xref: /netbsd-src/sys/dev/ic/rtw.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /* $NetBSD: rtw.c,v 1.128 2018/06/26 06:48:00 msaitoh Exp $ */
2 /*-
3  * Copyright (c) 2004, 2005, 2006, 2007 David Young.  All rights
4  * reserved.
5  *
6  * Programmed for NetBSD by David Young.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
19  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
20  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
21  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
22  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
23  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
28  * OF SUCH DAMAGE.
29  */
30 /*
31  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.128 2018/06/26 06:48:00 msaitoh Exp $");
36 
37 
38 #include <sys/param.h>
39 #include <sys/sysctl.h>
40 #include <sys/systm.h>
41 #include <sys/callout.h>
42 #include <sys/mbuf.h>
43 #include <sys/malloc.h>
44 #include <sys/kernel.h>
45 #include <sys/time.h>
46 #include <sys/types.h>
47 #include <sys/device.h>
48 #include <sys/sockio.h>
49 
50 #include <machine/endian.h>
51 #include <sys/bus.h>
52 #include <sys/intr.h>	/* splnet */
53 
54 #include <net/if.h>
55 #include <net/if_media.h>
56 #include <net/if_ether.h>
57 
58 #include <net80211/ieee80211_netbsd.h>
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_radiotap.h>
61 
62 #include <net/bpf.h>
63 
64 #include <dev/ic/rtwreg.h>
65 #include <dev/ic/rtwvar.h>
66 #include <dev/ic/rtwphyio.h>
67 #include <dev/ic/rtwphy.h>
68 
69 #include <dev/ic/smc93cx6var.h>
70 
71 static int rtw_rfprog_fallback = 0;
72 static int rtw_host_rfio = 0;
73 
74 #ifdef RTW_DEBUG
75 int rtw_debug = 0;
76 static int rtw_rxbufs_limit = RTW_RXQLEN;
77 #endif /* RTW_DEBUG */
78 
79 #define NEXT_ATTACH_STATE(sc, state) do {			\
80 	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
81 	    ("%s: attach state %s\n", __func__, #state));	\
82 	sc->sc_attach_state = state;				\
83 } while (0)
84 
85 int rtw_dwelltime = 200;	/* milliseconds */
86 static struct ieee80211_cipher rtw_cipher_wep;
87 
88 static void rtw_disable_interrupts(struct rtw_regs *);
89 static void rtw_enable_interrupts(struct rtw_softc *);
90 
91 static int rtw_init(struct ifnet *);
92 static void rtw_softintr(void *);
93 
94 static void rtw_start(struct ifnet *);
95 static void rtw_reset_oactive(struct rtw_softc *);
96 static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
97     struct ieee80211_node *);
98 static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
99 
100 static void rtw_io_enable(struct rtw_softc *, uint8_t, int);
101 static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
102 static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
103     const u_int8_t[IEEE80211_ADDR_LEN]);
104 static void rtw_key_update_end(struct ieee80211com *);
105 static void rtw_key_update_begin(struct ieee80211com *);
106 static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
107 static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
108 
109 static void rtw_led_attach(struct rtw_led_state *, void *);
110 static void rtw_led_detach(struct rtw_led_state *);
111 static void rtw_led_init(struct rtw_regs *);
112 static void rtw_led_slowblink(void *);
113 static void rtw_led_fastblink(void *);
114 static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
115 
116 static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
117 static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
118 #ifdef RTW_DEBUG
119 static void rtw_dump_rings(struct rtw_softc *sc);
120 static void rtw_print_txdesc(struct rtw_softc *, const char *,
121     struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
122 static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
123 static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
124 #endif /* RTW_DEBUG */
125 #ifdef RTW_DIAG
126 static void rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln);
127 #endif /* RTW_DIAG */
128 
129 /*
130  * Setup sysctl(3) MIB, hw.rtw.*
131  *
132  * TBD condition CTLFLAG_PERMANENT on being a module or not
133  */
134 SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
135 {
136 	int rc;
137 	const struct sysctlnode *cnode, *rnode;
138 
139 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
140 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
141 	    "Realtek RTL818x 802.11 controls",
142 	    NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL)) != 0)
143 		goto err;
144 
145 #ifdef RTW_DEBUG
146 	/* control debugging printfs */
147 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
148 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
149 	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
150 	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
151 	    CTL_CREATE, CTL_EOL)) != 0)
152 		goto err;
153 
154 	/* Limit rx buffers, for simulating resource exhaustion. */
155 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
156 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
157 	    "rxbufs_limit",
158 	    SYSCTL_DESCR("Set rx buffers limit"),
159 	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
160 	    CTL_CREATE, CTL_EOL)) != 0)
161 		goto err;
162 
163 #endif /* RTW_DEBUG */
164 	/* set fallback RF programming method */
165 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
166 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
167 	    "rfprog_fallback",
168 	    SYSCTL_DESCR("Set fallback RF programming method"),
169 	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
170 	    CTL_CREATE, CTL_EOL)) != 0)
171 		goto err;
172 
173 	/* force host to control RF I/O bus */
174 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
175 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
176 	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
177 	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
178 	    CTL_CREATE, CTL_EOL)) != 0)
179 		goto err;
180 
181 	return;
182 err:
183 	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
184 }
185 
186 static int
187 rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
188 {
189 	int error, t;
190 	struct sysctlnode node;
191 
192 	node = *rnode;
193 	t = *(int*)rnode->sysctl_data;
194 	node.sysctl_data = &t;
195 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
196 	if (error || newp == NULL)
197 		return (error);
198 
199 	if (t < lower || t > upper)
200 		return (EINVAL);
201 
202 	*(int*)rnode->sysctl_data = t;
203 
204 	return (0);
205 }
206 
207 static int
208 rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
209 {
210 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
211 	    __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
212 }
213 
214 static int
215 rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
216 {
217 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
218 }
219 
220 #ifdef RTW_DEBUG
221 static int
222 rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
223 {
224 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
225 	    0, RTW_DEBUG_MAX);
226 }
227 
228 static int
229 rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
230 {
231 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
232 	    0, RTW_RXQLEN);
233 }
234 
235 static void
236 rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
237 {
238 #define PRINTREG32(sc, reg)				\
239 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
240 	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
241 	    dvname, reg, RTW_READ(regs, reg)))
242 
243 #define PRINTREG16(sc, reg)				\
244 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
245 	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
246 	    dvname, reg, RTW_READ16(regs, reg)))
247 
248 #define PRINTREG8(sc, reg)				\
249 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
250 	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
251 	    dvname, reg, RTW_READ8(regs, reg)))
252 
253 	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
254 
255 	PRINTREG32(regs, RTW_IDR0);
256 	PRINTREG32(regs, RTW_IDR1);
257 	PRINTREG32(regs, RTW_MAR0);
258 	PRINTREG32(regs, RTW_MAR1);
259 	PRINTREG32(regs, RTW_TSFTRL);
260 	PRINTREG32(regs, RTW_TSFTRH);
261 	PRINTREG32(regs, RTW_TLPDA);
262 	PRINTREG32(regs, RTW_TNPDA);
263 	PRINTREG32(regs, RTW_THPDA);
264 	PRINTREG32(regs, RTW_TCR);
265 	PRINTREG32(regs, RTW_RCR);
266 	PRINTREG32(regs, RTW_TINT);
267 	PRINTREG32(regs, RTW_TBDA);
268 	PRINTREG32(regs, RTW_ANAPARM);
269 	PRINTREG32(regs, RTW_BB);
270 	PRINTREG32(regs, RTW_PHYCFG);
271 	PRINTREG32(regs, RTW_WAKEUP0L);
272 	PRINTREG32(regs, RTW_WAKEUP0H);
273 	PRINTREG32(regs, RTW_WAKEUP1L);
274 	PRINTREG32(regs, RTW_WAKEUP1H);
275 	PRINTREG32(regs, RTW_WAKEUP2LL);
276 	PRINTREG32(regs, RTW_WAKEUP2LH);
277 	PRINTREG32(regs, RTW_WAKEUP2HL);
278 	PRINTREG32(regs, RTW_WAKEUP2HH);
279 	PRINTREG32(regs, RTW_WAKEUP3LL);
280 	PRINTREG32(regs, RTW_WAKEUP3LH);
281 	PRINTREG32(regs, RTW_WAKEUP3HL);
282 	PRINTREG32(regs, RTW_WAKEUP3HH);
283 	PRINTREG32(regs, RTW_WAKEUP4LL);
284 	PRINTREG32(regs, RTW_WAKEUP4LH);
285 	PRINTREG32(regs, RTW_WAKEUP4HL);
286 	PRINTREG32(regs, RTW_WAKEUP4HH);
287 	PRINTREG32(regs, RTW_DK0);
288 	PRINTREG32(regs, RTW_DK1);
289 	PRINTREG32(regs, RTW_DK2);
290 	PRINTREG32(regs, RTW_DK3);
291 	PRINTREG32(regs, RTW_RETRYCTR);
292 	PRINTREG32(regs, RTW_RDSAR);
293 	PRINTREG32(regs, RTW_FER);
294 	PRINTREG32(regs, RTW_FEMR);
295 	PRINTREG32(regs, RTW_FPSR);
296 	PRINTREG32(regs, RTW_FFER);
297 
298 	/* 16-bit registers */
299 	PRINTREG16(regs, RTW_BRSR);
300 	PRINTREG16(regs, RTW_IMR);
301 	PRINTREG16(regs, RTW_ISR);
302 	PRINTREG16(regs, RTW_BCNITV);
303 	PRINTREG16(regs, RTW_ATIMWND);
304 	PRINTREG16(regs, RTW_BINTRITV);
305 	PRINTREG16(regs, RTW_ATIMTRITV);
306 	PRINTREG16(regs, RTW_CRC16ERR);
307 	PRINTREG16(regs, RTW_CRC0);
308 	PRINTREG16(regs, RTW_CRC1);
309 	PRINTREG16(regs, RTW_CRC2);
310 	PRINTREG16(regs, RTW_CRC3);
311 	PRINTREG16(regs, RTW_CRC4);
312 	PRINTREG16(regs, RTW_CWR);
313 
314 	/* 8-bit registers */
315 	PRINTREG8(regs, RTW_CR);
316 	PRINTREG8(regs, RTW_9346CR);
317 	PRINTREG8(regs, RTW_CONFIG0);
318 	PRINTREG8(regs, RTW_CONFIG1);
319 	PRINTREG8(regs, RTW_CONFIG2);
320 	PRINTREG8(regs, RTW_MSR);
321 	PRINTREG8(regs, RTW_CONFIG3);
322 	PRINTREG8(regs, RTW_CONFIG4);
323 	PRINTREG8(regs, RTW_TESTR);
324 	PRINTREG8(regs, RTW_PSR);
325 	PRINTREG8(regs, RTW_SCR);
326 	PRINTREG8(regs, RTW_PHYDELAY);
327 	PRINTREG8(regs, RTW_CRCOUNT);
328 	PRINTREG8(regs, RTW_PHYADDR);
329 	PRINTREG8(regs, RTW_PHYDATAW);
330 	PRINTREG8(regs, RTW_PHYDATAR);
331 	PRINTREG8(regs, RTW_CONFIG5);
332 	PRINTREG8(regs, RTW_TPPOLL);
333 
334 	PRINTREG16(regs, RTW_BSSID16);
335 	PRINTREG32(regs, RTW_BSSID32);
336 #undef PRINTREG32
337 #undef PRINTREG16
338 #undef PRINTREG8
339 }
340 #endif /* RTW_DEBUG */
341 
342 void
343 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
344 {
345 	struct rtw_regs *regs = &sc->sc_regs;
346 
347 	uint32_t tcr;
348 	tcr = RTW_READ(regs, RTW_TCR);
349 	tcr &= ~RTW_TCR_LBK_MASK;
350 	if (enable)
351 		tcr |= RTW_TCR_LBK_CONT;
352 	else
353 		tcr |= RTW_TCR_LBK_NORMAL;
354 	RTW_WRITE(regs, RTW_TCR, tcr);
355 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
356 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
357 	rtw_txdac_enable(sc, !enable);
358 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
359 	rtw_set_access(regs, RTW_ACCESS_NONE);
360 }
361 
362 #ifdef RTW_DEBUG
363 static const char *
364 rtw_access_string(enum rtw_access access)
365 {
366 	switch (access) {
367 	case RTW_ACCESS_NONE:
368 		return "none";
369 	case RTW_ACCESS_CONFIG:
370 		return "config";
371 	case RTW_ACCESS_ANAPARM:
372 		return "anaparm";
373 	default:
374 		return "unknown";
375 	}
376 }
377 #endif /* RTW_DEBUG */
378 
379 static void
380 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
381 {
382 	KASSERT(/* naccess >= RTW_ACCESS_NONE && */
383 	    naccess <= RTW_ACCESS_ANAPARM);
384 	KASSERT(/* regs->r_access >= RTW_ACCESS_NONE && */
385 	    regs->r_access <= RTW_ACCESS_ANAPARM);
386 
387 	if (naccess == regs->r_access)
388 		return;
389 
390 	switch (naccess) {
391 	case RTW_ACCESS_NONE:
392 		switch (regs->r_access) {
393 		case RTW_ACCESS_ANAPARM:
394 			rtw_anaparm_enable(regs, 0);
395 			/*FALLTHROUGH*/
396 		case RTW_ACCESS_CONFIG:
397 			rtw_config0123_enable(regs, 0);
398 			/*FALLTHROUGH*/
399 		case RTW_ACCESS_NONE:
400 			break;
401 		}
402 		break;
403 	case RTW_ACCESS_CONFIG:
404 		switch (regs->r_access) {
405 		case RTW_ACCESS_NONE:
406 			rtw_config0123_enable(regs, 1);
407 			/*FALLTHROUGH*/
408 		case RTW_ACCESS_CONFIG:
409 			break;
410 		case RTW_ACCESS_ANAPARM:
411 			rtw_anaparm_enable(regs, 0);
412 			break;
413 		}
414 		break;
415 	case RTW_ACCESS_ANAPARM:
416 		switch (regs->r_access) {
417 		case RTW_ACCESS_NONE:
418 			rtw_config0123_enable(regs, 1);
419 			/*FALLTHROUGH*/
420 		case RTW_ACCESS_CONFIG:
421 			rtw_anaparm_enable(regs, 1);
422 			/*FALLTHROUGH*/
423 		case RTW_ACCESS_ANAPARM:
424 			break;
425 		}
426 		break;
427 	}
428 }
429 
430 void
431 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
432 {
433 	rtw_set_access1(regs, access);
434 	RTW_DPRINTF(RTW_DEBUG_ACCESS,
435 	    ("%s: access %s -> %s\n", __func__,
436 	    rtw_access_string(regs->r_access),
437 	    rtw_access_string(access)));
438 	regs->r_access = access;
439 }
440 
441 /*
442  * Enable registers, switch register banks.
