xref: /netbsd-src/sys/dev/ic/rtw.c (revision a30f264f2a5f410ffefcc55600a9238b3a0c935c)
1 /* $NetBSD: rtw.c,v 1.61 2005/12/24 20:27:30 perry Exp $ */
2 /*-
3  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
4  *
5  * Programmed for NetBSD by David Young.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. The name of David Young may not be used to endorse or promote
16  *    products derived from this software without specific prior
17  *    written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
20  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
23  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
25  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
30  * OF SUCH DAMAGE.
31  */
32 /*
33  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
34  */
35 
36 #include <sys/cdefs.h>
37 __KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.61 2005/12/24 20:27:30 perry Exp $");
38 
39 #include "bpfilter.h"
40 
41 #include <sys/param.h>
42 #include <sys/sysctl.h>
43 #include <sys/systm.h>
44 #include <sys/callout.h>
45 #include <sys/mbuf.h>
46 #include <sys/malloc.h>
47 #include <sys/kernel.h>
48 #include <sys/time.h>
49 #include <sys/types.h>
50 
51 #include <machine/endian.h>
52 #include <machine/bus.h>
53 #include <machine/intr.h>	/* splnet */
54 
55 #include <uvm/uvm_extern.h>
56 
57 #include <net/if.h>
58 #include <net/if_media.h>
59 #include <net/if_ether.h>
60 
61 #include <net80211/ieee80211_netbsd.h>
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_radiotap.h>
64 
65 #if NBPFILTER > 0
66 #include <net/bpf.h>
67 #endif
68 
69 #include <dev/ic/rtwreg.h>
70 #include <dev/ic/rtwvar.h>
71 #include <dev/ic/rtwphyio.h>
72 #include <dev/ic/rtwphy.h>
73 
74 #include <dev/ic/smc93cx6var.h>
75 
76 #define	KASSERT2(__cond, __msg)		\
77 	do {				\
78 		if (!(__cond))		\
79 			panic __msg ;	\
80 	} while (0)
81 
82 static int rtw_rfprog_fallback = 0;
83 static int rtw_host_rfio = 0;
84 
85 #ifdef RTW_DEBUG
86 int rtw_debug = 0;
87 static int rtw_rxbufs_limit = RTW_RXQLEN;
88 #endif /* RTW_DEBUG */
89 
90 #define NEXT_ATTACH_STATE(sc, state) do {			\
91 	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
92 	    ("%s: attach state %s\n", __func__, #state));	\
93 	sc->sc_attach_state = state;				\
94 } while (0)
95 
96 static int rtw_xmtr_restart = 0;
97 static int rtw_do_chip_reset = 0;
98 static int rtw_ring_reset = 0;
99 
100 int rtw_dwelltime = 200;	/* milliseconds */
101 static struct ieee80211_cipher rtw_cipher_wep;
102 
103 static void rtw_start(struct ifnet *);
104 static void rtw_reset_oactive(struct rtw_softc *);
105 static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
106     struct ieee80211_node *);
107 static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
108 
109 static void rtw_io_enable(struct rtw_regs *, uint8_t, int);
110 static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
111 static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
112     const u_int8_t[IEEE80211_ADDR_LEN]);
113 static void rtw_key_update_end(struct ieee80211com *);
114 static void rtw_key_update_begin(struct ieee80211com *);
115 static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
116 static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
117 
118 static void rtw_led_attach(struct rtw_led_state *, void *);
119 static void rtw_led_init(struct rtw_regs *);
120 static void rtw_led_slowblink(void *);
121 static void rtw_led_fastblink(void *);
122 static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
123 
124 static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
125 static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
126 #ifdef RTW_DEBUG
127 static void rtw_print_txdesc(struct rtw_softc *, const char *,
128     struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
129 static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
130 static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
131 #endif /* RTW_DEBUG */
132 
133 /*
134  * Setup sysctl(3) MIB, hw.rtw.*
135  *
136  * TBD condition CTLFLAG_PERMANENT on being an LKM or not
137  */
138 SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
139 {
140 	int rc;
141 	const struct sysctlnode *cnode, *rnode;
142 
143 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
144 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
145 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
146 		goto err;
147 
148 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
149 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
150 	    "Realtek RTL818x 802.11 controls",
151 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
152 		goto err;
153 
154 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
155 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
156 	    "chip_reset", SYSCTL_DESCR("Gratuitously reset chip on rcvr error"),
157 	    NULL, 0, &rtw_do_chip_reset, 0,
158 	    CTL_CREATE, CTL_EOL)) != 0)
159 		goto err;
160 
161 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
162 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
163 	    "ring_reset", SYSCTL_DESCR("Reset ring pointers on rcvr error"),
164 	    NULL, 0, &rtw_ring_reset, 0,
165 	    CTL_CREATE, CTL_EOL)) != 0)
166 		goto err;
167 
168 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
169 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
170 	    "xmtr_restart",
171 	    SYSCTL_DESCR("Gratuitously reset xmtr on rcvr error"),
172 	    NULL, 0, &rtw_xmtr_restart, 0,
173 	    CTL_CREATE, CTL_EOL)) != 0)
174 		goto err;
175 
176 #ifdef RTW_DEBUG
177 	/* control debugging printfs */
178 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
179 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
180 	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
181 	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
182 	    CTL_CREATE, CTL_EOL)) != 0)
183 		goto err;
184 
185 	/* Limit rx buffers, for simulating resource exhaustion. */
186 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
187 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
188 	    "rxbufs_limit",
189 	    SYSCTL_DESCR("Set rx buffers limit"),
190 	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
191 	    CTL_CREATE, CTL_EOL)) != 0)
192 		goto err;
193 
194 #endif /* RTW_DEBUG */
195 	/* set fallback RF programming method */
196 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
197 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
198 	    "rfprog_fallback",
199 	    SYSCTL_DESCR("Set fallback RF programming method"),
200 	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
201 	    CTL_CREATE, CTL_EOL)) != 0)
202 		goto err;
203 
204 	/* force host to control RF I/O bus */
205 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
206 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
207 	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
208 	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
209 	    CTL_CREATE, CTL_EOL)) != 0)
210 		goto err;
211 
212 	return;
213 err:
214 	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
215 }
216 
217 static int
218 rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
219 {
220 	int error, t;
221 	struct sysctlnode node;
222 
223 	node = *rnode;
224 	t = *(int*)rnode->sysctl_data;
225 	node.sysctl_data = &t;
226 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
227 	if (error || newp == NULL)
228 		return (error);
229 
230 	if (t < lower || t > upper)
231 		return (EINVAL);
232 
233 	*(int*)rnode->sysctl_data = t;
234 
235 	return (0);
236 }
237 
238 static int
239 rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
240 {
241 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
242 	    MASK_AND_RSHIFT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
243 }
244 
245 static int
246 rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
247 {
248 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
249 }
250 
251 #ifdef RTW_DEBUG
252 static int
253 rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
254 {
255 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
256 	    0, RTW_DEBUG_MAX);
257 }
258 
259 static int
260 rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
261 {
262 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
263 	    0, RTW_RXQLEN);
264 }
265 
266 static void
267 rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
268 {
269 #define PRINTREG32(sc, reg)				\
270 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
271 	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
272 	    dvname, reg, RTW_READ(regs, reg)))
273 
274 #define PRINTREG16(sc, reg)				\
275 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
276 	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
277 	    dvname, reg, RTW_READ16(regs, reg)))
278 
279 #define PRINTREG8(sc, reg)				\
280 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
281 	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
282 	    dvname, reg, RTW_READ8(regs, reg)))
283 
284 	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
285 
286 	PRINTREG32(regs, RTW_IDR0);
287 	PRINTREG32(regs, RTW_IDR1);
288 	PRINTREG32(regs, RTW_MAR0);
289 	PRINTREG32(regs, RTW_MAR1);
290 	PRINTREG32(regs, RTW_TSFTRL);
291 	PRINTREG32(regs, RTW_TSFTRH);
292 	PRINTREG32(regs, RTW_TLPDA);
293 	PRINTREG32(regs, RTW_TNPDA);
294 	PRINTREG32(regs, RTW_THPDA);
295 	PRINTREG32(regs, RTW_TCR);
296 	PRINTREG32(regs, RTW_RCR);
297 	PRINTREG32(regs, RTW_TINT);
298 	PRINTREG32(regs, RTW_TBDA);
299 	PRINTREG32(regs, RTW_ANAPARM);
300 	PRINTREG32(regs, RTW_BB);
301 	PRINTREG32(regs, RTW_PHYCFG);
302 	PRINTREG32(regs, RTW_WAKEUP0L);
303 	PRINTREG32(regs, RTW_WAKEUP0H);
304 	PRINTREG32(regs, RTW_WAKEUP1L);
305 	PRINTREG32(regs, RTW_WAKEUP1H);
306 	PRINTREG32(regs, RTW_WAKEUP2LL);
307 	PRINTREG32(regs, RTW_WAKEUP2LH);
308 	PRINTREG32(regs, RTW_WAKEUP2HL);
309 	PRINTREG32(regs, RTW_WAKEUP2HH);
310 	PRINTREG32(regs, RTW_WAKEUP3LL);
311 	PRINTREG32(regs, RTW_WAKEUP3LH);
312 	PRINTREG32(regs, RTW_WAKEUP3HL);
313 	PRINTREG32(regs, RTW_WAKEUP3HH);
314 	PRINTREG32(regs, RTW_WAKEUP4LL);
315 	PRINTREG32(regs, RTW_WAKEUP4LH);
316 	PRINTREG32(regs, RTW_WAKEUP4HL);
317 	PRINTREG32(regs, RTW_WAKEUP4HH);
318 	PRINTREG32(regs, RTW_DK0);
319 	PRINTREG32(regs, RTW_DK1);
320 	PRINTREG32(regs, RTW_DK2);
321 	PRINTREG32(regs, RTW_DK3);
322 	PRINTREG32(regs, RTW_RETRYCTR);
323 	PRINTREG32(regs, RTW_RDSAR);
324 	PRINTREG32(regs, RTW_FER);
325 	PRINTREG32(regs, RTW_FEMR);
326 	PRINTREG32(regs, RTW_FPSR);
327 	PRINTREG32(regs, RTW_FFER);
328 
329 	/* 16-bit registers */
330 	PRINTREG16(regs, RTW_BRSR);
331 	PRINTREG16(regs, RTW_IMR);
332 	PRINTREG16(regs, RTW_ISR);
333 	PRINTREG16(regs, RTW_BCNITV);
334 	PRINTREG16(regs, RTW_ATIMWND);
335 	PRINTREG16(regs, RTW_BINTRITV);
336 	PRINTREG16(regs, RTW_ATIMTRITV);
337 	PRINTREG16(regs, RTW_CRC16ERR);
338 	PRINTREG16(regs, RTW_CRC0);
339 	PRINTREG16(regs, RTW_CRC1);
340 	PRINTREG16(regs, RTW_CRC2);
341 	PRINTREG16(regs, RTW_CRC3);
342 	PRINTREG16(regs, RTW_CRC4);
343 	PRINTREG16(regs, RTW_CWR);
344 
345 	/* 8-bit registers */
346 	PRINTREG8(regs, RTW_CR);
347 	PRINTREG8(regs, RTW_9346CR);
348 	PRINTREG8(regs, RTW_CONFIG0);
349 	PRINTREG8(regs, RTW_CONFIG1);
350 	PRINTREG8(regs, RTW_CONFIG2);
351 	PRINTREG8(regs, RTW_MSR);
352 	PRINTREG8(regs, RTW_CONFIG3);
353 	PRINTREG8(regs, RTW_CONFIG4);
354 	PRINTREG8(regs, RTW_TESTR);
355 	PRINTREG8(regs, RTW_PSR);
356 	PRINTREG8(regs, RTW_SCR);
357 	PRINTREG8(regs, RTW_PHYDELAY);
358 	PRINTREG8(regs, RTW_CRCOUNT);
359 	PRINTREG8(regs, RTW_PHYADDR);
360 	PRINTREG8(regs, RTW_PHYDATAW);
361 	PRINTREG8(regs, RTW_PHYDATAR);
362 	PRINTREG8(regs, RTW_CONFIG5);
363 	PRINTREG8(regs, RTW_TPPOLL);
364 
365 	PRINTREG16(regs, RTW_BSSID16);
366 	PRINTREG32(regs, RTW_BSSID32);
367 #undef PRINTREG32
368 #undef PRINTREG16
369 #undef PRINTREG8
370 }
371 #endif /* RTW_DEBUG */
372 
373 void
374 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
375 {
376 	struct rtw_regs *regs = &sc->sc_regs;
377 
378 	uint32_t tcr;
379 	tcr = RTW_READ(regs, RTW_TCR);
380 	tcr &= ~RTW_TCR_LBK_MASK;
381 	if (enable)
382 		tcr |= RTW_TCR_LBK_CONT;
383 	else
384 		tcr |= RTW_TCR_LBK_NORMAL;
385 	RTW_WRITE(regs, RTW_TCR, tcr);
386 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
387 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
388 	rtw_txdac_enable(sc, !enable);
389 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
390 	rtw_set_access(regs, RTW_ACCESS_NONE);
391 }
392 
393 #ifdef RTW_DEBUG
394 static const char *
395 rtw_access_string(enum rtw_access access)
396 {
397 	switch (access) {
398 	case RTW_ACCESS_NONE:
399 		return "none";
400 	case RTW_ACCESS_CONFIG:
401 		return "config";
402 	case RTW_ACCESS_ANAPARM:
403 		return "anaparm";
404 	default:
405 		return "unknown";
406 	}
407 }
408 #endif /* RTW_DEBUG */
409 
410 static void
411 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
412 {
413 	KASSERT(naccess >= RTW_ACCESS_NONE && naccess <= RTW_ACCESS_ANAPARM);
414 	KASSERT(regs->r_access >= RTW_ACCESS_NONE &&
415 	        regs->r_access <= RTW_ACCESS_ANAPARM);
416 
417 	if (naccess == regs->r_access)
418 		return;
419 
420 	switch (naccess) {
421 	case RTW_ACCESS_NONE:
422 		switch (regs->r_access) {
423 		case RTW_ACCESS_ANAPARM:
424 			rtw_anaparm_enable(regs, 0);
425 			/*FALLTHROUGH*/
426 		case RTW_ACCESS_CONFIG:
427 			rtw_config0123_enable(regs, 0);
428 			/*FALLTHROUGH*/
429 		case RTW_ACCESS_NONE:
430 			break;
431 		}
432 		break;
433 	case RTW_ACCESS_CONFIG:
434 		switch (regs->r_access) {
435 		case RTW_ACCESS_NONE:
436 			rtw_config0123_enable(regs, 1);
437 			/*FALLTHROUGH*/
438 		case RTW_ACCESS_CONFIG:
439 			break;
440 		case RTW_ACCESS_ANAPARM:
441 			rtw_anaparm_enable(regs, 0);
442 			break;
443 		}
444 		break;
445 	case RTW_ACCESS_ANAPARM:
446 		switch (regs->r_access) {
447 		case RTW_ACCESS_NONE:
448 			rtw_config0123_enable(regs, 1);
449 			/*FALLTHROUGH*/
450 		case RTW_ACCESS_CONFIG:
451 			rtw_anaparm_enable(regs, 1);
452 			/*FALLTHROUGH*/
453 		case RTW_ACCESS_ANAPARM:
454 			break;
455 		}
456 		break;
457 	}
458 }
459 
460 void
461 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
462 {
463 	rtw_set_access1(regs, access);
464 	RTW_DPRINTF(RTW_DEBUG_ACCESS,
465 	    ("%s: access %s -> %s\n", __func__,
466 	    rtw_access_string(regs->r_access),
467 	    rtw_access_string(access)));
468 	regs->r_access = access;
469 }
470 
471 /*
472  * Enable registers, switch register banks.
