic_flags & IEEE80211_F_PRIVACY) != 0)
2203 		sc->sc_wepctl |= ATW_WEPCTL_WEPENABLE;
2204 
2205 	switch (sc->sc_rev) {
2206 	case ATW_REVISION_AB:
2207 	case ATW_REVISION_AF:
2208 		/* Bypass WEP on Rx. */
2209 		sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
2210 		break;
2211 	default:
2212 		break;
2213 	}
2214 #endif
2215 
2216 	atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (u_int8_t*)&buf[0][0],
2217 	    sizeof(buf));
2218 
2219 	sc->sc_flags |= ATWF_WEP_SRAM_VALID;
2220 }
2221 
2222 static void
2223 atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
2224     struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
2225 {
2226 	struct atw_softc *sc = (struct atw_softc *)ic->ic_ifp->if_softc;
2227 
2228 	/* The ADM8211A answers probe requests. TBD ADM8211B/C. */
2229 	if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_REQ)
2230 		return;
2231 
2232 	(*sc->sc_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
2233 
2234 	switch (subtype) {
2235 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2236 	case IEEE80211_FC0_SUBTYPE_BEACON:
2237 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
2238 		    ic->ic_state == IEEE80211_S_RUN) {
2239 			if (le64toh(ni->ni_tstamp.tsf) >= atw_get_tsft(sc))
2240 				(void)ieee80211_ibss_merge(ni);
2241 		}
2242 		break;
2243 	default:
2244 		break;
2245 	}
2246 	return;
2247 }
2248 
2249 /* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
2250  * In ad hoc mode, the SSID is written to the beacons sent by the
2251  * ADM8211. In both ad hoc and infrastructure mode, beacons received
2252  * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
2253  * indications.
2254  */
2255 static void
2256 atw_write_ssid(struct atw_softc *sc)
2257 {
2258 	struct ieee80211com *ic = &sc->sc_ic;
2259 	/* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
2260 	 * it only expects the element length, not its ID.
2261 	 */
2262 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
2263 
2264 	memset(buf, 0, sizeof(buf));
2265 	buf[0] = ic->ic_bss->ni_esslen;
2266 	memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
2267 
2268 	atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
2269 	    roundup(1 + ic->ic_bss->ni_esslen, 2));
2270 }
2271 
2272 /* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
2273  * In ad hoc mode, the supported rates are written to beacons sent by the
2274  * ADM8211.
2275  */
2276 static void
2277 atw_write_sup_rates(struct atw_softc *sc)
2278 {
2279 	struct ieee80211com *ic = &sc->sc_ic;
2280 	/* 14 bytes are probably (XXX) reserved in the ADM8211 SRAM for
2281 	 * supported rates
2282 	 */
2283 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_RATE_SIZE, 2)];
2284 
2285 	memset(buf, 0, sizeof(buf));
2286 
2287 	buf[0] = ic->ic_bss->ni_rates.rs_nrates;
2288 
2289 	memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates,
2290 	    ic->ic_bss->ni_rates.rs_nrates);
2291 
2292 	atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
2293 }
2294 
2295 /* Start/stop sending beacons. */
2296 void
2297 atw_start_beacon(struct atw_softc *sc, int start)
2298 {
2299 	struct ieee80211com *ic = &sc->sc_ic;
2300 	uint16_t chan;
2301 	uint32_t bcnt, bpli, cap0, cap1, capinfo;
2302 	size_t len;
2303 
2304 	if (!device_is_active(sc->sc_dev))
2305 		return;
2306 
2307 	/* start beacons */
2308 	len = sizeof(struct ieee80211_frame) +
2309 	    8 /* timestamp */ + 2 /* beacon interval */ +
2310 	    2 /* capability info */ +
2311 	    2 + ic->ic_bss->ni_esslen /* SSID element */ +
2312 	    2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
2313 	    3 /* DS parameters */ +
2314 	    IEEE80211_CRC_LEN;
2315 
2316 	bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
2317 	cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
2318 	cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
2319 
2320 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2321 	ATW_WRITE(sc, ATW_CAP1, cap1);
2322 
2323 	if (!start)
2324 		return;
2325 
2326 	/* TBD use ni_capinfo */
2327 
2328 	capinfo = 0;
2329 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
2330 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2331 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
2332 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2333 
2334 	switch (ic->ic_opmode) {
2335 	case IEEE80211_M_IBSS:
2336 		len += 4; /* IBSS parameters */
2337 		capinfo |= IEEE80211_CAPINFO_IBSS;
2338 		break;
2339 	case IEEE80211_M_HOSTAP:
2340 		/* XXX 6-byte minimum TIM */
2341 		len += atw_beacon_len_adjust;
2342 		capinfo |= IEEE80211_CAPINFO_ESS;
2343 		break;
2344 	default:
2345 		return;
2346 	}
2347 
2348 	/* set listen interval
2349 	 * XXX do software units agree w/ hardware?
2350 	 */
2351 	bpli = __SHIFTIN(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2352 	    __SHIFTIN(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
2353 
2354 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2355 
2356 	bcnt |= __SHIFTIN(len, ATW_BCNT_BCNT_MASK);
2357 	cap0 |= __SHIFTIN(chan, ATW_CAP0_CHN_MASK);
2358 	cap1 |= __SHIFTIN(capinfo, ATW_CAP1_CAPI_MASK);
2359 
2360 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2361 	ATW_WRITE(sc, ATW_BPLI, bpli);
2362 	ATW_WRITE(sc, ATW_CAP0, cap0);
2363 	ATW_WRITE(sc, ATW_CAP1, cap1);
2364 
2365 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
2366 	    device_xname(sc->sc_dev), bcnt));
2367 
2368 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
2369 	    device_xname(sc->sc_dev), cap1));
2370 }
2371 
2372 /* Return the 32 lsb of the last TSFT divisible by ival. */
2373 static inline uint32_t
2374 atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
2375 {
2376 	/* Following the reference driver's lead, I compute
2377 	 *
2378 	 *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
2379 	 *
2380 	 * without using 64-bit arithmetic, using the following
2381 	 * relationship:
2382 	 *
2383 	 *     (0x100000000 * H + L) % m
2384 	 *   = ((0x100000000 % m) * H + L) % m
2385 	 *   = (((0xffffffff + 1) % m) * H + L) % m
2386 	 *   = ((0xffffffff % m + 1 % m) * H + L) % m
2387 	 *   = ((0xffffffff % m + 1) * H + L) % m
2388 	 */
2389 	return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
2390 }
2391 
2392 static uint64_t
2393 atw_get_tsft(struct atw_softc *sc)
2394 {
2395 	int i;
2396 	uint32_t tsfth, tsftl;
2397 	for (i = 0; i < 2; i++) {
2398 		tsfth = ATW_READ(sc, ATW_TSFTH);
2399 		tsftl = ATW_READ(sc, ATW_TSFTL);
2400 		if (ATW_READ(sc, ATW_TSFTH) == tsfth)
2401 			break;
2402 	}
2403 	return ((uint64_t)tsfth << 32) | tsftl;
2404 }
2405 
2406 /* If we've created an IBSS, write the TSF time in the ADM8211 to
2407  * the ieee80211com.
2408  *
2409  * Predict the next target beacon transmission time (TBTT) and
2410  * write it to the ADM8211.
2411  */
2412 static void
2413 atw_predict_beacon(struct atw_softc *sc)
2414 {
2415 #define TBTTOFS 20 /* TU */
2416 
2417 	struct ieee80211com *ic = &sc->sc_ic;
2418 	uint64_t tsft;
2419 	uint32_t ival, past_even, tbtt, tsfth, tsftl;
2420 	union {
2421 		uint64_t	word;
2422 		uint8_t		tstamp[8];
2423 	} u;
2424 
2425 	if ((ic->ic_opmode == IEEE80211_M_HOSTAP) ||
2426 	    ((ic->ic_opmode == IEEE80211_M_IBSS) &&
2427 	     (ic->ic_flags & IEEE80211_F_SIBSS))) {
2428 		tsft = atw_get_tsft(sc);
2429 		u.word = htole64(tsft);
2430 		(void)memcpy(&ic->ic_bss->ni_tstamp, &u.tstamp[0],
2431 		    sizeof(ic->ic_bss->ni_tstamp));
2432 	} else
2433 		tsft = le64toh(ic->ic_bss->ni_tstamp.tsf);
2434 
2435 	ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
2436 
2437 	tsftl = tsft & 0xFFFFFFFF;
2438 	tsfth = tsft >> 32;
2439 
2440 	/* We sent/received the last beacon `past' microseconds
2441 	 * after the interval divided the TSF timer.