443  */
444 void
445 rtw_config0123_enable(struct rtw_regs *regs, int enable)
446 {
447 	uint8_t ecr;
448 	ecr = RTW_READ8(regs, RTW_9346CR);
449 	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
450 	if (enable)
451 		ecr |= RTW_9346CR_EEM_CONFIG;
452 	else {
453 		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
454 		ecr |= RTW_9346CR_EEM_NORMAL;
455 	}
456 	RTW_WRITE8(regs, RTW_9346CR, ecr);
457 	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
458 }
459 
460 /* requires rtw_config0123_enable(, 1) */
461 void
462 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
463 {
464 	uint8_t cfg3;
465 
466 	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
467 	cfg3 |= RTW_CONFIG3_CLKRUNEN;
468 	if (enable)
469 		cfg3 |= RTW_CONFIG3_PARMEN;
470 	else
471 		cfg3 &= ~RTW_CONFIG3_PARMEN;
472 	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
473 	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
474 }
475 
476 /* requires rtw_anaparm_enable(, 1) */
477 void
478 rtw_txdac_enable(struct rtw_softc *sc, int enable)
479 {
480 	uint32_t anaparm;
481 	struct rtw_regs *regs = &sc->sc_regs;
482 
483 	anaparm = RTW_READ(regs, RTW_ANAPARM);
484 	if (enable)
485 		anaparm &= ~RTW_ANAPARM_TXDACOFF;
486 	else
487 		anaparm |= RTW_ANAPARM_TXDACOFF;
488 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
489 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
490 }
491 
492 static inline int
493 rtw_chip_reset1(struct rtw_regs *regs, device_t dev)
494 {
495 	uint8_t cr;
496 	int i;
497 
498 	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
499 
500 	RTW_WBR(regs, RTW_CR, RTW_CR);
501 
502 	for (i = 0; i < 1000; i++) {
503 		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
504 			RTW_DPRINTF(RTW_DEBUG_RESET,
505 			    ("%s: reset in %dus\n", device_xname(dev), i));
506 			return 0;
507 		}
508 		RTW_RBR(regs, RTW_CR, RTW_CR);
509 		DELAY(10); /* 10us */
510 	}
511 
512 	aprint_error_dev(dev, "reset failed\n");
513 	return ETIMEDOUT;
514 }
515 
516 static inline int
517 rtw_chip_reset(struct rtw_regs *regs, device_t dev)
518 {
519 	uint32_t tcr;
520 
521 	/* from Linux driver */
522 	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
523 	      __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
524 
525 	RTW_WRITE(regs, RTW_TCR, tcr);
526 
527 	RTW_WBW(regs, RTW_CR, RTW_TCR);
528 
529 	return rtw_chip_reset1(regs, dev);
530 }
531 
532 static int
533 rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
534 {
535 	struct ieee80211_key keycopy;
536 
537 	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
538 
539 	keycopy = *k;
540 	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
541 
542 	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
543 }
544 
545 static int
546 rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
547 {
548 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
549 
550 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__,
551 	    k->wk_keyix));
552 
553 	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
554 
555 	if (k->wk_keylen != 0 &&
556 	    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP)
557 		sc->sc_flags &= ~RTW_F_DK_VALID;
558 
559 	return 1;
560 }
561 
562 static int
563 rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
564     const u_int8_t mac[IEEE80211_ADDR_LEN])
565 {
566 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
567 
568 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
569 
570 	KASSERT(k->wk_keyix < IEEE80211_WEP_NKID);
571 
572 	sc->sc_flags &= ~RTW_F_DK_VALID;
573 
574 	return 1;
575 }
576 
577 static void
578 rtw_key_update_begin(struct ieee80211com *ic)
579 {
580 #ifdef RTW_DEBUG
581 	struct ifnet *ifp = ic->ic_ifp;
582 	struct rtw_softc *sc = ifp->if_softc;
583 #endif
584 
585 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
586 }
587 
588 static void
589 rtw_tx_kick(struct rtw_regs *regs, uint8_t ringsel)
590 {
591 	uint8_t tppoll;
592 
593 	tppoll = RTW_READ8(regs, RTW_TPPOLL);
594 	tppoll &= ~RTW_TPPOLL_SALL;
595 	tppoll |= ringsel & RTW_TPPOLL_ALL;
596 	RTW_WRITE8(regs, RTW_TPPOLL, tppoll);
597 	RTW_SYNC(regs, RTW_TPPOLL, RTW_TPPOLL);
598 }
599 
600 static void
601 rtw_key_update_end(struct ieee80211com *ic)
602 {
603 	struct ifnet *ifp = ic->ic_ifp;
604 	struct rtw_softc *sc = ifp->if_softc;
605 
606 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
607 
608 	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
609 	    !device_is_active(sc->sc_dev))
610 		return;
611 
612 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
613 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
614 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
615 	    (ifp->if_flags & IFF_RUNNING) != 0);
616 }
617 
618 static bool
619 rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
620 {
621 	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
622 		return false;
623 
624 	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
625 		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
626 }
627 
628 static void
629 rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
630 {
631 	uint8_t psr, scr;
632 	int i, keylen = 0;
633 	struct rtw_regs *regs;
634 	union rtw_keys *rk;
635 
636 	regs = &sc->sc_regs;
637 	rk = &sc->sc_keys;
638 
639 	(void)memset(rk, 0, sizeof(*rk));
640 
641 	/* Temporarily use software crypto for all keys. */
642 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
643 		if (wk[i].wk_cipher == &rtw_cipher_wep)
644 			wk[i].wk_cipher = &ieee80211_cipher_wep;
645 	}
646 
647 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
648 
649 	psr = RTW_READ8(regs, RTW_PSR);
650 	scr = RTW_READ8(regs, RTW_SCR);
651 	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
652 
653 	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
654 		goto out;
655 
656 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
657 		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
658 			continue;
659 		if (i == txkey) {
660 			keylen = wk[i].wk_keylen;
661 			break;
662 		}
663 		keylen = MAX(keylen, wk[i].wk_keylen);
664 	}
665 
666 	if (keylen == 5)
667 		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
668 	else if (keylen == 13)
669 		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
670 
671 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
672 		if (wk[i].wk_keylen != keylen ||
673 		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
674 			continue;
675 		/* h/w will decrypt, s/w still strips headers */
676 		wk[i].wk_cipher = &rtw_cipher_wep;
677 		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
678 	}
679 
680 out:
681 	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
682 
683 	bus_space_write_region_stream_4(regs->r_bt, regs->r_bh,
684 	    RTW_DK0, rk->rk_words, __arraycount(rk->rk_words));
685 
686 	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
687 	    BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
688 
689 	RTW_DPRINTF(RTW_DEBUG_KEY,
690 	    ("%s.%d: scr %02" PRIx8 ", keylen %d\n", __func__, __LINE__, scr,
691 	     keylen));
692 
693 	RTW_WBW(regs, RTW_DK0, RTW_PSR);
694 	RTW_WRITE8(regs, RTW_PSR, psr);
695 	RTW_WBW(regs, RTW_PSR, RTW_SCR);
696 	RTW_WRITE8(regs, RTW_SCR, scr);
697 	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
698 	rtw_set_access(regs, RTW_ACCESS_NONE);
699 	sc->sc_flags |= RTW_F_DK_VALID;
700 }
701 
702 static inline int
703 rtw_recall_eeprom(struct rtw_regs *regs, device_t dev)
704 {
705 	int i;
706 	uint8_t ecr;
707 
708 	ecr = RTW_READ8(regs, RTW_9346CR);
709 	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
710 	RTW_WRITE8(regs, RTW_9346CR, ecr);
711 
712 	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
713 
714 	/* wait 25ms for completion */
715 	for (i = 0; i < 250; i++) {
716 		ecr = RTW_READ8(regs, RTW_9346CR);
717 		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
718 			RTW_DPRINTF(RTW_DEBUG_RESET,
719 			    ("%s: recall EEPROM in %dus\n", device_xname(dev),
720 			    i * 100));
721 			return 0;
722 		}
723 		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
724 		DELAY(100);
725 	}
726 	aprint_error_dev(dev, "recall EEPROM failed\n");
727 	return ETIMEDOUT;
728 }
729 
730 static inline int
731 rtw_reset(struct rtw_softc *sc)
732 {
733 	int rc;
734 	uint8_t config1;
735 
736 	sc->sc_flags &= ~RTW_F_DK_VALID;
737 
738 	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev)) != 0)
739 		return rc;
740 
741 	rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev);
742 
743 	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
744 	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
745 	/* TBD turn off maximum power saving? */
746 
747 	return 0;
748 }
749 
750 static inline int
751 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
752     u_int ndescs)
753 {
754 	int i, rc = 0;
755 	for (i = 0; i < ndescs; i++) {
756 		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
757 		    0, 0, &descs[i].ts_dmamap);
758 		if (rc != 0)
759 			break;
760 	}
761 	return rc;
762 }
763 
764 static inline int
765 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
766     u_int ndescs)
767 {
768 	int i, rc = 0;
769 	for (i = 0; i < ndescs; i++) {
770 		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
771 		    &descs[i].rs_dmamap);
772 		if (rc != 0)
773 			break;
774 	}
775 	return rc;
776 }
777 
778 static inline void
779 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
780     u_int ndescs)
781 {
782 	int i;
783 	for (i = 0; i < ndescs; i++) {
784 		if (descs[i].rs_dmamap != NULL)
785 			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
786 	}
787 }
788 
789 static inline void
790 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
791     u_int ndescs)
792 {
793 	int i;
794 	for (i = 0; i < ndescs; i++) {
795 		if (descs[i].ts_dmamap != NULL)
796 			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
797 	}
798 }
799 
800 static inline void
801 rtw_srom_free(struct rtw_srom *sr)
802 {
803 	sr->sr_size = 0;
804 	if (sr->sr_content == NULL)
805 		return;
806 	free(sr->sr_content, M_DEVBUF);
807 	sr->sr_content = NULL;
808 }
809 
810 static void
811 rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags,
812     uint8_t *cs_threshold, enum rtw_rfchipid *rfchipid, uint32_t *rcr)
813 {
814 	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
815 	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
816 	*rcr |= RTW_RCR_ENCS1;
817 	*rfchipid = RTW_RFCHIPID_PHILIPS;
818 }
819 
820 static int
821 rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
822     enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
823     device_t dev)
824 {
825 	int i;
826 	const char *rfname, *paname;
827 	char scratch[sizeof("unknown 0xXX")];
828 	uint16_t srom_version;
829 
830 	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
831 	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
832 
833 	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
834 
835 	if (srom_version <= 0x0101) {
836 		aprint_error_dev(dev,
837 		    "SROM version %d.%d is not understood, "
838 		    "limping along with defaults\n",
839 		    srom_version >> 8, srom_version & 0xff);
840 		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
841 		return 0;
842 	} else {
843 		aprint_verbose_dev(dev, "SROM version %d.%d\n",
844 		    srom_version >> 8, srom_version & 0xff);
845 	}
846 
847 	uint8_t mac[IEEE80211_ADDR_LEN];
848 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
849 		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
850 	__USE(mac);
851 
852 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
853 	    ("%s: EEPROM MAC %s\n", device_xname(dev), ether_sprintf(mac)));
854 
855 	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
856 
857 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
858 		*flags |= RTW_F_ANTDIV;
859 
860 	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
861 	 * to be reversed.
862 	 */
863 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
864 		*flags |= RTW_F_DIGPHY;
865 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
866 		*flags |= RTW_F_DFLANTB;
867 
868 	*rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
869 	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
870 
871 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
872 		*flags |= RTW_C_RXWEP_104;
873 
874 	*flags |= RTW_C_RXWEP_40;	/* XXX */
875 
876 	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
877 	switch (*rfchipid) {
878 	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
879 		rfname = "GCT GRF5101";
880 		paname = "Winspring WS9901";
881 		break;
882 	case RTW_RFCHIPID_MAXIM:
883 		rfname = "Maxim MAX2820";	/* guess */
884 		paname = "Maxim MAX2422";	/* guess */
885 		break;
886 	case RTW_RFCHIPID_INTERSIL:
887 		rfname = "Intersil HFA3873";	/* guess */
888 		paname = "Intersil <unknown>";
889 		break;
890 	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
891 		rfname = "Philips SA2400A";
892 		paname = "Philips SA2411";
893 		break;
894 	case RTW_RFCHIPID_RFMD:
895 		/* this is the same front-end as an atw(4)! */
896 		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
897 			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
898 			 "SYN: Silicon Labs Si4126";	/* inferred from
899 			 				 * reference driver
900 							 */
901 		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
902 		break;
903 	case RTW_RFCHIPID_RESERVED:
904 		rfname = paname = "reserved";
905 		break;
906 	default:
907 		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
908 		rfname = paname = scratch;
909 	}
910 	aprint_normal_dev(dev, "RF: %s, PA: %s\n", rfname, paname);
911 
912 	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
913 	case RTW_CONFIG0_GL_USA:
914 	case _RTW_CONFIG0_GL_USA:
915 		*locale = RTW_LOCALE_USA;
916 		break;
917 	case RTW_CONFIG0_GL_EUROPE:
918 		*locale = RTW_LOCALE_EUROPE;
919 		break;
920 	case RTW_CONFIG0_GL_JAPAN:
921 		*locale = RTW_LOCALE_JAPAN;
922 		break;
923 	default:
924 		*locale = RTW_LOCALE_UNKNOWN;
925 		break;
926 	}
927 	return 0;
928 }
929 
930 /* Returns -1 on failure. */
931 static int
932 rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
933     device_t dev)
934 {
935 	int rc;
936 	struct seeprom_descriptor sd;
937 	uint8_t ecr;
938 
939 	(void)memset(&sd, 0, sizeof(sd));
940 
941 	ecr = RTW_READ8(regs, RTW_9346CR);
942 
943 	if ((flags & RTW_F_9356SROM) != 0) {
944 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n",
945 		    device_xname(dev)));
946 		sr->sr_size = 256;
947 		sd.sd_chip = C56_66;
948 	} else {
949 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n",
950 		    device_xname(dev)));
951 		sr->sr_size = 128;
952 		sd.sd_chip = C46;
953 	}
954 
955 	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
956 	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
957 	ecr |= RTW_9346CR_EEM_PROGRAM;
958 
959 	RTW_WRITE8(regs, RTW_9346CR, ecr);
960 
961 	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
962 
963 	if (sr->sr_content == NULL) {
964 		aprint_error_dev(dev, "unable to allocate SROM buffer\n");
965 		return ENOMEM;
966 	}
967 
968 	(void)memset(sr->sr_content, 0, sr->sr_size);
969 
970 	/* RTL8180 has a single 8-bit register for controlling the
971 	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
972 	 * input/output sense is the reverse of read_seeprom's.
973 	 */
974 	sd.sd_tag = regs->r_bt;
975 	sd.sd_bsh = regs->r_bh;
976 	sd.sd_regsize = 1;
977 	sd.sd_control_offset = RTW_9346CR;
978 	sd.sd_status_offset = RTW_9346CR;
979 	sd.sd_dataout_offset = RTW_9346CR;
980 	sd.sd_CK = RTW_9346CR_EESK;
981 	sd.sd_CS = RTW_9346CR_EECS;
982 	sd.sd_DI = RTW_9346CR_EEDO;
983 	sd.sd_DO = RTW_9346CR_EEDI;
984 	/* make read_seeprom enter EEPROM read/write mode */
985 	sd.sd_MS = ecr;
986 	sd.sd_RDY = 0;
987 
988 	/* TBD bus barriers */
989 	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
990 		aprint_error_dev(dev, "could not read SROM\n");
991 		free(sr->sr_content, M_DEVBUF);
992 		sr->sr_content = NULL;
993 		return -1;	/* XXX */
994 	}
995 
996 	/* end EEPROM read/write mode */
997 	RTW_WRITE8(regs, RTW_9346CR,
998 	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
999 	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
1000 
1001 	if ((rc = rtw_recall_eeprom(regs, dev)) != 0)
1002 		return rc;
1003 
1004 #ifdef RTW_DEBUG
1005 	{
1006 		int i;
1007 		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1008 		    ("\n%s: serial ROM:\n\t", device_xname(dev)));
1009 		for (i = 0; i < sr->sr_size/2; i++) {
1010 			if (((i % 8) == 0) && (i != 0))
1011 				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1012 			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1013 			    (" %04x", sr->sr_content[i]));
1014 		}
1015 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1016 	}
1017 #endif /* RTW_DEBUG */
1018 	return 0;
1019 }
1020 
1021 static void
1022 rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1023     device_t dev)
1024 {
1025 	uint8_t cfg4;
1026 	const char *method;
1027 
1028 	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1029 
1030 	switch (rfchipid) {
1031 	default:
1032 		cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1033 		method = "fallback";
1034 		break;
1035 	case RTW_RFCHIPID_INTERSIL:
1036 		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1037 		method = "Intersil";
1038 		break;
1039 	case RTW_RFCHIPID_PHILIPS:
1040 		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1041 		method = "Philips";
1042 		break;
1043 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1044 	case RTW_RFCHIPID_RFMD:
1045 		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1046 		method = "RFMD";
1047 		break;
1048 	}
1049 
1050 	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1051 
1052 	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1053 
1054 #ifdef RTW_DEBUG
1055 	RTW_DPRINTF(RTW_DEBUG_INIT,
1056 	    ("%s: %s RF programming method, %#02x\n", device_xname(dev), method,
1057 	    RTW_READ8(regs, RTW_CONFIG4)));
1058 #else
1059 	__USE(method);
1060 #endif
1061 }
1062 
1063 static inline void
1064 rtw_init_channels(enum rtw_locale locale,
1065     struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1], device_t dev)
1066 {
1067 	int i;
1068 	const char *name = NULL;
1069 #define ADD_CHANNEL(_chans, _chan) do {			\
1070 	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1071 	(*_chans)[_chan].ic_freq =				\
1072 	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1073 } while (0)
1074 
1075 	switch (locale) {
1076 	case RTW_LOCALE_USA:	/* 1-11 */
1077 		name = "USA";
1078 		for (i = 1; i <= 11; i++)
1079 			ADD_CHANNEL(chans, i);
1080 		break;
1081 	case RTW_LOCALE_JAPAN:	/* 1-14 */
1082 		name = "Japan";
1083 		ADD_CHANNEL(chans, 14);
1084 		for (i = 1; i <= 14; i++)
1085 			ADD_CHANNEL(chans, i);
1086 		break;
1087 	case RTW_LOCALE_EUROPE:	/* 1-13 */
1088 		name = "Europe";
1089 		for (i = 1; i <= 13; i++)
1090 			ADD_CHANNEL(chans, i);
1091 		break;
1092 	default:			/* 10-11 allowed by most countries */
1093 		name = "<unknown>";
1094 		for (i = 10; i <= 11; i++)
1095 			ADD_CHANNEL(chans, i);
1096 		break;
1097 	}
1098 	aprint_normal_dev(dev, "Geographic Location %s\n", name);
1099 #undef ADD_CHANNEL
1100 }
1101 
1102 
1103 static inline void
1104 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1105 {
1106 	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1107 
1108 	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1109 	case RTW_CONFIG0_GL_USA:
1110 	case _RTW_CONFIG0_GL_USA:
1111 		*locale = RTW_LOCALE_USA;
1112 		break;
1113 	case RTW_CONFIG0_GL_JAPAN:
1114 		*locale = RTW_LOCALE_JAPAN;
1115 		break;
1116 	case RTW_CONFIG0_GL_EUROPE:
1117 		*locale = RTW_LOCALE_EUROPE;
1118 		break;
1119 	default:
1120 		*locale = RTW_LOCALE_UNKNOWN;
1121 		break;
1122 	}
1123 }
1124 
1125 static inline int
1126 rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1127     device_t dev)
1128 {
1129 	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1130 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1131 	};
1132 	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1133 	          idr1 = RTW_READ(regs, RTW_IDR1);
1134 
1135 	(*addr)[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1136 	(*addr)[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1137 	(*addr)[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1138 	(*addr)[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
1139 
1140 	(*addr)[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1141 	(*addr)[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1142 
1143 	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1144 		aprint_error_dev(dev,
1145 		    "could not get mac address, attach failed\n");
1146 		return ENXIO;
1147 	}
1148 
1149 	aprint_normal_dev(dev, "802.11 address %s\n", ether_sprintf(*addr));
1150 
1151 	return 0;
1152 }
1153 
1154 static uint8_t
1155 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1156     struct ieee80211_channel *chan)
1157 {
1158 	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1159 	KASSERT(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14);
1160 	return RTW_SR_GET(sr, idx);
1161 }
1162 
1163 static void
1164 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1165 {
1166 	int pri;
1167 	/* nfree: the number of free descriptors in each ring.