473  */
474 void
475 rtw_config0123_enable(struct rtw_regs *regs, int enable)
476 {
477 	uint8_t ecr;
478 	ecr = RTW_READ8(regs, RTW_9346CR);
479 	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
480 	if (enable)
481 		ecr |= RTW_9346CR_EEM_CONFIG;
482 	else {
483 		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
484 		ecr |= RTW_9346CR_EEM_NORMAL;
485 	}
486 	RTW_WRITE8(regs, RTW_9346CR, ecr);
487 	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
488 }
489 
490 /* requires rtw_config0123_enable(, 1) */
491 void
492 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
493 {
494 	uint8_t cfg3;
495 
496 	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
497 	cfg3 |= RTW_CONFIG3_CLKRUNEN;
498 	if (enable)
499 		cfg3 |= RTW_CONFIG3_PARMEN;
500 	else
501 		cfg3 &= ~RTW_CONFIG3_PARMEN;
502 	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
503 	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
504 }
505 
506 /* requires rtw_anaparm_enable(, 1) */
507 void
508 rtw_txdac_enable(struct rtw_softc *sc, int enable)
509 {
510 	uint32_t anaparm;
511 	struct rtw_regs *regs = &sc->sc_regs;
512 
513 	anaparm = RTW_READ(regs, RTW_ANAPARM);
514 	if (enable)
515 		anaparm &= ~RTW_ANAPARM_TXDACOFF;
516 	else
517 		anaparm |= RTW_ANAPARM_TXDACOFF;
518 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
519 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
520 }
521 
522 static inline int
523 rtw_chip_reset1(struct rtw_regs *regs, const char *dvname)
524 {
525 	uint8_t cr;
526 	int i;
527 
528 	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
529 
530 	RTW_WBR(regs, RTW_CR, RTW_CR);
531 
532 	for (i = 0; i < 1000; i++) {
533 		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
534 			RTW_DPRINTF(RTW_DEBUG_RESET,
535 			    ("%s: reset in %dus\n", dvname, i));
536 			return 0;
537 		}
538 		RTW_RBR(regs, RTW_CR, RTW_CR);
539 		DELAY(10); /* 10us */
540 	}
541 
542 	printf("%s: reset failed\n", dvname);
543 	return ETIMEDOUT;
544 }
545 
546 static inline int
547 rtw_chip_reset(struct rtw_regs *regs, const char *dvname)
548 {
549 	uint32_t tcr;
550 
551 	/* from Linux driver */
552 	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
553 	      LSHIFT(7, RTW_TCR_SRL_MASK) | LSHIFT(7, RTW_TCR_LRL_MASK);
554 
555 	RTW_WRITE(regs, RTW_TCR, tcr);
556 
557 	RTW_WBW(regs, RTW_CR, RTW_TCR);
558 
559 	return rtw_chip_reset1(regs, dvname);
560 }
561 
562 static int
563 rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
564 {
565 	struct ieee80211_key keycopy;
566 
567 	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
568 
569 	keycopy = *k;
570 	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
571 
572 	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
573 }
574 
575 static int
576 rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
577 {
578 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
579 	u_int keyix = k->wk_keyix;
580 
581 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__, keyix));
582 
583 	if (keyix >= IEEE80211_WEP_NKID)
584 		return 0;
585 	if (k->wk_keylen != 0)
586 		sc->sc_flags &= ~RTW_F_DK_VALID;
587 
588 	return 1;
589 }
590 
591 static int
592 rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
593 	const u_int8_t mac[IEEE80211_ADDR_LEN])
594 {
595 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
596 
597 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
598 
599 	if (k->wk_keyix >= IEEE80211_WEP_NKID)
600 		return 0;
601 
602 	sc->sc_flags &= ~RTW_F_DK_VALID;
603 
604 	return 1;
605 }
606 
607 static void
608 rtw_key_update_begin(struct ieee80211com *ic)
609 {
610 #ifdef RTW_DEBUG
611 	struct ifnet *ifp = ic->ic_ifp;
612 	struct rtw_softc *sc = ifp->if_softc;
613 #endif
614 
615 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
616 }
617 
618 static void
619 rtw_key_update_end(struct ieee80211com *ic)
620 {
621 	struct ifnet *ifp = ic->ic_ifp;
622 	struct rtw_softc *sc = ifp->if_softc;
623 
624 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
625 
626 	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
627 	    (sc->sc_flags & RTW_F_ENABLED) == 0 ||
628 	    (sc->sc_flags & RTW_F_INVALID) != 0)
629 		return;
630 
631 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
632 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
633 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE,
634 	    (ifp->if_flags & IFF_RUNNING) != 0);
635 }
636 
637 static inline int
638 rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
639 {
640 	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
641 		return 0;
642 
643 	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
644 		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
645 }
646 
647 static void
648 rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
649 {
650 	uint8_t psr, scr;
651 	int i, tx_key_len;
652 	struct rtw_regs *regs;
653 	union rtw_keys *rk;
654 
655 	regs = &sc->sc_regs;
656 	rk = &sc->sc_keys;
657 
658 	(void)memset(rk->rk_keys, 0, sizeof(rk->rk_keys));
659 
660 	/* Temporarily use software crypto for all keys. */
661 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
662 		if (wk[i].wk_cipher == &rtw_cipher_wep)
663 			wk[i].wk_cipher = &ieee80211_cipher_wep;
664 	}
665 
666 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
667 
668 	psr = RTW_READ8(regs, RTW_PSR);
669 	scr = RTW_READ8(regs, RTW_SCR);
670 	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
671 
672 	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
673 		goto out;
674 
675 	if (!rtw_key_hwsupp(sc->sc_flags, &wk[txkey]))
676 		goto out;
677 
678 	tx_key_len = wk[txkey].wk_keylen;
679 
680 	switch (tx_key_len) {
681 	case 5:
682 		scr |= RTW_SCR_KM_WEP40;
683 		break;
684 	case 13:
685 		scr |= RTW_SCR_KM_WEP104;
686 		break;
687 	default:
688 		goto out;
689 	}
690 
691 	scr |= RTW_SCR_RXSECON;
692 
693 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
694 		if (wk[i].wk_keylen != tx_key_len ||
695 		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
696 			continue;
697 		/* h/w will decrypt, s/w still strips headers */
698 		wk[i].wk_cipher = &rtw_cipher_wep;
699 		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
700 	}
701 
702 out:
703 	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
704 
705 	bus_space_write_region_4(regs->r_bt, regs->r_bh,
706 	    RTW_DK0, rk->rk_words,
707 	    sizeof(rk->rk_words) / sizeof(rk->rk_words[0]));
708 
709 	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
710 	    BUS_SPACE_BARRIER_SYNC);
711 
712 	RTW_WBW(regs, RTW_DK0, RTW_PSR);
713 	RTW_WRITE8(regs, RTW_PSR, psr);
714 	RTW_WBW(regs, RTW_PSR, RTW_SCR);
715 	RTW_WRITE8(regs, RTW_SCR, scr);
716 	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
717 	rtw_set_access(regs, RTW_ACCESS_NONE);
718 	sc->sc_flags |= RTW_F_DK_VALID;
719 }
720 
721 static inline int
722 rtw_recall_eeprom(struct rtw_regs *regs, const char *dvname)
723 {
724 	int i;
725 	uint8_t ecr;
726 
727 	ecr = RTW_READ8(regs, RTW_9346CR);
728 	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
729 	RTW_WRITE8(regs, RTW_9346CR, ecr);
730 
731 	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
732 
733 	/* wait 25ms for completion */
734 	for (i = 0; i < 250; i++) {
735 		ecr = RTW_READ8(regs, RTW_9346CR);
736 		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
737 			RTW_DPRINTF(RTW_DEBUG_RESET,
738 			    ("%s: recall EEPROM in %dus\n", dvname, i * 100));
739 			return 0;
740 		}
741 		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
742 		DELAY(100);
743 	}
744 	printf("%s: recall EEPROM failed\n", dvname);
745 	return ETIMEDOUT;
746 }
747 
748 static inline int
749 rtw_reset(struct rtw_softc *sc)
750 {
751 	int rc;
752 	uint8_t config1;
753 
754 	sc->sc_flags &= ~RTW_F_DK_VALID;
755 
756 	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
757 		return rc;
758 
759 	if ((rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
760 		;
761 
762 	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
763 	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
764 	/* TBD turn off maximum power saving? */
765 
766 	return 0;
767 }
768 
769 static inline int
770 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
771     u_int ndescs)
772 {
773 	int i, rc = 0;
774 	for (i = 0; i < ndescs; i++) {
775 		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
776 		    0, 0, &descs[i].ts_dmamap);
777 		if (rc != 0)
778 			break;
779 	}
780 	return rc;
781 }
782 
783 static inline int
784 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
785     u_int ndescs)
786 {
787 	int i, rc = 0;
788 	for (i = 0; i < ndescs; i++) {
789 		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
790 		    &descs[i].rs_dmamap);
791 		if (rc != 0)
792 			break;
793 	}
794 	return rc;
795 }
796 
797 static inline void
798 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
799     u_int ndescs)
800 {
801 	int i;
802 	for (i = 0; i < ndescs; i++) {
803 		if (descs[i].rs_dmamap != NULL)
804 			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
805 	}
806 }
807 
808 static inline void
809 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
810     u_int ndescs)
811 {
812 	int i;
813 	for (i = 0; i < ndescs; i++) {
814 		if (descs[i].ts_dmamap != NULL)
815 			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
816 	}
817 }
818 
819 static inline void
820 rtw_srom_free(struct rtw_srom *sr)
821 {
822 	sr->sr_size = 0;
823 	if (sr->sr_content == NULL)
824 		return;
825 	free(sr->sr_content, M_DEVBUF);
826 	sr->sr_content = NULL;
827 }
828 
829 static void
830 rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
831     enum rtw_rfchipid *rfchipid, uint32_t *rcr)
832 {
833 	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
834 	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
835 	*rcr |= RTW_RCR_ENCS1;
836 	*rfchipid = RTW_RFCHIPID_PHILIPS;
837 }
838 
839 static int
840 rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
841     enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
842     const char *dvname)
843 {
844 	int i;
845 	const char *rfname, *paname;
846 	char scratch[sizeof("unknown 0xXX")];
847 	uint16_t srom_version;
848 	uint8_t mac[IEEE80211_ADDR_LEN];
849 
850 	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
851 	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
852 
853 	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
854 	printf("%s: SROM version %d.%d", dvname,
855 	    srom_version >> 8, srom_version & 0xff);
856 
857 	if (srom_version <= 0x0101) {
858 		printf(" is not understood, limping along with defaults\n");
859 		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
860 		return 0;
861 	}
862 	printf("\n");
863 
864 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
865 		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
866 
867 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
868 	    ("%s: EEPROM MAC %s\n", dvname, ether_sprintf(mac)));
869 
870 	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
871 
872 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
873 		*flags |= RTW_F_ANTDIV;
874 
875 	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
876 	 * to be reversed.
877 	 */
878 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
879 		*flags |= RTW_F_DIGPHY;
880 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
881 		*flags |= RTW_F_DFLANTB;
882 
883 	*rcr |= LSHIFT(MASK_AND_RSHIFT(RTW_SR_GET(sr, RTW_SR_RFPARM),
884 	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
885 
886 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
887 		*flags |= RTW_C_RXWEP_104;
888 
889 	*flags |= RTW_C_RXWEP_40;	/* XXX */
890 
891 	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
892 	switch (*rfchipid) {
893 	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
894 		rfname = "GCT GRF5101";
895 		paname = "Winspring WS9901";
896 		break;
897 	case RTW_RFCHIPID_MAXIM:
898 		rfname = "Maxim MAX2820";	/* guess */
899 		paname = "Maxim MAX2422";	/* guess */
900 		break;
901 	case RTW_RFCHIPID_INTERSIL:
902 		rfname = "Intersil HFA3873";	/* guess */
903 		paname = "Intersil <unknown>";
904 		break;
905 	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
906 		rfname = "Philips SA2400A";
907 		paname = "Philips SA2411";
908 		break;
909 	case RTW_RFCHIPID_RFMD:
910 		/* this is the same front-end as an atw(4)! */
911 		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
912 			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
913 			 "SYN: Silicon Labs Si4126";	/* inferred from
914 			 				 * reference driver
915 							 */
916 		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
917 		break;
918 	case RTW_RFCHIPID_RESERVED:
919 		rfname = paname = "reserved";
920 		break;
921 	default:
922 		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
923 		rfname = paname = scratch;
924 	}
925 	printf("%s: RF: %s, PA: %s\n", dvname, rfname, paname);
926 
927 	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
928 	case RTW_CONFIG0_GL_USA:
929 	case _RTW_CONFIG0_GL_USA:
930 		*locale = RTW_LOCALE_USA;
931 		break;
932 	case RTW_CONFIG0_GL_EUROPE:
933 		*locale = RTW_LOCALE_EUROPE;
934 		break;
935 	case RTW_CONFIG0_GL_JAPAN:
936 		*locale = RTW_LOCALE_JAPAN;
937 		break;
938 	default:
939 		*locale = RTW_LOCALE_UNKNOWN;
940 		break;
941 	}
942 	return 0;
943 }
944 
945 /* Returns -1 on failure. */
946 static int
947 rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
948     const char *dvname)
949 {
950 	int rc;
951 	struct seeprom_descriptor sd;
952 	uint8_t ecr;
953 
954 	(void)memset(&sd, 0, sizeof(sd));
955 
956 	ecr = RTW_READ8(regs, RTW_9346CR);
957 
958 	if ((flags & RTW_F_9356SROM) != 0) {
959 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n", dvname));
960 		sr->sr_size = 256;
961 		sd.sd_chip = C56_66;
962 	} else {
963 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n", dvname));
964 		sr->sr_size = 128;
965 		sd.sd_chip = C46;
966 	}
967 
968 	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
969 	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
970 	ecr |= RTW_9346CR_EEM_PROGRAM;
971 
972 	RTW_WRITE8(regs, RTW_9346CR, ecr);
973 
974 	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
975 
976 	if (sr->sr_content == NULL) {
977 		printf("%s: unable to allocate SROM buffer\n", dvname);
978 		return ENOMEM;
979 	}
980 
981 	(void)memset(sr->sr_content, 0, sr->sr_size);
982 
983 	/* RTL8180 has a single 8-bit register for controlling the
984 	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
985 	 * input/output sense is the reverse of read_seeprom's.
