xref: /netbsd-src/sys/dev/ic/rtw.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /* $NetBSD: rtw.c,v 1.94 2007/11/18 12:40:15 jnemeth Exp $ */
2 /*-
3  * Copyright (c) 2004, 2005, 2006, 2007 David Young.  All rights
4  * reserved.
5  *
6  * Programmed for NetBSD by David Young.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The name of David Young may not be used to endorse or promote
17  *    products derived from this software without specific prior
18  *    written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
21  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
23  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
24  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
25  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
26  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
31  * OF SUCH DAMAGE.
32  */
33 /*
34  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
35  */
36 
37 #include <sys/cdefs.h>
38 __KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.94 2007/11/18 12:40:15 jnemeth Exp $");
39 
40 #include "bpfilter.h"
41 
42 #include <sys/param.h>
43 #include <sys/sysctl.h>
44 #include <sys/systm.h>
45 #include <sys/callout.h>
46 #include <sys/mbuf.h>
47 #include <sys/malloc.h>
48 #include <sys/kernel.h>
49 #include <sys/time.h>
50 #include <sys/types.h>
51 
52 #include <machine/endian.h>
53 #include <sys/bus.h>
54 #include <sys/intr.h>	/* splnet */
55 
56 #include <uvm/uvm_extern.h>
57 
58 #include <net/if.h>
59 #include <net/if_media.h>
60 #include <net/if_ether.h>
61 
62 #include <net80211/ieee80211_netbsd.h>
63 #include <net80211/ieee80211_var.h>
64 #include <net80211/ieee80211_radiotap.h>
65 
66 #if NBPFILTER > 0
67 #include <net/bpf.h>
68 #endif
69 
70 #include <dev/ic/rtwreg.h>
71 #include <dev/ic/rtwvar.h>
72 #include <dev/ic/rtwphyio.h>
73 #include <dev/ic/rtwphy.h>
74 
75 #include <dev/ic/smc93cx6var.h>
76 
77 #define	KASSERT2(__cond, __msg)		\
78 	do {				\
79 		if (!(__cond))		\
80 			panic __msg ;	\
81 	} while (0)
82 
83 static int rtw_rfprog_fallback = 0;
84 static int rtw_host_rfio = 0;
85 
86 #ifdef RTW_DEBUG
87 int rtw_debug = 0;
88 static int rtw_rxbufs_limit = RTW_RXQLEN;
89 #endif /* RTW_DEBUG */
90 
91 #define NEXT_ATTACH_STATE(sc, state) do {			\
92 	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
93 	    ("%s: attach state %s\n", __func__, #state));	\
94 	sc->sc_attach_state = state;				\
95 } while (0)
96 
97 int rtw_dwelltime = 200;	/* milliseconds */
98 static struct ieee80211_cipher rtw_cipher_wep;
99 
100 static void rtw_start(struct ifnet *);
101 static void rtw_reset_oactive(struct rtw_softc *);
102 static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
103     struct ieee80211_node *);
104 static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
105 
106 static void rtw_io_enable(struct rtw_softc *, uint8_t, int);
107 static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
108 static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
109     const u_int8_t[IEEE80211_ADDR_LEN]);
110 static void rtw_key_update_end(struct ieee80211com *);
111 static void rtw_key_update_begin(struct ieee80211com *);
112 static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
113 static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
114 
115 static void rtw_led_attach(struct rtw_led_state *, void *);
116 static void rtw_led_init(struct rtw_regs *);
117 static void rtw_led_slowblink(void *);
118 static void rtw_led_fastblink(void *);
119 static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
120 
121 static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
122 static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
123 #ifdef RTW_DEBUG
124 static void rtw_dump_rings(struct rtw_softc *sc);
125 static void rtw_print_txdesc(struct rtw_softc *, const char *,
126     struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
127 static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
128 static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
129 #endif /* RTW_DEBUG */
130 #ifdef RTW_DIAG
131 static void rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln);
132 #endif /* RTW_DIAG */
133 
134 /*
135  * Setup sysctl(3) MIB, hw.rtw.*
136  *
137  * TBD condition CTLFLAG_PERMANENT on being an LKM or not
138  */
139 SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
140 {
141 	int rc;
142 	const struct sysctlnode *cnode, *rnode;
143 
144 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
145 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
146 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
147 		goto err;
148 
149 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
150 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
151 	    "Realtek RTL818x 802.11 controls",
152 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
153 		goto err;
154 
155 #ifdef RTW_DEBUG
156 	/* control debugging printfs */
157 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
158 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
159 	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
160 	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
161 	    CTL_CREATE, CTL_EOL)) != 0)
162 		goto err;
163 
164 	/* Limit rx buffers, for simulating resource exhaustion. */
165 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
166 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
167 	    "rxbufs_limit",
168 	    SYSCTL_DESCR("Set rx buffers limit"),
169 	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
170 	    CTL_CREATE, CTL_EOL)) != 0)
171 		goto err;
172 
173 #endif /* RTW_DEBUG */
174 	/* set fallback RF programming method */
175 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
176 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
177 	    "rfprog_fallback",
178 	    SYSCTL_DESCR("Set fallback RF programming method"),
179 	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
180 	    CTL_CREATE, CTL_EOL)) != 0)
181 		goto err;
182 
183 	/* force host to control RF I/O bus */
184 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
185 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
186 	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
187 	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
188 	    CTL_CREATE, CTL_EOL)) != 0)
189 		goto err;
190 
191 	return;
192 err:
193 	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
194 }
195 
196 static int
197 rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
198 {
199 	int error, t;
200 	struct sysctlnode node;
201 
202 	node = *rnode;
203 	t = *(int*)rnode->sysctl_data;
204 	node.sysctl_data = &t;
205 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
206 	if (error || newp == NULL)
207 		return (error);
208 
209 	if (t < lower || t > upper)
210 		return (EINVAL);
211 
212 	*(int*)rnode->sysctl_data = t;
213 
214 	return (0);
215 }
216 
217 static int
218 rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
219 {
220 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
221 	    __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
222 }
223 
224 static int
225 rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
226 {
227 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
228 }
229 
230 #ifdef RTW_DEBUG
231 static int
232 rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
233 {
234 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
235 	    0, RTW_DEBUG_MAX);
236 }
237 
238 static int
239 rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
240 {
241 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
242 	    0, RTW_RXQLEN);
243 }
244 
245 static void
246 rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
247 {
248 #define PRINTREG32(sc, reg)				\
249 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
250 	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
251 	    dvname, reg, RTW_READ(regs, reg)))
252 
253 #define PRINTREG16(sc, reg)				\
254 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
255 	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
256 	    dvname, reg, RTW_READ16(regs, reg)))
257 
258 #define PRINTREG8(sc, reg)				\
259 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
260 	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
261 	    dvname, reg, RTW_READ8(regs, reg)))
262 
263 	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
264 
265 	PRINTREG32(regs, RTW_IDR0);
266 	PRINTREG32(regs, RTW_IDR1);
267 	PRINTREG32(regs, RTW_MAR0);
268 	PRINTREG32(regs, RTW_MAR1);
269 	PRINTREG32(regs, RTW_TSFTRL);
270 	PRINTREG32(regs, RTW_TSFTRH);
271 	PRINTREG32(regs, RTW_TLPDA);
272 	PRINTREG32(regs, RTW_TNPDA);
273 	PRINTREG32(regs, RTW_THPDA);
274 	PRINTREG32(regs, RTW_TCR);
275 	PRINTREG32(regs, RTW_RCR);
276 	PRINTREG32(regs, RTW_TINT);
277 	PRINTREG32(regs, RTW_TBDA);
278 	PRINTREG32(regs, RTW_ANAPARM);
279 	PRINTREG32(regs, RTW_BB);
280 	PRINTREG32(regs, RTW_PHYCFG);
281 	PRINTREG32(regs, RTW_WAKEUP0L);
282 	PRINTREG32(regs, RTW_WAKEUP0H);
283 	PRINTREG32(regs, RTW_WAKEUP1L);
284 	PRINTREG32(regs, RTW_WAKEUP1H);
285 	PRINTREG32(regs, RTW_WAKEUP2LL);
286 	PRINTREG32(regs, RTW_WAKEUP2LH);
287 	PRINTREG32(regs, RTW_WAKEUP2HL);
288 	PRINTREG32(regs, RTW_WAKEUP2HH);
289 	PRINTREG32(regs, RTW_WAKEUP3LL);
290 	PRINTREG32(regs, RTW_WAKEUP3LH);
291 	PRINTREG32(regs, RTW_WAKEUP3HL);
292 	PRINTREG32(regs, RTW_WAKEUP3HH);
293 	PRINTREG32(regs, RTW_WAKEUP4LL);
294 	PRINTREG32(regs, RTW_WAKEUP4LH);
295 	PRINTREG32(regs, RTW_WAKEUP4HL);
296 	PRINTREG32(regs, RTW_WAKEUP4HH);
297 	PRINTREG32(regs, RTW_DK0);
298 	PRINTREG32(regs, RTW_DK1);
299 	PRINTREG32(regs, RTW_DK2);
300 	PRINTREG32(regs, RTW_DK3);
301 	PRINTREG32(regs, RTW_RETRYCTR);
302 	PRINTREG32(regs, RTW_RDSAR);
303 	PRINTREG32(regs, RTW_FER);
304 	PRINTREG32(regs, RTW_FEMR);
305 	PRINTREG32(regs, RTW_FPSR);
306 	PRINTREG32(regs, RTW_FFER);
307 
308 	/* 16-bit registers */
309 	PRINTREG16(regs, RTW_BRSR);
310 	PRINTREG16(regs, RTW_IMR);
311 	PRINTREG16(regs, RTW_ISR);
312 	PRINTREG16(regs, RTW_BCNITV);
313 	PRINTREG16(regs, RTW_ATIMWND);
314 	PRINTREG16(regs, RTW_BINTRITV);
315 	PRINTREG16(regs, RTW_ATIMTRITV);
316 	PRINTREG16(regs, RTW_CRC16ERR);
317 	PRINTREG16(regs, RTW_CRC0);
318 	PRINTREG16(regs, RTW_CRC1);
319 	PRINTREG16(regs, RTW_CRC2);
320 	PRINTREG16(regs, RTW_CRC3);
321 	PRINTREG16(regs, RTW_CRC4);
322 	PRINTREG16(regs, RTW_CWR);
323 
324 	/* 8-bit registers */
325 	PRINTREG8(regs, RTW_CR);
326 	PRINTREG8(regs, RTW_9346CR);
327 	PRINTREG8(regs, RTW_CONFIG0);
328 	PRINTREG8(regs, RTW_CONFIG1);
329 	PRINTREG8(regs, RTW_CONFIG2);
330 	PRINTREG8(regs, RTW_MSR);
331 	PRINTREG8(regs, RTW_CONFIG3);
332 	PRINTREG8(regs, RTW_CONFIG4);
333 	PRINTREG8(regs, RTW_TESTR);
334 	PRINTREG8(regs, RTW_PSR);
335 	PRINTREG8(regs, RTW_SCR);
336 	PRINTREG8(regs, RTW_PHYDELAY);
337 	PRINTREG8(regs, RTW_CRCOUNT);
338 	PRINTREG8(regs, RTW_PHYADDR);
339 	PRINTREG8(regs, RTW_PHYDATAW);
340 	PRINTREG8(regs, RTW_PHYDATAR);
341 	PRINTREG8(regs, RTW_CONFIG5);
342 	PRINTREG8(regs, RTW_TPPOLL);
343 
344 	PRINTREG16(regs, RTW_BSSID16);
345 	PRINTREG32(regs, RTW_BSSID32);
346 #undef PRINTREG32
347 #undef PRINTREG16
348 #undef PRINTREG8
349 }
350 #endif /* RTW_DEBUG */
351 
352 void
353 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
354 {
355 	struct rtw_regs *regs = &sc->sc_regs;
356 
357 	uint32_t tcr;
358 	tcr = RTW_READ(regs, RTW_TCR);
359 	tcr &= ~RTW_TCR_LBK_MASK;
360 	if (enable)
361 		tcr |= RTW_TCR_LBK_CONT;
362 	else
363 		tcr |= RTW_TCR_LBK_NORMAL;
364 	RTW_WRITE(regs, RTW_TCR, tcr);
365 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
366 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
367 	rtw_txdac_enable(sc, !enable);
368 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
369 	rtw_set_access(regs, RTW_ACCESS_NONE);
370 }
371 
372 #ifdef RTW_DEBUG
373 static const char *
374 rtw_access_string(enum rtw_access access)
375 {
376 	switch (access) {
377 	case RTW_ACCESS_NONE:
378 		return "none";
379 	case RTW_ACCESS_CONFIG:
380 		return "config";
381 	case RTW_ACCESS_ANAPARM:
382 		return "anaparm";
383 	default:
384 		return "unknown";
385 	}
386 }
387 #endif /* RTW_DEBUG */
388 
389 static void
390 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
391 {
392 	KASSERT(/* naccess >= RTW_ACCESS_NONE && */
393 	    naccess <= RTW_ACCESS_ANAPARM);
394 	KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
395 	    regs->r_access <= RTW_ACCESS_ANAPARM);
396 
397 	if (naccess == regs->r_access)
398 		return;
399 
400 	switch (naccess) {
401 	case RTW_ACCESS_NONE:
402 		switch (regs->r_access) {
403 		case RTW_ACCESS_ANAPARM:
404 			rtw_anaparm_enable(regs, 0);
405 			/*FALLTHROUGH*/
406 		case RTW_ACCESS_CONFIG:
407 			rtw_config0123_enable(regs, 0);
408 			/*FALLTHROUGH*/
409 		case RTW_ACCESS_NONE:
410 			break;
411 		}
412 		break;
413 	case RTW_ACCESS_CONFIG:
414 		switch (regs->r_access) {
415 		case RTW_ACCESS_NONE:
416 			rtw_config0123_enable(regs, 1);
417 			/*FALLTHROUGH*/
418 		case RTW_ACCESS_CONFIG:
419 			break;
420 		case RTW_ACCESS_ANAPARM:
421 			rtw_anaparm_enable(regs, 0);
422 			break;
423 		}
424 		break;
425 	case RTW_ACCESS_ANAPARM:
426 		switch (regs->r_access) {
427 		case RTW_ACCESS_NONE:
428 			rtw_config0123_enable(regs, 1);
429 			/*FALLTHROUGH*/
430 		case RTW_ACCESS_CONFIG:
431 			rtw_anaparm_enable(regs, 1);
432 			/*FALLTHROUGH*/
433 		case RTW_ACCESS_ANAPARM:
434 			break;
435 		}
436 		break;
437 	}
438 }
439 
440 void
441 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
442 {
443 	rtw_set_access1(regs, access);
444 	RTW_DPRINTF(RTW_DEBUG_ACCESS,
445 	    ("%s: access %s -> %s\n", __func__,
446 	    rtw_access_string(regs->r_access),
447 	    rtw_access_string(access)));
448 	regs->r_access = access;
449 }
450 
451 /*
452  * Enable registers, switch register banks.