1168 	 * The beacon ring is a special case: I do not let the
1169 	 * driver use all of the descriptors on the beacon ring.
1170 	 * The reasons are two-fold:
1171 	 *
1172 	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1173 	 * updated, so the driver cannot easily know if the descriptor
1174 	 * belongs to it, or if it is racing the NIC.  If the NIC
1175 	 * does not OWN every descriptor, then the driver can safely
1176 	 * update the descriptors when RTW_TBDA points at tdb_next.
1177 	 *
1178 	 * (2) I hope that the NIC will process more than one BEACON
1179 	 * descriptor in a single beacon interval, since that will
1180 	 * enable multiple-BSS support.  Since the NIC does not
1181 	 * clear the OWN bit, there is no natural place for it to
1182 	 * stop processing BEACON desciptors.  Maybe it will *not*
1183 	 * stop processing them!  I do not want to chance the NIC
1184 	 * looping around and around a saturated beacon ring, so
1185 	 * I will leave one descriptor unOWNed at all times.
1186 	 */
1187 	u_int nfree[RTW_NTXPRI] =
1188 	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1189 	     RTW_NTXDESCBCN - 1};
1190 
1191 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1192 		tdb[pri].tdb_nfree = nfree[pri];
1193 		tdb[pri].tdb_next = 0;
1194 	}
1195 }
1196 
1197 static int
1198 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1199 {
1200 	int i;
1201 	struct rtw_txsoft *ts;
1202 
1203 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1204 	SIMPLEQ_INIT(&tsb->tsb_freeq);
1205 	for (i = 0; i < tsb->tsb_ndesc; i++) {
1206 		ts = &tsb->tsb_desc[i];
1207 		ts->ts_mbuf = NULL;
1208 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1209 	}
1210 	tsb->tsb_tx_timer = 0;
1211 	return 0;
1212 }
1213 
1214 static void
1215 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1216 {
1217 	int pri;
1218 	for (pri = 0; pri < RTW_NTXPRI; pri++)
1219 		rtw_txsoft_blk_init(&tsb[pri]);
1220 }
1221 
1222 static inline void
1223 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1224 {
1225 	KASSERT(nsync <= rdb->rdb_ndesc);
1226 	/* sync to end of ring */
1227 	if (desc0 + nsync > rdb->rdb_ndesc) {
1228 		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1229 		    offsetof(struct rtw_descs, hd_rx[desc0]),
1230 		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1231 		nsync -= (rdb->rdb_ndesc - desc0);
1232 		desc0 = 0;
1233 	}
1234 
1235 	KASSERT(desc0 < rdb->rdb_ndesc);
1236 	KASSERT(nsync <= rdb->rdb_ndesc);
1237 	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1238 
1239 	/* sync what remains */
1240 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1241 	    offsetof(struct rtw_descs, hd_rx[desc0]),
1242 	    sizeof(struct rtw_rxdesc) * nsync, ops);
1243 }
1244 
1245 static void
1246 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1247 {
1248 	/* sync to end of ring */
1249 	if (desc0 + nsync > tdb->tdb_ndesc) {
1250 		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1251 		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1252 		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1253 		    ops);
1254 		nsync -= (tdb->tdb_ndesc - desc0);
1255 		desc0 = 0;
1256 	}
1257 
1258 	/* sync what remains */
1259 	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1260 	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1261 	    sizeof(struct rtw_txdesc) * nsync, ops);
1262 }
1263 
1264 static void
1265 rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1266 {
1267 	int pri;
1268 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1269 		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1270 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1271 	}
1272 }
1273 
1274 static void
1275 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1276 {
1277 	int i;
1278 	struct rtw_rxsoft *rs;
1279 
1280 	for (i = 0; i < RTW_RXQLEN; i++) {
1281 		rs = &desc[i];
1282 		if (rs->rs_mbuf == NULL)
1283 			continue;
1284 		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1285 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1286 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1287 		m_freem(rs->rs_mbuf);
1288 		rs->rs_mbuf = NULL;
1289 	}
1290 }
1291 
1292 static inline int
1293 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1294 {
1295 	int rc;
1296 	struct mbuf *m;
1297 
1298 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1299 	if (m == NULL)
1300 		return ENOBUFS;
1301 
1302 	MCLGET(m, M_DONTWAIT);
1303 	if ((m->m_flags & M_EXT) == 0) {
1304 		m_freem(m);
1305 		return ENOBUFS;
1306 	}
1307 
1308 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1309 
1310 	if (rs->rs_mbuf != NULL)
1311 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1312 
1313 	rs->rs_mbuf = NULL;
1314 
1315 	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1316 	if (rc != 0) {
1317 		m_freem(m);
1318 		return -1;
1319 	}
1320 
1321 	rs->rs_mbuf = m;
1322 
1323 	return 0;
1324 }
1325 
1326 static int
1327 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1328     int *ndesc, device_t dev)
1329 {
1330 	int i, rc = 0;
1331 	struct rtw_rxsoft *rs;
1332 
1333 	for (i = 0; i < RTW_RXQLEN; i++) {
1334 		rs = &desc[i];
1335 		/* we're in rtw_init, so there should be no mbufs allocated */
1336 		KASSERT(rs->rs_mbuf == NULL);
1337 #ifdef RTW_DEBUG
1338 		if (i == rtw_rxbufs_limit) {
1339 			aprint_error_dev(dev, "TEST hit %d-buffer limit\n", i);
1340 			rc = ENOBUFS;
1341 			break;
1342 		}
1343 #endif /* RTW_DEBUG */
1344 		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1345 			aprint_error_dev(dev,
1346 			    "rtw_rxsoft_alloc failed, %d buffers, rc %d\n",
1347 			    i, rc);
1348 			break;
1349 		}
1350 	}
1351 	*ndesc = i;
1352 	return rc;
1353 }
1354 
1355 static inline void
1356 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1357     int idx, int kick)
1358 {
1359 	int is_last = (idx == rdb->rdb_ndesc - 1);
1360 	uint32_t ctl, octl, obuf;
1361 	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1362 
1363 	/* sync the mbuf before the descriptor */
1364 	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1365 	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1366 
1367 	obuf = rd->rd_buf;
1368 	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1369 
1370 	ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1371 	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1372 
1373 	if (is_last)
1374 		ctl |= RTW_RXCTL_EOR;
1375 
1376 	octl = rd->rd_ctl;
1377 	rd->rd_ctl = htole32(ctl);
1378 
1379 #ifdef RTW_DEBUG
1380 	RTW_DPRINTF(
1381 	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1382 	         : RTW_DEBUG_RECV_DESC,
1383 	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1384 	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1385 	     le32toh(rd->rd_ctl)));
1386 #else
1387 	__USE(octl);
1388 	__USE(obuf);
1389 #endif
1390 
1391 	/* sync the descriptor */
1392 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1393 	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1394 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1395 }
1396 
1397 static void
1398 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1399 {
1400 	int i;
1401 	struct rtw_rxsoft *rs;
1402 
1403 	for (i = 0; i < rdb->rdb_ndesc; i++) {
1404 		rs = &ctl[i];
1405 		rtw_rxdesc_init(rdb, rs, i, kick);
1406 	}
1407 }
1408 
1409 static void
1410 rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1411 {
1412 	struct rtw_regs *regs = &sc->sc_regs;
1413 	uint8_t cr;
1414 
1415 	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1416 	    enable ? "enable" : "disable", flags));
1417 
1418 	cr = RTW_READ8(regs, RTW_CR);
1419 
1420 	/* XXX reference source does not enable MULRW */
1421 	/* enable PCI Read/Write Multiple */
1422 	cr |= RTW_CR_MULRW;
1423 
1424 	/* The receive engine will always start at RDSAR.  */
1425 	if (enable && (flags & ~cr & RTW_CR_RE)) {
1426 		struct rtw_rxdesc_blk *rdb;
1427 		rdb = &sc->sc_rxdesc_blk;
1428 		rdb->rdb_next = 0;
1429 	}
1430 
1431 	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1432 	if (enable)
1433 		cr |= flags;
1434 	else
1435 		cr &= ~flags;
1436 	RTW_WRITE8(regs, RTW_CR, cr);
1437 	RTW_SYNC(regs, RTW_CR, RTW_CR);
1438 
1439 #ifdef RTW_DIAG
1440 	if (cr & RTW_CR_TE)
1441 		rtw_txring_fixup(sc, __func__, __LINE__);
1442 #endif
1443 	if (cr & RTW_CR_TE) {
1444 		rtw_tx_kick(&sc->sc_regs,
1445 		    RTW_TPPOLL_HPQ | RTW_TPPOLL_NPQ | RTW_TPPOLL_LPQ);
1446 	}
1447 }
1448 
1449 static void
1450 rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1451 {
1452 #define	IS_BEACON(__fc0)						\
1453     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1454      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1455 
1456 	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1457 							 * hardware -> net80211
1458 							 */
1459 	u_int next, nproc = 0;
1460 	int hwrate, len, rate, rssi, sq, s;
1461 	uint32_t hrssi, hstat, htsfth, htsftl;
1462 	struct rtw_rxdesc *rd;
1463 	struct rtw_rxsoft *rs;
1464 	struct rtw_rxdesc_blk *rdb;
1465 	struct mbuf *m;
1466 	struct ifnet *ifp = &sc->sc_if;
1467 
1468 	struct ieee80211_node *ni;
1469 	struct ieee80211_frame_min *wh;
1470 
1471 	rdb = &sc->sc_rxdesc_blk;
1472 
1473 	for (next = rdb->rdb_next; ; next = rdb->rdb_next) {
1474 		KASSERT(next < rdb->rdb_ndesc);
1475 
1476 		rtw_rxdescs_sync(rdb, next, 1,
1477 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1478 		rd = &rdb->rdb_desc[next];
1479 		rs = &sc->sc_rxsoft[next];
1480 
1481 		hstat = le32toh(rd->rd_stat);
1482 		hrssi = le32toh(rd->rd_rssi);
1483 		htsfth = le32toh(rd->rd_tsfth);
1484 		htsftl = le32toh(rd->rd_tsftl);
1485 
1486 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1487 		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1488 		    __func__, next, hstat, hrssi, htsfth, htsftl));
1489 
1490 		++nproc;
1491 
1492 		/* still belongs to NIC */
1493 		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1494 			rtw_rxdescs_sync(rdb, next, 1, BUS_DMASYNC_PREREAD);
1495 			break;
1496 		}
1497 
1498                 /* ieee80211_input() might reset the receive engine
1499                  * (e.g. by indirectly calling rtw_tune()), so save
1500                  * the next pointer here and retrieve it again on
1501                  * the next round.
1502 		 */
1503 		rdb->rdb_next = (next + 1) % rdb->rdb_ndesc;
1504 
1505 #ifdef RTW_DEBUG
1506 #define PRINTSTAT(flag) do { \
1507 	if ((hstat & flag) != 0) { \
1508 		printf("%s" #flag, delim); \
1509 		delim = ","; \
1510 	} \
1511 } while (0)
1512 		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1513 			const char *delim = "<";
1514 			printf("%s: ", device_xname(sc->sc_dev));
1515 			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1516 				printf("status %08x", hstat);
1517 				PRINTSTAT(RTW_RXSTAT_SPLCP);
1518 				PRINTSTAT(RTW_RXSTAT_MAR);
1519 				PRINTSTAT(RTW_RXSTAT_PAR);
1520 				PRINTSTAT(RTW_RXSTAT_BAR);
1521 				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1522 				PRINTSTAT(RTW_RXSTAT_CRC32);
1523 				PRINTSTAT(RTW_RXSTAT_ICV);
1524 				printf(">, ");
1525 			}
1526 		}
1527 #endif /* RTW_DEBUG */
1528 
1529 		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1530 			aprint_error_dev(sc->sc_dev,
1531 			    "DMA error/FIFO overflow %08" PRIx32 ", "
1532 			    "rx descriptor %d\n", hstat, next);
1533 			ifp->if_ierrors++;
1534 			goto next;
1535 		}
1536 
1537 		len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1538 		if (len < IEEE80211_MIN_LEN) {
1539 			sc->sc_ic.ic_stats.is_rx_tooshort++;
1540 			goto next;
1541 		}
1542 		if (len > rs->rs_mbuf->m_len) {
1543 			aprint_error_dev(sc->sc_dev,
1544 			    "rx frame too long, %d > %d, %08" PRIx32
1545 			    ", desc %d\n",
1546 			    len, rs->rs_mbuf->m_len, hstat, next);
1547 			ifp->if_ierrors++;
1548 			goto next;
1549 		}
1550 
1551 		hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1552 		if (hwrate >= __arraycount(ratetbl)) {
1553 			aprint_error_dev(sc->sc_dev,
1554 			    "unknown rate #%" __PRIuBITS "\n",
1555 			    __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1556 			ifp->if_ierrors++;
1557 			goto next;
1558 		}
1559 		rate = ratetbl[hwrate];
1560 
1561 #ifdef RTW_DEBUG
1562 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1563 		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1564 		     (rate * 5) % 10, htsfth, htsftl));
1565 #endif /* RTW_DEBUG */
1566 
1567 		/* if bad flags, skip descriptor */
1568 		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1569 			aprint_error_dev(sc->sc_dev, "too many rx segments, "
1570 			    "next=%d, %08" PRIx32 "\n", next, hstat);
1571 			goto next;
1572 		}
1573 
1574 		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1575 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1576 
1577 		m = rs->rs_mbuf;
1578 
1579 		/* if temporarily out of memory, re-use mbuf */
1580 		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1581 		case 0:
1582 			break;
1583 		case ENOBUFS:
1584 			aprint_error_dev(sc->sc_dev,
1585 			    "rtw_rxsoft_alloc(, %d) failed, dropping packet\n",
1586 			    next);
1587 			goto next;
1588 		default:
1589 			/* XXX shorten rx ring, instead? */
1590 			aprint_error_dev(sc->sc_dev,
1591 			    "could not load DMA map\n");
1592 		}
1593 
1594 		sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1595 
1596 		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1597 			rssi = UINT8_MAX - sq;
1598 		else {
1599 			rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1600 			/* TBD find out each front-end's LNA gain in the
1601 			 * front-end's units
1602 			 */
1603 			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1604 				rssi |= 0x80;
1605 		}
1606 
1607 		/* Note well: now we cannot recycle the rs_mbuf unless
1608 		 * we restore its original length.
