xref: /netbsd-src/sys/dev/ic/rtw.c (revision 274254cdae52594c1aa480a736aef78313d15c9c)
1 /* $NetBSD: rtw.c,v 1.108 2009/04/07 18:02:04 dyoung Exp $ */
2 /*-
3  * Copyright (c) 2004, 2005, 2006, 2007 David Young.  All rights
4  * reserved.
5  *
6  * Programmed for NetBSD by David Young.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The name of David Young may not be used to endorse or promote
17  *    products derived from this software without specific prior
18  *    written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
21  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
23  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
24  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
25  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
26  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
31  * OF SUCH DAMAGE.
32  */
33 /*
34  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
35  */
36 
37 #include <sys/cdefs.h>
38 __KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.108 2009/04/07 18:02:04 dyoung Exp $");
39 
40 #include "bpfilter.h"
41 
42 #include <sys/param.h>
43 #include <sys/sysctl.h>
44 #include <sys/systm.h>
45 #include <sys/callout.h>
46 #include <sys/mbuf.h>
47 #include <sys/malloc.h>
48 #include <sys/kernel.h>
49 #include <sys/time.h>
50 #include <sys/types.h>
51 #include <sys/device.h>
52 
53 #include <machine/endian.h>
54 #include <sys/bus.h>
55 #include <sys/intr.h>	/* splnet */
56 
57 #include <uvm/uvm_extern.h>
58 
59 #include <net/if.h>
60 #include <net/if_media.h>
61 #include <net/if_ether.h>
62 
63 #include <net80211/ieee80211_netbsd.h>
64 #include <net80211/ieee80211_var.h>
65 #include <net80211/ieee80211_radiotap.h>
66 
67 #if NBPFILTER > 0
68 #include <net/bpf.h>
69 #endif
70 
71 #include <dev/ic/rtwreg.h>
72 #include <dev/ic/rtwvar.h>
73 #include <dev/ic/rtwphyio.h>
74 #include <dev/ic/rtwphy.h>
75 
76 #include <dev/ic/smc93cx6var.h>
77 
78 static int rtw_rfprog_fallback = 0;
79 static int rtw_host_rfio = 0;
80 
81 #ifdef RTW_DEBUG
82 int rtw_debug = 0;
83 static int rtw_rxbufs_limit = RTW_RXQLEN;
84 #endif /* RTW_DEBUG */
85 
86 #define NEXT_ATTACH_STATE(sc, state) do {			\
87 	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
88 	    ("%s: attach state %s\n", __func__, #state));	\
89 	sc->sc_attach_state = state;				\
90 } while (0)
91 
92 int rtw_dwelltime = 200;	/* milliseconds */
93 static struct ieee80211_cipher rtw_cipher_wep;
94 
95 static void rtw_disable_interrupts(struct rtw_regs *);
96 static void rtw_enable_interrupts(struct rtw_softc *);
97 
98 static int rtw_init(struct ifnet *);
99 
100 static void rtw_start(struct ifnet *);
101 static void rtw_reset_oactive(struct rtw_softc *);
102 static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
103     struct ieee80211_node *);
104 static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
105 
106 static void rtw_io_enable(struct rtw_softc *, uint8_t, int);
107 static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
108 static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
109     const u_int8_t[IEEE80211_ADDR_LEN]);
110 static void rtw_key_update_end(struct ieee80211com *);
111 static void rtw_key_update_begin(struct ieee80211com *);
112 static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
113 static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
114 
115 static void rtw_led_attach(struct rtw_led_state *, void *);
116 static void rtw_led_detach(struct rtw_led_state *);
117 static void rtw_led_init(struct rtw_regs *);
118 static void rtw_led_slowblink(void *);
119 static void rtw_led_fastblink(void *);
120 static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
121 
122 static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
123 static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
124 #ifdef RTW_DEBUG
125 static void rtw_dump_rings(struct rtw_softc *sc);
126 static void rtw_print_txdesc(struct rtw_softc *, const char *,
127     struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
128 static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
129 static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
130 #endif /* RTW_DEBUG */
131 #ifdef RTW_DIAG
132 static void rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln);
133 #endif /* RTW_DIAG */
134 
135 /*
136  * Setup sysctl(3) MIB, hw.rtw.*
137  *
138  * TBD condition CTLFLAG_PERMANENT on being a module or not
139  */
140 SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
141 {
142 	int rc;
143 	const struct sysctlnode *cnode, *rnode;
144 
145 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
146 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
147 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
148 		goto err;
149 
150 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
151 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
152 	    "Realtek RTL818x 802.11 controls",
153 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
154 		goto err;
155 
156 #ifdef RTW_DEBUG
157 	/* control debugging printfs */
158 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
159 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
160 	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
161 	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
162 	    CTL_CREATE, CTL_EOL)) != 0)
163 		goto err;
164 
165 	/* Limit rx buffers, for simulating resource exhaustion. */
166 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
167 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
168 	    "rxbufs_limit",
169 	    SYSCTL_DESCR("Set rx buffers limit"),
170 	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
171 	    CTL_CREATE, CTL_EOL)) != 0)
172 		goto err;
173 
174 #endif /* RTW_DEBUG */
175 	/* set fallback RF programming method */
176 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
177 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
178 	    "rfprog_fallback",
179 	    SYSCTL_DESCR("Set fallback RF programming method"),
180 	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
181 	    CTL_CREATE, CTL_EOL)) != 0)
182 		goto err;
183 
184 	/* force host to control RF I/O bus */
185 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
186 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
187 	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
188 	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
189 	    CTL_CREATE, CTL_EOL)) != 0)
190 		goto err;
191 
192 	return;
193 err:
194 	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
195 }
196 
197 static int
198 rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
199 {
200 	int error, t;
201 	struct sysctlnode node;
202 
203 	node = *rnode;
204 	t = *(int*)rnode->sysctl_data;
205 	node.sysctl_data = &t;
206 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
207 	if (error || newp == NULL)
208 		return (error);
209 
210 	if (t < lower || t > upper)
211 		return (EINVAL);
212 
213 	*(int*)rnode->sysctl_data = t;
214 
215 	return (0);
216 }
217 
218 static int
219 rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
220 {
221 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
222 	    __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
223 }
224 
225 static int
226 rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
227 {
228 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
229 }
230 
231 #ifdef RTW_DEBUG
232 static int
233 rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
234 {
235 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
236 	    0, RTW_DEBUG_MAX);
237 }
238 
239 static int
240 rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
241 {
242 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
243 	    0, RTW_RXQLEN);
244 }
245 
246 static void
247 rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
248 {
249 #define PRINTREG32(sc, reg)				\
250 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
251 	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
252 	    dvname, reg, RTW_READ(regs, reg)))
253 
254 #define PRINTREG16(sc, reg)				\
255 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
256 	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
257 	    dvname, reg, RTW_READ16(regs, reg)))
258 
259 #define PRINTREG8(sc, reg)				\
260 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
261 	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
262 	    dvname, reg, RTW_READ8(regs, reg)))
263 
264 	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
265 
266 	PRINTREG32(regs, RTW_IDR0);
267 	PRINTREG32(regs, RTW_IDR1);
268 	PRINTREG32(regs, RTW_MAR0);
269 	PRINTREG32(regs, RTW_MAR1);
270 	PRINTREG32(regs, RTW_TSFTRL);
271 	PRINTREG32(regs, RTW_TSFTRH);
272 	PRINTREG32(regs, RTW_TLPDA);
273 	PRINTREG32(regs, RTW_TNPDA);
274 	PRINTREG32(regs, RTW_THPDA);
275 	PRINTREG32(regs, RTW_TCR);
276 	PRINTREG32(regs, RTW_RCR);
277 	PRINTREG32(regs, RTW_TINT);
278 	PRINTREG32(regs, RTW_TBDA);
279 	PRINTREG32(regs, RTW_ANAPARM);
280 	PRINTREG32(regs, RTW_BB);
281 	PRINTREG32(regs, RTW_PHYCFG);
282 	PRINTREG32(regs, RTW_WAKEUP0L);
283 	PRINTREG32(regs, RTW_WAKEUP0H);
284 	PRINTREG32(regs, RTW_WAKEUP1L);
285 	PRINTREG32(regs, RTW_WAKEUP1H);
286 	PRINTREG32(regs, RTW_WAKEUP2LL);
287 	PRINTREG32(regs, RTW_WAKEUP2LH);
288 	PRINTREG32(regs, RTW_WAKEUP2HL);
289 	PRINTREG32(regs, RTW_WAKEUP2HH);
290 	PRINTREG32(regs, RTW_WAKEUP3LL);
291 	PRINTREG32(regs, RTW_WAKEUP3LH);
292 	PRINTREG32(regs, RTW_WAKEUP3HL);
293 	PRINTREG32(regs, RTW_WAKEUP3HH);
294 	PRINTREG32(regs, RTW_WAKEUP4LL);
295 	PRINTREG32(regs, RTW_WAKEUP4LH);
296 	PRINTREG32(regs, RTW_WAKEUP4HL);
297 	PRINTREG32(regs, RTW_WAKEUP4HH);
298 	PRINTREG32(regs, RTW_DK0);
299 	PRINTREG32(regs, RTW_DK1);
300 	PRINTREG32(regs, RTW_DK2);
301 	PRINTREG32(regs, RTW_DK3);
302 	PRINTREG32(regs, RTW_RETRYCTR);
303 	PRINTREG32(regs, RTW_RDSAR);
304 	PRINTREG32(regs, RTW_FER);
305 	PRINTREG32(regs, RTW_FEMR);
306 	PRINTREG32(regs, RTW_FPSR);
307 	PRINTREG32(regs, RTW_FFER);
308 
309 	/* 16-bit registers */
310 	PRINTREG16(regs, RTW_BRSR);
311 	PRINTREG16(regs, RTW_IMR);
312 	PRINTREG16(regs, RTW_ISR);
313 	PRINTREG16(regs, RTW_BCNITV);
314 	PRINTREG16(regs, RTW_ATIMWND);
315 	PRINTREG16(regs, RTW_BINTRITV);
316 	PRINTREG16(regs, RTW_ATIMTRITV);
317 	PRINTREG16(regs, RTW_CRC16ERR);
318 	PRINTREG16(regs, RTW_CRC0);
319 	PRINTREG16(regs, RTW_CRC1);
320 	PRINTREG16(regs, RTW_CRC2);
321 	PRINTREG16(regs, RTW_CRC3);
322 	PRINTREG16(regs, RTW_CRC4);
323 	PRINTREG16(regs, RTW_CWR);
324 
325 	/* 8-bit registers */
326 	PRINTREG8(regs, RTW_CR);
327 	PRINTREG8(regs, RTW_9346CR);
328 	PRINTREG8(regs, RTW_CONFIG0);
329 	PRINTREG8(regs, RTW_CONFIG1);
330 	PRINTREG8(regs, RTW_CONFIG2);
331 	PRINTREG8(regs, RTW_MSR);
332 	PRINTREG8(regs, RTW_CONFIG3);
333 	PRINTREG8(regs, RTW_CONFIG4);
334 	PRINTREG8(regs, RTW_TESTR);
335 	PRINTREG8(regs, RTW_PSR);
336 	PRINTREG8(regs, RTW_SCR);
337 	PRINTREG8(regs, RTW_PHYDELAY);
338 	PRINTREG8(regs, RTW_CRCOUNT);
339 	PRINTREG8(regs, RTW_PHYADDR);
340 	PRINTREG8(regs, RTW_PHYDATAW);
341 	PRINTREG8(regs, RTW_PHYDATAR);
342 	PRINTREG8(regs, RTW_CONFIG5);
343 	PRINTREG8(regs, RTW_TPPOLL);
344 
345 	PRINTREG16(regs, RTW_BSSID16);
346 	PRINTREG32(regs, RTW_BSSID32);
347 #undef PRINTREG32
348 #undef PRINTREG16
349 #undef PRINTREG8
350 }
351 #endif /* RTW_DEBUG */
352 
353 void
354 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
355 {
356 	struct rtw_regs *regs = &sc->sc_regs;
357 
358 	uint32_t tcr;
359 	tcr = RTW_READ(regs, RTW_TCR);
360 	tcr &= ~RTW_TCR_LBK_MASK;
361 	if (enable)
362 		tcr |= RTW_TCR_LBK_CONT;
363 	else
364 		tcr |= RTW_TCR_LBK_NORMAL;
365 	RTW_WRITE(regs, RTW_TCR, tcr);
366 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
367 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
368 	rtw_txdac_enable(sc, !enable);
369 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
370 	rtw_set_access(regs, RTW_ACCESS_NONE);
371 }
372 
373 #ifdef RTW_DEBUG
374 static const char *
375 rtw_access_string(enum rtw_access access)
376 {
377 	switch (access) {
378 	case RTW_ACCESS_NONE:
379 		return "none";
380 	case RTW_ACCESS_CONFIG:
381 		return "config";
382 	case RTW_ACCESS_ANAPARM:
383 		return "anaparm";
384 	default:
385 		return "unknown";
386 	}
387 }
388 #endif /* RTW_DEBUG */
389 
390 static void
391 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
392 {
393 	KASSERT(/* naccess >= RTW_ACCESS_NONE && */
394 	    naccess <= RTW_ACCESS_ANAPARM);
395 	KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
396 	    regs->r_access <= RTW_ACCESS_ANAPARM);
397 
398 	if (naccess == regs->r_access)
399 		return;
400 
401 	switch (naccess) {
402 	case RTW_ACCESS_NONE:
403 		switch (regs->r_access) {
404 		case RTW_ACCESS_ANAPARM:
405 			rtw_anaparm_enable(regs, 0);
406 			/*FALLTHROUGH*/
407 		case RTW_ACCESS_CONFIG:
408 			rtw_config0123_enable(regs, 0);
409 			/*FALLTHROUGH*/
410 		case RTW_ACCESS_NONE:
411 			break;
412 		}
413 		break;
414 	case RTW_ACCESS_CONFIG:
415 		switch (regs->r_access) {
416 		case RTW_ACCESS_NONE:
417 			rtw_config0123_enable(regs, 1);
418 			/*FALLTHROUGH*/
419 		case RTW_ACCESS_CONFIG:
420 			break;
421 		case RTW_ACCESS_ANAPARM:
422 			rtw_anaparm_enable(regs, 0);
423 			break;
424 		}
425 		break;
426 	case RTW_ACCESS_ANAPARM:
427 		switch (regs->r_access) {
428 		case RTW_ACCESS_NONE:
429 			rtw_config0123_enable(regs, 1);
430 			/*FALLTHROUGH*/
431 		case RTW_ACCESS_CONFIG:
432 			rtw_anaparm_enable(regs, 1);
433 			/*FALLTHROUGH*/
434 		case RTW_ACCESS_ANAPARM:
435 			break;
436 		}
437 		break;
438 	}
439 }
440 
441 void
442 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
443 {
444 	rtw_set_access1(regs, access);
445 	RTW_DPRINTF(RTW_DEBUG_ACCESS,
446 	    ("%s: access %s -> %s\n", __func__,
447 	    rtw_access_string(regs->r_access),
448 	    rtw_access_string(access)));
449 	regs->r_access = access;
450 }
451 
452 /*
453  * Enable registers, switch register banks.