453  */
454 void
455 rtw_config0123_enable(struct rtw_regs *regs, int enable)
456 {
457 	uint8_t ecr;
458 	ecr = RTW_READ8(regs, RTW_9346CR);
459 	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
460 	if (enable)
461 		ecr |= RTW_9346CR_EEM_CONFIG;
462 	else {
463 		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
464 		ecr |= RTW_9346CR_EEM_NORMAL;
465 	}
466 	RTW_WRITE8(regs, RTW_9346CR, ecr);
467 	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
468 }
469 
470 /* requires rtw_config0123_enable(, 1) */
471 void
472 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
473 {
474 	uint8_t cfg3;
475 
476 	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
477 	cfg3 |= RTW_CONFIG3_CLKRUNEN;
478 	if (enable)
479 		cfg3 |= RTW_CONFIG3_PARMEN;
480 	else
481 		cfg3 &= ~RTW_CONFIG3_PARMEN;
482 	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
483 	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
484 }
485 
486 /* requires rtw_anaparm_enable(, 1) */
487 void
488 rtw_txdac_enable(struct rtw_softc *sc, int enable)
489 {
490 	uint32_t anaparm;
491 	struct rtw_regs *regs = &sc->sc_regs;
492 
493 	anaparm = RTW_READ(regs, RTW_ANAPARM);
494 	if (enable)
495 		anaparm &= ~RTW_ANAPARM_TXDACOFF;
496 	else
497 		anaparm |= RTW_ANAPARM_TXDACOFF;
498 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
499 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
500 }
501 
502 static inline int
503 rtw_chip_reset1(struct rtw_regs *regs, const char *dvname)
504 {
505 	uint8_t cr;
506 	int i;
507 
508 	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
509 
510 	RTW_WBR(regs, RTW_CR, RTW_CR);
511 
512 	for (i = 0; i < 1000; i++) {
513 		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
514 			RTW_DPRINTF(RTW_DEBUG_RESET,
515 			    ("%s: reset in %dus\n", dvname, i));
516 			return 0;
517 		}
518 		RTW_RBR(regs, RTW_CR, RTW_CR);
519 		DELAY(10); /* 10us */
520 	}
521 
522 	printf("%s: reset failed\n", dvname);
523 	return ETIMEDOUT;
524 }
525 
526 static inline int
527 rtw_chip_reset(struct rtw_regs *regs, const char *dvname)
528 {
529 	uint32_t tcr;
530 
531 	/* from Linux driver */
532 	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
533 	      __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
534 
535 	RTW_WRITE(regs, RTW_TCR, tcr);
536 
537 	RTW_WBW(regs, RTW_CR, RTW_TCR);
538 
539 	return rtw_chip_reset1(regs, dvname);
540 }
541 
542 static int
543 rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
544 {
545 	struct ieee80211_key keycopy;
546 
547 	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
548 
549 	keycopy = *k;
550 	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
551 
552 	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
553 }
554 
555 static int
556 rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
557 {
558 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
559 	u_int keyix = k->wk_keyix;
560 
561 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__, keyix));
562 
563 	if (keyix >= IEEE80211_WEP_NKID)
564 		return 0;
565 	if (k->wk_keylen != 0)
566 		sc->sc_flags &= ~RTW_F_DK_VALID;
567 
568 	return 1;
569 }
570 
571 static int
572 rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
573     const u_int8_t mac[IEEE80211_ADDR_LEN])
574 {
575 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
576 
577 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
578 
579 	if (k->wk_keyix >= IEEE80211_WEP_NKID)
580 		return 0;
581 
582 	sc->sc_flags &= ~RTW_F_DK_VALID;
583 
584 	return 1;
585 }
586 
587 static void
588 rtw_key_update_begin(struct ieee80211com *ic)
589 {
590 #ifdef RTW_DEBUG
591 	struct ifnet *ifp = ic->ic_ifp;
592 	struct rtw_softc *sc = ifp->if_softc;
593 #endif
594 
595 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
596 }
597 
598 static void
599 rtw_key_update_end(struct ieee80211com *ic)
600 {
601 	struct ifnet *ifp = ic->ic_ifp;
602 	struct rtw_softc *sc = ifp->if_softc;
603 
604 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
605 
606 	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
607 	    (sc->sc_flags & RTW_F_ENABLED) == 0 ||
608 	    (sc->sc_flags & RTW_F_INVALID) != 0)
609 		return;
610 
611 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
612 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
613 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
614 	    (ifp->if_flags & IFF_RUNNING) != 0);
615 }
616 
617 static inline int
618 rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
619 {
620 	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
621 		return 0;
622 
623 	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
624 		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
625 }
626 
627 static void
628 rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
629 {
630 	uint8_t psr, scr;
631 	int i, keylen;
632 	struct rtw_regs *regs;
633 	union rtw_keys *rk;
634 
635 	regs = &sc->sc_regs;
636 	rk = &sc->sc_keys;
637 
638 	(void)memset(rk, 0, sizeof(rk));
639 
640 	/* Temporarily use software crypto for all keys. */
641 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
642 		if (wk[i].wk_cipher == &rtw_cipher_wep)
643 			wk[i].wk_cipher = &ieee80211_cipher_wep;
644 	}
645 
646 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
647 
648 	psr = RTW_READ8(regs, RTW_PSR);
649 	scr = RTW_READ8(regs, RTW_SCR);
650 	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
651 
652 	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
653 		goto out;
654 
655 	for (keylen = i = 0; i < IEEE80211_WEP_NKID; i++) {
656 		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
657 			continue;
658 		if (i == txkey) {
659 			keylen = wk[i].wk_keylen;
660 			break;
661 		}
662 		keylen = MAX(keylen, wk[i].wk_keylen);
663 	}
664 
665 	if (keylen == 5)
666 		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
667 	else if (keylen == 13)
668 		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
669 
670 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
671 		if (wk[i].wk_keylen != keylen ||
672 		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
673 			continue;
674 		/* h/w will decrypt, s/w still strips headers */
675 		wk[i].wk_cipher = &rtw_cipher_wep;
676 		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
677 	}
678 
679 out:
680 	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
681 
682 	bus_space_write_region_stream_4(regs->r_bt, regs->r_bh,
683 	    RTW_DK0, rk->rk_words, __arraycount(rk->rk_words));
684 
685 	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
686 	    BUS_SPACE_BARRIER_SYNC);
687 
688 	RTW_WBW(regs, RTW_DK0, RTW_PSR);
689 	RTW_WRITE8(regs, RTW_PSR, psr);
690 	RTW_WBW(regs, RTW_PSR, RTW_SCR);
691 	RTW_WRITE8(regs, RTW_SCR, scr);
692 	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
693 	rtw_set_access(regs, RTW_ACCESS_NONE);
694 	sc->sc_flags |= RTW_F_DK_VALID;
695 }
696 
697 static inline int
698 rtw_recall_eeprom(struct rtw_regs *regs, const char *dvname)
699 {
700 	int i;
701 	uint8_t ecr;
702 
703 	ecr = RTW_READ8(regs, RTW_9346CR);
704 	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
705 	RTW_WRITE8(regs, RTW_9346CR, ecr);
706 
707 	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
708 
709 	/* wait 25ms for completion */
710 	for (i = 0; i < 250; i++) {
711 		ecr = RTW_READ8(regs, RTW_9346CR);
712 		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
713 			RTW_DPRINTF(RTW_DEBUG_RESET,
714 			    ("%s: recall EEPROM in %dus\n", dvname, i * 100));
715 			return 0;
716 		}
717 		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
718 		DELAY(100);
719 	}
720 	printf("%s: recall EEPROM failed\n", dvname);
721 	return ETIMEDOUT;
722 }
723 
724 static inline int
725 rtw_reset(struct rtw_softc *sc)
726 {
727 	int rc;
728 	uint8_t config1;
729 
730 	sc->sc_flags &= ~RTW_F_DK_VALID;
731 
732 	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
733 		return rc;
734 
735 	rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev.dv_xname);
736 
737 	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
738 	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
739 	/* TBD turn off maximum power saving? */
740 
741 	return 0;
742 }
743 
744 static inline int
745 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
746     u_int ndescs)
747 {
748 	int i, rc = 0;
749 	for (i = 0; i < ndescs; i++) {
750 		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
751 		    0, 0, &descs[i].ts_dmamap);
752 		if (rc != 0)
753 			break;
754 	}
755 	return rc;
756 }
757 
758 static inline int
759 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
760     u_int ndescs)
761 {
762 	int i, rc = 0;
763 	for (i = 0; i < ndescs; i++) {
764 		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
765 		    &descs[i].rs_dmamap);
766 		if (rc != 0)
767 			break;
768 	}
769 	return rc;
770 }
771 
772 static inline void
773 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
774     u_int ndescs)
775 {
776 	int i;
777 	for (i = 0; i < ndescs; i++) {
778 		if (descs[i].rs_dmamap != NULL)
779 			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
780 	}
781 }
782 
783 static inline void
784 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
785     u_int ndescs)
786 {
787 	int i;
788 	for (i = 0; i < ndescs; i++) {
789 		if (descs[i].ts_dmamap != NULL)
790 			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
791 	}
792 }
793 
794 static inline void
795 rtw_srom_free(struct rtw_srom *sr)
796 {
797 	sr->sr_size = 0;
798 	if (sr->sr_content == NULL)
799 		return;
800 	free(sr->sr_content, M_DEVBUF);
801 	sr->sr_content = NULL;
802 }
803 
804 static void
805 rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
806     uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
807 {
808 	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
809 	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
810 	*rcr |= RTW_RCR_ENCS1;
811 	*rfchipid = RTW_RFCHIPID_PHILIPS;
812 }
813 
814 static int
815 rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
816     enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
817     const char *dvname)
818 {
819 	int i;
820 	const char *rfname, *paname;
821 	char scratch[sizeof("unknown 0xXX")];
822 	uint16_t srom_version;
823 	uint8_t mac[IEEE80211_ADDR_LEN];
824 
825 	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
826 	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
827 
828 	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
829 	printf("%s: SROM version %d.%d", dvname,
830 	    srom_version >> 8, srom_version & 0xff);
831 
832 	if (srom_version <= 0x0101) {
833 		printf(" is not understood, limping along with defaults\n");
834 		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
835 		return 0;
836 	}
837 	printf("\n");
838 
839 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
840 		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
841 
842 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
843 	    ("%s: EEPROM MAC %s\n", dvname, ether_sprintf(mac)));
844 
845 	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
846 
847 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
848 		*flags |= RTW_F_ANTDIV;
849 
850 	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
851 	 * to be reversed.
852 	 */
853 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
854 		*flags |= RTW_F_DIGPHY;
855 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
856 		*flags |= RTW_F_DFLANTB;
857 
858 	*rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
859 	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
860 
861 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
862 		*flags |= RTW_C_RXWEP_104;
863 
864 	*flags |= RTW_C_RXWEP_40;	/* XXX */
865 
866 	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
867 	switch (*rfchipid) {
868 	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
869 		rfname = "GCT GRF5101";
870 		paname = "Winspring WS9901";
871 		break;
872 	case RTW_RFCHIPID_MAXIM:
873 		rfname = "Maxim MAX2820";	/* guess */
874 		paname = "Maxim MAX2422";	/* guess */
875 		break;
876 	case RTW_RFCHIPID_INTERSIL:
877 		rfname = "Intersil HFA3873";	/* guess */
878 		paname = "Intersil <unknown>";
879 		break;
880 	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
881 		rfname = "Philips SA2400A";
882 		paname = "Philips SA2411";
883 		break;
884 	case RTW_RFCHIPID_RFMD:
885 		/* this is the same front-end as an atw(4)! */
886 		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
887 			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
888 			 "SYN: Silicon Labs Si4126";	/* inferred from
889 			 				 * reference driver
890 							 */
891 		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
892 		break;
893 	case RTW_RFCHIPID_RESERVED:
894 		rfname = paname = "reserved";
895 		break;
896 	default:
897 		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
898 		rfname = paname = scratch;
899 	}
900 	printf("%s: RF: %s, PA: %s\n", dvname, rfname, paname);
901 
902 	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
903 	case RTW_CONFIG0_GL_USA:
904 	case _RTW_CONFIG0_GL_USA:
905 		*locale = RTW_LOCALE_USA;
906 		break;
907 	case RTW_CONFIG0_GL_EUROPE:
908 		*locale = RTW_LOCALE_EUROPE;
909 		break;
910 	case RTW_CONFIG0_GL_JAPAN:
911 		*locale = RTW_LOCALE_JAPAN;
912 		break;
913 	default:
914 		*locale = RTW_LOCALE_UNKNOWN;
915 		break;
916 	}
917 	return 0;
918 }
919 
920 /* Returns -1 on failure. */
921 static int
922 rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
923     const char *dvname)
924 {
925 	int rc;
926 	struct seeprom_descriptor sd;
927 	uint8_t ecr;
928 
929 	(void)memset(&sd, 0, sizeof(sd));
930 
931 	ecr = RTW_READ8(regs, RTW_9346CR);
932 
933 	if ((flags & RTW_F_9356SROM) != 0) {
934 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n", dvname));
935 		sr->sr_size = 256;
936 		sd.sd_chip = C56_66;
937 	} else {
938 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n", dvname));
939 		sr->sr_size = 128;
940 		sd.sd_chip = C46;
941 	}
942 
943 	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
944 	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
945 	ecr |= RTW_9346CR_EEM_PROGRAM;
946 
947 	RTW_WRITE8(regs, RTW_9346CR, ecr);
948 
949 	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
950 
951 	if (sr->sr_content == NULL) {
952 		printf("%s: unable to allocate SROM buffer\n", dvname);
953 		return ENOMEM;
954 	}
955 
956 	(void)memset(sr->sr_content, 0, sr->sr_size);
957 
958 	/* RTL8180 has a single 8-bit register for controlling the
959 	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
960 	 * input/output sense is the reverse of read_seeprom's.
961 	 */
962 	sd.sd_tag = regs->r_bt;
963 	sd.sd_bsh = regs->r_bh;
964 	sd.sd_regsize = 1;
965 	sd.sd_control_offset = RTW_9346CR;
966 	sd.sd_status_offset = RTW_9346CR;
967 	sd.sd_dataout_offset = RTW_9346CR;
968 	sd.sd_CK = RTW_9346CR_EESK;
969 	sd.sd_CS = RTW_9346CR_EECS;
970 	sd.sd_DI = RTW_9346CR_EEDO;
971 	sd.sd_DO = RTW_9346CR_EEDI;
972 	/* make read_seeprom enter EEPROM read/write mode */
973 	sd.sd_MS = ecr;
974 	sd.sd_RDY = 0;
975 
976 	/* TBD bus barriers */
977 	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
978 		printf("%s: could not read SROM\n", dvname);
979 		free(sr->sr_content, M_DEVBUF);
980 		sr->sr_content = NULL;
981 		return -1;	/* XXX */
982 	}
983 
984 	/* end EEPROM read/write mode */
985 	RTW_WRITE8(regs, RTW_9346CR,
986 	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
987 	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
988 
989 	if ((rc = rtw_recall_eeprom(regs, dvname)) != 0)
990 		return rc;
991 
992 #ifdef RTW_DEBUG
993 	{
994 		int i;
995 		RTW_DPRINTF(RTW_DEBUG_ATTACH,
996 		    ("\n%s: serial ROM:\n\t", dvname));
997 		for (i = 0; i < sr->sr_size/2; i++) {
998 			if (((i % 8) == 0) && (i != 0))
999 				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1000 			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1001 			    (" %04x", sr->sr_content[i]));
1002 		}
1003 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1004 	}
1005 #endif /* RTW_DEBUG */
1006 	return 0;
1007 }
1008 
1009 static void
1010 rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1011     const char *dvname)
1012 {
1013 	uint8_t cfg4;
1014 	const char *method;
1015 
1016 	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1017 
1018 	switch (rfchipid) {
1019 	default:
1020 		cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1021 		method = "fallback";
1022 		break;
1023 	case RTW_RFCHIPID_INTERSIL:
1024 		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1025 		method = "Intersil";
1026 		break;
1027 	case RTW_RFCHIPID_PHILIPS:
1028 		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1029 		method = "Philips";
1030 		break;
1031 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1032 	case RTW_RFCHIPID_RFMD:
1033 		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1034 		method = "RFMD";
1035 		break;
1036 	}
1037 
1038 	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1039 
1040 	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1041 
1042 	RTW_DPRINTF(RTW_DEBUG_INIT,
1043 	    ("%s: %s RF programming method, %#02x\n", dvname, method,
1044 	    RTW_READ8(regs, RTW_CONFIG4)));
1045 }
1046 
1047 static inline void
1048 rtw_init_channels(enum rtw_locale locale,
1049     struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1],
1050     const char *dvname)
1051 {
1052 	int i;
1053 	const char *name = NULL;
1054 #define ADD_CHANNEL(_chans, _chan) do {			\
1055 	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1056 	(*_chans)[_chan].ic_freq =				\
1057 	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1058 } while (0)
1059 
1060 	switch (locale) {
1061 	case RTW_LOCALE_USA:	/* 1-11 */
1062 		name = "USA";
1063 		for (i = 1; i <= 11; i++)
1064 			ADD_CHANNEL(chans, i);
1065 		break;
1066 	case RTW_LOCALE_JAPAN:	/* 1-14 */
1067 		name = "Japan";
1068 		ADD_CHANNEL(chans, 14);
1069 		for (i = 1; i <= 14; i++)
1070 			ADD_CHANNEL(chans, i);
1071 		break;
1072 	case RTW_LOCALE_EUROPE:	/* 1-13 */
1073 		name = "Europe";
1074 		for (i = 1; i <= 13; i++)
1075 			ADD_CHANNEL(chans, i);
1076 		break;
1077 	default:			/* 10-11 allowed by most countries */
1078 		name = "<unknown>";
1079 		for (i = 10; i <= 11; i++)
1080 			ADD_CHANNEL(chans, i);
1081 		break;
1082 	}
1083 	printf("%s: Geographic Location %s\n", dvname, name);
1084 #undef ADD_CHANNEL
1085 }
1086 
1087 
1088 static inline void
1089 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1090 {
1091 	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1092 
1093 	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1094 	case RTW_CONFIG0_GL_USA:
1095 	case _RTW_CONFIG0_GL_USA:
1096 		*locale = RTW_LOCALE_USA;
1097 		break;
1098 	case RTW_CONFIG0_GL_JAPAN:
1099 		*locale = RTW_LOCALE_JAPAN;
1100 		break;
1101 	case RTW_CONFIG0_GL_EUROPE:
1102 		*locale = RTW_LOCALE_EUROPE;
1103 		break;
1104 	default:
1105 		*locale = RTW_LOCALE_UNKNOWN;
1106 		break;
1107 	}
1108 }
1109 
1110 static inline int
1111 rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1112     const char *dvname)
1113 {
1114 	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1115 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1116 	};
1117 	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1118 	          idr1 = RTW_READ(regs, RTW_IDR1);
1119 
1120 	(*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1121 	(*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1122 	(*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1123 	(*addr)[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
1124 
1125 	(*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1126 	(*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1127 
1128 	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1129 		printf("%s: could not get mac address, attach failed\n",
1130 		    dvname);
1131 		return ENXIO;
1132 	}
1133 
1134 	printf("%s: 802.11 address %s\n", dvname, ether_sprintf(*addr));
1135 
1136 	return 0;
1137 }
1138 
1139 static uint8_t
1140 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1141     struct ieee80211_channel *chan)
1142 {
1143 	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1144 	KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
1145 	    ("%s: channel %d out of range", __func__,
1146 	     idx - RTW_SR_TXPOWER1 + 1));
1147 	return RTW_SR_GET(sr, idx);
1148 }
1149 
1150 static void
1151 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1152 {
1153 	int pri;
1154 	/* nfree: the number of free descriptors in each ring.