1609 		 */
1610 		m_set_rcvif(m, ifp);
1611 		m->m_pkthdr.len = m->m_len = len;
1612 
1613 		wh = mtod(m, struct ieee80211_frame_min *);
1614 
1615 		s = splnet();
1616 
1617 		if (!IS_BEACON(wh->i_fc[0]))
1618 			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1619 
1620 		sc->sc_tsfth = htsfth;
1621 
1622 #ifdef RTW_DEBUG
1623 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1624 		    (IFF_DEBUG|IFF_LINK2)) {
1625 			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1626 			    rate, rssi);
1627 		}
1628 #endif /* RTW_DEBUG */
1629 
1630 		if (sc->sc_radiobpf != NULL) {
1631 			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1632 
1633 			rr->rr_tsft =
1634 			    htole64(((uint64_t)htsfth << 32) | htsftl);
1635 
1636 			rr->rr_flags = IEEE80211_RADIOTAP_F_FCS;
1637 
1638 			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1639 				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1640 			if ((hstat & RTW_RXSTAT_CRC32) != 0)
1641 				rr->rr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1642 
1643 			rr->rr_rate = rate;
1644 
1645 			if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1646 				rr->rr_u.u_philips.p_antsignal = rssi;
1647 			else {
1648 				rr->rr_u.u_other.o_antsignal = rssi;
1649 				rr->rr_u.u_other.o_barker_lock =
1650 				    htole16(UINT8_MAX - sq);
1651 			}
1652 
1653 			bpf_mtap2(sc->sc_radiobpf,
1654 			    rr, sizeof(sc->sc_rxtapu), m, BPF_D_IN);
1655 		}
1656 
1657 		if ((hstat & RTW_RXSTAT_RES) != 0) {
1658 			m_freem(m);
1659 			splx(s);
1660 			goto next;
1661 		}
1662 
1663 		/* CRC is included with the packet; trim it off. */
1664 		m_adj(m, -IEEE80211_CRC_LEN);
1665 
1666 		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1667 		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1668 		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1669 		ieee80211_free_node(ni);
1670 		splx(s);
1671 next:
1672 		rtw_rxdesc_init(rdb, rs, next, 0);
1673 	}
1674 #undef IS_BEACON
1675 }
1676 
1677 static void
1678 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1679     struct rtw_txsoft *ts)
1680 {
1681 	struct mbuf *m;
1682 	struct ieee80211_node *ni;
1683 
1684 	m = ts->ts_mbuf;
1685 	ni = ts->ts_ni;
1686 	KASSERT(m != NULL);
1687 	KASSERT(ni != NULL);
1688 	ts->ts_mbuf = NULL;
1689 	ts->ts_ni = NULL;
1690 
1691 	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1692 	    BUS_DMASYNC_POSTWRITE);
1693 	bus_dmamap_unload(dmat, ts->ts_dmamap);
1694 	m_freem(m);
1695 	ieee80211_free_node(ni);
1696 }
1697 
1698 static void
1699 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1700     struct rtw_txsoft_blk *tsb)
1701 {
1702 	struct rtw_txsoft *ts;
1703 
1704 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1705 		rtw_txsoft_release(dmat, ic, ts);
1706 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1707 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1708 	}
1709 	tsb->tsb_tx_timer = 0;
1710 }
1711 
1712 static inline void
1713 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1714     struct rtw_txsoft *ts, int ndesc)
1715 {
1716 	uint32_t hstat;
1717 	int data_retry, rts_retry;
1718 	struct rtw_txdesc *tdn;
1719 	const char *condstring;
1720 	struct ifnet *ifp = &sc->sc_if;
1721 
1722 	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1723 
1724 	tdb->tdb_nfree += ndesc;
1725 
1726 	tdn = &tdb->tdb_desc[ts->ts_last];
1727 
1728 	hstat = le32toh(tdn->td_stat);
1729 	rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1730 	data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1731 
1732 	ifp->if_collisions += rts_retry + data_retry;
1733 
1734 	if ((hstat & RTW_TXSTAT_TOK) != 0)
1735 		condstring = "ok";
1736 	else {
1737 		ifp->if_oerrors++;
1738 		condstring = "error";
1739 	}
1740 
1741 #ifdef RTW_DEBUG
1742 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1743 	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1744 	    device_xname(sc->sc_dev), ts, ts->ts_first, ts->ts_last,
1745 	    condstring, rts_retry, data_retry));
1746 #else
1747 	__USE(condstring);
1748 #endif
1749 }
1750 
1751 static void
1752 rtw_reset_oactive(struct rtw_softc *sc)
1753 {
1754 	short oflags;
1755 	int pri;
1756 	struct rtw_txsoft_blk *tsb;
1757 	struct rtw_txdesc_blk *tdb;
1758 	oflags = sc->sc_if.if_flags;
1759 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1760 		tsb = &sc->sc_txsoft_blk[pri];
1761 		tdb = &sc->sc_txdesc_blk[pri];
1762 		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1763 			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1764 	}
1765 	if (oflags != sc->sc_if.if_flags) {
1766 		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1767 		    ("%s: reset OACTIVE\n", __func__));
1768 	}
1769 }
1770 
1771 /* Collect transmitted packets. */
1772 static bool
1773 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1774     struct rtw_txdesc_blk *tdb, int force)
1775 {
1776 	bool collected = false;
1777 	int ndesc;
1778 	struct rtw_txsoft *ts;
1779 
1780 #ifdef RTW_DEBUG
1781 	rtw_dump_rings(sc);
1782 #endif
1783 
1784 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1785 		/* If we're clearing a failed transmission, only clear
1786 		   up to the last packet the hardware has processed.  */
1787 		if (ts->ts_first == rtw_txring_next(&sc->sc_regs, tdb))
1788 			break;
1789 
1790 		ndesc = 1 + ts->ts_last - ts->ts_first;
1791 		if (ts->ts_last < ts->ts_first)
1792 			ndesc += tdb->tdb_ndesc;
1793 
1794 		KASSERT(ndesc > 0);
1795 
1796 		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1797 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1798 
1799 		if (force) {
1800 			int next;
1801 #ifdef RTW_DIAG
1802 			printf("%s: clearing packet, stats", __func__);
1803 #endif
1804 			for (next = ts->ts_first; ;
1805 			    next = RTW_NEXT_IDX(tdb, next)) {
1806 #ifdef RTW_DIAG
1807 				printf(" %" PRIx32 "/%" PRIx32 "/%" PRIx32 "/%" PRIu32 "/%" PRIx32, le32toh(tdb->tdb_desc[next].td_stat), le32toh(tdb->tdb_desc[next].td_ctl1), le32toh(tdb->tdb_desc[next].td_buf), le32toh(tdb->tdb_desc[next].td_len), le32toh(tdb->tdb_desc[next].td_next));
1808 #endif
1809 				tdb->tdb_desc[next].td_stat &=
1810 				    ~htole32(RTW_TXSTAT_OWN);
1811 				if (next == ts->ts_last)
1812 					break;
1813 			}
1814 			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1815 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1816 #ifdef RTW_DIAG
1817 			next = RTW_NEXT_IDX(tdb, next);
1818 			printf(" -> end %u stat %" PRIx32 ", was %u\n", next,
1819 			    le32toh(tdb->tdb_desc[next].td_stat),
1820 			    rtw_txring_next(&sc->sc_regs, tdb));
1821 #endif
1822 		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1823 		    htole32(RTW_TXSTAT_OWN)) != 0) {
1824 			rtw_txdescs_sync(tdb, ts->ts_last, 1,
1825 			    BUS_DMASYNC_PREREAD);
1826 			break;
1827 		}
1828 
1829 		collected = true;
1830 
1831 		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1832 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1833 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1834 	}
1835 
1836 	/* no more pending transmissions, cancel watchdog */
1837 	if (ts == NULL)
1838 		tsb->tsb_tx_timer = 0;
1839 	rtw_reset_oactive(sc);
1840 
1841 	return collected;
1842 }
1843 
1844 static void
1845 rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1846 {
1847 	int pri, s;
1848 	struct rtw_txsoft_blk	*tsb;
1849 	struct rtw_txdesc_blk	*tdb;
1850 	struct ifnet *ifp = &sc->sc_if;
1851 
1852 	s = splnet();
1853 
1854 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1855 		tsb = &sc->sc_txsoft_blk[pri];
1856 		tdb = &sc->sc_txdesc_blk[pri];
1857 		rtw_collect_txring(sc, tsb, tdb, 0);
1858 	}
1859 
1860 	if ((isr & RTW_INTR_TX) != 0)
1861 		rtw_start(ifp); /* in softint */
1862 
1863 	splx(s);
1864 }
1865 
1866 static void
1867 rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1868 {
1869 	u_int next;
1870 	uint32_t tsfth, tsftl;
1871 	struct ieee80211com *ic;
1872 	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1873 	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1874 	struct mbuf *m;
1875 	int s;
1876 
1877 	s = splnet();
1878 
1879 	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1880 	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1881 
1882 	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1883 		next = rtw_txring_next(&sc->sc_regs, tdb);
1884 #ifdef RTW_DEBUG
1885 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1886 		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1887 		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1888 		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1889 		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1890 #else
1891 		__USE(next);
1892 		__USE(tsfth);
1893 		__USE(tsftl);
1894 #endif
1895 		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0)
1896 			rtw_collect_txring(sc, tsb, tdb, 1);
1897 	}
1898 	/* Start beacon transmission. */
1899 
1900 	if ((isr & RTW_INTR_BCNINT) != 0 &&
1901 	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1902 	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1903 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1904 		    ("%s: beacon prep. time, isr = %#04" PRIx16
1905 		     ", %16" PRIu64 "\n", __func__, isr,
1906 		     (uint64_t)tsfth << 32 | tsftl));
1907 		ic = &sc->sc_ic;
1908 		m = rtw_beacon_alloc(sc, ic->ic_bss);
1909 
1910 		if (m == NULL) {
1911 			aprint_error_dev(sc->sc_dev,
1912 			    "could not allocate beacon\n");
1913 			splx(s);
1914 			return;
1915 		}
1916 		M_SETCTX(m, ieee80211_ref_node(ic->ic_bss));
1917 		IF_ENQUEUE(&sc->sc_beaconq, m);
1918 		rtw_start(&sc->sc_if); /* in softint */
1919 	}
1920 
1921 	splx(s);
1922 }
1923 
1924 static void
1925 rtw_intr_atim(struct rtw_softc *sc)
1926 {
1927 	/* TBD */
1928 	return;
1929 }
1930 
1931 #ifdef RTW_DEBUG
1932 static void
1933 rtw_dump_rings(struct rtw_softc *sc)
1934 {
1935 	struct rtw_txdesc_blk *tdb;
1936 	struct rtw_rxdesc *rd;
1937 	struct rtw_rxdesc_blk *rdb;
1938 	int desc, pri;
1939 
1940 	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1941 		return;
1942 
1943 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1944 		tdb = &sc->sc_txdesc_blk[pri];
1945 		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1946 		    tdb->tdb_ndesc, tdb->tdb_nfree);
1947 		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1948 			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1949 	}
1950 
1951 	rdb = &sc->sc_rxdesc_blk;
1952 
1953 	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1954 		rd = &rdb->rdb_desc[desc];
1955 		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1956 		    "rsvd1/tsfth %08x\n", __func__,
1957 		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1958 		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1959 		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1960 	}
1961 }
1962 #endif /* RTW_DEBUG */
1963 
1964 static void
1965 rtw_hwring_setup(struct rtw_softc *sc)
1966 {
1967 	int pri;
1968 	struct rtw_regs *regs = &sc->sc_regs;
1969 	struct rtw_txdesc_blk *tdb;
1970 
1971 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1972 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1973 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1974 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1975 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1976 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1977 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1978 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1979 
1980 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1981 		tdb = &sc->sc_txdesc_blk[pri];
1982 		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1983 		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1984 		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1985 		     (uintptr_t)tdb->tdb_base));
1986 	}
1987 
1988 	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1989 
1990 	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1991 	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1992 	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1993 
1994 	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1995 
1996 }
1997 
1998 static int
1999 rtw_swring_setup(struct rtw_softc *sc)
2000 {
2001 	int rc;
2002 	struct rtw_rxdesc_blk *rdb;
2003 
2004 	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
2005 
2006 	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
2007 
2008 	rdb = &sc->sc_rxdesc_blk;
2009 	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
2010 	     sc->sc_dev)) != 0 && rdb->rdb_ndesc == 0) {
2011 		aprint_error_dev(sc->sc_dev, "could not allocate rx buffers\n");
2012 		return rc;
2013 	}
2014 
2015 	rdb = &sc->sc_rxdesc_blk;
2016 	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
2017 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
2018 	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
2019 	rdb->rdb_next = 0;
2020 
2021 	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
2022 	return 0;
2023 }
2024 
2025 static void
2026 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
2027 {
2028 	int i;
2029 
2030 	(void)memset(tdb->tdb_desc, 0,
2031 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
2032 	for (i = 0; i < tdb->tdb_ndesc; i++)
2033 		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
2034 }
2035 
2036 static u_int
2037 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
2038 {
2039 	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
2040 	    sizeof(struct rtw_txdesc);
2041 }
2042 
2043 #ifdef RTW_DIAG
2044 static void
2045 rtw_txring_fixup(struct rtw_softc *sc, const char *fn, int ln)
2046 {
2047 	int pri;
2048 	u_int next;
2049 	struct rtw_txdesc_blk *tdb;
2050 	struct rtw_regs *regs = &sc->sc_regs;
2051 
2052 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2053 		int i;
2054 		tdb = &sc->sc_txdesc_blk[pri];
2055 		next = rtw_txring_next(regs, tdb);
2056 		if (tdb->tdb_next == next)
2057 			continue;
2058 		for (i = 0; next != tdb->tdb_next;
2059 		    next = RTW_NEXT_IDX(tdb, next), i++) {
2060 			if ((tdb->tdb_desc[next].td_stat & htole32(RTW_TXSTAT_OWN)) == 0)
2061 				break;
2062 		}
2063 		printf("%s:%d: tx-ring %d expected next %u, read %u+%d -> %s\n", fn,
2064 		    ln, pri, tdb->tdb_next, next, i, tdb->tdb_next == next ? "okay" : "BAD");
2065 		if (tdb->tdb_next == next)
2066 			continue;
2067 		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
2068 	}
2069 }
2070 #endif
2071 
2072 static void
2073 rtw_txdescs_reset(struct rtw_softc *sc)
2074 {
2075 	int pri;
2076 	struct rtw_txsoft_blk	*tsb;
2077 	struct rtw_txdesc_blk	*tdb;
2078 
2079 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2080 		tsb = &sc->sc_txsoft_blk[pri];
2081 		tdb = &sc->sc_txdesc_blk[pri];
2082 		rtw_collect_txring(sc, tsb, tdb, 1);
2083 #ifdef RTW_DIAG
2084 		if (!SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
2085 			printf("%s: packets left in ring %d\n", __func__, pri);
2086 #endif
2087 	}
2088 }
2089 
2090 static void
2091 rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2092 {
2093 	int s;
2094 
2095 	aprint_error_dev(sc->sc_dev, "tx fifo underflow\n");
2096 
2097 	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: cleaning up xmit, isr %" PRIx16
2098 	    "\n", device_xname(sc->sc_dev), isr));
2099 
2100 	s = splnet();
2101 
2102 #ifdef RTW_DEBUG
2103 	rtw_dump_rings(sc);
2104 #endif /* RTW_DEBUG */
2105 
2106 	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2107 	 * timeouts.