2442 	 */
2443 	past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
2444 
2445 	/* Skip ten beacons so that the TBTT cannot pass before
2446 	 * we've programmed it.  Ten is an arbitrary number.
2447 	 */
2448 	tbtt = past_even + ival * 10;
2449 
2450 	ATW_WRITE(sc, ATW_TOFS1,
2451 	    __SHIFTIN(1, ATW_TOFS1_TSFTOFSR_MASK) |
2452 	    __SHIFTIN(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
2453 	    __SHIFTIN(__SHIFTOUT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
2454 	        ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
2455 #undef TBTTOFS
2456 }
2457 
2458 static void
2459 atw_next_scan(void *arg)
2460 {
2461 	struct atw_softc *sc = arg;
2462 	struct ieee80211com *ic = &sc->sc_ic;
2463 	int s;
2464 
2465 	/* don't call atw_start w/o network interrupts blocked */
2466 	s = splnet();
2467 	if (ic->ic_state == IEEE80211_S_SCAN)
2468 		ieee80211_next_scan(ic);
2469 	splx(s);
2470 }
2471 
2472 /* Synchronize the hardware state with the software state. */
2473 static int
2474 atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2475 {
2476 	struct ifnet *ifp = ic->ic_ifp;
2477 	struct atw_softc *sc = ifp->if_softc;
2478 	enum ieee80211_state ostate;
2479 	int error = 0;
2480 
2481 	ostate = ic->ic_state;
2482 	callout_stop(&sc->sc_scan_ch);
2483 
2484 	switch (nstate) {
2485 	case IEEE80211_S_AUTH:
2486 	case IEEE80211_S_ASSOC:
2487 		atw_write_bssid(sc);
2488 		error = atw_tune(sc);
2489 		break;
2490 	case IEEE80211_S_INIT:
2491 		callout_stop(&sc->sc_scan_ch);
2492 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
2493 		atw_start_beacon(sc, 0);
2494 		break;
2495 	case IEEE80211_S_SCAN:
2496 		error = atw_tune(sc);
2497 		callout_reset(&sc->sc_scan_ch, atw_dwelltime * hz / 1000,
2498 		    atw_next_scan, sc);
2499 		break;
2500 	case IEEE80211_S_RUN:
2501 		error = atw_tune(sc);
2502 		atw_write_bssid(sc);
2503 		atw_write_ssid(sc);
2504 		atw_write_sup_rates(sc);
2505 
2506 		if (ic->ic_opmode == IEEE80211_M_AHDEMO ||
2507 		    ic->ic_opmode == IEEE80211_M_MONITOR)
2508 			break;
2509 
2510 		/* set listen interval
2511 		 * XXX do software units agree w/ hardware?
2512 		 */
2513 		ATW_WRITE(sc, ATW_BPLI,
2514 		    __SHIFTIN(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2515 		    __SHIFTIN(ic->ic_lintval / ic->ic_bss->ni_intval,
2516 			   ATW_BPLI_LI_MASK));
2517 
2518 		DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n", device_xname(sc->sc_dev),
2519 		    ATW_READ(sc, ATW_BPLI)));
2520 
2521 		atw_predict_beacon(sc);
2522 
2523 		switch (ic->ic_opmode) {
2524 		case IEEE80211_M_AHDEMO:
2525 		case IEEE80211_M_HOSTAP:
2526 		case IEEE80211_M_IBSS:
2527 			atw_start_beacon(sc, 1);
2528 			break;
2529 		case IEEE80211_M_MONITOR:
2530 		case IEEE80211_M_STA:
2531 			break;
2532 		}
2533 
2534 		break;
2535 	}
2536 	return (error != 0) ? error : (*sc->sc_newstate)(ic, nstate, arg);
2537 }
2538 
2539 /*
2540  * atw_add_rxbuf:
2541  *
2542  *	Add a receive buffer to the indicated descriptor.
2543  */
2544 int
2545 atw_add_rxbuf(struct atw_softc *sc, int idx)
2546 {
2547 	struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
2548 	struct mbuf *m;
2549 	int error;
2550 
2551 	MGETHDR(m, M_DONTWAIT, MT_DATA);
2552 	if (m == NULL)
2553 		return (ENOBUFS);
2554 
2555 	MCLGET(m, M_DONTWAIT);
2556 	if ((m->m_flags & M_EXT) == 0) {
2557 		m_freem(m);
2558 		return (ENOBUFS);
2559 	}
2560 
2561 	if (rxs->rxs_mbuf != NULL)
2562 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2563 
2564 	rxs->rxs_mbuf = m;
2565 
2566 	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
2567 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
2568 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
2569 	if (error) {
2570 		aprint_error_dev(sc->sc_dev, "can't load rx DMA map %d, error = %d\n",
2571 		    idx, error);
2572 		panic("atw_add_rxbuf");	/* XXX */
2573 	}
2574 
2575 	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
2576 	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
2577 
2578 	atw_init_rxdesc(sc, idx);
2579 
2580 	return (0);
2581 }
2582 
2583 /*
2584  * Release any queued transmit buffers.
2585  */
2586 void
2587 atw_txdrain(struct atw_softc *sc)
2588 {
2589 	struct atw_txsoft *txs;
2590 
2591 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
2592 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
2593 		if (txs->txs_mbuf != NULL) {
2594 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2595 			m_freem(txs->txs_mbuf);
2596 			txs->txs_mbuf = NULL;
2597 		}
2598 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
2599 		sc->sc_txfree += txs->txs_ndescs;
2600 	}
2601 
2602 	KASSERT((sc->sc_if.if_flags & IFF_RUNNING) == 0 ||
2603 	        !(SIMPLEQ_EMPTY(&sc->sc_txfreeq) ||
2604 		  sc->sc_txfree != ATW_NTXDESC));
2605 	sc->sc_if.if_flags &= ~IFF_OACTIVE;
2606 	sc->sc_tx_timer = 0;
2607 }
2608 
2609 /*
2610  * atw_stop:		[ ifnet interface function ]
2611  *
2612  *	Stop transmission on the interface.
2613  */
2614 void
2615 atw_stop(struct ifnet *ifp, int disable)
2616 {
2617 	struct atw_softc *sc = ifp->if_softc;
2618 	struct ieee80211com *ic = &sc->sc_ic;
2619 
2620 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2621 
2622 	if (device_is_active(sc->sc_dev)) {
2623 		/* Disable interrupts. */
2624 		ATW_WRITE(sc, ATW_IER, 0);
2625 
2626 		/* Stop the transmit and receive processes. */
2627 		ATW_WRITE(sc, ATW_NAR, 0);
2628 		DELAY(atw_nar_delay);
2629 		ATW_WRITE(sc, ATW_TDBD, 0);
2630 		ATW_WRITE(sc, ATW_TDBP, 0);
2631 		ATW_WRITE(sc, ATW_RDB, 0);
2632 	}
2633 
2634 	sc->sc_opmode = 0;
2635 
2636 	atw_txdrain(sc);
2637 
2638 	/*
2639 	 * Mark the interface down and cancel the watchdog timer.
2640 	 */
2641 	ifp->if_flags &= ~IFF_RUNNING;
2642 	ifp->if_timer = 0;
2643 
2644 	if (disable)
2645 		pmf_device_suspend(sc->sc_dev, &sc->sc_qual);
2646 }
2647 
2648 /*
2649  * atw_rxdrain:
2650  *
2651  *	Drain the receive queue.
2652  */
2653 void
2654 atw_rxdrain(struct atw_softc *sc)
2655 {
2656 	struct atw_rxsoft *rxs;
2657 	int i;
2658 
2659 	for (i = 0; i < ATW_NRXDESC; i++) {
2660 		rxs = &sc->sc_rxsoft[i];
2661 		if (rxs->rxs_mbuf == NULL)
2662 			continue;
2663 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2664 		m_freem(rxs->rxs_mbuf);
2665 		rxs->rxs_mbuf = NULL;
2666 	}
2667 }
2668 
2669 /*
2670  * atw_detach:
2671  *
2672  *	Detach an ADM8211 interface.
2673  */
2674 int
2675 atw_detach(struct atw_softc *sc)
2676 {
2677 	struct ifnet *ifp = &sc->sc_if;
2678 	struct atw_rxsoft *rxs;
2679 	struct atw_txsoft *txs;
2680 	int i;
2681 
2682 	/*
2683 	 * Succeed now if there isn't any work to do.
