xref: /openbsd-src/sys/dev/ic/atw.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: atw.c,v 1.83 2014/07/12 18:48:17 tedu Exp $	*/
2 /*	$NetBSD: atw.c,v 1.69 2004/07/23 07:07:55 dyoung Exp $	*/
3 
4 /*-
5  * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
35  */
36 
37 #include "bpfilter.h"
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/mbuf.h>
42 #include <sys/malloc.h>
43 #include <sys/kernel.h>
44 #include <sys/socket.h>
45 #include <sys/ioctl.h>
46 #include <sys/errno.h>
47 #include <sys/device.h>
48 #include <sys/time.h>
49 
50 #include <machine/endian.h>
51 
52 #include <net/if.h>
53 #include <net/if_dl.h>
54 #include <net/if_media.h>
55 
56 #if NBPFILTER > 0
57 #include <net/bpf.h>
58 #endif
59 
60 #ifdef INET
61 #include <netinet/in.h>
62 #include <netinet/if_ether.h>
63 #endif
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_radiotap.h>
67 
68 #include <machine/bus.h>
69 #include <machine/intr.h>
70 
71 #include <dev/ic/atwreg.h>
72 #include <dev/ic/rf3000reg.h>
73 #include <dev/ic/si4136reg.h>
74 #include <dev/ic/atwvar.h>
75 #include <dev/ic/smc93cx6var.h>
76 
77 /* XXX TBD open questions
78  *
79  *
80  * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
81  * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
82  * handle this for me?
83  *
84  */
85 /* device attachment
86  *
87  *    print TOFS[012]
88  *
89  * device initialization
90  *
91  *    clear ATW_FRCTL_MAXPSP to disable max power saving
92  *    set ATW_TXBR_ALCUPDATE to enable ALC
93  *    set TOFS[012]? (hope not)
94  *    disable rx/tx
95  *    set ATW_PAR_SWR (software reset)
96  *    wait for ATW_PAR_SWR clear
97  *    disable interrupts
98  *    ack status register
99  *    enable interrupts
100  *
101  * rx/tx initialization
102  *
103  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
104  *    allocate and init descriptor rings
105  *    write ATW_PAR_DSL (descriptor skip length)
106  *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
107  *    write ATW_NAR_SQ for one/both transmit descriptor rings
108  *    write ATW_NAR_SQ for one/both transmit descriptor rings
109  *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
110  *
111  * rx/tx end
112  *
113  *    stop DMA
114  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
115  *    flush tx w/ ATW_NAR_HF
116  *
117  * scan
118  *
119  *    initialize rx/tx
120  *
121  * BSS join: (re)association response
122  *
123  *    set ATW_FRCTL_AID
124  *
125  * optimizations ???
126  *
127  */
128 
129 #define ATW_REFSLAVE	/* slavishly do what the reference driver does */
130 
131 int atw_bbp_io_enable_delay = 20 * 1000;
132 int atw_bbp_io_disable_delay = 2 * 1000;
133 int atw_writewep_delay = 1000;
134 int atw_beacon_len_adjust = 4;
135 int atw_dwelltime = 200;
136 int atw_xindiv2 = 0;
137 
138 #ifdef ATW_DEBUG
139 int atw_debug = 0;
140 
141 #define ATW_DPRINTF(x)	if (atw_debug > 0) printf x
142 #define ATW_DPRINTF2(x)	if (atw_debug > 1) printf x
143 #define ATW_DPRINTF3(x)	if (atw_debug > 2) printf x
144 #define	DPRINTF(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) printf x
145 #define	DPRINTF2(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
146 #define	DPRINTF3(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
147 void atw_print_regs(struct atw_softc *, const char *);
148 void atw_dump_pkt(struct ifnet *, struct mbuf *);
149 
150 /* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
151 #	ifdef ATW_BBPDEBUG
152 int atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
153 void atw_rf3000_print(struct atw_softc *);
154 #	endif /* ATW_BBPDEBUG */
155 
156 #	ifdef ATW_SYNDEBUG
157 int atw_si4126_read(struct atw_softc *, u_int, u_int *);
158 void atw_si4126_print(struct atw_softc *);
159 #	endif /* ATW_SYNDEBUG */
160 
161 #else
162 #define ATW_DPRINTF(x)