2108 	 */
2109 	rtw_txdescs_reset(sc);
2110 
2111 #ifdef RTW_DEBUG
2112 	rtw_dump_rings(sc);
2113 #endif /* RTW_DEBUG */
2114 
2115 	splx(s);
2116 }
2117 
2118 static inline void
2119 rtw_suspend_ticks(struct rtw_softc *sc)
2120 {
2121 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2122 	    ("%s: suspending ticks\n", device_xname(sc->sc_dev)));
2123 	sc->sc_do_tick = 0;
2124 }
2125 
2126 static inline void
2127 rtw_resume_ticks(struct rtw_softc *sc)
2128 {
2129 	uint32_t tsftrl0, tsftrl1, next_tint;
2130 
2131 	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2132 
2133 	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2134 	next_tint = tsftrl1 + 1000000;
2135 	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tint);
2136 
2137 	sc->sc_do_tick = 1;
2138 
2139 #ifdef RTW_DEBUG
2140 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2141 	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2142 	    device_xname(sc->sc_dev), tsftrl1 - tsftrl0, tsftrl1, next_tint));
2143 #else
2144 	__USE(tsftrl0);
2145 #endif
2146 }
2147 
2148 static void
2149 rtw_intr_timeout(struct rtw_softc *sc)
2150 {
2151 	int s;
2152 
2153 	s = splnet();
2154 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", device_xname(sc->sc_dev)));
2155 	if (sc->sc_do_tick)
2156 		rtw_resume_ticks(sc);
2157 	splx(s);
2158 }
2159 
2160 int
2161 rtw_intr(void *arg)
2162 {
2163 	struct rtw_softc *sc = arg;
2164 	struct rtw_regs *regs = &sc->sc_regs;
2165 	uint16_t isr;
2166 	struct ifnet *ifp = &sc->sc_if;
2167 
2168 	/*
2169 	 * If the interface isn't running, the interrupt couldn't
2170 	 * possibly have come from us.
2171 	 */
2172 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2173 	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER)) {
2174 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2175 		    device_xname(sc->sc_dev)));
2176 		return (0);
2177 	}
2178 
2179 	isr = RTW_READ16(regs, RTW_ISR);
2180 	if (isr == 0)
2181 		return (0);
2182 
2183 	/* Disable interrupts. */
2184 	RTW_WRITE16(regs, RTW_IMR, 0);
2185 	RTW_WBW(regs, RTW_IMR, RTW_IMR);
2186 
2187 	softint_schedule(sc->sc_soft_ih);
2188 	return (1);
2189 }
2190 
2191 static void
2192 rtw_softintr(void *arg)
2193 {
2194 	int i;
2195 	struct rtw_softc *sc = arg;
2196 	struct rtw_regs *regs = &sc->sc_regs;
2197 	uint16_t isr;
2198 	struct ifnet *ifp = &sc->sc_if;
2199 
2200 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2201 	    !device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER)) {
2202 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
2203 		    device_xname(sc->sc_dev)));
2204 		return;
2205 	}
2206 
2207 	for (i = 0; i < 10; i++) {
2208 		isr = RTW_READ16(regs, RTW_ISR);
2209 
2210 		RTW_WRITE16(regs, RTW_ISR, isr);
2211 		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2212 
2213 		if (sc->sc_intr_ack != NULL)
2214 			(*sc->sc_intr_ack)(regs);
2215 
2216 		if (isr == 0)
2217 			break;
2218 
2219 #ifdef RTW_DEBUG
2220 #define PRINTINTR(flag) do { \
2221 	if ((isr & flag) != 0) { \
2222 		printf("%s" #flag, delim); \
2223 		delim = ","; \
2224 	} \
2225 } while (0)
2226 
2227 		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2228 			const char *delim = "<";
2229 
2230 			printf("%s: reg[ISR] = %x", device_xname(sc->sc_dev),
2231 			    isr);
2232 
2233 			PRINTINTR(RTW_INTR_TXFOVW);
2234 			PRINTINTR(RTW_INTR_TIMEOUT);
2235 			PRINTINTR(RTW_INTR_BCNINT);
2236 			PRINTINTR(RTW_INTR_ATIMINT);
2237 			PRINTINTR(RTW_INTR_TBDER);
2238 			PRINTINTR(RTW_INTR_TBDOK);
2239 			PRINTINTR(RTW_INTR_THPDER);
2240 			PRINTINTR(RTW_INTR_THPDOK);
2241 			PRINTINTR(RTW_INTR_TNPDER);
2242 			PRINTINTR(RTW_INTR_TNPDOK);
2243 			PRINTINTR(RTW_INTR_RXFOVW);
2244 			PRINTINTR(RTW_INTR_RDU);
2245 			PRINTINTR(RTW_INTR_TLPDER);
2246 			PRINTINTR(RTW_INTR_TLPDOK);
2247 			PRINTINTR(RTW_INTR_RER);
2248 			PRINTINTR(RTW_INTR_ROK);
2249 
2250 			printf(">\n");
2251 		}
2252 #undef PRINTINTR
2253 #endif /* RTW_DEBUG */
2254 
2255 		if ((isr & RTW_INTR_RX) != 0)
2256 			rtw_intr_rx(sc, isr);
2257 		if ((isr & RTW_INTR_TX) != 0)
2258 			rtw_intr_tx(sc, isr);
2259 		if ((isr & RTW_INTR_BEACON) != 0)
2260 			rtw_intr_beacon(sc, isr);
2261 		if ((isr & RTW_INTR_ATIMINT) != 0)
2262 			rtw_intr_atim(sc);
2263 		if ((isr & RTW_INTR_IOERROR) != 0)
2264 			rtw_intr_ioerror(sc, isr);
2265 		if ((isr & RTW_INTR_TIMEOUT) != 0)
2266 			rtw_intr_timeout(sc);
2267 	}
2268 	if (i == 10)
2269 		softint_schedule(sc->sc_soft_ih);
2270 
2271 	/* Re-enable interrupts */
2272 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2273 	RTW_WBW(regs, RTW_IMR, RTW_IMR);
2274 }
2275 
2276 /* Must be called at splnet. */
2277 static void
2278 rtw_stop(struct ifnet *ifp, int disable)
2279 {
2280 	int pri;
2281 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2282 	struct ieee80211com *ic = &sc->sc_ic;
2283 	struct rtw_regs *regs = &sc->sc_regs;
2284 
2285 	rtw_suspend_ticks(sc);
2286 
2287 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2288 
2289 	if (device_has_power(sc->sc_dev)) {
2290 		/* Disable interrupts. */
2291 		RTW_WRITE16(regs, RTW_IMR, 0);
2292 
2293 		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2294 
2295 		/* Stop the transmit and receive processes. First stop DMA,
2296 		 * then disable receiver and transmitter.
2297 		 */
2298 		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2299 
2300 		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2301 
2302 		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2303 	}
2304 
2305 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2306 		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2307 		    &sc->sc_txsoft_blk[pri]);
2308 	}
2309 
2310 	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2311 
2312 	/* Mark the interface as not running.  Cancel the watchdog timer. */
2313 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2314 	ifp->if_timer = 0;
2315 
2316 	if (disable)
2317 		pmf_device_suspend(sc->sc_dev, &sc->sc_qual);
2318 
2319 	return;
2320 }
2321 
2322 const char *
2323 rtw_pwrstate_string(enum rtw_pwrstate power)
2324 {
2325 	switch (power) {
2326 	case RTW_ON:
2327 		return "on";
2328 	case RTW_SLEEP:
2329 		return "sleep";
2330 	case RTW_OFF:
2331 		return "off";
2332 	default:
2333 		return "unknown";
2334 	}
2335 }
2336 
2337 /* XXX For Maxim, I am using the RFMD settings gleaned from the
2338  * reference driver, plus a magic Maxim "ON" value that comes from
2339  * the Realtek document "Windows PG for Rtl8180."
2340  */
2341 static void
2342 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2343     int before_rf, int digphy)
2344 {
2345 	uint32_t anaparm;
2346 
2347 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2348 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2349 
2350 	switch (power) {
2351 	case RTW_OFF:
2352 		if (before_rf)
2353 			return;
2354 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2355 		anaparm |= RTW_ANAPARM_TXDACOFF;
2356 		break;
2357 	case RTW_SLEEP:
2358 		if (!before_rf)
2359 			return;
2360 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2361 		anaparm |= RTW_ANAPARM_TXDACOFF;
2362 		break;
2363 	case RTW_ON:
2364 		if (!before_rf)
2365 			return;
2366 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2367 		break;
2368 	}
2369 	RTW_DPRINTF(RTW_DEBUG_PWR,
2370 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2371 	    __func__, rtw_pwrstate_string(power),
2372 	    (before_rf) ? "before" : "after", anaparm));
2373 
2374 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2375 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2376 }
2377 
2378 /* XXX I am using the RFMD settings gleaned from the reference
2379  * driver.  They agree
2380  */
2381 static void
2382 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2383     int before_rf, int digphy)
2384 {
2385 	uint32_t anaparm;
2386 
2387 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2388 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2389 
2390 	switch (power) {
2391 	case RTW_OFF:
2392 		if (before_rf)
2393 			return;
2394 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2395 		anaparm |= RTW_ANAPARM_TXDACOFF;
2396 		break;
2397 	case RTW_SLEEP:
2398 		if (!before_rf)
2399 			return;
2400 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2401 		anaparm |= RTW_ANAPARM_TXDACOFF;
2402 		break;
2403 	case RTW_ON:
2404 		if (!before_rf)
2405 			return;
2406 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2407 		break;
2408 	}
2409 	RTW_DPRINTF(RTW_DEBUG_PWR,
2410 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2411 	    __func__, rtw_pwrstate_string(power),
2412 	    (before_rf) ? "before" : "after", anaparm));
2413 
2414 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2415 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2416 }
2417 
2418 static void
2419 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2420     int before_rf, int digphy)
2421 {
2422 	uint32_t anaparm;
2423 
2424 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2425 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2426 
2427 	switch (power) {
2428 	case RTW_OFF:
2429 		if (before_rf)
2430 			return;
2431 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2432 		anaparm |= RTW_ANAPARM_TXDACOFF;
2433 		break;
2434 	case RTW_SLEEP:
2435 		if (!before_rf)
2436 			return;
2437 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2438 		anaparm |= RTW_ANAPARM_TXDACOFF;
2439 		break;
2440 	case RTW_ON:
2441 		if (!before_rf)
2442 			return;
2443 		if (digphy) {
2444 			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2445 			/* XXX guess */
2446 			anaparm |= RTW_ANAPARM_TXDACOFF;
2447 		} else
2448 			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2449 		break;
2450 	}
2451 	RTW_DPRINTF(RTW_DEBUG_PWR,
2452 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2453 	    __func__, rtw_pwrstate_string(power),
2454 	    (before_rf) ? "before" : "after", anaparm));
2455 
2456 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2457 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2458 }
2459 
2460 static void
2461 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2462     int digphy)
2463 {
2464 	struct rtw_regs *regs = &sc->sc_regs;
2465 
2466 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2467 
2468 	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2469 
2470 	rtw_set_access(regs, RTW_ACCESS_NONE);
2471 
2472 	return;
2473 }
2474 
2475 static int
2476 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2477 {
2478 	int rc;
2479 
2480 	RTW_DPRINTF(RTW_DEBUG_PWR,
2481 	    ("%s: %s->%s\n", __func__,
2482 	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2483 
2484 	if (sc->sc_pwrstate == power)
2485 		return 0;
2486 
2487 	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2488 	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2489 	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2490 
2491 	switch (power) {
2492 	case RTW_ON:
2493 		/* TBD set LEDs */
2494 		break;
2495 	case RTW_SLEEP:
2496 		/* TBD */
2497 		break;
2498 	case RTW_OFF:
2499 		/* TBD */
2500 		break;
2501 	}
2502 	if (rc == 0)
2503 		sc->sc_pwrstate = power;
2504 	else
2505 		sc->sc_pwrstate = RTW_OFF;
2506 	return rc;
2507 }
2508 
2509 static int
2510 rtw_tune(struct rtw_softc *sc)
2511 {
2512 	struct ieee80211com *ic = &sc->sc_ic;
2513 	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2514 	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2515 	u_int chan;
2516 	int rc;
2517 	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2518 	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2519 
2520 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2521 	KASSERT(chan != IEEE80211_CHAN_ANY);
2522 
2523 	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2524 	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2525 
2526 	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2527 	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2528 
2529 	if (chan == sc->sc_cur_chan) {
2530 		RTW_DPRINTF(RTW_DEBUG_TUNE,
2531 		    ("%s: already tuned chan #%d\n", __func__, chan));
2532 		return 0;
2533 	}
2534 
2535 	rtw_suspend_ticks(sc);
2536 
2537 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2538 
2539 	/* TBD wait for Tx to complete */
2540 
2541 	KASSERT(device_has_power(sc->sc_dev));
2542 
2543 	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2544 	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2545 	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2546 		/* XXX condition on powersaving */
2547 		aprint_error_dev(sc->sc_dev, "phy init failed\n");
2548 	}
2549 
2550 	sc->sc_cur_chan = chan;
2551 
2552 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2553 
2554 	rtw_resume_ticks(sc);
2555 
2556 	return rc;
2557 }
2558 
2559 bool
2560 rtw_suspend(device_t self, const pmf_qual_t *qual)
2561 {
2562 	int rc;
2563 	struct rtw_softc *sc = device_private(self);
2564 
2565 	sc->sc_flags &= ~RTW_F_DK_VALID;
2566 
2567 	if (!device_has_power(self))
2568 		return false;
2569 
2570 	/* turn off PHY */
2571 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2572 		aprint_error_dev(self, "failed to turn off PHY (%d)\n", rc);
2573 		return false;
2574 	}
2575 
2576 	rtw_disable_interrupts(&sc->sc_regs);
2577 
2578 	return true;
2579 }
2580 
2581 bool
2582 rtw_resume(device_t self, const pmf_qual_t *qual)
2583 {
2584 	struct rtw_softc *sc = device_private(self);
2585 
2586 	/* Power may have been removed, resetting WEP keys.
2587 	 */
2588 	sc->sc_flags &= ~RTW_F_DK_VALID;
2589 	rtw_enable_interrupts(sc);
2590 
2591 	return true;
2592 }
2593 
2594 static void
2595 rtw_transmit_config(struct rtw_regs *regs)
2596 {
2597 	uint32_t tcr;
2598 
2599 	tcr = RTW_READ(regs, RTW_TCR);
2600 
2601 	tcr |= RTW_TCR_CWMIN;
2602 	tcr &= ~RTW_TCR_MXDMA_MASK;
2603 	tcr |= RTW_TCR_MXDMA_256;
2604 	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2605 	tcr &= ~RTW_TCR_LBK_MASK;
2606 	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2607 
2608 	/* set short/long retry limits */
2609 	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2610 	tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2611 
2612 	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2613 
2614 	RTW_WRITE(regs, RTW_TCR, tcr);
2615 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2616 }
2617 
2618 static void
2619 rtw_disable_interrupts(struct rtw_regs *regs)
2620 {
2621 	RTW_WRITE16(regs, RTW_IMR, 0);
2622 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2623 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2624 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2625 }
2626 
2627 static void
2628 rtw_enable_interrupts(struct rtw_softc *sc)
2629 {
2630 	struct rtw_regs *regs = &sc->sc_regs;
2631 
2632 	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2633 	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2634 
2635 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2636 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2637 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2638 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2639 
2640 	/* XXX necessary? */
2641 	if (sc->sc_intr_ack != NULL)
2642 		(*sc->sc_intr_ack)(regs);
2643 }
2644 
2645 static void
2646 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2647 {
2648 	uint8_t msr;
2649 
2650 	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2651 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2652 
2653 	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2654 
2655 	switch (opmode) {
2656 	case IEEE80211_M_AHDEMO:
2657 	case IEEE80211_M_IBSS:
2658 		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2659 		break;
2660 	case IEEE80211_M_HOSTAP:
2661 		msr |= RTW_MSR_NETYPE_AP_OK;
2662 		break;
2663 	case IEEE80211_M_MONITOR:
2664 		/* XXX */
2665 		msr |= RTW_MSR_NETYPE_NOLINK;
2666 		break;
2667 	case IEEE80211_M_STA:
2668 		msr |= RTW_MSR_NETYPE_INFRA_OK;
2669 		break;
2670 	}
2671 	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2672 
2673 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2674 }
2675 
2676 #define	rtw_calchash(addr) \
2677 	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2678 
2679 static void
2680 rtw_pktfilt_load(struct rtw_softc *sc)
2681 {
2682 	struct rtw_regs *regs = &sc->sc_regs;
2683 	struct ieee80211com *ic = &sc->sc_ic;
2684 	struct ethercom *ec = &sc->sc_ec;
2685 	struct ifnet *ifp = &sc->sc_if;
2686 	int hash;
2687 	uint32_t hashes[2] = { 0, 0 };
2688 	struct ether_multi *enm;
2689 	struct ether_multistep step;
2690 
2691 	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2692 
2693 	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2694 	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2695 
2696 	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2697 	/* MAC auto-reset PHY (huh?) */
2698 	sc->sc_rcr |= RTW_RCR_ENMARP;
2699 	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2700 	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2701 
2702 	switch (ic->ic_opmode) {
2703 	case IEEE80211_M_MONITOR:
2704 		sc->sc_rcr |= RTW_RCR_MONITOR;
2705 		break;
2706 	case IEEE80211_M_AHDEMO:
2707 	case IEEE80211_M_IBSS:
2708 		/* receive broadcasts in our BSS */
2709 		sc->sc_rcr |= RTW_RCR_ADD3;
2710 		break;
2711 	default:
2712 		break;
2713 	}
2714 
2715 	ifp->if_flags &= ~IFF_ALLMULTI;
2716 
2717 	/*
2718 	 * Program the 64-bit multicast hash filter.