1155 	 * The beacon ring is a special case: I do not let the
1156 	 * driver use all of the descriptors on the beacon ring.
1157 	 * The reasons are two-fold:
1158 	 *
1159 	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1160 	 * updated, so the driver cannot easily know if the descriptor
1161 	 * belongs to it, or if it is racing the NIC.  If the NIC
1162 	 * does not OWN every descriptor, then the driver can safely
1163 	 * update the descriptors when RTW_TBDA points at tdb_next.
1164 	 *
1165 	 * (2) I hope that the NIC will process more than one BEACON
1166 	 * descriptor in a single beacon interval, since that will
1167 	 * enable multiple-BSS support.  Since the NIC does not
1168 	 * clear the OWN bit, there is no natural place for it to
1169 	 * stop processing BEACON desciptors.  Maybe it will *not*
1170 	 * stop processing them!  I do not want to chance the NIC
1171 	 * looping around and around a saturated beacon ring, so
1172 	 * I will leave one descriptor unOWNed at all times.
1173 	 */
1174 	u_int nfree[RTW_NTXPRI] =
1175 	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1176 	     RTW_NTXDESCBCN - 1};
1177 
1178 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1179 		tdb[pri].tdb_nfree = nfree[pri];
1180 		tdb[pri].tdb_next = 0;
1181 	}
1182 }
1183 
1184 static int
1185 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1186 {
1187 	int i;
1188 	struct rtw_txsoft *ts;
1189 
1190 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1191 	SIMPLEQ_INIT(&tsb->tsb_freeq);
1192 	for (i = 0; i < tsb->tsb_ndesc; i++) {
1193 		ts = &tsb->tsb_desc[i];
1194 		ts->ts_mbuf = NULL;
1195 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1196 	}
1197 	tsb->tsb_tx_timer = 0;
1198 	return 0;
1199 }
1200 
1201 static void
1202 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1203 {
1204 	int pri;
1205 	for (pri = 0; pri < RTW_NTXPRI; pri++)
1206 		rtw_txsoft_blk_init(&tsb[pri]);
1207 }
1208 
1209 static inline void
1210 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1211 {
1212 	KASSERT(nsync <= rdb->rdb_ndesc);
1213 	/* sync to end of ring */
1214 	if (desc0 + nsync > rdb->rdb_ndesc) {
1215 		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1216 		    offsetof(struct rtw_descs, hd_rx[desc0]),
1217 		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1218 		nsync -= (rdb->rdb_ndesc - desc0);
1219 		desc0 = 0;
1220 	}
1221 
1222 	KASSERT(desc0 < rdb->rdb_ndesc);
1223 	KASSERT(nsync <= rdb->rdb_ndesc);
1224 	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1225 
1226 	/* sync what remains */
1227 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1228 	    offsetof(struct rtw_descs, hd_rx[desc0]),
1229 	    sizeof(struct rtw_rxdesc) * nsync, ops);
1230 }
1231 
1232 static void
1233 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1234 {
1235 	/* sync to end of ring */
1236 	if (desc0 + nsync > tdb->tdb_ndesc) {
1237 		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1238 		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1239 		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1240 		    ops);
1241 		nsync -= (tdb->tdb_ndesc - desc0);
1242 		desc0 = 0;
1243 	}
1244 
1245 	/* sync what remains */
1246 	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1247 	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1248 	    sizeof(struct rtw_txdesc) * nsync, ops);
1249 }
1250 
1251 static void
1252 rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1253 {
1254 	int pri;
1255 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1256 		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1257 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1258 	}
1259 }
1260 
1261 static void
1262 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1263 {
1264 	int i;
1265 	struct rtw_rxsoft *rs;
1266 
1267 	for (i = 0; i < RTW_RXQLEN; i++) {
1268 		rs = &desc[i];
1269 		if (rs->rs_mbuf == NULL)
1270 			continue;
1271 		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1272 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1273 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1274 		m_freem(rs->rs_mbuf);
1275 		rs->rs_mbuf = NULL;
1276 	}
1277 }
1278 
1279 static inline int
1280 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1281 {
1282 	int rc;
1283 	struct mbuf *m;
1284 
1285 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1286 	if (m == NULL)
1287 		return ENOBUFS;
1288 
1289 	MCLGET(m, M_DONTWAIT);
1290 	if ((m->m_flags & M_EXT) == 0) {
1291 		m_freem(m);
1292 		return ENOBUFS;
1293 	}
1294 
1295 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1296 
1297 	if (rs->rs_mbuf != NULL)
1298 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1299 
1300 	rs->rs_mbuf = NULL;
1301 
1302 	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1303 	if (rc != 0) {
1304 		m_freem(m);
1305 		return -1;
1306 	}
1307 
1308 	rs->rs_mbuf = m;
1309 
1310 	return 0;
1311 }
1312 
1313 static int
1314 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1315     int *ndesc, const char *dvname)
1316 {
1317 	int i, rc = 0;
1318 	struct rtw_rxsoft *rs;
1319 
1320 	for (i = 0; i < RTW_RXQLEN; i++) {
1321 		rs = &desc[i];
1322 		/* we're in rtw_init, so there should be no mbufs allocated */
1323 		KASSERT(rs->rs_mbuf == NULL);
1324 #ifdef RTW_DEBUG
1325 		if (i == rtw_rxbufs_limit) {
1326 			printf("%s: TEST hit %d-buffer limit\n", dvname, i);
1327 			rc = ENOBUFS;
1328 			break;
1329 		}
1330 #endif /* RTW_DEBUG */
1331 		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1332 			printf("%s: rtw_rxsoft_alloc failed, %d buffers, "
1333 			       "rc %d\n", dvname, i, rc);
1334 			break;
1335 		}
1336 	}
1337 	*ndesc = i;
1338 	return rc;
1339 }
1340 
1341 static inline void
1342 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1343     int idx, int kick)
1344 {
1345 	int is_last = (idx == rdb->rdb_ndesc - 1);
1346 	uint32_t ctl, octl, obuf;
1347 	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1348 
1349 	/* sync the mbuf before the descriptor */
1350 	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1351 	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1352 
1353 	obuf = rd->rd_buf;
1354 	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1355 
1356 	ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1357 	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1358 
1359 	if (is_last)
1360 		ctl |= RTW_RXCTL_EOR;
1361 
1362 	octl = rd->rd_ctl;
1363 	rd->rd_ctl = htole32(ctl);
1364 
1365 	RTW_DPRINTF(
1366 	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1367 	         : RTW_DEBUG_RECV_DESC,
1368 	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1369 	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1370 	     le32toh(rd->rd_ctl)));
1371 
1372 	/* sync the descriptor */
1373 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1374 	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1375 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1376 }
1377 
1378 static void
1379 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1380 {
1381 	int i;
1382 	struct rtw_rxdesc *rd;
1383 	struct rtw_rxsoft *rs;
1384 
1385 	for (i = 0; i < rdb->rdb_ndesc; i++) {
1386 		rd = &rdb->rdb_desc[i];
1387 		rs = &ctl[i];
1388 		rtw_rxdesc_init(rdb, rs, i, kick);
1389 	}
1390 }
1391 
1392 static void
1393 rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1394 {
1395 	struct rtw_regs *regs = &sc->sc_regs;
1396 	uint8_t cr;
1397 
1398 	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1399 	    enable ? "enable" : "disable", flags));
1400 
1401 	cr = RTW_READ8(regs, RTW_CR);
1402 
1403 	/* XXX reference source does not enable MULRW */
1404 	/* enable PCI Read/Write Multiple */
1405 	cr |= RTW_CR_MULRW;
1406 
1407 	/* The receive engine will always start at RDSAR.  */
1408 	if (enable && (flags & ~cr & RTW_CR_RE)) {
1409 		struct rtw_rxdesc_blk *rdb;
1410 		rdb = &sc->sc_rxdesc_blk;
1411 		rdb->rdb_next = 0;
1412 	}
1413 
1414 	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1415 	if (enable)
1416 		cr |= flags;
1417 	else
1418 		cr &= ~flags;
1419 	RTW_WRITE8(regs, RTW_CR, cr);
1420 	RTW_SYNC(regs, RTW_CR, RTW_CR);
1421 
1422 #ifdef RTW_DIAG
1423 	if (cr & RTW_CR_TE)
1424 		rtw_txring_fixup(sc, __func__, __LINE__);
1425 #endif
1426 }
1427 
1428 static void
1429 rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1430 {
1431 #define	IS_BEACON(__fc0)						\
1432     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1433      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1434 
1435 	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1436 							 * hardware -> net80211
1437 							 */
1438 	u_int next, nproc = 0;
1439 	int hwrate, len, rate, rssi, sq;
1440 	uint32_t hrssi, hstat, htsfth, htsftl;
1441 	struct rtw_rxdesc *rd;
1442 	struct rtw_rxsoft *rs;
1443 	struct rtw_rxdesc_blk *rdb;
1444 	struct mbuf *m;
1445 	struct ifnet *ifp = &sc->sc_if;
1446 
1447 	struct ieee80211_node *ni;
1448 	struct ieee80211_frame_min *wh;
1449 
1450 	rdb = &sc->sc_rxdesc_blk;
1451 
1452 	for (next = rdb->rdb_next; ; next = rdb->rdb_next) {
1453 		KASSERT(next < rdb->rdb_ndesc);
1454 
1455 		rtw_rxdescs_sync(rdb, next, 1,
1456 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1457 		rd = &rdb->rdb_desc[next];
1458 		rs = &sc->sc_rxsoft[next];
1459 
1460 		hstat = le32toh(rd->rd_stat);
1461 		hrssi = le32toh(rd->rd_rssi);
1462 		htsfth = le32toh(rd->rd_tsfth);
1463 		htsftl = le32toh(rd->rd_tsftl);
1464 
1465 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1466 		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1467 		    __func__, next, hstat, hrssi, htsfth, htsftl));
1468 
1469 		++nproc;
1470 
1471 		/* still belongs to NIC */
1472 		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1473 			rtw_rxdescs_sync(rdb, next, 1, BUS_DMASYNC_PREREAD);
1474 			break;
1475 		}
1476 
1477                 /* ieee80211_input() might reset the receive engine
1478                  * (e.g. by indirectly calling rtw_tune()), so save
1479                  * the next pointer here and retrieve it again on
1480                  * the next round.
1481 		 */
1482 		rdb->rdb_next = (next + 1) % rdb->rdb_ndesc;
1483 
1484 #ifdef RTW_DEBUG
1485 #define PRINTSTAT(flag) do { \
1486 	if ((hstat & flag) != 0) { \
1487 		printf("%s" #flag, delim); \
1488 		delim = ","; \
1489 	} \
1490 } while (0)
1491 		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1492 			const char *delim = "<";
1493 			printf("%s: ", sc->sc_dev.dv_xname);
1494 			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1495 				printf("status %08x", hstat);
1496 				PRINTSTAT(RTW_RXSTAT_SPLCP);
1497 				PRINTSTAT(RTW_RXSTAT_MAR);
1498 				PRINTSTAT(RTW_RXSTAT_PAR);
1499 				PRINTSTAT(RTW_RXSTAT_BAR);
1500 				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1501 				PRINTSTAT(RTW_RXSTAT_CRC32);
1502 				PRINTSTAT(RTW_RXSTAT_ICV);
1503 				printf(">, ");
1504 			}
1505 		}
1506 #endif /* RTW_DEBUG */
1507 
1508 		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1509 			printf("%s: DMA error/FIFO overflow %08" PRIx32 ", "
1510 			    "rx descriptor %d\n", sc->sc_dev.dv_xname,
1511 			    hstat, next);
1512 			ifp->if_ierrors++;
1513 			goto next;
1514 		}
1515 
1516 		len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1517 		if (len < IEEE80211_MIN_LEN) {
1518 			sc->sc_ic.ic_stats.is_rx_tooshort++;
1519 			goto next;
1520 		}
1521 		KASSERT(len <= rs->rs_mbuf->m_pkthdr.len);
1522 		KASSERT(len <= rs->rs_mbuf->m_len);
1523 
1524 		hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1525 		if (hwrate >= __arraycount(ratetbl)) {
1526 			printf("%s: unknown rate #%" __PRIuBITS "\n",
1527 			    sc->sc_dev.dv_xname,
1528 			    __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1529 			ifp->if_ierrors++;
1530 			goto next;
1531 		}
1532 		rate = ratetbl[hwrate];
1533 
1534 #ifdef RTW_DEBUG
1535 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1536 		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1537 		     (rate * 5) % 10, htsfth, htsftl));
1538 #endif /* RTW_DEBUG */
1539 
1540 		/* if bad flags, skip descriptor */
1541 		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1542 			printf("%s: too many rx segments, "
1543 			    "next=%d, %08" PRIx32 "\n",
1544 			    sc->sc_dev.dv_xname, next, hstat);
1545 			goto next;
1546 		}
1547 
1548 		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1549 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1550 
1551 		m = rs->rs_mbuf;
1552 
1553 		/* if temporarily out of memory, re-use mbuf */
1554 		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1555 		case 0:
1556 			break;
1557 		case ENOBUFS:
1558 			printf("%s: rtw_rxsoft_alloc(, %d) failed, "
1559 			    "dropping packet\n", sc->sc_dev.dv_xname, next);
1560 			goto next;
1561 		default:
1562 			/* XXX shorten rx ring, instead? */
1563 			panic("%s: could not load DMA map\n",
1564 			    sc->sc_dev.dv_xname);
1565 		}
1566 
1567 		sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1568 
1569 		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1570 			rssi = UINT8_MAX - sq;
1571 		else {
1572 			rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1573 			/* TBD find out each front-end's LNA gain in the
1574 			 * front-end's units
1575 			 */
1576 			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1577 				rssi |= 0x80;
1578 		}
1579 
1580 		/* Note well: now we cannot recycle the rs_mbuf unless
1581 		 * we restore its original length.