454  */
455 void
456 rtw_config0123_enable(struct rtw_regs *regs, int enable)
457 {
458 	uint8_t ecr;
459 	ecr = RTW_READ8(regs, RTW_9346CR);
460 	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
461 	if (enable)
462 		ecr |= RTW_9346CR_EEM_CONFIG;
463 	else {
464 		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
465 		ecr |= RTW_9346CR_EEM_NORMAL;
466 	}
467 	RTW_WRITE8(regs, RTW_9346CR, ecr);
468 	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
469 }
470 
471 /* requires rtw_config0123_enable(, 1) */
472 void
473 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
474 {
475 	uint8_t cfg3;
476 
477 	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
478 	cfg3 |= RTW_CONFIG3_CLKRUNEN;
479 	if (enable)
480 		cfg3 |= RTW_CONFIG3_PARMEN;
481 	else
482 		cfg3 &= ~RTW_CONFIG3_PARMEN;
483 	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
484 	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
485 }
486 
487 /* requires rtw_anaparm_enable(, 1) */
488 void
489 rtw_txdac_enable(struct rtw_softc *sc, int enable)
490 {
491 	uint32_t anaparm;
492 	struct rtw_regs *regs = &sc->sc_regs;
493 
494 	anaparm = RTW_READ(regs, RTW_ANAPARM);
495 	if (enable)
496 		anaparm &= ~RTW_ANAPARM_TXDACOFF;
497 	else
498 		anaparm |= RTW_ANAPARM_TXDACOFF;
499 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
500 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
501 }
502 
503 static inline int
504 rtw_chip_reset1(struct rtw_regs *regs, device_t dev)
505 {
506 	uint8_t cr;
507 	int i;
508 
509 	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
510 
511 	RTW_WBR(regs, RTW_CR, RTW_CR);
512 
513 	for (i = 0; i < 1000; i++) {
514 		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
515 			RTW_DPRINTF(RTW_DEBUG_RESET,
516 			    ("%s: reset in %dus\n", device_xname(dev), i));
517 			return 0;
518 		}
519 		RTW_RBR(regs, RTW_CR, RTW_CR);
520 		DELAY(10); /* 10us */
521 	}
522 
523 	aprint_error_dev(dev, "reset failed\n");
524 	return ETIMEDOUT;
525 }
526 
527 static inline int
528 rtw_chip_reset(struct rtw_regs *regs, device_t dev)
529 {
530 	uint32_t tcr;
531 
532 	/* from Linux driver */
533 	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
534 	      __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
535 
536 	RTW_WRITE(regs, RTW_TCR, tcr);
537 
538 	RTW_WBW(regs, RTW_CR, RTW_TCR);
539 
540 	return rtw_chip_reset1(regs, dev);
541 }
542 
543 static int
544 rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
545 {
546 	struct ieee80211_key keycopy;
547 
548 	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
549 
550 	keycopy = *k;
551 	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
552 
553 	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
554 }
555 
556 static int
557 rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
558 {
559 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
560 
561 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__,
562 	    k->wk_keyix));
563 
564 	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
565 
566 	if (k->wk_keylen != 0 &&
567 	    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP)
568 		sc->sc_flags &= ~RTW_F_DK_VALID;
569 
570 	return 1;
571 }
572 
573 static int
574 rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
575     const u_int8_t mac[IEEE80211_ADDR_LEN])
576 {
577 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
578 
579 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
580 
581 	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
582 
583 	sc->sc_flags &= ~RTW_F_DK_VALID;
584 
585 	return 1;
586 }
587 
588 static void
589 rtw_key_update_begin(struct ieee80211com *ic)
590 {
591 #ifdef RTW_DEBUG
592 	struct ifnet *ifp = ic->ic_ifp;
593 	struct rtw_softc *sc = ifp->if_softc;
594 #endif
595 
596 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
597 }
598 
599 static void
600 rtw_tx_kick(struct rtw_regs *regs, uint8_t ringsel)
601 {
602 	uint8_t tppoll;
603 
604 	tppoll = RTW_READ8(regs, RTW_TPPOLL);
605 	tppoll &= ~RTW_TPPOLL_SALL;
606 	tppoll |= ringsel & RTW_TPPOLL_ALL;
607 	RTW_WRITE8(regs, RTW_TPPOLL, tppoll);
608 	RTW_SYNC(regs, RTW_TPPOLL, RTW_TPPOLL);
609 }
610 
611 static void
612 rtw_key_update_end(struct ieee80211com *ic)
613 {
614 	struct ifnet *ifp = ic->ic_ifp;
615 	struct rtw_softc *sc = ifp->if_softc;
616 
617 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
618 
619 	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
620 	    !device_is_active(sc->sc_dev))
621 		return;
622 
623 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
624 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
625 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
626 	    (ifp->if_flags & IFF_RUNNING) != 0);
627 }
628 
629 static bool
630 rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
631 {
632 	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
633 		return false;
634 
635 	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
636 		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
637 }
638 
639 static void
640 rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
641 {
642 	uint8_t psr, scr;
643 	int i, keylen = 0;
644 	struct rtw_regs *regs;
645 	union rtw_keys *rk;
646 
647 	regs = &sc->sc_regs;
648 	rk = &sc->sc_keys;
649 
650 	(void)memset(rk, 0, sizeof(rk));
651 
652 	/* Temporarily use software crypto for all keys. */
653 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
654 		if (wk[i].wk_cipher == &rtw_cipher_wep)
655 			wk[i].wk_cipher = &ieee80211_cipher_wep;
656 	}
657 
658 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
659 
660 	psr = RTW_READ8(regs, RTW_PSR);
661 	scr = RTW_READ8(regs, RTW_SCR);
662 	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
663 
664 	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
665 		goto out;
666 
667 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
668 		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
669 			continue;
670 		if (i == txkey) {
671 			keylen = wk[i].wk_keylen;
672 			break;
673 		}
674 		keylen = MAX(keylen, wk[i].wk_keylen);
675 	}
676 
677 	if (keylen == 5)
678 		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
679 	else if (keylen == 13)
680 		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
681 
682 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
683 		if (wk[i].wk_keylen != keylen ||
684 		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
685 			continue;
686 		/* h/w will decrypt, s/w still strips headers */
687 		wk[i].wk_cipher = &rtw_cipher_wep;
688 		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
689 	}
690 
691 out:
692 	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
693 
694 	bus_space_write_region_stream_4(regs->r_bt, regs->r_bh,
695 	    RTW_DK0, rk->rk_words, __arraycount(rk->rk_words));
696 
697 	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
698 	    BUS_SPACE_BARRIER_SYNC);
699 
700 	RTW_DPRINTF(RTW_DEBUG_KEY,
701 	    ("%s.%d: scr %02" PRIx8 ", keylen %d\n", __func__, __LINE__, scr,
702 	     keylen));
703 
704 	RTW_WBW(regs, RTW_DK0, RTW_PSR);
705 	RTW_WRITE8(regs, RTW_PSR, psr);
706 	RTW_WBW(regs, RTW_PSR, RTW_SCR);
707 	RTW_WRITE8(regs, RTW_SCR, scr);
708 	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
709 	rtw_set_access(regs, RTW_ACCESS_NONE);
710 	sc->sc_flags |= RTW_F_DK_VALID;
711 }
712 
713 static inline int
714 rtw_recall_eeprom(struct rtw_regs *regs, device_t dev)
715 {
716 	int i;
717 	uint8_t ecr;
718 
719 	ecr = RTW_READ8(regs, RTW_9346CR);
720 	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
721 	RTW_WRITE8(regs, RTW_9346CR, ecr);
722 
723 	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
724 
725 	/* wait 25ms for completion */
726 	for (i = 0; i < 250; i++) {
727 		ecr = RTW_READ8(regs, RTW_9346CR);
728 		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
729 			RTW_DPRINTF(RTW_DEBUG_RESET,
730 			    ("%s: recall EEPROM in %dus\n", device_xname(dev),
731 			    i * 100));
732 			return 0;
733 		}
734 		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
735 		DELAY(100);
736 	}
737 	aprint_error_dev(dev, "recall EEPROM failed\n");
738 	return ETIMEDOUT;
739 }
740 
741 static inline int
742 rtw_reset(struct rtw_softc *sc)
743 {
744 	int rc;
745 	uint8_t config1;
746 
747 	sc->sc_flags &= ~RTW_F_DK_VALID;
748 
749 	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev)) != 0)
750 		return rc;
751 
752 	rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev);
753 
754 	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
755 	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
756 	/* TBD turn off maximum power saving? */
757 
758 	return 0;
759 }
760 
761 static inline int
762 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
763     u_int ndescs)
764 {
765 	int i, rc = 0;
766 	for (i = 0; i < ndescs; i++) {
767 		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
768 		    0, 0, &descs[i].ts_dmamap);
769 		if (rc != 0)
770 			break;
771 	}
772 	return rc;
773 }
774 
775 static inline int
776 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
777     u_int ndescs)
778 {
779 	int i, rc = 0;
780 	for (i = 0; i < ndescs; i++) {
781 		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
782 		    &descs[i].rs_dmamap);
783 		if (rc != 0)
784 			break;
785 	}
786 	return rc;
787 }
788 
789 static inline void
790 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
791     u_int ndescs)
792 {
793 	int i;
794 	for (i = 0; i < ndescs; i++) {
795 		if (descs[i].rs_dmamap != NULL)
796 			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
797 	}
798 }
799 
800 static inline void
801 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
802     u_int ndescs)
803 {
804 	int i;
805 	for (i = 0; i < ndescs; i++) {
806 		if (descs[i].ts_dmamap != NULL)
807 			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
808 	}
809 }
810 
811 static inline void
812 rtw_srom_free(struct rtw_srom *sr)
813 {
814 	sr->sr_size = 0;
815 	if (sr->sr_content == NULL)
816 		return;
817 	free(sr->sr_content, M_DEVBUF);
818 	sr->sr_content = NULL;
819 }
820 
821 static void
822 rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
823     uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
824 {
825 	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
826 	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
827 	*rcr |= RTW_RCR_ENCS1;
828 	*rfchipid = RTW_RFCHIPID_PHILIPS;
829 }
830 
831 static int
832 rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
833     enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
834     device_t dev)
835 {
836 	int i;
837 	const char *rfname, *paname;
838 	char scratch[sizeof("unknown 0xXX")];
839 	uint16_t srom_version;
840 	uint8_t mac[IEEE80211_ADDR_LEN];
841 
842 	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
843 	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
844 
845 	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
846 
847 	if (srom_version <= 0x0101) {
848 		aprint_error_dev(dev,
849 		    "SROM version %d.%d is not understood, "
850 		    "limping along with defaults\n",
851 		    srom_version >> 8, srom_version & 0xff);
852 		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
853 		return 0;
854 	} else {
855 		aprint_verbose_dev(dev, "SROM version %d.%d",
856 		    srom_version >> 8, srom_version & 0xff);
857 	}
858 
859 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
860 		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
861 
862 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
863 	    ("%s: EEPROM MAC %s\n", device_xname(dev), ether_sprintf(mac)));
864 
865 	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
866 
867 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
868 		*flags |= RTW_F_ANTDIV;
869 
870 	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
871 	 * to be reversed.
872 	 */
873 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
874 		*flags |= RTW_F_DIGPHY;
875 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
876 		*flags |= RTW_F_DFLANTB;
877 
878 	*rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
879 	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
880 
881 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
882 		*flags |= RTW_C_RXWEP_104;
883 
884 	*flags |= RTW_C_RXWEP_40;	/* XXX */
885 
886 	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
887 	switch (*rfchipid) {
888 	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
889 		rfname = "GCT GRF5101";
890 		paname = "Winspring WS9901";
891 		break;
892 	case RTW_RFCHIPID_MAXIM:
893 		rfname = "Maxim MAX2820";	/* guess */
894 		paname = "Maxim MAX2422";	/* guess */
895 		break;
896 	case RTW_RFCHIPID_INTERSIL:
897 		rfname = "Intersil HFA3873";	/* guess */
898 		paname = "Intersil <unknown>";
899 		break;
900 	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
901 		rfname = "Philips SA2400A";
902 		paname = "Philips SA2411";
903 		break;
904 	case RTW_RFCHIPID_RFMD:
905 		/* this is the same front-end as an atw(4)! */
906 		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
907 			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
908 			 "SYN: Silicon Labs Si4126";	/* inferred from
909 			 				 * reference driver
910 							 */
911 		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
912 		break;
913 	case RTW_RFCHIPID_RESERVED:
914 		rfname = paname = "reserved";
915 		break;
916 	default:
917 		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
918 		rfname = paname = scratch;
919 	}
920 	aprint_normal_dev(dev, "RF: %s, PA: %s\n", rfname, paname);
921 
922 	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
923 	case RTW_CONFIG0_GL_USA:
924 	case _RTW_CONFIG0_GL_USA:
925 		*locale = RTW_LOCALE_USA;
926 		break;
927 	case RTW_CONFIG0_GL_EUROPE:
928 		*locale = RTW_LOCALE_EUROPE;
929 		break;
930 	case RTW_CONFIG0_GL_JAPAN:
931 		*locale = RTW_LOCALE_JAPAN;
932 		break;
933 	default:
934 		*locale = RTW_LOCALE_UNKNOWN;
935 		break;
936 	}
937 	return 0;
938 }
939 
940 /* Returns -1 on failure. */
941 static int
942 rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
943     device_t dev)
944 {
945 	int rc;
946 	struct seeprom_descriptor sd;
947 	uint8_t ecr;
948 
949 	(void)memset(&sd, 0, sizeof(sd));
950 
951 	ecr = RTW_READ8(regs, RTW_9346CR);
952 
953 	if ((flags & RTW_F_9356SROM) != 0) {
954 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n",
955 		    device_xname(dev)));
956 		sr->sr_size = 256;
957 		sd.sd_chip = C56_66;
958 	} else {
959 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n",
960 		    device_xname(dev)));
961 		sr->sr_size = 128;
962 		sd.sd_chip = C46;
963 	}
964 
965 	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
966 	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
967 	ecr |= RTW_9346CR_EEM_PROGRAM;
968 
969 	RTW_WRITE8(regs, RTW_9346CR, ecr);
970 
971 	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
972 
973 	if (sr->sr_content == NULL) {
974 		aprint_error_dev(dev, "unable to allocate SROM buffer\n");
975 		return ENOMEM;
976 	}
977 
978 	(void)memset(sr->sr_content, 0, sr->sr_size);
979 
980 	/* RTL8180 has a single 8-bit register for controlling the
981 	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
982 	 * input/output sense is the reverse of read_seeprom's.