163 #define ATW_DPRINTF2(x)
164 #define ATW_DPRINTF3(x)
165 #define	DPRINTF(sc, x)	/* nothing */
166 #define	DPRINTF2(sc, x)	/* nothing */
167 #define	DPRINTF3(sc, x)	/* nothing */
168 #endif
169 
170 #ifdef ATW_STATS
171 void	atw_print_stats(struct atw_softc *);
172 #endif
173 
174 const char *atw_printmac(u_int8_t);
175 
176 /* ifnet methods */
177 void	atw_start(struct ifnet *);
178 void	atw_watchdog(struct ifnet *);
179 int	atw_ioctl(struct ifnet *, u_long, caddr_t);
180 int	atw_init(struct ifnet *);
181 void	atw_stop(struct ifnet *, int);
182 
183 /* Rx/Tx process */
184 void	atw_rxdrain(struct atw_softc *);
185 void	atw_txdrain(struct atw_softc *);
186 int	atw_add_rxbuf(struct atw_softc *, int);
187 void	atw_idle(struct atw_softc *, u_int32_t);
188 
189 /* Device (de)activation and power state */
190 void	atw_disable(struct atw_softc *);
191 void	atw_reset(struct atw_softc *);
192 
193 /* Interrupt handlers */
194 void	atw_rxintr(struct atw_softc *);
195 void	atw_txintr(struct atw_softc *);
196 void	atw_linkintr(struct atw_softc *, u_int32_t);
197 
198 /* 802.11 state machine */
199 int	atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
200 int	atw_tune(struct atw_softc *);
201 #ifndef IEEE80211_STA_ONLY
202 void	atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
203 	    struct ieee80211_node *, struct ieee80211_rxinfo *, int);
204 #endif
205 void	atw_next_scan(void *);
206 
207 /* Device initialization */
208 void	atw_wcsr_init(struct atw_softc *);
209 void	atw_cmdr_init(struct atw_softc *);
210 void	atw_tofs2_init(struct atw_softc *);
211 void	atw_txlmt_init(struct atw_softc *);
212 void	atw_test1_init(struct atw_softc *);
213 void	atw_rf_reset(struct atw_softc *);
214 void	atw_cfp_init(struct atw_softc *);
215 void	atw_tofs0_init(struct atw_softc *);
216 void	atw_ifs_init(struct atw_softc *);
217 void	atw_response_times_init(struct atw_softc *);
218 void	atw_bbp_io_init(struct atw_softc *);
219 void	atw_nar_init(struct atw_softc *);
220 
221 /* RAM/ROM utilities */
222 void	atw_clear_sram(struct atw_softc *);
223 void	atw_write_sram(struct atw_softc *, u_int, u_int8_t *, u_int);
224 int	atw_read_srom(struct atw_softc *);
225 
226 /* BSS setup */
227 void	atw_predict_beacon(struct atw_softc *sc);
228 void	atw_start_beacon(struct atw_softc *, int);
229 void	atw_write_bssid(struct atw_softc *);
230 void	atw_write_ssid(struct atw_softc *);
231 void	atw_write_sup_rates(struct atw_softc *);
232 void	atw_write_wep(struct atw_softc *);
233 
234 /* Media */
235 int	atw_media_change(struct ifnet *);
236 void	atw_media_status(struct ifnet *, struct ifmediareq *);
237 
238 void	atw_filter_setup(struct atw_softc *);
239 
240 /* 802.11 utilities */
241 struct	ieee80211_node *atw_node_alloc(struct ieee80211com *);
242 void	atw_node_free(struct ieee80211com *, struct ieee80211_node *);
243 static	__inline uint32_t atw_last_even_tsft(uint32_t, uint32_t, uint32_t);
244 uint64_t atw_get_tsft(struct atw_softc *sc);
245 void	atw_change_ibss(struct atw_softc *);
246 int	atw_compute_duration1(int, int, uint32_t, int, struct atw_duration *);
247 int	atw_compute_duration(struct ieee80211_frame *, int, uint32_t, int,
248 	    int, struct atw_duration *, struct atw_duration *, int *, int);
249 
250 /*
251  * Tuner/transceiver/modem
252  */
253 void	atw_bbp_io_enable(struct atw_softc *, int);
254 
255 /* RFMD RF3000 Baseband Processor */
256 int	atw_rf3000_init(struct atw_softc *);
257 int	atw_rf3000_tune(struct atw_softc *, u_int);
258 int	atw_rf3000_write(struct atw_softc *, u_int, u_int);
259 
260 /* Silicon Laboratories Si4126 RF/IF Synthesizer */
261 void	atw_si4126_tune(struct atw_softc *, u_int);
262 void	atw_si4126_write(struct atw_softc *, u_int, u_int);
263 void	atw_si4126_init(struct atw_softc *);
264 
