xref: /netbsd-src/sys/dev/ic/rtw.c (revision fad4c9f71477ae11cea2ee75ec82151ac770a534)
1 /* $NetBSD: rtw.c,v 1.74 2006/05/26 13:01:53 blymn Exp $ */
2 /*-
3  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
4  *
5  * Programmed for NetBSD by David Young.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. The name of David Young may not be used to endorse or promote
16  *    products derived from this software without specific prior
17  *    written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
20  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
23  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
25  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
30  * OF SUCH DAMAGE.
31  */
32 /*
33  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
34  */
35 
36 #include <sys/cdefs.h>
37 __KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.74 2006/05/26 13:01:53 blymn Exp $");
38 
39 #include "bpfilter.h"
40 
41 #include <sys/param.h>
42 #include <sys/sysctl.h>
43 #include <sys/systm.h>
44 #include <sys/callout.h>
45 #include <sys/mbuf.h>
46 #include <sys/malloc.h>
47 #include <sys/kernel.h>
48 #include <sys/time.h>
49 #include <sys/types.h>
50 
51 #include <machine/endian.h>
52 #include <machine/bus.h>
53 #include <machine/intr.h>	/* splnet */
54 
55 #include <uvm/uvm_extern.h>
56 
57 #include <net/if.h>
58 #include <net/if_media.h>
59 #include <net/if_ether.h>
60 
61 #include <net80211/ieee80211_netbsd.h>
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_radiotap.h>
64 
65 #if NBPFILTER > 0
66 #include <net/bpf.h>
67 #endif
68 
69 #include <dev/ic/rtwreg.h>
70 #include <dev/ic/rtwvar.h>
71 #include <dev/ic/rtwphyio.h>
72 #include <dev/ic/rtwphy.h>
73 
74 #include <dev/ic/smc93cx6var.h>
75 
76 #define	KASSERT2(__cond, __msg)		\
77 	do {				\
78 		if (!(__cond))		\
79 			panic __msg ;	\
80 	} while (0)
81 
82 static int rtw_rfprog_fallback = 0;
83 static int rtw_host_rfio = 0;
84 
85 #ifdef RTW_DEBUG
86 int rtw_debug = 0;
87 static int rtw_rxbufs_limit = RTW_RXQLEN;
88 #endif /* RTW_DEBUG */
89 
90 #define NEXT_ATTACH_STATE(sc, state) do {			\
91 	DPRINTF(sc, RTW_DEBUG_ATTACH,				\
92 	    ("%s: attach state %s\n", __func__, #state));	\
93 	sc->sc_attach_state = state;				\
94 } while (0)
95 
96 static int rtw_xmtr_restart = 0;
97 static int rtw_do_chip_reset = 0;
98 static int rtw_ring_reset = 0;
99 
100 int rtw_dwelltime = 200;	/* milliseconds */
101 static struct ieee80211_cipher rtw_cipher_wep;
102 
103 static void rtw_start(struct ifnet *);
104 static void rtw_reset_oactive(struct rtw_softc *);
105 static struct mbuf *rtw_beacon_alloc(struct rtw_softc *,
106     struct ieee80211_node *);
107 static u_int rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
108 
109 static void rtw_io_enable(struct rtw_regs *, uint8_t, int);
110 static int rtw_key_delete(struct ieee80211com *, const struct ieee80211_key *);
111 static int rtw_key_set(struct ieee80211com *, const struct ieee80211_key *,
112     const u_int8_t[IEEE80211_ADDR_LEN]);
113 static void rtw_key_update_end(struct ieee80211com *);
114 static void rtw_key_update_begin(struct ieee80211com *);
115 static int rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
116 static void rtw_wep_setkeys(struct rtw_softc *, struct ieee80211_key *, int);
117 
118 static void rtw_led_attach(struct rtw_led_state *, void *);
119 static void rtw_led_init(struct rtw_regs *);
120 static void rtw_led_slowblink(void *);
121 static void rtw_led_fastblink(void *);
122 static void rtw_led_set(struct rtw_led_state *, struct rtw_regs *, int);
123 
124 static int rtw_sysctl_verify_rfio(SYSCTLFN_PROTO);
125 static int rtw_sysctl_verify_rfprog(SYSCTLFN_PROTO);
126 #ifdef RTW_DEBUG
127 static void rtw_print_txdesc(struct rtw_softc *, const char *,
128     struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
129 static int rtw_sysctl_verify_debug(SYSCTLFN_PROTO);
130 static int rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_PROTO);
131 #endif /* RTW_DEBUG */
132 
133 /*
134  * Setup sysctl(3) MIB, hw.rtw.*
135  *
136  * TBD condition CTLFLAG_PERMANENT on being an LKM or not
137  */
138 SYSCTL_SETUP(sysctl_rtw, "sysctl rtw(4) subtree setup")
139 {
140 	int rc;
141 	const struct sysctlnode *cnode, *rnode;
142 
143 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
144 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
145 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
146 		goto err;
147 
148 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
149 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "rtw",
150 	    "Realtek RTL818x 802.11 controls",
151 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
152 		goto err;
153 
154 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
155 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
156 	    "chip_reset", SYSCTL_DESCR("Gratuitously reset chip on rcvr error"),
157 	    NULL, 0, &rtw_do_chip_reset, 0,
158 	    CTL_CREATE, CTL_EOL)) != 0)
159 		goto err;
160 
161 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
162 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
163 	    "ring_reset", SYSCTL_DESCR("Reset ring pointers on rcvr error"),
164 	    NULL, 0, &rtw_ring_reset, 0,
165 	    CTL_CREATE, CTL_EOL)) != 0)
166 		goto err;
167 
168 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
169 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
170 	    "xmtr_restart",
171 	    SYSCTL_DESCR("Gratuitously reset xmtr on rcvr error"),
172 	    NULL, 0, &rtw_xmtr_restart, 0,
173 	    CTL_CREATE, CTL_EOL)) != 0)
174 		goto err;
175 
176 #ifdef RTW_DEBUG
177 	/* control debugging printfs */
178 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
179 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
180 	    "debug", SYSCTL_DESCR("Enable RTL818x debugging output"),
181 	    rtw_sysctl_verify_debug, 0, &rtw_debug, 0,
182 	    CTL_CREATE, CTL_EOL)) != 0)
183 		goto err;
184 
185 	/* Limit rx buffers, for simulating resource exhaustion. */
186 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
187 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
188 	    "rxbufs_limit",
189 	    SYSCTL_DESCR("Set rx buffers limit"),
190 	    rtw_sysctl_verify_rxbufs_limit, 0, &rtw_rxbufs_limit, 0,
191 	    CTL_CREATE, CTL_EOL)) != 0)
192 		goto err;
193 
194 #endif /* RTW_DEBUG */
195 	/* set fallback RF programming method */
196 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
197 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
198 	    "rfprog_fallback",
199 	    SYSCTL_DESCR("Set fallback RF programming method"),
200 	    rtw_sysctl_verify_rfprog, 0, &rtw_rfprog_fallback, 0,
201 	    CTL_CREATE, CTL_EOL)) != 0)
202 		goto err;
203 
204 	/* force host to control RF I/O bus */
205 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
206 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
207 	    "host_rfio", SYSCTL_DESCR("Enable host control of RF I/O"),
208 	    rtw_sysctl_verify_rfio, 0, &rtw_host_rfio, 0,
209 	    CTL_CREATE, CTL_EOL)) != 0)
210 		goto err;
211 
212 	return;
213 err:
214 	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
215 }
216 
217 static int
218 rtw_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
219 {
220 	int error, t;
221 	struct sysctlnode node;
222 
223 	node = *rnode;
224 	t = *(int*)rnode->sysctl_data;
225 	node.sysctl_data = &t;
226 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
227 	if (error || newp == NULL)
228 		return (error);
229 
230 	if (t < lower || t > upper)
231 		return (EINVAL);
232 
233 	*(int*)rnode->sysctl_data = t;
234 
235 	return (0);
236 }
237 
238 static int
239 rtw_sysctl_verify_rfprog(SYSCTLFN_ARGS)
240 {
241 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0,
242 	    SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK));
243 }
244 
245 static int
246 rtw_sysctl_verify_rfio(SYSCTLFN_ARGS)
247 {
248 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)), 0, 1);
249 }
250 
251 #ifdef RTW_DEBUG
252 static int
253 rtw_sysctl_verify_debug(SYSCTLFN_ARGS)
254 {
255 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
256 	    0, RTW_DEBUG_MAX);
257 }
258 
259 static int
260 rtw_sysctl_verify_rxbufs_limit(SYSCTLFN_ARGS)
261 {
262 	return rtw_sysctl_verify(SYSCTLFN_CALL(__UNCONST(rnode)),
263 	    0, RTW_RXQLEN);
264 }
265 
266 static void
267 rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
268 {
269 #define PRINTREG32(sc, reg)				\
270 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
271 	    ("%s: reg[ " #reg " / %03x ] = %08x\n",	\
272 	    dvname, reg, RTW_READ(regs, reg)))
273 
274 #define PRINTREG16(sc, reg)				\
275 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
276 	    ("%s: reg[ " #reg " / %03x ] = %04x\n",	\
277 	    dvname, reg, RTW_READ16(regs, reg)))
278 
279 #define PRINTREG8(sc, reg)				\
280 	RTW_DPRINTF(RTW_DEBUG_REGDUMP,			\
281 	    ("%s: reg[ " #reg " / %03x ] = %02x\n",	\
282 	    dvname, reg, RTW_READ8(regs, reg)))
283 
284 	RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
285 
286 	PRINTREG32(regs, RTW_IDR0);
287 	PRINTREG32(regs, RTW_IDR1);
288 	PRINTREG32(regs, RTW_MAR0);
289 	PRINTREG32(regs, RTW_MAR1);
290 	PRINTREG32(regs, RTW_TSFTRL);
291 	PRINTREG32(regs, RTW_TSFTRH);
292 	PRINTREG32(regs, RTW_TLPDA);
293 	PRINTREG32(regs, RTW_TNPDA);
294 	PRINTREG32(regs, RTW_THPDA);
295 	PRINTREG32(regs, RTW_TCR);
296 	PRINTREG32(regs, RTW_RCR);
297 	PRINTREG32(regs, RTW_TINT);
298 	PRINTREG32(regs, RTW_TBDA);
299 	PRINTREG32(regs, RTW_ANAPARM);
300 	PRINTREG32(regs, RTW_BB);
301 	PRINTREG32(regs, RTW_PHYCFG);
302 	PRINTREG32(regs, RTW_WAKEUP0L);
303 	PRINTREG32(regs, RTW_WAKEUP0H);
304 	PRINTREG32(regs, RTW_WAKEUP1L);
305 	PRINTREG32(regs, RTW_WAKEUP1H);
306 	PRINTREG32(regs, RTW_WAKEUP2LL);
307 	PRINTREG32(regs, RTW_WAKEUP2LH);
308 	PRINTREG32(regs, RTW_WAKEUP2HL);
309 	PRINTREG32(regs, RTW_WAKEUP2HH);
310 	PRINTREG32(regs, RTW_WAKEUP3LL);
311 	PRINTREG32(regs, RTW_WAKEUP3LH);
312 	PRINTREG32(regs, RTW_WAKEUP3HL);
313 	PRINTREG32(regs, RTW_WAKEUP3HH);
314 	PRINTREG32(regs, RTW_WAKEUP4LL);
315 	PRINTREG32(regs, RTW_WAKEUP4LH);
316 	PRINTREG32(regs, RTW_WAKEUP4HL);
317 	PRINTREG32(regs, RTW_WAKEUP4HH);
318 	PRINTREG32(regs, RTW_DK0);
319 	PRINTREG32(regs, RTW_DK1);
320 	PRINTREG32(regs, RTW_DK2);
321 	PRINTREG32(regs, RTW_DK3);
322 	PRINTREG32(regs, RTW_RETRYCTR);
323 	PRINTREG32(regs, RTW_RDSAR);
324 	PRINTREG32(regs, RTW_FER);
325 	PRINTREG32(regs, RTW_FEMR);
326 	PRINTREG32(regs, RTW_FPSR);
327 	PRINTREG32(regs, RTW_FFER);
328 
329 	/* 16-bit registers */
330 	PRINTREG16(regs, RTW_BRSR);
331 	PRINTREG16(regs, RTW_IMR);
332 	PRINTREG16(regs, RTW_ISR);
333 	PRINTREG16(regs, RTW_BCNITV);
334 	PRINTREG16(regs, RTW_ATIMWND);
335 	PRINTREG16(regs, RTW_BINTRITV);
336 	PRINTREG16(regs, RTW_ATIMTRITV);
337 	PRINTREG16(regs, RTW_CRC16ERR);
338 	PRINTREG16(regs, RTW_CRC0);
339 	PRINTREG16(regs, RTW_CRC1);
340 	PRINTREG16(regs, RTW_CRC2);
341 	PRINTREG16(regs, RTW_CRC3);
342 	PRINTREG16(regs, RTW_CRC4);
343 	PRINTREG16(regs, RTW_CWR);
344 
345 	/* 8-bit registers */
346 	PRINTREG8(regs, RTW_CR);
347 	PRINTREG8(regs, RTW_9346CR);
348 	PRINTREG8(regs, RTW_CONFIG0);
349 	PRINTREG8(regs, RTW_CONFIG1);
350 	PRINTREG8(regs, RTW_CONFIG2);
351 	PRINTREG8(regs, RTW_MSR);
352 	PRINTREG8(regs, RTW_CONFIG3);
353 	PRINTREG8(regs, RTW_CONFIG4);
354 	PRINTREG8(regs, RTW_TESTR);
355 	PRINTREG8(regs, RTW_PSR);
356 	PRINTREG8(regs, RTW_SCR);
357 	PRINTREG8(regs, RTW_PHYDELAY);
358 	PRINTREG8(regs, RTW_CRCOUNT);
359 	PRINTREG8(regs, RTW_PHYADDR);
360 	PRINTREG8(regs, RTW_PHYDATAW);
361 	PRINTREG8(regs, RTW_PHYDATAR);
362 	PRINTREG8(regs, RTW_CONFIG5);
363 	PRINTREG8(regs, RTW_TPPOLL);
364 
365 	PRINTREG16(regs, RTW_BSSID16);
366 	PRINTREG32(regs, RTW_BSSID32);
367 #undef PRINTREG32
368 #undef PRINTREG16
369 #undef PRINTREG8
370 }
371 #endif /* RTW_DEBUG */
372 
373 void
374 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
375 {
376 	struct rtw_regs *regs = &sc->sc_regs;
377 
378 	uint32_t tcr;
379 	tcr = RTW_READ(regs, RTW_TCR);
380 	tcr &= ~RTW_TCR_LBK_MASK;
381 	if (enable)
382 		tcr |= RTW_TCR_LBK_CONT;
383 	else
384 		tcr |= RTW_TCR_LBK_NORMAL;
385 	RTW_WRITE(regs, RTW_TCR, tcr);
386 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
387 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
388 	rtw_txdac_enable(sc, !enable);
389 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
390 	rtw_set_access(regs, RTW_ACCESS_NONE);
391 }
392 
393 #ifdef RTW_DEBUG
394 static const char *
395 rtw_access_string(enum rtw_access access)
396 {
397 	switch (access) {
398 	case RTW_ACCESS_NONE:
399 		return "none";
400 	case RTW_ACCESS_CONFIG:
401 		return "config";
402 	case RTW_ACCESS_ANAPARM:
403 		return "anaparm";
404 	default:
405 		return "unknown";
406 	}
407 }
408 #endif /* RTW_DEBUG */
409 
410 static void
411 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
412 {
413 	KASSERT(naccess >= RTW_ACCESS_NONE && naccess <= RTW_ACCESS_ANAPARM);
414 	KASSERT(regs->r_access >= RTW_ACCESS_NONE &&
415 	        regs->r_access <= RTW_ACCESS_ANAPARM);
416 
417 	if (naccess == regs->r_access)
418 		return;
419 
420 	switch (naccess) {
421 	case RTW_ACCESS_NONE:
422 		switch (regs->r_access) {
423 		case RTW_ACCESS_ANAPARM:
424 			rtw_anaparm_enable(regs, 0);
425 			/*FALLTHROUGH*/
426 		case RTW_ACCESS_CONFIG:
427 			rtw_config0123_enable(regs, 0);
428 			/*FALLTHROUGH*/
429 		case RTW_ACCESS_NONE:
430 			break;
431 		}
432 		break;
433 	case RTW_ACCESS_CONFIG:
434 		switch (regs->r_access) {
435 		case RTW_ACCESS_NONE:
436 			rtw_config0123_enable(regs, 1);
437 			/*FALLTHROUGH*/
438 		case RTW_ACCESS_CONFIG:
439 			break;
440 		case RTW_ACCESS_ANAPARM:
441 			rtw_anaparm_enable(regs, 0);
442 			break;
443 		}
444 		break;
445 	case RTW_ACCESS_ANAPARM:
446 		switch (regs->r_access) {
447 		case RTW_ACCESS_NONE:
448 			rtw_config0123_enable(regs, 1);
449 			/*FALLTHROUGH*/
450 		case RTW_ACCESS_CONFIG:
451 			rtw_anaparm_enable(regs, 1);
452 			/*FALLTHROUGH*/
453 		case RTW_ACCESS_ANAPARM:
454 			break;
455 		}
456 		break;
457 	}
458 }
459 
460 void
461 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
462 {
463 	rtw_set_access1(regs, access);
464 	RTW_DPRINTF(RTW_DEBUG_ACCESS,
465 	    ("%s: access %s -> %s\n", __func__,
466 	    rtw_access_string(regs->r_access),
467 	    rtw_access_string(access)));
468 	regs->r_access = access;
469 }
470 
471 /*
472  * Enable registers, switch register banks.