983 	 */
984 	sd.sd_tag = regs->r_bt;
985 	sd.sd_bsh = regs->r_bh;
986 	sd.sd_regsize = 1;
987 	sd.sd_control_offset = RTW_9346CR;
988 	sd.sd_status_offset = RTW_9346CR;
989 	sd.sd_dataout_offset = RTW_9346CR;
990 	sd.sd_CK = RTW_9346CR_EESK;
991 	sd.sd_CS = RTW_9346CR_EECS;
992 	sd.sd_DI = RTW_9346CR_EEDO;
993 	sd.sd_DO = RTW_9346CR_EEDI;
994 	/* make read_seeprom enter EEPROM read/write mode */
995 	sd.sd_MS = ecr;
996 	sd.sd_RDY = 0;
997 
998 	/* TBD bus barriers */
999 	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
1000 		aprint_error_dev(dev, "could not read SROM\n");
1001 		free(sr->sr_content, M_DEVBUF);
1002 		sr->sr_content = NULL;
1003 		return -1;	/* XXX */
1004 	}
1005 
1006 	/* end EEPROM read/write mode */
1007 	RTW_WRITE8(regs, RTW_9346CR,
1008 	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
1009 	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
1010 
1011 	if ((rc = rtw_recall_eeprom(regs, dev)) != 0)
1012 		return rc;
1013 
1014 #ifdef RTW_DEBUG
1015 	{
1016 		int i;
1017 		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1018 		    ("\n%s: serial ROM:\n\t", device_xname(dev)));
1019 		for (i = 0; i < sr->sr_size/2; i++) {
1020 			if (((i % 8) == 0) && (i != 0))
1021 				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1022 			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1023 			    (" %04x", sr->sr_content[i]));
1024 		}
1025 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1026 	}
1027 #endif /* RTW_DEBUG */
1028 	return 0;
1029 }
1030 
1031 static void
1032 rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1033     device_t dev)
1034 {
1035 	uint8_t cfg4;
1036 	const char *method;
1037 
1038 	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1039 
1040 	switch (rfchipid) {
1041 	default:
1042 		cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1043 		method = "fallback";
1044 		break;
1045 	case RTW_RFCHIPID_INTERSIL:
1046 		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1047 		method = "Intersil";
1048 		break;
1049 	case RTW_RFCHIPID_PHILIPS:
1050 		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1051 		method = "Philips";
1052 		break;
1053 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1054 	case RTW_RFCHIPID_RFMD:
1055 		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1056 		method = "RFMD";
1057 		break;
1058 	}
1059 
1060 	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1061 
1062 	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1063 
1064 	RTW_DPRINTF(RTW_DEBUG_INIT,
1065 	    ("%s: %s RF programming method, %#02x\n", device_xname(dev), method,
1066 	    RTW_READ8(regs, RTW_CONFIG4)));
1067 }
1068 
1069 static inline void
1070 rtw_init_channels(enum rtw_locale locale,
1071     struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1], device_t dev)
1072 {
1073 	int i;
1074 	const char *name = NULL;
1075 #define ADD_CHANNEL(_chans, _chan) do {			\
1076 	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1077 	(*_chans)[_chan].ic_freq =				\
1078 	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1079 } while (0)
1080 
1081 	switch (locale) {
1082 	case RTW_LOCALE_USA:	/* 1-11 */
1083 		name = "USA";
1084 		for (i = 1; i <= 11; i++)
1085 			ADD_CHANNEL(chans, i);
1086 		break;
1087 	case RTW_LOCALE_JAPAN:	/* 1-14 */
1088 		name = "Japan";
1089 		ADD_CHANNEL(chans, 14);
1090 		for (i = 1; i <= 14; i++)
1091 			ADD_CHANNEL(chans, i);
1092 		break;
1093 	case RTW_LOCALE_EUROPE:	/* 1-13 */
1094 		name = "Europe";
1095 		for (i = 1; i <= 13; i++)
1096 			ADD_CHANNEL(chans, i);
1097 		break;
1098 	default:			/* 10-11 allowed by most countries */
1099 		name = "<unknown>";
1100 		for (i = 10; i <= 11; i++)
1101 			ADD_CHANNEL(chans, i);
1102 		break;
1103 	}
1104 	aprint_normal_dev(dev, "Geographic Location %s\n", name);
1105 #undef ADD_CHANNEL
1106 }
1107 
1108 
1109 static inline void
1110 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1111 {
1112 	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1113 
1114 	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1115 	case RTW_CONFIG0_GL_USA:
1116 	case _RTW_CONFIG0_GL_USA:
1117 		*locale = RTW_LOCALE_USA;
1118 		break;
1119 	case RTW_CONFIG0_GL_JAPAN:
1120 		*locale = RTW_LOCALE_JAPAN;
1121 		break;
1122 	case RTW_CONFIG0_GL_EUROPE:
1123 		*locale = RTW_LOCALE_EUROPE;
1124 		break;
1125 	default:
1126 		*locale = RTW_LOCALE_UNKNOWN;
1127 		break;
1128 	}
1129 }
1130 
1131 static inline int
1132 rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1133     device_t dev)
1134 {
1135 	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1136 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1137 	};
1138 	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1139 	          idr1 = RTW_READ(regs, RTW_IDR1);
1140 
1141 	(*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1142 	(*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1143 	(*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1144 	(*addr)[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
1145 
1146 	(*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1147 	(*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1148 
1149 	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1150 		aprint_error_dev(dev,
1151 		    "could not get mac address, attach failed\n");
1152 		return ENXIO;
1153 	}
1154 
1155 	aprint_normal_dev(dev, "802.11 address %s\n", ether_sprintf(*addr));
1156 
1157 	return 0;
1158 }
1159 
1160 static uint8_t
1161 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1162     struct ieee80211_channel *chan)
1163 {
1164 	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1165 	KASSERT(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14);
1166 	return RTW_SR_GET(sr, idx);
1167 }
1168 
1169 static void
1170 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1171 {
1172 	int pri;
1173 	/* nfree: the number of free descriptors in each ring.
1174 	 * The beacon ring is a special case: I do not let the
1175 	 * driver use all of the descriptors on the beacon ring.
1176 	 * The reasons are two-fold:
1177 	 *
1178 	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1179 	 * updated, so the driver cannot easily know if the descriptor
1180 	 * belongs to it, or if it is racing the NIC.  If the NIC
1181 	 * does not OWN every descriptor, then the driver can safely
1182 	 * update the descriptors when RTW_TBDA points at tdb_next.
1183 	 *
1184 	 * (2) I hope that the NIC will process more than one BEACON
1185 	 * descriptor in a single beacon interval, since that will
1186 	 * enable multiple-BSS support.  Since the NIC does not
1187 	 * clear the OWN bit, there is no natural place for it to
1188 	 * stop processing BEACON desciptors.  Maybe it will *not*
1189 	 * stop processing them!  I do not want to chance the NIC
1190 	 * looping around and around a saturated beacon ring, so
1191 	 * I will leave one descriptor unOWNed at all times.
1192 	 */
1193 	u_int nfree[RTW_NTXPRI] =
1194 	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1195 	     RTW_NTXDESCBCN - 1};
1196 
1197 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1198 		tdb[pri].tdb_nfree = nfree[pri];
1199 		tdb[pri].tdb_next = 0;
1200 	}
1201 }
1202 
1203 static int
1204 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1205 {
1206 	int i;
1207 	struct rtw_txsoft *ts;
1208 
1209 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1210 	SIMPLEQ_INIT(&tsb->tsb_freeq);
1211 	for (i = 0; i < tsb->tsb_ndesc; i++) {
1212 		ts = &tsb->tsb_desc[i];
1213 		ts->ts_mbuf = NULL;
1214 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1215 	}
1216 	tsb->tsb_tx_timer = 0;
1217 	return 0;
1218 }
1219 
1220 static void
1221 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1222 {
1223 	int pri;
1224 	for (pri = 0; pri < RTW_NTXPRI; pri++)
1225 		rtw_txsoft_blk_init(&tsb[pri]);
1226 }
1227 
1228 static inline void
1229 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1230 {
1231 	KASSERT(nsync <= rdb->rdb_ndesc);
1232 	/* sync to end of ring */
1233 	if (desc0 + nsync > rdb->rdb_ndesc) {
1234 		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1235 		    offsetof(struct rtw_descs, hd_rx[desc0]),
1236 		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1237 		nsync -= (rdb->rdb_ndesc - desc0);
1238 		desc0 = 0;
1239 	}
1240 
1241 	KASSERT(desc0 < rdb->rdb_ndesc);
1242 	KASSERT(nsync <= rdb->rdb_ndesc);
1243 	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1244 
1245 	/* sync what remains */
1246 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1247 	    offsetof(struct rtw_descs, hd_rx[desc0]),
1248 	    sizeof(struct rtw_rxdesc) * nsync, ops);
1249 }
1250 
1251 static void
1252 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1253 {
1254 	/* sync to end of ring */
1255 	if (desc0 + nsync > tdb->tdb_ndesc) {
1256 		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1257 		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1258 		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1259 		    ops);
1260 		nsync -= (tdb->tdb_ndesc - desc0);
1261 		desc0 = 0;
1262 	}
1263 
1264 	/* sync what remains */
1265 	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1266 	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1267 	    sizeof(struct rtw_txdesc) * nsync, ops);
1268 }
1269 
1270 static void
1271 rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1272 {
1273 	int pri;
1274 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1275 		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1276 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1277 	}
1278 }
1279 
1280 static void
1281 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1282 {
1283 	int i;
1284 	struct rtw_rxsoft *rs;
1285 
1286 	for (i = 0; i < RTW_RXQLEN; i++) {
1287 		rs = &desc[i];
1288 		if (rs->rs_mbuf == NULL)
1289 			continue;
1290 		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1291 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1292 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1293 		m_freem(rs->rs_mbuf);
1294 		rs->rs_mbuf = NULL;
1295 	}
1296 }
1297 
1298 static inline int
1299 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1300 {
1301 	int rc;
1302 	struct mbuf *m;
1303 
1304 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1305 	if (m == NULL)
1306 		return ENOBUFS;
1307 
1308 	MCLGET(m, M_DONTWAIT);
1309 	if ((m->m_flags & M_EXT) == 0) {
1310 		m_freem(m);
1311 		return ENOBUFS;
1312 	}
1313 
1314 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1315 
1316 	if (rs->rs_mbuf != NULL)
1317 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1318 
1319 	rs->rs_mbuf = NULL;
1320 
1321 	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1322 	if (rc != 0) {
1323 		m_freem(m);
1324 		return -1;
1325 	}
1326 
1327 	rs->rs_mbuf = m;
1328 
1329 	return 0;
1330 }
1331 
1332 static int
1333 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1334     int *ndesc, device_t dev)
1335 {
1336 	int i, rc = 0;
1337 	struct rtw_rxsoft *rs;
1338 
1339 	for (i = 0; i < RTW_RXQLEN; i++) {
1340 		rs = &desc[i];
1341 		/* we're in rtw_init, so there should be no mbufs allocated */
1342 		KASSERT(rs->rs_mbuf == NULL);
1343 #ifdef RTW_DEBUG
1344 		if (i == rtw_rxbufs_limit) {
1345 			aprint_error_dev(dev, "TEST hit %d-buffer limit\n", i);
1346 			rc = ENOBUFS;
1347 			break;
1348 		}
1349 #endif /* RTW_DEBUG */
1350 		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1351 			aprint_error_dev(dev,
1352 			    "rtw_rxsoft_alloc failed, %d buffers, rc %d\n",
1353 			    i, rc);
1354 			break;
1355 		}
1356 	}
1357 	*ndesc = i;
1358 	return rc;
1359 }
1360 
1361 static inline void
1362 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1363     int idx, int kick)
1364 {
1365 	int is_last = (idx == rdb->rdb_ndesc - 1);
1366 	uint32_t ctl, octl, obuf;
1367 	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1368 
1369 	/* sync the mbuf before the descriptor */
1370 	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1371 	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1372 
1373 	obuf = rd->rd_buf;
1374 	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1375 
1376 	ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1377 	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1378 
1379 	if (is_last)
1380 		ctl |= RTW_RXCTL_EOR;
1381 
1382 	octl = rd->rd_ctl;
1383 	rd->rd_ctl = htole32(ctl);
1384 
1385 	RTW_DPRINTF(
1386 	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1387 	         : RTW_DEBUG_RECV_DESC,
1388 	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1389 	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1390 	     le32toh(rd->rd_ctl)));
1391 
1392 	/* sync the descriptor */
1393 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1394 	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1395 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1396 }
1397 
1398 static void
1399 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1400 {
1401 	int i;
1402 	struct rtw_rxdesc *rd;
1403 	struct rtw_rxsoft *rs;
1404 
1405 	for (i = 0; i < rdb->rdb_ndesc; i++) {
1406 		rd = &rdb->rdb_desc[i];
1407 		rs = &ctl[i];
1408 		rtw_rxdesc_init(rdb, rs, i, kick);
1409 	}
1410 }
1411 
1412 static void
1413 rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1414 {
1415 	struct rtw_regs *regs = &sc->sc_regs;
1416 	uint8_t cr;
1417 
1418 	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1419 	    enable ? "enable" : "disable", flags));
1420 
1421 	cr = RTW_READ8(regs, RTW_CR);
1422 
1423 	/* XXX reference source does not enable MULRW */
1424 	/* enable PCI Read/Write Multiple */
1425 	cr |= RTW_CR_MULRW;
1426 
1427 	/* The receive engine will always start at RDSAR.  */
1428 	if (enable && (flags & ~cr & RTW_CR_RE)) {
1429 		struct rtw_rxdesc_blk *rdb;
1430 		rdb = &sc->sc_rxdesc_blk;
1431 		rdb->rdb_next = 0;
1432 	}
1433 
1434 	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1435 	if (enable)
1436 		cr |= flags;
1437 	else
1438 		cr &= ~flags;
1439 	RTW_WRITE8(regs, RTW_CR, cr);
1440 	RTW_SYNC(regs, RTW_CR, RTW_CR);
1441 
1442 #ifdef RTW_DIAG
1443 	if (cr & RTW_CR_TE)
1444 		rtw_txring_fixup(sc, __func__, __LINE__);
1445 #endif
1446 	if (cr & RTW_CR_TE) {
1447 		rtw_tx_kick(&sc->sc_regs,
1448 		    RTW_TPPOLL_HPQ | RTW_TPPOLL_NPQ | RTW_TPPOLL_LPQ);
1449 	}
1450 }
1451 
1452 static void
1453 rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1454 {
1455 #define	IS_BEACON(__fc0)						\
1456     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1457      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1458 
1459 	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1460 							 * hardware -> net80211
1461 							 */
1462 	u_int next, nproc = 0;
1463 	int hwrate, len, rate, rssi, sq;
1464 	uint32_t hrssi, hstat, htsfth, htsftl;
1465 	struct rtw_rxdesc *rd;
1466 	struct rtw_rxsoft *rs;
1467 	struct rtw_rxdesc_blk *rdb;
1468 	struct mbuf *m;
1469 	struct ifnet *ifp = &sc->sc_if;
1470 
1471 	struct ieee80211_node *ni;
1472 	struct ieee80211_frame_min *wh;
1473 
1474 	rdb = &sc->sc_rxdesc_blk;
1475 
1476 	for (next = rdb->rdb_next; ; next = rdb->rdb_next) {
1477 		KASSERT(next < rdb->rdb_ndesc);
1478 
1479 		rtw_rxdescs_sync(rdb, next, 1,
1480 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1481 		rd = &rdb->rdb_desc[next];
1482 		rs = &sc->sc_rxsoft[next];
1483 
1484 		hstat = le32toh(rd->rd_stat);
1485 		hrssi = le32toh(rd->rd_rssi);
1486 		htsfth = le32toh(rd->rd_tsfth);
1487 		htsftl = le32toh(rd->rd_tsftl);
1488 
1489 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1490 		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1491 		    __func__, next, hstat, hrssi, htsfth, htsftl));
1492 
1493 		++nproc;
1494 
1495 		/* still belongs to NIC */
1496 		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1497 			rtw_rxdescs_sync(rdb, next, 1, BUS_DMASYNC_PREREAD);
1498 			break;
1499 		}
1500 
1501                 /* ieee80211_input() might reset the receive engine
1502                  * (e.g. by indirectly calling rtw_tune()), so save
1503                  * the next pointer here and retrieve it again on
1504                  * the next round.
1505 		 */
1506 		rdb->rdb_next = (next + 1) % rdb->rdb_ndesc;
1507 
1508 #ifdef RTW_DEBUG
1509 #define PRINTSTAT(flag) do { \
1510 	if ((hstat & flag) != 0) { \
1511 		printf("%s" #flag, delim); \
1512 		delim = ","; \
1513 	} \
1514 } while (0)
1515 		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1516 			const char *delim = "<";
1517 			printf("%s: ", device_xname(sc->sc_dev));
1518 			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1519 				printf("status %08x", hstat);
1520 				PRINTSTAT(RTW_RXSTAT_SPLCP);
1521 				PRINTSTAT(RTW_RXSTAT_MAR);
1522 				PRINTSTAT(RTW_RXSTAT_PAR);
1523 				PRINTSTAT(RTW_RXSTAT_BAR);
1524 				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1525 				PRINTSTAT(RTW_RXSTAT_CRC32);
1526 				PRINTSTAT(RTW_RXSTAT_ICV);
1527 				printf(">, ");
1528 			}
1529 		}
1530 #endif /* RTW_DEBUG */
1531 
1532 		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1533 			aprint_error_dev(sc->sc_dev,
1534 			    "DMA error/FIFO overflow %08" PRIx32 ", "
1535 			    "rx descriptor %d\n", hstat, next);
1536 			ifp->if_ierrors++;
1537 			goto next;
1538 		}
1539 
1540 		len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1541 		if (len < IEEE80211_MIN_LEN) {
1542 			sc->sc_ic.ic_stats.is_rx_tooshort++;
1543 			goto next;
1544 		}
1545 		if (len > rs->rs_mbuf->m_len) {
1546 			aprint_error_dev(sc->sc_dev,
1547 			    "rx frame too long, %d > %d, %08" PRIx32
1548 			    ", desc %d\n",
1549 			    len, rs->rs_mbuf->m_len, hstat, next);
1550 			ifp->if_ierrors++;
1551 			goto next;
1552 		}
1553 
1554 		hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1555 		if (hwrate >= __arraycount(ratetbl)) {
1556 			aprint_error_dev(sc->sc_dev,
1557 			    "unknown rate #%" __PRIuBITS "\n",
1558 			    __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1559 			ifp->if_ierrors++;
1560 			goto next;
1561 		}
1562 		rate = ratetbl[hwrate];
1563 
1564 #ifdef RTW_DEBUG
1565 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1566 		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1567 		     (rate * 5) % 10, htsfth, htsftl));
1568 #endif /* RTW_DEBUG */
1569 
1570 		/* if bad flags, skip descriptor */
1571 		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1572 			aprint_error_dev(sc->sc_dev, "too many rx segments, "
1573 			    "next=%d, %08" PRIx32 "\n", next, hstat);
1574 			goto next;
1575 		}
1576 
1577 		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1578 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1579 
1580 		m = rs->rs_mbuf;
1581 
1582 		/* if temporarily out of memory, re-use mbuf */
1583 		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1584 		case 0:
1585 			break;
1586 		case ENOBUFS:
1587 			aprint_error_dev(sc->sc_dev,
1588 			    "rtw_rxsoft_alloc(, %d) failed, dropping packet\n",
1589 			    next);
1590 			goto next;
1591 		default:
1592 			/* XXX shorten rx ring, instead? */
1593 			aprint_error_dev(sc->sc_dev,
1594 			    "could not load DMA map\n");
1595 		}
1596 
1597 		sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1598 
1599 		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1600 			rssi = UINT8_MAX - sq;
1601 		else {
1602 			rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1603 			/* TBD find out each front-end's LNA gain in the
1604 			 * front-end's units
1605 			 */
1606 			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1607 				rssi |= 0x80;
1608 		}
1609 
1610 		/* Note well: now we cannot recycle the rs_mbuf unless
1611 		 * we restore its original length.