265 const struct atw_txthresh_tab atw_txthresh_tab_lo[] = {
266 	{ ATW_NAR_TR_L64,	"64 bytes" },
267 	{ ATW_NAR_TR_L160,	"160 bytes" },
268 	{ ATW_NAR_TR_L192,	"192 bytes" },
269 	{ ATW_NAR_SF,		"store and forward" },
270 	{ 0,			NULL }
271 };
272 const struct atw_txthresh_tab atw_txthresh_tab_hi[] = {
273 	{ ATW_NAR_TR_H96,	"96 bytes" },
274 	{ ATW_NAR_TR_H288,	"288 bytes" },
275 	{ ATW_NAR_TR_H544,	"544 bytes" },
276 	{ ATW_NAR_SF,		"store and forward" },
277 	{ 0,			NULL }
278 };
279 
280 struct cfdriver atw_cd = {
281     NULL, "atw", DV_IFNET
282 };
283 
284 static const u_int atw_rfmd2958_ifn[] = {
285 	0x22bd, 0x22d2, 0x22e8, 0x22fe, 0x2314, 0x232a, 0x2340,
286 	0x2355, 0x236b, 0x2381, 0x2397, 0x23ad, 0x23c2, 0x23f7
287 };
288 
289 static const u_int atw_rfmd2958_rf1r[] = {
290 	0x05d17, 0x3a2e8, 0x2e8ba, 0x22e8b, 0x1745d, 0x0ba2e, 0x00000,
291 	0x345d1, 0x28ba2, 0x1d174, 0x11745, 0x05d17, 0x3a2e8, 0x11745
292 };
293 
294 
295 #ifdef ATW_DEBUG
296 
297 const char *atw_tx_state[] = {
298 	"STOPPED",
299 	"RUNNING - read descriptor",
300 	"RUNNING - transmitting",
301 	"RUNNING - filling fifo",	/* XXX */
302 	"SUSPENDED",
303 	"RUNNING -- write descriptor",
304 	"RUNNING -- write last descriptor",
305 	"RUNNING - fifo full"
306 };
307 
308 const char *atw_rx_state[] = {
309 	"STOPPED",
310 	"RUNNING - read descriptor",
311 	"RUNNING - check this packet, pre-fetch next",
312 	"RUNNING - wait for reception",
313 	"SUSPENDED",
314 	"RUNNING - write descriptor",
315 	"RUNNING - flush fifo",
316 	"RUNNING - fifo drain"
317 };
318 
319 #endif
320 
321 /*
322  * atw_enable:
323  *
324  *	Enable the ADM8211 chip.
325  */
326 int
327 atw_enable(struct atw_softc *sc)
328 {
329 
330 	if (ATW_IS_ENABLED(sc) == 0) {
331 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
332 			printf("%s: device enable failed\n",
333 			    sc->sc_dev.dv_xname);
334 			return (EIO);
335 		}
336 		sc->sc_flags |= ATWF_ENABLED;
337 	}
338 	return (0);
339 }
340 
341 /*
342  * atw_disable:
343  *
344  *	Disable the ADM8211 chip.
345  */
346 void
347 atw_disable(struct atw_softc *sc)
348 {
349 	if (!ATW_IS_ENABLED(sc))
350 		return;
351 	if (sc->sc_disable != NULL)
352 		(*sc->sc_disable)(sc);
353 	sc->sc_flags &= ~ATWF_ENABLED;
354 }
355 
356 /* Returns -1 on failure. */
357 int
358 atw_read_srom(struct atw_softc *sc)
359 {
360 	struct seeprom_descriptor sd;
361 	u_int32_t test0, fail_bits;
362 
363 	(void)memset(&sd, 0, sizeof(sd));
364 
365 	test0 = ATW_READ(sc, ATW_TEST0);
366 
367 	switch (sc->sc_rev) {
368 	case ATW_REVISION_BA:
369 	case ATW_REVISION_CA:
370 		fail_bits = ATW_TEST0_EPNE;
371 		break;
372 	default:
373 		fail_bits = ATW_TEST0_EPNE|ATW_TEST0_EPSNM;
374 		break;
375 	}
376 	if ((test0 & fail_bits) != 0) {
377 		printf("%s: bad or missing/bad SROM\n", sc->sc_dev.dv_xname);
378 		return -1;
379 	}
380 
381 	switch (test0 & ATW_TEST0_EPTYP_MASK) {
382 	case ATW_TEST0_EPTYP_93c66:
383 		ATW_DPRINTF(("%s: 93c66 SROM\n", sc->sc_dev.dv_xname));
384 		sc->sc_sromsz = 512;
385 		sd.sd_chip = C56_66;
386 		break;
387 	case ATW_TEST0_EPTYP_93c46:
388 		ATW_DPRINTF(("%s: 93c46 SROM\n", sc->sc_dev.dv_xname));
389 		sc->sc_sromsz = 128;
390 		sd.sd_chip = C46;
391 		break;
392 	default:
393 		printf("%s: unknown SROM type %d\n", sc->sc_dev.dv_xname,
394 		    MASK_AND_RSHIFT(test0, ATW_TEST0_EPTYP_MASK));
395 		return -1;
396 	}
397 
398 	sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_NOWAIT | M_ZERO);
399 	if (sc->sc_srom == NULL) {
400 		printf("%s: unable to allocate SROM buffer\n",
401 		    sc->sc_dev.dv_xname);
402 		return -1;
403 	}
404 
405 	/*
406 	 * ADM8211 has a single 32-bit register for controlling the
407 	 * 93cx6 SROM.  Bit SRS enables the serial port. There is no
408 	 * "ready" bit. The ADM8211 input/output sense is the reverse
409 	 * of read_seeprom's.