2684 	 */
2685 	if ((sc->sc_flags & ATWF_ATTACHED) == 0)
2686 		return (0);
2687 
2688 	pmf_device_deregister(sc->sc_dev);
2689 
2690 	callout_stop(&sc->sc_scan_ch);
2691 
2692 	ieee80211_ifdetach(&sc->sc_ic);
2693 	if_detach(ifp);
2694 
2695 	for (i = 0; i < ATW_NRXDESC; i++) {
2696 		rxs = &sc->sc_rxsoft[i];
2697 		if (rxs->rxs_mbuf != NULL) {
2698 			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2699 			m_freem(rxs->rxs_mbuf);
2700 			rxs->rxs_mbuf = NULL;
2701 		}
2702 		bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
2703 	}
2704 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
2705 		txs = &sc->sc_txsoft[i];
2706 		if (txs->txs_mbuf != NULL) {
2707 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2708 			m_freem(txs->txs_mbuf);
2709 			txs->txs_mbuf = NULL;
2710 		}
2711 		bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
2712 	}
2713 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
2714 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
2715 	bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_control_data,
2716 	    sizeof(struct atw_control_data));
2717 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
2718 
2719 	if (sc->sc_srom)
2720 		free(sc->sc_srom, M_DEVBUF);
2721 
2722 	atw_evcnt_detach(sc);
2723 
2724 	return (0);
2725 }
2726 
2727 /* atw_shutdown: make sure the interface is stopped at reboot time. */
2728 bool
2729 atw_shutdown(device_t self, int flags)
2730 {
2731 	struct atw_softc *sc = device_private(self);
2732 
2733 	atw_stop(&sc->sc_if, 1);
2734 	return true;
2735 }
2736 
2737 #if 0
2738 static void
2739 atw_workaround1(struct atw_softc *sc)
2740 {
2741 	uint32_t test1;
2742 
2743 	test1 = ATW_READ(sc, ATW_TEST1);
2744 
2745 	sc->sc_misc_ev.ev_count++;
2746 
2747 	if ((test1 & ATW_TEST1_RXPKT1IN) != 0) {
2748 		sc->sc_rxpkt1in_ev.ev_count++;
2749 		return;
2750 	}
2751 	if (__SHIFTOUT(test1, ATW_TEST1_RRA_MASK) ==
2752 	    __SHIFTOUT(test1, ATW_TEST1_RWA_MASK)) {
2753 		sc->sc_rxamatch_ev.ev_count++;
2754 		return;
2755 	}
2756 	sc->sc_workaround1_ev.ev_count++;
2757 	(void)atw_init(&sc->sc_if);
2758 }
2759 #endif
2760 
2761 int
2762 atw_intr(void *arg)
2763 {
2764 	struct atw_softc *sc = arg;
2765 	struct ifnet *ifp = &sc->sc_if;
2766 	u_int32_t status, rxstatus, txstatus, linkstatus;
2767 	int handled = 0, txthresh;
2768 
2769 #ifdef DEBUG
2770 	if (!device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
2771 		panic("%s: atw_intr: not enabled", device_xname(sc->sc_dev));
2772 #endif
2773 
2774 	/*
2775 	 * If the interface isn't running, the interrupt couldn't
2776 	 * possibly have come from us.
2777 	 */
2778 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2779 	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
2780 		return (0);
2781 
2782 	for (;;) {
2783 		status = ATW_READ(sc, ATW_STSR);
2784 
2785 		if (status)
2786 			ATW_WRITE(sc, ATW_STSR, status);
2787 
2788 #ifdef ATW_DEBUG
2789 #define PRINTINTR(flag) do { \
2790 	if ((status & flag) != 0) { \
2791 		printf("%s" #flag, delim); \
2792 		delim = ","; \
2793 	} \
2794 } while (0)
2795 
2796 		if (atw_debug > 1 && status) {
2797 			const char *delim = "<";
2798 
2799 			printf("%s: reg[STSR] = %x",
2800 			    device_xname(sc->sc_dev), status);
2801 
2802 			PRINTINTR(ATW_INTR_FBE);
2803 			PRINTINTR(ATW_INTR_LINKOFF);
2804 			PRINTINTR(ATW_INTR_LINKON);
2805 			PRINTINTR(ATW_INTR_RCI);
2806 			PRINTINTR(ATW_INTR_RDU);
2807 			PRINTINTR(ATW_INTR_REIS);
2808 			PRINTINTR(ATW_INTR_RPS);
2809 			PRINTINTR(ATW_INTR_TCI);
2810 			PRINTINTR(ATW_INTR_TDU);
2811 			PRINTINTR(ATW_INTR_TLT);
2812 			PRINTINTR(ATW_INTR_TPS);
2813 			PRINTINTR(ATW_INTR_TRT);
2814 			PRINTINTR(ATW_INTR_TUF);
2815 			PRINTINTR(ATW_INTR_BCNTC);
2816 			PRINTINTR(ATW_INTR_ATIME);
2817 			PRINTINTR(ATW_INTR_TBTT);
2818 			PRINTINTR(ATW_INTR_TSCZ);
2819 			PRINTINTR(ATW_INTR_TSFTF);
2820 			printf(">\n");
2821 		}
2822 #undef PRINTINTR
2823 #endif /* ATW_DEBUG */
2824 
2825 		if ((status & sc->sc_inten) == 0)
2826 			break;
2827 
2828 		handled = 1;
2829 
2830 		rxstatus = status & sc->sc_rxint_mask;
2831 		txstatus = status & sc->sc_txint_mask;
2832 		linkstatus = status & sc->sc_linkint_mask;
2833 
2834 		if (linkstatus) {
2835 			atw_linkintr(sc, linkstatus);
2836 		}
2837 
2838 		if (rxstatus) {
2839 			/* Grab any new packets. */
2840 			atw_rxintr(sc);
2841 
2842 			if (rxstatus & ATW_INTR_RDU) {
2843 				printf("%s: receive ring overrun\n",
2844 				    device_xname(sc->sc_dev));
2845 				/* Get the receive process going again. */
2846 				ATW_WRITE(sc, ATW_RDR, 0x1);
2847 			}
2848 		}
2849 
2850 		if (txstatus) {
2851 			/* Sweep up transmit descriptors. */
2852 			atw_txintr(sc, txstatus);
2853 
2854 			if (txstatus & ATW_INTR_TLT) {
2855 				DPRINTF(sc, ("%s: tx lifetime exceeded\n",
2856 				    device_xname(sc->sc_dev)));
2857 				(void)atw_init(&sc->sc_if);
2858 			}
2859 
2860 			if (txstatus & ATW_INTR_TRT) {
2861 				DPRINTF(sc, ("%s: tx retry limit exceeded\n",
2862 				    device_xname(sc->sc_dev)));
2863 			}
2864 
2865 			/* If Tx under-run, increase our transmit threshold
2866 			 * if another is available.
2867 			 */
2868 			txthresh = sc->sc_txthresh + 1;
2869 			if ((txstatus & ATW_INTR_TUF) &&
2870 			    sc->sc_txth[txthresh].txth_name != NULL) {
2871 				/* Idle the transmit process. */
2872 				atw_idle(sc, ATW_NAR_ST);
2873 
2874 				sc->sc_txthresh = txthresh;
2875 				sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
2876 				sc->sc_opmode |=
2877 				    sc->sc_txth[txthresh].txth_opmode;
2878 				printf("%s: transmit underrun; new "
2879 				    "threshold: %s\n", device_xname(sc->sc_dev),
2880 				    sc->sc_txth[txthresh].txth_name);
2881 
2882 				/* Set the new threshold and restart
2883 				 * the transmit process.
2884 				 */
2885 				ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2886 				DELAY(atw_nar_delay);
2887 				ATW_WRITE(sc, ATW_TDR, 0x1);
2888 				/* XXX Log every Nth underrun from
2889 				 * XXX now on?