473  */
474 void
475 rtw_config0123_enable(struct rtw_regs *regs, int enable)
476 {
477 	uint8_t ecr;
478 	ecr = RTW_READ8(regs, RTW_9346CR);
479 	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
480 	if (enable)
481 		ecr |= RTW_9346CR_EEM_CONFIG;
482 	else {
483 		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
484 		ecr |= RTW_9346CR_EEM_NORMAL;
485 	}
486 	RTW_WRITE8(regs, RTW_9346CR, ecr);
487 	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
488 }
489 
490 /* requires rtw_config0123_enable(, 1) */
491 void
492 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
493 {
494 	uint8_t cfg3;
495 
496 	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
497 	cfg3 |= RTW_CONFIG3_CLKRUNEN;
498 	if (enable)
499 		cfg3 |= RTW_CONFIG3_PARMEN;
500 	else
501 		cfg3 &= ~RTW_CONFIG3_PARMEN;
502 	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
503 	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
504 }
505 
506 /* requires rtw_anaparm_enable(, 1) */
507 void
508 rtw_txdac_enable(struct rtw_softc *sc, int enable)
509 {
510 	uint32_t anaparm;
511 	struct rtw_regs *regs = &sc->sc_regs;
512 
513 	anaparm = RTW_READ(regs, RTW_ANAPARM);
514 	if (enable)
515 		anaparm &= ~RTW_ANAPARM_TXDACOFF;
516 	else
517 		anaparm |= RTW_ANAPARM_TXDACOFF;
518 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
519 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
520 }
521 
522 static inline int
523 rtw_chip_reset1(struct rtw_regs *regs, const char *dvname)
524 {
525 	uint8_t cr;
526 	int i;
527 
528 	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
529 
530 	RTW_WBR(regs, RTW_CR, RTW_CR);
531 
532 	for (i = 0; i < 1000; i++) {
533 		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
534 			RTW_DPRINTF(RTW_DEBUG_RESET,
535 			    ("%s: reset in %dus\n", dvname, i));
536 			return 0;
537 		}
538 		RTW_RBR(regs, RTW_CR, RTW_CR);
539 		DELAY(10); /* 10us */
540 	}
541 
542 	printf("%s: reset failed\n", dvname);
543 	return ETIMEDOUT;
544 }
545 
546 static inline int
547 rtw_chip_reset(struct rtw_regs *regs, const char *dvname)
548 {
549 	uint32_t tcr;
550 
551 	/* from Linux driver */
552 	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
553 	      SHIFTIN(7, RTW_TCR_SRL_MASK) | SHIFTIN(7, RTW_TCR_LRL_MASK);
554 
555 	RTW_WRITE(regs, RTW_TCR, tcr);
556 
557 	RTW_WBW(regs, RTW_CR, RTW_TCR);
558 
559 	return rtw_chip_reset1(regs, dvname);
560 }
561 
562 static int
563 rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
564 {
565 	struct ieee80211_key keycopy;
566 
567 	RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
568 
569 	keycopy = *k;
570 	keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
571 
572 	return (*ieee80211_cipher_wep.ic_decap)(&keycopy, m, hdrlen);
573 }
574 
575 static int
576 rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
577 {
578 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
579 	u_int keyix = k->wk_keyix;
580 
581 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__, keyix));
582 
583 	if (keyix >= IEEE80211_WEP_NKID)
584 		return 0;
585 	if (k->wk_keylen != 0)
586 		sc->sc_flags &= ~RTW_F_DK_VALID;
587 
588 	return 1;
589 }
590 
591 static int
592 rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
593 	const u_int8_t mac[IEEE80211_ADDR_LEN])
594 {
595 	struct rtw_softc *sc = ic->ic_ifp->if_softc;
596 
597 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
598 
599 	if (k->wk_keyix >= IEEE80211_WEP_NKID)
600 		return 0;
601 
602 	sc->sc_flags &= ~RTW_F_DK_VALID;
603 
604 	return 1;
605 }
606 
607 static void
608 rtw_key_update_begin(struct ieee80211com *ic)
609 {
610 #ifdef RTW_DEBUG
611 	struct ifnet *ifp = ic->ic_ifp;
612 	struct rtw_softc *sc = ifp->if_softc;
613 #endif
614 
615 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
616 }
617 
618 static void
619 rtw_key_update_end(struct ieee80211com *ic)
620 {
621 	struct ifnet *ifp = ic->ic_ifp;
622 	struct rtw_softc *sc = ifp->if_softc;
623 
624 	DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
625 
626 	if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
627 	    (sc->sc_flags & RTW_F_ENABLED) == 0 ||
628 	    (sc->sc_flags & RTW_F_INVALID) != 0)
629 		return;
630 
631 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
632 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
633 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE,
634 	    (ifp->if_flags & IFF_RUNNING) != 0);
635 }
636 
637 static inline int
638 rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
639 {
640 	if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
641 		return 0;
642 
643 	return	((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
644 		((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
645 }
646 
647 static void
648 rtw_wep_setkeys(struct rtw_softc *sc, struct ieee80211_key *wk, int txkey)
649 {
650 	uint8_t psr, scr;
651 	int i, keylen;
652 	struct rtw_regs *regs;
653 	union rtw_keys *rk;
654 
655 	regs = &sc->sc_regs;
656 	rk = &sc->sc_keys;
657 
658 	(void)memset(rk->rk_keys, 0, sizeof(rk->rk_keys));
659 
660 	/* Temporarily use software crypto for all keys. */
661 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
662 		if (wk[i].wk_cipher == &rtw_cipher_wep)
663 			wk[i].wk_cipher = &ieee80211_cipher_wep;
664 	}
665 
666 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
667 
668 	psr = RTW_READ8(regs, RTW_PSR);
669 	scr = RTW_READ8(regs, RTW_SCR);
670 	scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
671 
672 	if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
673 		goto out;
674 
675 	for (keylen = i = 0; i < IEEE80211_WEP_NKID; i++) {
676 		if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
677 			continue;
678 		if (i == txkey) {
679 			keylen = wk[i].wk_keylen;
680 			break;
681 		}
682 		keylen = MAX(keylen, wk[i].wk_keylen);
683 	}
684 
685 	if (keylen == 5)
686 		scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
687 	else if (keylen == 13)
688 		scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
689 
690 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
691 		if (wk[i].wk_keylen != keylen ||
692 		    wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
693 			continue;
694 		/* h/w will decrypt, s/w still strips headers */
695 		wk[i].wk_cipher = &rtw_cipher_wep;
696 		(void)memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
697 	}
698 
699 out:
700 	RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
701 
702 	bus_space_write_region_4(regs->r_bt, regs->r_bh,
703 	    RTW_DK0, rk->rk_words,
704 	    sizeof(rk->rk_words) / sizeof(rk->rk_words[0]));
705 
706 	bus_space_barrier(regs->r_bt, regs->r_bh, RTW_DK0, sizeof(rk->rk_words),
707 	    BUS_SPACE_BARRIER_SYNC);
708 
709 	RTW_WBW(regs, RTW_DK0, RTW_PSR);
710 	RTW_WRITE8(regs, RTW_PSR, psr);
711 	RTW_WBW(regs, RTW_PSR, RTW_SCR);
712 	RTW_WRITE8(regs, RTW_SCR, scr);
713 	RTW_SYNC(regs, RTW_SCR, RTW_SCR);
714 	rtw_set_access(regs, RTW_ACCESS_NONE);
715 	sc->sc_flags |= RTW_F_DK_VALID;
716 }
717 
718 static inline int
719 rtw_recall_eeprom(struct rtw_regs *regs, const char *dvname)
720 {
721 	int i;
722 	uint8_t ecr;
723 
724 	ecr = RTW_READ8(regs, RTW_9346CR);
725 	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
726 	RTW_WRITE8(regs, RTW_9346CR, ecr);
727 
728 	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
729 
730 	/* wait 25ms for completion */
731 	for (i = 0; i < 250; i++) {
732 		ecr = RTW_READ8(regs, RTW_9346CR);
733 		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
734 			RTW_DPRINTF(RTW_DEBUG_RESET,
735 			    ("%s: recall EEPROM in %dus\n", dvname, i * 100));
736 			return 0;
737 		}
738 		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
739 		DELAY(100);
740 	}
741 	printf("%s: recall EEPROM failed\n", dvname);
742 	return ETIMEDOUT;
743 }
744 
745 static inline int
746 rtw_reset(struct rtw_softc *sc)
747 {
748 	int rc;
749 	uint8_t config1;
750 
751 	sc->sc_flags &= ~RTW_F_DK_VALID;
752 
753 	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
754 		return rc;
755 
756 	if ((rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
757 		;
758 
759 	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
760 	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
761 	/* TBD turn off maximum power saving? */
762 
763 	return 0;
764 }
765 
766 static inline int
767 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
768     u_int ndescs)
769 {
770 	int i, rc = 0;
771 	for (i = 0; i < ndescs; i++) {
772 		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
773 		    0, 0, &descs[i].ts_dmamap);
774 		if (rc != 0)
775 			break;
776 	}
777 	return rc;
778 }
779 
780 static inline int
781 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
782     u_int ndescs)
783 {
784 	int i, rc = 0;
785 	for (i = 0; i < ndescs; i++) {
786 		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
787 		    &descs[i].rs_dmamap);
788 		if (rc != 0)
789 			break;
790 	}
791 	return rc;
792 }
793 
794 static inline void
795 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
796     u_int ndescs)
797 {
798 	int i;
799 	for (i = 0; i < ndescs; i++) {
800 		if (descs[i].rs_dmamap != NULL)
801 			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
802 	}
803 }
804 
805 static inline void
806 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
807     u_int ndescs)
808 {
809 	int i;
810 	for (i = 0; i < ndescs; i++) {
811 		if (descs[i].ts_dmamap != NULL)
812 			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
813 	}
814 }
815 
816 static inline void
817 rtw_srom_free(struct rtw_srom *sr)
818 {
819 	sr->sr_size = 0;
820 	if (sr->sr_content == NULL)
821 		return;
822 	free(sr->sr_content, M_DEVBUF);
823 	sr->sr_content = NULL;
824 }
825 
826 static void
827 rtw_srom_defaults(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
828     enum rtw_rfchipid *rfchipid, uint32_t *rcr)
829 {
830 	*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
831 	*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
832 	*rcr |= RTW_RCR_ENCS1;
833 	*rfchipid = RTW_RFCHIPID_PHILIPS;
834 }
835 
836 static int
837 rtw_srom_parse(struct rtw_srom *sr, uint32_t *flags, uint8_t *cs_threshold,
838     enum rtw_rfchipid *rfchipid, uint32_t *rcr, enum rtw_locale *locale,
839     const char *dvname)
840 {
841 	int i;
842 	const char *rfname, *paname;
843 	char scratch[sizeof("unknown 0xXX")];
844 	uint16_t srom_version;
845 	uint8_t mac[IEEE80211_ADDR_LEN];
846 
847 	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
848 	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
849 
850 	srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
851 	printf("%s: SROM version %d.%d", dvname,
852 	    srom_version >> 8, srom_version & 0xff);
853 
854 	if (srom_version <= 0x0101) {
855 		printf(" is not understood, limping along with defaults\n");
856 		rtw_srom_defaults(sr, flags, cs_threshold, rfchipid, rcr);
857 		return 0;
858 	}
859 	printf("\n");
860 
861 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
862 		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
863 
864 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
865 	    ("%s: EEPROM MAC %s\n", dvname, ether_sprintf(mac)));
866 
867 	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
868 
869 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
870 		*flags |= RTW_F_ANTDIV;
871 
872 	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
873 	 * to be reversed.
874 	 */
875 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
876 		*flags |= RTW_F_DIGPHY;
877 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
878 		*flags |= RTW_F_DFLANTB;
879 
880 	*rcr |= SHIFTIN(SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
881 	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
882 
883 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
884 		*flags |= RTW_C_RXWEP_104;
885 
886 	*flags |= RTW_C_RXWEP_40;	/* XXX */
887 
888 	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
889 	switch (*rfchipid) {
890 	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
891 		rfname = "GCT GRF5101";
892 		paname = "Winspring WS9901";
893 		break;
894 	case RTW_RFCHIPID_MAXIM:
895 		rfname = "Maxim MAX2820";	/* guess */
896 		paname = "Maxim MAX2422";	/* guess */
897 		break;
898 	case RTW_RFCHIPID_INTERSIL:
899 		rfname = "Intersil HFA3873";	/* guess */
900 		paname = "Intersil <unknown>";
901 		break;
902 	case RTW_RFCHIPID_PHILIPS:	/* this combo seen in the wild */
903 		rfname = "Philips SA2400A";
904 		paname = "Philips SA2411";
905 		break;
906 	case RTW_RFCHIPID_RFMD:
907 		/* this is the same front-end as an atw(4)! */
908 		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
909 			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
910 			 "SYN: Silicon Labs Si4126";	/* inferred from
911 			 				 * reference driver
912 							 */
913 		paname = "RFMD RF2189";		/* mentioned in Realtek docs */
914 		break;
915 	case RTW_RFCHIPID_RESERVED:
916 		rfname = paname = "reserved";
917 		break;
918 	default:
919 		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", *rfchipid);
920 		rfname = paname = scratch;
921 	}
922 	printf("%s: RF: %s, PA: %s\n", dvname, rfname, paname);
923 
924 	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
925 	case RTW_CONFIG0_GL_USA:
926 	case _RTW_CONFIG0_GL_USA:
927 		*locale = RTW_LOCALE_USA;
928 		break;
929 	case RTW_CONFIG0_GL_EUROPE:
930 		*locale = RTW_LOCALE_EUROPE;
931 		break;
932 	case RTW_CONFIG0_GL_JAPAN:
933 		*locale = RTW_LOCALE_JAPAN;
934 		break;
935 	default:
936 		*locale = RTW_LOCALE_UNKNOWN;
937 		break;
938 	}
939 	return 0;
940 }
941 
942 /* Returns -1 on failure. */
943 static int
944 rtw_srom_read(struct rtw_regs *regs, uint32_t flags, struct rtw_srom *sr,
945     const char *dvname)
946 {
947 	int rc;
948 	struct seeprom_descriptor sd;
949 	uint8_t ecr;
950 
951 	(void)memset(&sd, 0, sizeof(sd));
952 
953 	ecr = RTW_READ8(regs, RTW_9346CR);
954 
955 	if ((flags & RTW_F_9356SROM) != 0) {
956 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n", dvname));
957 		sr->sr_size = 256;
958 		sd.sd_chip = C56_66;
959 	} else {
960 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n", dvname));
961 		sr->sr_size = 128;
962 		sd.sd_chip = C46;
963 	}
964 
965 	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
966 	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
967 	ecr |= RTW_9346CR_EEM_PROGRAM;
968 
969 	RTW_WRITE8(regs, RTW_9346CR, ecr);
970 
971 	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT);
972 
973 	if (sr->sr_content == NULL) {
974 		printf("%s: unable to allocate SROM buffer\n", dvname);
975 		return ENOMEM;
976 	}
977 
978 	(void)memset(sr->sr_content, 0, sr->sr_size);
979 
980 	/* RTL8180 has a single 8-bit register for controlling the
981 	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
982 	 * input/output sense is the reverse of read_seeprom's.