986 	 */
987 	sd.sd_tag = regs->r_bt;
988 	sd.sd_bsh = regs->r_bh;
989 	sd.sd_regsize = 1;
990 	sd.sd_control_offset = RTW_9346CR;
991 	sd.sd_status_offset = RTW_9346CR;
992 	sd.sd_dataout_offset = RTW_9346CR;
993 	sd.sd_CK = RTW_9346CR_EESK;
994 	sd.sd_CS = RTW_9346CR_EECS;
995 	sd.sd_DI = RTW_9346CR_EEDO;
996 	sd.sd_DO = RTW_9346CR_EEDI;
997 	/* make read_seeprom enter EEPROM read/write mode */
998 	sd.sd_MS = ecr;
999 	sd.sd_RDY = 0;
1000 
1001 	/* TBD bus barriers */
1002 	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
1003 		printf("%s: could not read SROM\n", dvname);
1004 		free(sr->sr_content, M_DEVBUF);
1005 		sr->sr_content = NULL;
1006 		return -1;	/* XXX */
1007 	}
1008 
1009 	/* end EEPROM read/write mode */
1010 	RTW_WRITE8(regs, RTW_9346CR,
1011 	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
1012 	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
1013 
1014 	if ((rc = rtw_recall_eeprom(regs, dvname)) != 0)
1015 		return rc;
1016 
1017 #ifdef RTW_DEBUG
1018 	{
1019 		int i;
1020 		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1021 		    ("\n%s: serial ROM:\n\t", dvname));
1022 		for (i = 0; i < sr->sr_size/2; i++) {
1023 			if (((i % 8) == 0) && (i != 0))
1024 				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1025 			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1026 			    (" %04x", sr->sr_content[i]));
1027 		}
1028 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1029 	}
1030 #endif /* RTW_DEBUG */
1031 	return 0;
1032 }
1033 
1034 static void
1035 rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1036     const char *dvname)
1037 {
1038 	uint8_t cfg4;
1039 	const char *method;
1040 
1041 	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1042 
1043 	switch (rfchipid) {
1044 	default:
1045 		cfg4 |= LSHIFT(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1046 		method = "fallback";
1047 		break;
1048 	case RTW_RFCHIPID_INTERSIL:
1049 		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1050 		method = "Intersil";
1051 		break;
1052 	case RTW_RFCHIPID_PHILIPS:
1053 		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1054 		method = "Philips";
1055 		break;
1056 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1057 	case RTW_RFCHIPID_RFMD:
1058 		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1059 		method = "RFMD";
1060 		break;
1061 	}
1062 
1063 	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1064 
1065 	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1066 
1067 	RTW_DPRINTF(RTW_DEBUG_INIT,
1068 	    ("%s: %s RF programming method, %#02x\n", dvname, method,
1069 	    RTW_READ8(regs, RTW_CONFIG4)));
1070 }
1071 
1072 static inline void
1073 rtw_init_channels(enum rtw_locale locale,
1074     struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1],
1075     const char *dvname)
1076 {
1077 	int i;
1078 	const char *name = NULL;
1079 #define ADD_CHANNEL(_chans, _chan) do {			\
1080 	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1081 	(*_chans)[_chan].ic_freq =				\
1082 	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1083 } while (0)
1084 
1085 	switch (locale) {
1086 	case RTW_LOCALE_USA:	/* 1-11 */
1087 		name = "USA";
1088 		for (i = 1; i <= 11; i++)
1089 			ADD_CHANNEL(chans, i);
1090 		break;
1091 	case RTW_LOCALE_JAPAN:	/* 1-14 */
1092 		name = "Japan";
1093 		ADD_CHANNEL(chans, 14);
1094 		for (i = 1; i <= 14; i++)
1095 			ADD_CHANNEL(chans, i);
1096 		break;
1097 	case RTW_LOCALE_EUROPE:	/* 1-13 */
1098 		name = "Europe";
1099 		for (i = 1; i <= 13; i++)
1100 			ADD_CHANNEL(chans, i);
1101 		break;
1102 	default:			/* 10-11 allowed by most countries */
1103 		name = "<unknown>";
1104 		for (i = 10; i <= 11; i++)
1105 			ADD_CHANNEL(chans, i);
1106 		break;
1107 	}
1108 	printf("%s: Geographic Location %s\n", dvname, name);
1109 #undef ADD_CHANNEL
1110 }
1111 
1112 
1113 static inline void
1114 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1115 {
1116 	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1117 
1118 	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1119 	case RTW_CONFIG0_GL_USA:
1120 	case _RTW_CONFIG0_GL_USA:
1121 		*locale = RTW_LOCALE_USA;
1122 		break;
1123 	case RTW_CONFIG0_GL_JAPAN:
1124 		*locale = RTW_LOCALE_JAPAN;
1125 		break;
1126 	case RTW_CONFIG0_GL_EUROPE:
1127 		*locale = RTW_LOCALE_EUROPE;
1128 		break;
1129 	default:
1130 		*locale = RTW_LOCALE_UNKNOWN;
1131 		break;
1132 	}
1133 }
1134 
1135 static inline int
1136 rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1137     const char *dvname)
1138 {
1139 	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1140 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1141 	};
1142 	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1143 	          idr1 = RTW_READ(regs, RTW_IDR1);
1144 
1145 	(*addr)[0] = MASK_AND_RSHIFT(idr0, BITS(0,  7));
1146 	(*addr)[1] = MASK_AND_RSHIFT(idr0, BITS(8,  15));
1147 	(*addr)[2] = MASK_AND_RSHIFT(idr0, BITS(16, 23));
1148 	(*addr)[3] = MASK_AND_RSHIFT(idr0, BITS(24 ,31));
1149 
1150 	(*addr)[4] = MASK_AND_RSHIFT(idr1, BITS(0,  7));
1151 	(*addr)[5] = MASK_AND_RSHIFT(idr1, BITS(8, 15));
1152 
1153 	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1154 		printf("%s: could not get mac address, attach failed\n",
1155 		    dvname);
1156 		return ENXIO;
1157 	}
1158 
1159 	printf("%s: 802.11 address %s\n", dvname, ether_sprintf(*addr));
1160 
1161 	return 0;
1162 }
1163 
1164 static uint8_t
1165 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1166     struct ieee80211_channel *chan)
1167 {
1168 	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1169 	KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
1170 	    ("%s: channel %d out of range", __func__,
1171 	     idx - RTW_SR_TXPOWER1 + 1));
1172 	return RTW_SR_GET(sr, idx);
1173 }
1174 
1175 static void
1176 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1177 {
1178 	int pri;
1179 	/* nfree: the number of free descriptors in each ring.
1180 	 * The beacon ring is a special case: I do not let the
1181 	 * driver use all of the descriptors on the beacon ring.
1182 	 * The reasons are two-fold:
1183 	 *
1184 	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1185 	 * updated, so the driver cannot easily know if the descriptor
1186 	 * belongs to it, or if it is racing the NIC.  If the NIC
1187 	 * does not OWN every descriptor, then the driver can safely
1188 	 * update the descriptors when RTW_TBDA points at tdb_next.
1189 	 *
1190 	 * (2) I hope that the NIC will process more than one BEACON
1191 	 * descriptor in a single beacon interval, since that will
1192 	 * enable multiple-BSS support.  Since the NIC does not
1193 	 * clear the OWN bit, there is no natural place for it to
1194 	 * stop processing BEACON desciptors.  Maybe it will *not*
1195 	 * stop processing them!  I do not want to chance the NIC
1196 	 * looping around and around a saturated beacon ring, so
1197 	 * I will leave one descriptor unOWNed at all times.
1198 	 */
1199 	u_int nfree[RTW_NTXPRI] =
1200 	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1201 	     RTW_NTXDESCBCN - 1};
1202 
1203 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1204 		tdb[pri].tdb_nfree = nfree[pri];
1205 		tdb[pri].tdb_next = 0;
1206 	}
1207 }
1208 
1209 static int
1210 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1211 {
1212 	int i;
1213 	struct rtw_txsoft *ts;
1214 
1215 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1216 	SIMPLEQ_INIT(&tsb->tsb_freeq);
1217 	for (i = 0; i < tsb->tsb_ndesc; i++) {
1218 		ts = &tsb->tsb_desc[i];
1219 		ts->ts_mbuf = NULL;
1220 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1221 	}
1222 	tsb->tsb_tx_timer = 0;
1223 	return 0;
1224 }
1225 
1226 static void
1227 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1228 {
1229 	int pri;
1230 	for (pri = 0; pri < RTW_NTXPRI; pri++)
1231 		rtw_txsoft_blk_init(&tsb[pri]);
1232 }
1233 
1234 static inline void
1235 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1236 {
1237 	KASSERT(nsync <= rdb->rdb_ndesc);
1238 	/* sync to end of ring */
1239 	if (desc0 + nsync > rdb->rdb_ndesc) {
1240 		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1241 		    offsetof(struct rtw_descs, hd_rx[desc0]),
1242 		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1243 		nsync -= (rdb->rdb_ndesc - desc0);
1244 		desc0 = 0;
1245 	}
1246 
1247 	KASSERT(desc0 < rdb->rdb_ndesc);
1248 	KASSERT(nsync <= rdb->rdb_ndesc);
1249 	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1250 
1251 	/* sync what remains */
1252 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1253 	    offsetof(struct rtw_descs, hd_rx[desc0]),
1254 	    sizeof(struct rtw_rxdesc) * nsync, ops);
1255 }
1256 
1257 static void
1258 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1259 {
1260 	/* sync to end of ring */
1261 	if (desc0 + nsync > tdb->tdb_ndesc) {
1262 		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1263 		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1264 		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1265 		    ops);
1266 		nsync -= (tdb->tdb_ndesc - desc0);
1267 		desc0 = 0;
1268 	}
1269 
1270 	/* sync what remains */
1271 	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1272 	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1273 	    sizeof(struct rtw_txdesc) * nsync, ops);
1274 }
1275 
1276 static void
1277 rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1278 {
1279 	int pri;
1280 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1281 		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1282 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1283 	}
1284 }
1285 
1286 static void
1287 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1288 {
1289 	int i;
1290 	struct rtw_rxsoft *rs;
1291 
1292 	for (i = 0; i < RTW_RXQLEN; i++) {
1293 		rs = &desc[i];
1294 		if (rs->rs_mbuf == NULL)
1295 			continue;
1296 		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1297 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1298 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1299 		m_freem(rs->rs_mbuf);
1300 		rs->rs_mbuf = NULL;
1301 	}
1302 }
1303 
1304 static inline int
1305 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1306 {
1307 	int rc;
1308 	struct mbuf *m;
1309 
1310 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1311 	if (m == NULL)
1312 		return ENOBUFS;
1313 
1314 	MCLGET(m, M_DONTWAIT);
1315 	if ((m->m_flags & M_EXT) == 0) {
1316 		m_freem(m);
1317 		return ENOBUFS;
1318 	}
1319 
1320 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1321 
1322 	if (rs->rs_mbuf != NULL)
1323 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1324 
1325 	rs->rs_mbuf = NULL;
1326 
1327 	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1328 	if (rc != 0) {
1329 		m_freem(m);
1330 		return -1;
1331 	}
1332 
1333 	rs->rs_mbuf = m;
1334 
1335 	return 0;
1336 }
1337 
1338 static int
1339 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1340     int *ndesc, const char *dvname)
1341 {
1342 	int i, rc = 0;
1343 	struct rtw_rxsoft *rs;
1344 
1345 	for (i = 0; i < RTW_RXQLEN; i++) {
1346 		rs = &desc[i];
1347 		/* we're in rtw_init, so there should be no mbufs allocated */
1348 		KASSERT(rs->rs_mbuf == NULL);
1349 #ifdef RTW_DEBUG
1350 		if (i == rtw_rxbufs_limit) {
1351 			printf("%s: TEST hit %d-buffer limit\n", dvname, i);
1352 			rc = ENOBUFS;
1353 			break;
1354 		}
1355 #endif /* RTW_DEBUG */
1356 		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1357 			printf("%s: rtw_rxsoft_alloc failed, %d buffers, "
1358 			       "rc %d\n", dvname, i, rc);
1359 			break;
1360 		}
1361 	}
1362 	*ndesc = i;
1363 	return rc;
1364 }
1365 
1366 static inline void
1367 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1368     int idx, int kick)
1369 {
1370 	int is_last = (idx == rdb->rdb_ndesc - 1);
1371 	uint32_t ctl, octl, obuf;
1372 	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1373 
1374 	obuf = rd->rd_buf;
1375 	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1376 
1377 	ctl = LSHIFT(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1378 	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1379 
1380 	if (is_last)
1381 		ctl |= RTW_RXCTL_EOR;
1382 
1383 	octl = rd->rd_ctl;
1384 	rd->rd_ctl = htole32(ctl);
1385 
1386 	RTW_DPRINTF(
1387 	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1388 	         : RTW_DEBUG_RECV_DESC,
1389 	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1390 	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1391 	     le32toh(rd->rd_ctl)));
1392 
1393 	/* sync the mbuf */
1394 	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1395 	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1396 
1397 	/* sync the descriptor */
1398 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1399 	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1400 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1401 }
1402 
1403 static void
1404 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1405 {
1406 	int i;
1407 	struct rtw_rxdesc *rd;
1408 	struct rtw_rxsoft *rs;
1409 
1410 	for (i = 0; i < rdb->rdb_ndesc; i++) {
1411 		rd = &rdb->rdb_desc[i];
1412 		rs = &ctl[i];
1413 		rtw_rxdesc_init(rdb, rs, i, kick);
1414 	}
1415 }
1416 
1417 static void
1418 rtw_io_enable(struct rtw_regs *regs, uint8_t flags, int enable)
1419 {
1420 	uint8_t cr;
1421 
1422 	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1423 	    enable ? "enable" : "disable", flags));
1424 
1425 	cr = RTW_READ8(regs, RTW_CR);
1426 
1427 	/* XXX reference source does not enable MULRW */
1428 #if 0
1429 	/* enable PCI Read/Write Multiple */
1430 	cr |= RTW_CR_MULRW;
1431 #endif
1432 
1433 	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1434 	if (enable)
1435 		cr |= flags;
1436 	else
1437 		cr &= ~flags;
1438 	RTW_WRITE8(regs, RTW_CR, cr);
1439 	RTW_SYNC(regs, RTW_CR, RTW_CR);
1440 }
1441 
1442 static void
1443 rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1444 {
1445 #define	IS_BEACON(__fc0)						\
1446     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1447      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1448 
1449 	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1450 							 * hardware -> net80211
1451 							 */
1452 	u_int next, nproc = 0;
1453 	int hwrate, len, rate, rssi, sq;
1454 	uint32_t hrssi, hstat, htsfth, htsftl;
1455 	struct rtw_rxdesc *rd;
1456 	struct rtw_rxsoft *rs;
1457 	struct rtw_rxdesc_blk *rdb;
1458 	struct mbuf *m;
1459 	struct ifnet *ifp = &sc->sc_if;
1460 
1461 	struct ieee80211_node *ni;
1462 	struct ieee80211_frame_min *wh;
1463 
1464 	rdb = &sc->sc_rxdesc_blk;
1465 
1466 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1467 
1468 	for (next = rdb->rdb_next; ; next = (next + 1) % rdb->rdb_ndesc) {
1469 		rtw_rxdescs_sync(rdb, next, 1,
1470 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1471 		rd = &rdb->rdb_desc[next];
1472 		rs = &sc->sc_rxsoft[next];
1473 
1474 		hstat = le32toh(rd->rd_stat);
1475 		hrssi = le32toh(rd->rd_rssi);
1476 		htsfth = le32toh(rd->rd_tsfth);
1477 		htsftl = le32toh(rd->rd_tsftl);
1478 
1479 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1480 		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1481 		    __func__, next, hstat, hrssi, htsfth, htsftl));
1482 
1483 		++nproc;
1484 
1485 		/* still belongs to NIC */
1486 		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1487 			if (nproc > 1)
1488 				break;
1489 
1490 			/* sometimes the NIC skips to the 0th descriptor */
1491 			rtw_rxdescs_sync(rdb, 0, 1,
1492 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1493 			rd = &rdb->rdb_desc[0];
1494 			if ((rd->rd_stat & htole32(RTW_RXSTAT_OWN)) != 0)
1495 				break;
1496 			RTW_DPRINTF(RTW_DEBUG_BUGS,
1497 			    ("%s: NIC skipped from rxdesc[%u] to rxdesc[0]\n",
1498 			     sc->sc_dev.dv_xname, next));
1499 			next = rdb->rdb_ndesc - 1;
1500 			continue;
1501 		}
1502 
1503 #ifdef RTW_DEBUG
1504 #define PRINTSTAT(flag) do { \
1505 	if ((hstat & flag) != 0) { \
1506 		printf("%s" #flag, delim); \
1507 		delim = ","; \
1508 	} \
1509 } while (0)
1510 		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1511 			const char *delim = "<";
1512 			printf("%s: ", sc->sc_dev.dv_xname);
1513 			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1514 				printf("status %08x", hstat);
1515 				PRINTSTAT(RTW_RXSTAT_SPLCP);
1516 				PRINTSTAT(RTW_RXSTAT_MAR);
1517 				PRINTSTAT(RTW_RXSTAT_PAR);
1518 				PRINTSTAT(RTW_RXSTAT_BAR);
1519 				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1520 				PRINTSTAT(RTW_RXSTAT_CRC32);
1521 				PRINTSTAT(RTW_RXSTAT_ICV);
1522 				printf(">, ");
1523 			}
1524 		}
1525 #endif /* RTW_DEBUG */
1526 
1527 		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1528 			printf("%s: DMA error/FIFO overflow %08x, "
1529 			    "rx descriptor %d\n", sc->sc_dev.dv_xname,
1530 			    hstat & RTW_RXSTAT_IOERROR, next);
1531 			ifp->if_ierrors++;
1532 			goto next;
1533 		}
1534 
1535 		len = MASK_AND_RSHIFT(hstat, RTW_RXSTAT_LENGTH_MASK);
1536 		if (len < IEEE80211_MIN_LEN) {
1537 			sc->sc_ic.ic_stats.is_rx_tooshort++;
1538 			goto next;
1539 		}
1540 
1541 		/* CRC is included with the packet; trim it off. */
1542 		len -= IEEE80211_CRC_LEN;
1543 
1544 		hwrate = MASK_AND_RSHIFT(hstat, RTW_RXSTAT_RATE_MASK);
1545 		if (hwrate >= sizeof(ratetbl) / sizeof(ratetbl[0])) {
1546 			printf("%s: unknown rate #%d\n", sc->sc_dev.dv_xname,
1547 			    MASK_AND_RSHIFT(hstat, RTW_RXSTAT_RATE_MASK));
1548 			ifp->if_ierrors++;
1549 			goto next;
1550 		}
1551 		rate = ratetbl[hwrate];
1552 
1553 #ifdef RTW_DEBUG
1554 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1555 		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1556 		     (rate * 5) % 10, htsfth, htsftl));
1557 #endif /* RTW_DEBUG */
1558 
1559 		if ((hstat & RTW_RXSTAT_RES) != 0 &&
1560 		    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
1561 			goto next;
1562 
1563 		/* if bad flags, skip descriptor */
1564 		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1565 			printf("%s: too many rx segments\n",
1566 			    sc->sc_dev.dv_xname);
1567 			goto next;
1568 		}
1569 
1570 		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1571 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1572 
1573 		m = rs->rs_mbuf;
1574 
1575 		/* if temporarily out of memory, re-use mbuf */
1576 		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1577 		case 0:
1578 			break;
1579 		case ENOBUFS:
1580 			printf("%s: rtw_rxsoft_alloc(, %d) failed, "
1581 			    "dropping packet\n", sc->sc_dev.dv_xname, next);
1582 			goto next;
1583 		default:
1584 			/* XXX shorten rx ring, instead? */
1585 			panic("%s: could not load DMA map\n",
1586 			    sc->sc_dev.dv_xname);
1587 		}
1588 
1589 		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1590 			rssi = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_RSSI);
1591 		else {
1592 			rssi = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_IMR_RSSI);
1593 			/* TBD find out each front-end's LNA gain in the
1594 			 * front-end's units
1595 			 */
1596 			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1597 				rssi |= 0x80;
1598 		}
1599 		sq = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_SQ);
1600 
1601 		/* Note well: now we cannot recycle the rs_mbuf unless
1602 		 * we restore its original length.