2890 				 */
2891 			}
2892 		}
2893 
2894 		if (status & (ATW_INTR_TPS|ATW_INTR_RPS)) {
2895 			if (status & ATW_INTR_TPS)
2896 				printf("%s: transmit process stopped\n",
2897 				    device_xname(sc->sc_dev));
2898 			if (status & ATW_INTR_RPS)
2899 				printf("%s: receive process stopped\n",
2900 				    device_xname(sc->sc_dev));
2901 			(void)atw_init(ifp);
2902 			break;
2903 		}
2904 
2905 		if (status & ATW_INTR_FBE) {
2906 			aprint_error_dev(sc->sc_dev, "fatal bus error\n");
2907 			(void)atw_init(ifp);
2908 			break;
2909 		}
2910 
2911 		/*
2912 		 * Not handled:
2913 		 *
2914 		 *	Transmit buffer unavailable -- normal
2915 		 *	condition, nothing to do, really.
2916 		 *
2917 		 *	Early receive interrupt -- not available on
2918 		 *	all chips, we just use RI.  We also only
2919 		 *	use single-segment receive DMA, so this
2920 		 *	is mostly useless.
2921 		 *
2922 		 *      TBD others
2923 		 */
2924 	}
2925 
2926 	/* Try to get more packets going. */
2927 	atw_start(ifp);
2928 
2929 	return (handled);
2930 }
2931 
2932 /*
2933  * atw_idle:
2934  *
2935  *	Cause the transmit and/or receive processes to go idle.
2936  *
2937  *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
2938  *	process in STSR if I clear SR or ST after the process has already
2939  *	ceased. Fair enough. But the Rx process status bits in ATW_TEST0
2940  *      do not seem to be too reliable. Perhaps I have the sense of the
2941  *	Rx bits switched with the Tx bits?
2942  */
2943 void
2944 atw_idle(struct atw_softc *sc, u_int32_t bits)
2945 {
2946 	u_int32_t ackmask = 0, opmode, stsr, test0;
2947 	int i, s;
2948 
2949 	s = splnet();
2950 
2951 	opmode = sc->sc_opmode & ~bits;
2952 
2953 	if (bits & ATW_NAR_SR)
2954 		ackmask |= ATW_INTR_RPS;
2955 
2956 	if (bits & ATW_NAR_ST) {
2957 		ackmask |= ATW_INTR_TPS;
2958 		/* set ATW_NAR_HF to flush TX FIFO. */
2959 		opmode |= ATW_NAR_HF;
2960 	}
2961 
2962 	ATW_WRITE(sc, ATW_NAR, opmode);
2963 	DELAY(atw_nar_delay);
2964 
2965 	for (i = 0; i < 1000; i++) {
2966 		stsr = ATW_READ(sc, ATW_STSR);
2967 		if ((stsr & ackmask) == ackmask)
2968 			break;
2969 		DELAY(10);
2970 	}
2971 
2972 	ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
2973 
2974 	if ((stsr & ackmask) == ackmask)
2975 		goto out;
2976 
2977 	test0 = ATW_READ(sc, ATW_TEST0);
2978 
2979 	if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
2980 	    (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
2981 		printf("%s: transmit process not idle [%s]\n",
2982 		    device_xname(sc->sc_dev),
2983 		    atw_tx_state[__SHIFTOUT(test0, ATW_TEST0_TS_MASK)]);
2984 		printf("%s: bits %08x test0 %08x stsr %08x\n",
2985 		    device_xname(sc->sc_dev), bits, test0, stsr);
2986 	}
2987 
2988 	if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
2989 	    (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
2990 		DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
2991 		    device_xname(sc->sc_dev),
2992 		    atw_rx_state[__SHIFTOUT(test0, ATW_TEST0_RS_MASK)]));
2993 		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
2994 		    device_xname(sc->sc_dev), bits, test0, stsr));
2995 	}
2996 out:
2997 	if ((bits & ATW_NAR_ST) != 0)
2998 		atw_txdrain(sc);
2999 	splx(s);
3000 	return;
3001 }
3002 
3003 /*
3004  * atw_linkintr:
3005  *
3006  *	Helper; handle link-status interrupts.
3007  */
3008 void
3009 atw_linkintr(struct atw_softc *sc, u_int32_t linkstatus)
3010 {
3011 	struct ieee80211com *ic = &sc->sc_ic;
3012 
3013 	if (ic->ic_state != IEEE80211_S_RUN)
3014 		return;
3015 
3016 	if (linkstatus & ATW_INTR_LINKON) {
3017 		DPRINTF(sc, ("%s: link on\n", device_xname(sc->sc_dev)));
3018 		sc->sc_rescan_timer = 0;
3019 	} else if (linkstatus & ATW_INTR_LINKOFF) {
3020 		DPRINTF(sc, ("%s: link off\n", device_xname(sc->sc_dev)));
3021 		if (ic->ic_opmode != IEEE80211_M_STA)
3022 			return;
3023 		sc->sc_rescan_timer = 3;
3024 		sc->sc_if.if_timer = 1;
3025 	}
3026 }
3027 
3028 static inline int
3029 atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame_min *wh)
3030 {
3031 	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
3032 		return 0;
3033 	if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
3034 		return 0;
3035 	return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
3036 }
3037 
3038 /*
3039  * atw_rxintr:
3040  *
3041  *	Helper; handle receive interrupts.
3042  */
3043 void
3044 atw_rxintr(struct atw_softc *sc)
3045 {
3046 	static int rate_tbl[] = {2, 4, 11, 22, 44};
3047 	struct ieee80211com *ic = &sc->sc_ic;
3048 	struct ieee80211_node *ni;
3049 	struct ieee80211_frame_min *wh;
3050 	struct ifnet *ifp = &sc->sc_if;
3051 	struct atw_rxsoft *rxs;
3052 	struct mbuf *m;
3053 	u_int32_t rxstat;
3054 	int i, len, rate, rate0;
3055 	u_int32_t rssi, ctlrssi;
3056 
3057 	for (i = sc->sc_rxptr;; i = sc->sc_rxptr) {
3058 		rxs = &sc->sc_rxsoft[i];
3059 
3060 		ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3061 
3062 		rxstat = le32toh(sc->sc_rxdescs[i].ar_stat);
3063 		ctlrssi = le32toh(sc->sc_rxdescs[i].ar_ctlrssi);
3064 		rate0 = __SHIFTOUT(rxstat, ATW_RXSTAT_RXDR_MASK);
3065 
3066 		if (rxstat & ATW_RXSTAT_OWN) {
3067 			ATW_CDRXSYNC(sc, i, BUS_DMASYNC_PREREAD);
3068 			break;
3069 		}
3070 
3071 		sc->sc_rxptr = ATW_NEXTRX(i);
3072 
3073 		DPRINTF3(sc,
3074 		    ("%s: rx stat %08x ctlrssi %08x buf1 %08x buf2 %08x\n",
3075 		    device_xname(sc->sc_dev),
3076 		    rxstat, ctlrssi,
3077 		    le32toh(sc->sc_rxdescs[i].ar_buf1),
3078 		    le32toh(sc->sc_rxdescs[i].ar_buf2)));
3079 
3080 		/*
3081 		 * Make sure the packet fits in one buffer.  This should
3082 		 * always be the case.
3083 		 */
3084 		if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=
3085 		    (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {
3086 			printf("%s: incoming packet spilled, resetting\n",
3087 			    device_xname(sc->sc_dev));
3088 			(void)atw_init(ifp);
3089 			return;
3090 		}
3091 
3092 		/*
3093 		 * If an error occurred, update stats, clear the status
3094 		 * word, and leave the packet buffer in place.  It will
3095 		 * simply be reused the next time the ring comes around.
3096 		 */
3097 		if ((rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_RXTOE)) != 0) {
3098 #define	PRINTERR(bit, str)						\
3099 			if (rxstat & (bit))				\
3100 				aprint_error_dev(sc->sc_dev, "receive error: %s\n",	\
3101 				    str)
3102 			ifp->if_ierrors++;
3103 			PRINTERR(ATW_RXSTAT_DE, "descriptor error");
3104 			PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
3105 #if 0
3106 			PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
3107 			PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
3108 			PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
3109 			PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
3110 #endif
3111 #undef PRINTERR
3112 			atw_init_rxdesc(sc, i);
3113 			continue;
3114 		}
3115 
3116 		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3117 		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
3118 
3119 		/*
3120 		 * No errors; receive the packet.  Note the ADM8211
3121 		 * includes the CRC in promiscuous mode.
3122 		 */
3123 		len = __SHIFTOUT(rxstat, ATW_RXSTAT_FL_MASK);
3124 
3125 		/*
3126 		 * Allocate a new mbuf cluster.  If that fails, we are
3127 		 * out of memory, and must drop the packet and recycle
3128 		 * the buffer that's already attached to this descriptor.