983 	 */
984 	sd.sd_tag = regs->r_bt;
985 	sd.sd_bsh = regs->r_bh;
986 	sd.sd_regsize = 1;
987 	sd.sd_control_offset = RTW_9346CR;
988 	sd.sd_status_offset = RTW_9346CR;
989 	sd.sd_dataout_offset = RTW_9346CR;
990 	sd.sd_CK = RTW_9346CR_EESK;
991 	sd.sd_CS = RTW_9346CR_EECS;
992 	sd.sd_DI = RTW_9346CR_EEDO;
993 	sd.sd_DO = RTW_9346CR_EEDI;
994 	/* make read_seeprom enter EEPROM read/write mode */
995 	sd.sd_MS = ecr;
996 	sd.sd_RDY = 0;
997 
998 	/* TBD bus barriers */
999 	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
1000 		printf("%s: could not read SROM\n", dvname);
1001 		free(sr->sr_content, M_DEVBUF);
1002 		sr->sr_content = NULL;
1003 		return -1;	/* XXX */
1004 	}
1005 
1006 	/* end EEPROM read/write mode */
1007 	RTW_WRITE8(regs, RTW_9346CR,
1008 	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
1009 	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
1010 
1011 	if ((rc = rtw_recall_eeprom(regs, dvname)) != 0)
1012 		return rc;
1013 
1014 #ifdef RTW_DEBUG
1015 	{
1016 		int i;
1017 		RTW_DPRINTF(RTW_DEBUG_ATTACH,
1018 		    ("\n%s: serial ROM:\n\t", dvname));
1019 		for (i = 0; i < sr->sr_size/2; i++) {
1020 			if (((i % 8) == 0) && (i != 0))
1021 				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
1022 			RTW_DPRINTF(RTW_DEBUG_ATTACH,
1023 			    (" %04x", sr->sr_content[i]));
1024 		}
1025 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
1026 	}
1027 #endif /* RTW_DEBUG */
1028 	return 0;
1029 }
1030 
1031 static void
1032 rtw_set_rfprog(struct rtw_regs *regs, enum rtw_rfchipid rfchipid,
1033     const char *dvname)
1034 {
1035 	uint8_t cfg4;
1036 	const char *method;
1037 
1038 	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
1039 
1040 	switch (rfchipid) {
1041 	default:
1042 		cfg4 |= SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
1043 		method = "fallback";
1044 		break;
1045 	case RTW_RFCHIPID_INTERSIL:
1046 		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
1047 		method = "Intersil";
1048 		break;
1049 	case RTW_RFCHIPID_PHILIPS:
1050 		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1051 		method = "Philips";
1052 		break;
1053 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
1054 	case RTW_RFCHIPID_RFMD:
1055 		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1056 		method = "RFMD";
1057 		break;
1058 	}
1059 
1060 	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1061 
1062 	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1063 
1064 	RTW_DPRINTF(RTW_DEBUG_INIT,
1065 	    ("%s: %s RF programming method, %#02x\n", dvname, method,
1066 	    RTW_READ8(regs, RTW_CONFIG4)));
1067 }
1068 
1069 static inline void
1070 rtw_init_channels(enum rtw_locale locale,
1071     struct ieee80211_channel (*chans)[IEEE80211_CHAN_MAX+1],
1072     const char *dvname)
1073 {
1074 	int i;
1075 	const char *name = NULL;
1076 #define ADD_CHANNEL(_chans, _chan) do {			\
1077 	(*_chans)[_chan].ic_flags = IEEE80211_CHAN_B;		\
1078 	(*_chans)[_chan].ic_freq =				\
1079 	    ieee80211_ieee2mhz(_chan, (*_chans)[_chan].ic_flags);\
1080 } while (0)
1081 
1082 	switch (locale) {
1083 	case RTW_LOCALE_USA:	/* 1-11 */
1084 		name = "USA";
1085 		for (i = 1; i <= 11; i++)
1086 			ADD_CHANNEL(chans, i);
1087 		break;
1088 	case RTW_LOCALE_JAPAN:	/* 1-14 */
1089 		name = "Japan";
1090 		ADD_CHANNEL(chans, 14);
1091 		for (i = 1; i <= 14; i++)
1092 			ADD_CHANNEL(chans, i);
1093 		break;
1094 	case RTW_LOCALE_EUROPE:	/* 1-13 */
1095 		name = "Europe";
1096 		for (i = 1; i <= 13; i++)
1097 			ADD_CHANNEL(chans, i);
1098 		break;
1099 	default:			/* 10-11 allowed by most countries */
1100 		name = "<unknown>";
1101 		for (i = 10; i <= 11; i++)
1102 			ADD_CHANNEL(chans, i);
1103 		break;
1104 	}
1105 	printf("%s: Geographic Location %s\n", dvname, name);
1106 #undef ADD_CHANNEL
1107 }
1108 
1109 
1110 static inline void
1111 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
1112 {
1113 	uint8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
1114 
1115 	switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1116 	case RTW_CONFIG0_GL_USA:
1117 	case _RTW_CONFIG0_GL_USA:
1118 		*locale = RTW_LOCALE_USA;
1119 		break;
1120 	case RTW_CONFIG0_GL_JAPAN:
1121 		*locale = RTW_LOCALE_JAPAN;
1122 		break;
1123 	case RTW_CONFIG0_GL_EUROPE:
1124 		*locale = RTW_LOCALE_EUROPE;
1125 		break;
1126 	default:
1127 		*locale = RTW_LOCALE_UNKNOWN;
1128 		break;
1129 	}
1130 }
1131 
1132 static inline int
1133 rtw_identify_sta(struct rtw_regs *regs, uint8_t (*addr)[IEEE80211_ADDR_LEN],
1134     const char *dvname)
1135 {
1136 	static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1137 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1138 	};
1139 	uint32_t idr0 = RTW_READ(regs, RTW_IDR0),
1140 	          idr1 = RTW_READ(regs, RTW_IDR1);
1141 
1142 	(*addr)[0] = SHIFTOUT(idr0, __BITS(0,  7));
1143 	(*addr)[1] = SHIFTOUT(idr0, __BITS(8,  15));
1144 	(*addr)[2] = SHIFTOUT(idr0, __BITS(16, 23));
1145 	(*addr)[3] = SHIFTOUT(idr0, __BITS(24 ,31));
1146 
1147 	(*addr)[4] = SHIFTOUT(idr1, __BITS(0,  7));
1148 	(*addr)[5] = SHIFTOUT(idr1, __BITS(8, 15));
1149 
1150 	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1151 		printf("%s: could not get mac address, attach failed\n",
1152 		    dvname);
1153 		return ENXIO;
1154 	}
1155 
1156 	printf("%s: 802.11 address %s\n", dvname, ether_sprintf(*addr));
1157 
1158 	return 0;
1159 }
1160 
1161 static uint8_t
1162 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1163     struct ieee80211_channel *chan)
1164 {
1165 	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1166 	KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
1167 	    ("%s: channel %d out of range", __func__,
1168 	     idx - RTW_SR_TXPOWER1 + 1));
1169 	return RTW_SR_GET(sr, idx);
1170 }
1171 
1172 static void
1173 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
1174 {
1175 	int pri;
1176 	/* nfree: the number of free descriptors in each ring.
1177 	 * The beacon ring is a special case: I do not let the
1178 	 * driver use all of the descriptors on the beacon ring.
1179 	 * The reasons are two-fold:
1180 	 *
1181 	 * (1) A BEACON descriptor's OWN bit is (apparently) not
1182 	 * updated, so the driver cannot easily know if the descriptor
1183 	 * belongs to it, or if it is racing the NIC.  If the NIC
1184 	 * does not OWN every descriptor, then the driver can safely
1185 	 * update the descriptors when RTW_TBDA points at tdb_next.
1186 	 *
1187 	 * (2) I hope that the NIC will process more than one BEACON
1188 	 * descriptor in a single beacon interval, since that will
1189 	 * enable multiple-BSS support.  Since the NIC does not
1190 	 * clear the OWN bit, there is no natural place for it to
1191 	 * stop processing BEACON desciptors.  Maybe it will *not*
1192 	 * stop processing them!  I do not want to chance the NIC
1193 	 * looping around and around a saturated beacon ring, so
1194 	 * I will leave one descriptor unOWNed at all times.
1195 	 */
1196 	u_int nfree[RTW_NTXPRI] =
1197 	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
1198 	     RTW_NTXDESCBCN - 1};
1199 
1200 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1201 		tdb[pri].tdb_nfree = nfree[pri];
1202 		tdb[pri].tdb_next = 0;
1203 	}
1204 }
1205 
1206 static int
1207 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
1208 {
1209 	int i;
1210 	struct rtw_txsoft *ts;
1211 
1212 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
1213 	SIMPLEQ_INIT(&tsb->tsb_freeq);
1214 	for (i = 0; i < tsb->tsb_ndesc; i++) {
1215 		ts = &tsb->tsb_desc[i];
1216 		ts->ts_mbuf = NULL;
1217 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1218 	}
1219 	tsb->tsb_tx_timer = 0;
1220 	return 0;
1221 }
1222 
1223 static void
1224 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
1225 {
1226 	int pri;
1227 	for (pri = 0; pri < RTW_NTXPRI; pri++)
1228 		rtw_txsoft_blk_init(&tsb[pri]);
1229 }
1230 
1231 static inline void
1232 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
1233 {
1234 	KASSERT(nsync <= rdb->rdb_ndesc);
1235 	/* sync to end of ring */
1236 	if (desc0 + nsync > rdb->rdb_ndesc) {
1237 		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1238 		    offsetof(struct rtw_descs, hd_rx[desc0]),
1239 		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
1240 		nsync -= (rdb->rdb_ndesc - desc0);
1241 		desc0 = 0;
1242 	}
1243 
1244 	KASSERT(desc0 < rdb->rdb_ndesc);
1245 	KASSERT(nsync <= rdb->rdb_ndesc);
1246 	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
1247 
1248 	/* sync what remains */
1249 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1250 	    offsetof(struct rtw_descs, hd_rx[desc0]),
1251 	    sizeof(struct rtw_rxdesc) * nsync, ops);
1252 }
1253 
1254 static void
1255 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
1256 {
1257 	/* sync to end of ring */
1258 	if (desc0 + nsync > tdb->tdb_ndesc) {
1259 		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1260 		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1261 		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
1262 		    ops);
1263 		nsync -= (tdb->tdb_ndesc - desc0);
1264 		desc0 = 0;
1265 	}
1266 
1267 	/* sync what remains */
1268 	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1269 	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
1270 	    sizeof(struct rtw_txdesc) * nsync, ops);
1271 }
1272 
1273 static void
1274 rtw_txdescs_sync_all(struct rtw_txdesc_blk *tdb)
1275 {
1276 	int pri;
1277 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1278 		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1279 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1280 	}
1281 }
1282 
1283 static void
1284 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
1285 {
1286 	int i;
1287 	struct rtw_rxsoft *rs;
1288 
1289 	for (i = 0; i < RTW_RXQLEN; i++) {
1290 		rs = &desc[i];
1291 		if (rs->rs_mbuf == NULL)
1292 			continue;
1293 		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
1294 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1295 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1296 		m_freem(rs->rs_mbuf);
1297 		rs->rs_mbuf = NULL;
1298 	}
1299 }
1300 
1301 static inline int
1302 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
1303 {
1304 	int rc;
1305 	struct mbuf *m;
1306 
1307 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1308 	if (m == NULL)
1309 		return ENOBUFS;
1310 
1311 	MCLGET(m, M_DONTWAIT);
1312 	if ((m->m_flags & M_EXT) == 0) {
1313 		m_freem(m);
1314 		return ENOBUFS;
1315 	}
1316 
1317 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1318 
1319 	if (rs->rs_mbuf != NULL)
1320 		bus_dmamap_unload(dmat, rs->rs_dmamap);
1321 
1322 	rs->rs_mbuf = NULL;
1323 
1324 	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
1325 	if (rc != 0) {
1326 		m_freem(m);
1327 		return -1;
1328 	}
1329 
1330 	rs->rs_mbuf = m;
1331 
1332 	return 0;
1333 }
1334 
1335 static int
1336 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
1337     int *ndesc, const char *dvname)
1338 {
1339 	int i, rc = 0;
1340 	struct rtw_rxsoft *rs;
1341 
1342 	for (i = 0; i < RTW_RXQLEN; i++) {
1343 		rs = &desc[i];
1344 		/* we're in rtw_init, so there should be no mbufs allocated */
1345 		KASSERT(rs->rs_mbuf == NULL);
1346 #ifdef RTW_DEBUG
1347 		if (i == rtw_rxbufs_limit) {
1348 			printf("%s: TEST hit %d-buffer limit\n", dvname, i);
1349 			rc = ENOBUFS;
1350 			break;
1351 		}
1352 #endif /* RTW_DEBUG */
1353 		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
1354 			printf("%s: rtw_rxsoft_alloc failed, %d buffers, "
1355 			       "rc %d\n", dvname, i, rc);
1356 			break;
1357 		}
1358 	}
1359 	*ndesc = i;
1360 	return rc;
1361 }
1362 
1363 static inline void
1364 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1365     int idx, int kick)
1366 {
1367 	int is_last = (idx == rdb->rdb_ndesc - 1);
1368 	uint32_t ctl, octl, obuf;
1369 	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1370 
1371 	obuf = rd->rd_buf;
1372 	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1373 
1374 	ctl = SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1375 	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1376 
1377 	if (is_last)
1378 		ctl |= RTW_RXCTL_EOR;
1379 
1380 	octl = rd->rd_ctl;
1381 	rd->rd_ctl = htole32(ctl);
1382 
1383 	RTW_DPRINTF(
1384 	    kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1385 	         : RTW_DEBUG_RECV_DESC,
1386 	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1387 	     le32toh(obuf), le32toh(rd->rd_buf), le32toh(octl),
1388 	     le32toh(rd->rd_ctl)));
1389 
1390 	/* sync the mbuf */
1391 	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1392 	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1393 
1394 	/* sync the descriptor */
1395 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1396 	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1397 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1398 }
1399 
1400 static void
1401 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl, int kick)
1402 {
1403 	int i;
1404 	struct rtw_rxdesc *rd;
1405 	struct rtw_rxsoft *rs;
1406 
1407 	for (i = 0; i < rdb->rdb_ndesc; i++) {
1408 		rd = &rdb->rdb_desc[i];
1409 		rs = &ctl[i];
1410 		rtw_rxdesc_init(rdb, rs, i, kick);
1411 	}
1412 }
1413 
1414 static void
1415 rtw_io_enable(struct rtw_regs *regs, uint8_t flags, int enable)
1416 {
1417 	uint8_t cr;
1418 
1419 	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1420 	    enable ? "enable" : "disable", flags));
1421 
1422 	cr = RTW_READ8(regs, RTW_CR);
1423 
1424 	/* XXX reference source does not enable MULRW */
1425 #if 0
1426 	/* enable PCI Read/Write Multiple */
1427 	cr |= RTW_CR_MULRW;
1428 #endif
1429 
1430 	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1431 	if (enable)
1432 		cr |= flags;
1433 	else
1434 		cr &= ~flags;
1435 	RTW_WRITE8(regs, RTW_CR, cr);
1436 	RTW_SYNC(regs, RTW_CR, RTW_CR);
1437 }
1438 
1439 static void
1440 rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1441 {
1442 #define	IS_BEACON(__fc0)						\
1443     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1444      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1445 
1446 	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1447 							 * hardware -> net80211
1448 							 */
1449 	u_int next, nproc = 0;
1450 	int hwrate, len, rate, rssi, sq;
1451 	uint32_t hrssi, hstat, htsfth, htsftl;
1452 	struct rtw_rxdesc *rd;
1453 	struct rtw_rxsoft *rs;
1454 	struct rtw_rxdesc_blk *rdb;
1455 	struct mbuf *m;
1456 	struct ifnet *ifp = &sc->sc_if;
1457 
1458 	struct ieee80211_node *ni;
1459 	struct ieee80211_frame_min *wh;
1460 
1461 	rdb = &sc->sc_rxdesc_blk;
1462 
1463 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1464 
1465 	for (next = rdb->rdb_next; ; next = (next + 1) % rdb->rdb_ndesc) {
1466 		rtw_rxdescs_sync(rdb, next, 1,
1467 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1468 		rd = &rdb->rdb_desc[next];
1469 		rs = &sc->sc_rxsoft[next];
1470 
1471 		hstat = le32toh(rd->rd_stat);
1472 		hrssi = le32toh(rd->rd_rssi);
1473 		htsfth = le32toh(rd->rd_tsfth);
1474 		htsftl = le32toh(rd->rd_tsftl);
1475 
1476 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1477 		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1478 		    __func__, next, hstat, hrssi, htsfth, htsftl));
1479 
1480 		++nproc;
1481 
1482 		/* still belongs to NIC */
1483 		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1484 			if (nproc > 1)
1485 				break;
1486 
1487 			/* sometimes the NIC skips to the 0th descriptor */
1488 			rtw_rxdescs_sync(rdb, 0, 1,
1489 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1490 			rd = &rdb->rdb_desc[0];
1491 			if ((rd->rd_stat & htole32(RTW_RXSTAT_OWN)) != 0)
1492 				break;
1493 			RTW_DPRINTF(RTW_DEBUG_BUGS,
1494 			    ("%s: NIC skipped from rxdesc[%u] to rxdesc[0]\n",
1495 			     sc->sc_dev.dv_xname, next));
1496 			next = rdb->rdb_ndesc - 1;
1497 			continue;
1498 		}
1499 
1500 #ifdef RTW_DEBUG
1501 #define PRINTSTAT(flag) do { \
1502 	if ((hstat & flag) != 0) { \
1503 		printf("%s" #flag, delim); \
1504 		delim = ","; \
1505 	} \
1506 } while (0)
1507 		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1508 			const char *delim = "<";
1509 			printf("%s: ", sc->sc_dev.dv_xname);
1510 			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1511 				printf("status %08x", hstat);
1512 				PRINTSTAT(RTW_RXSTAT_SPLCP);
1513 				PRINTSTAT(RTW_RXSTAT_MAR);
1514 				PRINTSTAT(RTW_RXSTAT_PAR);
1515 				PRINTSTAT(RTW_RXSTAT_BAR);
1516 				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1517 				PRINTSTAT(RTW_RXSTAT_CRC32);
1518 				PRINTSTAT(RTW_RXSTAT_ICV);
1519 				printf(">, ");
1520 			}
1521 		}
1522 #endif /* RTW_DEBUG */
1523 
1524 		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1525 			printf("%s: DMA error/FIFO overflow %08x, "
1526 			    "rx descriptor %d\n", sc->sc_dev.dv_xname,
1527 			    hstat & RTW_RXSTAT_IOERROR, next);
1528 			ifp->if_ierrors++;
1529 			goto next;
1530 		}
1531 
1532 		len = SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1533 		if (len < IEEE80211_MIN_LEN) {
1534 			sc->sc_ic.ic_stats.is_rx_tooshort++;
1535 			goto next;
1536 		}
1537 
1538 		/* CRC is included with the packet; trim it off. */
1539 		len -= IEEE80211_CRC_LEN;
1540 
1541 		hwrate = SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1542 		if (hwrate >= sizeof(ratetbl) / sizeof(ratetbl[0])) {
1543 			printf("%s: unknown rate #%d\n", sc->sc_dev.dv_xname,
1544 			    SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1545 			ifp->if_ierrors++;
1546 			goto next;
1547 		}
1548 		rate = ratetbl[hwrate];
1549 
1550 #ifdef RTW_DEBUG
1551 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1552 		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1553 		     (rate * 5) % 10, htsfth, htsftl));
1554 #endif /* RTW_DEBUG */
1555 
1556 		if ((hstat & RTW_RXSTAT_RES) != 0 &&
1557 		    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
1558 			goto next;
1559 
1560 		/* if bad flags, skip descriptor */
1561 		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1562 			printf("%s: too many rx segments\n",
1563 			    sc->sc_dev.dv_xname);
1564 			goto next;
1565 		}
1566 
1567 		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1568 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1569 
1570 		m = rs->rs_mbuf;
1571 
1572 		/* if temporarily out of memory, re-use mbuf */
1573 		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1574 		case 0:
1575 			break;
1576 		case ENOBUFS:
1577 			printf("%s: rtw_rxsoft_alloc(, %d) failed, "
1578 			    "dropping packet\n", sc->sc_dev.dv_xname, next);
1579 			goto next;
1580 		default:
1581 			/* XXX shorten rx ring, instead? */
1582 			panic("%s: could not load DMA map\n",
1583 			    sc->sc_dev.dv_xname);
1584 		}
1585 
1586 		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1587 			rssi = SHIFTOUT(hrssi, RTW_RXRSSI_RSSI);
1588 		else {
1589 			rssi = SHIFTOUT(hrssi, RTW_RXRSSI_IMR_RSSI);
1590 			/* TBD find out each front-end's LNA gain in the
1591 			 * front-end's units
1592 			 */
1593 			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1594 				rssi |= 0x80;
1595 		}
1596 		sq = SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1597 
1598 		/* Note well: now we cannot recycle the rs_mbuf unless
1599 		 * we restore its original length.