2719 	 */
2720 	ETHER_FIRST_MULTI(step, ec, enm);
2721 	while (enm != NULL) {
2722 		/* XXX */
2723 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2724 		    ETHER_ADDR_LEN) != 0) {
2725 			ifp->if_flags |= IFF_ALLMULTI;
2726 			break;
2727 		}
2728 
2729 		hash = rtw_calchash(enm->enm_addrlo);
2730 		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2731 		ETHER_NEXT_MULTI(step, enm);
2732 	}
2733 
2734 	/* XXX accept all broadcast if scanning */
2735 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2736 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2737 
2738 	if (ifp->if_flags & IFF_PROMISC) {
2739 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2740 		sc->sc_rcr |= RTW_RCR_ACRC32;	/* accept frames failing CRC */
2741 		sc->sc_rcr |= RTW_RCR_AICV;	/* accept frames failing ICV */
2742 		ifp->if_flags |= IFF_ALLMULTI;
2743 	}
2744 
2745 	if (ifp->if_flags & IFF_ALLMULTI)
2746 		hashes[0] = hashes[1] = 0xffffffff;
2747 
2748 	if ((hashes[0] | hashes[1]) != 0)
2749 		sc->sc_rcr |= RTW_RCR_AM;	/* accept multicast */
2750 
2751 	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2752 	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2753 	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2754 	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2755 
2756 	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2757 	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2758 	    device_xname(sc->sc_dev), RTW_READ(regs, RTW_MAR0),
2759 	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2760 }
2761 
2762 static struct mbuf *
2763 rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2764 {
2765 	struct ieee80211com *ic = &sc->sc_ic;
2766 	struct mbuf *m;
2767 	struct ieee80211_beacon_offsets	boff;
2768 
2769 	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2770 		RTW_DPRINTF(RTW_DEBUG_BEACON,
2771 		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2772 	}
2773 	return m;
2774 }
2775 
2776 /* Must be called at splnet. */
2777 static int
2778 rtw_init(struct ifnet *ifp)
2779 {
2780 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2781 	struct ieee80211com *ic = &sc->sc_ic;
2782 	struct rtw_regs *regs = &sc->sc_regs;
2783 	int rc;
2784 
2785 	if (device_is_active(sc->sc_dev)) {
2786 		/* Cancel pending I/O and reset. */
2787 		rtw_stop(ifp, 0);
2788 	} else if (!pmf_device_resume(sc->sc_dev, &sc->sc_qual) ||
2789 	           !device_is_active(sc->sc_dev))
2790 		return 0;
2791 
2792 	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2793 	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2794 	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2795 
2796 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2797 		goto out;
2798 
2799 	if ((rc = rtw_swring_setup(sc)) != 0)
2800 		goto out;
2801 
2802 	rtw_transmit_config(regs);
2803 
2804 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2805 
2806 	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2807 	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2808 
2809 	/* long PLCP header, 1Mb/2Mb basic rate */
2810 	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2811 	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2812 
2813 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2814 	rtw_set_access(regs, RTW_ACCESS_NONE);
2815 
2816 	/* XXX from reference sources */
2817 	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2818 	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2819 
2820 	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev);
2821 
2822 	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2823 	/* from Linux driver */
2824 	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2825 
2826 	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2827 
2828 	rtw_enable_interrupts(sc);
2829 
2830 	rtw_pktfilt_load(sc);
2831 
2832 	rtw_hwring_setup(sc);
2833 
2834 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2835 
2836 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2837 
2838 	ifp->if_flags |= IFF_RUNNING;
2839 	ic->ic_state = IEEE80211_S_INIT;
2840 
2841 	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2842 	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2843 
2844 	rtw_resume_ticks(sc);
2845 
2846 	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2847 
2848 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2849 		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2850 	else
2851 		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2852 
2853 out:
2854 	aprint_error_dev(sc->sc_dev, "interface not running\n");
2855 	return rc;
2856 }
2857 
2858 static inline void
2859 rtw_led_init(struct rtw_regs *regs)
2860 {
2861 	uint8_t cfg0, cfg1;
2862 
2863 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2864 
2865 	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2866 	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2867 	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2868 
2869 	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2870 	RTW_DPRINTF(RTW_DEBUG_LED,
2871 	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2872 
2873 	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2874 	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2875 	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2876 
2877 	rtw_set_access(regs, RTW_ACCESS_NONE);
2878 }
2879 
2880 /*
2881  * IEEE80211_S_INIT: 		LED1 off
2882  *
2883  * IEEE80211_S_AUTH,
2884  * IEEE80211_S_ASSOC,
2885  * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2886  *
2887  * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2888  */
2889 static void
2890 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2891 {
2892 	struct rtw_led_state *ls;
2893 
2894 	ls = &sc->sc_led_state;
2895 
2896 	switch (nstate) {
2897 	case IEEE80211_S_INIT:
2898 		rtw_led_init(&sc->sc_regs);
2899 		aprint_debug_dev(sc->sc_dev, "stopping blink\n");
2900 		callout_stop(&ls->ls_slow_ch);
2901 		callout_stop(&ls->ls_fast_ch);
2902 		ls->ls_slowblink = 0;
2903 		ls->ls_actblink = 0;
2904 		ls->ls_default = 0;
2905 		break;
2906 	case IEEE80211_S_SCAN:
2907 		aprint_debug_dev(sc->sc_dev, "scheduling blink\n");
2908 		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2909 		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2910 		/*FALLTHROUGH*/
2911 	case IEEE80211_S_AUTH:
2912 	case IEEE80211_S_ASSOC:
2913 		ls->ls_default = RTW_LED1;
2914 		ls->ls_actblink = RTW_LED1;
2915 		ls->ls_slowblink = RTW_LED1;
2916 		break;
2917 	case IEEE80211_S_RUN:
2918 		ls->ls_slowblink = 0;
2919 		break;
2920 	}
2921 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2922 }
2923 
2924 static void
2925 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2926 {
2927 	uint8_t led_condition;
2928 	bus_size_t ofs;
2929 	uint8_t mask, newval, val;
2930 
2931 	led_condition = ls->ls_default;
2932 
2933 	if (ls->ls_state & RTW_LED_S_SLOW)
2934 		led_condition ^= ls->ls_slowblink;
2935 	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2936 		led_condition ^= ls->ls_actblink;
2937 
2938 	RTW_DPRINTF(RTW_DEBUG_LED,
2939 	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2940 
2941 	switch (hwverid) {
2942 	default:
2943 	case 'F':
2944 		ofs = RTW_PSR;
2945 		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2946 		if (led_condition & RTW_LED0)
2947 			newval &= ~RTW_PSR_LEDGPO0;
2948 		if (led_condition & RTW_LED1)
2949 			newval &= ~RTW_PSR_LEDGPO1;
2950 		break;
2951 	case 'D':
2952 		ofs = RTW_9346CR;
2953 		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2954 		newval = RTW_9346CR_EEM_PROGRAM;
2955 		if (led_condition & RTW_LED0)
2956 			newval |= RTW_9346CR_EEDI;
2957 		if (led_condition & RTW_LED1)
2958 			newval |= RTW_9346CR_EECS;
2959 		break;
2960 	}
2961 	val = RTW_READ8(regs, ofs);
2962 	RTW_DPRINTF(RTW_DEBUG_LED,
2963 	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2964 	     (uintptr_t)ofs));
2965 	val &= ~mask;
2966 	val |= newval;
2967 	RTW_WRITE8(regs, ofs, val);
2968 	RTW_DPRINTF(RTW_DEBUG_LED,
2969 	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2970 	     (uintptr_t)ofs));
2971 	RTW_SYNC(regs, ofs, ofs);
2972 }
2973 
2974 static void
2975 rtw_led_fastblink(void *arg)
2976 {
2977 	int ostate, s;
2978 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2979 	struct rtw_led_state *ls = &sc->sc_led_state;
2980 
2981 	s = splnet();
2982 	ostate = ls->ls_state;
2983 	ls->ls_state ^= ls->ls_event;
2984 
2985 	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2986 		ls->ls_state &= ~RTW_LED_S_TX;
2987 
2988 	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2989 		ls->ls_state &= ~RTW_LED_S_RX;
2990 
2991 	ls->ls_event = 0;
2992 
2993 	if (ostate != ls->ls_state)
2994 		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2995 	splx(s);
2996 
2997 	aprint_debug_dev(sc->sc_dev, "scheduling fast blink\n");
2998 	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2999 }
3000 
3001 static void
3002 rtw_led_slowblink(void *arg)
3003 {
3004 	int s;
3005 	struct rtw_softc *sc = (struct rtw_softc *)arg;
3006 	struct rtw_led_state *ls = &sc->sc_led_state;
3007 
3008 	s = splnet();
3009 	ls->ls_state ^= RTW_LED_S_SLOW;
3010 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
3011 	splx(s);
3012 	aprint_debug_dev(sc->sc_dev, "scheduling slow blink\n");
3013 	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
3014 }
3015 
3016 static void
3017 rtw_led_detach(struct rtw_led_state *ls)
3018 {
3019 	callout_destroy(&ls->ls_fast_ch);
3020 	callout_destroy(&ls->ls_slow_ch);
3021 }
3022 
3023 static void
3024 rtw_led_attach(struct rtw_led_state *ls, void *arg)
3025 {
3026 	callout_init(&ls->ls_fast_ch, 0);
3027 	callout_init(&ls->ls_slow_ch, 0);
3028 	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
3029 	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
3030 }
3031 
3032 static int
3033 rtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
3034 {
3035 	int rc = 0, s;
3036 	struct rtw_softc *sc = ifp->if_softc;
3037 
3038 	s = splnet();
3039 	if (cmd == SIOCSIFFLAGS) {
3040 		if ((rc = ifioctl_common(ifp, cmd, data)) != 0)
3041 			;
3042 		else switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
3043 		case IFF_UP:
3044 			rc = rtw_init(ifp);
3045 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3046 			break;
3047 		case IFF_UP|IFF_RUNNING:
3048 			if (device_activation(sc->sc_dev, DEVACT_LEVEL_DRIVER))
3049 				rtw_pktfilt_load(sc);
3050 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3051 			break;
3052 		case IFF_RUNNING:
3053 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
3054 			rtw_stop(ifp, 1);
3055 			break;
3056 		default:
3057 			break;
3058 		}
3059 	} else if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
3060 		;	/* nothing to do */
3061 	else if (cmd == SIOCADDMULTI || cmd == SIOCDELMULTI) {
3062 		/* reload packet filter if running */
3063 		if (ifp->if_flags & IFF_RUNNING)
3064 			rtw_pktfilt_load(sc);
3065 		rc = 0;
3066 	} else if ((ifp->if_flags & IFF_UP) != 0)
3067 		rc = rtw_init(ifp);
3068 	else
3069 		rc = 0;
3070 	splx(s);
3071 	return rc;
3072 }
3073 
3074 /* Select a transmit ring with at least one h/w and s/w descriptor free.
3075  * Return 0 on success, -1 on failure.
3076  */
3077 static inline int
3078 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
3079     struct rtw_txdesc_blk **tdbp, int pri)
3080 {
3081 	struct rtw_txsoft_blk *tsb;
3082 	struct rtw_txdesc_blk *tdb;
3083 
3084 	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
3085 
3086 	tsb = &sc->sc_txsoft_blk[pri];
3087 	tdb = &sc->sc_txdesc_blk[pri];
3088 
3089 	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
3090 		if (tsb->tsb_tx_timer == 0)
3091 			tsb->tsb_tx_timer = 5;
3092 		*tsbp = NULL;
3093 		*tdbp = NULL;
3094 		return -1;
3095 	}
3096 	*tsbp = tsb;
3097 	*tdbp = tdb;
3098 	return 0;
3099 }
3100 
3101 static inline struct mbuf *
3102 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3103     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3104     struct ieee80211_node **nip, short *if_flagsp)
3105 {
3106 	struct mbuf *m;
3107 
3108 	if (IF_IS_EMPTY(ifq))
3109 		return NULL;
3110 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3111 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3112 		    __func__, pri));
3113 		*if_flagsp |= IFF_OACTIVE;
3114 		sc->sc_if.if_timer = 1;
3115 		return NULL;
3116 	}
3117 	IF_DEQUEUE(ifq, m);
3118 	*nip = M_GETCTX(m, struct ieee80211_node *);
3119 	M_SETCTX(m, NULL);
3120 	KASSERT(*nip != NULL);
3121 	return m;
3122 }
3123 
3124 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3125  * at the driver's selection of transmit control block for the packet.
3126  */
3127 static inline int
3128 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3129     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3130     struct ieee80211_node **nip)
3131 {
3132 	int pri;
3133 	struct ether_header *eh;
3134 	struct mbuf *m0;
3135 	struct rtw_softc *sc;
3136 	short *if_flagsp;
3137 
3138 	*mp = NULL;
3139 
3140 	sc = (struct rtw_softc *)ifp->if_softc;
3141 
3142 	DPRINTF(sc, RTW_DEBUG_XMIT,
3143 	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3144 
3145 	if_flagsp = &ifp->if_flags;
3146 
3147 	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3148 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3149 		                     tdbp, nip, if_flagsp)) != NULL) {
3150 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3151 		    __func__));
3152 		return 0;
3153 	}
3154 
3155 	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3156 		                     tdbp, nip, if_flagsp)) != NULL) {
3157 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3158 		    __func__));
3159 		return 0;
3160 	}
3161 
3162 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3163 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3164 		return 0;
3165 	}
3166 
3167 	IFQ_POLL(&ifp->if_snd, m0);
3168 	if (m0 == NULL) {
3169 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3170 		    __func__));
3171 		return 0;
3172 	}
3173 
3174 	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3175 
3176 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3177 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3178 		    __func__, pri));
3179 		*if_flagsp |= IFF_OACTIVE;
3180 		sc->sc_if.if_timer = 1;
3181 		return 0;
3182 	}
3183 
3184 	IFQ_DEQUEUE(&ifp->if_snd, m0);
3185 	if (m0 == NULL) {
3186 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3187 		    __func__));
3188 		return 0;
3189 	}
3190 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3191 	ifp->if_opackets++;
3192 	bpf_mtap(ifp, m0, BPF_D_OUT);
3193 	eh = mtod(m0, struct ether_header *);
3194 	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3195 	if (*nip == NULL) {
3196 		/* NB: ieee80211_find_txnode does stat+msg */
3197 		m_freem(m0);
3198 		return -1;
3199 	}
3200 	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3201 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3202 		ifp->if_oerrors++;
3203 		return -1;
3204 	}
3205 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3206 	*mp = m0;
3207 	return 0;
3208 }
3209 
3210 static int
3211 rtw_seg_too_short(bus_dmamap_t dmamap)
3212 {
3213 	int i;
3214 	for (i = 0; i < dmamap->dm_nsegs; i++) {
3215 		if (dmamap->dm_segs[i].ds_len < 4)
3216 			return 1;
3217 	}
3218 	return 0;
3219 }
3220 
3221 /* TBD factor with atw_start */
3222 static struct mbuf *
3223 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3224     u_int ndescfree, device_t dev)
3225 {
3226 	int first, rc;
3227 	struct mbuf *m, *m0;
3228 
3229 	m0 = chain;
3230 
3231 	/*
3232 	 * Load the DMA map.  Copy and try (once) again if the packet
3233 	 * didn't fit in the alloted number of segments.