3129 		 */
3130 		m = rxs->rxs_mbuf;
3131 		if (atw_add_rxbuf(sc, i) != 0) {
3132 			ifp->if_ierrors++;
3133 			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3134 			    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
3135 			atw_init_rxdesc(sc, i);
3136 			continue;
3137 		}
3138 
3139 		ifp->if_ipackets++;
3140 		m->m_pkthdr.rcvif = ifp;
3141 		m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
3142 
3143 		rate = (rate0 < __arraycount(rate_tbl)) ? rate_tbl[rate0] : 0;
3144 
3145 		/* The RSSI comes straight from a register in the
3146 		 * baseband processor.  I know that for the RF3000,
3147 		 * the RSSI register also contains the antenna-selection
3148 		 * bits.  Mask those off.
3149 		 *
3150 		 * TBD Treat other basebands.
3151 		 * TBD Use short-preamble bit and such in RF3000_RXSTAT.
3152 		 */
3153 		if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
3154 			rssi = ctlrssi & RF3000_RSSI_MASK;
3155 		else
3156 			rssi = ctlrssi;
3157 
3158 		/* Pass this up to any BPF listeners. */
3159 		if (sc->sc_radiobpf != NULL) {
3160 			struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
3161 
3162 			tap->ar_rate = rate;
3163 
3164 			/* TBD verify units are dB */
3165 			tap->ar_antsignal = (int)rssi;
3166 			if (sc->sc_opmode & ATW_NAR_PR)
3167 				tap->ar_flags = IEEE80211_RADIOTAP_F_FCS;
3168 			else
3169 				tap->ar_flags = 0;
3170 
3171 			if ((rxstat & ATW_RXSTAT_CRC32E) != 0)
3172 				tap->ar_flags |= IEEE80211_RADIOTAP_F_BADFCS;
3173 
3174 			bpf_mtap2(sc->sc_radiobpf, tap, sizeof(sc->sc_rxtapu),
3175 			    m);
3176  		}
3177 
3178 		sc->sc_recv_ev.ev_count++;
3179 
3180 		if ((rxstat & (ATW_RXSTAT_CRC16E|ATW_RXSTAT_CRC32E|ATW_RXSTAT_ICVE|ATW_RXSTAT_SFDE|ATW_RXSTAT_SIGE)) != 0) {
3181 			if (rxstat & ATW_RXSTAT_CRC16E)
3182 				sc->sc_crc16e_ev.ev_count++;
3183 			if (rxstat & ATW_RXSTAT_CRC32E)
3184 				sc->sc_crc32e_ev.ev_count++;
3185 			if (rxstat & ATW_RXSTAT_ICVE)
3186 				sc->sc_icve_ev.ev_count++;
3187 			if (rxstat & ATW_RXSTAT_SFDE)
3188 				sc->sc_sfde_ev.ev_count++;
3189 			if (rxstat & ATW_RXSTAT_SIGE)
3190 				sc->sc_sige_ev.ev_count++;
3191 			ifp->if_ierrors++;
3192 			m_freem(m);
3193 			continue;
3194 		}
3195 
3196 		if (sc->sc_opmode & ATW_NAR_PR)
3197 			m_adj(m, -IEEE80211_CRC_LEN);
3198 
3199 		wh = mtod(m, struct ieee80211_frame_min *);
3200 		ni = ieee80211_find_rxnode(ic, wh);
3201 #if 0
3202 		if (atw_hw_decrypted(sc, wh)) {
3203 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
3204 			DPRINTF(sc, ("%s: hw decrypted\n", __func__));
3205 		}
3206 #endif
3207 		ieee80211_input(ic, m, ni, (int)rssi, 0);
3208 		ieee80211_free_node(ni);
3209 	}
3210 }
3211 
3212 /*
3213  * atw_txintr:
3214  *
3215  *	Helper; handle transmit interrupts.
3216  */
3217 void
3218 atw_txintr(struct atw_softc *sc, uint32_t status)
3219 {
3220 	static char txstat_buf[sizeof("ffffffff<>" ATW_TXSTAT_FMT)];
3221 	struct ifnet *ifp = &sc->sc_if;
3222 	struct atw_txsoft *txs;
3223 	u_int32_t txstat;
3224 
3225 	DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
3226 	    device_xname(sc->sc_dev), sc->sc_flags));
3227 
3228 	/*
3229 	 * Go through our Tx list and free mbufs for those
3230 	 * frames that have been transmitted.
3231 	 */
3232 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
3233 		ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
3234 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3235 
3236 #ifdef ATW_DEBUG
3237 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3238 			int i;
3239 			printf("    txsoft %p transmit chain:\n", txs);
3240 			ATW_CDTXSYNC(sc, txs->txs_firstdesc,
3241 			    txs->txs_ndescs - 1,
3242 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3243 			for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
3244 				printf("     descriptor %d:\n", i);
3245 				printf("       at_status:   0x%08x\n",
3246 				    le32toh(sc->sc_txdescs[i].at_stat));
3247 				printf("       at_flags:      0x%08x\n",
3248 				    le32toh(sc->sc_txdescs[i].at_flags));
3249 				printf("       at_buf1: 0x%08x\n",
3250 				    le32toh(sc->sc_txdescs[i].at_buf1));
3251 				printf("       at_buf2: 0x%08x\n",
3252 				    le32toh(sc->sc_txdescs[i].at_buf2));
3253 				if (i == txs->txs_lastdesc)
3254 					break;
3255 			}
3256 			ATW_CDTXSYNC(sc, txs->txs_firstdesc,
3257 			    txs->txs_ndescs - 1, BUS_DMASYNC_PREREAD);
3258 		}
3259 #endif
3260 
3261 		txstat = le32toh(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
3262 		if (txstat & ATW_TXSTAT_OWN) {
3263 			ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
3264 			    BUS_DMASYNC_PREREAD);
3265 			break;
3266 		}
3267 
3268 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
3269 
3270 		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
3271 		    0, txs->txs_dmamap->dm_mapsize,
3272 		    BUS_DMASYNC_POSTWRITE);
3273 		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
3274 		m_freem(txs->txs_mbuf);
3275 		txs->txs_mbuf = NULL;
3276 
3277 		sc->sc_txfree += txs->txs_ndescs;
3278 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
3279 
3280 		KASSERT(!SIMPLEQ_EMPTY(&sc->sc_txfreeq) && sc->sc_txfree != 0);
3281 		sc->sc_tx_timer = 0;
3282 		ifp->if_flags &= ~IFF_OACTIVE;
3283 
3284 		if ((ifp->if_flags & IFF_DEBUG) != 0 &&
3285 		    (txstat & ATW_TXSTAT_ERRMASK) != 0) {
3286 			snprintb(txstat_buf, sizeof(txstat_buf),
3287 			    ATW_TXSTAT_FMT, txstat & ATW_TXSTAT_ERRMASK);
3288 			printf("%s: txstat %s %" __PRIuBITS "\n",
3289 			    device_xname(sc->sc_dev), txstat_buf,
3290 			    __SHIFTOUT(txstat, ATW_TXSTAT_ARC_MASK));
3291 		}
3292 
3293 		sc->sc_xmit_ev.ev_count++;
3294 
3295 		/*
3296 		 * Check for errors and collisions.
3297 		 */
3298 		if (txstat & ATW_TXSTAT_TUF)
3299 			sc->sc_tuf_ev.ev_count++;
3300 		if (txstat & ATW_TXSTAT_TLT)
3301 			sc->sc_tlt_ev.ev_count++;
3302 		if (txstat & ATW_TXSTAT_TRT)
3303 			sc->sc_trt_ev.ev_count++;
3304 		if (txstat & ATW_TXSTAT_TRO)
3305 			sc->sc_tro_ev.ev_count++;
3306 		if (txstat & ATW_TXSTAT_SOFBR)
3307 			sc->sc_sofbr_ev.ev_count++;
3308 
3309 		if ((txstat & ATW_TXSTAT_ES) == 0)
3310 			ifp->if_collisions +=
3311 			    __SHIFTOUT(txstat, ATW_TXSTAT_ARC_MASK);
3312 		else
3313 			ifp->if_oerrors++;
3314 
3315 		ifp->if_opackets++;
3316 	}
3317 
3318 	KASSERT(txs != NULL || (ifp->if_flags & IFF_OACTIVE) == 0);
3319 }
3320 
3321 /*
3322  * atw_watchdog:	[ifnet interface function]
3323  *
3324  *	Watchdog timer handler.