1600 		 */
1601 		m->m_pkthdr.rcvif = ifp;
1602 		m->m_pkthdr.len = m->m_len = len;
1603 
1604 		wh = mtod(m, struct ieee80211_frame_min *);
1605 
1606 		if (!IS_BEACON(wh->i_fc[0]))
1607 			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1608 		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1609 		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1610 
1611 		sc->sc_tsfth = htsfth;
1612 
1613 #ifdef RTW_DEBUG
1614 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1615 		    (IFF_DEBUG|IFF_LINK2)) {
1616 			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1617 			    rate, rssi);
1618 		}
1619 #endif /* RTW_DEBUG */
1620 
1621 #if NBPFILTER > 0
1622 		if (sc->sc_radiobpf != NULL) {
1623 			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1624 
1625 			rr->rr_tsft =
1626 			    htole64(((uint64_t)htsfth << 32) | htsftl);
1627 
1628 			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1629 				rr->rr_flags = IEEE80211_RADIOTAP_F_SHORTPRE;
1630 
1631 			rr->rr_flags = 0;
1632 			rr->rr_rate = rate;
1633 			rr->rr_antsignal = rssi;
1634 			rr->rr_barker_lock = htole16(sq);
1635 
1636 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)rr,
1637 			    sizeof(sc->sc_rxtapu), m);
1638 		}
1639 #endif /* NPBFILTER > 0 */
1640 
1641 		ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1642 		ieee80211_free_node(ni);
1643 next:
1644 		rtw_rxdesc_init(rdb, rs, next, 0);
1645 	}
1646 	rdb->rdb_next = next;
1647 
1648 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1649 
1650 	return;
1651 #undef IS_BEACON
1652 }
1653 
1654 static void
1655 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1656     struct rtw_txsoft *ts)
1657 {
1658 	struct mbuf *m;
1659 	struct ieee80211_node *ni;
1660 
1661 	m = ts->ts_mbuf;
1662 	ni = ts->ts_ni;
1663 	KASSERT(m != NULL);
1664 	KASSERT(ni != NULL);
1665 	ts->ts_mbuf = NULL;
1666 	ts->ts_ni = NULL;
1667 
1668 	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1669 	    BUS_DMASYNC_POSTWRITE);
1670 	bus_dmamap_unload(dmat, ts->ts_dmamap);
1671 	m_freem(m);
1672 	ieee80211_free_node(ni);
1673 }
1674 
1675 static void
1676 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1677     struct rtw_txsoft_blk *tsb)
1678 {
1679 	struct rtw_txsoft *ts;
1680 
1681 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1682 		rtw_txsoft_release(dmat, ic, ts);
1683 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1684 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1685 	}
1686 	tsb->tsb_tx_timer = 0;
1687 }
1688 
1689 static inline void
1690 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1691     struct rtw_txsoft *ts, int ndesc)
1692 {
1693 	uint32_t hstat;
1694 	int data_retry, rts_retry;
1695 	struct rtw_txdesc *tdn;
1696 	const char *condstring;
1697 	struct ifnet *ifp = &sc->sc_if;
1698 
1699 	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1700 
1701 	tdb->tdb_nfree += ndesc;
1702 
1703 	tdn = &tdb->tdb_desc[ts->ts_last];
1704 
1705 	hstat = le32toh(tdn->td_stat);
1706 	rts_retry = SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1707 	data_retry = SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1708 
1709 	ifp->if_collisions += rts_retry + data_retry;
1710 
1711 	if ((hstat & RTW_TXSTAT_TOK) != 0)
1712 		condstring = "ok";
1713 	else {
1714 		ifp->if_oerrors++;
1715 		condstring = "error";
1716 	}
1717 
1718 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1719 	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1720 	    sc->sc_dev.dv_xname, ts, ts->ts_first, ts->ts_last,
1721 	    condstring, rts_retry, data_retry));
1722 }
1723 
1724 static void
1725 rtw_reset_oactive(struct rtw_softc *sc)
1726 {
1727 	short oflags;
1728 	int pri;
1729 	struct rtw_txsoft_blk *tsb;
1730 	struct rtw_txdesc_blk *tdb;
1731 	oflags = sc->sc_if.if_flags;
1732 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1733 		tsb = &sc->sc_txsoft_blk[pri];
1734 		tdb = &sc->sc_txdesc_blk[pri];
1735 		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1736 			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1737 	}
1738 	if (oflags != sc->sc_if.if_flags) {
1739 		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1740 		    ("%s: reset OACTIVE\n", __func__));
1741 	}
1742 }
1743 
1744 /* Collect transmitted packets. */
1745 static inline void
1746 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1747     struct rtw_txdesc_blk *tdb, int force)
1748 {
1749 	int ndesc;
1750 	struct rtw_txsoft *ts;
1751 
1752 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1753 		ndesc = 1 + ts->ts_last - ts->ts_first;
1754 		if (ts->ts_last < ts->ts_first)
1755 			ndesc += tdb->tdb_ndesc;
1756 
1757 		KASSERT(ndesc > 0);
1758 
1759 		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1760 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1761 
1762 		if (force) {
1763 			int i;
1764 			for (i = ts->ts_first; ; i = RTW_NEXT_IDX(tdb, i)) {
1765 				tdb->tdb_desc[i].td_stat &=
1766 				    ~htole32(RTW_TXSTAT_OWN);
1767 				if (i == ts->ts_last)
1768 					break;
1769 			}
1770 			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1771 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1772 		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1773 		    htole32(RTW_TXSTAT_OWN)) != 0)
1774 			break;
1775 
1776 		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1777 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1778 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1779 	}
1780 	/* no more pending transmissions, cancel watchdog */
1781 	if (ts == NULL)
1782 		tsb->tsb_tx_timer = 0;
1783 	rtw_reset_oactive(sc);
1784 }
1785 
1786 static void
1787 rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1788 {
1789 	int pri;
1790 	struct rtw_txsoft_blk	*tsb;
1791 	struct rtw_txdesc_blk	*tdb;
1792 	struct ifnet *ifp = &sc->sc_if;
1793 
1794 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1795 		tsb = &sc->sc_txsoft_blk[pri];
1796 		tdb = &sc->sc_txdesc_blk[pri];
1797 
1798 		rtw_collect_txring(sc, tsb, tdb, 0);
1799 	}
1800 
1801 	if ((isr & RTW_INTR_TX) != 0)
1802 		rtw_start(ifp);
1803 
1804 	return;
1805 }
1806 
1807 static void
1808 rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1809 {
1810 	u_int next;
1811 	uint32_t tsfth, tsftl;
1812 	struct ieee80211com *ic;
1813 	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1814 	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1815 	struct mbuf *m;
1816 
1817 	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1818 	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1819 
1820 	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1821 		next = rtw_txring_next(&sc->sc_regs, tdb);
1822 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1823 		    ("%s: beacon ring %sprocessed, isr = %#04" PRIx16
1824 		     ", next %u expected %u, %" PRIu64 "\n", __func__,
1825 		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1826 		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1827 		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0){
1828 			rtw_collect_txring(sc, tsb, tdb, 1);
1829 			tdb->tdb_next = 0;
1830 		}
1831 	}
1832 	/* Start beacon transmission. */
1833 
1834 	if ((isr & RTW_INTR_BCNINT) != 0 &&
1835 	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1836 	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1837 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1838 		    ("%s: beacon prep. time, isr = %#04" PRIx16
1839 		     ", %16" PRIu64 "\n", __func__, isr,
1840 		     (uint64_t)tsfth << 32 | tsftl));
1841 		ic = &sc->sc_ic;
1842 		m = rtw_beacon_alloc(sc, ic->ic_bss);
1843 
1844 		if (m == NULL) {
1845 			printf("%s: could not allocate beacon\n",
1846 			    sc->sc_dev.dv_xname);
1847 			return;
1848 		}
1849 		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1850 		IF_ENQUEUE(&sc->sc_beaconq, m);
1851 		rtw_start(&sc->sc_if);
1852 	}
1853 }
1854 
1855 static void
1856 rtw_intr_atim(struct rtw_softc *sc)
1857 {
1858 	/* TBD */
1859 	return;
1860 }
1861 
1862 #ifdef RTW_DEBUG
1863 static void
1864 rtw_dump_rings(struct rtw_softc *sc)
1865 {
1866 	struct rtw_txdesc_blk *tdb;
1867 	struct rtw_rxdesc *rd;
1868 	struct rtw_rxdesc_blk *rdb;
1869 	int desc, pri;
1870 
1871 	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1872 		return;
1873 
1874 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1875 		tdb = &sc->sc_txdesc_blk[pri];
1876 		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1877 		    tdb->tdb_ndesc, tdb->tdb_nfree);
1878 		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1879 			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1880 	}
1881 
1882 	rdb = &sc->sc_rxdesc_blk;
1883 
1884 	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1885 		rd = &rdb->rdb_desc[desc];
1886 		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1887 		    "rsvd1/tsfth %08x\n", __func__,
1888 		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1889 		    le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1890 		    le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1891 	}
1892 }
1893 #endif /* RTW_DEBUG */
1894 
1895 static void
1896 rtw_hwring_setup(struct rtw_softc *sc)
1897 {
1898 	int pri;
1899 	struct rtw_regs *regs = &sc->sc_regs;
1900 	struct rtw_txdesc_blk *tdb;
1901 
1902 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1903 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1904 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1905 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1906 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1907 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1908 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1909 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1910 
1911 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1912 		tdb = &sc->sc_txdesc_blk[pri];
1913 		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1914 		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1915 		    ("%s: reg[tdb->tdb_basereg] <- %" PRIxPTR "\n", __func__,
1916 		     (uintptr_t)tdb->tdb_base));
1917 	}
1918 
1919 	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1920 
1921 	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1922 	    ("%s: reg[RDSAR] <- %" PRIxPTR "\n", __func__,
1923 	     (uintptr_t)RTW_RING_BASE(sc, hd_rx)));
1924 
1925 	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1926 
1927 }
1928 
1929 static int
1930 rtw_swring_setup(struct rtw_softc *sc)
1931 {
1932 	int rc;
1933 	struct rtw_rxdesc_blk *rdb;
1934 
1935 	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1936 
1937 	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1938 
1939 	rdb = &sc->sc_rxdesc_blk;
1940 	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft, &rdb->rdb_ndesc,
1941 	     sc->sc_dev.dv_xname)) != 0 && rdb->rdb_ndesc == 0) {
1942 		printf("%s: could not allocate rx buffers\n",
1943 		    sc->sc_dev.dv_xname);
1944 		return rc;
1945 	}
1946 
1947 	rdb = &sc->sc_rxdesc_blk;
1948 	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
1949 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1950 	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
1951 	rdb->rdb_next = 0;
1952 
1953 	rtw_txdescs_sync_all(&sc->sc_txdesc_blk[0]);
1954 	return 0;
1955 }
1956 
1957 static void
1958 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
1959 {
1960 	int i;
1961 
1962 	(void)memset(tdb->tdb_desc, 0,
1963 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
1964 	for (i = 0; i < tdb->tdb_ndesc; i++)
1965 		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
1966 }
1967 
1968 static u_int
1969 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
1970 {
1971 	return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
1972 	    sizeof(struct rtw_txdesc);
1973 }
1974 
1975 static void
1976 rtw_txring_fixup(struct rtw_softc *sc)
1977 {
1978 	int pri;
1979 	u_int next;
1980 	struct rtw_txdesc_blk *tdb;
1981 	struct rtw_regs *regs = &sc->sc_regs;
1982 
1983 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1984 		tdb = &sc->sc_txdesc_blk[pri];
1985 		next = rtw_txring_next(regs, tdb);
1986 		if (tdb->tdb_next == next)
1987 			continue;
1988 		printf("%s: tx-ring %d expected next %u, read %u\n", __func__,
1989 		    pri, tdb->tdb_next, next);
1990 		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
1991 	}
1992 }
1993 
1994 static void
1995 rtw_rxring_fixup(struct rtw_softc *sc)
1996 {
1997 	u_int next;
1998 	uint32_t rdsar;
1999 	struct rtw_rxdesc_blk *rdb;
2000 
2001 	rdsar = le32toh(RTW_READ(&sc->sc_regs, RTW_RDSAR));
2002 	next = (rdsar - RTW_RING_BASE(sc, hd_rx)) / sizeof(struct rtw_rxdesc);
2003 
2004 	rdb = &sc->sc_rxdesc_blk;
2005 	if (rdb->rdb_next != next) {
2006 		printf("%s: rx-ring expected next %u, read %u\n", __func__,
2007 		    rdb->rdb_next, next);
2008 		rdb->rdb_next = MIN(next, rdb->rdb_ndesc - 1);
2009 	}
2010 }
2011 
2012 static void
2013 rtw_txdescs_reset(struct rtw_softc *sc)
2014 {
2015 	int pri;
2016 
2017 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2018 		rtw_collect_txring(sc, &sc->sc_txsoft_blk[pri],
2019 		    &sc->sc_txdesc_blk[pri], 1);
2020 	}
2021 }
2022 
2023 static void
2024 rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
2025 {
2026 	uint8_t cr = 0;
2027 	int xmtr = 0, rcvr = 0;
2028 	struct rtw_regs *regs = &sc->sc_regs;
2029 
2030 	if ((isr & RTW_INTR_TXFOVW) != 0) {
2031 		printf("%s: tx fifo underflow\n", sc->sc_dev.dv_xname);
2032 		rcvr = xmtr = 1;
2033 		cr |= RTW_CR_TE | RTW_CR_RE;
2034 	}
2035 
2036 	if ((isr & (RTW_INTR_RDU|RTW_INTR_RXFOVW)) != 0) {
2037 		cr |= RTW_CR_RE;
2038 		rcvr = 1;
2039 	}
2040 
2041 	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: restarting xmit/recv, isr %" PRIx16
2042 	    "\n", sc->sc_dev.dv_xname, isr));
2043 
2044 #ifdef RTW_DEBUG
2045 	rtw_dump_rings(sc);
2046 #endif /* RTW_DEBUG */
2047 
2048 	rtw_io_enable(regs, cr, 0);
2049 
2050 	/* Collect rx'd packets.  Refresh rx buffers. */
2051 	if (rcvr)
2052 		rtw_intr_rx(sc, 0);
2053 	/* Collect tx'd packets.  XXX let's hope this stops the transmit
2054 	 * timeouts.
2055 	 */
2056 	if (xmtr)
2057 		rtw_txdescs_reset(sc);
2058 
2059 	RTW_WRITE16(regs, RTW_IMR, 0);
2060 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
2061 
2062 	if (rtw_do_chip_reset) {
2063 		rtw_chip_reset1(regs, sc->sc_dev.dv_xname);
2064 		rtw_wep_setkeys(sc, sc->sc_ic.ic_nw_keys,
2065 		    sc->sc_ic.ic_def_txkey);
2066 	}
2067 
2068 	rtw_rxdesc_init_all(&sc->sc_rxdesc_blk, &sc->sc_rxsoft[0], 1);
2069 
2070 #ifdef RTW_DEBUG
2071 	rtw_dump_rings(sc);
2072 #endif /* RTW_DEBUG */
2073 
2074 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2075 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
2076 	if (rcvr)
2077 		rtw_rxring_fixup(sc);
2078 	rtw_io_enable(regs, cr, 1);
2079 	if (xmtr)
2080 		rtw_txring_fixup(sc);
2081 }
2082 
2083 static inline void
2084 rtw_suspend_ticks(struct rtw_softc *sc)
2085 {
2086 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2087 	    ("%s: suspending ticks\n", sc->sc_dev.dv_xname));
2088 	sc->sc_do_tick = 0;
2089 }
2090 
2091 static inline void
2092 rtw_resume_ticks(struct rtw_softc *sc)
2093 {
2094 	uint32_t tsftrl0, tsftrl1, next_tick;
2095 
2096 	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2097 
2098 	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
2099 	next_tick = tsftrl1 + 1000000;
2100 	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
2101 
2102 	sc->sc_do_tick = 1;
2103 
2104 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2105 	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
2106 	    sc->sc_dev.dv_xname, tsftrl1 - tsftrl0, tsftrl1, next_tick));
2107 }
2108 
2109 static void
2110 rtw_intr_timeout(struct rtw_softc *sc)
2111 {
2112 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", sc->sc_dev.dv_xname));
2113 	if (sc->sc_do_tick)
2114 		rtw_resume_ticks(sc);
2115 	return;
2116 }
2117 
2118 int
2119 rtw_intr(void *arg)
2120 {
2121 	int i;
2122 	struct rtw_softc *sc = arg;
2123 	struct rtw_regs *regs = &sc->sc_regs;
2124 	uint16_t isr;
2125 	struct ifnet *ifp = &sc->sc_if;
2126 
2127 	/*
2128 	 * If the interface isn't running, the interrupt couldn't
2129 	 * possibly have come from us.