410 	 */
411 	sd.sd_tag = sc->sc_st;
412 	sd.sd_bsh = sc->sc_sh;
413 	sd.sd_regsize = 4;
414 	sd.sd_control_offset = ATW_SPR;
415 	sd.sd_status_offset = ATW_SPR;
416 	sd.sd_dataout_offset = ATW_SPR;
417 	sd.sd_CK = ATW_SPR_SCLK;
418 	sd.sd_CS = ATW_SPR_SCS;
419 	sd.sd_DI = ATW_SPR_SDO;
420 	sd.sd_DO = ATW_SPR_SDI;
421 	sd.sd_MS = ATW_SPR_SRS;
422 	sd.sd_RDY = 0;
423 
424 	if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
425 		printf("%s: could not read SROM\n", sc->sc_dev.dv_xname);
426 		free(sc->sc_srom, M_DEVBUF, 0);
427 		return -1;
428 	}
429 #ifdef ATW_DEBUG
430 	{
431 		int i;
432 		ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
433 		for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
434 			if (((i % 8) == 0) && (i != 0)) {
435 				ATW_DPRINTF(("\n\t"));
436 			}
437 			ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
438 		}
439 		ATW_DPRINTF(("\n"));
440 	}
441 #endif /* ATW_DEBUG */
442 	return 0;
443 }
444 
445 #ifdef ATW_DEBUG
446 void
447 atw_print_regs(struct atw_softc *sc, const char *where)
448 {
449 #define PRINTREG(sc, reg) \
450 	ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
451 	    sc->sc_dev.dv_xname, reg, ATW_READ(sc, reg)))
452 
453 	ATW_DPRINTF2(("%s: %s\n", sc->sc_dev.dv_xname, where));
454 
455 	PRINTREG(sc, ATW_PAR);
456 	PRINTREG(sc, ATW_FRCTL);
457 	PRINTREG(sc, ATW_TDR);
458 	PRINTREG(sc, ATW_WTDP);
459 	PRINTREG(sc, ATW_RDR);
460 	PRINTREG(sc, ATW_WRDP);
461 	PRINTREG(sc, ATW_RDB);
462 	PRINTREG(sc, ATW_CSR3A);
463 	PRINTREG(sc, ATW_TDBD);
464 	PRINTREG(sc, ATW_TDBP);
465 	PRINTREG(sc, ATW_STSR);
466 	PRINTREG(sc, ATW_CSR5A);
467 	PRINTREG(sc, ATW_NAR);
468 	PRINTREG(sc, ATW_CSR6A);
469 	PRINTREG(sc, ATW_IER);
470 	PRINTREG(sc, ATW_CSR7A);
471 	PRINTREG(sc, ATW_LPC);
472 	PRINTREG(sc, ATW_TEST1);
473 	PRINTREG(sc, ATW_SPR);
474 	PRINTREG(sc, ATW_TEST0);
475 	PRINTREG(sc, ATW_WCSR);
476 	PRINTREG(sc, ATW_WPDR);
477 	PRINTREG(sc, ATW_GPTMR);
478 	PRINTREG(sc, ATW_GPIO);
479 	PRINTREG(sc, ATW_BBPCTL);
480 	PRINTREG(sc, ATW_SYNCTL);
481 	PRINTREG(sc, ATW_PLCPHD);
482 	PRINTREG(sc, ATW_MMIWADDR);
483 	PRINTREG(sc, ATW_MMIRADDR1);
484 	PRINTREG(sc, ATW_MMIRADDR2);
485 	PRINTREG(sc, ATW_TXBR);
486 	PRINTREG(sc, ATW_CSR15A);
487 	PRINTREG(sc, ATW_ALCSTAT);
488 	PRINTREG(sc, ATW_TOFS2);
489 	PRINTREG(sc, ATW_CMDR);
490 	PRINTREG(sc, ATW_PCIC);
491 	PRINTREG(sc, ATW_PMCSR);
492 	PRINTREG(sc, ATW_PAR0);
493 	PRINTREG(sc, ATW_PAR1);
494 	PRINTREG(sc, ATW_MAR0);
495 	PRINTREG(sc, ATW_MAR1);
496 	PRINTREG(sc, ATW_ATIMDA0);
497 	PRINTREG(sc, ATW_ABDA1);
498 	PRINTREG(sc, ATW_BSSID0);
499 	PRINTREG(sc, ATW_TXLMT);
500 	PRINTREG(sc, ATW_MIBCNT);
501 	PRINTREG(sc, ATW_BCNT);
502 	PRINTREG(sc, ATW_TSFTH);
503 	PRINTREG(sc, ATW_TSC);
504 	PRINTREG(sc, ATW_SYNRF);
505 	PRINTREG(sc, ATW_BPLI);
506 	PRINTREG(sc, ATW_CAP0);
507 	PRINTREG(sc, ATW_CAP1);
508 	PRINTREG(sc, ATW_RMD);
509 	PRINTREG(sc, ATW_CFPP);