1582 		 */
1583 		m->m_pkthdr.rcvif = ifp;
1584 		m->m_pkthdr.len = m->m_len = len;
1585 
1586 		wh = mtod(m, struct ieee80211_frame_min *);
1587 
1588 		if (!IS_BEACON(wh->i_fc[0]))
1589 			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1590 
1591 		sc->sc_tsfth = htsfth;
1592 
1593 #ifdef RTW_DEBUG
1594 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1595 		    (IFF_DEBUG|IFF_LINK2)) {
1596 			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1597 			    rate, rssi);
1598 		}
1599 #endif /* RTW_DEBUG */
1600 
1601 #if NBPFILTER > 0
1602 		if (sc->sc_radiobpf != NULL) {
1603 			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1604 
1605 			rr->rr_tsft =
1606 			    htole64(((uint64_t)htsfth << 32) | htsftl);
1607 
1608 			rr->rr_flags = IEEE80211_RADIOTAP_F_FCS;
1609 
1610 			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1611 				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1612 			if ((hstat & RTW_RXSTAT_CRC32) != 0)
1613 				rr->rr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1614 
1615 			rr->rr_rate = rate;
1616 
1617 			if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1618 				rr->rr_u.u_philips.p_antsignal = rssi;
1619 			else {
1620 				rr->rr_u.u_other.o_antsignal = rssi;
1621 				rr->rr_u.u_other.o_barker_lock =
1622 				    htole16(UINT8_MAX - sq);
1623 			}
1624 
1625 			bpf_mtap2(sc->sc_radiobpf, rr,
1626 			    sizeof(sc->sc_rxtapu), m);
1627 		}
1628 #endif /* NBPFILTER > 0 */
1629 
1630 		if ((hstat & RTW_RXSTAT_RES) != 0) {
1631 			m_freem(m);
1632 			goto next;
1633 		}
1634 
1635 		/* CRC is included with the packet; trim it off. */
1636 		m_adj(m, -IEEE80211_CRC_LEN);
1637 
1638 		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1639 		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1640 		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1641 		ieee80211_free_node(ni);
1642 next:
1643 		rtw_rxdesc_init(rdb, rs, next, 0);
1644 	}
1645 #undef IS_BEACON
1646 }
1647 
1648 static void
1649 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1650     struct rtw_txsoft *ts)
1651 {
1652 	struct mbuf *m;
1653 	struct ieee80211_node *ni;
1654 
1655 	m = ts->ts_mbuf;
1656 	ni = ts->ts_ni;
1657 	KASSERT(m != NULL);
1658 	KASSERT(ni != NULL);
1659 	ts->ts_mbuf = NULL;
1660 	ts->ts_ni = NULL;
1661 
1662 	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1663 	    BUS_DMASYNC_POSTWRITE);
1664 	bus_dmamap_unload(dmat, ts->ts_dmamap);
1665 	m_freem(m);
1666 	ieee80211_free_node(ni);
1667 }
1668 
1669 static void
1670 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1671     struct rtw_txsoft_blk *tsb)
1672 {
1673 	struct rtw_txsoft *ts;
1674 
1675 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1676 		rtw_txsoft_release(dmat, ic, ts);
1677 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1678 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1679 	}
1680 	tsb->tsb_tx_timer = 0;
1681 }
1682 
1683 static inline void
1684 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1685     struct rtw_txsoft *ts, int ndesc)
1686 {
1687 	uint32_t hstat;
1688 	int data_retry, rts_retry;
1689 	struct rtw_txdesc *tdn;
1690 	const char *condstring;
1691 	struct ifnet *ifp = &sc->sc_if;
1692 
1693 	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1694 
1695 	tdb->tdb_nfree += ndesc;
1696 
1697 	tdn = &tdb->tdb_desc[ts->ts_last];
1698 
1699 	hstat = le32toh(tdn->td_stat);
1700 	rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1701 	data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1702 
1703 	ifp->if_collisions += rts_retry + data_retry;
1704 
1705 	if ((hstat & RTW_TXSTAT_TOK) != 0)
1706 		condstring = "ok";
1707 	else {
1708 		ifp->if_oerrors++;
1709 		condstring = "error";
1710 	}
1711 
1712 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1713 	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1714 	    sc->sc_dev.dv_xname, ts, ts->ts_first, ts->ts_last,
1715 	    condstring, rts_retry, data_retry));
1716 }
1717 
1718 static void
1719 rtw_reset_oactive(struct rtw_softc *sc)
1720 {
1721 	short oflags;
1722 	int pri;
1723 	struct rtw_txsoft_blk *tsb;
1724 	struct rtw_txdesc_blk *tdb;
1725 	oflags = sc->sc_if.if_flags;
1726 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1727 		tsb = &sc->sc_txsoft_blk[pri];
1728 		tdb = &sc->sc_txdesc_blk[pri];
1729 		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1730 			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1731 	}
1732 	if (oflags != sc->sc_if.if_flags) {
1733 		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1734 		    ("%s: reset OACTIVE\n", __func__));
1735 	}
1736 }
1737 
1738 /* Collect transmitted packets. */
1739 static void
1740 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1741     struct rtw_txdesc_blk *tdb, int force)
1742 {
1743 	int ndesc;
1744 	struct rtw_txsoft *ts;
1745 
1746 #ifdef RTW_DEBUG
1747 	rtw_dump_rings(sc);
1748 #endif
1749 
1750 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1751 		/* If we're clearing a failed transmission, only clear
1752 		   up to the last packet the hardware has processed.  */
1753 		if (ts->ts_first == rtw_txring_next(&sc->sc_regs, tdb))
1754 			break;
1755 
1756 		ndesc = 1 + ts->ts_last - ts->ts_first;
1757 		if (ts->ts_last < ts->ts_first)
1758 			ndesc += tdb->tdb_ndesc;
1759 
1760 		KASSERT(ndesc > 0);
1761 
1762 		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1763 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1764 
1765 		if (force) {
1766 			int next;
1767 #ifdef RTW_DIAG
1768 			printf("%s: clearing packet, stats", __func__);
1769 #endif
1770 			for (next = ts->ts_first; ;
1771 			    next = RTW_NEXT_IDX(tdb, next)) {
1772 #ifdef RTW_DIAG
1773 				printf(" %" PRIx32 "/%" PRIx32 "/%" PRIx32 "/%" PRIu32 "/%" PRIx32, le32toh(tdb->tdb_desc[next].td_stat), le32toh(tdb->tdb_desc[next].td_ctl1), le32toh(tdb->tdb_desc[next].td_buf), le32toh(tdb->tdb_desc[next].td_len), le32toh(tdb->tdb_desc[next].td_next));
1774 #endif
1775 				tdb->tdb_desc[next].td_stat &=
1776 				    ~htole32(RTW_TXSTAT_OWN);
1777 				if (next == ts->ts_last)
1778 					break;
1779 			}
1780 			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1781 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1782 #ifdef RTW_DIAG
1783 			next = RTW_NEXT_IDX(tdb, next);
1784 			printf(" -> end %u stat %" PRIx32 ", was %u\n", next,
1785 			    le32toh(tdb->tdb_desc[next].td_stat),
1786 			    rtw_txring_next(&sc->sc_regs, tdb));
1787 #endif
1788 		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1789 		    htole32(RTW_TXSTAT_OWN)) != 0) {
1790 			rtw_txdescs_sync(tdb, ts->ts_last, 1,
1791 			    BUS_DMASYNC_PREREAD);
1792 			break;
1793 		}
1794 
1795 		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1796 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1797 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1798 	}
1799 
1800 	/* no more pending transmissions, cancel watchdog */
1801 	if (ts == NULL)
1802 		tsb->tsb_tx_timer = 0;
1803 	rtw_reset_oactive(sc);
1804 }
1805 
1806 static void
1807 rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1808 {
1809 	int pri;
1810 	struct rtw_txsoft_blk	*tsb;
1811 	struct rtw_txdesc_blk	*tdb;
1812 	struct ifnet *ifp = &sc->sc_if;
1813 
1814 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1815 		tsb = &sc->sc_txsoft_blk[pri];
1816 		tdb = &sc->sc_txdesc_blk[pri];
1817 		rtw_collect_txring(sc, tsb, tdb, 0);
1818 	}
1819 
1820 	if ((isr & RTW_INTR_TX) != 0)
1821 		rtw_start(ifp);
1822 
1823 	return;
1824 }
1825 
1826 static void
1827 rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1828 {
1829 	u_int next;
1830 	uint32_t tsfth, tsftl;
1831 	struct ieee80211com *ic;
1832 	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1833 	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1834 	struct mbuf *m;
1835 
1836 	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1837 	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1838 
1839 	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1840 		next = rtw_txring_next(&sc->sc_regs, tdb);
1841 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1842 		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1843 		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1844 		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1845 		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1846 		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0)
1847 			rtw_collect_txring(sc, tsb, tdb, 1);
1848 	}
1849 	/* Start beacon transmission. */
1850 
1851 	if ((isr & RTW_INTR_BCNINT) != 0 &&
1852 	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1853 	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1854 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1855 		    ("%s: beacon prep. time, isr = %#04" PRIx16
1856 		     ", %16" PRIu64 "\n", __func__, isr,
1857 		     (uint64_t)tsfth << 32 | tsftl));
1858 		ic = &sc->sc_ic;
1859 		m = rtw_beacon_alloc(sc, ic->ic_bss);
1860 
1861 		if (m == NULL) {
1862 			printf("%s: could not allocate beacon\n",
1863 			    sc->sc_dev.dv_xname);
1864 			return;
1865 		}
1866 		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1867 		IF_ENQUEUE(&sc->sc_beaconq, m);
1868 		rtw_start(&sc->sc_if);
1869 	}
1870 }
1871 
1872 static void
1873 rtw_intr_atim(struct rtw_softc *sc)
1874 {
1875 	/* TBD */
1876 	return;
1877 }
1878 
1879 #ifdef RTW_DEBUG
1880 static void
1881 rtw_dump_rings(struct rtw_softc *sc)
1882 {
1883 	struct rtw_txdesc_blk *tdb;
1884 	struct rtw_rxdesc *rd;
1885 	struct rtw_rxdesc_blk *rdb;
1886 	int desc, pri;
1887 
1888 	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1889 		return;
1890 
1891 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1892 		tdb = &sc->sc_txdesc_blk[pri];
1893 		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1894 		    tdb->tdb_ndesc, tdb->tdb_nfree);
1895 		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1896 			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1897 	}
1898 
1899 	rdb = &sc->sc_rxdesc_blk;
1900 
1901 	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1902 		rd = &rdb->rdb_desc[desc];
1903 		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1904 		    "rsvd1/tsfth %08x\n", __func__,
1905 		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1906 		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1907 		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1908 	}
1909 }
1910 #endif /* RTW_DEBUG */
1911 
1912 static void
1913 rtw_hwring_setup(struct rtw_softc *sc)
1914 {
1915 	int pri;
1916 	struct rtw_regs *regs = &sc->sc_regs;
1917 	struct rtw_txdesc_blk *tdb;
1918 
1919 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1920 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1921 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1922 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1923 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1924 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1925 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1926 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1927 
1928 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1929 		tdb = &sc->sc_txdesc_blk[pri];
1930 		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1931 		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1932 		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1933 		     (uintptr_t)tdb->tdb_base));
1934 	}
1935 
1936 	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1937 
1938 	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1939 	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1940 	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1941 
1942 	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1943 
1944 }
1945 
1946 static int
1947 rtw_swring_setup(struct rtw_softc *sc)
1948 {
1949 	int rc;
1950 	struct rtw_rxdesc_blk *rdb;
1951 
1952 	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1953 
1954 	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1955 
1956 	rdb = &sc->sc_rxdesc_blk;
1957 	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
1958 	     sc->sc_dev.dv_xname)) != 0 && rdb->rdb_ndesc == 0) {
1959 		printf("%s: could not allocate rx buffers\n",
1960 		    sc->sc_dev.dv_xname);
1961 		return rc;
1962 	}
1963 
1964 	rdb = &sc->sc_rxdesc_blk;
1965 	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
1966 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1967 	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
1968 	rdb->rdb_next = 0;
1969 
1970 	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
1971 	return 0;
1972 }
1973 
1974 static void
1975 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
1976 {
1977 	int i;
1978 
1979 	(void)memset(tdb->tdb_desc, 0,
1980 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
1981 	for (i = 0; i < tdb->tdb_ndesc; i++)
1982 		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
1983 }
1984 
1985 static u_int
1986 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
1987 {
1988 	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
1989 	    sizeof(struct rtw_txdesc);
1990 }
1991 
1992 #ifdef RTW_DIAG
1993 static void
1994 rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln)
1995 {
1996 	int pri;
1997 	u_int next;
1998 	struct rtw_txdesc_blk *tdb;
1999 	struct rtw_regs *regs = &sc->sc_regs;
2000 
2001 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2002 		int i;
2003 		tdb = &sc->sc_txdesc_blk[pri];
2004 		next = rtw_txring_next(regs, tdb);
2005 		if (tdb->tdb_next == next)
2006 			continue;
2007 		for (i = 0; next != tdb->tdb_next;
2008 		    next = RTW_NEXT_IDX(tdb, next), i++) {
2009 			if ((tdb->tdb_desc[next].td_stat & htole32(RTW_TXSTAT_OWN)) == 0)
2010 				break;
2011 		}
2012 		printf("%s:%d: tx-ring %d expected next %u, read %u+%d -> %s\n", fn,
2013 		    ln, pri, tdb->tdb_next, next, i, tdb->tdb_next == next ? "okay" : "BAD");
2014 		if (tdb->tdb_next == next)
2015 			continue;
2016 		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
2017 	}
2018 }
2019 #endif
2020 
2021 static void
2022 rtw_txdescs_reset(struct rtw_softc *sc)
2023 {
2024 	int pri;
2025 	struct rtw_txsoft_blk	*tsb;
2026 	struct rtw_txdesc_blk	*tdb;
2027 
2028 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2029 		tsb = &sc->sc_txsoft_blk[pri];
2030 		tdb = &sc->sc_txdesc_blk[pri];
2031 		rtw_collect_txring(sc, tsb, tdb, 1);
2032 #ifdef RTW_DIAG
2033 		if (!SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
2034 			printf("%s: packets left in ring %d\n", __func__, pri);
2035 #endif
2036 	}
2037 }
2038 
2039 static void
2040 rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2041 {
2042 	printf("%s: tx fifo underflow\n", sc->sc_dev.dv_xname);
2043 
2044 	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: cleaning up xmit, isr %" PRIx16
2045 	    "\n", sc->sc_dev.dv_xname, isr));
2046 
2047 #ifdef RTW_DEBUG
2048 	rtw_dump_rings(sc);
2049 #endif /* RTW_DEBUG */
2050 
2051 	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2052 	 * timeouts.
2053 	 */
2054 	rtw_txdescs_reset(sc);
2055 
2056 #ifdef RTW_DEBUG
2057 	rtw_dump_rings(sc);
2058 #endif /* RTW_DEBUG */
2059 }
2060 
2061 static inline void
2062 rtw_suspend_ticks(struct rtw_softc *sc)
2063 {
2064 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2065 	    ("%s: suspending ticks\n", sc->sc_dev.dv_xname));
2066 	sc->sc_do_tick = 0;
2067 }
2068 
2069 static inline void
2070 rtw_resume_ticks(struct rtw_softc *sc)
2071 {
2072 	uint32_t tsftrl0, tsftrl1, next_tick;
2073 
2074 	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2075 
2076 	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2077 	next_tick = tsftrl1 + 1000000;
2078 	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
2079 
2080 	sc->sc_do_tick = 1;
2081 
2082 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2083 	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2084 	    sc->sc_dev.dv_xname, tsftrl1 - tsftrl0, tsftrl1, next_tick));
2085 }
2086 
2087 static void
2088 rtw_intr_timeout(struct rtw_softc *sc)
2089 {
2090 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", sc->sc_dev.dv_xname));
2091 	if (sc->sc_do_tick)
2092 		rtw_resume_ticks(sc);
2093 	return;
2094 }
2095 
2096 int
2097 rtw_intr(void *arg)
2098 {
2099 	int i;
2100 	struct rtw_softc *sc = arg;
2101 	struct rtw_regs *regs = &sc->sc_regs;
2102 	uint16_t isr;
2103 	struct ifnet *ifp = &sc->sc_if;
2104 
2105 	/*
2106 	 * If the interface isn't running, the interrupt couldn't
2107 	 * possibly have come from us.