1612 		 */
1613 		m->m_pkthdr.rcvif = ifp;
1614 		m->m_pkthdr.len = m->m_len = len;
1615 
1616 		wh = mtod(m, struct ieee80211_frame_min *);
1617 
1618 		if (!IS_BEACON(wh->i_fc[0]))
1619 			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1620 
1621 		sc->sc_tsfth = htsfth;
1622 
1623 #ifdef RTW_DEBUG
1624 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1625 		    (IFF_DEBUG|IFF_LINK2)) {
1626 			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1627 			    rate, rssi);
1628 		}
1629 #endif /* RTW_DEBUG */
1630 
1631 #if NBPFILTER > 0
1632 		if (sc->sc_radiobpf != NULL) {
1633 			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1634 
1635 			rr->rr_tsft =
1636 			    htole64(((uint64_t)htsfth << 32) | htsftl);
1637 
1638 			rr->rr_flags = IEEE80211_RADIOTAP_F_FCS;
1639 
1640 			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1641 				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1642 			if ((hstat & RTW_RXSTAT_CRC32) != 0)
1643 				rr->rr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1644 
1645 			rr->rr_rate = rate;
1646 
1647 			if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1648 				rr->rr_u.u_philips.p_antsignal = rssi;
1649 			else {
1650 				rr->rr_u.u_other.o_antsignal = rssi;
1651 				rr->rr_u.u_other.o_barker_lock =
1652 				    htole16(UINT8_MAX - sq);
1653 			}
1654 
1655 			bpf_mtap2(sc->sc_radiobpf, rr,
1656 			    sizeof(sc->sc_rxtapu), m);
1657 		}
1658 #endif /* NBPFILTER > 0 */
1659 
1660 		if ((hstat & RTW_RXSTAT_RES) != 0) {
1661 			m_freem(m);
1662 			goto next;
1663 		}
1664 
1665 		/* CRC is included with the packet; trim it off. */
1666 		m_adj(m, -IEEE80211_CRC_LEN);
1667 
1668 		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1669 		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1670 		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1671 		ieee80211_free_node(ni);
1672 next:
1673 		rtw_rxdesc_init(rdb, rs, next, 0);
1674 	}
1675 #undef IS_BEACON
1676 }
1677 
1678 static void
1679 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1680     struct rtw_txsoft *ts)
1681 {
1682 	struct mbuf *m;
1683 	struct ieee80211_node *ni;
1684 
1685 	m = ts->ts_mbuf;
1686 	ni = ts->ts_ni;
1687 	KASSERT(m != NULL);
1688 	KASSERT(ni != NULL);
1689 	ts->ts_mbuf = NULL;
1690 	ts->ts_ni = NULL;
1691 
1692 	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1693 	    BUS_DMASYNC_POSTWRITE);
1694 	bus_dmamap_unload(dmat, ts->ts_dmamap);
1695 	m_freem(m);
1696 	ieee80211_free_node(ni);
1697 }
1698 
1699 static void
1700 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1701     struct rtw_txsoft_blk *tsb)
1702 {
1703 	struct rtw_txsoft *ts;
1704 
1705 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1706 		rtw_txsoft_release(dmat, ic, ts);
1707 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1708 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1709 	}
1710 	tsb->tsb_tx_timer = 0;
1711 }
1712 
1713 static inline void
1714 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1715     struct rtw_txsoft *ts, int ndesc)
1716 {
1717 	uint32_t hstat;
1718 	int data_retry, rts_retry;
1719 	struct rtw_txdesc *tdn;
1720 	const char *condstring;
1721 	struct ifnet *ifp = &sc->sc_if;
1722 
1723 	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1724 
1725 	tdb->tdb_nfree += ndesc;
1726 
1727 	tdn = &tdb->tdb_desc[ts->ts_last];
1728 
1729 	hstat = le32toh(tdn->td_stat);
1730 	rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1731 	data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1732 
1733 	ifp->if_collisions += rts_retry + data_retry;
1734 
1735 	if ((hstat & RTW_TXSTAT_TOK) != 0)
1736 		condstring = "ok";
1737 	else {
1738 		ifp->if_oerrors++;
1739 		condstring = "error";
1740 	}
1741 
1742 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1743 	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1744 	    device_xname(sc->sc_dev), ts, ts->ts_first, ts->ts_last,
1745 	    condstring, rts_retry, data_retry));
1746 }
1747 
1748 static void
1749 rtw_reset_oactive(struct rtw_softc *sc)
1750 {
1751 	short oflags;
1752 	int pri;
1753 	struct rtw_txsoft_blk *tsb;
1754 	struct rtw_txdesc_blk *tdb;
1755 	oflags = sc->sc_if.if_flags;
1756 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1757 		tsb = &sc->sc_txsoft_blk[pri];
1758 		tdb = &sc->sc_txdesc_blk[pri];
1759 		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1760 			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1761 	}
1762 	if (oflags != sc->sc_if.if_flags) {
1763 		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1764 		    ("%s: reset OACTIVE\n", __func__));
1765 	}
1766 }
1767 
1768 /* Collect transmitted packets. */
1769 static bool
1770 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1771     struct rtw_txdesc_blk *tdb, int force)
1772 {
1773 	bool collected = false;
1774 	int ndesc;
1775 	struct rtw_txsoft *ts;
1776 
1777 #ifdef RTW_DEBUG
1778 	rtw_dump_rings(sc);
1779 #endif
1780 
1781 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1782 		/* If we're clearing a failed transmission, only clear
1783 		   up to the last packet the hardware has processed.  */
1784 		if (ts->ts_first == rtw_txring_next(&sc->sc_regs, tdb))
1785 			break;
1786 
1787 		ndesc = 1 + ts->ts_last - ts->ts_first;
1788 		if (ts->ts_last < ts->ts_first)
1789 			ndesc += tdb->tdb_ndesc;
1790 
1791 		KASSERT(ndesc > 0);
1792 
1793 		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1794 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1795 
1796 		if (force) {
1797 			int next;
1798 #ifdef RTW_DIAG
1799 			printf("%s: clearing packet, stats", __func__);
1800 #endif
1801 			for (next = ts->ts_first; ;
1802 			    next = RTW_NEXT_IDX(tdb, next)) {
1803 #ifdef RTW_DIAG
1804 				printf(" %" PRIx32 "/%" PRIx32 "/%" PRIx32 "/%" PRIu32 "/%" PRIx32, le32toh(tdb->tdb_desc[next].td_stat), le32toh(tdb->tdb_desc[next].td_ctl1), le32toh(tdb->tdb_desc[next].td_buf), le32toh(tdb->tdb_desc[next].td_len), le32toh(tdb->tdb_desc[next].td_next));
1805 #endif
1806 				tdb->tdb_desc[next].td_stat &=
1807 				    ~htole32(RTW_TXSTAT_OWN);
1808 				if (next == ts->ts_last)
1809 					break;
1810 			}
1811 			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1812 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1813 #ifdef RTW_DIAG
1814 			next = RTW_NEXT_IDX(tdb, next);
1815 			printf(" -> end %u stat %" PRIx32 ", was %u\n", next,
1816 			    le32toh(tdb->tdb_desc[next].td_stat),
1817 			    rtw_txring_next(&sc->sc_regs, tdb));
1818 #endif
1819 		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1820 		    htole32(RTW_TXSTAT_OWN)) != 0) {
1821 			rtw_txdescs_sync(tdb, ts->ts_last, 1,
1822 			    BUS_DMASYNC_PREREAD);
1823 			break;
1824 		}
1825 
1826 		collected = true;
1827 
1828 		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1829 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1830 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1831 	}
1832 
1833 	/* no more pending transmissions, cancel watchdog */
1834 	if (ts == NULL)
1835 		tsb->tsb_tx_timer = 0;
1836 	rtw_reset_oactive(sc);
1837 
1838 	return collected;
1839 }
1840 
1841 static void
1842 rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1843 {
1844 	int pri;
1845 	struct rtw_txsoft_blk	*tsb;
1846 	struct rtw_txdesc_blk	*tdb;
1847 	struct ifnet *ifp = &sc->sc_if;
1848 
1849 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1850 		tsb = &sc->sc_txsoft_blk[pri];
1851 		tdb = &sc->sc_txdesc_blk[pri];
1852 		rtw_collect_txring(sc, tsb, tdb, 0);
1853 	}
1854 
1855 	if ((isr & RTW_INTR_TX) != 0)
1856 		rtw_start(ifp);
1857 
1858 	return;
1859 }
1860 
1861 static void
1862 rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1863 {
1864 	u_int next;
1865 	uint32_t tsfth, tsftl;
1866 	struct ieee80211com *ic;
1867 	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1868 	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1869 	struct mbuf *m;
1870 
1871 	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1872 	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1873 
1874 	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1875 		next = rtw_txring_next(&sc->sc_regs, tdb);
1876 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1877 		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1878 		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1879 		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1880 		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1881 		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0)
1882 			rtw_collect_txring(sc, tsb, tdb, 1);
1883 	}
1884 	/* Start beacon transmission. */
1885 
1886 	if ((isr & RTW_INTR_BCNINT) != 0 &&
1887 	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1888 	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1889 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1890 		    ("%s: beacon prep. time, isr = %#04" PRIx16
1891 		     ", %16" PRIu64 "\n", __func__, isr,
1892 		     (uint64_t)tsfth << 32 | tsftl));
1893 		ic = &sc->sc_ic;
1894 		m = rtw_beacon_alloc(sc, ic->ic_bss);
1895 
1896 		if (m == NULL) {
1897 			aprint_error_dev(sc->sc_dev,
1898 			    "could not allocate beacon\n");
1899 			return;
1900 		}
1901 		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1902 		IF_ENQUEUE(&sc->sc_beaconq, m);
1903 		rtw_start(&sc->sc_if);
1904 	}
1905 }
1906 
1907 static void
1908 rtw_intr_atim(struct rtw_softc *sc)
1909 {
1910 	/* TBD */
1911 	return;
1912 }
1913 
1914 #ifdef RTW_DEBUG
1915 static void
1916 rtw_dump_rings(struct rtw_softc *sc)
1917 {
1918 	struct rtw_txdesc_blk *tdb;
1919 	struct rtw_rxdesc *rd;
1920 	struct rtw_rxdesc_blk *rdb;
1921 	int desc, pri;
1922 
1923 	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1924 		return;
1925 
1926 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1927 		tdb = &sc->sc_txdesc_blk[pri];
1928 		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1929 		    tdb->tdb_ndesc, tdb->tdb_nfree);
1930 		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1931 			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1932 	}
1933 
1934 	rdb = &sc->sc_rxdesc_blk;
1935 
1936 	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1937 		rd = &rdb->rdb_desc[desc];
1938 		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1939 		    "rsvd1/tsfth %08x\n", __func__,
1940 		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1941 		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1942 		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1943 	}
1944 }
1945 #endif /* RTW_DEBUG */
1946 
1947 static void
1948 rtw_hwring_setup(struct rtw_softc *sc)
1949 {
1950 	int pri;
1951 	struct rtw_regs *regs = &sc->sc_regs;
1952 	struct rtw_txdesc_blk *tdb;
1953 
1954 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1955 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1956 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1957 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1958 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1959 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1960 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1961 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1962 
1963 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1964 		tdb = &sc->sc_txdesc_blk[pri];
1965 		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1966 		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1967 		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1968 		     (uintptr_t)tdb->tdb_base));
1969 	}
1970 
1971 	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1972 
1973 	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1974 	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1975 	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1976 
1977 	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1978 
1979 }
1980 
1981 static int
1982 rtw_swring_setup(struct rtw_softc *sc)
1983 {
1984 	int rc;
1985 	struct rtw_rxdesc_blk *rdb;
1986 
1987 	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1988 
1989 	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1990 
1991 	rdb = &sc->sc_rxdesc_blk;
1992 	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
1993 	     sc->sc_dev)) != 0 && rdb->rdb_ndesc == 0) {
1994 		aprint_error_dev(sc->sc_dev, "could not allocate rx buffers\n");
1995 		return rc;
1996 	}
1997 
1998 	rdb = &sc->sc_rxdesc_blk;
1999 	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
2000 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
2001 	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
2002 	rdb->rdb_next = 0;
2003 
2004 	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
2005 	return 0;
2006 }
2007 
2008 static void
2009 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
2010 {
2011 	int i;
2012 
2013 	(void)memset(tdb->tdb_desc, 0,
2014 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
2015 	for (i = 0; i < tdb->tdb_ndesc; i++)
2016 		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
2017 }
2018 
2019 static u_int
2020 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
2021 {
2022 	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
2023 	    sizeof(struct rtw_txdesc);
2024 }
2025 
2026 #ifdef RTW_DIAG
2027 static void
2028 rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln)
2029 {
2030 	int pri;
2031 	u_int next;
2032 	struct rtw_txdesc_blk *tdb;
2033 	struct rtw_regs *regs = &sc->sc_regs;
2034 
2035 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2036 		int i;
2037 		tdb = &sc->sc_txdesc_blk[pri];
2038 		next = rtw_txring_next(regs, tdb);
2039 		if (tdb->tdb_next == next)
2040 			continue;
2041 		for (i = 0; next != tdb->tdb_next;
2042 		    next = RTW_NEXT_IDX(tdb, next), i++) {
2043 			if ((tdb->tdb_desc[next].td_stat & htole32(RTW_TXSTAT_OWN)) == 0)
2044 				break;
2045 		}
2046 		printf("%s:%d: tx-ring %d expected next %u, read %u+%d -> %s\n", fn,
2047 		    ln, pri, tdb->tdb_next, next, i, tdb->tdb_next == next ? "okay" : "BAD");
2048 		if (tdb->tdb_next == next)
2049 			continue;
2050 		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
2051 	}
2052 }
2053 #endif
2054 
2055 static void
2056 rtw_txdescs_reset(struct rtw_softc *sc)
2057 {
2058 	int pri;
2059 	struct rtw_txsoft_blk	*tsb;
2060 	struct rtw_txdesc_blk	*tdb;
2061 
2062 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2063 		tsb = &sc->sc_txsoft_blk[pri];
2064 		tdb = &sc->sc_txdesc_blk[pri];
2065 		rtw_collect_txring(sc, tsb, tdb, 1);
2066 #ifdef RTW_DIAG
2067 		if (!SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
2068 			printf("%s: packets left in ring %d\n", __func__, pri);
2069 #endif
2070 	}
2071 }
2072 
2073 static void
2074 rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2075 {
2076 	aprint_error_dev(sc->sc_dev, "tx fifo underflow\n");
2077 
2078 	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: cleaning up xmit, isr %" PRIx16
2079 	    "\n", device_xname(sc->sc_dev), isr));
2080 
2081 #ifdef RTW_DEBUG
2082 	rtw_dump_rings(sc);
2083 #endif /* RTW_DEBUG */
2084 
2085 	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2086 	 * timeouts.