510 	PRINTREG(sc, ATW_TOFS0);
511 	PRINTREG(sc, ATW_TOFS1);
512 	PRINTREG(sc, ATW_IFST);
513 	PRINTREG(sc, ATW_RSPT);
514 	PRINTREG(sc, ATW_TSFTL);
515 	PRINTREG(sc, ATW_WEPCTL);
516 	PRINTREG(sc, ATW_WESK);
517 	PRINTREG(sc, ATW_WEPCNT);
518 	PRINTREG(sc, ATW_MACTEST);
519 	PRINTREG(sc, ATW_FER);
520 	PRINTREG(sc, ATW_FEMR);
521 	PRINTREG(sc, ATW_FPSR);
522 	PRINTREG(sc, ATW_FFER);
523 #undef PRINTREG
524 }
525 #endif /* ATW_DEBUG */
526 
527 const char*
528 atw_printmac(u_int8_t rev) {
529 	switch (rev) {
530 	case ATW_REVISION_AB:
531 		return "ADM8211AB";
532 	case ATW_REVISION_AF:
533 		return "ADM8211AF";
534 	case ATW_REVISION_BA:
535 		return "ADM8211BA";
536 	case ATW_REVISION_CA:
537 		return "ADM8211CA";
538 	default:
539 		return "unknown";
540 	}
541 }
542 
543 /*
544  * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
545  */
546 void
547 atw_attach(struct atw_softc *sc)
548 {
549 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
550 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
551 	};
552 	struct ieee80211com *ic = &sc->sc_ic;
553 	struct ifnet *ifp = &ic->ic_if;
554 	int country_code, error, i, srom_major;
555 	u_int32_t reg;
556 	static const char *type_strings[] = {"Intersil (not supported)",
557 	    "RFMD", "Marvel (not supported)"};
558 
559 	sc->sc_txth = atw_txthresh_tab_lo;
560 
561 	SIMPLEQ_INIT(&sc->sc_txfreeq);
562 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
563 
564 #ifdef ATW_DEBUG
565 	atw_print_regs(sc, "atw_attach");
566 #endif /* ATW_DEBUG */
567 
568 	/*
569 	 * Allocate the control data structures, and create and load the
570 	 * DMA map for it.
571 	 */
572 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
573 	    sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
574 	    1, &sc->sc_cdnseg, 0)) != 0) {
575 		printf("%s: unable to allocate control data, error = %d\n",
576 		    sc->sc_dev.dv_xname, error);
577 		goto fail_0;
578 	}
579 
580 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
581 	    sizeof(struct atw_control_data), (caddr_t *)&sc->sc_control_data,
582 	    BUS_DMA_COHERENT)) != 0) {
583 		printf("%s: unable to map control data, error = %d\n",
584 		    sc->sc_dev.dv_xname, error);
585 		goto fail_1;
586 	}
587 
588 	if ((error = bus_dmamap_create(sc->sc_dmat,
589 	    sizeof(struct atw_control_data), 1,
590 	    sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
591 		printf("%s: unable to create control data DMA map, "
592 		    "error = %d\n", sc->sc_dev.dv_xname, error);
593 		goto fail_2;
594 	}
595 
596 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
597 	    sc->sc_control_data, sizeof(struct atw_control_data), NULL,
598 	    0)) != 0) {
599 		printf("%s: unable to load control data DMA map, error = %d\n",
600 		    sc->sc_dev.dv_xname, error);
601 		goto fail_3;
602 	}
603 
604 	/*
605 	 * Create the transmit buffer DMA maps.