2108 	 */
2109 	if ((sc->sc_flags & RTW_F_ENABLED) == 0 ||
2110 	    (ifp->if_flags & IFF_RUNNING) == 0 ||
2111 	    !device_is_active(&sc->sc_dev)) {
2112 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n", sc->sc_dev.dv_xname));
2113 		return (0);
2114 	}
2115 
2116 	for (i = 0; i < 10; i++) {
2117 		isr = RTW_READ16(regs, RTW_ISR);
2118 
2119 		RTW_WRITE16(regs, RTW_ISR, isr);
2120 		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2121 
2122 		if (sc->sc_intr_ack != NULL)
2123 			(*sc->sc_intr_ack)(regs);
2124 
2125 		if (isr == 0)
2126 			break;
2127 
2128 #ifdef RTW_DEBUG
2129 #define PRINTINTR(flag) do { \
2130 	if ((isr & flag) != 0) { \
2131 		printf("%s" #flag, delim); \
2132 		delim = ","; \
2133 	} \
2134 } while (0)
2135 
2136 		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2137 			const char *delim = "<";
2138 
2139 			printf("%s: reg[ISR] = %x", sc->sc_dev.dv_xname, isr);
2140 
2141 			PRINTINTR(RTW_INTR_TXFOVW);
2142 			PRINTINTR(RTW_INTR_TIMEOUT);
2143 			PRINTINTR(RTW_INTR_BCNINT);
2144 			PRINTINTR(RTW_INTR_ATIMINT);
2145 			PRINTINTR(RTW_INTR_TBDER);
2146 			PRINTINTR(RTW_INTR_TBDOK);
2147 			PRINTINTR(RTW_INTR_THPDER);
2148 			PRINTINTR(RTW_INTR_THPDOK);
2149 			PRINTINTR(RTW_INTR_TNPDER);
2150 			PRINTINTR(RTW_INTR_TNPDOK);
2151 			PRINTINTR(RTW_INTR_RXFOVW);
2152 			PRINTINTR(RTW_INTR_RDU);
2153 			PRINTINTR(RTW_INTR_TLPDER);
2154 			PRINTINTR(RTW_INTR_TLPDOK);
2155 			PRINTINTR(RTW_INTR_RER);
2156 			PRINTINTR(RTW_INTR_ROK);
2157 
2158 			printf(">\n");
2159 		}
2160 #undef PRINTINTR
2161 #endif /* RTW_DEBUG */
2162 
2163 		if ((isr & RTW_INTR_RX) != 0)
2164 			rtw_intr_rx(sc, isr);
2165 		if ((isr & RTW_INTR_TX) != 0)
2166 			rtw_intr_tx(sc, isr);
2167 		if ((isr & RTW_INTR_BEACON) != 0)
2168 			rtw_intr_beacon(sc, isr);
2169 		if ((isr & RTW_INTR_ATIMINT) != 0)
2170 			rtw_intr_atim(sc);
2171 		if ((isr & RTW_INTR_IOERROR) != 0)
2172 			rtw_intr_ioerror(sc, isr);
2173 		if ((isr & RTW_INTR_TIMEOUT) != 0)
2174 			rtw_intr_timeout(sc);
2175 	}
2176 
2177 	return 1;
2178 }
2179 
2180 /* Must be called at splnet. */
2181 static void
2182 rtw_stop(struct ifnet *ifp, int disable)
2183 {
2184 	int pri;
2185 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2186 	struct ieee80211com *ic = &sc->sc_ic;
2187 	struct rtw_regs *regs = &sc->sc_regs;
2188 
2189 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2190 		return;
2191 
2192 	rtw_suspend_ticks(sc);
2193 
2194 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2195 
2196 	if ((sc->sc_flags & RTW_F_INVALID) == 0) {
2197 		/* Disable interrupts. */
2198 		RTW_WRITE16(regs, RTW_IMR, 0);
2199 
2200 		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2201 
2202 		/* Stop the transmit and receive processes. First stop DMA,
2203 		 * then disable receiver and transmitter.
2204 		 */
2205 		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2206 
2207 		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2208 
2209 		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2210 	}
2211 
2212 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2213 		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2214 		    &sc->sc_txsoft_blk[pri]);
2215 	}
2216 
2217 	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2218 
2219 	if (disable)
2220 		rtw_disable(sc);
2221 
2222 	/* Mark the interface as not running.  Cancel the watchdog timer. */
2223 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2224 	ifp->if_timer = 0;
2225 
2226 	return;
2227 }
2228 
2229 const char *
2230 rtw_pwrstate_string(enum rtw_pwrstate power)
2231 {
2232 	switch (power) {
2233 	case RTW_ON:
2234 		return "on";
2235 	case RTW_SLEEP:
2236 		return "sleep";
2237 	case RTW_OFF:
2238 		return "off";
2239 	default:
2240 		return "unknown";
2241 	}
2242 }
2243 
2244 /* XXX For Maxim, I am using the RFMD settings gleaned from the
2245  * reference driver, plus a magic Maxim "ON" value that comes from
2246  * the Realtek document "Windows PG for Rtl8180."
2247  */
2248 static void
2249 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2250     int before_rf, int digphy)
2251 {
2252 	uint32_t anaparm;
2253 
2254 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2255 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2256 
2257 	switch (power) {
2258 	case RTW_OFF:
2259 		if (before_rf)
2260 			return;
2261 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2262 		anaparm |= RTW_ANAPARM_TXDACOFF;
2263 		break;
2264 	case RTW_SLEEP:
2265 		if (!before_rf)
2266 			return;
2267 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2268 		anaparm |= RTW_ANAPARM_TXDACOFF;
2269 		break;
2270 	case RTW_ON:
2271 		if (!before_rf)
2272 			return;
2273 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2274 		break;
2275 	}
2276 	RTW_DPRINTF(RTW_DEBUG_PWR,
2277 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2278 	    __func__, rtw_pwrstate_string(power),
2279 	    (before_rf) ? "before" : "after", anaparm));
2280 
2281 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2282 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2283 }
2284 
2285 /* XXX I am using the RFMD settings gleaned from the reference
2286  * driver.  They agree
2287  */
2288 static void
2289 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2290     int before_rf, int digphy)
2291 {
2292 	uint32_t anaparm;
2293 
2294 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2295 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2296 
2297 	switch (power) {
2298 	case RTW_OFF:
2299 		if (before_rf)
2300 			return;
2301 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2302 		anaparm |= RTW_ANAPARM_TXDACOFF;
2303 		break;
2304 	case RTW_SLEEP:
2305 		if (!before_rf)
2306 			return;
2307 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2308 		anaparm |= RTW_ANAPARM_TXDACOFF;
2309 		break;
2310 	case RTW_ON:
2311 		if (!before_rf)
2312 			return;
2313 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2314 		break;
2315 	}
2316 	RTW_DPRINTF(RTW_DEBUG_PWR,
2317 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2318 	    __func__, rtw_pwrstate_string(power),
2319 	    (before_rf) ? "before" : "after", anaparm));
2320 
2321 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2322 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2323 }
2324 
2325 static void
2326 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2327     int before_rf, int digphy)
2328 {
2329 	uint32_t anaparm;
2330 
2331 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2332 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2333 
2334 	switch (power) {
2335 	case RTW_OFF:
2336 		if (before_rf)
2337 			return;
2338 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2339 		anaparm |= RTW_ANAPARM_TXDACOFF;
2340 		break;
2341 	case RTW_SLEEP:
2342 		if (!before_rf)
2343 			return;
2344 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2345 		anaparm |= RTW_ANAPARM_TXDACOFF;
2346 		break;
2347 	case RTW_ON:
2348 		if (!before_rf)
2349 			return;
2350 		if (digphy) {
2351 			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2352 			/* XXX guess */
2353 			anaparm |= RTW_ANAPARM_TXDACOFF;
2354 		} else
2355 			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2356 		break;
2357 	}
2358 	RTW_DPRINTF(RTW_DEBUG_PWR,
2359 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2360 	    __func__, rtw_pwrstate_string(power),
2361 	    (before_rf) ? "before" : "after", anaparm));
2362 
2363 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2364 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2365 }
2366 
2367 static void
2368 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2369     int digphy)
2370 {
2371 	struct rtw_regs *regs = &sc->sc_regs;
2372 
2373 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2374 
2375 	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2376 
2377 	rtw_set_access(regs, RTW_ACCESS_NONE);
2378 
2379 	return;
2380 }
2381 
2382 static int
2383 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2384 {
2385 	int rc;
2386 
2387 	RTW_DPRINTF(RTW_DEBUG_PWR,
2388 	    ("%s: %s->%s\n", __func__,
2389 	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2390 
2391 	if (sc->sc_pwrstate == power)
2392 		return 0;
2393 
2394 	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2395 	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2396 	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2397 
2398 	switch (power) {
2399 	case RTW_ON:
2400 		/* TBD set LEDs */
2401 		break;
2402 	case RTW_SLEEP:
2403 		/* TBD */
2404 		break;
2405 	case RTW_OFF:
2406 		/* TBD */
2407 		break;
2408 	}
2409 	if (rc == 0)
2410 		sc->sc_pwrstate = power;
2411 	else
2412 		sc->sc_pwrstate = RTW_OFF;
2413 	return rc;
2414 }
2415 
2416 static int
2417 rtw_tune(struct rtw_softc *sc)
2418 {
2419 	struct ieee80211com *ic = &sc->sc_ic;
2420 	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2421 	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2422 	u_int chan;
2423 	int rc;
2424 	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2425 	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2426 
2427 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2428 	if (chan == IEEE80211_CHAN_ANY)
2429 		panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
2430 
2431 	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2432 	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2433 
2434 	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2435 	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2436 
2437 	if (chan == sc->sc_cur_chan) {
2438 		RTW_DPRINTF(RTW_DEBUG_TUNE,
2439 		    ("%s: already tuned chan #%d\n", __func__, chan));
2440 		return 0;
2441 	}
2442 
2443 	rtw_suspend_ticks(sc);
2444 
2445 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2446 
2447 	/* TBD wait for Tx to complete */
2448 
2449 	KASSERT((sc->sc_flags & RTW_F_ENABLED) != 0);
2450 
2451 	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2452 	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2453 	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2454 		/* XXX condition on powersaving */
2455 		printf("%s: phy init failed\n", sc->sc_dev.dv_xname);
2456 	}
2457 
2458 	sc->sc_cur_chan = chan;
2459 
2460 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2461 
2462 	rtw_resume_ticks(sc);
2463 
2464 	return rc;
2465 }
2466 
2467 void
2468 rtw_disable(struct rtw_softc *sc)
2469 {
2470 	int rc;
2471 
2472 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2473 		return;
2474 
2475 	/* turn off PHY */
2476 	if ((sc->sc_flags & RTW_F_INVALID) == 0 &&
2477 	    (rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2478 		printf("%s: failed to turn off PHY (%d)\n",
2479 		    sc->sc_dev.dv_xname, rc);
2480 	}
2481 
2482 	if (sc->sc_disable != NULL)
2483 		(*sc->sc_disable)(sc);
2484 
2485 	sc->sc_flags &= ~RTW_F_ENABLED;
2486 }
2487 
2488 int
2489 rtw_enable(struct rtw_softc *sc)
2490 {
2491 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
2492 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2493 			printf("%s: device enable failed\n",
2494 			    sc->sc_dev.dv_xname);
2495 			return (EIO);
2496 		}
2497 		sc->sc_flags |= RTW_F_ENABLED;
2498                 /* Power may have been removed, and WEP keys thus
2499                  * reset.
2500 		 */
2501 		sc->sc_flags &= ~RTW_F_DK_VALID;
2502 	}
2503 	return (0);
2504 }
2505 
2506 static void
2507 rtw_transmit_config(struct rtw_regs *regs)
2508 {
2509 	uint32_t tcr;
2510 
2511 	tcr = RTW_READ(regs, RTW_TCR);
2512 
2513 	tcr |= RTW_TCR_CWMIN;
2514 	tcr &= ~RTW_TCR_MXDMA_MASK;
2515 	tcr |= RTW_TCR_MXDMA_256;
2516 	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2517 	tcr &= ~RTW_TCR_LBK_MASK;
2518 	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2519 
2520 	/* set short/long retry limits */
2521 	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2522 	tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2523 
2524 	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2525 
2526 	RTW_WRITE(regs, RTW_TCR, tcr);
2527 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2528 }
2529 
2530 static inline void
2531 rtw_enable_interrupts(struct rtw_softc *sc)
2532 {
2533 	struct rtw_regs *regs = &sc->sc_regs;
2534 
2535 	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2536 	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2537 
2538 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2539 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2540 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2541 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2542 
2543 	/* XXX necessary? */
2544 	if (sc->sc_intr_ack != NULL)
2545 		(*sc->sc_intr_ack)(regs);
2546 }
2547 
2548 static void
2549 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2550 {
2551 	uint8_t msr;
2552 
2553 	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2554 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2555 
2556 	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2557 
2558 	switch (opmode) {
2559 	case IEEE80211_M_AHDEMO:
2560 	case IEEE80211_M_IBSS:
2561 		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2562 		break;
2563 	case IEEE80211_M_HOSTAP:
2564 		msr |= RTW_MSR_NETYPE_AP_OK;
2565 		break;
2566 	case IEEE80211_M_MONITOR:
2567 		/* XXX */
2568 		msr |= RTW_MSR_NETYPE_NOLINK;
2569 		break;
2570 	case IEEE80211_M_STA:
2571 		msr |= RTW_MSR_NETYPE_INFRA_OK;
2572 		break;
2573 	}
2574 	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2575 
2576 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2577 }
2578 
2579 #define	rtw_calchash(addr) \
2580 	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2581 
2582 static void
2583 rtw_pktfilt_load(struct rtw_softc *sc)
2584 {
2585 	struct rtw_regs *regs = &sc->sc_regs;
2586 	struct ieee80211com *ic = &sc->sc_ic;
2587 	struct ethercom *ec = &sc->sc_ec;
2588 	struct ifnet *ifp = &sc->sc_if;
2589 	int hash;
2590 	uint32_t hashes[2] = { 0, 0 };
2591 	struct ether_multi *enm;
2592 	struct ether_multistep step;
2593 
2594 	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2595 
2596 	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2597 	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2598 
2599 	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2600 	/* MAC auto-reset PHY (huh?) */
2601 	sc->sc_rcr |= RTW_RCR_ENMARP;
2602 	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2603 	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2604 
2605 	switch (ic->ic_opmode) {
2606 	case IEEE80211_M_MONITOR:
2607 		sc->sc_rcr |= RTW_RCR_MONITOR;
2608 		break;
2609 	case IEEE80211_M_AHDEMO:
2610 	case IEEE80211_M_IBSS:
2611 		/* receive broadcasts in our BSS */
2612 		sc->sc_rcr |= RTW_RCR_ADD3;
2613 		break;
2614 	default:
2615 		break;
2616 	}
2617 
2618 	ifp->if_flags &= ~IFF_ALLMULTI;
2619 
2620 	/*
2621 	 * Program the 64-bit multicast hash filter.