2087 	 */
2088 	rtw_txdescs_reset(sc);
2089 
2090 #ifdef RTW_DEBUG
2091 	rtw_dump_rings(sc);
2092 #endif /* RTW_DEBUG */
2093 }
2094 
2095 static inline void
2096 rtw_suspend_ticks(struct rtw_softc *sc)
2097 {
2098 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2099 	    ("%s: suspending ticks\n", device_xname(sc->sc_dev)));
2100 	sc->sc_do_tick = 0;
2101 }
2102 
2103 static inline void
2104 rtw_resume_ticks(struct rtw_softc *sc)
2105 {
2106 	uint32_t tsftrl0, tsftrl1, next_tick;
2107 
2108 	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2109 
2110 	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2111 	next_tick = tsftrl1 + 1000000;
2112 	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
2113 
2114 	sc->sc_do_tick = 1;
2115 
2116 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2117 	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2118 	    device_xname(sc->sc_dev), tsftrl1 - tsftrl0, tsftrl1, next_tick));
2119 }
2120 
2121 static void
2122 rtw_intr_timeout(struct rtw_softc *sc)
2123 {
2124 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", device_xname(sc->sc_dev)));
2125 	if (sc->sc_do_tick)
2126 		rtw_resume_ticks(sc);
2127 	return;
2128 }
2129 
2130 int
2131 rtw_intr(void *arg)
2132 {
2133 	int i;
2134 	struct rtw_softc *sc = arg;
2135 	struct rtw_regs *regs = &sc->sc_regs;
2136 	uint16_t isr;
2137 	struct ifnet *ifp = &sc->sc_if;
2138 
2139 	/*
2140 	 * If the interface isn't running, the interrupt couldn't
2141 	 * possibly have come from us.
2142 	 */
2143 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2144 	    !device_is_active(sc->sc_dev)) {
2145 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2146 		    device_xname(sc->sc_dev)));
2147 		return (0);
2148 	}
2149 
2150 	for (i = 0; i < 10; i++) {
2151 		isr = RTW_READ16(regs, RTW_ISR);
2152 
2153 		RTW_WRITE16(regs, RTW_ISR, isr);
2154 		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2155 
2156 		if (sc->sc_intr_ack != NULL)
2157 			(*sc->sc_intr_ack)(regs);
2158 
2159 		if (isr == 0)
2160 			break;
2161 
2162 #ifdef RTW_DEBUG
2163 #define PRINTINTR(flag) do { \
2164 	if ((isr & flag) != 0) { \
2165 		printf("%s" #flag, delim); \
2166 		delim = ","; \
2167 	} \
2168 } while (0)
2169 
2170 		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2171 			const char *delim = "<";
2172 
2173 			printf("%s: reg[ISR] = %x", device_xname(sc->sc_dev),
2174 			    isr);
2175 
2176 			PRINTINTR(RTW_INTR_TXFOVW);
2177 			PRINTINTR(RTW_INTR_TIMEOUT);
2178 			PRINTINTR(RTW_INTR_BCNINT);
2179 			PRINTINTR(RTW_INTR_ATIMINT);
2180 			PRINTINTR(RTW_INTR_TBDER);
2181 			PRINTINTR(RTW_INTR_TBDOK);
2182 			PRINTINTR(RTW_INTR_THPDER);
2183 			PRINTINTR(RTW_INTR_THPDOK);
2184 			PRINTINTR(RTW_INTR_TNPDER);
2185 			PRINTINTR(RTW_INTR_TNPDOK);
2186 			PRINTINTR(RTW_INTR_RXFOVW);
2187 			PRINTINTR(RTW_INTR_RDU);
2188 			PRINTINTR(RTW_INTR_TLPDER);
2189 			PRINTINTR(RTW_INTR_TLPDOK);
2190 			PRINTINTR(RTW_INTR_RER);
2191 			PRINTINTR(RTW_INTR_ROK);
2192 
2193 			printf(">\n");
2194 		}
2195 #undef PRINTINTR
2196 #endif /* RTW_DEBUG */
2197 
2198 		if ((isr & RTW_INTR_RX) != 0)
2199 			rtw_intr_rx(sc, isr);
2200 		if ((isr & RTW_INTR_TX) != 0)
2201 			rtw_intr_tx(sc, isr);
2202 		if ((isr & RTW_INTR_BEACON) != 0)
2203 			rtw_intr_beacon(sc, isr);
2204 		if ((isr & RTW_INTR_ATIMINT) != 0)
2205 			rtw_intr_atim(sc);
2206 		if ((isr & RTW_INTR_IOERROR) != 0)
2207 			rtw_intr_ioerror(sc, isr);
2208 		if ((isr & RTW_INTR_TIMEOUT) != 0)
2209 			rtw_intr_timeout(sc);
2210 	}
2211 
2212 	return 1;
2213 }
2214 
2215 /* Must be called at splnet. */
2216 static void
2217 rtw_stop(struct ifnet *ifp, int disable)
2218 {
2219 	int pri;
2220 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2221 	struct ieee80211com *ic = &sc->sc_ic;
2222 	struct rtw_regs *regs = &sc->sc_regs;
2223 
2224 	rtw_suspend_ticks(sc);
2225 
2226 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2227 
2228 	if (device_has_power(sc->sc_dev)) {
2229 		/* Disable interrupts. */
2230 		RTW_WRITE16(regs, RTW_IMR, 0);
2231 
2232 		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2233 
2234 		/* Stop the transmit and receive processes. First stop DMA,
2235 		 * then disable receiver and transmitter.
2236 		 */
2237 		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2238 
2239 		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2240 
2241 		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2242 	}
2243 
2244 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2245 		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2246 		    &sc->sc_txsoft_blk[pri]);
2247 	}
2248 
2249 	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2250 
2251 	/* Mark the interface as not running.  Cancel the watchdog timer. */
2252 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2253 	ifp->if_timer = 0;
2254 
2255 	if (disable)
2256 		pmf_device_suspend_self(sc->sc_dev);
2257 
2258 	return;
2259 }
2260 
2261 const char *
2262 rtw_pwrstate_string(enum rtw_pwrstate power)
2263 {
2264 	switch (power) {
2265 	case RTW_ON:
2266 		return "on";
2267 	case RTW_SLEEP:
2268 		return "sleep";
2269 	case RTW_OFF:
2270 		return "off";
2271 	default:
2272 		return "unknown";
2273 	}
2274 }
2275 
2276 /* XXX For Maxim, I am using the RFMD settings gleaned from the
2277  * reference driver, plus a magic Maxim "ON" value that comes from
2278  * the Realtek document "Windows PG for Rtl8180."
2279  */
2280 static void
2281 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2282     int before_rf, int digphy)
2283 {
2284 	uint32_t anaparm;
2285 
2286 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2287 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2288 
2289 	switch (power) {
2290 	case RTW_OFF:
2291 		if (before_rf)
2292 			return;
2293 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2294 		anaparm |= RTW_ANAPARM_TXDACOFF;
2295 		break;
2296 	case RTW_SLEEP:
2297 		if (!before_rf)
2298 			return;
2299 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2300 		anaparm |= RTW_ANAPARM_TXDACOFF;
2301 		break;
2302 	case RTW_ON:
2303 		if (!before_rf)
2304 			return;
2305 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2306 		break;
2307 	}
2308 	RTW_DPRINTF(RTW_DEBUG_PWR,
2309 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2310 	    __func__, rtw_pwrstate_string(power),
2311 	    (before_rf) ? "before" : "after", anaparm));
2312 
2313 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2314 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2315 }
2316 
2317 /* XXX I am using the RFMD settings gleaned from the reference
2318  * driver.  They agree
2319  */
2320 static void
2321 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2322     int before_rf, int digphy)
2323 {
2324 	uint32_t anaparm;
2325 
2326 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2327 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2328 
2329 	switch (power) {
2330 	case RTW_OFF:
2331 		if (before_rf)
2332 			return;
2333 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2334 		anaparm |= RTW_ANAPARM_TXDACOFF;
2335 		break;
2336 	case RTW_SLEEP:
2337 		if (!before_rf)
2338 			return;
2339 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2340 		anaparm |= RTW_ANAPARM_TXDACOFF;
2341 		break;
2342 	case RTW_ON:
2343 		if (!before_rf)
2344 			return;
2345 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2346 		break;
2347 	}
2348 	RTW_DPRINTF(RTW_DEBUG_PWR,
2349 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2350 	    __func__, rtw_pwrstate_string(power),
2351 	    (before_rf) ? "before" : "after", anaparm));
2352 
2353 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2354 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2355 }
2356 
2357 static void
2358 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2359     int before_rf, int digphy)
2360 {
2361 	uint32_t anaparm;
2362 
2363 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2364 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2365 
2366 	switch (power) {
2367 	case RTW_OFF:
2368 		if (before_rf)
2369 			return;
2370 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2371 		anaparm |= RTW_ANAPARM_TXDACOFF;
2372 		break;
2373 	case RTW_SLEEP:
2374 		if (!before_rf)
2375 			return;
2376 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2377 		anaparm |= RTW_ANAPARM_TXDACOFF;
2378 		break;
2379 	case RTW_ON:
2380 		if (!before_rf)
2381 			return;
2382 		if (digphy) {
2383 			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2384 			/* XXX guess */
2385 			anaparm |= RTW_ANAPARM_TXDACOFF;
2386 		} else
2387 			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2388 		break;
2389 	}
2390 	RTW_DPRINTF(RTW_DEBUG_PWR,
2391 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2392 	    __func__, rtw_pwrstate_string(power),
2393 	    (before_rf) ? "before" : "after", anaparm));
2394 
2395 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2396 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2397 }
2398 
2399 static void
2400 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2401     int digphy)
2402 {
2403 	struct rtw_regs *regs = &sc->sc_regs;
2404 
2405 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2406 
2407 	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2408 
2409 	rtw_set_access(regs, RTW_ACCESS_NONE);
2410 
2411 	return;
2412 }
2413 
2414 static int
2415 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2416 {
2417 	int rc;
2418 
2419 	RTW_DPRINTF(RTW_DEBUG_PWR,
2420 	    ("%s: %s->%s\n", __func__,
2421 	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2422 
2423 	if (sc->sc_pwrstate == power)
2424 		return 0;
2425 
2426 	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2427 	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2428 	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2429 
2430 	switch (power) {
2431 	case RTW_ON:
2432 		/* TBD set LEDs */
2433 		break;
2434 	case RTW_SLEEP:
2435 		/* TBD */
2436 		break;
2437 	case RTW_OFF:
2438 		/* TBD */
2439 		break;
2440 	}
2441 	if (rc == 0)
2442 		sc->sc_pwrstate = power;
2443 	else
2444 		sc->sc_pwrstate = RTW_OFF;
2445 	return rc;
2446 }
2447 
2448 static int
2449 rtw_tune(struct rtw_softc *sc)
2450 {
2451 	struct ieee80211com *ic = &sc->sc_ic;
2452 	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2453 	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2454 	u_int chan;
2455 	int rc;
2456 	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2457 	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2458 
2459 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2460 	KASSERT(chan != IEEE80211_CHAN_ANY);
2461 
2462 	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2463 	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2464 
2465 	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2466 	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2467 
2468 	if (chan == sc->sc_cur_chan) {
2469 		RTW_DPRINTF(RTW_DEBUG_TUNE,
2470 		    ("%s: already tuned chan #%d\n", __func__, chan));
2471 		return 0;
2472 	}
2473 
2474 	rtw_suspend_ticks(sc);
2475 
2476 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2477 
2478 	/* TBD wait for Tx to complete */
2479 
2480 	KASSERT(device_has_power(sc->sc_dev));
2481 
2482 	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2483 	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2484 	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2485 		/* XXX condition on powersaving */
2486 		aprint_error_dev(sc->sc_dev, "phy init failed\n");
2487 	}
2488 
2489 	sc->sc_cur_chan = chan;
2490 
2491 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2492 
2493 	rtw_resume_ticks(sc);
2494 
2495 	return rc;
2496 }
2497 
2498 bool
2499 rtw_suspend(device_t self PMF_FN_ARGS)
2500 {
2501 	int rc;
2502 	struct rtw_softc *sc = device_private(self);
2503 
2504 	sc->sc_flags &= ~RTW_F_DK_VALID;
2505 
2506 	if (!device_has_power(self))
2507 		return false;
2508 
2509 	/* turn off PHY */
2510 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2511 		aprint_error_dev(self, "failed to turn off PHY (%d)\n", rc);
2512 		return false;
2513 	}
2514 
2515 	rtw_disable_interrupts(&sc->sc_regs);
2516 
2517 	return true;
2518 }
2519 
2520 bool
2521 rtw_resume(device_t self PMF_FN_ARGS)
2522 {
2523 	struct rtw_softc *sc = device_private(self);
2524 
2525 	/* Power may have been removed, resetting WEP keys.
2526 	 */
2527 	sc->sc_flags &= ~RTW_F_DK_VALID;
2528 	rtw_enable_interrupts(sc);
2529 
2530 	return true;
2531 }
2532 
2533 static void
2534 rtw_transmit_config(struct rtw_regs *regs)
2535 {
2536 	uint32_t tcr;
2537 
2538 	tcr = RTW_READ(regs, RTW_TCR);
2539 
2540 	tcr |= RTW_TCR_CWMIN;
2541 	tcr &= ~RTW_TCR_MXDMA_MASK;
2542 	tcr |= RTW_TCR_MXDMA_256;
2543 	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2544 	tcr &= ~RTW_TCR_LBK_MASK;
2545 	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2546 
2547 	/* set short/long retry limits */
2548 	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2549 	tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2550 
2551 	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2552 
2553 	RTW_WRITE(regs, RTW_TCR, tcr);
2554 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2555 }
2556 
2557 static void
2558 rtw_disable_interrupts(struct rtw_regs *regs)
2559 {
2560 	RTW_WRITE16(regs, RTW_IMR, 0);
2561 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2562 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2563 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2564 }
2565 
2566 static void
2567 rtw_enable_interrupts(struct rtw_softc *sc)
2568 {
2569 	struct rtw_regs *regs = &sc->sc_regs;
2570 
2571 	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2572 	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2573 
2574 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2575 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2576 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2577 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2578 
2579 	/* XXX necessary? */
2580 	if (sc->sc_intr_ack != NULL)
2581 		(*sc->sc_intr_ack)(regs);
2582 }
2583 
2584 static void
2585 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2586 {
2587 	uint8_t msr;
2588 
2589 	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2590 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2591 
2592 	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2593 
2594 	switch (opmode) {
2595 	case IEEE80211_M_AHDEMO:
2596 	case IEEE80211_M_IBSS:
2597 		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2598 		break;
2599 	case IEEE80211_M_HOSTAP:
2600 		msr |= RTW_MSR_NETYPE_AP_OK;
2601 		break;
2602 	case IEEE80211_M_MONITOR:
2603 		/* XXX */
2604 		msr |= RTW_MSR_NETYPE_NOLINK;
2605 		break;
2606 	case IEEE80211_M_STA:
2607 		msr |= RTW_MSR_NETYPE_INFRA_OK;
2608 		break;
2609 	}
2610 	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2611 
2612 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2613 }
2614 
2615 #define	rtw_calchash(addr) \
2616 	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2617 
2618 static void
2619 rtw_pktfilt_load(struct rtw_softc *sc)
2620 {
2621 	struct rtw_regs *regs = &sc->sc_regs;
2622 	struct ieee80211com *ic = &sc->sc_ic;
2623 	struct ethercom *ec = &sc->sc_ec;
2624 	struct ifnet *ifp = &sc->sc_if;
2625 	int hash;
2626 	uint32_t hashes[2] = { 0, 0 };
2627 	struct ether_multi *enm;
2628 	struct ether_multistep step;
2629 
2630 	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2631 
2632 	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2633 	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2634 
2635 	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2636 	/* MAC auto-reset PHY (huh?) */
2637 	sc->sc_rcr |= RTW_RCR_ENMARP;
2638 	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2639 	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2640 
2641 	switch (ic->ic_opmode) {
2642 	case IEEE80211_M_MONITOR:
2643 		sc->sc_rcr |= RTW_RCR_MONITOR;
2644 		break;
2645 	case IEEE80211_M_AHDEMO:
2646 	case IEEE80211_M_IBSS:
2647 		/* receive broadcasts in our BSS */
2648 		sc->sc_rcr |= RTW_RCR_ADD3;
2649 		break;
2650 	default:
2651 		break;
2652 	}
2653 
2654 	ifp->if_flags &= ~IFF_ALLMULTI;
2655 
2656 	/*
2657 	 * Program the 64-bit multicast hash filter.