1603 		 */
1604 		m->m_pkthdr.rcvif = ifp;
1605 		m->m_pkthdr.len = m->m_len = len;
1606 
1607 		wh = mtod(m, struct ieee80211_frame_min *);
1608 
1609 		if (!IS_BEACON(wh->i_fc[0]))
1610 			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1611 		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1612 		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1613 
1614 		sc->sc_tsfth = htsfth;
1615 
1616 #ifdef RTW_DEBUG
1617 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1618 		    (IFF_DEBUG|IFF_LINK2)) {
1619 			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1620 			    rate, rssi);
1621 		}
1622 #endif /* RTW_DEBUG */
1623 
1624 #if NBPFILTER > 0
1625 		if (sc->sc_radiobpf != NULL) {
1626 			struct ieee80211com *ic = &sc->sc_ic;
1627 			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1628 
1629 			rr->rr_tsft =
1630 			    htole64(((uint64_t)htsfth << 32) | htsftl);
1631 
1632 			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1633 				rr->rr_flags = IEEE80211_RADIOTAP_F_SHORTPRE;
1634 
1635 			rr->rr_flags = 0;
1636 			rr->rr_rate = rate;
1637 			rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1638 			rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1639 			rr->rr_antsignal = rssi;
1640 			rr->rr_barker_lock = htole16(sq);
1641 
1642 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)rr,
1643 			    sizeof(sc->sc_rxtapu), m);
1644 		}
1645 #endif /* NPBFILTER > 0 */
1646 
1647 		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1648 		ieee80211_free_node(ni);
1649 next:
1650 		rtw_rxdesc_init(rdb, rs, next, 0);
1651 	}
1652 	rdb->rdb_next = next;
1653 
1654 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1655 
1656 	return;
1657 #undef IS_BEACON
1658 }
1659 
1660 static void
1661 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1662     struct rtw_txsoft *ts)
1663 {
1664 	struct mbuf *m;
1665 	struct ieee80211_node *ni;
1666 
1667 	m = ts->ts_mbuf;
1668 	ni = ts->ts_ni;
1669 	KASSERT(m != NULL);
1670 	KASSERT(ni != NULL);
1671 	ts->ts_mbuf = NULL;
1672 	ts->ts_ni = NULL;
1673 
1674 	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1675 	    BUS_DMASYNC_POSTWRITE);
1676 	bus_dmamap_unload(dmat, ts->ts_dmamap);
1677 	m_freem(m);
1678 	ieee80211_free_node(ni);
1679 }
1680 
1681 static void
1682 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1683     struct rtw_txsoft_blk *tsb)
1684 {
1685 	struct rtw_txsoft *ts;
1686 
1687 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1688 		rtw_txsoft_release(dmat, ic, ts);
1689 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1690 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1691 	}
1692 	tsb->tsb_tx_timer = 0;
1693 }
1694 
1695 static inline void
1696 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1697     struct rtw_txsoft *ts, int ndesc)
1698 {
1699 	uint32_t hstat;
1700 	int data_retry, rts_retry;
1701 	struct rtw_txdesc *tdn;
1702 	const char *condstring;
1703 	struct ifnet *ifp = &sc->sc_if;
1704 
1705 	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1706 
1707 	tdb->tdb_nfree += ndesc;
1708 
1709 	tdn = &tdb->tdb_desc[ts->ts_last];
1710 
1711 	hstat = le32toh(tdn->td_stat);
1712 	rts_retry = MASK_AND_RSHIFT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1713 	data_retry = MASK_AND_RSHIFT(hstat, RTW_TXSTAT_DRC_MASK);
1714 
1715 	ifp->if_collisions += rts_retry + data_retry;
1716 
1717 	if ((hstat & RTW_TXSTAT_TOK) != 0)
1718 		condstring = "ok";
1719 	else {
1720 		ifp->if_oerrors++;
1721 		condstring = "error";
1722 	}
1723 
1724 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1725 	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1726 	    sc->sc_dev.dv_xname, ts, ts->ts_first, ts->ts_last,
1727 	    condstring, rts_retry, data_retry));
1728 }
1729 
1730 static void
1731 rtw_reset_oactive(struct rtw_softc *sc)
1732 {
1733 	short oflags;
1734 	int pri;
1735 	struct rtw_txsoft_blk *tsb;
1736 	struct rtw_txdesc_blk *tdb;
1737 	oflags = sc->sc_if.if_flags;
1738 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1739 		tsb = &sc->sc_txsoft_blk[pri];
1740 		tdb = &sc->sc_txdesc_blk[pri];
1741 		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1742 			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1743 	}
1744 	if (oflags != sc->sc_if.if_flags) {
1745 		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1746 		    ("%s: reset OACTIVE\n", __func__));
1747 	}
1748 }
1749 
1750 /* Collect transmitted packets. */
1751 static inline void
1752 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1753     struct rtw_txdesc_blk *tdb, int force)
1754 {
1755 	int ndesc;
1756 	struct rtw_txsoft *ts;
1757 
1758 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1759 		ndesc = 1 + ts->ts_last - ts->ts_first;
1760 		if (ts->ts_last < ts->ts_first)
1761 			ndesc += tdb->tdb_ndesc;
1762 
1763 		KASSERT(ndesc > 0);
1764 
1765 		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1766 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1767 
1768 		if (force) {
1769 			int i;
1770 			for (i = ts->ts_first; ; i = RTW_NEXT_IDX(tdb, i)) {
1771 				tdb->tdb_desc[i].td_stat &=
1772 				    ~htole32(RTW_TXSTAT_OWN);
1773 				if (i == ts->ts_last)
1774 					break;
1775 			}
1776 			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1777 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1778 		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1779 		    htole32(RTW_TXSTAT_OWN)) != 0)
1780 			break;
1781 
1782 		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1783 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1784 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1785 	}
1786 	/* no more pending transmissions, cancel watchdog */
1787 	if (ts == NULL)
1788 		tsb->tsb_tx_timer = 0;
1789 	rtw_reset_oactive(sc);
1790 }
1791 
1792 static void
1793 rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1794 {
1795 	int pri;
1796 	struct rtw_txsoft_blk	*tsb;
1797 	struct rtw_txdesc_blk	*tdb;
1798 	struct ifnet *ifp = &sc->sc_if;
1799 
1800 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1801 		tsb = &sc->sc_txsoft_blk[pri];
1802 		tdb = &sc->sc_txdesc_blk[pri];
1803 
1804 		rtw_collect_txring(sc, tsb, tdb, 0);
1805 	}
1806 
1807 	if ((isr & RTW_INTR_TX) != 0)
1808 		rtw_start(ifp);
1809 
1810 	return;
1811 }
1812 
1813 static void
1814 rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1815 {
1816 	u_int next;
1817 	uint32_t tsfth, tsftl;
1818 	struct ieee80211com *ic;
1819 	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1820 	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1821 	struct mbuf *m;
1822 
1823 	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1824 	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1825 
1826 	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1827 		next = rtw_txring_next(&sc->sc_regs, tdb);
1828 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1829 		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1830 		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1831 		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1832 		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1833 		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0){
1834 			rtw_collect_txring(sc, tsb, tdb, 1);
1835 			tdb->tdb_next = 0;
1836 		}
1837 	}
1838 	/* Start beacon transmission. */
1839 
1840 	if ((isr & RTW_INTR_BCNINT) != 0 &&
1841 	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1842 	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1843 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1844 		    ("%s: beacon prep. time, isr = %#04" PRIx16
1845 		     ", %16" PRIu64 "\n", __func__, isr,
1846 		     (uint64_t)tsfth << 32 | tsftl));
1847 		ic = &sc->sc_ic;
1848 		m = rtw_beacon_alloc(sc, ic->ic_bss);
1849 
1850 		if (m == NULL) {
1851 			printf("%s: could not allocate beacon\n",
1852 			    sc->sc_dev.dv_xname);
1853 			return;
1854 		}
1855 		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1856 		IF_ENQUEUE(&sc->sc_beaconq, m);
1857 		rtw_start(&sc->sc_if);
1858 	}
1859 }
1860 
1861 static void
1862 rtw_intr_atim(struct rtw_softc *sc)
1863 {
1864 	/* TBD */
1865 	return;
1866 }
1867 
1868 #ifdef RTW_DEBUG
1869 static void
1870 rtw_dump_rings(struct rtw_softc *sc)
1871 {
1872 	struct rtw_txdesc_blk *tdb;
1873 	struct rtw_rxdesc *rd;
1874 	struct rtw_rxdesc_blk *rdb;
1875 	int desc, pri;
1876 
1877 	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1878 		return;
1879 
1880 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1881 		tdb = &sc->sc_txdesc_blk[pri];
1882 		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1883 		    tdb->tdb_ndesc, tdb->tdb_nfree);
1884 		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1885 			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1886 	}
1887 
1888 	rdb = &sc->sc_rxdesc_blk;
1889 
1890 	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1891 		rd = &rdb->rdb_desc[desc];
1892 		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1893 		    "rsvd1/tsfth %08x\n", __func__,
1894 		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1895 		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1896 		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1897 	}
1898 }
1899 #endif /* RTW_DEBUG */
1900 
1901 static void
1902 rtw_hwring_setup(struct rtw_softc *sc)
1903 {
1904 	int pri;
1905 	struct rtw_regs *regs = &sc->sc_regs;
1906 	struct rtw_txdesc_blk *tdb;
1907 
1908 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1909 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1910 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1911 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1912 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1913 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1914 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1915 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1916 
1917 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1918 		tdb = &sc->sc_txdesc_blk[pri];
1919 		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1920 		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1921 		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1922 		     (uintptr_t)tdb->tdb_base));
1923 	}
1924 
1925 	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1926 
1927 	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1928 	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1929 	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1930 
1931 	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1932 
1933 }
1934 
1935 static int
1936 rtw_swring_setup(struct rtw_softc *sc)
1937 {
1938 	int rc;
1939 	struct rtw_rxdesc_blk *rdb;
1940 
1941 	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1942 
1943 	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1944 
1945 	rdb = &sc->sc_rxdesc_blk;
1946 	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
1947 	     sc->sc_dev.dv_xname)) != 0 && rdb->rdb_ndesc == 0) {
1948 		printf("%s: could not allocate rx buffers\n",
1949 		    sc->sc_dev.dv_xname);
1950 		return rc;
1951 	}
1952 
1953 	rdb = &sc->sc_rxdesc_blk;
1954 	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
1955 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1956 	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
1957 	rdb->rdb_next = 0;
1958 
1959 	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
1960 	return 0;
1961 }
1962 
1963 static void
1964 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
1965 {
1966 	int i;
1967 
1968 	(void)memset(tdb->tdb_desc, 0,
1969 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
1970 	for (i = 0; i < tdb->tdb_ndesc; i++)
1971 		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
1972 }
1973 
1974 static u_int
1975 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
1976 {
1977 	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
1978 	    sizeof(struct rtw_txdesc);
1979 }
1980 
1981 static void
1982 rtw_txring_fixup(struct rtw_softc *sc)
1983 {
1984 	int pri;
1985 	u_int next;
1986 	struct rtw_txdesc_blk *tdb;
1987 	struct rtw_regs *regs = &sc->sc_regs;
1988 
1989 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1990 		tdb = &sc->sc_txdesc_blk[pri];
1991 		next = rtw_txring_next(regs, tdb);
1992 		if (tdb->tdb_next == next)
1993 			continue;
1994 		printf("%s: tx-ring %d expected next %u, read %u\n", __func__,
1995 		    pri, tdb->tdb_next, next);
1996 		tdb->tdb_next = next;
1997 	}
1998 }
1999 
2000 static void
2001 rtw_rxring_fixup(struct rtw_softc *sc)
2002 {
2003 	u_int next;
2004 	uint32_t rdsar;
2005 	struct rtw_rxdesc_blk *rdb;
2006 
2007 	rdsar = le32toh(RTW_READ(&sc->sc_regs, RTW_RDSAR));
2008 	next = (rdsar - RTW_RING_BASE(sc, hd_rx)) / sizeof(struct rtw_rxdesc);
2009 
2010 	rdb = &sc->sc_rxdesc_blk;
2011 	if (rdb->rdb_next != next) {
2012 		printf("%s: rx-ring expected next %u, read %u\n", __func__,
2013 		    rdb->rdb_next, next);
2014 		rdb->rdb_next = next;
2015 	}
2016 }
2017 
2018 static void
2019 rtw_txdescs_reset(struct rtw_softc *sc)
2020 {
2021 	int pri;
2022 
2023 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2024 		rtw_collect_txring(sc, &sc->sc_txsoft_blk[pri],
2025 		    &sc->sc_txdesc_blk[pri], 1);
2026 	}
2027 }
2028 
2029 static void
2030 rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2031 {
2032 	uint8_t cr = 0;
2033 	int xmtr = 0, rcvr = 0;
2034 	struct rtw_regs *regs = &sc->sc_regs;
2035 
2036 	if ((isr & RTW_INTR_TXFOVW) != 0) {
2037 		printf("%s: tx fifo underflow\n", sc->sc_dev.dv_xname);
2038 		rcvr = xmtr = 1;
2039 		cr |= RTW_CR_TE | RTW_CR_RE;
2040 	}
2041 
2042 	if ((isr & (RTW_INTR_RDU|RTW_INTR_RXFOVW)) != 0) {
2043 		cr |= RTW_CR_RE;
2044 		rcvr = 1;
2045 	}
2046 
2047 	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: restarting xmit/recv, isr %" PRIx16
2048 	    "\n", sc->sc_dev.dv_xname, isr));
2049 
2050 #ifdef RTW_DEBUG
2051 	rtw_dump_rings(sc);
2052 #endif /* RTW_DEBUG */
2053 
2054 	rtw_io_enable(regs, cr, 0);
2055 
2056 	/* Collect rx'd packets.  Refresh rx buffers. */
2057 	if (rcvr)
2058 		rtw_intr_rx(sc, 0);
2059 	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2060 	 * timeouts.
2061 	 */
2062 	if (xmtr)
2063 		rtw_txdescs_reset(sc);
2064 
2065 	RTW_WRITE16(regs, RTW_IMR, 0);
2066 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
2067 
2068 	if (rtw_do_chip_reset) {
2069 		rtw_chip_reset1(regs, sc->sc_dev.dv_xname);
2070 		rtw_wep_setkeys(sc, sc->sc_ic.ic_nw_keys,
2071 		    sc->sc_ic.ic_def_txkey);
2072 	}
2073 
2074 	rtw_rxdesc_init_all(&sc->sc_rxdesc_blk, &sc->sc_rxsoft[0], 1);
2075 
2076 #ifdef RTW_DEBUG
2077 	rtw_dump_rings(sc);
2078 #endif /* RTW_DEBUG */
2079 
2080 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2081 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
2082 	if (rcvr)
2083 		rtw_rxring_fixup(sc);
2084 	rtw_io_enable(regs, cr, 1);
2085 	if (xmtr)
2086 		rtw_txring_fixup(sc);
2087 }
2088 
2089 static inline void
2090 rtw_suspend_ticks(struct rtw_softc *sc)
2091 {
2092 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2093 	    ("%s: suspending ticks\n", sc->sc_dev.dv_xname));
2094 	sc->sc_do_tick = 0;
2095 }
2096 
2097 static inline void
2098 rtw_resume_ticks(struct rtw_softc *sc)
2099 {
2100 	uint32_t tsftrl0, tsftrl1, next_tick;
2101 
2102 	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2103 
2104 	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2105 	next_tick = tsftrl1 + 1000000;
2106 	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
2107 
2108 	sc->sc_do_tick = 1;
2109 
2110 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2111 	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2112 	    sc->sc_dev.dv_xname, tsftrl1 - tsftrl0, tsftrl1, next_tick));
2113 }
2114 
2115 static void
2116 rtw_intr_timeout(struct rtw_softc *sc)
2117 {
2118 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", sc->sc_dev.dv_xname));
2119 	if (sc->sc_do_tick)
2120 		rtw_resume_ticks(sc);
2121 	return;
2122 }
2123 
2124 int
2125 rtw_intr(void *arg)
2126 {
2127 	int i;
2128 	struct rtw_softc *sc = arg;
2129 	struct rtw_regs *regs = &sc->sc_regs;
2130 	uint16_t isr;
2131 	struct ifnet *ifp = &sc->sc_if;
2132 
2133 	/*
2134 	 * If the interface isn't running, the interrupt couldn't
2135 	 * possibly have come from us.