606 	 */
607 	sc->sc_ntxsegs = ATW_NTXSEGS;
608 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
609 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
610 		    sc->sc_ntxsegs, MCLBYTES, 0, 0,
611 		    &sc->sc_txsoft[i].txs_dmamap)) != 0) {
612 			printf("%s: unable to create tx DMA map %d, "
613 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
614 			goto fail_4;
615 		}
616 	}
617 
618 	/*
619 	 * Create the receive buffer DMA maps.
620 	 */
621 	for (i = 0; i < ATW_NRXDESC; i++) {
622 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
623 		    MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
624 			printf("%s: unable to create rx DMA map %d, "
625 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
626 			goto fail_5;
627 		}
628 	}
629 	for (i = 0; i < ATW_NRXDESC; i++) {
630 		sc->sc_rxsoft[i].rxs_mbuf = NULL;
631 	}
632 
633 	switch (sc->sc_rev) {
634 	case ATW_REVISION_AB:
635 	case ATW_REVISION_AF:
636 		sc->sc_sramlen = ATW_SRAM_A_SIZE;
637 		break;
638 	case ATW_REVISION_BA:
639 	case ATW_REVISION_CA:
640 		sc->sc_sramlen = ATW_SRAM_B_SIZE;
641 		break;
642 	}
643 
644 	/* Reset the chip to a known state. */
645 	atw_reset(sc);
646 
647 	if (atw_read_srom(sc) == -1)
648 		return;
649 
650 	sc->sc_rftype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
651 	    ATW_SR_RFTYPE_MASK);
652 
653 	sc->sc_bbptype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
654 	    ATW_SR_BBPTYPE_MASK);
655 
656 	if (sc->sc_rftype >= nitems(type_strings)) {
657 		printf("%s: unknown RF\n", sc->sc_dev.dv_xname);
658 		return;
659 	}
660 	if (sc->sc_bbptype >= nitems(type_strings)) {
661 		printf("%s: unknown BBP\n", sc->sc_dev.dv_xname);
662 		return;
663 	}
664 
665 	printf("%s: MAC %s, BBP %s, RF %s", sc->sc_dev.dv_xname,
666 	    atw_printmac(sc->sc_rev), type_strings[sc->sc_bbptype],
667 	    type_strings[sc->sc_rftype]);
668 
669 	/* XXX There exists a Linux driver which seems to use RFType = 0 for
670 	 * MARVEL. My bug, or theirs?
671 	 */
672 
673 	reg = LSHIFT(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
674 
675 	switch (sc->sc_rftype) {
676 	case ATW_RFTYPE_INTERSIL:
677 		reg |= ATW_SYNCTL_CS1;
678 		break;
679 	case ATW_RFTYPE_RFMD:
680 		reg |= ATW_SYNCTL_CS0;
681 		break;
682 	case ATW_RFTYPE_MARVEL:
683 		break;
684 	}
685 
686 	sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
687 	sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
688 
689 	reg = LSHIFT(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
690 
691 	switch (sc->sc_bbptype) {
692 	case ATW_BBPTYPE_INTERSIL:
693 		reg |= ATW_BBPCTL_TWI;
694 		break;
695 	case ATW_BBPTYPE_RFMD:
696 		reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
697 		    ATW_BBPCTL_CCA_ACTLO;
698 		break;
699 	case ATW_BBPTYPE_MARVEL:
700 		break;
701 	case ATW_C_BBPTYPE_RFMD:
702 		printf("%s: ADM8211C MAC/RFMD BBP not supported yet.\n",
703 		    sc->sc_dev.dv_xname);
704 		break;
705 	}
706 
707 	sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
708 	sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
709 
710 	/*
711 	 * From this point forward, the attachment cannot fail.  A failure
712 	 * before this point releases all resources that may have been
713 	 * allocated.