2658 	 */
2659 	ETHER_FIRST_MULTI(step, ec, enm);
2660 	while (enm != NULL) {
2661 		/* XXX */
2662 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2663 		    ETHER_ADDR_LEN) != 0) {
2664 			ifp->if_flags |= IFF_ALLMULTI;
2665 			break;
2666 		}
2667 
2668 		hash = rtw_calchash(enm->enm_addrlo);
2669 		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2670 		ETHER_NEXT_MULTI(step, enm);
2671 	}
2672 
2673 	/* XXX accept all broadcast if scanning */
2674 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2675 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2676 
2677 	if (ifp->if_flags & IFF_PROMISC) {
2678 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2679 		sc->sc_rcr |= RTW_RCR_ACRC32;	/* accept frames failing CRC */
2680 		sc->sc_rcr |= RTW_RCR_AICV;	/* accept frames failing ICV */
2681 		ifp->if_flags |= IFF_ALLMULTI;
2682 	}
2683 
2684 	if (ifp->if_flags & IFF_ALLMULTI)
2685 		hashes[0] = hashes[1] = 0xffffffff;
2686 
2687 	if ((hashes[0] | hashes[1]) != 0)
2688 		sc->sc_rcr |= RTW_RCR_AM;	/* accept multicast */
2689 
2690 	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2691 	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2692 	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2693 	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2694 
2695 	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2696 	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2697 	    device_xname(sc->sc_dev), RTW_READ(regs, RTW_MAR0),
2698 	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2699 }
2700 
2701 static struct mbuf *
2702 rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2703 {
2704 	struct ieee80211com *ic = &sc->sc_ic;
2705 	struct mbuf *m;
2706 	struct ieee80211_beacon_offsets	boff;
2707 
2708 	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2709 		RTW_DPRINTF(RTW_DEBUG_BEACON,
2710 		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2711 	}
2712 	return m;
2713 }
2714 
2715 /* Must be called at splnet. */
2716 static int
2717 rtw_init(struct ifnet *ifp)
2718 {
2719 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2720 	struct ieee80211com *ic = &sc->sc_ic;
2721 	struct rtw_regs *regs = &sc->sc_regs;
2722 	int rc;
2723 
2724 	if (device_is_active(sc->sc_dev)) {
2725 		/* Cancel pending I/O and reset. */
2726 		rtw_stop(ifp, 0);
2727 	} else if (!pmf_device_resume_self(sc->sc_dev))
2728 		return 0;	/* XXX error? */
2729 
2730 	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2731 	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2732 	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2733 
2734 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2735 		goto out;
2736 
2737 	if ((rc = rtw_swring_setup(sc)) != 0)
2738 		goto out;
2739 
2740 	rtw_transmit_config(regs);
2741 
2742 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2743 
2744 	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2745 	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2746 
2747 	/* long PLCP header, 1Mb/2Mb basic rate */
2748 	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2749 	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2750 
2751 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2752 	rtw_set_access(regs, RTW_ACCESS_NONE);
2753 
2754 	/* XXX from reference sources */
2755 	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2756 	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2757 
2758 	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev);
2759 
2760 	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2761 	/* from Linux driver */
2762 	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2763 
2764 	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2765 
2766 	rtw_enable_interrupts(sc);
2767 
2768 	rtw_pktfilt_load(sc);
2769 
2770 	rtw_hwring_setup(sc);
2771 
2772 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2773 
2774 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2775 
2776 	ifp->if_flags |= IFF_RUNNING;
2777 	ic->ic_state = IEEE80211_S_INIT;
2778 
2779 	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2780 	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2781 
2782 	rtw_resume_ticks(sc);
2783 
2784 	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2785 
2786 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2787 		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2788 	else
2789 		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2790 
2791 out:
2792 	aprint_error_dev(sc->sc_dev, "interface not running\n");
2793 	return rc;
2794 }
2795 
2796 static inline void
2797 rtw_led_init(struct rtw_regs *regs)
2798 {
2799 	uint8_t cfg0, cfg1;
2800 
2801 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2802 
2803 	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2804 	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2805 	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2806 
2807 	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2808 	RTW_DPRINTF(RTW_DEBUG_LED,
2809 	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2810 
2811 	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2812 	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2813 	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2814 
2815 	rtw_set_access(regs, RTW_ACCESS_NONE);
2816 }
2817 
2818 /*
2819  * IEEE80211_S_INIT: 		LED1 off
2820  *
2821  * IEEE80211_S_AUTH,
2822  * IEEE80211_S_ASSOC,
2823  * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2824  *
2825  * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2826  */
2827 static void
2828 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2829 {
2830 	struct rtw_led_state *ls;
2831 
2832 	ls = &sc->sc_led_state;
2833 
2834 	switch (nstate) {
2835 	case IEEE80211_S_INIT:
2836 		rtw_led_init(&sc->sc_regs);
2837 		aprint_debug_dev(sc->sc_dev, "stopping blink\n");
2838 		callout_stop(&ls->ls_slow_ch);
2839 		callout_stop(&ls->ls_fast_ch);
2840 		ls->ls_slowblink = 0;
2841 		ls->ls_actblink = 0;
2842 		ls->ls_default = 0;
2843 		break;
2844 	case IEEE80211_S_SCAN:
2845 		aprint_debug_dev(sc->sc_dev, "scheduling blink\n");
2846 		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2847 		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2848 		/*FALLTHROUGH*/
2849 	case IEEE80211_S_AUTH:
2850 	case IEEE80211_S_ASSOC:
2851 		ls->ls_default = RTW_LED1;
2852 		ls->ls_actblink = RTW_LED1;
2853 		ls->ls_slowblink = RTW_LED1;
2854 		break;
2855 	case IEEE80211_S_RUN:
2856 		ls->ls_slowblink = 0;
2857 		break;
2858 	}
2859 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2860 }
2861 
2862 static void
2863 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2864 {
2865 	uint8_t led_condition;
2866 	bus_size_t ofs;
2867 	uint8_t mask, newval, val;
2868 
2869 	led_condition = ls->ls_default;
2870 
2871 	if (ls->ls_state & RTW_LED_S_SLOW)
2872 		led_condition ^= ls->ls_slowblink;
2873 	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2874 		led_condition ^= ls->ls_actblink;
2875 
2876 	RTW_DPRINTF(RTW_DEBUG_LED,
2877 	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2878 
2879 	switch (hwverid) {
2880 	default:
2881 	case 'F':
2882 		ofs = RTW_PSR;
2883 		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2884 		if (led_condition & RTW_LED0)
2885 			newval &= ~RTW_PSR_LEDGPO0;
2886 		if (led_condition & RTW_LED1)
2887 			newval &= ~RTW_PSR_LEDGPO1;
2888 		break;
2889 	case 'D':
2890 		ofs = RTW_9346CR;
2891 		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2892 		newval = RTW_9346CR_EEM_PROGRAM;
2893 		if (led_condition & RTW_LED0)
2894 			newval |= RTW_9346CR_EEDI;
2895 		if (led_condition & RTW_LED1)
2896 			newval |= RTW_9346CR_EECS;
2897 		break;
2898 	}
2899 	val = RTW_READ8(regs, ofs);
2900 	RTW_DPRINTF(RTW_DEBUG_LED,
2901 	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2902 	     (uintptr_t)ofs));
2903 	val &= ~mask;
2904 	val |= newval;
2905 	RTW_WRITE8(regs, ofs, val);
2906 	RTW_DPRINTF(RTW_DEBUG_LED,
2907 	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2908 	     (uintptr_t)ofs));
2909 	RTW_SYNC(regs, ofs, ofs);
2910 }
2911 
2912 static void
2913 rtw_led_fastblink(void *arg)
2914 {
2915 	int ostate, s;
2916 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2917 	struct rtw_led_state *ls = &sc->sc_led_state;
2918 
2919 	s = splnet();
2920 	ostate = ls->ls_state;
2921 	ls->ls_state ^= ls->ls_event;
2922 
2923 	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2924 		ls->ls_state &= ~RTW_LED_S_TX;
2925 
2926 	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2927 		ls->ls_state &= ~RTW_LED_S_RX;
2928 
2929 	ls->ls_event = 0;
2930 
2931 	if (ostate != ls->ls_state)
2932 		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2933 	splx(s);
2934 
2935 	aprint_debug_dev(sc->sc_dev, "scheduling fast blink\n");
2936 	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2937 }
2938 
2939 static void
2940 rtw_led_slowblink(void *arg)
2941 {
2942 	int s;
2943 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2944 	struct rtw_led_state *ls = &sc->sc_led_state;
2945 
2946 	s = splnet();
2947 	ls->ls_state ^= RTW_LED_S_SLOW;
2948 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2949 	splx(s);
2950 	aprint_debug_dev(sc->sc_dev, "scheduling slow blink\n");
2951 	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2952 }
2953 
2954 static void
2955 rtw_led_detach(struct rtw_led_state *ls)
2956 {
2957 	callout_destroy(&ls->ls_fast_ch);
2958 	callout_destroy(&ls->ls_slow_ch);
2959 }
2960 
2961 static void
2962 rtw_led_attach(struct rtw_led_state *ls, void *arg)
2963 {
2964 	callout_init(&ls->ls_fast_ch, 0);
2965 	callout_init(&ls->ls_slow_ch, 0);
2966 	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2967 	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2968 }
2969 
2970 static int
2971 rtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2972 {
2973 	int rc = 0, s;
2974 	struct rtw_softc *sc = ifp->if_softc;
2975 
2976 	s = splnet();
2977 	if (cmd == SIOCSIFFLAGS) {
2978 		if ((rc = ifioctl_common(ifp, cmd, data)) != 0)
2979 			;
2980 		else if ((ifp->if_flags & IFF_UP) != 0) {
2981 			if (device_is_active(sc->sc_dev))
2982 				rtw_pktfilt_load(sc);
2983 			else
2984 				rc = rtw_init(ifp);
2985 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2986 		} else if (device_is_active(sc->sc_dev)) {
2987 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2988 			rtw_stop(ifp, 1);
2989 		}
2990 	} else if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
2991 		;	/* nothing to do */
2992 	else if (cmd == SIOCADDMULTI || cmd == SIOCDELMULTI) {
2993 		/* reload packet filter if running */
2994 		if (ifp->if_flags & IFF_RUNNING)
2995 			rtw_pktfilt_load(sc);
2996 		rc = 0;
2997 	} else if ((ifp->if_flags & IFF_UP) != 0)
2998 		rc = rtw_init(ifp);
2999 	else
3000 		rc = 0;
3001 	splx(s);
3002 	return rc;
3003 }
3004 
3005 /* Select a transmit ring with at least one h/w and s/w descriptor free.
3006  * Return 0 on success, -1 on failure.
3007  */
3008 static inline int
3009 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
3010     struct rtw_txdesc_blk **tdbp, int pri)
3011 {
3012 	struct rtw_txsoft_blk *tsb;
3013 	struct rtw_txdesc_blk *tdb;
3014 
3015 	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
3016 
3017 	tsb = &sc->sc_txsoft_blk[pri];
3018 	tdb = &sc->sc_txdesc_blk[pri];
3019 
3020 	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
3021 		if (tsb->tsb_tx_timer == 0)
3022 			tsb->tsb_tx_timer = 5;
3023 		*tsbp = NULL;
3024 		*tdbp = NULL;
3025 		return -1;
3026 	}
3027 	*tsbp = tsb;
3028 	*tdbp = tdb;
3029 	return 0;
3030 }
3031 
3032 static inline struct mbuf *
3033 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3034     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3035     struct ieee80211_node **nip, short *if_flagsp)
3036 {
3037 	struct mbuf *m;
3038 
3039 	if (IF_IS_EMPTY(ifq))
3040 		return NULL;
3041 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3042 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3043 		    __func__, pri));
3044 		*if_flagsp |= IFF_OACTIVE;
3045 		sc->sc_if.if_timer = 1;
3046 		return NULL;
3047 	}
3048 	IF_DEQUEUE(ifq, m);
3049 	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3050 	m->m_pkthdr.rcvif = NULL;
3051 	KASSERT(*nip != NULL);
3052 	return m;
3053 }
3054 
3055 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3056  * at the driver's selection of transmit control block for the packet.
3057  */
3058 static inline int
3059 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3060     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3061     struct ieee80211_node **nip)
3062 {
3063 	int pri;
3064 	struct ether_header *eh;
3065 	struct mbuf *m0;
3066 	struct rtw_softc *sc;
3067 	short *if_flagsp;
3068 
3069 	*mp = NULL;
3070 
3071 	sc = (struct rtw_softc *)ifp->if_softc;
3072 
3073 	DPRINTF(sc, RTW_DEBUG_XMIT,
3074 	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3075 
3076 	if_flagsp = &ifp->if_flags;
3077 
3078 	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3079 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3080 		                     tdbp, nip, if_flagsp)) != NULL) {
3081 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3082 		    __func__));
3083 		return 0;
3084 	}
3085 
3086 	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3087 		                     tdbp, nip, if_flagsp)) != NULL) {
3088 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3089 		    __func__));
3090 		return 0;
3091 	}
3092 
3093 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3094 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3095 		return 0;
3096 	}
3097 
3098 	IFQ_POLL(&ifp->if_snd, m0);
3099 	if (m0 == NULL) {
3100 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3101 		    __func__));
3102 		return 0;
3103 	}
3104 
3105 	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3106 
3107 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3108 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3109 		    __func__, pri));
3110 		*if_flagsp |= IFF_OACTIVE;
3111 		sc->sc_if.if_timer = 1;
3112 		return 0;
3113 	}
3114 
3115 	IFQ_DEQUEUE(&ifp->if_snd, m0);
3116 	if (m0 == NULL) {
3117 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3118 		    __func__));
3119 		return 0;
3120 	}
3121 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3122 	ifp->if_opackets++;
3123 #if NBPFILTER > 0
3124 	if (ifp->if_bpf)
3125 		bpf_mtap(ifp->if_bpf, m0);
3126 #endif
3127 	eh = mtod(m0, struct ether_header *);
3128 	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3129 	if (*nip == NULL) {
3130 		/* NB: ieee80211_find_txnode does stat+msg */
3131 		m_freem(m0);
3132 		return -1;
3133 	}
3134 	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3135 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3136 		ifp->if_oerrors++;
3137 		return -1;
3138 	}
3139 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3140 	*mp = m0;
3141 	return 0;
3142 }
3143 
3144 static int
3145 rtw_seg_too_short(bus_dmamap_t dmamap)
3146 {
3147 	int i;
3148 	for (i = 0; i < dmamap->dm_nsegs; i++) {
3149 		if (dmamap->dm_segs[i].ds_len < 4)
3150 			return 1;
3151 	}
3152 	return 0;
3153 }
3154 
3155 /* TBD factor with atw_start */
3156 static struct mbuf *
3157 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3158     u_int ndescfree, device_t dev)
3159 {
3160 	int first, rc;
3161 	struct mbuf *m, *m0;
3162 
3163 	m0 = chain;
3164 
3165 	/*
3166 	 * Load the DMA map.  Copy and try (once) again if the packet
3167 	 * didn't fit in the alloted number of segments.