3325  */
3326 void
3327 atw_watchdog(struct ifnet *ifp)
3328 {
3329 	struct atw_softc *sc = ifp->if_softc;
3330 	struct ieee80211com *ic = &sc->sc_ic;
3331 
3332 	ifp->if_timer = 0;
3333 	if (!device_is_active(sc->sc_dev))
3334 		return;
3335 
3336 	if (sc->sc_rescan_timer != 0 && --sc->sc_rescan_timer == 0)
3337 		(void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3338 	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0 &&
3339 	    !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
3340 		printf("%s: transmit timeout\n", ifp->if_xname);
3341 		ifp->if_oerrors++;
3342 		(void)atw_init(ifp);
3343 		atw_start(ifp);
3344 	}
3345 	if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
3346 		ifp->if_timer = 1;
3347 	ieee80211_watchdog(ic);
3348 }
3349 
3350 static void
3351 atw_evcnt_detach(struct atw_softc *sc)
3352 {
3353 	evcnt_detach(&sc->sc_sige_ev);
3354 	evcnt_detach(&sc->sc_sfde_ev);
3355 	evcnt_detach(&sc->sc_icve_ev);
3356 	evcnt_detach(&sc->sc_crc32e_ev);
3357 	evcnt_detach(&sc->sc_crc16e_ev);
3358 	evcnt_detach(&sc->sc_recv_ev);
3359 
3360 	evcnt_detach(&sc->sc_tuf_ev);
3361 	evcnt_detach(&sc->sc_tro_ev);
3362 	evcnt_detach(&sc->sc_trt_ev);
3363 	evcnt_detach(&sc->sc_tlt_ev);
3364 	evcnt_detach(&sc->sc_sofbr_ev);
3365 	evcnt_detach(&sc->sc_xmit_ev);
3366 
3367 	evcnt_detach(&sc->sc_rxpkt1in_ev);
3368 	evcnt_detach(&sc->sc_rxamatch_ev);
3369 	evcnt_detach(&sc->sc_workaround1_ev);
3370 	evcnt_detach(&sc->sc_misc_ev);
3371 }
3372 
3373 static void
3374 atw_evcnt_attach(struct atw_softc *sc)
3375 {
3376 	evcnt_attach_dynamic(&sc->sc_recv_ev, EVCNT_TYPE_MISC,
3377 	    NULL, sc->sc_if.if_xname, "recv");
3378 	evcnt_attach_dynamic(&sc->sc_crc16e_ev, EVCNT_TYPE_MISC,
3379 	    &sc->sc_recv_ev, sc->sc_if.if_xname, "CRC16 error");
3380 	evcnt_attach_dynamic(&sc->sc_crc32e_ev, EVCNT_TYPE_MISC,
3381 	    &sc->sc_recv_ev, sc->sc_if.if_xname, "CRC32 error");
3382 	evcnt_attach_dynamic(&sc->sc_icve_ev, EVCNT_TYPE_MISC,
3383 	    &sc->sc_recv_ev, sc->sc_if.if_xname, "ICV error");
3384 	evcnt_attach_dynamic(&sc->sc_sfde_ev, EVCNT_TYPE_MISC,
3385 	    &sc->sc_recv_ev, sc->sc_if.if_xname, "PLCP SFD error");
3386 	evcnt_attach_dynamic(&sc->sc_sige_ev, EVCNT_TYPE_MISC,
3387 	    &sc->sc_recv_ev, sc->sc_if.if_xname, "PLCP Signal Field error");
3388 
3389 	evcnt_attach_dynamic(&sc->sc_xmit_ev, EVCNT_TYPE_MISC,
3390 	    NULL, sc->sc_if.if_xname, "xmit");
3391 	evcnt_attach_dynamic(&sc->sc_tuf_ev, EVCNT_TYPE_MISC,
3392 	    &sc->sc_xmit_ev, sc->sc_if.if_xname, "transmit underflow");
3393 	evcnt_attach_dynamic(&sc->sc_tro_ev, EVCNT_TYPE_MISC,
3394 	    &sc->sc_xmit_ev, sc->sc_if.if_xname, "transmit overrun");
3395 	evcnt_attach_dynamic(&sc->sc_trt_ev, EVCNT_TYPE_MISC,
3396 	    &sc->sc_xmit_ev, sc->sc_if.if_xname, "retry count exceeded");
3397 	evcnt_attach_dynamic(&sc->sc_tlt_ev, EVCNT_TYPE_MISC,
3398 	    &sc->sc_xmit_ev, sc->sc_if.if_xname, "lifetime exceeded");
3399 	evcnt_attach_dynamic(&sc->sc_sofbr_ev, EVCNT_TYPE_MISC,
3400 	    &sc->sc_xmit_ev, sc->sc_if.if_xname, "packet size mismatch");
3401 
3402 	evcnt_attach_dynamic(&sc->sc_misc_ev, EVCNT_TYPE_MISC,
3403 	    NULL, sc->sc_if.if_xname, "misc");
3404 	evcnt_attach_dynamic(&sc->sc_workaround1_ev, EVCNT_TYPE_MISC,
3405 	    &sc->sc_misc_ev, sc->sc_if.if_xname, "workaround #1");
3406 	evcnt_attach_dynamic(&sc->sc_rxamatch_ev, EVCNT_TYPE_MISC,
3407 	    &sc->sc_misc_ev, sc->sc_if.if_xname, "rra equals rwa");
3408 	evcnt_attach_dynamic(&sc->sc_rxpkt1in_ev, EVCNT_TYPE_MISC,
3409 	    &sc->sc_misc_ev, sc->sc_if.if_xname, "rxpkt1in set");
3410 }
3411 
3412 #ifdef ATW_DEBUG
3413 static void
3414 atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
3415 {
3416 	struct atw_softc *sc = ifp->if_softc;
3417 	struct mbuf *m;
3418 	int i, noctets = 0;
3419 
3420 	printf("%s: %d-byte packet\n", device_xname(sc->sc_dev),
3421 	    m0->m_pkthdr.len);
3422 
3423 	for (m = m0; m; m = m->m_next) {
3424 		if (m->m_len == 0)
3425 			continue;
3426 		for (i = 0; i < m->m_len; i++) {
3427 			printf(" %02x", ((u_int8_t*)m->m_data)[i]);
3428 			if (++noctets % 24 == 0)
3429 				printf("\n");
3430 		}
3431 	}
3432 	printf("%s%s: %d bytes emitted\n",
3433 	    (noctets % 24 != 0) ? "\n" : "", device_xname(sc->sc_dev), noctets);
3434 }
3435 #endif /* ATW_DEBUG */
3436 
3437 /*
3438  * atw_start:		[ifnet interface function]
3439  *
3440  *	Start packet transmission on the interface.
3441  */
3442 void
3443 atw_start(struct ifnet *ifp)
3444 {
3445 	struct atw_softc *sc = ifp->if_softc;
3446 	struct ieee80211_key *k;
3447 	struct ieee80211com *ic = &sc->sc_ic;
3448 	struct ieee80211_node *ni;
3449 	struct ieee80211_frame_min *whm;
3450 	struct ieee80211_frame *wh;
3451 	struct atw_frame *hh;
3452 	uint16_t hdrctl;
3453 	struct mbuf *m0, *m;
3454 	struct atw_txsoft *txs, *last_txs;
3455 	struct atw_txdesc *txd;
3456 	int npkt, rate;
3457 	bus_dmamap_t dmamap;
3458 	int ctl, error, firsttx, nexttx, lasttx, first, ofree, seg;
3459 
3460 	DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
3461 	    device_xname(sc->sc_dev), sc->sc_flags, ifp->if_flags));
3462 
3463 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3464 		return;
3465 
3466 	/*
3467 	 * Remember the previous number of free descriptors and
3468 	 * the first descriptor we'll use.
3469 	 */
3470 	ofree = sc->sc_txfree;
3471 	firsttx = lasttx = sc->sc_txnext;
3472 
3473 	DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
3474 	    device_xname(sc->sc_dev), ofree, firsttx));
3475 
3476 	/*
3477 	 * Loop through the send queue, setting up transmit descriptors
3478 	 * until we drain the queue, or use up all available transmit
3479 	 * descriptors.
3480 	 */
3481 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
3482 	       sc->sc_txfree != 0) {
3483 
3484 		hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
3485 
3486 		/*
3487 		 * Grab a packet off the management queue, if it
3488 		 * is not empty. Otherwise, from the data queue.