2622 	 */
2623 	ETHER_FIRST_MULTI(step, ec, enm);
2624 	while (enm != NULL) {
2625 		/* XXX */
2626 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2627 		    ETHER_ADDR_LEN) != 0) {
2628 			ifp->if_flags |= IFF_ALLMULTI;
2629 			break;
2630 		}
2631 
2632 		hash = rtw_calchash(enm->enm_addrlo);
2633 		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2634 		ETHER_NEXT_MULTI(step, enm);
2635 	}
2636 
2637 	/* XXX accept all broadcast if scanning */
2638 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2639 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2640 
2641 	if (ifp->if_flags & IFF_PROMISC) {
2642 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2643 		sc->sc_rcr |= RTW_RCR_ACRC32;	/* accept frames failing CRC */
2644 		sc->sc_rcr |= RTW_RCR_AICV;	/* accept frames failing ICV */
2645 		ifp->if_flags |= IFF_ALLMULTI;
2646 	}
2647 
2648 	if (ifp->if_flags & IFF_ALLMULTI)
2649 		hashes[0] = hashes[1] = 0xffffffff;
2650 
2651 	if ((hashes[0] | hashes[1]) != 0)
2652 		sc->sc_rcr |= RTW_RCR_AM;	/* accept multicast */
2653 
2654 	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2655 	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2656 	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2657 	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2658 
2659 	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2660 	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2661 	    sc->sc_dev.dv_xname, RTW_READ(regs, RTW_MAR0),
2662 	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2663 }
2664 
2665 static struct mbuf *
2666 rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2667 {
2668 	struct ieee80211com *ic = &sc->sc_ic;
2669 	struct mbuf *m;
2670 	struct ieee80211_beacon_offsets	boff;
2671 
2672 	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2673 		RTW_DPRINTF(RTW_DEBUG_BEACON,
2674 		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2675 	}
2676 	return m;
2677 }
2678 
2679 /* Must be called at splnet. */
2680 static int
2681 rtw_init(struct ifnet *ifp)
2682 {
2683 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2684 	struct ieee80211com *ic = &sc->sc_ic;
2685 	struct rtw_regs *regs = &sc->sc_regs;
2686 	int rc = 0;
2687 
2688 	if ((rc = rtw_enable(sc)) != 0)
2689 		goto out;
2690 
2691 	/* Cancel pending I/O and reset. */
2692 	rtw_stop(ifp, 0);
2693 
2694 	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2695 	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2696 	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2697 
2698 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2699 		goto out;
2700 
2701 	if ((rc = rtw_swring_setup(sc)) != 0)
2702 		goto out;
2703 
2704 	rtw_transmit_config(regs);
2705 
2706 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2707 
2708 	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2709 	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2710 
2711 	/* long PLCP header, 1Mb/2Mb basic rate */
2712 	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2713 	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2714 
2715 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2716 	rtw_set_access(regs, RTW_ACCESS_NONE);
2717 
2718 	/* XXX from reference sources */
2719 	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2720 	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2721 
2722 	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev.dv_xname);
2723 
2724 	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2725 	/* from Linux driver */
2726 	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2727 
2728 	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2729 
2730 	rtw_enable_interrupts(sc);
2731 
2732 	rtw_pktfilt_load(sc);
2733 
2734 	rtw_hwring_setup(sc);
2735 
2736 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2737 
2738 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2739 
2740 	ifp->if_flags |= IFF_RUNNING;
2741 	ic->ic_state = IEEE80211_S_INIT;
2742 
2743 	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2744 	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2745 
2746 	rtw_resume_ticks(sc);
2747 
2748 	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2749 
2750 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2751 		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2752 	else
2753 		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2754 
2755 out:
2756 	printf("%s: interface not running\n", sc->sc_dev.dv_xname);
2757 	return rc;
2758 }
2759 
2760 static inline void
2761 rtw_led_init(struct rtw_regs *regs)
2762 {
2763 	uint8_t cfg0, cfg1;
2764 
2765 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2766 
2767 	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2768 	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2769 	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2770 
2771 	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2772 	RTW_DPRINTF(RTW_DEBUG_LED,
2773 	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2774 
2775 	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2776 	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2777 	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2778 
2779 	rtw_set_access(regs, RTW_ACCESS_NONE);
2780 }
2781 
2782 /*
2783  * IEEE80211_S_INIT: 		LED1 off
2784  *
2785  * IEEE80211_S_AUTH,
2786  * IEEE80211_S_ASSOC,
2787  * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2788  *
2789  * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2790  */
2791 static void
2792 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2793 {
2794 	struct rtw_led_state *ls;
2795 
2796 	ls = &sc->sc_led_state;
2797 
2798 	switch (nstate) {
2799 	case IEEE80211_S_INIT:
2800 		rtw_led_init(&sc->sc_regs);
2801 		callout_stop(&ls->ls_slow_ch);
2802 		callout_stop(&ls->ls_fast_ch);
2803 		ls->ls_slowblink = 0;
2804 		ls->ls_actblink = 0;
2805 		ls->ls_default = 0;
2806 		break;
2807 	case IEEE80211_S_SCAN:
2808 		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2809 		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2810 		/*FALLTHROUGH*/
2811 	case IEEE80211_S_AUTH:
2812 	case IEEE80211_S_ASSOC:
2813 		ls->ls_default = RTW_LED1;
2814 		ls->ls_actblink = RTW_LED1;
2815 		ls->ls_slowblink = RTW_LED1;
2816 		break;
2817 	case IEEE80211_S_RUN:
2818 		ls->ls_slowblink = 0;
2819 		break;
2820 	}
2821 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2822 }
2823 
2824 static void
2825 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2826 {
2827 	uint8_t led_condition;
2828 	bus_size_t ofs;
2829 	uint8_t mask, newval, val;
2830 
2831 	led_condition = ls->ls_default;
2832 
2833 	if (ls->ls_state & RTW_LED_S_SLOW)
2834 		led_condition ^= ls->ls_slowblink;
2835 	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2836 		led_condition ^= ls->ls_actblink;
2837 
2838 	RTW_DPRINTF(RTW_DEBUG_LED,
2839 	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2840 
2841 	switch (hwverid) {
2842 	default:
2843 	case 'F':
2844 		ofs = RTW_PSR;
2845 		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2846 		if (led_condition & RTW_LED0)
2847 			newval &= ~RTW_PSR_LEDGPO0;
2848 		if (led_condition & RTW_LED1)
2849 			newval &= ~RTW_PSR_LEDGPO1;
2850 		break;
2851 	case 'D':
2852 		ofs = RTW_9346CR;
2853 		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2854 		newval = RTW_9346CR_EEM_PROGRAM;
2855 		if (led_condition & RTW_LED0)
2856 			newval |= RTW_9346CR_EEDI;
2857 		if (led_condition & RTW_LED1)
2858 			newval |= RTW_9346CR_EECS;
2859 		break;
2860 	}
2861 	val = RTW_READ8(regs, ofs);
2862 	RTW_DPRINTF(RTW_DEBUG_LED,
2863 	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2864 	     (uintptr_t)ofs));
2865 	val &= ~mask;
2866 	val |= newval;
2867 	RTW_WRITE8(regs, ofs, val);
2868 	RTW_DPRINTF(RTW_DEBUG_LED,
2869 	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2870 	     (uintptr_t)ofs));
2871 	RTW_SYNC(regs, ofs, ofs);
2872 }
2873 
2874 static void
2875 rtw_led_fastblink(void *arg)
2876 {
2877 	int ostate, s;
2878 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2879 	struct rtw_led_state *ls = &sc->sc_led_state;
2880 
2881 	s = splnet();
2882 	ostate = ls->ls_state;
2883 	ls->ls_state ^= ls->ls_event;
2884 
2885 	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2886 		ls->ls_state &= ~RTW_LED_S_TX;
2887 
2888 	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2889 		ls->ls_state &= ~RTW_LED_S_RX;
2890 
2891 	ls->ls_event = 0;
2892 
2893 	if (ostate != ls->ls_state)
2894 		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2895 	splx(s);
2896 
2897 	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2898 }
2899 
2900 static void
2901 rtw_led_slowblink(void *arg)
2902 {
2903 	int s;
2904 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2905 	struct rtw_led_state *ls = &sc->sc_led_state;
2906 
2907 	s = splnet();
2908 	ls->ls_state ^= RTW_LED_S_SLOW;
2909 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2910 	splx(s);
2911 	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2912 }
2913 
2914 static inline void
2915 rtw_led_attach(struct rtw_led_state *ls, void *arg)
2916 {
2917 	callout_init(&ls->ls_fast_ch, 0);
2918 	callout_init(&ls->ls_slow_ch, 0);
2919 	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2920 	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2921 }
2922 
2923 static int
2924 rtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2925 {
2926 	int rc = 0, s;
2927 	struct rtw_softc *sc = ifp->if_softc;
2928 
2929 	s = splnet();
2930 	if (cmd == SIOCSIFFLAGS) {
2931 		if ((ifp->if_flags & IFF_UP) != 0) {
2932 			if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2933 				rtw_pktfilt_load(sc);
2934 			else
2935 				rc = rtw_init(ifp);
2936 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2937 		} else if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
2938 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2939 			rtw_stop(ifp, 1);
2940 		}
2941 	} else if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
2942 		;	/* nothing to do */
2943 	else if (cmd == SIOCADDMULTI || cmd == SIOCDELMULTI) {
2944 		/* reload packet filter if running */
2945 		if (ifp->if_flags & IFF_RUNNING)
2946 			rtw_pktfilt_load(sc);
2947 		rc = 0;
2948 	} else if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2949 		/* reinitialize h/w if activated */
2950 		rc = rtw_init(ifp);
2951 	else
2952 		rc = 0;
2953 	splx(s);
2954 	return rc;
2955 }
2956 
2957 /* Select a transmit ring with at least one h/w and s/w descriptor free.
2958  * Return 0 on success, -1 on failure.
2959  */
2960 static inline int
2961 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
2962     struct rtw_txdesc_blk **tdbp, int pri)
2963 {
2964 	struct rtw_txsoft_blk *tsb;
2965 	struct rtw_txdesc_blk *tdb;
2966 
2967 	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
2968 
2969 	tsb = &sc->sc_txsoft_blk[pri];
2970 	tdb = &sc->sc_txdesc_blk[pri];
2971 
2972 	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
2973 		if (tsb->tsb_tx_timer == 0)
2974 			tsb->tsb_tx_timer = 5;
2975 		*tsbp = NULL;
2976 		*tdbp = NULL;
2977 		return -1;
2978 	}
2979 	*tsbp = tsb;
2980 	*tdbp = tdb;
2981 	return 0;
2982 }
2983 
2984 static inline struct mbuf *
2985 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
2986     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
2987     struct ieee80211_node **nip, short *if_flagsp)
2988 {
2989 	struct mbuf *m;
2990 
2991 	if (IF_IS_EMPTY(ifq))
2992 		return NULL;
2993 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
2994 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
2995 		    __func__, pri));
2996 		*if_flagsp |= IFF_OACTIVE;
2997 		sc->sc_if.if_timer = 1;
2998 		return NULL;
2999 	}
3000 	IF_DEQUEUE(ifq, m);
3001 	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3002 	m->m_pkthdr.rcvif = NULL;
3003 	KASSERT(*nip != NULL);
3004 	return m;
3005 }
3006 
3007 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3008  * at the driver's selection of transmit control block for the packet.
3009  */
3010 static inline int
3011 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3012     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3013     struct ieee80211_node **nip)
3014 {
3015 	int pri;
3016 	struct ether_header *eh;
3017 	struct mbuf *m0;
3018 	struct rtw_softc *sc;
3019 	short *if_flagsp;
3020 
3021 	*mp = NULL;
3022 
3023 	sc = (struct rtw_softc *)ifp->if_softc;
3024 
3025 	DPRINTF(sc, RTW_DEBUG_XMIT,
3026 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3027 
3028 	if_flagsp = &ifp->if_flags;
3029 
3030 	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3031 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3032 		                     tdbp, nip, if_flagsp)) != NULL) {
3033 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3034 		    __func__));
3035 		return 0;
3036 	}
3037 
3038 	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3039 		                     tdbp, nip, if_flagsp)) != NULL) {
3040 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3041 		    __func__));
3042 		return 0;
3043 	}
3044 
3045 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3046 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3047 		return 0;
3048 	}
3049 
3050 	IFQ_POLL(&ifp->if_snd, m0);
3051 	if (m0 == NULL) {
3052 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3053 		    __func__));
3054 		return 0;
3055 	}
3056 
3057 	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3058 
3059 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3060 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3061 		    __func__, pri));
3062 		*if_flagsp |= IFF_OACTIVE;
3063 		sc->sc_if.if_timer = 1;
3064 		return 0;
3065 	}
3066 
3067 	IFQ_DEQUEUE(&ifp->if_snd, m0);
3068 	if (m0 == NULL) {
3069 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3070 		    __func__));
3071 		return 0;
3072 	}
3073 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3074 	ifp->if_opackets++;
3075 #if NBPFILTER > 0
3076 	if (ifp->if_bpf)
3077 		bpf_mtap(ifp->if_bpf, m0);
3078 #endif
3079 	eh = mtod(m0, struct ether_header *);
3080 	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3081 	if (*nip == NULL) {
3082 		/* NB: ieee80211_find_txnode does stat+msg */
3083 		m_freem(m0);
3084 		return -1;
3085 	}
3086 	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3087 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3088 		ifp->if_oerrors++;
3089 		return -1;
3090 	}
3091 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3092 	*mp = m0;
3093 	return 0;
3094 }
3095 
3096 static int
3097 rtw_seg_too_short(bus_dmamap_t dmamap)
3098 {
3099 	int i;
3100 	for (i = 0; i < dmamap->dm_nsegs; i++) {
3101 		if (dmamap->dm_segs[i].ds_len < 4)
3102 			return 1;
3103 	}
3104 	return 0;
3105 }
3106 
3107 /* TBD factor with atw_start */
3108 static struct mbuf *
3109 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3110     u_int ndescfree, const char *dvname)
3111 {
3112 	int first, rc;
3113 	struct mbuf *m, *m0;
3114 
3115 	m0 = chain;
3116 
3117 	/*
3118 	 * Load the DMA map.  Copy and try (once) again if the packet
3119 	 * didn't fit in the alloted number of segments.
3120 	 */
3121 	for (first = 1;
3122 	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3123 			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3124 	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3125 	     first = 0) {
3126 		if (rc == 0) {
3127 #ifdef RTW_DIAGxxx
3128 			if (rtw_seg_too_short(dmam)) {
3129 				printf("%s: short segment, mbuf lengths:", __func__);
3130 				for (m = m0; m; m = m->m_next)
3131 					printf(" %d", m->m_len);
3132 				printf("\n");
3133 			}
3134 #endif
3135 			bus_dmamap_unload(dmat, dmam);
3136 		}
3137 		MGETHDR(m, M_DONTWAIT, MT_DATA);
3138 		if (m == NULL) {
3139 			printf("%s: unable to allocate Tx mbuf\n",
3140 			    dvname);
3141 			break;
3142 		}
3143 		if (m0->m_pkthdr.len > MHLEN) {
3144 			MCLGET(m, M_DONTWAIT);
3145 			if ((m->m_flags & M_EXT) == 0) {
3146 				printf("%s: cannot allocate Tx cluster\n",
3147 				    dvname);
3148 				m_freem(m);
3149 				break;
3150 			}
3151 		}
3152 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3153 		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3154 		m_freem(m0);
3155 		m0 = m;
3156 		m = NULL;
3157 	}
3158 	if (rc != 0) {
3159 		printf("%s: cannot load Tx buffer, rc = %d\n", dvname, rc);
3160 		m_freem(m0);
3161 		return NULL;
3162 	} else if (rtw_seg_too_short(dmam)) {
3163 		printf("%s: cannot load Tx buffer, segment too short\n",
3164 		    dvname);
3165 		bus_dmamap_unload(dmat, dmam);
3166 		m_freem(m0);
3167 		return NULL;
3168 	} else if (dmam->dm_nsegs > ndescfree) {
3169 		printf("%s: too many tx segments\n", dvname);
3170 		bus_dmamap_unload(dmat, dmam);
3171 		m_freem(m0);
3172 		return NULL;
3173 	}
3174 	return m0;
3175 }
3176 
3177 #ifdef RTW_DEBUG
3178 static void
3179 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3180     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3181 {
3182 	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3183 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3184 	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3185 	    sc->sc_dev.dv_xname, ts, action, desc,
3186 	    le32toh(td->td_buf), le32toh(td->td_next),
3187 	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3188 	    le32toh(td->td_len)));
3189 }
3190 #endif /* RTW_DEBUG */
3191 
3192 static void
3193 rtw_start(struct ifnet *ifp)
3194 {
3195 	uint8_t tppoll;
3196 	int desc, i, lastdesc, npkt, rate;
3197 	uint32_t proto_ctl0, ctl0, ctl1;
3198 	bus_dmamap_t		dmamap;
3199 	struct ieee80211com	*ic;
3200 	struct ieee80211_duration *d0;
3201 	struct ieee80211_frame_min	*wh;
3202 	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3203 	struct mbuf		*m0;
3204 	struct rtw_softc	*sc;
3205 	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3206 	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3207 	struct rtw_txsoft	*ts;
3208 	struct rtw_txdesc	*td;
3209 	struct ieee80211_key	*k;
3210 
3211 	sc = (struct rtw_softc *)ifp->if_softc;
3212 	ic = &sc->sc_ic;
3213 
3214 	DPRINTF(sc, RTW_DEBUG_XMIT,
3215 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3216 
3217 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3218 		goto out;
3219 
3220 	/* XXX do real rate control */
3221 	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3222 
3223 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3224 		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3225 
3226 	for (;;) {
3227 		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3228 			continue;
3229 		if (m0 == NULL)
3230 			break;
3231 
3232 		wh = mtod(m0, struct ieee80211_frame_min *);
3233 
3234 		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3235 		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3236 			m_freem(m0);
3237 			break;
3238 		} else
3239 			k = NULL;
3240 
3241 		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3242 
3243 		dmamap = ts->ts_dmamap;
3244 
3245 		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3246 		    tdb->tdb_nfree, sc->sc_dev.dv_xname);
3247 
3248 		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3249 			DPRINTF(sc, RTW_DEBUG_XMIT,
3250 			    ("%s: fail dmamap load\n", __func__));
3251 			goto post_dequeue_err;
3252 		}
3253 
3254 		/* Note well: rtw_dmamap_load_txbuf may have created
3255 		 * a new chain, so we must find the header once
3256 		 * more.