3168 	 */
3169 	for (first = 1;
3170 	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3171 			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3172 	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3173 	     first = 0) {
3174 		if (rc == 0) {
3175 #ifdef RTW_DIAGxxx
3176 			if (rtw_seg_too_short(dmam)) {
3177 				printf("%s: short segment, mbuf lengths:", __func__);
3178 				for (m = m0; m; m = m->m_next)
3179 					printf(" %d", m->m_len);
3180 				printf("\n");
3181 			}
3182 #endif
3183 			bus_dmamap_unload(dmat, dmam);
3184 		}
3185 		MGETHDR(m, M_DONTWAIT, MT_DATA);
3186 		if (m == NULL) {
3187 			aprint_error_dev(dev, "unable to allocate Tx mbuf\n");
3188 			break;
3189 		}
3190 		if (m0->m_pkthdr.len > MHLEN) {
3191 			MCLGET(m, M_DONTWAIT);
3192 			if ((m->m_flags & M_EXT) == 0) {
3193 				aprint_error_dev(dev,
3194 				    "cannot allocate Tx cluster\n");
3195 				m_freem(m);
3196 				break;
3197 			}
3198 		}
3199 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3200 		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3201 		m_freem(m0);
3202 		m0 = m;
3203 		m = NULL;
3204 	}
3205 	if (rc != 0) {
3206 		aprint_error_dev(dev, "cannot load Tx buffer, rc = %d\n", rc);
3207 		m_freem(m0);
3208 		return NULL;
3209 	} else if (rtw_seg_too_short(dmam)) {
3210 		aprint_error_dev(dev,
3211 		    "cannot load Tx buffer, segment too short\n");
3212 		bus_dmamap_unload(dmat, dmam);
3213 		m_freem(m0);
3214 		return NULL;
3215 	} else if (dmam->dm_nsegs > ndescfree) {
3216 		aprint_error_dev(dev, "too many tx segments\n");
3217 		bus_dmamap_unload(dmat, dmam);
3218 		m_freem(m0);
3219 		return NULL;
3220 	}
3221 	return m0;
3222 }
3223 
3224 #ifdef RTW_DEBUG
3225 static void
3226 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3227     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3228 {
3229 	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3230 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3231 	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3232 	    device_xname(sc->sc_dev), ts, action, desc,
3233 	    le32toh(td->td_buf), le32toh(td->td_next),
3234 	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3235 	    le32toh(td->td_len)));
3236 }
3237 #endif /* RTW_DEBUG */
3238 
3239 static void
3240 rtw_start(struct ifnet *ifp)
3241 {
3242 	int desc, i, lastdesc, npkt, rate;
3243 	uint32_t proto_ctl0, ctl0, ctl1;
3244 	bus_dmamap_t		dmamap;
3245 	struct ieee80211com	*ic;
3246 	struct ieee80211_duration *d0;
3247 	struct ieee80211_frame_min	*wh;
3248 	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3249 	struct mbuf		*m0;
3250 	struct rtw_softc	*sc;
3251 	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3252 	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3253 	struct rtw_txsoft	*ts;
3254 	struct rtw_txdesc	*td;
3255 	struct ieee80211_key	*k;
3256 
3257 	sc = (struct rtw_softc *)ifp->if_softc;
3258 	ic = &sc->sc_ic;
3259 
3260 	DPRINTF(sc, RTW_DEBUG_XMIT,
3261 	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3262 
3263 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3264 		goto out;
3265 
3266 	/* XXX do real rate control */
3267 	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3268 
3269 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3270 		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3271 
3272 	for (;;) {
3273 		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3274 			continue;
3275 		if (m0 == NULL)
3276 			break;
3277 
3278 		wh = mtod(m0, struct ieee80211_frame_min *);
3279 
3280 		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3281 		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3282 			m_freem(m0);
3283 			break;
3284 		} else
3285 			k = NULL;
3286 
3287 		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3288 
3289 		dmamap = ts->ts_dmamap;
3290 
3291 		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3292 		    tdb->tdb_nfree, sc->sc_dev);
3293 
3294 		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3295 			DPRINTF(sc, RTW_DEBUG_XMIT,
3296 			    ("%s: fail dmamap load\n", __func__));
3297 			goto post_dequeue_err;
3298 		}
3299 
3300 		/* Note well: rtw_dmamap_load_txbuf may have created
3301 		 * a new chain, so we must find the header once
3302 		 * more.
3303 		 */
3304 		wh = mtod(m0, struct ieee80211_frame_min *);
3305 
3306 		/* XXX do real rate control */
3307 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3308 		    IEEE80211_FC0_TYPE_MGT)
3309 			rate = 2;
3310 		else
3311 			rate = MAX(2, ieee80211_get_rate(ni));
3312 
3313 #ifdef RTW_DEBUG
3314 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3315 		    (IFF_DEBUG|IFF_LINK2)) {
3316 			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3317 			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3318 			                            : sizeof(wh),
3319 			    rate, 0);
3320 		}
3321 #endif /* RTW_DEBUG */
3322 		ctl0 = proto_ctl0 |
3323 		    __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3324 
3325 		switch (rate) {
3326 		default:
3327 		case 2:
3328 			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3329 			break;
3330 		case 4:
3331 			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3332 			break;
3333 		case 11:
3334 			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3335 			break;
3336 		case 22:
3337 			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3338 			break;
3339 		}
3340 		/* XXX >= ? Compare after fragmentation? */
3341 		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3342 			ctl0 |= RTW_TXCTL0_RTSEN;
3343 
3344                 /* XXX Sometimes writes a bogus keyid; h/w doesn't
3345                  * seem to care, since we don't activate h/w Tx
3346                  * encryption.
3347 		 */
3348 		if (k != NULL &&
3349 		    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
3350 			ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3351 			    RTW_TXCTL0_KEYID_MASK;
3352 		}
3353 
3354 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3355 		    IEEE80211_FC0_TYPE_MGT) {
3356 			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3357 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3358 			    IEEE80211_FC0_SUBTYPE_BEACON)
3359 				ctl0 |= RTW_TXCTL0_BEACON;
3360 		}
3361 
3362 		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3363 		    ic->ic_flags, ic->ic_fragthreshold,
3364 		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3365 		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3366 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3367 			DPRINTF(sc, RTW_DEBUG_XMIT,
3368 			    ("%s: fail compute duration\n", __func__));
3369 			goto post_load_err;
3370 		}
3371 
3372 		d0 = &ts->ts_d0;
3373 
3374 		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3375 
3376 		ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3377 		    __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3378 
3379 		if (d0->d_residue)
3380 			ctl1 |= RTW_TXCTL1_LENGEXT;
3381 
3382 		/* TBD fragmentation */
3383 
3384 		ts->ts_first = tdb->tdb_next;
3385 
3386 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3387 		    BUS_DMASYNC_PREWRITE);
3388 
3389 		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3390 
3391 #if NBPFILTER > 0
3392 		if (ic->ic_rawbpf != NULL)
3393 			bpf_mtap((void *)ic->ic_rawbpf, m0);
3394 
3395 		if (sc->sc_radiobpf != NULL) {
3396 			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3397 
3398 			rt->rt_rate = rate;
3399 
3400 			bpf_mtap2(sc->sc_radiobpf, (void *)rt,
3401 			    sizeof(sc->sc_txtapu), m0);
3402 		}
3403 #endif /* NBPFILTER > 0 */
3404 
3405 		for (i = 0, lastdesc = desc = ts->ts_first;
3406 		     i < dmamap->dm_nsegs;
3407 		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3408 			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3409 				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3410 				    ("%s: seg too long\n", __func__));
3411 				goto post_load_err;
3412 			}
3413 			td = &tdb->tdb_desc[desc];
3414 			td->td_ctl0 = htole32(ctl0);
3415 			td->td_ctl1 = htole32(ctl1);
3416 			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3417 			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3418 			td->td_next = htole32(RTW_NEXT_DESC(tdb, desc));
3419 			if (i != 0)
3420 				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3421 			lastdesc = desc;
3422 #ifdef RTW_DEBUG
3423 			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3424 #endif /* RTW_DEBUG */
3425 		}
3426 
3427 		KASSERT(desc < tdb->tdb_ndesc);
3428 
3429 		ts->ts_ni = ni;
3430 		KASSERT(ni != NULL);
3431 		ts->ts_mbuf = m0;
3432 		ts->ts_last = lastdesc;
3433 		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3434 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3435 		   htole32(RTW_TXCTL0_FS);
3436 
3437 #ifdef RTW_DEBUG
3438 		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3439 		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3440 #endif /* RTW_DEBUG */
3441 
3442 		tdb->tdb_nfree -= dmamap->dm_nsegs;
3443 		tdb->tdb_next = desc;
3444 
3445 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3446 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3447 
3448 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3449 		    htole32(RTW_TXCTL0_OWN);
3450 
3451 #ifdef RTW_DEBUG
3452 		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3453 #endif /* RTW_DEBUG */
3454 
3455 		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3456 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3457 
3458 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3459 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3460 
3461 		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3462 			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3463 		tsb->tsb_tx_timer = 5;
3464 		ifp->if_timer = 1;
3465 		rtw_tx_kick(&sc->sc_regs, tsb->tsb_poll);
3466 	}
3467 out:
3468 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3469 	return;
3470 post_load_err:
3471 	bus_dmamap_unload(sc->sc_dmat, dmamap);
3472 	m_freem(m0);
3473 post_dequeue_err:
3474 	ieee80211_free_node(ni);
3475 	return;
3476 }
3477 
3478 static void
3479 rtw_idle(struct rtw_regs *regs)
3480 {
3481 	int active;
3482 	uint8_t tppoll;
3483 
3484 	/* request stop DMA; wait for packets to stop transmitting. */
3485 
3486 	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3487 	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3488 
3489 	for (active = 0; active < 300 &&
3490 	     (tppoll = RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0;
3491 	     active++)
3492 		DELAY(10);
3493 	printf("%s: transmit DMA idle in %dus, tppoll %02" PRIx8 "\n", __func__,
3494 	    active * 10, tppoll);
3495 }
3496 
3497 static void
3498 rtw_watchdog(struct ifnet *ifp)
3499 {
3500 	int pri, tx_timeouts = 0;
3501 	struct rtw_softc *sc;
3502 	struct rtw_txsoft_blk *tsb;
3503 
3504 	sc = ifp->if_softc;
3505 
3506 	ifp->if_timer = 0;
3507 
3508 	if (!device_is_active(sc->sc_dev))
3509 		return;
3510 
3511 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3512 		tsb = &sc->sc_txsoft_blk[pri];
3513 
3514 		if (tsb->tsb_tx_timer == 0)
3515 			continue;
3516 		else if (--tsb->tsb_tx_timer == 0) {
3517 			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3518 				continue;
3519 			else if (rtw_collect_txring(sc, tsb,
3520 			    &sc->sc_txdesc_blk[pri], 0))
3521 				continue;
3522 			printf("%s: transmit timeout, priority %d\n",
3523 			    ifp->if_xname, pri);
3524 			ifp->if_oerrors++;
3525 			if (pri != RTW_TXPRIBCN)
3526 				tx_timeouts++;
3527 		} else
3528 			ifp->if_timer = 1;
3529 	}
3530 
3531 	if (tx_timeouts > 0) {
3532 		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3533 		 * reset s/w tx-ring pointers, and start transmission.
3534 		 *
3535 		 * TBD Stop/restart just the broken rings?