3489 		 */
3490 		IF_DEQUEUE(&ic->ic_mgtq, m0);
3491 		if (m0 != NULL) {
3492 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
3493 			m0->m_pkthdr.rcvif = NULL;
3494 		} else if (ic->ic_state != IEEE80211_S_RUN)
3495 			break; /* send no data until associated */
3496 		else {
3497 			IFQ_DEQUEUE(&ifp->if_snd, m0);
3498 			if (m0 == NULL)
3499 				break;
3500 			bpf_mtap(ifp, m0);
3501 			ni = ieee80211_find_txnode(ic,
3502 			    mtod(m0, struct ether_header *)->ether_dhost);
3503 			if (ni == NULL) {
3504 				ifp->if_oerrors++;
3505 				break;
3506 			}
3507 			if ((m0 = ieee80211_encap(ic, m0, ni)) == NULL) {
3508 				ieee80211_free_node(ni);
3509 				ifp->if_oerrors++;
3510 				break;
3511 			}
3512 		}
3513 
3514 		rate = MAX(ieee80211_get_rate(ni), 2);
3515 
3516 		whm = mtod(m0, struct ieee80211_frame_min *);
3517 
3518 		if ((whm->i_fc[1] & IEEE80211_FC1_WEP) == 0)
3519 			k = NULL;
3520 		else if ((k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3521 			m_freem(m0);
3522 			ieee80211_free_node(ni);
3523 			ifp->if_oerrors++;
3524 			break;
3525 		}
3526 #if 0
3527 		if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3528 		    m0->m_pkthdr.len > ic->ic_fragthreshold)
3529 			hdrctl |= htole16(ATW_HDRCTL_MORE_FRAG);
3530 #endif
3531 
3532 		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN >= ic->ic_rtsthreshold)
3533 			hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
3534 
3535 		if (ieee80211_compute_duration(whm, k, m0->m_pkthdr.len,
3536 		    ic->ic_flags, ic->ic_fragthreshold, rate,
3537 		    &txs->txs_d0, &txs->txs_dn, &npkt, 0) == -1) {
3538 			DPRINTF2(sc, ("%s: fail compute duration\n", __func__));
3539 			m_freem(m0);
3540 			break;
3541 		}
3542 
3543 		/* XXX Misleading if fragmentation is enabled.  Better
3544 		 * to fragment in software?
3545 		 */
3546 		*(uint16_t *)whm->i_dur = htole16(txs->txs_d0.d_rts_dur);
3547 
3548 		/*
3549 		 * Pass the packet to any BPF listeners.
3550 		 */
3551 		bpf_mtap3(ic->ic_rawbpf, m0);
3552 
3553 		if (sc->sc_radiobpf != NULL) {
3554 			struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
3555 
3556 			tap->at_rate = rate;
3557 
3558 			bpf_mtap2(sc->sc_radiobpf, tap, sizeof(sc->sc_txtapu),
3559 			    m0);
3560 		}
3561 
3562 		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
3563 
3564 		if (ni != NULL)
3565 			ieee80211_free_node(ni);
3566 
3567 		if (m0 == NULL) {
3568 			ifp->if_oerrors++;
3569 			break;
3570 		}
3571 
3572 		/* just to make sure. */
3573 		m0 = m_pullup(m0, sizeof(struct atw_frame));
3574 
3575 		if (m0 == NULL) {
3576 			ifp->if_oerrors++;
3577 			break;
3578 		}
3579 
3580 		hh = mtod(m0, struct atw_frame *);
3581 		wh = &hh->atw_ihdr;
3582 
3583 		/* Copy everything we need from the 802.11 header:
3584 		 * Frame Control; address 1, address 3, or addresses
3585 		 * 3 and 4. NIC fills in BSSID, SA.
3586 		 */
3587 		if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
3588 			if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
3589 				panic("%s: illegal WDS frame",
3590 				    device_xname(sc->sc_dev));
3591 			memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
3592 		} else
3593 			memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
3594 
3595 		*(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;
3596 
3597 		/* initialize remaining Tx parameters */
3598 		memset(&hh->u, 0, sizeof(hh->u));
3599 
3600 		hh->atw_rate = rate * 5;
3601 		/* XXX this could be incorrect if M_FCS. _encap should
3602 		 * probably strip FCS just in case it sticks around in
3603 		 * bridged packets.
3604 		 */
3605 		hh->atw_service = 0x00; /* XXX guess */
3606 		hh->atw_paylen = htole16(m0->m_pkthdr.len -
3607 		    sizeof(struct atw_frame));
3608 
3609 		/* never fragment multicast frames */
3610 		if (IEEE80211_IS_MULTICAST(hh->atw_dst))
3611 			hh->atw_fragthr = htole16(IEEE80211_FRAG_MAX);
3612 		else {
3613 			if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
3614 			    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE))
3615 				hdrctl |= htole16(ATW_HDRCTL_SHORT_PREAMBLE);
3616 			hh->atw_fragthr = htole16(ic->ic_fragthreshold);
3617 		}
3618 
3619 		hh->atw_rtylmt = 3;
3620 #if 0
3621 		if (do_encrypt) {
3622 			hdrctl |= htole16(ATW_HDRCTL_WEP);
3623 			hh->atw_keyid = ic->ic_def_txkey;
3624 		}
3625 #endif
3626 
3627 		hh->atw_head_plcplen = htole16(txs->txs_d0.d_plcp_len);
3628 		hh->atw_tail_plcplen = htole16(txs->txs_dn.d_plcp_len);
3629 		if (txs->txs_d0.d_residue)
3630 			hh->atw_head_plcplen |= htole16(0x8000);
3631 		if (txs->txs_dn.d_residue)
3632 			hh->atw_tail_plcplen |= htole16(0x8000);
3633 		hh->atw_head_dur = htole16(txs->txs_d0.d_rts_dur);
3634 		hh->atw_tail_dur = htole16(txs->txs_dn.d_rts_dur);
3635 
3636 		hh->atw_hdrctl = hdrctl;
3637 		hh->atw_fragnum = npkt << 4;
3638 #ifdef ATW_DEBUG
3639 
3640 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3641 			printf("%s: dst = %s, rate = 0x%02x, "
3642 			    "service = 0x%02x, paylen = 0x%04x\n",
3643 			    device_xname(sc->sc_dev), ether_sprintf(hh->atw_dst),
3644 			    hh->atw_rate, hh->atw_service, hh->atw_paylen);
3645 
3646 			printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
3647 			    "dur1 = 0x%04x, dur2 = 0x%04x, "
3648 			    "dur3 = 0x%04x, rts_dur = 0x%04x\n",
3649 			    device_xname(sc->sc_dev), hh->atw_fc[0], hh->atw_fc[1],
3650 			    hh->atw_tail_plcplen, hh->atw_head_plcplen,
3651 			    hh->atw_tail_dur, hh->atw_head_dur);
3652 
3653 			printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
3654 			    "fragnum = 0x%02x, rtylmt = 0x%04x\n",
3655 			    device_xname(sc->sc_dev), hh->atw_hdrctl,
3656 			    hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
3657 
3658 			printf("%s: keyid = %d\n",
3659 			    device_xname(sc->sc_dev), hh->atw_keyid);
3660 
3661 			atw_dump_pkt(ifp, m0);
3662 		}
3663 #endif /* ATW_DEBUG */
3664 
3665 		dmamap = txs->txs_dmamap;
3666 
3667 		/*
3668 		 * Load the DMA map.  Copy and try (once) again if the packet
3669 		 * didn't fit in the alloted number of segments.
3670 		 */
3671 		for (first = 1;
3672 		     (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
3673 		                  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;
3674 		     first = 0) {
3675 			MGETHDR(m, M_DONTWAIT, MT_DATA);
3676 			if (m == NULL) {
3677 				aprint_error_dev(sc->sc_dev, "unable to allocate Tx mbuf\n");
3678 				break;
3679 			}
3680 			if (m0->m_pkthdr.len > MHLEN) {
3681 				MCLGET(m, M_DONTWAIT);
3682 				if ((m->m_flags & M_EXT) == 0) {
3683 					aprint_error_dev(sc->sc_dev, "unable to allocate Tx "
3684 					    "cluster\n");
3685 					m_freem(m);
3686 					break;
3687 				}
3688 			}
3689 			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3690 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3691 			m_freem(m0);
3692 			m0 = m;
3693 			m = NULL;
3694 		}
3695 		if (error != 0) {
3696 			aprint_error_dev(sc->sc_dev, "unable to load Tx buffer, "
3697 			    "error = %d\n", error);
3698 			m_freem(m0);
3699 			break;
3700 		}
3701 
3702 		/*
3703 		 * Ensure we have enough descriptors free to describe
3704 		 * the packet.