3257 		 */
3258 		wh = mtod(m0, struct ieee80211_frame_min *);
3259 
3260 		/* XXX do real rate control */
3261 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3262 		    IEEE80211_FC0_TYPE_MGT)
3263 			rate = 2;
3264 		else
3265 			rate = MAX(2, ieee80211_get_rate(ni));
3266 
3267 #ifdef RTW_DEBUG
3268 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3269 		    (IFF_DEBUG|IFF_LINK2)) {
3270 			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3271 			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3272 			                            : sizeof(wh),
3273 			    rate, 0);
3274 		}
3275 #endif /* RTW_DEBUG */
3276 		ctl0 = proto_ctl0 |
3277 		    __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3278 
3279 		switch (rate) {
3280 		default:
3281 		case 2:
3282 			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3283 			break;
3284 		case 4:
3285 			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3286 			break;
3287 		case 11:
3288 			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3289 			break;
3290 		case 22:
3291 			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3292 			break;
3293 		}
3294 		/* XXX >= ? Compare after fragmentation? */
3295 		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3296 			ctl0 |= RTW_TXCTL0_RTSEN;
3297 
3298                 /* XXX Sometimes writes a bogus keyid; h/w doesn't
3299                  * seem to care, since we don't activate h/w Tx
3300                  * encryption.
3301 		 */
3302 		if (k != NULL) {
3303 			ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3304 			    RTW_TXCTL0_KEYID_MASK;
3305 		}
3306 
3307 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3308 		    IEEE80211_FC0_TYPE_MGT) {
3309 			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3310 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3311 			    IEEE80211_FC0_SUBTYPE_BEACON)
3312 				ctl0 |= RTW_TXCTL0_BEACON;
3313 		}
3314 
3315 		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3316 		    ic->ic_flags, ic->ic_fragthreshold,
3317 		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3318 		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3319 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3320 			DPRINTF(sc, RTW_DEBUG_XMIT,
3321 			    ("%s: fail compute duration\n", __func__));
3322 			goto post_load_err;
3323 		}
3324 
3325 		d0 = &ts->ts_d0;
3326 
3327 		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3328 
3329 		ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3330 		    __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3331 
3332 		if (d0->d_residue)
3333 			ctl1 |= RTW_TXCTL1_LENGEXT;
3334 
3335 		/* TBD fragmentation */
3336 
3337 		ts->ts_first = tdb->tdb_next;
3338 
3339 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3340 		    BUS_DMASYNC_PREWRITE);
3341 
3342 		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3343 
3344 #if NBPFILTER > 0
3345 		if (ic->ic_rawbpf != NULL)
3346 			bpf_mtap((void *)ic->ic_rawbpf, m0);
3347 
3348 		if (sc->sc_radiobpf != NULL) {
3349 			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3350 
3351 			rt->rt_rate = rate;
3352 
3353 			bpf_mtap2(sc->sc_radiobpf, (void *)rt,
3354 			    sizeof(sc->sc_txtapu), m0);
3355 		}
3356 #endif /* NBPFILTER > 0 */
3357 
3358 		for (i = 0, lastdesc = desc = ts->ts_first;
3359 		     i < dmamap->dm_nsegs;
3360 		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3361 			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3362 				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3363 				    ("%s: seg too long\n", __func__));
3364 				goto post_load_err;
3365 			}
3366 			td = &tdb->tdb_desc[desc];
3367 			td->td_ctl0 = htole32(ctl0);
3368 			td->td_ctl1 = htole32(ctl1);
3369 			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3370 			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3371 			td->td_next = htole32(RTW_NEXT_DESC(tdb, desc));
3372 			if (i != 0)
3373 				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3374 			lastdesc = desc;
3375 #ifdef RTW_DEBUG
3376 			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3377 #endif /* RTW_DEBUG */
3378 		}
3379 
3380 		KASSERT(desc < tdb->tdb_ndesc);
3381 
3382 		ts->ts_ni = ni;
3383 		KASSERT(ni != NULL);
3384 		ts->ts_mbuf = m0;
3385 		ts->ts_last = lastdesc;
3386 		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3387 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3388 		   htole32(RTW_TXCTL0_FS);
3389 
3390 #ifdef RTW_DEBUG
3391 		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3392 		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3393 #endif /* RTW_DEBUG */
3394 
3395 		tdb->tdb_nfree -= dmamap->dm_nsegs;
3396 		tdb->tdb_next = desc;
3397 
3398 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3399 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3400 
3401 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3402 		    htole32(RTW_TXCTL0_OWN);
3403 
3404 #ifdef RTW_DEBUG
3405 		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3406 #endif /* RTW_DEBUG */
3407 
3408 		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3409 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3410 
3411 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3412 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3413 
3414 		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3415 			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3416 		tsb->tsb_tx_timer = 5;
3417 		ifp->if_timer = 1;
3418 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3419 		tppoll &= ~RTW_TPPOLL_SALL;
3420 		tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
3421 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3422 		RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
3423 	}
3424 out:
3425 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3426 	return;
3427 post_load_err:
3428 	bus_dmamap_unload(sc->sc_dmat, dmamap);
3429 	m_freem(m0);
3430 post_dequeue_err:
3431 	ieee80211_free_node(ni);
3432 	return;
3433 }
3434 
3435 static void
3436 rtw_idle(struct rtw_regs *regs)
3437 {
3438 	int active;
3439 
3440 	/* request stop DMA; wait for packets to stop transmitting. */
3441 
3442 	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3443 	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3444 
3445 	for (active = 0; active < 300 &&
3446 	     (RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0; active++)
3447 		DELAY(10);
3448 	printf("%s: transmit DMA idle in %dus\n", __func__, active * 10);
3449 }
3450 
3451 static void
3452 rtw_watchdog(struct ifnet *ifp)
3453 {
3454 	int pri, tx_timeouts = 0;
3455 	struct rtw_softc *sc;
3456 	struct rtw_txsoft_blk *tsb;
3457 
3458 	sc = ifp->if_softc;
3459 
3460 	ifp->if_timer = 0;
3461 
3462 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
3463 		return;
3464 
3465 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3466 		tsb = &sc->sc_txsoft_blk[pri];
3467 
3468 		if (tsb->tsb_tx_timer == 0)
3469 			continue;
3470 		else if (--tsb->tsb_tx_timer == 0) {
3471 			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3472 				continue;
3473 			printf("%s: transmit timeout, priority %d\n",
3474 			    ifp->if_xname, pri);
3475 			ifp->if_oerrors++;
3476 			if (pri != RTW_TXPRIBCN)
3477 				tx_timeouts++;
3478 		} else
3479 			ifp->if_timer = 1;
3480 	}
3481 
3482 	if (tx_timeouts > 0) {
3483 		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3484 		 * reset s/w tx-ring pointers, and start transmission.
3485 		 *
3486 		 * TBD Stop/restart just the broken rings?
3487 		 */
3488 		rtw_idle(&sc->sc_regs);
3489 		rtw_io_enable(sc, RTW_CR_TE, 0);
3490 		rtw_txdescs_reset(sc);
3491 		rtw_io_enable(sc, RTW_CR_TE, 1);
3492 		rtw_start(ifp);
3493 	}
3494 	ieee80211_watchdog(&sc->sc_ic);
3495 	return;
3496 }
3497 
3498 static void
3499 rtw_next_scan(void *arg)
3500 {
3501 	struct ieee80211com *ic = arg;
3502 	int s;
3503 
3504 	/* don't call rtw_start w/o network interrupts blocked */
3505 	s = splnet();
3506 	if (ic->ic_state == IEEE80211_S_SCAN)
3507 		ieee80211_next_scan(ic);
3508 	splx(s);
3509 }
3510 
3511 static void
3512 rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3513 {
3514 	uint16_t bcnitv, bintritv, intval;
3515 	int i;
3516 	struct rtw_regs *regs = &sc->sc_regs;
3517 
3518 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3519 		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3520 
3521 	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3522 
3523 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3524 
3525 	intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3526 
3527 	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3528 	bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3529 	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3530 	/* interrupt host 1ms before the TBTT */
3531 	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3532 	bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3533 	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3534 	/* magic from Linux */
3535 	RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3536 	RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3537 	rtw_set_access(regs, RTW_ACCESS_NONE);
3538 
3539 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3540 }
3541 
3542 /* Synchronize the hardware state with the software state. */
3543 static int
3544 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3545 {
3546 	struct ifnet *ifp = ic->ic_ifp;
3547 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3548 	enum ieee80211_state ostate;
3549 	int error;
3550 
3551 	ostate = ic->ic_state;
3552 
3553 	rtw_led_newstate(sc, nstate);
3554 
3555 	if (nstate == IEEE80211_S_INIT) {
3556 		callout_stop(&sc->sc_scan_ch);
3557 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3558 		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3559 	}
3560 
3561 	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3562 		rtw_pwrstate(sc, RTW_ON);
3563 
3564 	if ((error = rtw_tune(sc)) != 0)
3565 		return error;
3566 
3567 	switch (nstate) {
3568 	case IEEE80211_S_INIT:
3569 		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3570 		break;
3571 	case IEEE80211_S_SCAN:
3572 		if (ostate != IEEE80211_S_SCAN) {
3573 			(void)memset(ic->ic_bss->ni_bssid, 0,
3574 			    IEEE80211_ADDR_LEN);
3575 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3576 		}
3577 
3578 		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3579 		    rtw_next_scan, ic);
3580 
3581 		break;
3582 	case IEEE80211_S_RUN:
3583 		switch (ic->ic_opmode) {
3584 		case IEEE80211_M_HOSTAP:
3585 		case IEEE80211_M_IBSS:
3586 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3587 			/*FALLTHROUGH*/
3588 		case IEEE80211_M_AHDEMO:
3589 		case IEEE80211_M_STA:
3590 			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3591 			    ic->ic_bss->ni_intval);
3592 			break;
3593 		case IEEE80211_M_MONITOR:
3594 			break;
3595 		}
3596 		rtw_set_nettype(sc, ic->ic_opmode);
3597 		break;
3598 	case IEEE80211_S_ASSOC:
3599 	case IEEE80211_S_AUTH:
3600 		break;
3601 	}
3602 
3603 	if (nstate != IEEE80211_S_SCAN)
3604 		callout_stop(&sc->sc_scan_ch);
3605 
3606 	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3607 }
3608 
3609 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3610 static uint64_t
3611 rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3612 {
3613 	uint32_t tsftl, tsfth;
3614 
3615 	tsfth = RTW_READ(regs, RTW_TSFTRH);
3616 	tsftl = RTW_READ(regs, RTW_TSFTRL);
3617 	if (tsftl < rstamp)	/* Compensate for rollover. */
3618 		tsfth--;
3619 	return ((uint64_t)tsfth << 32) | rstamp;
3620 }
3621 
3622 static void
3623 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3624     struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3625 {
3626 	struct ifnet *ifp = ic->ic_ifp;
3627 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3628 
3629 	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3630 
3631 	switch (subtype) {
3632 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3633 	case IEEE80211_FC0_SUBTYPE_BEACON:
3634 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3635 		    ic->ic_state == IEEE80211_S_RUN) {
3636 			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3637 			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3638 				(void)ieee80211_ibss_merge(ni);
3639 		}
3640 		break;
3641 	default:
3642 		break;
3643 	}
3644 	return;
3645 }
3646 
3647 static struct ieee80211_node *
3648 rtw_node_alloc(struct ieee80211_node_table *nt)
3649 {
3650 	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3651 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3652 	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3653 
3654 	DPRINTF(sc, RTW_DEBUG_NODE,
3655 	    ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
3656 	return ni;
3657 }
3658 
3659 static void
3660 rtw_node_free(struct ieee80211_node *ni)
3661 {
3662 	struct ieee80211com *ic = ni->ni_ic;
3663 	struct ifnet *ifp = ic->ic_ifp;
3664 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3665 
3666 	DPRINTF(sc, RTW_DEBUG_NODE,
3667 	    ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
3668 	    ether_sprintf(ni->ni_bssid)));
3669 	(*sc->sc_mtbl.mt_node_free)(ni);
3670 }
3671 
3672 static int
3673 rtw_media_change(struct ifnet *ifp)
3674 {
3675 	int error;
3676 
3677 	error = ieee80211_media_change(ifp);
3678 	if (error == ENETRESET) {
3679 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3680 		    (IFF_RUNNING|IFF_UP))
3681 			rtw_init(ifp);		/* XXX lose error */
3682 		error = 0;
3683 	}
3684 	return error;
3685 }
3686 
3687 static void
3688 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3689 {
3690 	struct rtw_softc *sc = ifp->if_softc;
3691 
3692 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
3693 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3694 		imr->ifm_status = 0;
3695 		return;
3696 	}
3697 	ieee80211_media_status(ifp, imr);
3698 }
3699 
3700 void
3701 rtw_power(int why, void *arg)
3702 {
3703 	struct rtw_softc *sc = arg;
3704 	struct ifnet *ifp = &sc->sc_if;
3705 	int s;
3706 
3707 	DPRINTF(sc, RTW_DEBUG_PWR,
3708 	    ("%s: rtw_power(%d,)\n", sc->sc_dev.dv_xname, why));
3709 
3710 	s = splnet();
3711 	switch (why) {
3712 	case PWR_STANDBY:
3713 		/* XXX do nothing. */
3714 		break;
3715 	case PWR_SUSPEND:
3716 		rtw_stop(ifp, 0);
3717 		if (sc->sc_power != NULL)
3718 			(*sc->sc_power)(sc, why);
3719 		break;
3720 	case PWR_RESUME:
3721 		if (ifp->if_flags & IFF_UP) {
3722 			if (sc->sc_power != NULL)
3723 				(*sc->sc_power)(sc, why);
3724 			rtw_init(ifp);
3725 		}
3726 		break;
3727 	case PWR_SOFTSUSPEND:
3728 	case PWR_SOFTSTANDBY:
3729 	case PWR_SOFTRESUME:
3730 		break;
3731 	}
3732 	splx(s);
3733 }
3734 
3735 /* rtw_shutdown: make sure the interface is stopped at reboot time. */
3736 void
3737 rtw_shutdown(void *arg)
3738 {
3739 	struct rtw_softc *sc = arg;
3740 
3741 	rtw_stop(&sc->sc_if, 1);
3742 }
3743 
3744 static inline void
3745 rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3746 {
3747 	(void)memcpy(ifp->if_xname, dvname, IFNAMSIZ);
3748 	ifp->if_softc = softc;
3749 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3750 	    IFF_NOTRAILERS;
3751 	ifp->if_ioctl = rtw_ioctl;
3752 	ifp->if_start = rtw_start;
3753 	ifp->if_watchdog = rtw_watchdog;
3754 	ifp->if_init = rtw_init;
3755 	ifp->if_stop = rtw_stop;
3756 }
3757 
3758 static inline void
3759 rtw_set80211props(struct ieee80211com *ic)
3760 {
3761 	int nrate;
3762 	ic->ic_phytype = IEEE80211_T_DS;
3763 	ic->ic_opmode = IEEE80211_M_STA;
3764 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3765 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
3766 
3767 	nrate = 0;
3768 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3769 	    IEEE80211_RATE_BASIC | 2;
3770 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3771 	    IEEE80211_RATE_BASIC | 4;
3772 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3773 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3774 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3775 }
3776 
3777 static inline void
3778 rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3779 {
3780 	mtbl->mt_newstate = ic->ic_newstate;
3781 	ic->ic_newstate = rtw_newstate;
3782 
3783 	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3784 	ic->ic_recv_mgmt = rtw_recv_mgmt;
3785 
3786 	mtbl->mt_node_free = ic->ic_node_free;
3787 	ic->ic_node_free = rtw_node_free;
3788 
3789 	mtbl->mt_node_alloc = ic->ic_node_alloc;
3790 	ic->ic_node_alloc = rtw_node_alloc;
3791 
3792 	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3793 	ic->ic_crypto.cs_key_set = rtw_key_set;
3794 	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3795 	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3796 }
3797 
3798 static inline void
3799 rtw_establish_hooks(struct rtw_hooks *hooks, const char *dvname,
3800     void *arg)
3801 {
3802 	/*
3803 	 * Make sure the interface is shutdown during reboot.