3234 	 */
3235 	for (first = 1;
3236 	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3237 			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3238 	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3239 	     first = 0) {
3240 		if (rc == 0) {
3241 #ifdef RTW_DIAGxxx
3242 			if (rtw_seg_too_short(dmam)) {
3243 				printf("%s: short segment, mbuf lengths:", __func__);
3244 				for (m = m0; m; m = m->m_next)
3245 					printf(" %d", m->m_len);
3246 				printf("\n");
3247 			}
3248 #endif
3249 			bus_dmamap_unload(dmat, dmam);
3250 		}
3251 		MGETHDR(m, M_DONTWAIT, MT_DATA);
3252 		if (m == NULL) {
3253 			aprint_error_dev(dev, "unable to allocate Tx mbuf\n");
3254 			break;
3255 		}
3256 		if (m0->m_pkthdr.len > MHLEN) {
3257 			MCLGET(m, M_DONTWAIT);
3258 			if ((m->m_flags & M_EXT) == 0) {
3259 				aprint_error_dev(dev,
3260 				    "cannot allocate Tx cluster\n");
3261 				m_freem(m);
3262 				break;
3263 			}
3264 		}
3265 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
3266 		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3267 		m_freem(m0);
3268 		m0 = m;
3269 		m = NULL;
3270 	}
3271 	if (rc != 0) {
3272 		aprint_error_dev(dev, "cannot load Tx buffer, rc = %d\n", rc);
3273 		m_freem(m0);
3274 		return NULL;
3275 	} else if (rtw_seg_too_short(dmam)) {
3276 		aprint_error_dev(dev,
3277 		    "cannot load Tx buffer, segment too short\n");
3278 		bus_dmamap_unload(dmat, dmam);
3279 		m_freem(m0);
3280 		return NULL;
3281 	} else if (dmam->dm_nsegs > ndescfree) {
3282 		aprint_error_dev(dev, "too many tx segments\n");
3283 		bus_dmamap_unload(dmat, dmam);
3284 		m_freem(m0);
3285 		return NULL;
3286 	}
3287 	return m0;
3288 }
3289 
3290 #ifdef RTW_DEBUG
3291 static void
3292 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3293     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3294 {
3295 	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3296 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3297 	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3298 	    device_xname(sc->sc_dev), ts, action, desc,
3299 	    le32toh(td->td_buf), le32toh(td->td_next),
3300 	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3301 	    le32toh(td->td_len)));
3302 }
3303 #endif /* RTW_DEBUG */
3304 
3305 static void
3306 rtw_start(struct ifnet *ifp)
3307 {
3308 	int desc, i, lastdesc, npkt, rate;
3309 	uint32_t proto_ctl0, ctl0, ctl1;
3310 	bus_dmamap_t		dmamap;
3311 	struct ieee80211com	*ic;
3312 	struct ieee80211_duration *d0;
3313 	struct ieee80211_frame_min	*wh;
3314 	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3315 	struct mbuf		*m0;
3316 	struct rtw_softc	*sc;
3317 	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3318 	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3319 	struct rtw_txsoft	*ts;
3320 	struct rtw_txdesc	*td;
3321 	struct ieee80211_key	*k;
3322 
3323 	sc = (struct rtw_softc *)ifp->if_softc;
3324 	ic = &sc->sc_ic;
3325 
3326 	DPRINTF(sc, RTW_DEBUG_XMIT,
3327 	    ("%s: enter %s\n", device_xname(sc->sc_dev), __func__));
3328 
3329 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3330 		goto out;
3331 
3332 	/* XXX do real rate control */
3333 	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3334 
3335 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3336 		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3337 
3338 	for (;;) {
3339 		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3340 			continue;
3341 		if (m0 == NULL)
3342 			break;
3343 
3344 		wh = mtod(m0, struct ieee80211_frame_min *);
3345 
3346 		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3347 		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3348 			m_freem(m0);
3349 			break;
3350 		} else
3351 			k = NULL;
3352 
3353 		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3354 
3355 		dmamap = ts->ts_dmamap;
3356 
3357 		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3358 		    tdb->tdb_nfree, sc->sc_dev);
3359 
3360 		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3361 			DPRINTF(sc, RTW_DEBUG_XMIT,
3362 			    ("%s: fail dmamap load\n", __func__));
3363 			goto post_dequeue_err;
3364 		}
3365 
3366 		/* Note well: rtw_dmamap_load_txbuf may have created
3367 		 * a new chain, so we must find the header once
3368 		 * more.
3369 		 */
3370 		wh = mtod(m0, struct ieee80211_frame_min *);
3371 
3372 		/* XXX do real rate control */
3373 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3374 		    IEEE80211_FC0_TYPE_MGT)
3375 			rate = 2;
3376 		else
3377 			rate = MAX(2, ieee80211_get_rate(ni));
3378 
3379 #ifdef RTW_DEBUG
3380 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3381 		    (IFF_DEBUG|IFF_LINK2)) {
3382 			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3383 			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3384 			                            : sizeof(wh),
3385 			    rate, 0);
3386 		}
3387 #endif /* RTW_DEBUG */
3388 		ctl0 = proto_ctl0 |
3389 		    __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3390 
3391 		switch (rate) {
3392 		default:
3393 		case 2:
3394 			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3395 			break;
3396 		case 4:
3397 			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3398 			break;
3399 		case 11:
3400 			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3401 			break;
3402 		case 22:
3403 			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3404 			break;
3405 		}
3406 		/* XXX >= ? Compare after fragmentation? */
3407 		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3408 			ctl0 |= RTW_TXCTL0_RTSEN;
3409 
3410                 /* XXX Sometimes writes a bogus keyid; h/w doesn't
3411                  * seem to care, since we don't activate h/w Tx
3412                  * encryption.
3413 		 */
3414 		if (k != NULL &&
3415 		    k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
3416 			ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3417 			    RTW_TXCTL0_KEYID_MASK;
3418 		}
3419 
3420 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3421 		    IEEE80211_FC0_TYPE_MGT) {
3422 			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3423 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3424 			    IEEE80211_FC0_SUBTYPE_BEACON)
3425 				ctl0 |= RTW_TXCTL0_BEACON;
3426 		}
3427 
3428 		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3429 		    ic->ic_flags, ic->ic_fragthreshold,
3430 		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3431 		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3432 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3433 			DPRINTF(sc, RTW_DEBUG_XMIT,
3434 			    ("%s: fail compute duration\n", __func__));
3435 			goto post_load_err;
3436 		}
3437 
3438 		d0 = &ts->ts_d0;
3439 
3440 		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3441 
3442 		ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3443 		    __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3444 
3445 		if (d0->d_residue)
3446 			ctl1 |= RTW_TXCTL1_LENGEXT;
3447 
3448 		/* TBD fragmentation */
3449 
3450 		ts->ts_first = tdb->tdb_next;
3451 
3452 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3453 		    BUS_DMASYNC_PREWRITE);
3454 
3455 		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3456 
3457 		bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
3458 
3459 		if (sc->sc_radiobpf != NULL) {
3460 			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3461 
3462 			rt->rt_rate = rate;
3463 
3464 			bpf_mtap2(sc->sc_radiobpf, rt, sizeof(sc->sc_txtapu),
3465 			    m0, BPF_D_OUT);
3466 		}
3467 
3468 		for (i = 0, lastdesc = desc = ts->ts_first;
3469 		     i < dmamap->dm_nsegs;
3470 		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3471 			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3472 				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3473 				    ("%s: seg too long\n", __func__));
3474 				goto post_load_err;
3475 			}
3476 			td = &tdb->tdb_desc[desc];
3477 			td->td_ctl0 = htole32(ctl0);
3478 			td->td_ctl1 = htole32(ctl1);
3479 			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3480 			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3481 			td->td_next = htole32(RTW_NEXT_DESC(tdb, desc));
3482 			if (i != 0)
3483 				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3484 			lastdesc = desc;
3485 #ifdef RTW_DEBUG
3486 			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3487 #endif /* RTW_DEBUG */
3488 		}
3489 
3490 		KASSERT(desc < tdb->tdb_ndesc);
3491 
3492 		ts->ts_ni = ni;
3493 		KASSERT(ni != NULL);
3494 		ts->ts_mbuf = m0;
3495 		ts->ts_last = lastdesc;
3496 		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3497 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3498 		   htole32(RTW_TXCTL0_FS);
3499 
3500 #ifdef RTW_DEBUG
3501 		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3502 		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3503 #endif /* RTW_DEBUG */
3504 
3505 		tdb->tdb_nfree -= dmamap->dm_nsegs;
3506 		tdb->tdb_next = desc;
3507 
3508 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3509 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3510 
3511 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3512 		    htole32(RTW_TXCTL0_OWN);
3513 
3514 #ifdef RTW_DEBUG
3515 		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3516 #endif /* RTW_DEBUG */
3517 
3518 		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3519 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3520 
3521 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3522 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3523 
3524 		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3525 			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3526 		tsb->tsb_tx_timer = 5;
3527 		ifp->if_timer = 1;
3528 		rtw_tx_kick(&sc->sc_regs, tsb->tsb_poll);
3529 	}
3530 out:
3531 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3532 	return;
3533 post_load_err:
3534 	bus_dmamap_unload(sc->sc_dmat, dmamap);
3535 	m_freem(m0);
3536 post_dequeue_err:
3537 	ieee80211_free_node(ni);
3538 	return;
3539 }
3540 
3541 static void
3542 rtw_idle(struct rtw_regs *regs)
3543 {
3544 	int active;
3545 	uint8_t tppoll;
3546 
3547 	/* request stop DMA; wait for packets to stop transmitting. */
3548 
3549 	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3550 	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3551 
3552 	for (active = 0; active < 300 &&
3553 	     (tppoll = RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0;
3554 	     active++)
3555 		DELAY(10);
3556 	printf("%s: transmit DMA idle in %dus, tppoll %02" PRIx8 "\n", __func__,
3557 	    active * 10, tppoll);
3558 }
3559 
3560 static void
3561 rtw_watchdog(struct ifnet *ifp)
3562 {
3563 	int pri, tx_timeouts = 0;
3564 	struct rtw_softc *sc;
3565 	struct rtw_txsoft_blk *tsb;
3566 
3567 	sc = ifp->if_softc;
3568 
3569 	ifp->if_timer = 0;
3570 
3571 	if (!device_is_active(sc->sc_dev))
3572 		return;
3573 
3574 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3575 		tsb = &sc->sc_txsoft_blk[pri];
3576 
3577 		if (tsb->tsb_tx_timer == 0)
3578 			continue;
3579 		else if (--tsb->tsb_tx_timer == 0) {
3580 			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3581 				continue;
3582 			else if (rtw_collect_txring(sc, tsb,
3583 			    &sc->sc_txdesc_blk[pri], 0))
3584 				continue;
3585 			printf("%s: transmit timeout, priority %d\n",
3586 			    ifp->if_xname, pri);
3587 			ifp->if_oerrors++;
3588 			if (pri != RTW_TXPRIBCN)
3589 				tx_timeouts++;
3590 		} else
3591 			ifp->if_timer = 1;
3592 	}
3593 
3594 	if (tx_timeouts > 0) {
3595 		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3596 		 * reset s/w tx-ring pointers, and start transmission.
3597 		 *
3598 		 * TBD Stop/restart just the broken rings?
3599 		 */
3600 		rtw_idle(&sc->sc_regs);
3601 		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
3602 		rtw_txdescs_reset(sc);
3603 		rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3604 		rtw_start(ifp);
3605 	}
3606 	ieee80211_watchdog(&sc->sc_ic);
3607 	return;
3608 }
3609 
3610 static void
3611 rtw_next_scan(void *arg)
3612 {
3613 	struct ieee80211com *ic = arg;
3614 	int s;
3615 
3616 	/* don't call rtw_start w/o network interrupts blocked */
3617 	s = splnet();
3618 	if (ic->ic_state == IEEE80211_S_SCAN)
3619 		ieee80211_next_scan(ic);
3620 	splx(s);
3621 }
3622 
3623 static void
3624 rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3625 {
3626 	uint16_t bcnitv, bintritv, intval;
3627 	int i;
3628 	struct rtw_regs *regs = &sc->sc_regs;
3629 
3630 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3631 		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3632 
3633 	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3634 
3635 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3636 
3637 	intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3638 
3639 	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3640 	bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3641 	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3642 	/* interrupt host 1ms before the TBTT */
3643 	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3644 	bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3645 	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3646 	/* magic from Linux */
3647 	RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3648 	RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3649 	rtw_set_access(regs, RTW_ACCESS_NONE);
3650 
3651 	rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3652 }
3653 
3654 /* Synchronize the hardware state with the software state. */
3655 static int
3656 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3657 {
3658 	struct ifnet *ifp = ic->ic_ifp;
3659 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3660 	enum ieee80211_state ostate;
3661 	int error;
3662 
3663 	ostate = ic->ic_state;
3664 
3665 	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3666 	rtw_led_newstate(sc, nstate);
3667 
3668 	aprint_debug_dev(sc->sc_dev, "%s: l.%d\n", __func__, __LINE__);
3669 	if (nstate == IEEE80211_S_INIT) {
3670 		callout_stop(&sc->sc_scan_ch);
3671 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3672 		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3673 	}
3674 
3675 	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3676 		rtw_pwrstate(sc, RTW_ON);
3677 
3678 	if ((error = rtw_tune(sc)) != 0)
3679 		return error;
3680 
3681 	switch (nstate) {
3682 	case IEEE80211_S_INIT:
3683 		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3684 		break;
3685 	case IEEE80211_S_SCAN:
3686 		if (ostate != IEEE80211_S_SCAN) {
3687 			(void)memset(ic->ic_bss->ni_bssid, 0,
3688 			    IEEE80211_ADDR_LEN);
3689 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3690 		}
3691 
3692 		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3693 		    rtw_next_scan, ic);
3694 
3695 		break;
3696 	case IEEE80211_S_RUN:
3697 		switch (ic->ic_opmode) {
3698 		case IEEE80211_M_HOSTAP:
3699 		case IEEE80211_M_IBSS:
3700 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3701 			/*FALLTHROUGH*/
3702 		case IEEE80211_M_AHDEMO:
3703 		case IEEE80211_M_STA:
3704 			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3705 			    ic->ic_bss->ni_intval);
3706 			break;
3707 		case IEEE80211_M_MONITOR:
3708 			break;
3709 		}
3710 		rtw_set_nettype(sc, ic->ic_opmode);
3711 		break;
3712 	case IEEE80211_S_ASSOC:
3713 	case IEEE80211_S_AUTH:
3714 		break;
3715 	}
3716 
3717 	if (nstate != IEEE80211_S_SCAN)
3718 		callout_stop(&sc->sc_scan_ch);
3719 
3720 	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3721 }
3722 
3723 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3724 static uint64_t
3725 rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3726 {
3727 	uint32_t tsftl, tsfth;
3728 
3729 	tsfth = RTW_READ(regs, RTW_TSFTRH);
3730 	tsftl = RTW_READ(regs, RTW_TSFTRL);
3731 	if (tsftl < rstamp)	/* Compensate for rollover. */
3732 		tsfth--;
3733 	return ((uint64_t)tsfth << 32) | rstamp;
3734 }
3735 
3736 static void
3737 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3738     struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3739 {
3740 	struct ifnet *ifp = ic->ic_ifp;
3741 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3742 
3743 	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3744 
3745 	switch (subtype) {
3746 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3747 	case IEEE80211_FC0_SUBTYPE_BEACON:
3748 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3749 		    ic->ic_state == IEEE80211_S_RUN &&
3750 		    device_is_active(sc->sc_dev)) {
3751 			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3752 			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3753 				(void)ieee80211_ibss_merge(ni);
3754 		}
3755 		break;
3756 	default:
3757 		break;
3758 	}
3759 	return;
3760 }
3761 
3762 static struct ieee80211_node *
3763 rtw_node_alloc(struct ieee80211_node_table *nt)
3764 {
3765 	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3766 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3767 	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3768 
3769 	DPRINTF(sc, RTW_DEBUG_NODE,
3770 	    ("%s: alloc node %p\n", device_xname(sc->sc_dev), ni));
3771 	return ni;
3772 }
3773 
3774 static void
3775 rtw_node_free(struct ieee80211_node *ni)
3776 {
3777 	struct ieee80211com *ic = ni->ni_ic;
3778 	struct ifnet *ifp = ic->ic_ifp;
3779 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3780 