2130 	 */
2131 	if ((sc->sc_flags & RTW_F_ENABLED) == 0 ||
2132 	    (ifp->if_flags & IFF_RUNNING) == 0 ||
2133 	    !device_is_active(&sc->sc_dev)) {
2134 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n", sc->sc_dev.dv_xname));
2135 		return (0);
2136 	}
2137 
2138 	for (i = 0; i < 10; i++) {
2139 		isr = RTW_READ16(regs, RTW_ISR);
2140 
2141 		RTW_WRITE16(regs, RTW_ISR, isr);
2142 		RTW_WBR(regs, RTW_ISR, RTW_ISR);
2143 
2144 		if (sc->sc_intr_ack != NULL)
2145 			(*sc->sc_intr_ack)(regs);
2146 
2147 		if (isr == 0)
2148 			break;
2149 
2150 #ifdef RTW_DEBUG
2151 #define PRINTINTR(flag) do { \
2152 	if ((isr & flag) != 0) { \
2153 		printf("%s" #flag, delim); \
2154 		delim = ","; \
2155 	} \
2156 } while (0)
2157 
2158 		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2159 			const char *delim = "<";
2160 
2161 			printf("%s: reg[ISR] = %x", sc->sc_dev.dv_xname, isr);
2162 
2163 			PRINTINTR(RTW_INTR_TXFOVW);
2164 			PRINTINTR(RTW_INTR_TIMEOUT);
2165 			PRINTINTR(RTW_INTR_BCNINT);
2166 			PRINTINTR(RTW_INTR_ATIMINT);
2167 			PRINTINTR(RTW_INTR_TBDER);
2168 			PRINTINTR(RTW_INTR_TBDOK);
2169 			PRINTINTR(RTW_INTR_THPDER);
2170 			PRINTINTR(RTW_INTR_THPDOK);
2171 			PRINTINTR(RTW_INTR_TNPDER);
2172 			PRINTINTR(RTW_INTR_TNPDOK);
2173 			PRINTINTR(RTW_INTR_RXFOVW);
2174 			PRINTINTR(RTW_INTR_RDU);
2175 			PRINTINTR(RTW_INTR_TLPDER);
2176 			PRINTINTR(RTW_INTR_TLPDOK);
2177 			PRINTINTR(RTW_INTR_RER);
2178 			PRINTINTR(RTW_INTR_ROK);
2179 
2180 			printf(">\n");
2181 		}
2182 #undef PRINTINTR
2183 #endif /* RTW_DEBUG */
2184 
2185 		if ((isr & RTW_INTR_RX) != 0)
2186 			rtw_intr_rx(sc, isr & RTW_INTR_RX);
2187 		if ((isr & RTW_INTR_TX) != 0)
2188 			rtw_intr_tx(sc, isr & RTW_INTR_TX);
2189 		if ((isr & RTW_INTR_BEACON) != 0)
2190 			rtw_intr_beacon(sc, isr & RTW_INTR_BEACON);
2191 		if ((isr & RTW_INTR_ATIMINT) != 0)
2192 			rtw_intr_atim(sc);
2193 		if ((isr & RTW_INTR_IOERROR) != 0)
2194 			rtw_intr_ioerror(sc, isr & RTW_INTR_IOERROR);
2195 		if ((isr & RTW_INTR_TIMEOUT) != 0)
2196 			rtw_intr_timeout(sc);
2197 	}
2198 
2199 	return 1;
2200 }
2201 
2202 /* Must be called at splnet. */
2203 static void
2204 rtw_stop(struct ifnet *ifp, int disable)
2205 {
2206 	int pri;
2207 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2208 	struct ieee80211com *ic = &sc->sc_ic;
2209 	struct rtw_regs *regs = &sc->sc_regs;
2210 
2211 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2212 		return;
2213 
2214 	rtw_suspend_ticks(sc);
2215 
2216 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2217 
2218 	if ((sc->sc_flags & RTW_F_INVALID) == 0) {
2219 		/* Disable interrupts. */
2220 		RTW_WRITE16(regs, RTW_IMR, 0);
2221 
2222 		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2223 
2224 		/* Stop the transmit and receive processes. First stop DMA,
2225 		 * then disable receiver and transmitter.
2226 		 */
2227 		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2228 
2229 		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2230 
2231 		rtw_io_enable(&sc->sc_regs, RTW_CR_RE|RTW_CR_TE, 0);
2232 	}
2233 
2234 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
2235 		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
2236 		    &sc->sc_txsoft_blk[pri]);
2237 	}
2238 
2239 	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
2240 
2241 	if (disable)
2242 		rtw_disable(sc);
2243 
2244 	/* Mark the interface as not running.  Cancel the watchdog timer. */
2245 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2246 	ifp->if_timer = 0;
2247 
2248 	return;
2249 }
2250 
2251 const char *
2252 rtw_pwrstate_string(enum rtw_pwrstate power)
2253 {
2254 	switch (power) {
2255 	case RTW_ON:
2256 		return "on";
2257 	case RTW_SLEEP:
2258 		return "sleep";
2259 	case RTW_OFF:
2260 		return "off";
2261 	default:
2262 		return "unknown";
2263 	}
2264 }
2265 
2266 /* XXX For Maxim, I am using the RFMD settings gleaned from the
2267  * reference driver, plus a magic Maxim "ON" value that comes from
2268  * the Realtek document "Windows PG for Rtl8180."
2269  */
2270 static void
2271 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2272     int before_rf, int digphy)
2273 {
2274 	uint32_t anaparm;
2275 
2276 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2277 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2278 
2279 	switch (power) {
2280 	case RTW_OFF:
2281 		if (before_rf)
2282 			return;
2283 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2284 		anaparm |= RTW_ANAPARM_TXDACOFF;
2285 		break;
2286 	case RTW_SLEEP:
2287 		if (!before_rf)
2288 			return;
2289 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2290 		anaparm |= RTW_ANAPARM_TXDACOFF;
2291 		break;
2292 	case RTW_ON:
2293 		if (!before_rf)
2294 			return;
2295 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2296 		break;
2297 	}
2298 	RTW_DPRINTF(RTW_DEBUG_PWR,
2299 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2300 	    __func__, rtw_pwrstate_string(power),
2301 	    (before_rf) ? "before" : "after", anaparm));
2302 
2303 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2304 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2305 }
2306 
2307 /* XXX I am using the RFMD settings gleaned from the reference
2308  * driver.  They agree
2309  */
2310 static void
2311 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2312     int before_rf, int digphy)
2313 {
2314 	uint32_t anaparm;
2315 
2316 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2317 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2318 
2319 	switch (power) {
2320 	case RTW_OFF:
2321 		if (before_rf)
2322 			return;
2323 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2324 		anaparm |= RTW_ANAPARM_TXDACOFF;
2325 		break;
2326 	case RTW_SLEEP:
2327 		if (!before_rf)
2328 			return;
2329 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2330 		anaparm |= RTW_ANAPARM_TXDACOFF;
2331 		break;
2332 	case RTW_ON:
2333 		if (!before_rf)
2334 			return;
2335 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2336 		break;
2337 	}
2338 	RTW_DPRINTF(RTW_DEBUG_PWR,
2339 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2340 	    __func__, rtw_pwrstate_string(power),
2341 	    (before_rf) ? "before" : "after", anaparm));
2342 
2343 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2344 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2345 }
2346 
2347 static void
2348 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2349     int before_rf, int digphy)
2350 {
2351 	uint32_t anaparm;
2352 
2353 	anaparm = RTW_READ(regs, RTW_ANAPARM);
2354 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2355 
2356 	switch (power) {
2357 	case RTW_OFF:
2358 		if (before_rf)
2359 			return;
2360 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2361 		anaparm |= RTW_ANAPARM_TXDACOFF;
2362 		break;
2363 	case RTW_SLEEP:
2364 		if (!before_rf)
2365 			return;
2366 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2367 		anaparm |= RTW_ANAPARM_TXDACOFF;
2368 		break;
2369 	case RTW_ON:
2370 		if (!before_rf)
2371 			return;
2372 		if (digphy) {
2373 			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2374 			/* XXX guess */
2375 			anaparm |= RTW_ANAPARM_TXDACOFF;
2376 		} else
2377 			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2378 		break;
2379 	}
2380 	RTW_DPRINTF(RTW_DEBUG_PWR,
2381 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2382 	    __func__, rtw_pwrstate_string(power),
2383 	    (before_rf) ? "before" : "after", anaparm));
2384 
2385 	RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2386 	RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2387 }
2388 
2389 static void
2390 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2391     int digphy)
2392 {
2393 	struct rtw_regs *regs = &sc->sc_regs;
2394 
2395 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2396 
2397 	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2398 
2399 	rtw_set_access(regs, RTW_ACCESS_NONE);
2400 
2401 	return;
2402 }
2403 
2404 static int
2405 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2406 {
2407 	int rc;
2408 
2409 	RTW_DPRINTF(RTW_DEBUG_PWR,
2410 	    ("%s: %s->%s\n", __func__,
2411 	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2412 
2413 	if (sc->sc_pwrstate == power)
2414 		return 0;
2415 
2416 	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2417 	rc = rtw_rf_pwrstate(sc->sc_rf, power);
2418 	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2419 
2420 	switch (power) {
2421 	case RTW_ON:
2422 		/* TBD set LEDs */
2423 		break;
2424 	case RTW_SLEEP:
2425 		/* TBD */
2426 		break;
2427 	case RTW_OFF:
2428 		/* TBD */
2429 		break;
2430 	}
2431 	if (rc == 0)
2432 		sc->sc_pwrstate = power;
2433 	else
2434 		sc->sc_pwrstate = RTW_OFF;
2435 	return rc;
2436 }
2437 
2438 static int
2439 rtw_tune(struct rtw_softc *sc)
2440 {
2441 	struct ieee80211com *ic = &sc->sc_ic;
2442 	struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2443 	struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2444 	u_int chan;
2445 	int rc;
2446 	int antdiv = sc->sc_flags & RTW_F_ANTDIV,
2447 	    dflantb = sc->sc_flags & RTW_F_DFLANTB;
2448 
2449 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2450 	if (chan == IEEE80211_CHAN_ANY)
2451 		panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
2452 
2453 	rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2454 	rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2455 
2456 	rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2457 	rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2458 
2459 	if (chan == sc->sc_cur_chan) {
2460 		RTW_DPRINTF(RTW_DEBUG_TUNE,
2461 		    ("%s: already tuned chan #%d\n", __func__, chan));
2462 		return 0;
2463 	}
2464 
2465 	rtw_suspend_ticks(sc);
2466 
2467 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
2468 
2469 	/* TBD wait for Tx to complete */
2470 
2471 	KASSERT((sc->sc_flags & RTW_F_ENABLED) != 0);
2472 
2473 	if ((rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2474 	    rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan), sc->sc_csthr,
2475 	        ic->ic_curchan->ic_freq, antdiv, dflantb, RTW_ON)) != 0) {
2476 		/* XXX condition on powersaving */
2477 		printf("%s: phy init failed\n", sc->sc_dev.dv_xname);
2478 	}
2479 
2480 	sc->sc_cur_chan = chan;
2481 
2482 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 1);
2483 
2484 	rtw_resume_ticks(sc);
2485 
2486 	return rc;
2487 }
2488 
2489 void
2490 rtw_disable(struct rtw_softc *sc)
2491 {
2492 	int rc;
2493 
2494 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2495 		return;
2496 
2497 	/* turn off PHY */
2498 	if ((sc->sc_flags & RTW_F_INVALID) == 0 &&
2499 	    (rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2500 		printf("%s: failed to turn off PHY (%d)\n",
2501 		    sc->sc_dev.dv_xname, rc);
2502 	}
2503 
2504 	if (sc->sc_disable != NULL)
2505 		(*sc->sc_disable)(sc);
2506 
2507 	sc->sc_flags &= ~RTW_F_ENABLED;
2508 }
2509 
2510 int
2511 rtw_enable(struct rtw_softc *sc)
2512 {
2513 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
2514 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2515 			printf("%s: device enable failed\n",
2516 			    sc->sc_dev.dv_xname);
2517 			return (EIO);
2518 		}
2519 		sc->sc_flags |= RTW_F_ENABLED;
2520                 /* Power may have been removed, and WEP keys thus
2521                  * reset.
2522 		 */
2523 		sc->sc_flags &= ~RTW_F_DK_VALID;
2524 	}
2525 	return (0);
2526 }
2527 
2528 static void
2529 rtw_transmit_config(struct rtw_regs *regs)
2530 {
2531 	uint32_t tcr;
2532 
2533 	tcr = RTW_READ(regs, RTW_TCR);
2534 
2535 	tcr |= RTW_TCR_CWMIN;
2536 	tcr &= ~RTW_TCR_MXDMA_MASK;
2537 	tcr |= RTW_TCR_MXDMA_256;
2538 	tcr |= RTW_TCR_SAT;		/* send ACK as fast as possible */
2539 	tcr &= ~RTW_TCR_LBK_MASK;
2540 	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2541 
2542 	/* set short/long retry limits */
2543 	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2544 	tcr |= SHIFTIN(4, RTW_TCR_SRL_MASK) | SHIFTIN(4, RTW_TCR_LRL_MASK);
2545 
2546 	tcr &= ~RTW_TCR_CRC;	/* NIC appends CRC32 */
2547 
2548 	RTW_WRITE(regs, RTW_TCR, tcr);
2549 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2550 }
2551 
2552 static inline void
2553 rtw_enable_interrupts(struct rtw_softc *sc)
2554 {
2555 	struct rtw_regs *regs = &sc->sc_regs;
2556 
2557 	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2558 	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2559 
2560 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2561 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2562 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2563 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2564 
2565 	/* XXX necessary? */
2566 	if (sc->sc_intr_ack != NULL)
2567 		(*sc->sc_intr_ack)(regs);
2568 }
2569 
2570 static void
2571 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2572 {
2573 	uint8_t msr;
2574 
2575 	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2576 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2577 
2578 	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2579 
2580 	switch (opmode) {
2581 	case IEEE80211_M_AHDEMO:
2582 	case IEEE80211_M_IBSS:
2583 		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2584 		break;
2585 	case IEEE80211_M_HOSTAP:
2586 		msr |= RTW_MSR_NETYPE_AP_OK;
2587 		break;
2588 	case IEEE80211_M_MONITOR:
2589 		/* XXX */
2590 		msr |= RTW_MSR_NETYPE_NOLINK;
2591 		break;
2592 	case IEEE80211_M_STA:
2593 		msr |= RTW_MSR_NETYPE_INFRA_OK;
2594 		break;
2595 	}
2596 	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2597 
2598 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2599 }
2600 
2601 #define	rtw_calchash(addr) \
2602 	(ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2603 
2604 static void
2605 rtw_pktfilt_load(struct rtw_softc *sc)
2606 {
2607 	struct rtw_regs *regs = &sc->sc_regs;
2608 	struct ieee80211com *ic = &sc->sc_ic;
2609 	struct ethercom *ec = &sc->sc_ec;
2610 	struct ifnet *ifp = &sc->sc_if;
2611 	int hash;
2612 	uint32_t hashes[2] = { 0, 0 };
2613 	struct ether_multi *enm;
2614 	struct ether_multistep step;
2615 
2616 	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2617 
2618 	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2619 	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2620 
2621 	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2622 	/* MAC auto-reset PHY (huh?) */
2623 	sc->sc_rcr |= RTW_RCR_ENMARP;
2624 	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2625 	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2626 
2627 	switch (ic->ic_opmode) {
2628 	case IEEE80211_M_MONITOR:
2629 		sc->sc_rcr |= RTW_RCR_MONITOR;
2630 		break;
2631 	case IEEE80211_M_AHDEMO:
2632 	case IEEE80211_M_IBSS:
2633 		/* receive broadcasts in our BSS */
2634 		sc->sc_rcr |= RTW_RCR_ADD3;
2635 		break;
2636 	default:
2637 		break;
2638 	}
2639 
2640 	ifp->if_flags &= ~IFF_ALLMULTI;
2641 
2642 	/* XXX accept all broadcast if scanning */
2643 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2644 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2645 
2646 	if (ifp->if_flags & IFF_PROMISC) {
2647 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2648 allmulti:
2649 		ifp->if_flags |= IFF_ALLMULTI;
2650 		goto setit;
2651 	}
2652 
2653 	/*
2654 	 * Program the 64-bit multicast hash filter.