3705 		 */
3706 		if (dmamap->dm_nsegs > sc->sc_txfree) {
3707 			/*
3708 			 * Not enough free descriptors to transmit
3709 			 * this packet.  Unload the DMA map and
3710 			 * drop the packet.  Notify the upper layer
3711 			 * that there are no more slots left.
3712 			 *
3713 			 * XXX We could allocate an mbuf and copy, but
3714 			 * XXX it is worth it?
3715 			 */
3716 			bus_dmamap_unload(sc->sc_dmat, dmamap);
3717 			m_freem(m0);
3718 			break;
3719 		}
3720 
3721 		/*
3722 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
3723 		 */
3724 
3725 		/* Sync the DMA map. */
3726 		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
3727 		    BUS_DMASYNC_PREWRITE);
3728 
3729 		/* XXX arbitrary retry limit; 8 because I have seen it in
3730 		 * use already and maybe 0 means "no tries" !
3731 		 */
3732 		ctl = htole32(__SHIFTIN(8, ATW_TXCTL_TL_MASK));
3733 
3734 		DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
3735 		    device_xname(sc->sc_dev), rate * 5));
3736 		ctl |= htole32(__SHIFTIN(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
3737 
3738 		/*
3739 		 * Initialize the transmit descriptors.
3740 		 */
3741 		for (nexttx = sc->sc_txnext, seg = 0;
3742 		     seg < dmamap->dm_nsegs;
3743 		     seg++, nexttx = ATW_NEXTTX(nexttx)) {
3744 			/*
3745 			 * If this is the first descriptor we're
3746 			 * enqueueing, don't set the OWN bit just
3747 			 * yet.  That could cause a race condition.
3748 			 * We'll do it below.
3749 			 */
3750 			txd = &sc->sc_txdescs[nexttx];
3751 			txd->at_ctl = ctl |
3752 			    ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
3753 
3754 			txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
3755 			txd->at_flags =
3756 			    htole32(__SHIFTIN(dmamap->dm_segs[seg].ds_len,
3757 			                   ATW_TXFLAG_TBS1_MASK)) |
3758 			    ((nexttx == (ATW_NTXDESC - 1))
3759 			        ? htole32(ATW_TXFLAG_TER) : 0);
3760 			lasttx = nexttx;
3761 		}
3762 
3763 		/* Set `first segment' and `last segment' appropriately. */
3764 		sc->sc_txdescs[sc->sc_txnext].at_flags |=
3765 		    htole32(ATW_TXFLAG_FS);
3766 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
3767 
3768 #ifdef ATW_DEBUG
3769 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3770 			printf("     txsoft %p transmit chain:\n", txs);
3771 			for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
3772 				printf("     descriptor %d:\n", seg);
3773 				printf("       at_ctl:   0x%08x\n",
3774 				    le32toh(sc->sc_txdescs[seg].at_ctl));
3775 				printf("       at_flags:      0x%08x\n",
3776 				    le32toh(sc->sc_txdescs[seg].at_flags));
3777 				printf("       at_buf1: 0x%08x\n",
3778 				    le32toh(sc->sc_txdescs[seg].at_buf1));
3779 				printf("       at_buf2: 0x%08x\n",
3780 				    le32toh(sc->sc_txdescs[seg].at_buf2));
3781 				if (seg == lasttx)
3782 					break;
3783 			}
3784 		}
3785 #endif
3786 
3787 		/* Sync the descriptors we're using. */
3788 		ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
3789 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3790 
3791 		/*
3792 		 * Store a pointer to the packet so we can free it later,
3793 		 * and remember what txdirty will be once the packet is
3794 		 * done.
3795 		 */
3796 		txs->txs_mbuf = m0;
3797 		txs->txs_firstdesc = sc->sc_txnext;
3798 		txs->txs_lastdesc = lasttx;
3799 		txs->txs_ndescs = dmamap->dm_nsegs;
3800 
3801 		/* Advance the tx pointer. */
3802 		sc->sc_txfree -= dmamap->dm_nsegs;
3803 		sc->sc_txnext = nexttx;
3804 
3805 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
3806 		SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
3807 
3808 		last_txs = txs;
3809 	}
3810 
3811 	if (sc->sc_txfree != ofree) {
3812 		DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
3813 		    device_xname(sc->sc_dev), lasttx, firsttx));
3814 		/*
3815 		 * Cause a transmit interrupt to happen on the
3816 		 * last packet we enqueued.
3817 		 */
3818 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
3819 		ATW_CDTXSYNC(sc, lasttx, 1,
3820 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3821 
3822 		/*
3823 		 * The entire packet chain is set up.  Give the
3824 		 * first descriptor to the chip now.
3825 		 */
3826 		sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
3827 		ATW_CDTXSYNC(sc, firsttx, 1,
3828 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3829 
3830 		/* Wake up the transmitter. */
3831 		ATW_WRITE(sc, ATW_TDR, 0x1);
3832 
3833 		if (txs == NULL || sc->sc_txfree == 0)
3834 			ifp->if_flags |= IFF_OACTIVE;
3835 
3836 		/* Set a watchdog timer in case the chip flakes out. */
3837 		sc->sc_tx_timer = 5;
3838 		ifp->if_timer = 1;
3839 	}
3840 }
3841 
3842 /*
3843  * atw_ioctl:		[ifnet interface function]
3844  *
3845  *	Handle control requests from the operator.
3846  */
3847 int
3848 atw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
3849 {
3850 	struct atw_softc *sc = ifp->if_softc;
3851 	struct ieee80211req *ireq;
3852 	int s, error = 0;
3853 
3854 	s = splnet();
3855 
3856 	switch (cmd) {
3857 	case SIOCSIFFLAGS:
3858 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
3859 			break;
3860 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
3861 		case IFF_UP|IFF_RUNNING:
3862 			/*
3863 			 * To avoid rescanning another access point,
3864 			 * do not call atw_init() here.  Instead,
3865 			 * only reflect media settings.
3866 			 */
3867 			if (device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
3868 				atw_filter_setup(sc);
3869 			break;
3870 		case IFF_UP:
3871 			error = atw_init(ifp);
3872 			break;
3873 		case IFF_RUNNING:
3874 			atw_stop(ifp, 1);
3875 			break;
3876 		case 0:
3877 			break;
3878 		}
3879 		break;
3880 	case SIOCADDMULTI:
3881 	case SIOCDELMULTI:
3882 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
3883 			if (ifp->if_flags & IFF_RUNNING)
3884 				atw_filter_setup(sc); /* do not rescan */
3885 			error = 0;
3886 		}
3887 		break;
3888 	case SIOCS80211:
3889 		ireq = data;
3890 		if (ireq->i_type == IEEE80211_IOC_FRAGTHRESHOLD) {
3891 			if ((error = kauth_authorize_network(curlwp->l_cred,
3892 			    KAUTH_NETWORK_INTERFACE,
3893 			    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp,
3894 			    (void *)cmd, NULL) != 0))
3895 				break;
3896 			if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
3897 			      ireq->i_val <= IEEE80211_FRAG_MAX))
3898 				error = EINVAL;
3899 			else
3900 				sc->sc_ic.ic_fragthreshold = ireq->i_val;
3901 			break;
3902 		}
3903 		/*FALLTHROUGH*/
3904 	default:
3905 		error = ieee80211_ioctl(&sc->sc_ic, cmd, data);
3906 		if (error == ENETRESET || error == ERESTART) {
3907 			if (is_running(ifp))
3908 				error = atw_init(ifp);
3909 			else
3910 				error = 0;
3911 		}
3912 		break;
3913 	}
3914 
3915 	/* Try to get more packets going. */
3916 	if (device_is_active(sc->sc_dev))
3917 		atw_start(ifp);
3918 
3919 	splx(s);
3920 	return (error);
3921 }
3922 
3923 static int
3924 atw_media_change(struct ifnet *ifp)
3925 {
3926 	int error;
3927 
3928 	error = ieee80211_media_change(ifp);
3929 	if (error == ENETRESET) {
3930 		if (is_running(ifp))
3931 			error = atw_init(ifp);
3932 		else
3933 			error = 0;
3934 	}
3935 	return error;
3936 }
3937