714 	 */
715 	sc->sc_flags |= ATWF_ATTACHED /* | ATWF_RTSCTS */;
716 
717 	ATW_DPRINTF((" SROM MAC %04x%04x%04x",
718 	    htole16(sc->sc_srom[ATW_SR_MAC00]),
719 	    htole16(sc->sc_srom[ATW_SR_MAC01]),
720 	    htole16(sc->sc_srom[ATW_SR_MAC10])));
721 
722 	srom_major = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
723 	    ATW_SR_MAJOR_MASK);
724 
725 	if (srom_major < 2)
726 		sc->sc_rf3000_options1 = 0;
727 	else if (sc->sc_rev == ATW_REVISION_BA) {
728 		sc->sc_rf3000_options1 =
729 		    MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CR28_CR03],
730 		    ATW_SR_CR28_MASK);
731 	} else
732 		sc->sc_rf3000_options1 = 0;
733 
734 	sc->sc_rf3000_options2 = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
735 	    ATW_SR_CR29_MASK);
736 
737 	country_code = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
738 	    ATW_SR_CTRY_MASK);
739 
740 #define ADD_CHANNEL(_ic, _chan) do {					\
741 	_ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;		\
742 	_ic->ic_channels[_chan].ic_freq =				\
743 	    ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
744 } while (0)
745 
746 	/* Find available channels */
747 	switch (country_code) {
748 	case COUNTRY_MMK2:	/* 1-14 */
749 		ADD_CHANNEL(ic, 14);
750 		/*FALLTHROUGH*/
751 	case COUNTRY_ETSI:	/* 1-13 */
752 		for (i = 1; i <= 13; i++)
753 			ADD_CHANNEL(ic, i);
754 		break;
755 	case COUNTRY_FCC:	/* 1-11 */
756 	case COUNTRY_IC:	/* 1-11 */
757 		for (i = 1; i <= 11; i++)
758 			ADD_CHANNEL(ic, i);
759 		break;
760 	case COUNTRY_MMK:	/* 14 */
761 		ADD_CHANNEL(ic, 14);
762 		break;
763 	case COUNTRY_FRANCE:	/* 10-13 */
764 		for (i = 10; i <= 13; i++)
765 			ADD_CHANNEL(ic, i);
766 		break;
767 	default:	/* assume channels 10-11 */
768 	case COUNTRY_SPAIN:	/* 10-11 */
769 		for (i = 10; i <= 11; i++)
770 			ADD_CHANNEL(ic, i);
771 		break;
772 	}
773 
774 	/* Read the MAC address. */
775 	reg = ATW_READ(sc, ATW_PAR0);
776 	ic->ic_myaddr[0] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB0_MASK);
777 	ic->ic_myaddr[1] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB1_MASK);
778 	ic->ic_myaddr[2] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB2_MASK);
779 	ic->ic_myaddr[3] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB3_MASK);
780 	reg = ATW_READ(sc, ATW_PAR1);
781 	ic->ic_myaddr[4] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB4_MASK);
782 	ic->ic_myaddr[5] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB5_MASK);
783 
784 	if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
785 		printf(" could not get mac address, attach failed\n");
786 		return;
787 	}
788 
789 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
790 
791 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
792 	ifp->if_softc = sc;
793 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
794 	    IFF_NOTRAILERS;
795 	ifp->if_ioctl = atw_ioctl;
796 	ifp->if_start = atw_start;
797 	ifp->if_watchdog = atw_watchdog;
798 	IFQ_SET_READY(&ifp->if_snd);
799 
800 	ic->ic_phytype = IEEE80211_T_DS;
801 	ic->ic_opmode = IEEE80211_M_STA;
802 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
803 #ifndef IEEE80211_STA_ONLY
804 	ic->ic_caps |= IEEE80211_C_IBSS;
805 #endif
806 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
807 
808 	/*
809 	 * Call MI attach routines.
810 	 */
811 
812 	if_attach(ifp);
813 	ieee80211_ifattach(ifp);
814 
815 	sc->sc_newstate = ic->ic_newstate;
816 	ic->ic_newstate = atw_newstate;
817 
818 #ifndef IEEE80211_STA_ONLY
819 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
820 	ic->ic_recv_mgmt = atw_recv_mgmt;
821 #endif
822 
823 	sc->sc_node_free = ic->ic_node_free;
824 	ic->ic_node_free = atw_node_free;
825 
826 	sc->sc_node_alloc = ic->ic_node_alloc;
827 	ic->ic_node_alloc = atw_node_alloc;
828 
829 	/* possibly we should fill in our own sc_send_prresp, since
830 	 * the ADM8211 is probably sending probe responses in ad hoc
831 	 * mode.
832 	 */
833 
834 	/* complete initialization */
835 	ieee80211_media_init(ifp, atw_media_change, atw_media_status);
836 	timeout_set(&sc->sc_scan_to, atw_next_scan, sc);
837 
838 #if NBPFILTER > 0
839 	bpfattach(&sc->sc_radiobpf, ifp, DLT_IEEE802_11_RADIO,
840 	    sizeof(struct ieee80211_frame) + 64);
841 #endif
842 
843 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
844 	sc->sc_rxtap.ar_ihdr.it_len = sizeof(sc->sc_rxtapu);
845 	sc->sc_rxtap.ar_ihdr.it_present = ATW_RX_RADIOTAP_PRESENT;
846 
847 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
848 	sc->sc_txtap.at_ihdr.it_len = sizeof(sc->sc_txtapu);
849 	sc->sc_txtap.at_ihdr.it_present = ATW_TX_RADIOTAP_PRESENT;
850 
851 	return;
852 
853 	/*
854 	 * Free any resources we've allocated during the failed attach
855 	 * attempt.  Do this in reverse order and fall through.