2655 	 */
2656 	ETHER_FIRST_MULTI(step, ec, enm);
2657 	while (enm != NULL) {
2658 		/* XXX */
2659 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2660 		    ETHER_ADDR_LEN) != 0)
2661 			goto allmulti;
2662 
2663 		hash = rtw_calchash(enm->enm_addrlo);
2664 		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2665 		sc->sc_rcr |= RTW_RCR_AM;
2666 		ETHER_NEXT_MULTI(step, enm);
2667 	}
2668 
2669 	/* all bits set => hash is useless */
2670 	if (~(hashes[0] & hashes[1]) == 0)
2671 		goto allmulti;
2672 
2673  setit:
2674 	if (ifp->if_flags & IFF_ALLMULTI) {
2675 		sc->sc_rcr |= RTW_RCR_AM;	/* accept all multicast */
2676 		hashes[0] = hashes[1] = 0xffffffff;
2677 	}
2678 
2679 	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2680 	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2681 	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2682 	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2683 
2684 	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2685 	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2686 	    sc->sc_dev.dv_xname, RTW_READ(regs, RTW_MAR0),
2687 	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2688 
2689 	return;
2690 }
2691 
2692 static struct mbuf *
2693 rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
2694 {
2695 	struct ieee80211com *ic = &sc->sc_ic;
2696 	struct mbuf *m;
2697 	struct ieee80211_beacon_offsets	boff;
2698 
2699 	if ((m = ieee80211_beacon_alloc(ic, ni, &boff)) != NULL) {
2700 		RTW_DPRINTF(RTW_DEBUG_BEACON,
2701 		    ("%s: m %p len %u\n", __func__, m, m->m_len));
2702 	}
2703 	return m;
2704 }
2705 
2706 /* Must be called at splnet. */
2707 static int
2708 rtw_init(struct ifnet *ifp)
2709 {
2710 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2711 	struct ieee80211com *ic = &sc->sc_ic;
2712 	struct rtw_regs *regs = &sc->sc_regs;
2713 	int rc = 0;
2714 
2715 	if ((rc = rtw_enable(sc)) != 0)
2716 		goto out;
2717 
2718 	/* Cancel pending I/O and reset. */
2719 	rtw_stop(ifp, 0);
2720 
2721 	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2722 	    __func__, ieee80211_chan2ieee(ic, ic->ic_curchan),
2723 	    ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2724 
2725 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2726 		goto out;
2727 
2728 	if ((rc = rtw_swring_setup(sc)) != 0)
2729 		goto out;
2730 
2731 	rtw_transmit_config(regs);
2732 
2733 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2734 
2735 	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2736 	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2737 
2738 	/* long PLCP header, 1Mb/2Mb basic rate */
2739 	RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2740 	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2741 
2742 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2743 	rtw_set_access(regs, RTW_ACCESS_NONE);
2744 
2745 	/* XXX from reference sources */
2746 	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2747 	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2748 
2749 	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev.dv_xname);
2750 
2751 	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2752 	/* from Linux driver */
2753 	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2754 
2755 	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2756 
2757 	rtw_enable_interrupts(sc);
2758 
2759 	rtw_pktfilt_load(sc);
2760 
2761 	rtw_hwring_setup(sc);
2762 
2763 	rtw_wep_setkeys(sc, ic->ic_nw_keys, ic->ic_def_txkey);
2764 
2765 	rtw_io_enable(regs, RTW_CR_RE|RTW_CR_TE, 1);
2766 
2767 	ifp->if_flags |= IFF_RUNNING;
2768 	ic->ic_state = IEEE80211_S_INIT;
2769 
2770 	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2771 	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2772 
2773 	rtw_resume_ticks(sc);
2774 
2775 	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2776 
2777 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2778 		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2779 	else
2780 		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2781 
2782 out:
2783 	printf("%s: interface not running\n", sc->sc_dev.dv_xname);
2784 	return rc;
2785 }
2786 
2787 static inline void
2788 rtw_led_init(struct rtw_regs *regs)
2789 {
2790 	uint8_t cfg0, cfg1;
2791 
2792 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2793 
2794 	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2795 	cfg0 |= RTW_CONFIG0_LEDGPOEN;
2796 	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2797 
2798 	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2799 	RTW_DPRINTF(RTW_DEBUG_LED,
2800 	    ("%s: read %" PRIx8 " from reg[CONFIG1]\n", __func__, cfg1));
2801 
2802 	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2803 	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2804 	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2805 
2806 	rtw_set_access(regs, RTW_ACCESS_NONE);
2807 }
2808 
2809 /*
2810  * IEEE80211_S_INIT: 		LED1 off
2811  *
2812  * IEEE80211_S_AUTH,
2813  * IEEE80211_S_ASSOC,
2814  * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2815  *
2816  * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2817  */
2818 static void
2819 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2820 {
2821 	struct rtw_led_state *ls;
2822 
2823 	ls = &sc->sc_led_state;
2824 
2825 	switch (nstate) {
2826 	case IEEE80211_S_INIT:
2827 		rtw_led_init(&sc->sc_regs);
2828 		callout_stop(&ls->ls_slow_ch);
2829 		callout_stop(&ls->ls_fast_ch);
2830 		ls->ls_slowblink = 0;
2831 		ls->ls_actblink = 0;
2832 		ls->ls_default = 0;
2833 		break;
2834 	case IEEE80211_S_SCAN:
2835 		callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2836 		callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2837 		/*FALLTHROUGH*/
2838 	case IEEE80211_S_AUTH:
2839 	case IEEE80211_S_ASSOC:
2840 		ls->ls_default = RTW_LED1;
2841 		ls->ls_actblink = RTW_LED1;
2842 		ls->ls_slowblink = RTW_LED1;
2843 		break;
2844 	case IEEE80211_S_RUN:
2845 		ls->ls_slowblink = 0;
2846 		break;
2847 	}
2848 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2849 }
2850 
2851 static void
2852 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, int hwverid)
2853 {
2854 	uint8_t led_condition;
2855 	bus_size_t ofs;
2856 	uint8_t mask, newval, val;
2857 
2858 	led_condition = ls->ls_default;
2859 
2860 	if (ls->ls_state & RTW_LED_S_SLOW)
2861 		led_condition ^= ls->ls_slowblink;
2862 	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2863 		led_condition ^= ls->ls_actblink;
2864 
2865 	RTW_DPRINTF(RTW_DEBUG_LED,
2866 	    ("%s: LED condition %" PRIx8 "\n", __func__, led_condition));
2867 
2868 	switch (hwverid) {
2869 	default:
2870 	case 'F':
2871 		ofs = RTW_PSR;
2872 		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2873 		if (led_condition & RTW_LED0)
2874 			newval &= ~RTW_PSR_LEDGPO0;
2875 		if (led_condition & RTW_LED1)
2876 			newval &= ~RTW_PSR_LEDGPO1;
2877 		break;
2878 	case 'D':
2879 		ofs = RTW_9346CR;
2880 		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2881 		newval = RTW_9346CR_EEM_PROGRAM;
2882 		if (led_condition & RTW_LED0)
2883 			newval |= RTW_9346CR_EEDI;
2884 		if (led_condition & RTW_LED1)
2885 			newval |= RTW_9346CR_EECS;
2886 		break;
2887 	}
2888 	val = RTW_READ8(regs, ofs);
2889 	RTW_DPRINTF(RTW_DEBUG_LED,
2890 	    ("%s: read %" PRIx8 " from reg[%#02" PRIxPTR "]\n", __func__, val,
2891 	     (uintptr_t)ofs));
2892 	val &= ~mask;
2893 	val |= newval;
2894 	RTW_WRITE8(regs, ofs, val);
2895 	RTW_DPRINTF(RTW_DEBUG_LED,
2896 	    ("%s: wrote %" PRIx8 " to reg[%#02" PRIxPTR "]\n", __func__, val,
2897 	     (uintptr_t)ofs));
2898 	RTW_SYNC(regs, ofs, ofs);
2899 }
2900 
2901 static void
2902 rtw_led_fastblink(void *arg)
2903 {
2904 	int ostate, s;
2905 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2906 	struct rtw_led_state *ls = &sc->sc_led_state;
2907 
2908 	s = splnet();
2909 	ostate = ls->ls_state;
2910 	ls->ls_state ^= ls->ls_event;
2911 
2912 	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2913 		ls->ls_state &= ~RTW_LED_S_TX;
2914 
2915 	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2916 		ls->ls_state &= ~RTW_LED_S_RX;
2917 
2918 	ls->ls_event = 0;
2919 
2920 	if (ostate != ls->ls_state)
2921 		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2922 	splx(s);
2923 
2924 	callout_schedule(&ls->ls_fast_ch, RTW_LED_FAST_TICKS);
2925 }
2926 
2927 static void
2928 rtw_led_slowblink(void *arg)
2929 {
2930 	int s;
2931 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2932 	struct rtw_led_state *ls = &sc->sc_led_state;
2933 
2934 	s = splnet();
2935 	ls->ls_state ^= RTW_LED_S_SLOW;
2936 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2937 	splx(s);
2938 	callout_schedule(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS);
2939 }
2940 
2941 static inline void
2942 rtw_led_attach(struct rtw_led_state *ls, void *arg)
2943 {
2944 	callout_init(&ls->ls_fast_ch);
2945 	callout_init(&ls->ls_slow_ch);
2946 	callout_setfunc(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2947 	callout_setfunc(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2948 }
2949 
2950 static int
2951 rtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2952 {
2953 	int rc = 0, s;
2954 	struct rtw_softc *sc = ifp->if_softc;
2955 	struct ifreq *ifr = (struct ifreq *)data;
2956 
2957 	s = splnet();
2958 	switch (cmd) {
2959 	case SIOCSIFFLAGS:
2960 		if ((ifp->if_flags & IFF_UP) != 0) {
2961 			if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
2962 				rtw_pktfilt_load(sc);
2963 			} else
2964 				rc = rtw_init(ifp);
2965 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2966 		} else if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
2967 			RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2968 			rtw_stop(ifp, 1);
2969 		}
2970 		break;
2971 	case SIOCADDMULTI:
2972 	case SIOCDELMULTI:
2973 		if (cmd == SIOCADDMULTI)
2974 			rc = ether_addmulti(ifr, &sc->sc_ec);
2975 		else
2976 			rc = ether_delmulti(ifr, &sc->sc_ec);
2977 		if (rc != ENETRESET)
2978 			break;
2979 		if (ifp->if_flags & IFF_RUNNING)
2980 			rtw_pktfilt_load(sc);
2981 		rc = 0;
2982 		break;
2983 	default:
2984 		if ((rc = ieee80211_ioctl(&sc->sc_ic, cmd, data)) != ENETRESET)
2985 			break;
2986 		if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2987 			rc = rtw_init(ifp);
2988 		else
2989 			rc = 0;
2990 		break;
2991 	}
2992 	splx(s);
2993 	return rc;
2994 }
2995 
2996 /* Select a transmit ring with at least one h/w and s/w descriptor free.
2997  * Return 0 on success, -1 on failure.
2998  */
2999 static inline int
3000 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
3001     struct rtw_txdesc_blk **tdbp, int pri)
3002 {
3003 	struct rtw_txsoft_blk *tsb;
3004 	struct rtw_txdesc_blk *tdb;
3005 
3006 	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
3007 
3008 	tsb = &sc->sc_txsoft_blk[pri];
3009 	tdb = &sc->sc_txdesc_blk[pri];
3010 
3011 	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
3012 		if (tsb->tsb_tx_timer == 0)
3013 			tsb->tsb_tx_timer = 5;
3014 		*tsbp = NULL;
3015 		*tdbp = NULL;
3016 		return -1;
3017 	}
3018 	*tsbp = tsb;
3019 	*tdbp = tdb;
3020 	return 0;
3021 }
3022 
3023 static inline struct mbuf *
3024 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
3025     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
3026     struct ieee80211_node **nip, short *if_flagsp)
3027 {
3028 	struct mbuf *m;
3029 
3030 	if (IF_IS_EMPTY(ifq))
3031 		return NULL;
3032 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3033 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3034 		    __func__, pri));
3035 		*if_flagsp |= IFF_OACTIVE;
3036 		sc->sc_if.if_timer = 1;
3037 		return NULL;
3038 	}
3039 	IF_DEQUEUE(ifq, m);
3040 	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3041 	m->m_pkthdr.rcvif = NULL;
3042 	KASSERT(*nip != NULL);
3043 	return m;
3044 }
3045 
3046 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
3047  * at the driver's selection of transmit control block for the packet.
3048  */
3049 static inline int
3050 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
3051     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
3052     struct ieee80211_node **nip)
3053 {
3054 	int pri;
3055 	struct ether_header *eh;
3056 	struct mbuf *m0;
3057 	struct rtw_softc *sc;
3058 	short *if_flagsp;
3059 
3060 	sc = (struct rtw_softc *)ifp->if_softc;
3061 
3062 	DPRINTF(sc, RTW_DEBUG_XMIT,
3063 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3064 
3065 	if_flagsp = &ifp->if_flags;
3066 
3067 	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
3068 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
3069 		                     tdbp, nip, if_flagsp)) != NULL) {
3070 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
3071 		    __func__));
3072 		return 0;
3073 	}
3074 
3075 	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
3076 		                     tdbp, nip, if_flagsp)) != NULL) {
3077 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
3078 		    __func__));
3079 		return 0;
3080 	}
3081 
3082 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
3083 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
3084 		return 0;
3085 	}
3086 
3087 	*mp = NULL;
3088 
3089 	IFQ_POLL(&ifp->if_snd, m0);
3090 	if (m0 == NULL) {
3091 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3092 		    __func__));
3093 		return 0;
3094 	}
3095 
3096 	pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
3097 
3098 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
3099 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
3100 		    __func__, pri));
3101 		*if_flagsp |= IFF_OACTIVE;
3102 		sc->sc_if.if_timer = 1;
3103 		return 0;
3104 	}
3105 
3106 	IFQ_DEQUEUE(&ifp->if_snd, m0);
3107 	if (m0 == NULL) {
3108 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
3109 		    __func__));
3110 		return 0;
3111 	}
3112 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
3113 	ifp->if_opackets++;
3114 #if NBPFILTER > 0
3115 	if (ifp->if_bpf)
3116 		bpf_mtap(ifp->if_bpf, m0);
3117 #endif
3118 	eh = mtod(m0, struct ether_header *);
3119 	*nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
3120 	if (*nip == NULL) {
3121 		/* NB: ieee80211_find_txnode does stat+msg */
3122 		m_freem(m0);
3123 		return -1;
3124 	}
3125 	if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
3126 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: encap error\n", __func__));
3127 		ifp->if_oerrors++;
3128 		return -1;
3129 	}
3130 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3131 	*mp = m0;
3132 	return 0;
3133 }
3134 
3135 static int
3136 rtw_seg_too_short(bus_dmamap_t dmamap)
3137 {
3138 	int i;
3139 	for (i = 0; i < dmamap->dm_nsegs; i++) {
3140 		if (dmamap->dm_segs[i].ds_len < 4) {
3141 			printf("%s: segment too short\n", __func__);
3142 			return 1;
3143 		}
3144 	}
3145 	return 0;
3146 }
3147 
3148 /* TBD factor with atw_start */
3149 static struct mbuf *
3150 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
3151     u_int ndescfree, const char *dvname)
3152 {
3153 	int first, rc;
3154 	struct mbuf *m, *m0;
3155 
3156 	m0 = chain;
3157 
3158 	/*
3159 	 * Load the DMA map.  Copy and try (once) again if the packet
3160 	 * didn't fit in the alloted number of segments.