2136 	 */
2137 	if ((sc->sc_flags & RTW_F_ENABLED) == 0 ||
2138 	    (ifp->if_flags & IFF_RUNNING) == 0 ||
2139 	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0) {
2140 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n", sc->sc_dev.dv_xname));
2141 		return (0);
2142 	}
2143 
2144 	for (i = 0; i < 10; i++) {
2145 		isr = RTW_READ16(regs, RTW_ISR);
2146 
2147 		RTW_WRITE16(regs, RTW_ISR, isr);
2148 		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2149 
2150 		if (sc->sc_intr_ack != NULL)
2151 			(*sc->sc_intr_ack)(regs);
2152 
2153 		if (isr == 0)
2154 			break;
2155 
2156 #ifdef RTW_DEBUG
2157 #define PRINTINTR(flag) do { \
2158 	if ((isr & flag) != 0) { \
2159 		printf("%s" #flag, delim); \
2160 		delim = ","; \
2161 	} \
2162 } while (0)
2163 
2164 		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2165 			const char *delim = "<";
2166 
2167 			printf("%s: reg[ISR] = %x", sc->sc_dev.dv_xname, isr);
2168 
2169 			PRINTINTR(RTW_INTR_TXFOVW);
2170 			PRINTINTR(RTW_INTR_TIMEOUT);
2171 			PRINTINTR(RTW_INTR_BCNINT);
2172 			PRINTINTR(RTW_INTR_ATIMINT);
2173 			PRINTINTR(RTW_INTR_TBDER);
2174 			PRINTINTR(RTW_INTR_TBDOK);
2175 			PRINTINTR(RTW_INTR_THPDER);
2176 			PRINTINTR(RTW_INTR_THPDOK);
2177 			PRINTINTR(RTW_INTR_TNPDER);
2178 			PRINTINTR(RTW_INTR_TNPDOK);
2179 			PRINTINTR(RTW_INTR_RXFOVW);
2180 			PRINTINTR(RTW_INTR_RDU);
2181 			PRINTINTR(RTW_INTR_TLPDER);
2182 			PRINTINTR(RTW_INTR_TLPDOK);
2183 			PRINTINTR(RTW_INTR_RER);
2184 			PRINTINTR(RTW_INTR_ROK);
2185 
2186 			printf(">\n");
2187 		}
2188 #undef PRINTINTR
2189 #endif /* RTW_DEBUG */
2190 
2191 		if ((isr & RTW_INTR_RX) != 0)
2192 			rtw_intr_rx(sc, isr & RTW_INTR_RX);
2193 		if ((isr & RTW_INTR_TX) != 0)
2194 			rtw_intr_tx(sc, isr & RTW_INTR_TX);
2195 		if ((isr & RTW_INTR_BEACON) != 0)
2196 			rtw_intr_beacon(sc, isr & RTW_INTR_BEACON);
2197 		if ((isr & RTW_INTR_ATIMINT) != 0)
2198 			rtw_intr_atim(sc);
2199 		if ((isr & RTW_INTR_IOERROR) != 0)
2200 			rtw_intr_ioerror(sc, isr & RTW_INTR_IOERROR);
2201 		if ((isr & RTW_INTR_TIMEOUT) != 0)
2202 			rtw_intr_timeout(sc);
2203 	}
2204 
2205 	return 1;
2206 }
2207 
2208 /* Must be called at splnet. */
2209 static void
2210 rtw_stop(struct ifnet *ifp, int disable)
2211 {
2212 	int pri;
2213 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2214 	struct ieee80211com *ic = &sc->sc_ic;
2215 	struct rtw_regs *regs = &sc->sc_regs;
2216 
2217 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2218 		return;
2219 
2220 	rtw_suspend_ticks(sc);
2221 
2222 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2223 
2224 	if ((sc->sc_flags & RTW_F_INVALID) == 0) {
2225 		/* Disable interrupts. */
2226 		RTW_WRITE16(regs, RTW_IMR, 0);
2227 
2228 		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2229 
2230 		/* Stop the transmit and receive processes. First stop DMA,
2231 		 * then disable receiver and transmitter.
2232 		 */
2233 		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2234 
2235 		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2236 
2237 		rtw_io_enable(&sc->sc_regs, RTW_CR_RE|RTW_CR_TE, 0);
2238 	}
2239 
2240 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2241 		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2242 		    &sc->sc_txsoft_blk[pri]);
2243 	}
2244 
2245 	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2246 
2247 	if (disable)
2248 		rtw_disable(sc);
2249 
2250 	/* Mark the interface as not running.  Cancel the watchdog timer. */
2251 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2252 	ifp->if_timer = 0;
2253 
2254 	return;
2255 }
2256 
2257 const char *
2258 rtw_pwrstate_string(enum rtw_pwrstate power)
2259 {
2260 	switch (power) {
2261 	case RTW_ON:
2262 		return "on";
2263 	case RTW_SLEEP:
2264 		return "sleep";
2265 	case RTW_OFF:
2266 		return "off";
2267 	default:
2268 		return "unknown";
2269 	}
2270 }
2271 
2272 /* XXX For Maxim, I am using the RFMD settings gleaned from the
2273  * reference driver, plus a magic Maxim "ON" value that comes from
2274  * the Realtek document "Windows PG for Rtl8180."
2275  */
2276 static void
2277 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2278     int before_rf, int digphy)
2279 {
2280 	uint32_t anaparm;
2281 
2282 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2283 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2284 
2285 	switch (power) {
2286 	case RTW_OFF:
2287 		if (before_rf)
2288 			return;
2289 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2290 		anaparm |= RTW_ANAPARM_TXDACOFF;
2291 		break;
2292 	case RTW_SLEEP:
2293 		if (!before_rf)
2294 			return;
2295 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2296 		anaparm |= RTW_ANAPARM_TXDACOFF;
2297 		break;
2298 	case RTW_ON:
2299 		if (!before_rf)
2300 			return;
2301 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2302 		break;
2303 	}
2304 	RTW_DPRINTF(RTW_DEBUG_PWR,
2305 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2306 	    __func__, rtw_pwrstate_string(power),
2307 	    (before_rf) ? "before" : "after", anaparm));
2308 
2309 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2310 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2311 }
2312 
2313 /* XXX I am using the RFMD settings gleaned from the reference
2314  * driver.  They agree
2315  */
2316 static void
2317 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2318     int before_rf, int digphy)
2319 {
2320 	uint32_t anaparm;
2321 
2322 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2323 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2324 
2325 	switch (power) {
2326 	case RTW_OFF:
2327 		if (before_rf)
2328 			return;
2329 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2330 		anaparm |= RTW_ANAPARM_TXDACOFF;
2331 		break;
2332 	case RTW_SLEEP:
2333 		if (!before_rf)
2334 			return;
2335 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2336 		anaparm |= RTW_ANAPARM_TXDACOFF;
2337 		break;
2338 	case RTW_ON:
2339 		if (!before_rf)
2340 			return;
2341 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2342 		break;
2343 	}
2344 	RTW_DPRINTF(RTW_DEBUG_PWR,
2345 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2346 	    __func__, rtw_pwrstate_string(power),
2347 	    (before_rf) ? "before" : "after", anaparm));
2348 
2349 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2350 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2351 }
2352 
2353 static void
2354 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2355     int before_rf, int digphy)
2356 {
2357 	uint32_t anaparm;
2358 
2359 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2360 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2361 
2362 	switch (power) {
2363 	case RTW_OFF:
2364 		if (before_rf)
2365 			return;
2366 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2367 		anaparm |= RTW_ANAPARM_TXDACOFF;
2368 		break;
2369 	case RTW_SLEEP:
2370 		if (!before_rf)
2371 			return;
2372 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2373 		anaparm |= RTW_ANAPARM_TXDACOFF;
2374 		break;
2375 	case RTW_ON:
2376 		if (!before_rf)
2377 			return;
2378 		if (digphy) {
2379 			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2380 			/* XXX guess */
2381 			anaparm |= RTW_ANAPARM_TXDACOFF;
2382 		} else
2383 			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2384 		break;
2385 	}
2386 	RTW_DPRINTF(RTW_DEBUG_PWR,
2387 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2388 	    __func__, rtw_pwrstate_string(power),
2389 	    (before_rf) ? "before" : "after", anaparm));
2390 
2391 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2392 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2393 }
2394 
2395 static void
2396 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2397     int digphy)
2398 {
2399 	struct rtw_regs *regs = &sc->sc_regs;
2400 
2401 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2402 
2403 	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2404 
2405 	rtw_set_access(regs, RTW_ACCESS_NONE);
2406 
2407 	return;
2408 }
2409 
2410 static int
2411 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2412 {
2413 	int rc;
2414 
2415 	RTW_DPRINTF(RTW_DEBUG_PWR,
2416 	    ("%s: %s->%s\n", __func__,
2417 	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2418 
2419 	if (sc->sc_pwrstate == power)
2420 		return 0;
2421 
2422 	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2423 	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2424 	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2425 
2426 	switch (power) {
2427 	case RTW_ON:
2428 		/* TBD set LEDs */
2429 		break;
2430 	case RTW_SLEEP:
2431 		/* TBD */
2432 		break;
2433 	case RTW_OFF:
2434 		/* TBD */
2435 		break;
2436 	}
2437 	if (rc == 0)
2438 		sc->sc_pwrstate = power;
2439 	else
2440 		sc->sc_pwrstate = RTW_OFF;
2441 	return rc;
2442 }
2443 
2444 static int
2445 rtw_tune(struct rtw_softc *sc)
2446 {
2447 	struct ieee80211com *ic = &sc->sc_ic;
2448 	u_int chan;
2449 	int rc;
2450 	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2451 	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2452 
2453 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2454 	if (chan == IEEE80211_CHAN_ANY)
2455 		panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
2456 
2457 	if (chan == sc->sc_cur_chan) {
2458 		RTW_DPRINTF(RTW_DEBUG_TUNE,
2459 		    ("%s: already tuned chan #%d\n", __func__, chan));
2460 		return 0;
2461 	}
2462 
2463 	rtw_suspend_ticks(sc);
2464 
2465 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
2466 
2467 	/* TBD wait for Tx to complete */
2468 
2469 	KASSERT((sc->sc_flags & RTW_F_ENABLED) != 0);
2470 
2471 	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2472 	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2473 	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2474 		/* XXX condition on powersaving */
2475 		printf("%s: phy init failed\n", sc->sc_dev.dv_xname);
2476 	}
2477 
2478 	sc->sc_cur_chan = chan;
2479 
2480 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 1);
2481 
2482 	rtw_resume_ticks(sc);
2483 
2484 	return rc;
2485 }
2486 
2487 void
2488 rtw_disable(struct rtw_softc *sc)
2489 {
2490 	int rc;
2491 
2492 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2493 		return;
2494 
2495 	/* turn off PHY */
2496 	if ((sc->sc_flags & RTW_F_INVALID) == 0 &&
2497 	    (rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2498 		printf("%s: failed to turn off PHY (%d)\n",
2499 		    sc->sc_dev.dv_xname, rc);
2500 	}
2501 
2502 	if (sc->sc_disable != NULL)
2503 		(*sc->sc_disable)(sc);
2504 
2505 	sc->sc_flags &= ~RTW_F_ENABLED;
2506 }
2507 
2508 int
2509 rtw_enable(struct rtw_softc *sc)
2510 {
2511 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
2512 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2513 			printf("%s: device enable failed\n",
2514 			    sc->sc_dev.dv_xname);
2515 			return (EIO);
2516 		}
2517 		sc->sc_flags |= RTW_F_ENABLED;
2518 	}
2519 	return (0);
2520 }
2521 
2522 static void
2523 rtw_transmit_config(struct rtw_regs *regs)
2524 {
2525 	uint32_t tcr;
2526 
2527 	tcr = RTW_READ(regs, RTW_TCR);
2528 
2529 	tcr |= RTW_TCR_CWMIN;
2530 	tcr &= ~RTW_TCR_MXDMA_MASK;
2531 	tcr |= RTW_TCR_MXDMA_256;
2532 	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2533 	tcr &= ~RTW_TCR_LBK_MASK;
2534 	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2535 
2536 	/* set short/long retry limits */
2537 	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2538 	tcr |= LSHIFT(4, RTW_TCR_SRL_MASK) | LSHIFT(4, RTW_TCR_LRL_MASK);
2539 
2540 	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2541 
2542 	RTW_WRITE(regs, RTW_TCR, tcr);
2543 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2544 }
2545 
2546 static inline void
2547 rtw_enable_interrupts(struct rtw_softc *sc)
2548 {
2549 	struct rtw_regs *regs = &sc->sc_regs;
2550 
2551 	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2552 	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2553 
2554 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2555 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2556 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2557 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2558 
2559 	/* XXX necessary? */
2560 	if (sc->sc_intr_ack != NULL)
2561 		(*sc->sc_intr_ack)(regs);
2562 }
2563 
2564 static void
2565 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2566 {
2567 	uint8_t msr;
2568 
2569 	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2570 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2571 
2572 	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2573 
2574 	switch (opmode) {
2575 	case IEEE80211_M_AHDEMO:
2576 	case IEEE80211_M_IBSS:
2577 		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2578 		break;
2579 	case IEEE80211_M_HOSTAP:
2580 		msr |= RTW_MSR_NETYPE_AP_OK;
2581 		break;
2582 	case IEEE80211_M_MONITOR:
2583 		/* XXX */
2584 		msr |= RTW_MSR_NETYPE_NOLINK;
2585 		break;
2586 	case IEEE80211_M_STA:
2587 		msr |= RTW_MSR_NETYPE_INFRA_OK;
2588 		break;
2589 	}
2590 	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2591 
2592 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2593 }
2594 
2595 #define	rtw_calchash(addr) \
2596 	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2597 
2598 static void
2599 rtw_pktfilt_load(struct rtw_softc *sc)
2600 {
2601 	struct rtw_regs *regs = &sc->sc_regs;
2602 	struct ieee80211com *ic = &sc->sc_ic;
2603 	struct ethercom *ec = &sc->sc_ec;
2604 	struct ifnet *ifp = &sc->sc_if;
2605 	int hash;
2606 	uint32_t hashes[2] = { 0, 0 };
2607 	struct ether_multi *enm;
2608 	struct ether_multistep step;
2609 
2610 	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2611 
2612 	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2613 	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2614 
2615 	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2616 	/* MAC auto-reset PHY (huh?) */
2617 	sc->sc_rcr |= RTW_RCR_ENMARP;
2618 	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2619 	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2620 
2621 	switch (ic->ic_opmode) {
2622 	case IEEE80211_M_MONITOR:
2623 		sc->sc_rcr |= RTW_RCR_MONITOR;
2624 		break;
2625 	case IEEE80211_M_AHDEMO:
2626 	case IEEE80211_M_IBSS:
2627 		/* receive broadcasts in our BSS */
2628 		sc->sc_rcr |= RTW_RCR_ADD3;
2629 		break;
2630 	default:
2631 		break;
2632 	}
2633 
2634 	ifp->if_flags &= ~IFF_ALLMULTI;
2635 
2636 	/* XXX accept all broadcast if scanning */
2637 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2638 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2639 
2640 	if (ifp->if_flags & IFF_PROMISC) {
2641 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2642 allmulti:
2643 		ifp->if_flags |= IFF_ALLMULTI;
2644 		goto setit;
2645 	}
2646 
2647 	/*
2648 	 * Program the 64-bit multicast hash filter.