3804 	 */
3805 	hooks->rh_shutdown = shutdownhook_establish(rtw_shutdown, arg);
3806 	if (hooks->rh_shutdown == NULL)
3807 		printf("%s: WARNING: unable to establish shutdown hook\n",
3808 		    dvname);
3809 
3810 	/*
3811 	 * Add a suspend hook to make sure we come back up after a
3812 	 * resume.
3813 	 */
3814 	hooks->rh_power = powerhook_establish(dvname, rtw_power, arg);
3815 	if (hooks->rh_power == NULL)
3816 		printf("%s: WARNING: unable to establish power hook\n",
3817 		    dvname);
3818 }
3819 
3820 static inline void
3821 rtw_disestablish_hooks(struct rtw_hooks *hooks, const char *dvname,
3822     void *arg)
3823 {
3824 	if (hooks->rh_shutdown != NULL)
3825 		shutdownhook_disestablish(hooks->rh_shutdown);
3826 
3827 	if (hooks->rh_power != NULL)
3828 		powerhook_disestablish(hooks->rh_power);
3829 }
3830 
3831 static inline void
3832 rtw_init_radiotap(struct rtw_softc *sc)
3833 {
3834 	uint32_t present;
3835 
3836 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3837 	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3838 
3839 	if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
3840 		present = htole32(RTW_PHILIPS_RX_RADIOTAP_PRESENT);
3841 	else
3842 		present = htole32(RTW_RX_RADIOTAP_PRESENT);
3843 	sc->sc_rxtap.rr_ihdr.it_present = present;
3844 
3845 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3846 	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3847 	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3848 }
3849 
3850 static int
3851 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3852 {
3853 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3854 	SIMPLEQ_INIT(&tsb->tsb_freeq);
3855 	tsb->tsb_ndesc = qlen;
3856 	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3857 	    M_NOWAIT);
3858 	if (tsb->tsb_desc == NULL)
3859 		return ENOMEM;
3860 	return 0;
3861 }
3862 
3863 static void
3864 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3865 {
3866 	int pri;
3867 	struct rtw_txsoft_blk *tsb;
3868 
3869 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3870 		tsb = &sc->sc_txsoft_blk[pri];
3871 		free(tsb->tsb_desc, M_DEVBUF);
3872 		tsb->tsb_desc = NULL;
3873 	}
3874 }
3875 
3876 static int
3877 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3878 {
3879 	int pri, rc = 0;
3880 	int qlen[RTW_NTXPRI] =
3881 	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3882 	struct rtw_txsoft_blk *tsbs;
3883 
3884 	tsbs = sc->sc_txsoft_blk;
3885 
3886 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3887 		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3888 		if (rc != 0)
3889 			break;
3890 	}
3891 	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3892 	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3893 	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3894 	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3895 	return rc;
3896 }
3897 
3898 static void
3899 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3900     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3901 {
3902 	tdb->tdb_ndesc = ndesc;
3903 	tdb->tdb_desc = desc;
3904 	tdb->tdb_physbase = physbase;
3905 	tdb->tdb_ofs = ofs;
3906 
3907 	(void)memset(tdb->tdb_desc, 0,
3908 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3909 
3910 	rtw_txdesc_blk_init(tdb);
3911 	tdb->tdb_next = 0;
3912 }
3913 
3914 static void
3915 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3916 {
3917 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3918 	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3919 	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3920 
3921 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3922 	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3923 	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3924 
3925 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3926 	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3927 	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3928 
3929 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3930 	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3931 	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3932 }
3933 
3934 static struct rtw_rf *
3935 rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3936 {
3937 	rtw_rf_write_t rf_write;
3938 	struct rtw_rf *rf;
3939 
3940 	switch (rfchipid) {
3941 	default:
3942 		rf_write = rtw_rf_hostwrite;
3943 		break;
3944 	case RTW_RFCHIPID_INTERSIL:
3945 	case RTW_RFCHIPID_PHILIPS:
3946 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3947 	case RTW_RFCHIPID_RFMD:
3948 		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3949 		break;
3950 	}
3951 
3952 	switch (rfchipid) {
3953 	case RTW_RFCHIPID_GCT:
3954 		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3955 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3956 		break;
3957 	case RTW_RFCHIPID_MAXIM:
3958 		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3959 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3960 		break;
3961 	case RTW_RFCHIPID_PHILIPS:
3962 		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
3963 		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3964 		break;
3965 	case RTW_RFCHIPID_RFMD:
3966 		/* XXX RFMD has no RF constructor */
3967 		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3968 		/*FALLTHROUGH*/
3969 	default:
3970 		return NULL;
3971 	}
3972 	rf->rf_continuous_tx_cb =
3973 	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
3974 	rf->rf_continuous_tx_arg = (void *)sc;
3975 	return rf;
3976 }
3977 
3978 /* Revision C and later use a different PHY delay setting than
3979  * revisions A and B.
3980  */
3981 static uint8_t
3982 rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
3983 {
3984 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
3985 #define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
3986 
3987 	uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
3988 
3989 	RTW_WRITE(regs, RTW_RCR, REVAB);
3990 	RTW_WBW(regs, RTW_RCR, RTW_RCR);
3991 	RTW_WRITE(regs, RTW_RCR, REVC);
3992 
3993 	RTW_WBR(regs, RTW_RCR, RTW_RCR);
3994 	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
3995 		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
3996 
3997 	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
3998 	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
3999 
4000 	return phydelay;
4001 #undef REVC
4002 }
4003 
4004 void
4005 rtw_attach(struct rtw_softc *sc)
4006 {
4007 	struct ifnet *ifp = &sc->sc_if;
4008 	struct ieee80211com *ic = &sc->sc_ic;
4009 	struct rtw_txsoft_blk *tsb;
4010 	int pri, rc;
4011 
4012 	rtw_cipher_wep = ieee80211_cipher_wep;
4013 	rtw_cipher_wep.ic_decap = rtw_wep_decap;
4014 
4015 	NEXT_ATTACH_STATE(sc, DETACHED);
4016 
4017 	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
4018 	case RTW_TCR_HWVERID_F:
4019 		sc->sc_hwverid = 'F';
4020 		break;
4021 	case RTW_TCR_HWVERID_D:
4022 		sc->sc_hwverid = 'D';
4023 		break;
4024 	default:
4025 		sc->sc_hwverid = '?';
4026 		break;
4027 	}
4028 	printf("%s: hardware version %c\n", sc->sc_dev.dv_xname,
4029 	    sc->sc_hwverid);
4030 
4031 	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4032 	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4033 	    0);
4034 
4035 	if (rc != 0) {
4036 		printf("%s: could not allocate hw descriptors, error %d\n",
4037 		     sc->sc_dev.dv_xname, rc);
4038 		goto err;
4039 	}
4040 
4041 	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4042 
4043 	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4044 	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4045 	    (void **)&sc->sc_descs, BUS_DMA_COHERENT);
4046 
4047 	if (rc != 0) {
4048 		printf("%s: could not map hw descriptors, error %d\n",
4049 		    sc->sc_dev.dv_xname, rc);
4050 		goto err;
4051 	}
4052 	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4053 
4054 	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4055 	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4056 
4057 	if (rc != 0) {
4058 		printf("%s: could not create DMA map for hw descriptors, "
4059 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4060 		goto err;
4061 	}
4062 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4063 
4064 	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4065 	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4066 
4067 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4068 		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4069 		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4070 	}
4071 
4072 	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4073 	    sizeof(struct rtw_descs), NULL, 0);
4074 
4075 	if (rc != 0) {
4076 		printf("%s: could not load DMA map for hw descriptors, "
4077 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4078 		goto err;
4079 	}
4080 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4081 
4082 	if (rtw_txsoft_blk_setup_all(sc) != 0)
4083 		goto err;
4084 	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4085 
4086 	rtw_txdesc_blk_setup_all(sc);
4087 
4088 	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4089 
4090 	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4091 
4092 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4093 		tsb = &sc->sc_txsoft_blk[pri];
4094 
4095 		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4096 		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4097 			printf("%s: could not load DMA map for "
4098 			    "hw tx descriptors, error %d\n",
4099 			    sc->sc_dev.dv_xname, rc);
4100 			goto err;
4101 		}
4102 	}
4103 
4104 	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4105 	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4106 	                                    RTW_RXQLEN)) != 0) {
4107 		printf("%s: could not load DMA map for hw rx descriptors, "
4108 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4109 		goto err;
4110 	}
4111 	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4112 
4113 	/* Reset the chip to a known state. */
4114 	if (rtw_reset(sc) != 0)
4115 		goto err;
4116 	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4117 
4118 	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4119 
4120 	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4121 		sc->sc_flags |= RTW_F_9356SROM;
4122 
4123 	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4124 	    sc->sc_dev.dv_xname) != 0)
4125 		goto err;
4126 
4127 	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4128 
4129 	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4130 	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4131 	    sc->sc_dev.dv_xname) != 0) {
4132 		printf("%s: attach failed, malformed serial ROM\n",
4133 		    sc->sc_dev.dv_xname);
4134 		goto err;
4135 	}
4136 
4137 	printf("%s: %s PHY\n", sc->sc_dev.dv_xname,
4138 	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4139 
4140 	printf("%s: CS threshold %u\n", sc->sc_dev.dv_xname, sc->sc_csthr);
4141 
4142 	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4143 
4144 	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4145 	    sc->sc_flags & RTW_F_DIGPHY);
4146 
4147 	if (sc->sc_rf == NULL) {
4148 		printf("%s: attach failed, could not attach RF\n",
4149 		    sc->sc_dev.dv_xname);
4150 		goto err;
4151 	}
4152 
4153 	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4154 
4155 	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4156 
4157 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4158 	    ("%s: PHY delay %d\n", sc->sc_dev.dv_xname, sc->sc_phydelay));
4159 
4160 	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4161 		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4162 
4163 	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels,
4164 	    sc->sc_dev.dv_xname);
4165 
4166 	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4167 	    sc->sc_dev.dv_xname) != 0)
4168 		goto err;
4169 	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4170 
4171 	rtw_setifprops(ifp, sc->sc_dev.dv_xname, (void*)sc);
4172 
4173 	IFQ_SET_READY(&ifp->if_snd);
4174 
4175 	sc->sc_ic.ic_ifp = ifp;
4176 	rtw_set80211props(&sc->sc_ic);
4177 
4178 	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4179 
4180 	/*
4181 	 * Call MI attach routines.
4182 	 */
4183 	if_attach(ifp);
4184 	ieee80211_ifattach(&sc->sc_ic);
4185 
4186 	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4187 
4188 	/* possibly we should fill in our own sc_send_prresp, since
4189 	 * the RTL8180 is probably sending probe responses in ad hoc
4190 	 * mode.
4191 	 */
4192 
4193 	/* complete initialization */
4194 	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4195 	callout_init(&sc->sc_scan_ch, 0);
4196 
4197 	rtw_init_radiotap(sc);
4198 
4199 #if NBPFILTER > 0
4200 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
4201 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4202 #endif
4203 
4204 	rtw_establish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname, (void*)sc);
4205 
4206 	NEXT_ATTACH_STATE(sc, FINISHED);
4207 
4208 	ieee80211_announce(ic);
4209 	return;
4210 err:
4211 	rtw_detach(sc);
4212 	return;
4213 }
4214 
4215 int
4216 rtw_detach(struct rtw_softc *sc)
4217 {
4218 	struct ifnet *ifp = &sc->sc_if;
4219 	int pri;
4220 
4221 	sc->sc_flags |= RTW_F_INVALID;
4222 
4223 	switch (sc->sc_attach_state) {
4224 	case FINISHED:
4225 		rtw_stop(ifp, 1);
4226 
4227 		rtw_disestablish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname,
4228 		    (void*)sc);
4229 		callout_stop(&sc->sc_scan_ch);
4230 		ieee80211_ifdetach(&sc->sc_ic);
4231 		if_detach(ifp);
4232 		break;
4233 	case FINISH_ID_STA:
4234 	case FINISH_RF_ATTACH:
4235 		rtw_rf_destroy(sc->sc_rf);
4236 		sc->sc_rf = NULL;
4237 		/*FALLTHROUGH*/
4238 	case FINISH_PARSE_SROM:
4239 	case FINISH_READ_SROM:
4240 		rtw_srom_free(&sc->sc_srom);
4241 		/*FALLTHROUGH*/
4242 	case FINISH_RESET:
4243 	case FINISH_RXMAPS_CREATE:
4244 		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4245 		    RTW_RXQLEN);
4246 		/*FALLTHROUGH*/
4247 	case FINISH_TXMAPS_CREATE:
4248 		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4249 			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4250 			    sc->sc_txsoft_blk[pri].tsb_desc,
4251 			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4252 		}
4253 		/*FALLTHROUGH*/
4254 	case FINISH_TXDESCBLK_SETUP:
4255 	case FINISH_TXCTLBLK_SETUP:
4256 		rtw_txsoft_blk_cleanup_all(sc);
4257 		/*FALLTHROUGH*/
4258 	case FINISH_DESCMAP_LOAD:
4259 		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4260 		/*FALLTHROUGH*/
4261 	case FINISH_DESCMAP_CREATE:
4262 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4263 		/*FALLTHROUGH*/
4264 	case FINISH_DESC_MAP:
4265 		bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_descs,
4266 		    sizeof(struct rtw_descs));
4267 		/*FALLTHROUGH*/
4268 	case FINISH_DESC_ALLOC:
4269 		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4270 		    sc->sc_desc_nsegs);
4271 		/*FALLTHROUGH*/
4272 	case DETACHED:
4273 		NEXT_ATTACH_STATE(sc, DETACHED);
4274 		break;
4275 	}
4276 	return 0;
4277 }
4278 
4279 int
4280 rtw_activate(struct device *self, enum devact act)
4281 {
4282 	struct rtw_softc *sc = (struct rtw_softc *)self;
4283 	int rc = 0, s;
4284 
4285 	s = splnet();
4286 	switch (act) {
4287 	case DVACT_ACTIVATE:
4288 		rc = EOPNOTSUPP;
4289 		break;
4290 
4291 	case DVACT_DEACTIVATE:
4292 		if_deactivate(&sc->sc_if);
4293 		break;
4294 	}
4295 	splx(s);
4296 	return rc;
4297 }
4298