3161 	 */
3162 	for (first = 1;
3163 	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
3164 			  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
3165 	      dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
3166 	     first = 0) {
3167 		if (rc == 0)
3168 			bus_dmamap_unload(dmat, dmam);
3169 		MGETHDR(m, M_DONTWAIT, MT_DATA);
3170 		if (m == NULL) {
3171 			printf("%s: unable to allocate Tx mbuf\n",
3172 			    dvname);
3173 			break;
3174 		}
3175 		if (m0->m_pkthdr.len > MHLEN) {
3176 			MCLGET(m, M_DONTWAIT);
3177 			if ((m->m_flags & M_EXT) == 0) {
3178 				printf("%s: cannot allocate Tx cluster\n",
3179 				    dvname);
3180 				m_freem(m);
3181 				break;
3182 			}
3183 		}
3184 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
3185 		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3186 		m_freem(m0);
3187 		m0 = m;
3188 		m = NULL;
3189 	}
3190 	if (rc != 0) {
3191 		printf("%s: cannot load Tx buffer, rc = %d\n", dvname, rc);
3192 		m_freem(m0);
3193 		return NULL;
3194 	} else if (rtw_seg_too_short(dmam)) {
3195 		printf("%s: cannot load Tx buffer, segment too short\n",
3196 		    dvname);
3197 		bus_dmamap_unload(dmat, dmam);
3198 		m_freem(m0);
3199 		return NULL;
3200 	} else if (dmam->dm_nsegs > ndescfree) {
3201 		printf("%s: too many tx segments\n", dvname);
3202 		bus_dmamap_unload(dmat, dmam);
3203 		m_freem(m0);
3204 		return NULL;
3205 	}
3206 	return m0;
3207 }
3208 
3209 #ifdef RTW_DEBUG
3210 static void
3211 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3212     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3213 {
3214 	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3215 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3216 	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3217 	    sc->sc_dev.dv_xname, ts, action, desc,
3218 	    le32toh(td->td_buf), le32toh(td->td_next),
3219 	    le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3220 	    le32toh(td->td_len)));
3221 }
3222 #endif /* RTW_DEBUG */
3223 
3224 static void
3225 rtw_start(struct ifnet *ifp)
3226 {
3227 	uint8_t tppoll;
3228 	int desc, i, lastdesc, npkt, rate;
3229 	uint32_t proto_ctl0, ctl0, ctl1;
3230 	bus_dmamap_t		dmamap;
3231 	struct ieee80211com	*ic;
3232 	struct ieee80211_duration *d0;
3233 	struct ieee80211_frame_min	*wh;
3234 	struct ieee80211_node	*ni = NULL;	/* XXX: GCC */
3235 	struct mbuf		*m0;
3236 	struct rtw_softc	*sc;
3237 	struct rtw_txsoft_blk	*tsb = NULL;	/* XXX: GCC */
3238 	struct rtw_txdesc_blk	*tdb = NULL;	/* XXX: GCC */
3239 	struct rtw_txsoft	*ts;
3240 	struct rtw_txdesc	*td;
3241 	struct ieee80211_key	*k;
3242 
3243 	sc = (struct rtw_softc *)ifp->if_softc;
3244 	ic = &sc->sc_ic;
3245 
3246 	DPRINTF(sc, RTW_DEBUG_XMIT,
3247 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3248 
3249 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3250 		goto out;
3251 
3252 	/* XXX do real rate control */
3253 	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3254 
3255 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3256 		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3257 
3258 	for (;;) {
3259 		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3260 			continue;
3261 		if (m0 == NULL)
3262 			break;
3263 
3264 		wh = mtod(m0, struct ieee80211_frame_min *);
3265 
3266 		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3267 		    (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3268 			m_freem(m0);
3269 			break;
3270 		} else
3271 			k = NULL;
3272 
3273 		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3274 
3275 		dmamap = ts->ts_dmamap;
3276 
3277 		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3278 		    tdb->tdb_nfree, sc->sc_dev.dv_xname);
3279 
3280 		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3281 			DPRINTF(sc, RTW_DEBUG_XMIT,
3282 			    ("%s: fail dmamap load\n", __func__));
3283 			goto post_dequeue_err;
3284 		}
3285 
3286 		/* Note well: rtw_dmamap_load_txbuf may have created
3287 		 * a new chain, so we must find the header once
3288 		 * more.
3289 		 */
3290 		wh = mtod(m0, struct ieee80211_frame_min *);
3291 
3292 		/* XXX do real rate control */
3293 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3294 		    IEEE80211_FC0_TYPE_MGT)
3295 			rate = 2;
3296 		else
3297 			rate = MAX(2, ieee80211_get_rate(ni));
3298 
3299 #ifdef RTW_DEBUG
3300 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3301 		    (IFF_DEBUG|IFF_LINK2)) {
3302 			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3303 			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3304 			                            : sizeof(wh),
3305 			    rate, 0);
3306 		}
3307 #endif /* RTW_DEBUG */
3308 		ctl0 = proto_ctl0 |
3309 		    SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3310 
3311 		switch (rate) {
3312 		default:
3313 		case 2:
3314 			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3315 			break;
3316 		case 4:
3317 			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3318 			break;
3319 		case 11:
3320 			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3321 			break;
3322 		case 22:
3323 			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3324 			break;
3325 		}
3326 		/* XXX >= ? Compare after fragmentation? */
3327 		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3328 			ctl0 |= RTW_TXCTL0_RTSEN;
3329 
3330                 /* XXX Sometimes writes a bogus keyid; h/w doesn't
3331                  * seem to care, since we don't activate h/w Tx
3332                  * encryption.
3333 		 */
3334 		if (k != NULL) {
3335 			ctl0 |= SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3336 			    RTW_TXCTL0_KEYID_MASK;
3337 		}
3338 
3339 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3340 		    IEEE80211_FC0_TYPE_MGT) {
3341 			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3342 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3343 			    IEEE80211_FC0_SUBTYPE_BEACON)
3344 				ctl0 |= RTW_TXCTL0_BEACON;
3345 		}
3346 
3347 		if (ieee80211_compute_duration(wh, k, m0->m_pkthdr.len,
3348 		    ic->ic_flags, ic->ic_fragthreshold,
3349 		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3350 		    (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3351 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3352 			DPRINTF(sc, RTW_DEBUG_XMIT,
3353 			    ("%s: fail compute duration\n", __func__));
3354 			goto post_load_err;
3355 		}
3356 
3357 		d0 = &ts->ts_d0;
3358 
3359 		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3360 
3361 		ctl1 = SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3362 		    SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3363 
3364 		if (d0->d_residue)
3365 			ctl1 |= RTW_TXCTL1_LENGEXT;
3366 
3367 		/* TBD fragmentation */
3368 
3369 		ts->ts_first = tdb->tdb_next;
3370 
3371 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3372 		    BUS_DMASYNC_PREWRITE);
3373 
3374 		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3375 
3376 #if NBPFILTER > 0
3377 		if (ic->ic_rawbpf != NULL)
3378 			bpf_mtap((caddr_t)ic->ic_rawbpf, m0);
3379 
3380 		if (sc->sc_radiobpf != NULL) {
3381 			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3382 
3383 			rt->rt_flags = 0;
3384 			rt->rt_rate = rate;
3385 
3386 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)rt,
3387 			    sizeof(sc->sc_txtapu), m0);
3388 		}
3389 #endif /* NPBFILTER > 0 */
3390 
3391 		for (i = 0, lastdesc = desc = ts->ts_first;
3392 		     i < dmamap->dm_nsegs;
3393 		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3394 			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3395 				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3396 				    ("%s: seg too long\n", __func__));
3397 				goto post_load_err;
3398 			}
3399 			td = &tdb->tdb_desc[desc];
3400 			td->td_ctl0 = htole32(ctl0);
3401 			if (i != 0)
3402 				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3403 			td->td_ctl1 = htole32(ctl1);
3404 			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3405 			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3406 			lastdesc = desc;
3407 #ifdef RTW_DEBUG
3408 			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3409 #endif /* RTW_DEBUG */
3410 		}
3411 
3412 		KASSERT(desc < tdb->tdb_ndesc);
3413 
3414 		ts->ts_ni = ni;
3415 		KASSERT(ni != NULL);
3416 		ts->ts_mbuf = m0;
3417 		ts->ts_last = lastdesc;
3418 		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3419 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3420 		   htole32(RTW_TXCTL0_FS);
3421 
3422 #ifdef RTW_DEBUG
3423 		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3424 		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3425 #endif /* RTW_DEBUG */
3426 
3427 		tdb->tdb_nfree -= dmamap->dm_nsegs;
3428 		tdb->tdb_next = desc;
3429 
3430 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3431 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3432 
3433 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3434 		    htole32(RTW_TXCTL0_OWN);
3435 
3436 #ifdef RTW_DEBUG
3437 		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3438 #endif /* RTW_DEBUG */
3439 
3440 		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3441 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3442 
3443 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3444 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3445 
3446 		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3447 			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3448 		tsb->tsb_tx_timer = 5;
3449 		ifp->if_timer = 1;
3450 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3451 		tppoll &= ~RTW_TPPOLL_SALL;
3452 		tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
3453 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3454 		RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
3455 	}
3456 out:
3457 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3458 	return;
3459 post_load_err:
3460 	bus_dmamap_unload(sc->sc_dmat, dmamap);
3461 	m_freem(m0);
3462 post_dequeue_err:
3463 	ieee80211_free_node(ni);
3464 	return;
3465 }
3466 
3467 static void
3468 rtw_idle(struct rtw_regs *regs)
3469 {
3470 	int active;
3471 
3472 	/* request stop DMA; wait for packets to stop transmitting. */
3473 
3474 	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3475 	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3476 
3477 	for (active = 0; active < 300 &&
3478 	     (RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0; active++)
3479 		DELAY(10);
3480 	printf("%s: transmit DMA idle in %dus\n", __func__, active * 10);
3481 }
3482 
3483 static void
3484 rtw_watchdog(struct ifnet *ifp)
3485 {
3486 	int pri, tx_timeouts = 0;
3487 	struct rtw_softc *sc;
3488 	struct rtw_txsoft_blk *tsb;
3489 
3490 	sc = ifp->if_softc;
3491 
3492 	ifp->if_timer = 0;
3493 
3494 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
3495 		return;
3496 
3497 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3498 		tsb = &sc->sc_txsoft_blk[pri];
3499 
3500 		if (tsb->tsb_tx_timer == 0)
3501 			continue;
3502 		else if (--tsb->tsb_tx_timer == 0) {
3503 			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3504 				continue;
3505 			printf("%s: transmit timeout, priority %d\n",
3506 			    ifp->if_xname, pri);
3507 			ifp->if_oerrors++;
3508 			tx_timeouts++;
3509 		} else
3510 			ifp->if_timer = 1;
3511 	}
3512 
3513 	if (tx_timeouts > 0) {
3514 		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3515 		 * reset s/w tx-ring pointers, and start transmission.
3516 		 *
3517 		 * TBD Stop/restart just the broken rings?
3518 		 */
3519 		rtw_idle(&sc->sc_regs);
3520 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 0);
3521 		rtw_txdescs_reset(sc);
3522 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 1);
3523 		rtw_txring_fixup(sc);
3524 		rtw_start(ifp);
3525 	}
3526 	ieee80211_watchdog(&sc->sc_ic);
3527 	return;
3528 }
3529 
3530 static void
3531 rtw_next_scan(void *arg)
3532 {
3533 	struct ieee80211com *ic = arg;
3534 	int s;
3535 
3536 	/* don't call rtw_start w/o network interrupts blocked */
3537 	s = splnet();
3538 	if (ic->ic_state == IEEE80211_S_SCAN)
3539 		ieee80211_next_scan(ic);
3540 	splx(s);
3541 }
3542 
3543 static void
3544 rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3545 {
3546 	uint16_t bcnitv, bintritv, intval;
3547 	int i;
3548 	struct rtw_regs *regs = &sc->sc_regs;
3549 
3550 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3551 		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3552 
3553 	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3554 
3555 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3556 
3557 	intval = MIN(intval0, SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3558 
3559 	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3560 	bcnitv |= SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3561 	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3562 	/* interrupt host 1ms before the TBTT */
3563 	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3564 	bintritv |= SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3565 	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3566 	/* magic from Linux */
3567 	RTW_WRITE16(regs, RTW_ATIMWND, SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3568 	RTW_WRITE16(regs, RTW_ATIMTRITV, SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3569 	rtw_set_access(regs, RTW_ACCESS_NONE);
3570 
3571 	rtw_io_enable(regs, RTW_CR_RE | RTW_CR_TE, 1);
3572 }
3573 
3574 /* Synchronize the hardware state with the software state. */
3575 static int
3576 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3577 {
3578 	struct ifnet *ifp = ic->ic_ifp;
3579 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3580 	enum ieee80211_state ostate;
3581 	int error;
3582 
3583 	ostate = ic->ic_state;
3584 
3585 	rtw_led_newstate(sc, nstate);
3586 
3587 	if (nstate == IEEE80211_S_INIT) {
3588 		callout_stop(&sc->sc_scan_ch);
3589 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3590 		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3591 	}
3592 
3593 	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3594 		rtw_pwrstate(sc, RTW_ON);
3595 
3596 	if ((error = rtw_tune(sc)) != 0)
3597 		return error;
3598 
3599 	switch (nstate) {
3600 	case IEEE80211_S_INIT:
3601 		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3602 		break;
3603 	case IEEE80211_S_SCAN:
3604 		if (ostate != IEEE80211_S_SCAN) {
3605 			(void)memset(ic->ic_bss->ni_bssid, 0,
3606 			    IEEE80211_ADDR_LEN);
3607 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3608 		}
3609 
3610 		callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3611 		    rtw_next_scan, ic);
3612 
3613 		break;
3614 	case IEEE80211_S_RUN:
3615 		switch (ic->ic_opmode) {
3616 		case IEEE80211_M_HOSTAP:
3617 		case IEEE80211_M_IBSS:
3618 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3619 			/*FALLTHROUGH*/
3620 		case IEEE80211_M_AHDEMO:
3621 		case IEEE80211_M_STA:
3622 			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3623 			    ic->ic_bss->ni_intval);
3624 			break;
3625 		case IEEE80211_M_MONITOR:
3626 			break;
3627 		}
3628 		rtw_set_nettype(sc, ic->ic_opmode);
3629 		break;
3630 	case IEEE80211_S_ASSOC:
3631 	case IEEE80211_S_AUTH:
3632 		break;
3633 	}
3634 
3635 	if (nstate != IEEE80211_S_SCAN)
3636 		callout_stop(&sc->sc_scan_ch);
3637 
3638 	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3639 }
3640 
3641 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3642 static uint64_t
3643 rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3644 {
3645 	uint32_t tsftl, tsfth;
3646 
3647 	tsfth = RTW_READ(regs, RTW_TSFTRH);
3648 	tsftl = RTW_READ(regs, RTW_TSFTRL);
3649 	if (tsftl < rstamp)	/* Compensate for rollover. */
3650 		tsfth--;
3651 	return ((uint64_t)tsfth << 32) | rstamp;
3652 }
3653 
3654 static void
3655 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3656     struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3657 {
3658 	struct ifnet *ifp = ic->ic_ifp;
3659 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3660 
3661 	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
3662 
3663 	switch (subtype) {
3664 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3665 	case IEEE80211_FC0_SUBTYPE_BEACON:
3666 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
3667 		    ic->ic_state == IEEE80211_S_RUN) {
3668 			uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3669 			if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3670 				(void)ieee80211_ibss_merge(ni);
3671 		}
3672 		break;
3673 	default:
3674 		break;
3675 	}
3676 	return;
3677 }
3678 
3679 static struct ieee80211_node *
3680 rtw_node_alloc(struct ieee80211_node_table *nt)
3681 {
3682 	struct ifnet *ifp = nt->nt_ic->ic_ifp;
3683 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3684 	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3685 
3686 	DPRINTF(sc, RTW_DEBUG_NODE,
3687 	    ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
3688 	return ni;
3689 }
3690 
3691 static void
3692 rtw_node_free(struct ieee80211_node *ni)
3693 {
3694 	struct ieee80211com *ic = ni->ni_ic;
3695 	struct ifnet *ifp = ic->ic_ifp;
3696 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3697 
3698 	DPRINTF(sc, RTW_DEBUG_NODE,
3699 	    ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
3700 	    ether_sprintf(ni->ni_bssid)));
3701 	(*sc->sc_mtbl.mt_node_free)(ni);
3702 }
3703 
3704 static int
3705 rtw_media_change(struct ifnet *ifp)
3706 {
3707 	int error;
3708 
3709 	error = ieee80211_media_change(ifp);
3710 	if (error == ENETRESET) {
3711 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3712 		    (IFF_RUNNING|IFF_UP))
3713 			rtw_init(ifp);		/* XXX lose error */
3714 		error = 0;
3715 	}
3716 	return error;
3717 }
3718 
3719 static void
3720 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3721 {
3722 	struct rtw_softc *sc = ifp->if_softc;
3723 
3724 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
3725 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3726 		imr->ifm_status = 0;
3727 		return;
3728 	}
3729 	ieee80211_media_status(ifp, imr);
3730 }
3731 
3732 void
3733 rtw_power(int why, void *arg)
3734 {
3735 	struct rtw_softc *sc = arg;
3736 	struct ifnet *ifp = &sc->sc_if;
3737 	int s;
3738 
3739 	DPRINTF(sc, RTW_DEBUG_PWR,
3740 	    ("%s: rtw_power(%d,)\n", sc->sc_dev.dv_xname, why));
3741 
3742 	s = splnet();
3743 	switch (why) {
3744 	case PWR_STANDBY:
3745 		/* XXX do nothing. */
3746 		break;
3747 	case PWR_SUSPEND:
3748 		rtw_stop(ifp, 0);
3749 		if (sc->sc_power != NULL)
3750 			(*sc->sc_power)(sc, why);
3751 		break;
3752 	case PWR_RESUME:
3753 		if (ifp->if_flags & IFF_UP) {
3754 			if (sc->sc_power != NULL)
3755 				(*sc->sc_power)(sc, why);
3756 			rtw_init(ifp);
3757 		}
3758 		break;
3759 	case PWR_SOFTSUSPEND:
3760 	case PWR_SOFTSTANDBY:
3761 	case PWR_SOFTRESUME:
3762 		break;
3763 	}
3764 	splx(s);
3765 }
3766 
3767 /* rtw_shutdown: make sure the interface is stopped at reboot time. */
3768 void
3769 rtw_shutdown(void *arg)
3770 {
3771 	struct rtw_softc *sc = arg;
3772 
3773 	rtw_stop(&sc->sc_if, 1);
3774 }
3775 
3776 static inline void
3777 rtw_setifprops(struct ifnet *ifp, const char *dvname, void *softc)
3778 {
3779 	(void)memcpy(ifp->if_xname, dvname, IFNAMSIZ);
3780 	ifp->if_softc = softc;
3781 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
3782 	    IFF_NOTRAILERS;
3783 	ifp->if_ioctl = rtw_ioctl;
3784 	ifp->if_start = rtw_start;
3785 	ifp->if_watchdog = rtw_watchdog;
3786 	ifp->if_init = rtw_init;
3787 	ifp->if_stop = rtw_stop;
3788 }
3789 
3790 static inline void
3791 rtw_set80211props(struct ieee80211com *ic)
3792 {
3793 	int nrate;
3794 	ic->ic_phytype = IEEE80211_T_DS;
3795 	ic->ic_opmode = IEEE80211_M_STA;
3796 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
3797 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR;
3798 
3799 	nrate = 0;
3800 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3801 	    IEEE80211_RATE_BASIC | 2;
3802 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] =
3803 	    IEEE80211_RATE_BASIC | 4;
3804 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
3805 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
3806 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
3807 }
3808 
3809 static inline void
3810 rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3811 {
3812 	mtbl->mt_newstate = ic->ic_newstate;
3813 	ic->ic_newstate = rtw_newstate;
3814 
3815 	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3816 	ic->ic_recv_mgmt = rtw_recv_mgmt;
3817 
3818 	mtbl->mt_node_free = ic->ic_node_free;
3819 	ic->ic_node_free = rtw_node_free;
3820 
3821 	mtbl->mt_node_alloc = ic->ic_node_alloc;
3822 	ic->ic_node_alloc = rtw_node_alloc;
3823 
3824 	ic->ic_crypto.cs_key_delete = rtw_key_delete;
3825 	ic->ic_crypto.cs_key_set = rtw_key_set;
3826 	ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3827 	ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3828 }
3829 
3830 static inline void
3831 rtw_establish_hooks(struct rtw_hooks *hooks, const char *dvname,
3832     void *arg)
3833 {
3834 	/*
3835 	 * Make sure the interface is shutdown during reboot.