2649 	 */
2650 	ETHER_FIRST_MULTI(step, ec, enm);
2651 	while (enm != NULL) {
2652 		/* XXX */
2653 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2654 		    ETHER_ADDR_LEN) != 0)
2655 			goto allmulti;
2656 
2657 		hash = rtw_calchash(enm->enm_addrlo);
2658 		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2659 		sc->sc_rcr |= RTW_RCR_AM;
2660 		ETHER_NEXT_MULTI(step, enm);
2661 	}
2662 
2663 	/* all bits set => hash is useless */
2664 	if (~(hashes[0] & hashes[1]) == 0)
2665 		goto allmulti;
2666 
2667  setit:
2668 	if (ifp->if_flags & IFF_ALLMULTI) {
2669 		sc->sc_rcr |= RTW_RCR_AM;	/* accept all multicast */
2670 		hashes[0] = hashes[1] = 0xffffffff;
2671 	}
2672 
2673 	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2674 	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2675 	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2676 	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2677 
2678 	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2679 	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2680 	    sc->sc_dev.dv_xname, RTW_READ(regs, RTW_MAR0),
2681 	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2682 
2683 	return;
2684 }
2685 
2686 static struct mbuf *
2687 rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2688 {
2689 	struct ieee80211com *ic = &sc->sc_ic;
2690 	struct mbuf *m;
2691 	struct ieee80211_beacon_offsets	boff;
2692 
2693 	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2694 		RTW_DPRINTF(RTW_DEBUG_BEACON,
2695 		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2696 	}
2697 	return m;
2698 }
2699 
2700 /* Must be called at splnet. */
2701 static int
2702 rtw_init(struct ifnet *ifp)
2703 {
2704 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2705 	struct ieee80211com *ic = &sc->sc_ic;
2706 	struct rtw_regs *regs = &sc->sc_regs;
2707 	int rc = 0;
2708 
2709 	if ((rc = rtw_enable(sc)) != 0)
2710 		goto out;
2711 
2712 	/* Cancel pending I/O and reset. */
2713 	rtw_stop(ifp, 0);
2714 
2715 	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2716 	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2717 	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2718 
2719 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2720 		goto out;
2721 
2722 	if ((rc = rtw_swring_setup(sc)) != 0)
2723 		goto out;
2724 
2725 	rtw_transmit_config(regs);
2726 
2727 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2728 
2729 	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2730 	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2731 
2732 	/* long PLCP header, 1Mb/2Mb basic rate */
2733 	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2734 	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2735 
2736 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2737 	rtw_set_access(regs, RTW_ACCESS_NONE);
2738 
2739 	/* XXX from reference sources */
2740 	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2741 	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2742 
2743 	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev.dv_xname);
2744 
2745 	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2746 	/* from Linux driver */
2747 	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2748 
2749 	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2750 
2751 	rtw_enable_interrupts(sc);
2752 
2753 	rtw_pktfilt_load(sc);
2754 
2755 	rtw_hwring_setup(sc);
2756 
2757 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2758 
2759 	rtw_io_enable(regs, RTW_CR_RE|RTW_CR_TE, 1);
2760 
2761 	ifp->if_flags |= IFF_RUNNING;
2762 	ic->ic_state = IEEE80211_S_INIT;
2763 
2764 	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2765 	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2766 
2767 	rtw_resume_ticks(sc);
2768 
2769 	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2770 
2771 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2772 		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2773 	else
2774 		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2775 
2776 out:
2777 	printf("%s: interface not running\n", sc->sc_dev.dv_xname);
2778 	return rc;
2779 }
2780 
2781 static inline void
2782 rtw_led_init(struct rtw_regs *regs)
2783 {
2784 	uint8_t cfg0, cfg1;
2785 
2786 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2787 
2788 	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2789 	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2790 	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2791 
2792 	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2793 	RTW_DPRINTF(RTW_DEBUG_LED,
2794 	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2795 
2796 	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2797 	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2798 	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2799 
2800 	rtw_set_access(regs, RTW_ACCESS_NONE);
2801 }
2802 
2803 /*
2804  * IEEE80211_S_INIT: 		LED1 off
2805  *
2806  * IEEE80211_S_AUTH,
2807  * IEEE80211_S_ASSOC,
2808  * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2809  *
2810  * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2811  */
2812 static void
2813 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2814 {
2815 	struct rtw_led_state *ls;
2816 
2817 	ls = &sc->sc_led_state;
2818 
2819 	switch (nstate) {
2820 	case IEEE80211_S_INIT:
2821 		rtw_led_init(&sc->sc_regs);
2822 		callout_stop(&ls->ls_slow_ch);
2823 		callout_stop(&ls->ls_fast_ch);
2824 		ls->ls_slowblink = 0;
2825 		ls->ls_actblink = 0;
2826 		ls->ls_default = 0;
2827 		break;
2828 	case IEEE80211_S_SCAN:
2829 		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2830 		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2831 		/*FALLTHROUGH*/
2832 	case IEEE80211_S_AUTH:
2833 	case IEEE80211_S_ASSOC:
2834 		ls->ls_default = RTW_LED1;
2835 		ls->ls_actblink = RTW_LED1;
2836 		ls->ls_slowblink = RTW_LED1;
2837 		break;
2838 	case IEEE80211_S_RUN:
2839 		ls->ls_slowblink = 0;
2840 		break;
2841 	}
2842 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2843 }
2844 
2845 static void
2846 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2847 {
2848 	uint8_t led_condition;
2849 	bus_size_t ofs;
2850 	uint8_t mask, newval, val;
2851 
2852 	led_condition = ls->ls_default;
2853 
2854 	if (ls->ls_state & RTW_LED_S_SLOW)
2855 		led_condition ^= ls->ls_slowblink;
2856 	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2857 		led_condition ^= ls->ls_actblink;
2858 
2859 	RTW_DPRINTF(RTW_DEBUG_LED,
2860 	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2861 
2862 	switch (hwverid) {
2863 	default:
2864 	case 'F':
2865 		ofs = RTW_PSR;
2866 		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2867 		if (led_condition & RTW_LED0)
2868 			newval &= ~RTW_PSR_LEDGPO0;
2869 		if (led_condition & RTW_LED1)
2870 			newval &= ~RTW_PSR_LEDGPO1;
2871 		break;
2872 	case 'D':
2873 		ofs = RTW_9346CR;
2874 		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2875 		newval = RTW_9346CR_EEM_PROGRAM;
2876 		if (led_condition & RTW_LED0)
2877 			newval |= RTW_9346CR_EEDI;
2878 		if (led_condition & RTW_LED1)
2879 			newval |= RTW_9346CR_EECS;
2880 		break;
2881 	}
2882 	val = RTW_READ8(regs, ofs);
2883 	RTW_DPRINTF(RTW_DEBUG_LED,
2884 	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2885 	     (uintptr_t)ofs));
2886 	val &= ~mask;
2887 	val |= newval;
2888 	RTW_WRITE8(regs, ofs, val);
2889 	RTW_DPRINTF(RTW_DEBUG_LED,
2890 	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2891 	     (uintptr_t)ofs));
2892 	RTW_SYNC(regs, ofs, ofs);
2893 }
2894 
2895 static void
2896 rtw_led_fastblink(void *arg)
2897 {
2898 	int ostate, s;
2899 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2900 	struct rtw_led_state *ls = &sc->sc_led_state;
2901 
2902 	s = splnet();
2903 	ostate = ls->ls_state;
2904 	ls->ls_state ^= ls->ls_event;
2905 
2906 	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2907 		ls->ls_state &= ~RTW_LED_S_TX;
2908 
2909 	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2910 		ls->ls_state &= ~RTW_LED_S_RX;
2911 
2912 	ls->ls_event = 0;
2913 
2914 	if (ostate != ls->ls_state)
2915 		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2916 	splx(s);
2917 
2918 	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2919 }
2920 
2921 static void
2922 rtw_led_slowblink(void *arg)
2923 {
2924 	int s;
2925 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2926 	struct rtw_led_state *ls = &sc->sc_led_state;
2927 
2928 	s = splnet();
2929 	ls->ls_state ^= RTW_LED_S_SLOW;
2930 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2931 	splx(s);
2932 	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2933 }
2934 
2935 static inline void
2936 rtw_led_attach(struct rtw_led_state *ls, void *arg)
2937 {
2938 	callout_init(&ls->ls_fast_ch);
2939 	callout_init(&ls->ls_slow_ch);
2940 	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2941 	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2942 }
2943 
2944 static int
2945 rtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2946 {
2947 	int rc = 0, s;
2948 	struct rtw_softc *sc = ifp->if_softc;
2949 	struct ifreq *ifr = (struct ifreq *)data;
2950 
2951 	s = splnet();
2952 	switch (cmd) {
2953 	case SIOCSIFFLAGS:
2954 		if ((ifp->if_flags & IFF_UP) != 0) {
2955 			if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
2956 				rtw_pktfilt_load(sc);
2957 			} else
2958 				rc = rtw_init(ifp);
2959 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2960 		} else if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
2961 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2962 			rtw_stop(ifp, 1);
2963 		}
2964 		break;
2965 	case SIOCADDMULTI:
2966 	case SIOCDELMULTI:
2967 		if (cmd == SIOCADDMULTI)
2968 			rc = ether_addmulti(ifr, &sc->sc_ec);
2969 		else
2970 			rc = ether_delmulti(ifr, &sc->sc_ec);
2971 		if (rc != ENETRESET)
2972 			break;
2973 		if (ifp->if_flags & IFF_RUNNING)
2974 			rtw_pktfilt_load(sc);
2975 		rc = 0;
2976 		break;
2977 	default:
2978 		if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
2979 			break;
2980 		if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2981 			rc = rtw_init(ifp);
2982 		else
2983 			rc = 0;
2984 		break;
2985 	}
2986 	splx(s);
2987 	return rc;
2988 }
2989 
2990 /* Select a transmit ring with at least one h/w and s/w descriptor free.
2991  * Return 0 on success, -1 on failure.
2992  */
2993 static inline int
2994 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
2995     struct rtw_txdesc_blk **tdbp, int pri)
2996 {
2997 	struct rtw_txsoft_blk *tsb;
2998 	struct rtw_txdesc_blk *tdb;
2999 
3000 	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
3001 
3002 	tsb = &sc->sc_txsoft_blk[pri];
3003 	tdb = &sc->sc_txdesc_blk[pri];
3004 
3005 	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
3006 		if (tsb->tsb_tx_timer == 0)
3007 			tsb->tsb_tx_timer = 5;
3008 		*tsbp = NULL;
3009 		*tdbp = NULL;
3010 		return -1;
3011 	}
3012 	*tsbp = tsb;
3013 	*tdbp = tdb;
3014 	return 0;
3015 }
3016 
3017 static inline struct mbuf *
3018 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3019     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3020     struct ieee80211_node **nip, short *if_flagsp)
3021 {
3022 	struct mbuf *m;
3023 
3024 	if (IF_IS_EMPTY(ifq))
3025 		return NULL;
3026 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3027 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3028 		    __func__, pri));
3029 		*if_flagsp |= IFF_OACTIVE;
3030 		sc->sc_if.if_timer = 1;
3031 		return NULL;
3032 	}
3033 	IF_DEQUEUE(ifq, m);
3034 	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3035 	m->m_pkthdr.rcvif = NULL;
3036 	KASSERT(*nip != NULL);
3037 	return m;
3038 }
3039 
3040 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3041  * at the driver's selection of transmit control block for the packet.
3042  */
3043 static inline int
3044 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3045     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3046     struct ieee80211_node **nip)
3047 {
3048 	int pri;
3049 	struct ether_header *eh;
3050 	struct mbuf *m0;
3051 	struct rtw_softc *sc;
3052 	short *if_flagsp;
3053 
3054 	sc = (struct rtw_softc *)ifp->if_softc;
3055 
3056 	DPRINTF(sc, RTW_DEBUG_XMIT,
3057 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3058 
3059 	if_flagsp = &ifp->if_flags;
3060 
3061 	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3062 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3063 		                     tdbp, nip, if_flagsp)) != NULL) {
3064 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3065 		    __func__));
3066 		return 0;
3067 	}
3068 
3069 	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3070 		                     tdbp, nip, if_flagsp)) != NULL) {
3071 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3072 		    __func__));
3073 		return 0;
3074 	}
3075 
3076 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3077 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3078 		return 0;
3079 	}
3080 
3081 	*mp = NULL;
3082 
3083 	IFQ_POLL(&ifp->if_snd, m0);
3084 	if (m0 == NULL) {
3085 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3086 		    __func__));
3087 		return 0;
3088 	}
3089 
3090 	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3091 
3092 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3093 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3094 		    __func__, pri));
3095 		*if_flagsp |= IFF_OACTIVE;
3096 		sc->sc_if.if_timer = 1;
3097 		return 0;
3098 	}
3099 
3100 	IFQ_DEQUEUE(&ifp->if_snd, m0);
3101 	if (m0 == NULL) {
3102 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3103 		    __func__));
3104 		return 0;
3105 	}
3106 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3107 	ifp->if_opackets++;
3108 #if NBPFILTER > 0
3109 	if (ifp->if_bpf)
3110 		bpf_mtap(ifp->if_bpf, m0);
3111 #endif
3112 	eh = mtod(m0, struct ether_header *);
3113 	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3114 	if (*nip == NULL) {
3115 		/* NB: ieee80211_find_txnode does stat+msg */
3116 		m_freem(m0);
3117 		return -1;
3118 	}
3119 	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3120 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3121 		ifp->if_oerrors++;
3122 		return -1;
3123 	}
3124 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3125 	*mp = m0;
3126 	return 0;
3127 }
3128 
3129 static int
3130 rtw_seg_too_short(bus_dmamap_t dmamap)
3131 {
3132 	int i;
3133 	for (i = 0; i < dmamap->dm_nsegs; i++) {
3134 		if (dmamap->dm_segs[i].ds_len < 4) {
3135 			printf("%s: segment too short\n", __func__);
3136 			return 1;
3137 		}
3138 	}
3139 	return 0;
3140 }
3141 
3142 /* TBD factor with atw_start */
3143 static struct mbuf *
3144 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3145     u_int ndescfree, short *ifflagsp, const char *dvname)
3146 {
3147 	int first, rc;
3148 	struct mbuf *m, *m0;
3149 
3150 	m0 = chain;
3151 
3152 	/*
3153 	 * Load the DMA map.  Copy and try (once) again if the packet
3154 	 * didn't fit in the alloted number of segments.
3155 	 */
3156 	for (first = 1;
3157 	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3158 			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3159 	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3160 	     first = 0) {
3161 		if (rc == 0)
3162 			bus_dmamap_unload(dmat, dmam);
3163 		MGETHDR(m, M_DONTWAIT, MT_DATA);
3164 		if (m == NULL) {
3165 			printf("%s: unable to allocate Tx mbuf\n",
3166 			    dvname);
3167 			break;
3168 		}
3169 		if (m0->m_pkthdr.len > MHLEN) {
3170 			MCLGET(m, M_DONTWAIT);
3171 			if ((m->m_flags & M_EXT) == 0) {
3172 				printf("%s: cannot allocate Tx cluster\n",
3173 				    dvname);
3174 				m_freem(m);
3175 				break;
3176 			}
3177 		}
3178 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
3179 		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3180 		m_freem(m0);
3181 		m0 = m;
3182 		m = NULL;
3183 	}
3184 	if (rc != 0) {
3185 		printf("%s: cannot load Tx buffer, rc = %d\n", dvname, rc);
3186 		m_freem(m0);
3187 		return NULL;
3188 	} else if (rtw_seg_too_short(dmam)) {
3189 		printf("%s: cannot load Tx buffer, segment too short\n",
3190 		    dvname);
3191 		bus_dmamap_unload(dmat, dmam);
3192 		m_freem(m0);
3193 		return NULL;
3194 	} else if (dmam->dm_nsegs > ndescfree) {
3195 		printf("%s: too many tx segments\n", dvname);
3196 		bus_dmamap_unload(dmat, dmam);
3197 		m_freem(m0);
3198 		return NULL;
3199 	}
3200 	return m0;
3201 }
3202 
3203 #ifdef RTW_DEBUG
3204 static void
3205 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3206     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3207 {
3208 	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3209 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3210 	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3211 	    sc->sc_dev.dv_xname, ts, action, desc,
3212 	    le32toh(td->td_buf), le32toh(td->td_next),
3213 	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3214 	    le32toh(td->td_len)));
3215 }
3216 #endif /* RTW_DEBUG */
3217 
3218 static void
3219 rtw_start(struct ifnet *ifp)
3220 {
3221 	uint8_t tppoll;
3222 	int desc, i, lastdesc, npkt, rate;
3223 	uint32_t proto_ctl0, ctl0, ctl1;
3224 	bus_dmamap_t		dmamap;
3225 	struct ieee80211com	*ic;
3226 	struct ieee80211_duration *d0;
3227 	struct ieee80211_frame_min	*wh;
3228 	struct ieee80211_node	*ni;
3229 	struct mbuf		*m0;
3230 	struct rtw_softc	*sc;
3231 	struct rtw_txsoft_blk	*tsb;
3232 	struct rtw_txdesc_blk	*tdb;
3233 	struct rtw_txsoft	*ts;
3234 	struct rtw_txdesc	*td;
3235 	struct ieee80211_key	*k;
3236 
3237 	sc = (struct rtw_softc *)ifp->if_softc;
3238 	ic = &sc->sc_ic;
3239 
3240 	DPRINTF(sc, RTW_DEBUG_XMIT,
3241 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3242 
3243 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3244 		goto out;
3245 
3246 	/* XXX do real rate control */
3247 	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3248 
3249 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3250 		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3251 
3252 	for (;;) {
3253 		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3254 			continue;
3255 		if (m0 == NULL)
3256 			break;
3257 
3258 		wh = mtod(m0, struct ieee80211_frame_min *);
3259 
3260 		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3261 		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3262 			m_freem(m0);
3263 			break;
3264 		} else
3265 			k = NULL;
3266 
3267 		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3268 
3269 		dmamap = ts->ts_dmamap;
3270 
3271 		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3272 		    tdb->tdb_nfree, &ifp->if_flags, sc->sc_dev.dv_xname);
3273 
3274 		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3275 			DPRINTF(sc, RTW_DEBUG_XMIT,
3276 			    ("%s: fail dmamap load\n", __func__));
3277 			goto post_dequeue_err;
3278 		}
3279 
3280 		/* Note well: rtw_dmamap_load_txbuf may have created
3281 		 * a new chain, so we must find the header once
3282 		 * more.