3781 	DPRINTF(sc, RTW_DEBUG_NODE,
3782 	    ("%s: freeing node %p %s\n", device_xname(sc->sc_dev), ni,
3783 	    ether_sprintf(ni->ni_bssid)));
3784 	(*sc->sc_mtbl.mt_node_free)(ni);
3785 }
3786 
3787 static int
3788 rtw_media_change(struct ifnet *ifp)
3789 {
3790 	int error;
3791 
3792 	error = ieee80211_media_change(ifp);
3793 	if (error == ENETRESET) {
3794 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3795 		    (IFF_RUNNING|IFF_UP))
3796 			rtw_init(ifp);		/* XXX lose error */
3797 		error = 0;
3798 	}
3799 	return error;
3800 }
3801 
3802 static void
3803 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3804 {
3805 	struct rtw_softc *sc = ifp->if_softc;
3806 
3807 	if (!device_is_active(sc->sc_dev)) {
3808 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3809 		imr->ifm_status = 0;
3810 		return;
3811 	}
3812 	ieee80211_media_status(ifp, imr);
3813 }
3814 
3815 static inline void
3816 rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3817 {
3818 	(void)strlcpy(ifp->if_xname, dvname, IFNAMSIZ);
3819 	ifp->if_softc = softc;
3820 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3821 	    IFF_NOTRAILERS;
3822 	ifp->if_ioctl = rtw_ioctl;
3823 	ifp->if_start = rtw_start;
3824 	ifp->if_watchdog = rtw_watchdog;
3825 	ifp->if_init = rtw_init;
3826 	ifp->if_stop = rtw_stop;
3827 }
3828 
3829 static inline void
3830 rtw_set80211props(struct ieee80211com *ic)
3831 {
3832 	int nrate;
3833 	ic->ic_phytype = IEEE80211_T_DS;
3834 	ic->ic_opmode = IEEE80211_M_STA;
3835 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3836 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
3837 
3838 	nrate = 0;
3839 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3840 	    IEEE80211_RATE_BASIC | 2;
3841 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3842 	    IEEE80211_RATE_BASIC | 4;
3843 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3844 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3845 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3846 }
3847 
3848 static inline void
3849 rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3850 {
3851 	mtbl->mt_newstate = ic->ic_newstate;
3852 	ic->ic_newstate = rtw_newstate;
3853 
3854 	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3855 	ic->ic_recv_mgmt = rtw_recv_mgmt;
3856 
3857 	mtbl->mt_node_free = ic->ic_node_free;
3858 	ic->ic_node_free = rtw_node_free;
3859 
3860 	mtbl->mt_node_alloc = ic->ic_node_alloc;
3861 	ic->ic_node_alloc = rtw_node_alloc;
3862 
3863 	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3864 	ic->ic_crypto.cs_key_set = rtw_key_set;
3865 	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3866 	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3867 }
3868 
3869 static inline void
3870 rtw_init_radiotap(struct rtw_softc *sc)
3871 {
3872 	uint32_t present;
3873 
3874 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3875 	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3876 
3877 	if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
3878 		present = htole32(RTW_PHILIPS_RX_RADIOTAP_PRESENT);
3879 	else
3880 		present = htole32(RTW_RX_RADIOTAP_PRESENT);
3881 	sc->sc_rxtap.rr_ihdr.it_present = present;
3882 
3883 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3884 	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3885 	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3886 }
3887 
3888 static int
3889 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3890 {
3891 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3892 	SIMPLEQ_INIT(&tsb->tsb_freeq);
3893 	tsb->tsb_ndesc = qlen;
3894 	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3895 	    M_NOWAIT);
3896 	if (tsb->tsb_desc == NULL)
3897 		return ENOMEM;
3898 	return 0;
3899 }
3900 
3901 static void
3902 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3903 {
3904 	int pri;
3905 	struct rtw_txsoft_blk *tsb;
3906 
3907 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3908 		tsb = &sc->sc_txsoft_blk[pri];
3909 		free(tsb->tsb_desc, M_DEVBUF);
3910 		tsb->tsb_desc = NULL;
3911 	}
3912 }
3913 
3914 static int
3915 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3916 {
3917 	int pri, rc = 0;
3918 	int qlen[RTW_NTXPRI] =
3919 	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3920 	struct rtw_txsoft_blk *tsbs;
3921 
3922 	tsbs = sc->sc_txsoft_blk;
3923 
3924 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3925 		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3926 		if (rc != 0)
3927 			break;
3928 	}
3929 	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3930 	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3931 	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3932 	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3933 	return rc;
3934 }
3935 
3936 static void
3937 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3938     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3939 {
3940 	tdb->tdb_ndesc = ndesc;
3941 	tdb->tdb_desc = desc;
3942 	tdb->tdb_physbase = physbase;
3943 	tdb->tdb_ofs = ofs;
3944 
3945 	(void)memset(tdb->tdb_desc, 0,
3946 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3947 
3948 	rtw_txdesc_blk_init(tdb);
3949 	tdb->tdb_next = 0;
3950 }
3951 
3952 static void
3953 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3954 {
3955 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3956 	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3957 	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3958 
3959 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3960 	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3961 	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3962 
3963 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3964 	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3965 	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3966 
3967 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3968 	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3969 	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3970 }
3971 
3972 static struct rtw_rf *
3973 rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3974 {
3975 	rtw_rf_write_t rf_write;
3976 	struct rtw_rf *rf;
3977 
3978 	switch (rfchipid) {
3979 	default:
3980 		rf_write = rtw_rf_hostwrite;
3981 		break;
3982 	case RTW_RFCHIPID_INTERSIL:
3983 	case RTW_RFCHIPID_PHILIPS:
3984 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3985 	case RTW_RFCHIPID_RFMD:
3986 		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3987 		break;
3988 	}
3989 
3990 	switch (rfchipid) {
3991 	case RTW_RFCHIPID_GCT:
3992 		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3993 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3994 		break;
3995 	case RTW_RFCHIPID_MAXIM:
3996 		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3997 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3998 		break;
3999 	case RTW_RFCHIPID_PHILIPS:
4000 		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
4001 		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
4002 		break;
4003 	case RTW_RFCHIPID_RFMD:
4004 		/* XXX RFMD has no RF constructor */
4005 		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
4006 		/*FALLTHROUGH*/
4007 	default:
4008 		return NULL;
4009 	}
4010 	rf->rf_continuous_tx_cb =
4011 	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
4012 	rf->rf_continuous_tx_arg = (void *)sc;
4013 	return rf;
4014 }
4015 
4016 /* Revision C and later use a different PHY delay setting than
4017  * revisions A and B.
4018  */
4019 static uint8_t
4020 rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
4021 {
4022 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
4023 #define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
4024 
4025 	uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
4026 
4027 	RTW_WRITE(regs, RTW_RCR, REVAB);
4028 	RTW_WBW(regs, RTW_RCR, RTW_RCR);
4029 	RTW_WRITE(regs, RTW_RCR, REVC);
4030 
4031 	RTW_WBR(regs, RTW_RCR, RTW_RCR);
4032 	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
4033 		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
4034 
4035 	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
4036 	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
4037 
4038 	return phydelay;
4039 #undef REVC
4040 }
4041 
4042 void
4043 rtw_attach(struct rtw_softc *sc)
4044 {
4045 	struct ifnet *ifp = &sc->sc_if;
4046 	struct ieee80211com *ic = &sc->sc_ic;
4047 	struct rtw_txsoft_blk *tsb;
4048 	int pri, rc;
4049 
4050 	pmf_self_suspensor_init(sc->sc_dev, &sc->sc_suspensor, &sc->sc_qual);
4051 
4052 	rtw_cipher_wep = ieee80211_cipher_wep;
4053 	rtw_cipher_wep.ic_decap = rtw_wep_decap;
4054 
4055 	NEXT_ATTACH_STATE(sc, DETACHED);
4056 
4057 	sc->sc_soft_ih = softint_establish(SOFTINT_NET, rtw_softintr, sc);
4058 	if (sc->sc_soft_ih == NULL) {
4059 		aprint_error_dev(sc->sc_dev, "could not establish softint\n");
4060 		goto err;
4061 	}
4062 
4063 	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
4064 	case RTW_TCR_HWVERID_F:
4065 		sc->sc_hwverid = 'F';
4066 		break;
4067 	case RTW_TCR_HWVERID_D:
4068 		sc->sc_hwverid = 'D';
4069 		break;
4070 	default:
4071 		sc->sc_hwverid = '?';
4072 		break;
4073 	}
4074 	aprint_verbose_dev(sc->sc_dev, "hardware version %c\n",
4075 	    sc->sc_hwverid);
4076 
4077 	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4078 	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4079 	    0);
4080 
4081 	if (rc != 0) {
4082 		aprint_error_dev(sc->sc_dev,
4083 		    "could not allocate hw descriptors, error %d\n", rc);
4084 		goto err;
4085 	}
4086 
4087 	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4088 
4089 	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4090 	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4091 	    (void **)&sc->sc_descs, BUS_DMA_COHERENT);
4092 
4093 	if (rc != 0) {
4094 		aprint_error_dev(sc->sc_dev,
4095 		    "could not map hw descriptors, error %d\n", rc);
4096 		goto err;
4097 	}
4098 	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4099 
4100 	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4101 	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4102 
4103 	if (rc != 0) {
4104 		aprint_error_dev(sc->sc_dev,
4105 		    "could not create DMA map for hw descriptors, error %d\n",
4106 		    rc);
4107 		goto err;
4108 	}
4109 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4110 
4111 	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4112 	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4113 
4114 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4115 		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4116 		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4117 	}
4118 
4119 	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4120 	    sizeof(struct rtw_descs), NULL, 0);
4121 
4122 	if (rc != 0) {
4123 		aprint_error_dev(sc->sc_dev,
4124 		    "could not load DMA map for hw descriptors, error %d\n",
4125 		    rc);
4126 		goto err;
4127 	}
4128 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4129 
4130 	if (rtw_txsoft_blk_setup_all(sc) != 0)
4131 		goto err;
4132 	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4133 
4134 	rtw_txdesc_blk_setup_all(sc);
4135 
4136 	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4137 
4138 	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4139 
4140 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4141 		tsb = &sc->sc_txsoft_blk[pri];
4142 
4143 		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4144 		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4145 			aprint_error_dev(sc->sc_dev,
4146 			    "could not load DMA map for hw tx descriptors, "
4147 			    "error %d\n", rc);
4148 			goto err;
4149 		}
4150 	}
4151 
4152 	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4153 	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4154 	                                    RTW_RXQLEN)) != 0) {
4155 		aprint_error_dev(sc->sc_dev,
4156 		    "could not load DMA map for hw rx descriptors, error %d\n",
4157 		    rc);
4158 		goto err;
4159 	}
4160 	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4161 
4162 	/* Reset the chip to a known state. */
4163 	if (rtw_reset(sc) != 0)
4164 		goto err;
4165 	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4166 
4167 	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4168 
4169 	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4170 		sc->sc_flags |= RTW_F_9356SROM;
4171 
4172 	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4173 	    sc->sc_dev) != 0)
4174 		goto err;
4175 
4176 	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4177 
4178 	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4179 	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4180 	    sc->sc_dev) != 0) {
4181 		aprint_error_dev(sc->sc_dev,
4182 		    "attach failed, malformed serial ROM\n");
4183 		goto err;
4184 	}
4185 
4186 	aprint_verbose_dev(sc->sc_dev, "%s PHY\n",
4187 	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4188 
4189 	aprint_verbose_dev(sc->sc_dev, "carrier-sense threshold %u\n",
4190 	    sc->sc_csthr);
4191 
4192 	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4193 
4194 	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4195 	    sc->sc_flags & RTW_F_DIGPHY);
4196 
4197 	if (sc->sc_rf == NULL) {
4198 		aprint_verbose_dev(sc->sc_dev,
4199 		    "attach failed, could not attach RF\n");
4200 		goto err;
4201 	}
4202 
4203 	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4204 
4205 	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4206 
4207 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4208 	    ("%s: PHY delay %d\n", device_xname(sc->sc_dev), sc->sc_phydelay));
4209 
4210 	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4211 		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4212 
4213 	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels, sc->sc_dev);
4214 
4215 	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4216 	    sc->sc_dev) != 0)
4217 		goto err;
4218 	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4219 
4220 	rtw_setifprops(ifp, device_xname(sc->sc_dev), (void*)sc);
4221 
4222 	IFQ_SET_READY(&ifp->if_snd);
4223 
4224 	sc->sc_ic.ic_ifp = ifp;
4225 	rtw_set80211props(&sc->sc_ic);
4226 
4227 	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4228 	NEXT_ATTACH_STATE(sc, FINISH_LED_ATTACH);
4229 
4230 	/*
4231 	 * Call MI attach routines.
4232 	 */
4233 	rc = if_initialize(ifp);
4234 	if (rc != 0) {
4235 		aprint_error_dev(sc->sc_dev, "if_initialize failed(%d)\n", rc);
4236 		goto err;
4237 	}
4238 	ieee80211_ifattach(ic);
4239 	/* Use common softint-based if_input */
4240 	ifp->if_percpuq = if_percpuq_create(ifp);
4241 	if_register(ifp);
4242 
4243 	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4244 
4245 	/* possibly we should fill in our own sc_send_prresp, since
4246 	 * the RTL8180 is probably sending probe responses in ad hoc
4247 	 * mode.
4248 	 */
4249 
4250 	/* complete initialization */
4251 	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4252 	callout_init(&sc->sc_scan_ch, 0);
4253 
4254 	rtw_init_radiotap(sc);
4255 
4256 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
4257 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4258 
4259 	NEXT_ATTACH_STATE(sc, FINISHED);
4260 
4261 	ieee80211_announce(ic);
4262 	return;
4263 err:
4264 	rtw_detach(sc);
4265 	return;
4266 }
4267 
4268 int
4269 rtw_detach(struct rtw_softc *sc)
4270 {
4271 	struct ifnet *ifp = &sc->sc_if;
4272 	int pri, s;
4273 
4274 	s = splnet();
4275 
4276 	switch (sc->sc_attach_state) {
4277 	case FINISHED:
4278 		rtw_stop(ifp, 1);
4279 
4280 		pmf_device_deregister(sc->sc_dev);
4281 		callout_stop(&sc->sc_scan_ch);
4282 		ieee80211_ifdetach(&sc->sc_ic);
4283 		if_detach(ifp);
4284 	case FINISH_LED_ATTACH:
4285 		rtw_led_detach(&sc->sc_led_state);
4286 		/*FALLTHROUGH*/
4287 	case FINISH_ID_STA:
4288 	case FINISH_RF_ATTACH:
4289 		rtw_rf_destroy(sc->sc_rf);
4290 		sc->sc_rf = NULL;
4291 		/*FALLTHROUGH*/
4292 	case FINISH_PARSE_SROM:
4293 	case FINISH_READ_SROM:
4294 		rtw_srom_free(&sc->sc_srom);
4295 		/*FALLTHROUGH*/
4296 	case FINISH_RESET:
4297 	case FINISH_RXMAPS_CREATE:
4298 		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4299 		    RTW_RXQLEN);
4300 		/*FALLTHROUGH*/
4301 	case FINISH_TXMAPS_CREATE:
4302 		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4303 			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4304 			    sc->sc_txsoft_blk[pri].tsb_desc,
4305 			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4306 		}
4307 		/*FALLTHROUGH*/
4308 	case FINISH_TXDESCBLK_SETUP:
4309 	case FINISH_TXCTLBLK_SETUP:
4310 		rtw_txsoft_blk_cleanup_all(sc);
4311 		/*FALLTHROUGH*/
4312 	case FINISH_DESCMAP_LOAD:
4313 		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4314 		/*FALLTHROUGH*/
4315 	case FINISH_DESCMAP_CREATE:
4316 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4317 		/*FALLTHROUGH*/
4318 	case FINISH_DESC_MAP:
4319 		bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_descs,
4320 		    sizeof(struct rtw_descs));
4321 		/*FALLTHROUGH*/
4322 	case FINISH_DESC_ALLOC:
4323 		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4324 		    sc->sc_desc_nsegs);
4325 		/*FALLTHROUGH*/
4326 	case DETACHED:
4327 		if (sc->sc_soft_ih != NULL) {
4328 			softint_disestablish(sc->sc_soft_ih);
4329 			sc->sc_soft_ih = NULL;
4330 		}
4331 		NEXT_ATTACH_STATE(sc, DETACHED);
4332 		break;
4333 	}
4334 	splx(s);
4335 	return 0;
4336 }
4337