3836 	 */
3837 	hooks->rh_shutdown = shutdownhook_establish(rtw_shutdown, arg);
3838 	if (hooks->rh_shutdown == NULL)
3839 		printf("%s: WARNING: unable to establish shutdown hook\n",
3840 		    dvname);
3841 
3842 	/*
3843 	 * Add a suspend hook to make sure we come back up after a
3844 	 * resume.
3845 	 */
3846 	hooks->rh_power = powerhook_establish(rtw_power, arg);
3847 	if (hooks->rh_power == NULL)
3848 		printf("%s: WARNING: unable to establish power hook\n",
3849 		    dvname);
3850 }
3851 
3852 static inline void
3853 rtw_disestablish_hooks(struct rtw_hooks *hooks, const char *dvname,
3854     void *arg)
3855 {
3856 	if (hooks->rh_shutdown != NULL)
3857 		shutdownhook_disestablish(hooks->rh_shutdown);
3858 
3859 	if (hooks->rh_power != NULL)
3860 		powerhook_disestablish(hooks->rh_power);
3861 }
3862 
3863 static inline void
3864 rtw_init_radiotap(struct rtw_softc *sc)
3865 {
3866 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
3867 	sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3868 	sc->sc_rxtap.rr_ihdr.it_present = htole32(RTW_RX_RADIOTAP_PRESENT);
3869 
3870 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
3871 	sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3872 	sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3873 }
3874 
3875 static int
3876 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3877 {
3878 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3879 	SIMPLEQ_INIT(&tsb->tsb_freeq);
3880 	tsb->tsb_ndesc = qlen;
3881 	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3882 	    M_NOWAIT);
3883 	if (tsb->tsb_desc == NULL)
3884 		return ENOMEM;
3885 	return 0;
3886 }
3887 
3888 static void
3889 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3890 {
3891 	int pri;
3892 	struct rtw_txsoft_blk *tsb;
3893 
3894 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3895 		tsb = &sc->sc_txsoft_blk[pri];
3896 		free(tsb->tsb_desc, M_DEVBUF);
3897 		tsb->tsb_desc = NULL;
3898 	}
3899 }
3900 
3901 static int
3902 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3903 {
3904 	int pri, rc = 0;
3905 	int qlen[RTW_NTXPRI] =
3906 	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3907 	struct rtw_txsoft_blk *tsbs;
3908 
3909 	tsbs = sc->sc_txsoft_blk;
3910 
3911 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3912 		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3913 		if (rc != 0)
3914 			break;
3915 	}
3916 	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3917 	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3918 	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3919 	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3920 	return rc;
3921 }
3922 
3923 static void
3924 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3925     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3926 {
3927 	tdb->tdb_ndesc = ndesc;
3928 	tdb->tdb_desc = desc;
3929 	tdb->tdb_physbase = physbase;
3930 	tdb->tdb_ofs = ofs;
3931 
3932 	(void)memset(tdb->tdb_desc, 0,
3933 	    sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3934 
3935 	rtw_txdesc_blk_init(tdb);
3936 	tdb->tdb_next = 0;
3937 }
3938 
3939 static void
3940 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3941 {
3942 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3943 	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3944 	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3945 
3946 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3947 	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3948 	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3949 
3950 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3951 	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3952 	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3953 
3954 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3955 	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3956 	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3957 }
3958 
3959 static struct rtw_rf *
3960 rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3961 {
3962 	rtw_rf_write_t rf_write;
3963 	struct rtw_rf *rf;
3964 
3965 	switch (rfchipid) {
3966 	default:
3967 		rf_write = rtw_rf_hostwrite;
3968 		break;
3969 	case RTW_RFCHIPID_INTERSIL:
3970 	case RTW_RFCHIPID_PHILIPS:
3971 	case RTW_RFCHIPID_GCT:	/* XXX a guess */
3972 	case RTW_RFCHIPID_RFMD:
3973 		rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3974 		break;
3975 	}
3976 
3977 	switch (rfchipid) {
3978 	case RTW_RFCHIPID_GCT:
3979 		rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3980 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3981 		break;
3982 	case RTW_RFCHIPID_MAXIM:
3983 		rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3984 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3985 		break;
3986 	case RTW_RFCHIPID_PHILIPS:
3987 		rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
3988 		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3989 		break;
3990 	case RTW_RFCHIPID_RFMD:
3991 		/* XXX RFMD has no RF constructor */
3992 		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3993 		/*FALLTHROUGH*/
3994 	default:
3995 		return NULL;
3996 	}
3997 	rf->rf_continuous_tx_cb =
3998 	    (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
3999 	rf->rf_continuous_tx_arg = (void *)sc;
4000 	return rf;
4001 }
4002 
4003 /* Revision C and later use a different PHY delay setting than
4004  * revisions A and B.
4005  */
4006 static uint8_t
4007 rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
4008 {
4009 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
4010 #define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
4011 
4012 	uint8_t phydelay = SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
4013 
4014 	RTW_WRITE(regs, RTW_RCR, REVAB);
4015 	RTW_WBW(regs, RTW_RCR, RTW_RCR);
4016 	RTW_WRITE(regs, RTW_RCR, REVC);
4017 
4018 	RTW_WBR(regs, RTW_RCR, RTW_RCR);
4019 	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
4020 		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
4021 
4022 	RTW_WRITE(regs, RTW_RCR, old_rcr);	/* restore RCR */
4023 	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
4024 
4025 	return phydelay;
4026 #undef REVC
4027 }
4028 
4029 void
4030 rtw_attach(struct rtw_softc *sc)
4031 {
4032 	struct ifnet *ifp = &sc->sc_if;
4033 	struct ieee80211com *ic = &sc->sc_ic;
4034 	struct rtw_txsoft_blk *tsb;
4035 	int pri, rc;
4036 
4037 	rtw_cipher_wep = ieee80211_cipher_wep;
4038 	rtw_cipher_wep.ic_decap = rtw_wep_decap;
4039 
4040 	NEXT_ATTACH_STATE(sc, DETACHED);
4041 
4042 	switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
4043 	case RTW_TCR_HWVERID_F:
4044 		sc->sc_hwverid = 'F';
4045 		break;
4046 	case RTW_TCR_HWVERID_D:
4047 		sc->sc_hwverid = 'D';
4048 		break;
4049 	default:
4050 		sc->sc_hwverid = '?';
4051 		break;
4052 	}
4053 	printf("%s: hardware version %c\n", sc->sc_dev.dv_xname,
4054 	    sc->sc_hwverid);
4055 
4056 	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
4057 	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
4058 	    0);
4059 
4060 	if (rc != 0) {
4061 		printf("%s: could not allocate hw descriptors, error %d\n",
4062 		     sc->sc_dev.dv_xname, rc);
4063 		goto err;
4064 	}
4065 
4066 	NEXT_ATTACH_STATE(sc, FINISH_DESC_ALLOC);
4067 
4068 	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
4069 	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
4070 	    (caddr_t*)&sc->sc_descs, BUS_DMA_COHERENT);
4071 
4072 	if (rc != 0) {
4073 		printf("%s: could not map hw descriptors, error %d\n",
4074 		    sc->sc_dev.dv_xname, rc);
4075 		goto err;
4076 	}
4077 	NEXT_ATTACH_STATE(sc, FINISH_DESC_MAP);
4078 
4079 	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
4080 	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
4081 
4082 	if (rc != 0) {
4083 		printf("%s: could not create DMA map for hw descriptors, "
4084 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4085 		goto err;
4086 	}
4087 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_CREATE);
4088 
4089 	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
4090 	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
4091 
4092 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4093 		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
4094 		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
4095 	}
4096 
4097 	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
4098 	    sizeof(struct rtw_descs), NULL, 0);
4099 
4100 	if (rc != 0) {
4101 		printf("%s: could not load DMA map for hw descriptors, "
4102 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4103 		goto err;
4104 	}
4105 	NEXT_ATTACH_STATE(sc, FINISH_DESCMAP_LOAD);
4106 
4107 	if (rtw_txsoft_blk_setup_all(sc) != 0)
4108 		goto err;
4109 	NEXT_ATTACH_STATE(sc, FINISH_TXCTLBLK_SETUP);
4110 
4111 	rtw_txdesc_blk_setup_all(sc);
4112 
4113 	NEXT_ATTACH_STATE(sc, FINISH_TXDESCBLK_SETUP);
4114 
4115 	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
4116 
4117 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4118 		tsb = &sc->sc_txsoft_blk[pri];
4119 
4120 		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
4121 		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
4122 			printf("%s: could not load DMA map for "
4123 			    "hw tx descriptors, error %d\n",
4124 			    sc->sc_dev.dv_xname, rc);
4125 			goto err;
4126 		}
4127 	}
4128 
4129 	NEXT_ATTACH_STATE(sc, FINISH_TXMAPS_CREATE);
4130 	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
4131 	                                    RTW_RXQLEN)) != 0) {
4132 		printf("%s: could not load DMA map for hw rx descriptors, "
4133 		    "error %d\n", sc->sc_dev.dv_xname, rc);
4134 		goto err;
4135 	}
4136 	NEXT_ATTACH_STATE(sc, FINISH_RXMAPS_CREATE);
4137 
4138 	/* Reset the chip to a known state. */
4139 	if (rtw_reset(sc) != 0)
4140 		goto err;
4141 	NEXT_ATTACH_STATE(sc, FINISH_RESET);
4142 
4143 	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
4144 
4145 	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
4146 		sc->sc_flags |= RTW_F_9356SROM;
4147 
4148 	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
4149 	    sc->sc_dev.dv_xname) != 0)
4150 		goto err;
4151 
4152 	NEXT_ATTACH_STATE(sc, FINISH_READ_SROM);
4153 
4154 	if (rtw_srom_parse(&sc->sc_srom, &sc->sc_flags, &sc->sc_csthr,
4155 	    &sc->sc_rfchipid, &sc->sc_rcr, &sc->sc_locale,
4156 	    sc->sc_dev.dv_xname) != 0) {
4157 		printf("%s: attach failed, malformed serial ROM\n",
4158 		    sc->sc_dev.dv_xname);
4159 		goto err;
4160 	}
4161 
4162 	printf("%s: %s PHY\n", sc->sc_dev.dv_xname,
4163 	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog");
4164 
4165 	printf("%s: CS threshold %u\n", sc->sc_dev.dv_xname, sc->sc_csthr);
4166 
4167 	NEXT_ATTACH_STATE(sc, FINISH_PARSE_SROM);
4168 
4169 	sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
4170 	    sc->sc_flags & RTW_F_DIGPHY);
4171 
4172 	if (sc->sc_rf == NULL) {
4173 		printf("%s: attach failed, could not attach RF\n",
4174 		    sc->sc_dev.dv_xname);
4175 		goto err;
4176 	}
4177 
4178 	NEXT_ATTACH_STATE(sc, FINISH_RF_ATTACH);
4179 
4180 	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
4181 
4182 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4183 	    ("%s: PHY delay %d\n", sc->sc_dev.dv_xname, sc->sc_phydelay));
4184 
4185 	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4186 		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4187 
4188 	rtw_init_channels(sc->sc_locale, &sc->sc_ic.ic_channels,
4189 	    sc->sc_dev.dv_xname);
4190 
4191 	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4192 	    sc->sc_dev.dv_xname) != 0)
4193 		goto err;
4194 	NEXT_ATTACH_STATE(sc, FINISH_ID_STA);
4195 
4196 	rtw_setifprops(ifp, sc->sc_dev.dv_xname, (void*)sc);
4197 
4198 	IFQ_SET_READY(&ifp->if_snd);
4199 
4200 	sc->sc_ic.ic_ifp = ifp;
4201 	rtw_set80211props(&sc->sc_ic);
4202 
4203 	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4204 
4205 	/*
4206 	 * Call MI attach routines.
4207 	 */
4208 	if_attach(ifp);
4209 	ieee80211_ifattach(&sc->sc_ic);
4210 
4211 	rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
4212 
4213 	/* possibly we should fill in our own sc_send_prresp, since
4214 	 * the RTL8180 is probably sending probe responses in ad hoc
4215 	 * mode.
4216 	 */
4217 
4218 	/* complete initialization */
4219 	ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
4220 	callout_init(&sc->sc_scan_ch);
4221 
4222 	rtw_init_radiotap(sc);
4223 
4224 #if NBPFILTER > 0
4225 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
4226 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
4227 #endif
4228 
4229 	rtw_establish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname, (void*)sc);
4230 
4231 	NEXT_ATTACH_STATE(sc, FINISHED);
4232 
4233 	ieee80211_announce(ic);
4234 	return;
4235 err:
4236 	rtw_detach(sc);
4237 	return;
4238 }
4239 
4240 int
4241 rtw_detach(struct rtw_softc *sc)
4242 {
4243 	struct ifnet *ifp = &sc->sc_if;
4244 	int pri;
4245 
4246 	sc->sc_flags |= RTW_F_INVALID;
4247 
4248 	switch (sc->sc_attach_state) {
4249 	case FINISHED:
4250 		rtw_stop(ifp, 1);
4251 
4252 		rtw_disestablish_hooks(&sc->sc_hooks, sc->sc_dev.dv_xname,
4253 		    (void*)sc);
4254 		callout_stop(&sc->sc_scan_ch);
4255 		ieee80211_ifdetach(&sc->sc_ic);
4256 		if_detach(ifp);
4257 		break;
4258 	case FINISH_ID_STA:
4259 	case FINISH_RF_ATTACH:
4260 		rtw_rf_destroy(sc->sc_rf);
4261 		sc->sc_rf = NULL;
4262 		/*FALLTHROUGH*/
4263 	case FINISH_PARSE_SROM:
4264 	case FINISH_READ_SROM:
4265 		rtw_srom_free(&sc->sc_srom);
4266 		/*FALLTHROUGH*/
4267 	case FINISH_RESET:
4268 	case FINISH_RXMAPS_CREATE:
4269 		rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4270 		    RTW_RXQLEN);
4271 		/*FALLTHROUGH*/
4272 	case FINISH_TXMAPS_CREATE:
4273 		for (pri = 0; pri < RTW_NTXPRI; pri++) {
4274 			rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4275 			    sc->sc_txsoft_blk[pri].tsb_desc,
4276 			    sc->sc_txsoft_blk[pri].tsb_ndesc);
4277 		}
4278 		/*FALLTHROUGH*/
4279 	case FINISH_TXDESCBLK_SETUP:
4280 	case FINISH_TXCTLBLK_SETUP:
4281 		rtw_txsoft_blk_cleanup_all(sc);
4282 		/*FALLTHROUGH*/
4283 	case FINISH_DESCMAP_LOAD:
4284 		bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4285 		/*FALLTHROUGH*/
4286 	case FINISH_DESCMAP_CREATE:
4287 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4288 		/*FALLTHROUGH*/
4289 	case FINISH_DESC_MAP:
4290 		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_descs,
4291 		    sizeof(struct rtw_descs));
4292 		/*FALLTHROUGH*/
4293 	case FINISH_DESC_ALLOC:
4294 		bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4295 		    sc->sc_desc_nsegs);
4296 		/*FALLTHROUGH*/
4297 	case DETACHED:
4298 		NEXT_ATTACH_STATE(sc, DETACHED);
4299 		break;
4300 	}
4301 	return 0;
4302 }
4303 
4304 int
4305 rtw_activate(struct device *self, enum devact act)
4306 {
4307 	struct rtw_softc *sc = (struct rtw_softc *)self;
4308 	int rc = 0, s;
4309 
4310 	s = splnet();
4311 	switch (act) {
4312 	case DVACT_ACTIVATE:
4313 		rc = EOPNOTSUPP;
4314 		break;
4315 
4316 	case DVACT_DEACTIVATE:
4317 		if_deactivate(&sc->sc_if);
4318 		break;
4319 	}
4320 	splx(s);
4321 	return rc;
4322 }
4323