3536 		 */
3537 		rtw_idle(&sc->sc_regs);
3538 		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
3539 		rtw_txdescs_reset(sc);
3540 		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3541 		rtw_start(ifp);
3542 	}
3543 	ieee80211_watchdog(&sc->sc_ic);
3544 	return;
3545 }
3546 
3547 static void
3548 rtw_next_scan(void *arg)
3549 {
3550 	struct ieee80211com *ic = arg;
3551 	int s;
3552 
3553 	/* don't call rtw_start w/o network interrupts blocked */
3554 	s = splnet();
3555 	if (ic->ic_state == IEEE80211_S_SCAN)
3556 		ieee80211_next_scan(ic);
3557 	splx(s);
3558 }
3559 
3560 static void
3561 rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3562 {
3563 	uint16_t bcnitv, bintritv, intval;
3564 	int i;
3565 	struct rtw_regs *regs = &sc->sc_regs;
3566 
3567 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3568 		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3569 
3570 	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3571 
3572 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3573 
3574 	intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3575 
3576 	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3577 	bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3578 	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3579 	/* interrupt host 1ms before the TBTT */
3580 	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3581 	bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3582 	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3583 	/* magic from Linux */
3584 	RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3585 	RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3586 	rtw_set_access(regs, RTW_ACCESS_NONE);
3587 
3588 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3589 }
3590 
3591 /* Synchronize the hardware state with the software state. */
3592 static int
3593 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3594 {
3595 	struct ifnet *ifp = ic->ic_ifp;
3596 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3597 	enum ieee80211_state ostate;
3598 	int error;
3599 
3600 	ostate = ic->ic_state;
3601 
3602 	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3603 	rtw_led_newstate(sc, nstate);
3604 
3605 	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3606 	if (nstate == IEEE80211_S_INIT) {
3607 		callout_stop(&sc->sc_scan_ch);
3608 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3609 		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3610 	}
3611 
3612 	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3613 		rtw_pwrstate(sc, RTW_ON);
3614 
3615 	if ((error = rtw_tune(sc)) != 0)
3616 		return error;
3617 
3618 	switch (nstate) {
3619 	case IEEE80211_S_INIT:
3620 		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3621 		break;
3622 	case IEEE80211_S_SCAN:
3623 		if (ostate != IEEE80211_S_SCAN) {
3624 			(void)memset(ic->ic_bss->ni_bssid, 0,
3625 			    IEEE80211_ADDR_LEN);
3626 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3627 		}
3628 
3629 		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3630 		    rtw_next_scan, ic);
3631 
3632 		break;
3633 	case IEEE80211_S_RUN:
3634 		switch (ic->ic_opmode) {
3635 		case IEEE80211_M_HOSTAP:
3636 		case IEEE80211_M_IBSS:
3637 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3638 			/*FALLTHROUGH*/
3639 		case IEEE80211_M_AHDEMO:
3640 		case IEEE80211_M_STA:
3641 			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3642 			    ic->ic_bss->ni_intval);
3643 			break;
3644 		case IEEE80211_M_MONITOR:
3645 			break;
3646 		}
3647 		rtw_set_nettype(sc, ic->ic_opmode);
3648 		break;
3649 	case IEEE80211_S_ASSOC:
3650 	case IEEE80211_S_AUTH:
3651 		break;
3652 	}
3653 
3654 	if (nstate != IEEE80211_S_SCAN)
3655 		callout_stop(&sc->sc_scan_ch);
3656 
3657 	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3658 }
3659 
3660 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3661 static uint64_t
3662 rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3663 {
3664 	uint32_t tsftl, tsfth;
3665 
3666 	tsfth = RTW_READ(regs, RTW_TSFTRH);
3667 	tsftl = RTW_READ(regs, RTW_TSFTRL);
3668 	if (tsftl < rstamp)	/* Compensate for rollover. */
3669 		tsfth--;
3670 	return ((uint64_t)tsfth << 32) | rstamp;
3671 }
3672 
3673 static void
3674 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3675     struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3676 {
3677 	struct ifnet *ifp = ic->ic_ifp;
3678 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3679 
3680 	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3681 
3682 	switch (subtype) {
3683 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3684 	case IEEE80211_FC0_SUBTYPE_BEACON:
3685 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3686 		    ic->ic_state == IEEE80211_S_RUN &&
3687 		    device_is_active(sc->sc_dev)) {
3688 			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3689 			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3690 				(void)ieee80211_ibss_merge(ni);
3691 		}
3692 		break;
3693 	default:
3694 		break;
3695 	}
3696 	return;
3697 }
3698 
3699 static struct ieee80211_node *
3700 rtw_node_alloc(struct ieee80211_node_table *nt)
3701 {
3702 	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3703 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3704 	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3705 
3706 	DPRINTF(sc, RTW_DEBUG_NODE,
3707 	    ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
3708 	return ni;
3709 }
3710 
3711 static void
3712 rtw_node_free(struct ieee80211_node *ni)
3713 {
3714 	struct ieee80211com *ic = ni->ni_ic;
3715 	struct ifnet *ifp = ic->ic_ifp;
3716 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3717 
3718 	DPRINTF(sc, RTW_DEBUG_NODE,
3719 	    ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
3720 	    ether_sprintf(ni->ni_bssid)));
3721 	(*sc->sc_mtbl.mt_node_free)(ni);
3722 }
3723 
3724 static int
3725 rtw_media_change(struct ifnet *ifp)
3726 {
3727 	int error;
3728 
3729 	error = ieee80211_media_change(ifp);
3730 	if (error == ENETRESET) {
3731 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3732 		    (IFF_RUNNING|IFF_UP))
3733 			rtw_init(ifp);		/* XXX lose error */
3734 		error = 0;
3735 	}
3736 	return error;
3737 }
3738 
3739 static void
3740 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3741 {
3742 	struct rtw_softc *sc = ifp->if_softc;
3743 
3744 	if (!device_is_active(sc->sc_dev)) {
3745 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3746 		imr->ifm_status = 0;
3747 		return;
3748 	}
3749 	ieee80211_media_status(ifp, imr);
3750 }
3751 
3752 static inline void
3753 rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3754 {
3755 	(void)strlcpy(ifp->if_xname, dvname, IFNAMSIZ);
3756 	ifp->if_softc = softc;
3757 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3758 	    IFF_NOTRAILERS;
3759 	ifp->if_ioctl = rtw_ioctl;
3760 	ifp->if_start = rtw_start;
3761 	ifp->if_watchdog = rtw_watchdog;
3762 	ifp->if_init = rtw_init;
3763 	ifp->if_stop = rtw_stop;
3764 }
3765 
3766 static inline void
3767 rtw_set80211props(struct ieee80211com *ic)
3768 {
3769 	int nrate;
3770 	ic->ic_phytype = IEEE80211_T_DS;
3771 	ic->ic_opmode = IEEE80211_M_STA;
3772 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3773 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
3774 
3775 	nrate = 0;
3776 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3777 	    IEEE80211_RATE_BASIC | 2;
3778 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3779 	    IEEE80211_RATE_BASIC | 4;
3780 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3781 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3782 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3783 }
3784 
3785 static inline void
3786 rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3787 {
3788 	mtbl->mt_newstate = ic->ic_newstate;
3789 	ic->ic_newstate = rtw_newstate;
3790 
3791 	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3792 	ic->ic_recv_mgmt = rtw_recv_mgmt;
3793 
3794 	mtbl->mt_node_free = ic->ic_node_free;
3795 	ic->ic_node_free = rtw_node_free;
3796 
3797 	mtbl->mt_node_alloc = ic->ic_node_alloc;
3798 	ic->ic_node_alloc = rtw_node_alloc;
3799 
3800 	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3801 	ic->ic_crypto.cs_key_set = rtw_key_set;
3802 	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3803 	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3804 }
3805 
3806 static inline void
3807 rtw_init_radiotap(struct rtw_softc *sc)
3808 {
3809 	uint32_t present;
3810 
3811 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3812 	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3813 
3814 	if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
3815 		present = htole32(RTW_PHILIPS_RX_RADIOTAP_PRESENT);
3816 	else
3817 		present = htole32(RTW_RX_RADIOTAP_PRESENT);
3818 	sc->sc_rxtap.rr_ihdr.it_present = present;
3819 
3820 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3821 	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3822 	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3823 }
3824 
3825 static int
3826 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3827 {
3828 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3829 	SIMPLEQ_INIT(&tsb->tsb_freeq);
3830 	tsb->tsb_ndesc = qlen;
3831 	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3832 	    M_NOWAIT);
3833 	if (tsb->tsb_desc == NULL)
3834 		return ENOMEM;
3835 	return 0;
3836 }
3837 
3838 static void
3839 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3840 {
3841 	int pri;
3842 	struct rtw_txsoft_blk *tsb;
3843 
3844 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3845 		tsb = &sc->sc_txsoft_blk[pri];
3846 		free(tsb->tsb_desc, M_DEVBUF);
3847 		tsb->tsb_desc = NULL;
3848 	}
3849 }
3850 
3851 static int
3852 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3853 {
3854 	int pri, rc = 0;
3855 	int qlen[RTW_NTXPRI] =
3856 	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3857 	struct rtw_txsoft_blk *tsbs;
3858 
3859 	tsbs = sc->sc_txsoft_blk;
3860 
3861 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3862 		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3863 		if (rc != 0)
3864 			break;
3865 	}
3866 	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3867 	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3868 	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3869 	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3870 	return rc;
3871 }
3872 
3873 static void
3874 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3875     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3876 {
3877 	tdb->tdb_ndesc = ndesc;
3878 	tdb->tdb_desc = desc;
3879 	tdb->tdb_physbase = physbase;
3880 	tdb->tdb_ofs = ofs;
3881 
3882 	(void)memset(tdb->tdb_desc, 0,
3883 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3884 
3885 	rtw_txdesc_blk_init(tdb);
3886 	tdb->tdb_next = 0;
3887 }
3888 
3889 static void
3890 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3891 {
3892 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3893 	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3894 	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3895 
3896 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3897 	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3898 	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3899 
3900 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3901 	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3902 	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3903 
3904 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3905 	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3906 	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3907 }
3908 
3909 static struct rtw_rf *
3910 rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3911 {
3912 	rtw_rf_write_t rf_write;
3913 	struct rtw_rf *rf;
3914 
3915 	switch (rfchipid) {
3916 	default:
3917 		rf_write = rtw_rf_hostwrite;
3918 		break;
3919 	case RTW_RFCHIPID_INTERSIL:
3920 	case RTW_RFCHIPID_PHILIPS:
3921 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3922 	case RTW_RFCHIPID_RFMD:
3923 		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3924 		break;
3925 	}
3926 
3927 	switch (rfchipid) {
3928 	case RTW_RFCHIPID_GCT:
3929 		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3930 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3931 		break;
3932 	case RTW_RFCHIPID_MAXIM:
3933 		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3934 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3935 		break;
3936 	case RTW_RFCHIPID_PHILIPS:
3937 		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
3938 		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3939 		break;
3940 	case RTW_RFCHIPID_RFMD:
3941 		/* XXX RFMD has no RF constructor */
3942 		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3943 		/*FALLTHROUGH*/
3944 	default:
3945 		return NULL;
3946 	}
3947 	rf->rf_continuous_tx_cb =
3948 	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
3949 	rf->rf_continuous_tx_arg = (void *)sc;
3950 	return rf;
3951 }
3952 
3953 /* Revision C and later use a different PHY delay setting than
3954  * revisions A and B.
3955  */
3956 static uint8_t
3957 rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
3958 {
3959 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
3960 #define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
3961 
3962 	uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
3963 
3964 	RTW_WRITE(regs, RTW_RCR, REVAB);
3965 	RTW_WBW(regs, RTW_RCR, RTW_RCR);
3966 	RTW_WRITE(regs, RTW_RCR, REVC);
3967 
3968 	RTW_WBR(regs, RTW_RCR, RTW_RCR);
3969 	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
3970 		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
3971 
3972 	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
3973 	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
3974 
3975 	return phydelay;
3976 #undef REVC
3977 }
3978 
3979 void
3980 rtw_attach(struct rtw_softc *sc)
3981 {
3982 	struct ifnet *ifp = &sc->sc_if;
3983 	struct ieee80211com *ic = &sc->sc_ic;
3984 	struct rtw_txsoft_blk *tsb;
3985 	int pri, rc;
3986 
3987 	rtw_cipher_wep = ieee80211_cipher_wep;
3988 	rtw_cipher_wep.ic_decap = rtw_wep_decap;
3989 
3990 	NEXT_ATTACH_STATE(sc, DETACHED);
3991 
3992 	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
3993 	case RTW_TCR_HWVERID_F:
3994 		sc->sc_hwverid = 'F';
3995 		break;
3996 	case RTW_TCR_HWVERID_D:
3997 		sc->sc_hwverid = 'D';
3998 		break;
3999 	default:
4000 		sc->sc_hwverid = '?';
4001 		break;
4002 	}
4003 	aprint_verbose_dev(sc->sc_dev, "hardware version %c\n",
4004 	    sc->sc_hwverid);
4005 
4006 	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4007 	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4008 	    0);
4009 
4010 	if (rc != 0) {
4011 		aprint_error_dev(sc->sc_dev,
4012 		    "could not allocate hw descriptors, error %d\n", rc);
4013 		goto err;
4014 	}
4015 
4016 	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4017 
4018 	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4019 	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4020 	    (void **)&sc->sc_descs, BUS_DMA_COHERENT);
4021 
4022 	if (rc != 0) {
4023 		aprint_error_dev(sc->sc_dev,
4024 		    "could not map hw descriptors, error %d\n", rc);
4025 		goto err;
4026 	}
4027 	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4028 
4029 	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4030 	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4031 
4032 	if (rc != 0) {
4033 		aprint_error_dev(sc->sc_dev,
4034 		    "could not create DMA map for hw descriptors, error %d\n",
4035 		    rc);
4036 		goto err;
4037 	}
4038 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4039 
4040 	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4041 	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4042 
4043 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4044 		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4045 		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4046 	}
4047 
4048 	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4049 	    sizeof(struct rtw_descs), NULL, 0);
4050 
4051 	if (rc != 0) {
4052 		aprint_error_dev(sc->sc_dev,
4053 		    "could not load DMA map for hw descriptors, error %d\n",
4054 		    rc);
4055 		goto err;
4056 	}
4057 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4058 
4059 	if (rtw_txsoft_blk_setup_all(sc) != 0)
4060 		goto err;
4061 	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4062 
4063 	rtw_txdesc_blk_setup_all(sc);
4064 
4065 	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4066 
4067 	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4068 
4069 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4070 		tsb = &sc->sc_txsoft_blk[pri];
4071 
4072 		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4073 		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4074 			aprint_error_dev(sc->sc_dev,
4075 			    "could not load DMA map for hw tx descriptors, "
4076 			    "error %d\n", rc);
4077 			goto err;
4078 		}
4079 	}
4080 
4081 	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4082 	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4083 	                                    RTW_RXQLEN)) != 0) {
4084 		aprint_error_dev(sc->sc_dev,
4085 		    "could not load DMA map for hw rx descriptors, error %d\n",
4086 		    rc);
4087 		goto err;
4088 	}
4089 	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4090 
4091 	/* Reset the chip to a known state. */
4092 	if (rtw_reset(sc) != 0)
4093 		goto err;
4094 	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4095 
4096 	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4097 
4098 	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4099 		sc->sc_flags |= RTW_F_9356SROM;
4100 
4101 	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4102 	    sc->sc_dev) != 0)
4103 		goto err;
4104 
4105 	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4106 
4107 	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4108 	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4109 	    sc->sc_dev) != 0) {
4110 		aprint_error_dev(sc->sc_dev,
4111 		    "attach failed, malformed serial ROM\n");
4112 		goto err;
4113 	}
4114 
4115 	aprint_verbose_dev(sc->sc_dev, "%s PHY\n",
4116 	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4117 
4118 	aprint_verbose_dev(sc->sc_dev, "carrier-sense threshold %u\n",
4119 	    sc->sc_csthr);
4120 
4121 	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4122 
4123 	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4124 	    sc->sc_flags & RTW_F_DIGPHY);
4125 
4126 	if (sc->sc_rf == NULL) {
4127 		aprint_verbose_dev(sc->sc_dev,
4128 		    "attach failed, could not attach RF\n");
4129 		goto err;
4130 	}
4131 
4132 	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4133 
4134 	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4135 
4136 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4137 	    ("%s: PHY delay %d\n", device_xname(sc->sc_dev), sc->sc_phydelay));
4138 
4139 	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4140 		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4141 
4142 	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels, sc->sc_dev);
4143 
4144 	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4145 	    sc->sc_dev) != 0)
4146 		goto err;
4147 	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4148 
4149 	rtw_setifprops(ifp, device_xname(sc->sc_dev), (void*)sc);
4150 
4151 	IFQ_SET_READY(&ifp->if_snd);
4152 
4153 	sc->sc_ic.ic_ifp = ifp;
4154 	rtw_set80211props(&sc->sc_ic);
4155 
4156 	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4157 
4158 	/*
4159 	 * Call MI attach routines.
4160 	 */
4161 	if_attach(ifp);
4162 	ieee80211_ifattach(&sc->sc_ic);
4163 
4164 	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4165 
4166 	/* possibly we should fill in our own sc_send_prresp, since
4167 	 * the RTL8180 is probably sending probe responses in ad hoc
4168 	 * mode.
4169 	 */
4170 
4171 	/* complete initialization */
4172 	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4173 	callout_init(&sc->sc_scan_ch, 0);
4174 
4175 	rtw_init_radiotap(sc);
4176 
4177 #if NBPFILTER > 0
4178 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
4179 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4180 #endif
4181 
4182 	NEXT_ATTACH_STATE(sc, FINISHED);
4183 
4184 	ieee80211_announce(ic);
4185 	return;
4186 err:
4187 	rtw_detach(sc);
4188 	return;
4189 }
4190 
4191 int
4192 rtw_detach(struct rtw_softc *sc)
4193 {
4194 	struct ifnet *ifp = &sc->sc_if;
4195 	int pri, s;
4196 
4197 	s = splnet();
4198 
4199 	switch (sc->sc_attach_state) {
4200 	case FINISHED:
4201 		rtw_stop(ifp, 1);
4202 
4203 		pmf_device_deregister(sc->sc_dev);
4204 		callout_stop(&sc->sc_scan_ch);
4205 		ieee80211_ifdetach(&sc->sc_ic);
4206 		if_detach(ifp);
4207 		rtw_led_detach(&sc->sc_led_state);
4208 		/*FALLTHROUGH*/
4209 	case FINISH_ID_STA:
4210 	case FINISH_RF_ATTACH:
4211 		rtw_rf_destroy(sc->sc_rf);
4212 		sc->sc_rf = NULL;
4213 		/*FALLTHROUGH*/
4214 	case FINISH_PARSE_SROM:
4215 	case FINISH_READ_SROM:
4216 		rtw_srom_free(&sc->sc_srom);
4217 		/*FALLTHROUGH*/
4218 	case FINISH_RESET:
4219 	case FINISH_RXMAPS_CREATE:
4220 		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4221 		    RTW_RXQLEN);
4222 		/*FALLTHROUGH*/
4223 	case FINISH_TXMAPS_CREATE:
4224 		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4225 			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4226 			    sc->sc_txsoft_blk[pri].tsb_desc,
4227 			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4228 		}
4229 		/*FALLTHROUGH*/
4230 	case FINISH_TXDESCBLK_SETUP:
4231 	case FINISH_TXCTLBLK_SETUP:
4232 		rtw_txsoft_blk_cleanup_all(sc);
4233 		/*FALLTHROUGH*/
4234 	case FINISH_DESCMAP_LOAD:
4235 		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4236 		/*FALLTHROUGH*/
4237 	case FINISH_DESCMAP_CREATE:
4238 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4239 		/*FALLTHROUGH*/
4240 	case FINISH_DESC_MAP:
4241 		bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_descs,
4242 		    sizeof(struct rtw_descs));
4243 		/*FALLTHROUGH*/
4244 	case FINISH_DESC_ALLOC:
4245 		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4246 		    sc->sc_desc_nsegs);
4247 		/*FALLTHROUGH*/
4248 	case DETACHED:
4249 		NEXT_ATTACH_STATE(sc, DETACHED);
4250 		break;
4251 	}
4252 	splx(s);
4253 	return 0;
4254 }
4255