3283 		 */
3284 		wh = mtod(m0, struct ieee80211_frame_min *);
3285 
3286 		/* XXX do real rate control */
3287 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3288 		    IEEE80211_FC0_TYPE_MGT)
3289 			rate = 2;
3290 		else
3291 			rate = MAX(2, ieee80211_get_rate(ic));
3292 
3293 #ifdef RTW_DEBUG
3294 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3295 		    (IFF_DEBUG|IFF_LINK2)) {
3296 			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3297 			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3298 			                            : sizeof(wh),
3299 			    rate, 0);
3300 		}
3301 #endif /* RTW_DEBUG */
3302 		ctl0 = proto_ctl0 |
3303 		    LSHIFT(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3304 
3305 		switch (rate) {
3306 		default:
3307 		case 2:
3308 			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3309 			break;
3310 		case 4:
3311 			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3312 			break;
3313 		case 11:
3314 			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3315 			break;
3316 		case 22:
3317 			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3318 			break;
3319 		}
3320 		/* XXX >= ? Compare after fragmentation? */
3321 		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3322 			ctl0 |= RTW_TXCTL0_RTSEN;
3323 
3324 		if (k != NULL) {
3325 			ctl0 |= LSHIFT(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3326 			    RTW_TXCTL0_KEYID_MASK;
3327 		}
3328 
3329 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3330 		    IEEE80211_FC0_TYPE_MGT) {
3331 			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3332 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3333 			    IEEE80211_FC0_SUBTYPE_BEACON)
3334 				ctl0 |= RTW_TXCTL0_BEACON;
3335 		}
3336 
3337 		if (ieee80211_compute_duration(wh, m0->m_pkthdr.len,
3338 		    ic->ic_flags, ic->ic_fragthreshold,
3339 		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3340 		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3341 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3342 			DPRINTF(sc, RTW_DEBUG_XMIT,
3343 			    ("%s: fail compute duration\n", __func__));
3344 			goto post_load_err;
3345 		}
3346 
3347 		d0 = &ts->ts_d0;
3348 
3349 		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3350 
3351 		ctl1 = LSHIFT(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3352 		    LSHIFT(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3353 
3354 		if (d0->d_residue)
3355 			ctl1 |= RTW_TXCTL1_LENGEXT;
3356 
3357 		/* TBD fragmentation */
3358 
3359 		ts->ts_first = tdb->tdb_next;
3360 
3361 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3362 		    BUS_DMASYNC_PREWRITE);
3363 
3364 		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3365 
3366 #if NBPFILTER > 0
3367 		if (ic->ic_rawbpf != NULL)
3368 			bpf_mtap((caddr_t)ic->ic_rawbpf, m0);
3369 
3370 		if (sc->sc_radiobpf != NULL) {
3371 			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3372 
3373 			rt->rt_flags = 0;
3374 			rt->rt_rate = rate;
3375 			rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
3376 			rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
3377 
3378 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)rt,
3379 			    sizeof(sc->sc_txtapu), m0);
3380 		}
3381 #endif /* NPBFILTER > 0 */
3382 
3383 		for (i = 0, lastdesc = desc = ts->ts_first;
3384 		     i < dmamap->dm_nsegs;
3385 		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3386 			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3387 				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3388 				    ("%s: seg too long\n", __func__));
3389 				goto post_load_err;
3390 			}
3391 			td = &tdb->tdb_desc[desc];
3392 			td->td_ctl0 = htole32(ctl0);
3393 			if (i != 0)
3394 				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3395 			td->td_ctl1 = htole32(ctl1);
3396 			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3397 			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3398 			lastdesc = desc;
3399 #ifdef RTW_DEBUG
3400 			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3401 #endif /* RTW_DEBUG */
3402 		}
3403 
3404 		KASSERT(desc < tdb->tdb_ndesc);
3405 
3406 		ts->ts_ni = ni;
3407 		KASSERT(ni != NULL);
3408 		ts->ts_mbuf = m0;
3409 		ts->ts_last = lastdesc;
3410 		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3411 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3412 		   htole32(RTW_TXCTL0_FS);
3413 
3414 #ifdef RTW_DEBUG
3415 		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3416 		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3417 #endif /* RTW_DEBUG */
3418 
3419 		tdb->tdb_nfree -= dmamap->dm_nsegs;
3420 		tdb->tdb_next = desc;
3421 
3422 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3423 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3424 
3425 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3426 		    htole32(RTW_TXCTL0_OWN);
3427 
3428 #ifdef RTW_DEBUG
3429 		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3430 #endif /* RTW_DEBUG */
3431 
3432 		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3433 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3434 
3435 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3436 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3437 
3438 		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3439 			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3440 		tsb->tsb_tx_timer = 5;
3441 		ifp->if_timer = 1;
3442 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3443 		tppoll &= ~RTW_TPPOLL_SALL;
3444 		tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
3445 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3446 		RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
3447 	}
3448 out:
3449 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3450 	return;
3451 post_load_err:
3452 	bus_dmamap_unload(sc->sc_dmat, dmamap);
3453 	m_freem(m0);
3454 post_dequeue_err:
3455 	ieee80211_free_node(ni);
3456 	return;
3457 }
3458 
3459 static void
3460 rtw_idle(struct rtw_regs *regs)
3461 {
3462 	int active;
3463 
3464 	/* request stop DMA; wait for packets to stop transmitting. */
3465 
3466 	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3467 	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3468 
3469 	for (active = 0; active < 300 &&
3470 	     (RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0; active++)
3471 		DELAY(10);
3472 	printf("%s: transmit DMA idle in %dus\n", __func__, active * 10);
3473 }
3474 
3475 static void
3476 rtw_watchdog(struct ifnet *ifp)
3477 {
3478 	int pri, tx_timeouts = 0;
3479 	struct rtw_softc *sc;
3480 	struct rtw_txsoft_blk *tsb;
3481 
3482 	sc = ifp->if_softc;
3483 
3484 	ifp->if_timer = 0;
3485 
3486 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
3487 		return;
3488 
3489 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3490 		tsb = &sc->sc_txsoft_blk[pri];
3491 
3492 		if (tsb->tsb_tx_timer == 0)
3493 			continue;
3494 		else if (--tsb->tsb_tx_timer == 0) {
3495 			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3496 				continue;
3497 			printf("%s: transmit timeout, priority %d\n",
3498 			    ifp->if_xname, pri);
3499 			ifp->if_oerrors++;
3500 			tx_timeouts++;
3501 		} else
3502 			ifp->if_timer = 1;
3503 	}
3504 
3505 	if (tx_timeouts > 0) {
3506 		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3507 		 * reset s/w tx-ring pointers, and start transmission.
3508 		 *
3509 		 * TBD Stop/restart just the broken rings?
3510 		 */
3511 		rtw_idle(&sc->sc_regs);
3512 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 0);
3513 		rtw_txdescs_reset(sc);
3514 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 1);
3515 		rtw_txring_fixup(sc);
3516 		rtw_start(ifp);
3517 	}
3518 	ieee80211_watchdog(&sc->sc_ic);
3519 	return;
3520 }
3521 
3522 static void
3523 rtw_next_scan(void *arg)
3524 {
3525 	struct ieee80211com *ic = arg;
3526 	int s;
3527 
3528 	/* don't call rtw_start w/o network interrupts blocked */
3529 	s = splnet();
3530 	if (ic->ic_state == IEEE80211_S_SCAN)
3531 		ieee80211_next_scan(ic);
3532 	splx(s);
3533 }
3534 
3535 static void
3536 rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3537 {
3538 	uint16_t bcnitv, bintritv, intval;
3539 	int i;
3540 	struct rtw_regs *regs = &sc->sc_regs;
3541 
3542 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3543 		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3544 
3545 	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3546 
3547 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3548 
3549 	intval = MIN(intval0, PRESHIFT(RTW_BCNITV_BCNITV_MASK));
3550 
3551 	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3552 	bcnitv |= LSHIFT(intval, RTW_BCNITV_BCNITV_MASK);
3553 	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3554 	/* interrupt host 1ms before the TBTT */
3555 	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3556 	bintritv |= LSHIFT(1000, RTW_BINTRITV_BINTRITV);
3557 	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3558 	/* magic from Linux */
3559 	RTW_WRITE16(regs, RTW_ATIMWND, LSHIFT(1, RTW_ATIMWND_ATIMWND));
3560 	RTW_WRITE16(regs, RTW_ATIMTRITV, LSHIFT(2, RTW_ATIMTRITV_ATIMTRITV));
3561 	rtw_set_access(regs, RTW_ACCESS_NONE);
3562 
3563 	rtw_io_enable(regs, RTW_CR_RE | RTW_CR_TE, 1);
3564 }
3565 
3566 /* Synchronize the hardware state with the software state. */
3567 static int
3568 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3569 {
3570 	struct ifnet *ifp = ic->ic_ifp;
3571 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3572 	enum ieee80211_state ostate;
3573 	int error;
3574 
3575 	ostate = ic->ic_state;
3576 
3577 	rtw_led_newstate(sc, nstate);
3578 
3579 	if (nstate == IEEE80211_S_INIT) {
3580 		callout_stop(&sc->sc_scan_ch);
3581 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3582 		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3583 	}
3584 
3585 	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3586 		rtw_pwrstate(sc, RTW_ON);
3587 
3588 	if ((error = rtw_tune(sc)) != 0)
3589 		return error;
3590 
3591 	switch (nstate) {
3592 	case IEEE80211_S_INIT:
3593 		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3594 		break;
3595 	case IEEE80211_S_SCAN:
3596 		if (ostate != IEEE80211_S_SCAN) {
3597 			(void)memset(ic->ic_bss->ni_bssid, 0,
3598 			    IEEE80211_ADDR_LEN);
3599 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3600 		}
3601 
3602 		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3603 		    rtw_next_scan, ic);
3604 
3605 		break;
3606 	case IEEE80211_S_RUN:
3607 		switch (ic->ic_opmode) {
3608 		case IEEE80211_M_HOSTAP:
3609 		case IEEE80211_M_IBSS:
3610 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3611 			/*FALLTHROUGH*/
3612 		case IEEE80211_M_AHDEMO:
3613 		case IEEE80211_M_STA:
3614 			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3615 			    ic->ic_bss->ni_intval);
3616 			break;
3617 		case IEEE80211_M_MONITOR:
3618 			break;
3619 		}
3620 		rtw_set_nettype(sc, ic->ic_opmode);
3621 		break;
3622 	case IEEE80211_S_ASSOC:
3623 	case IEEE80211_S_AUTH:
3624 		break;
3625 	}
3626 
3627 	if (nstate != IEEE80211_S_SCAN)
3628 		callout_stop(&sc->sc_scan_ch);
3629 
3630 	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3631 }
3632 
3633 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3634 static uint64_t
3635 rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3636 {
3637 	uint32_t tsftl, tsfth;
3638 
3639 	tsfth = RTW_READ(regs, RTW_TSFTRH);
3640 	tsftl = RTW_READ(regs, RTW_TSFTRL);
3641 	if (tsftl < rstamp)	/* Compensate for rollover. */
3642 		tsfth--;
3643 	return ((uint64_t)tsfth << 32) | rstamp;
3644 }
3645 
3646 static void
3647 rtw_ibss_merge(struct rtw_softc *sc, struct ieee80211_node *ni, uint32_t rstamp)
3648 {
3649 	uint8_t tppoll;
3650 
3651 	if (le64toh(ni->ni_tstamp.tsf) < rtw_tsf_extend(&sc->sc_regs, rstamp))
3652 		return;
3653 	if (ieee80211_ibss_merge(ni) == ENETRESET) {
3654 		/* Stop beacon queue.  Kick state machine to synchronize
3655 		 * with the new IBSS.
3656 		 */
3657 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3658 		tppoll |= RTW_TPPOLL_SBQ;
3659 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3660 		(void)ieee80211_new_state(&sc->sc_ic, IEEE80211_S_RUN, -1);
3661 	}
3662 	return;
3663 }
3664 
3665 static void
3666 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3667     struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3668 {
3669 	struct ifnet *ifp = ic->ic_ifp;
3670 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3671 
3672 	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3673 
3674 	switch (subtype) {
3675 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3676 	case IEEE80211_FC0_SUBTYPE_BEACON:
3677 		if (ic->ic_opmode != IEEE80211_M_IBSS ||
3678 		    ic->ic_state != IEEE80211_S_RUN)
3679 			return;
3680 		rtw_ibss_merge(sc, ni, rstamp);
3681 		break;
3682 	default:
3683 		break;
3684 	}
3685 	return;
3686 }
3687 
3688 static struct ieee80211_node *
3689 rtw_node_alloc(struct ieee80211_node_table *nt)
3690 {
3691 	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3692 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3693 	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3694 
3695 	DPRINTF(sc, RTW_DEBUG_NODE,
3696 	    ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
3697 	return ni;
3698 }
3699 
3700 static void
3701 rtw_node_free(struct ieee80211_node *ni)
3702 {
3703 	struct ieee80211com *ic = ni->ni_ic;
3704 	struct ifnet *ifp = ic->ic_ifp;
3705 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3706 
3707 	DPRINTF(sc, RTW_DEBUG_NODE,
3708 	    ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
3709 	    ether_sprintf(ni->ni_bssid)));
3710 	(*sc->sc_mtbl.mt_node_free)(ni);
3711 }
3712 
3713 static int
3714 rtw_media_change(struct ifnet *ifp)
3715 {
3716 	int error;
3717 
3718 	error = ieee80211_media_change(ifp);
3719 	if (error == ENETRESET) {
3720 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3721 		    (IFF_RUNNING|IFF_UP))
3722 			rtw_init(ifp);		/* XXX lose error */
3723 		error = 0;
3724 	}
3725 	return error;
3726 }
3727 
3728 static void
3729 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3730 {
3731 	struct rtw_softc *sc = ifp->if_softc;
3732 
3733 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
3734 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3735 		imr->ifm_status = 0;
3736 		return;
3737 	}
3738 	ieee80211_media_status(ifp, imr);
3739 }
3740 
3741 void
3742 rtw_power(int why, void *arg)
3743 {
3744 	struct rtw_softc *sc = arg;
3745 	struct ifnet *ifp = &sc->sc_if;
3746 	int s;
3747 
3748 	DPRINTF(sc, RTW_DEBUG_PWR,
3749 	    ("%s: rtw_power(%d,)\n", sc->sc_dev.dv_xname, why));
3750 
3751 	s = splnet();
3752 	switch (why) {
3753 	case PWR_STANDBY:
3754 		/* XXX do nothing. */
3755 		break;
3756 	case PWR_SUSPEND:
3757 		rtw_stop(ifp, 0);
3758 		if (sc->sc_power != NULL)
3759 			(*sc->sc_power)(sc, why);
3760 		break;
3761 	case PWR_RESUME:
3762 		if (ifp->if_flags & IFF_UP) {
3763 			if (sc->sc_power != NULL)
3764 				(*sc->sc_power)(sc, why);
3765 			rtw_init(ifp);
3766 		}
3767 		break;
3768 	case PWR_SOFTSUSPEND:
3769 	case PWR_SOFTSTANDBY:
3770 	case PWR_SOFTRESUME:
3771 		break;
3772 	}
3773 	splx(s);
3774 }
3775 
3776 /* rtw_shutdown: make sure the interface is stopped at reboot time. */
3777 void
3778 rtw_shutdown(void *arg)
3779 {
3780 	struct rtw_softc *sc = arg;
3781 
3782 	rtw_stop(&sc->sc_if, 1);
3783 }
3784 
3785 static inline void
3786 rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3787 {
3788 	(void)memcpy(ifp->if_xname, dvname, IFNAMSIZ);
3789 	ifp->if_softc = softc;
3790 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3791 	    IFF_NOTRAILERS;
3792 	ifp->if_ioctl = rtw_ioctl;
3793 	ifp->if_start = rtw_start;
3794 	ifp->if_watchdog = rtw_watchdog;
3795 	ifp->if_init = rtw_init;
3796 	ifp->if_stop = rtw_stop;
3797 }
3798 
3799 static inline void
3800 rtw_set80211props(struct ieee80211com *ic)
3801 {
3802 	int nrate;
3803 	ic->ic_phytype = IEEE80211_T_DS;
3804 	ic->ic_opmode = IEEE80211_M_STA;
3805 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3806 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
3807 
3808 	nrate = 0;
3809 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3810 	    IEEE80211_RATE_BASIC | 2;
3811 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3812 	    IEEE80211_RATE_BASIC | 4;
3813 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3814 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3815 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3816 }
3817 
3818 static inline void
3819 rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3820 {
3821 	mtbl->mt_newstate = ic->ic_newstate;
3822 	ic->ic_newstate = rtw_newstate;
3823 
3824 	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3825 	ic->ic_recv_mgmt = rtw_recv_mgmt;
3826 
3827 	mtbl->mt_node_free = ic->ic_node_free;
3828 	ic->ic_node_free = rtw_node_free;
3829 
3830 	mtbl->mt_node_alloc = ic->ic_node_alloc;
3831 	ic->ic_node_alloc = rtw_node_alloc;
3832 
3833 	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3834 	ic->ic_crypto.cs_key_set = rtw_key_set;
3835 	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3836 	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3837 }
3838 
3839 static inline void
3840 rtw_establish_hooks(struct rtw_hooks *hooks, const char *dvname,
3841     void *arg)
3842 {
3843 	/*
3844 	 * Make sure the interface is shutdown during reboot.
3845 	 */
3846 	hooks->rh_shutdown = shutdownhook_establish(rtw_shutdown, arg);
3847 	if (hooks->rh_shutdown == NULL)
3848 		printf("%s: WARNING: unable to establish shutdown hook\n",
3849 		    dvname);
3850 
3851 	/*
3852 	 * Add a suspend hook to make sure we come back up after a
3853 	 * resume.
3854 	 */
3855 	hooks->rh_power = powerhook_establish(rtw_power, arg);
3856 	if (hooks->rh_power == NULL)
3857 		printf("%s: WARNING: unable to establish power hook\n",
3858 		    dvname);
3859 }
3860 
3861 static inline void
3862 rtw_disestablish_hooks(struct rtw_hooks *hooks, const char *dvname,
3863     void *arg)
3864 {
3865 	if (hooks->rh_shutdown != NULL)
3866 		shutdownhook_disestablish(hooks->rh_shutdown);
3867 
3868 	if (hooks->rh_power != NULL)
3869 		powerhook_disestablish(hooks->rh_power);
3870 }
3871 
3872 static inline void
3873 rtw_init_radiotap(struct rtw_softc *sc)
3874 {
3875 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3876 	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3877 	sc->sc_rxtap.rr_ihdr.it_present = htole32(RTW_RX_RADIOTAP_PRESENT);
3878 
3879 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3880 	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3881 	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3882 }
3883 
3884 static int
3885 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3886 {
3887 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3888 	SIMPLEQ_INIT(&tsb->tsb_freeq);
3889 	tsb->tsb_ndesc = qlen;
3890 	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3891 	    M_NOWAIT);
3892 	if (tsb->tsb_desc == NULL)
3893 		return ENOMEM;
3894 	return 0;
3895 }
3896 
3897 static void
3898 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3899 {
3900 	int pri;
3901 	struct rtw_txsoft_blk *tsb;
3902 
3903 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3904 		tsb = &sc->sc_txsoft_blk[pri];
3905 		free(tsb->tsb_desc, M_DEVBUF);
3906 		tsb->tsb_desc = NULL;
3907 	}
3908 }
3909 
3910 static int
3911 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3912 {
3913 	int pri, rc = 0;
3914 	int qlen[RTW_NTXPRI] =
3915 	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3916 	struct rtw_txsoft_blk *tsbs;
3917 
3918 	tsbs = sc->sc_txsoft_blk;
3919 
3920 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3921 		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3922 		if (rc != 0)
3923 			break;
3924 	}
3925 	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3926 	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3927 	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3928 	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3929 	return rc;
3930 }
3931 
3932 static void
3933 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3934     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3935 {
3936 	tdb->tdb_ndesc = ndesc;
3937 	tdb->tdb_desc = desc;
3938 	tdb->tdb_physbase = physbase;
3939 	tdb->tdb_ofs = ofs;
3940 
3941 	(void)memset(tdb->tdb_desc, 0,
3942 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3943 
3944 	rtw_txdesc_blk_init(tdb);
3945 	tdb->tdb_next = 0;
3946 }
3947 
3948 static void
3949 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3950 {
3951 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3952 	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3953 	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3954 
3955 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3956 	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3957 	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3958 
3959 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3960 	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3961 	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3962 
3963 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3964 	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3965 	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3966 }
3967 
3968 static struct rtw_rf *
3969 rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3970 {
3971 	rtw_rf_write_t rf_write;
3972 	struct rtw_rf *rf;
3973 
3974 	switch (rfchipid) {
3975 	default:
3976 		rf_write = rtw_rf_hostwrite;
3977 		break;
3978 	case RTW_RFCHIPID_INTERSIL:
3979 	case RTW_RFCHIPID_PHILIPS:
3980 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3981 	case RTW_RFCHIPID_RFMD:
3982 		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3983 		break;
3984 	}
3985 
3986 	switch (rfchipid) {
3987 	case RTW_RFCHIPID_MAXIM:
3988 		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3989 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3990 		break;
3991 	case RTW_RFCHIPID_PHILIPS:
3992 		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
3993 		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3994 		break;
3995 	case RTW_RFCHIPID_RFMD:
3996 		/* XXX RFMD has no RF constructor */
3997 		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3998 		/*FALLTHROUGH*/
3999 	default:
4000 		return NULL;
4001 	}
4002 	rf->rf_continuous_tx_cb =
4003 	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
4004 	rf->rf_continuous_tx_arg = (void *)sc;
4005 	return rf;
4006 }
4007 
4008 /* Revision C and later use a different PHY delay setting than
4009  * revisions A and B.
4010  */
4011 static uint8_t
4012 rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
4013 {
4014 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
4015 #define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
4016 
4017 	uint8_t phydelay = LSHIFT(0x6, RTW_PHYDELAY_PHYDELAY);
4018 
4019 	RTW_WRITE(regs, RTW_RCR, REVAB);
4020 	RTW_WBW(regs, RTW_RCR, RTW_RCR);
4021 	RTW_WRITE(regs, RTW_RCR, REVC);
4022 
4023 	RTW_WBR(regs, RTW_RCR, RTW_RCR);
4024 	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
4025 		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
4026 
4027 	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
4028 	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
4029 
4030 	return phydelay;
4031 #undef REVC
4032 }
4033 
4034 void
4035 rtw_attach(struct rtw_softc *sc)
4036 {
4037 	struct ifnet *ifp = &sc->sc_if;
4038 	struct ieee80211com *ic = &sc->sc_ic;
4039 	struct rtw_txsoft_blk *tsb;
4040 	int pri, rc;
4041 
4042 	rtw_cipher_wep = ieee80211_cipher_wep;
4043 	rtw_cipher_wep.ic_decap = rtw_wep_decap;
4044 
4045 	NEXT_ATTACH_STATE(sc, DETACHED);
4046 
4047 	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
4048 	case RTW_TCR_HWVERID_F:
4049 		sc->sc_hwverid = 'F';
4050 		break;
4051 	case RTW_TCR_HWVERID_D:
4052 		sc->sc_hwverid = 'D';
4053 		break;
4054 	default:
4055 		sc->sc_hwverid = '?';
4056 		break;
4057 	}
4058 	printf("%s: hardware version %c\n", sc->sc_dev.dv_xname,
4059 	    sc->sc_hwverid);
4060 
4061 	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4062 	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4063 	    0);
4064 
4065 	if (rc != 0) {
4066 		printf("%s: could not allocate hw descriptors, error %d\n",
4067 		     sc->sc_dev.dv_xname, rc);
4068 		goto err;
4069 	}
4070 
4071 	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4072 
4073 	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4074 	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4075 	    (caddr_t*)&sc->sc_descs, BUS_DMA_COHERENT);
4076 
4077 	if (rc != 0) {
4078 		printf("%s: could not map hw descriptors, error %d\n",
4079 		    sc->sc_dev.dv_xname, rc);
4080 		goto err;
4081 	}
4082 	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4083 
4084 	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4085 	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4086 
4087 	if (rc != 0) {
4088 		printf("%s: could not create DMA map for hw descriptors, "
4089 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4090 		goto err;
4091 	}
4092 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4093 
4094 	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4095 	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4096 
4097 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4098 		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4099 		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4100 	}
4101 
4102 	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4103 	    sizeof(struct rtw_descs), NULL, 0);
4104 
4105 	if (rc != 0) {
4106 		printf("%s: could not load DMA map for hw descriptors, "
4107 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4108 		goto err;
4109 	}
4110 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4111 
4112 	if (rtw_txsoft_blk_setup_all(sc) != 0)
4113 		goto err;
4114 	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4115 
4116 	rtw_txdesc_blk_setup_all(sc);
4117 
4118 	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4119 
4120 	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4121 
4122 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4123 		tsb = &sc->sc_txsoft_blk[pri];
4124 
4125 		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4126 		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4127 			printf("%s: could not load DMA map for "
4128 			    "hw tx descriptors, error %d\n",
4129 			    sc->sc_dev.dv_xname, rc);
4130 			goto err;
4131 		}
4132 	}
4133 
4134 	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4135 	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4136 	                                    RTW_RXQLEN)) != 0) {
4137 		printf("%s: could not load DMA map for hw rx descriptors, "
4138 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4139 		goto err;
4140 	}
4141 	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4142 
4143 	/* Reset the chip to a known state. */
4144 	if (rtw_reset(sc) != 0)
4145 		goto err;
4146 	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4147 
4148 	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4149 
4150 	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4151 		sc->sc_flags |= RTW_F_9356SROM;
4152 
4153 	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4154 	    sc->sc_dev.dv_xname) != 0)
4155 		goto err;
4156 
4157 	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4158 
4159 	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4160 	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4161 	    sc->sc_dev.dv_xname) != 0) {
4162 		printf("%s: attach failed, malformed serial ROM\n",
4163 		    sc->sc_dev.dv_xname);
4164 		goto err;
4165 	}
4166 
4167 	printf("%s: %s PHY\n", sc->sc_dev.dv_xname,
4168 	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4169 
4170 	printf("%s: CS threshold %u\n", sc->sc_dev.dv_xname, sc->sc_csthr);
4171 
4172 	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4173 
4174 	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4175 	    sc->sc_flags & RTW_F_DIGPHY);
4176 
4177 	if (sc->sc_rf == NULL) {
4178 		printf("%s: attach failed, could not attach RF\n",
4179 		    sc->sc_dev.dv_xname);
4180 		goto err;
4181 	}
4182 
4183 	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4184 
4185 	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4186 
4187 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4188 	    ("%s: PHY delay %d\n", sc->sc_dev.dv_xname, sc->sc_phydelay));
4189 
4190 	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4191 		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4192 
4193 	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels,
4194 	    sc->sc_dev.dv_xname);
4195 
4196 	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4197 	    sc->sc_dev.dv_xname) != 0)
4198 		goto err;
4199 	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4200 
4201 	rtw_setifprops(ifp, sc->sc_dev.dv_xname, (void*)sc);
4202 
4203 	IFQ_SET_READY(&ifp->if_snd);
4204 
4205 	sc->sc_ic.ic_ifp = ifp;
4206 	rtw_set80211props(&sc->sc_ic);
4207 
4208 	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4209 
4210 	/*
4211 	 * Call MI attach routines.
4212 	 */
4213 	if_attach(ifp);
4214 	ieee80211_ifattach(&sc->sc_ic);
4215 
4216 	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4217 
4218 	/* possibly we should fill in our own sc_send_prresp, since
4219 	 * the RTL8180 is probably sending probe responses in ad hoc
4220 	 * mode.
4221 	 */
4222 
4223 	/* complete initialization */
4224 	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4225 	callout_init(&sc->sc_scan_ch);
4226 
4227 	rtw_init_radiotap(sc);
4228 
4229 #if NBPFILTER > 0
4230 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
4231 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4232 #endif
4233 
4234 	rtw_establish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname, (void*)sc);
4235 
4236 	NEXT_ATTACH_STATE(sc, FINISHED);
4237 
4238 	ieee80211_announce(ic);
4239 	return;
4240 err:
4241 	rtw_detach(sc);
4242 	return;
4243 }
4244 
4245 int
4246 rtw_detach(struct rtw_softc *sc)
4247 {
4248 	struct ifnet *ifp = &sc->sc_if;
4249 	int pri;
4250 
4251 	sc->sc_flags |= RTW_F_INVALID;
4252 
4253 	switch (sc->sc_attach_state) {
4254 	case FINISHED:
4255 		rtw_stop(ifp, 1);
4256 
4257 		rtw_disestablish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname,
4258 		    (void*)sc);
4259 		callout_stop(&sc->sc_scan_ch);
4260 		ieee80211_ifdetach(&sc->sc_ic);
4261 		if_detach(ifp);
4262 		break;
4263 	case FINISH_ID_STA:
4264 	case FINISH_RF_ATTACH:
4265 		rtw_rf_destroy(sc->sc_rf);
4266 		sc->sc_rf = NULL;
4267 		/*FALLTHROUGH*/
4268 	case FINISH_PARSE_SROM:
4269 	case FINISH_READ_SROM:
4270 		rtw_srom_free(&sc->sc_srom);
4271 		/*FALLTHROUGH*/
4272 	case FINISH_RESET:
4273 	case FINISH_RXMAPS_CREATE:
4274 		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4275 		    RTW_RXQLEN);
4276 		/*FALLTHROUGH*/
4277 	case FINISH_TXMAPS_CREATE:
4278 		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4279 			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4280 			    sc->sc_txsoft_blk[pri].tsb_desc,
4281 			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4282 		}
4283 		/*FALLTHROUGH*/
4284 	case FINISH_TXDESCBLK_SETUP:
4285 	case FINISH_TXCTLBLK_SETUP:
4286 		rtw_txsoft_blk_cleanup_all(sc);
4287 		/*FALLTHROUGH*/
4288 	case FINISH_DESCMAP_LOAD:
4289 		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4290 		/*FALLTHROUGH*/
4291 	case FINISH_DESCMAP_CREATE:
4292 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4293 		/*FALLTHROUGH*/
4294 	case FINISH_DESC_MAP:
4295 		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_descs,
4296 		    sizeof(struct rtw_descs));
4297 		/*FALLTHROUGH*/
4298 	case FINISH_DESC_ALLOC:
4299 		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4300 		    sc->sc_desc_nsegs);
4301 		/*FALLTHROUGH*/
4302 	case DETACHED:
4303 		NEXT_ATTACH_STATE(sc, DETACHED);
4304 		break;
4305 	}
4306 	return 0;
4307 }
4308 
4309 int
4310 rtw_activate(struct device *self, enum devact act)
4311 {
4312 	struct rtw_softc *sc = (struct rtw_softc *)self;
4313 	int rc = 0, s;
4314 
4315 	s = splnet();
4316 	switch (act) {
4317 	case DVACT_ACTIVATE:
4318 		rc = EOPNOTSUPP;
4319 		break;
4320 
4321 	case DVACT_DEACTIVATE:
4322 		if_deactivate(&sc->sc_if);
4323 		break;
4324 	}
4325 	splx(s);
4326 	return rc;
4327 }
4328