856 	 */
857  fail_5:
858 	for (i = 0; i < ATW_NRXDESC; i++) {
859 		if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
860 			continue;
861 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
862 	}
863  fail_4:
864 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
865 		if (sc->sc_txsoft[i].txs_dmamap == NULL)
866 			continue;
867 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
868 	}
869 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
870  fail_3:
871 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
872  fail_2:
873 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
874 	    sizeof(struct atw_control_data));
875  fail_1:
876 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
877  fail_0:
878 	return;
879 }
880 
881 struct ieee80211_node *
882 atw_node_alloc(struct ieee80211com *ic)
883 {
884 	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
885 	struct ieee80211_node *ni = (*sc->sc_node_alloc)(ic);
886 
887 	DPRINTF(sc, ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
888 	return ni;
889 }
890 
891 void
892 atw_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
893 {
894 	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
895 
896 	DPRINTF(sc, ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
897 	    ether_sprintf(ni->ni_bssid)));
898 	(*sc->sc_node_free)(ic, ni);
899 }
900 
901 
902 static void
903 atw_test1_reset(struct atw_softc *sc)
904 {
905 	switch (sc->sc_rev) {
906 	case ATW_REVISION_BA:
907 		if (1 /* XXX condition on transceiver type */) {
908 			ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
909 		}
910 		break;
911 	case ATW_REVISION_CA:
912 		ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
913 		break;
914 	default:
915 		break;
916 	}
917 }
918 
919 /*
920  * atw_reset:
921  *
922  *	Perform a soft reset on the ADM8211.
923  */
924 void
925 atw_reset(struct atw_softc *sc)
926 {
927 	int i;
928 	uint32_t lpc;
929 
930 	ATW_WRITE(sc, ATW_NAR, 0x0);
931 	DELAY(20 * 1000);
932 
933 	/* Reference driver has a cryptic remark indicating that this might
934 	 * power-on the chip.  I know that it turns off power-saving....
935 	 */
936 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
937 
938 	ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
939 
940 	for (i = 0; i < 50; i++) {
941 		if (ATW_READ(sc, ATW_PAR) == 0)
942 			break;
943 		DELAY(1000);
944 	}
945 
946 	/* ... and then pause 100ms longer for good measure. */
947 	DELAY(100 * 1000);
948 
949 	DPRINTF2(sc, ("%s: atw_reset %d iterations\n", sc->sc_dev.dv_xname, i));
950 
951 	if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
952 		printf("%s: reset failed to complete\n", sc->sc_dev.dv_xname);
953 
954 	atw_test1_reset(sc);
955 	/*
956 	 * Initialize the PCI Access Register.
957 	 */
958 	sc->sc_busmode = ATW_PAR_PBL_8DW;
959 
960 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
961 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
962 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
963 
964 	/* Turn off maximum power saving, etc.
965 	 *
966 	 * XXX Following example of reference driver, should I set
967 	 * an AID of 1?  It didn't seem to help....
968 	 */
969 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
970 
971 	DELAY(100 * 1000);
972 
973 	/* Recall EEPROM. */
974 	ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
975 
976 	DELAY(10 * 1000);
977 
978 	lpc = ATW_READ(sc, ATW_LPC);
979 
980 	DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
981 
982 	/* A reset seems to affect the SRAM contents, so put them into
983 	 * a known state.
984 	 */
985 	atw_clear_sram(sc);
986 
987 	memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
988 }
989 
990 void
991 atw_clear_sram(struct atw_softc *sc)
992 {
993 	memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
994 	/* XXX not for revision 0x20. */
995 	atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
996 }
997 
998 /* TBD atw_init
999  *
1000  * set MAC based on ic->ic_bss->myaddr
1001  * write WEP keys
1002  * set TX rate
1003  */
1004 
1005 /* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
1006  * without receiving a beacon with the preferred BSSID & SSID.
1007  * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
1008  */
1009 void
1010 atw_wcsr_init(struct atw_softc *sc)
1011 {
1012 	uint32_t wcsr;
1013 
1014 	wcsr = ATW_READ(sc, ATW_WCSR);
1015 	wcsr &= ~(ATW_WCSR_BLN_MASK|ATW_WCSR_LSOE|ATW_WCSR_MPRE|ATW_WCSR_LSOE);
1016 	wcsr |= LSHIFT(7, ATW_WCSR_BLN_MASK);
1017 	ATW_WRITE(sc, ATW_WCSR, wcsr);	/* XXX resets wake-up status bits */
1018 
1019 	DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
1020 	    sc->sc_dev.dv_xname, __func__, ATW_READ(sc, ATW_WCSR)));
1021 }
1022 
1023 /* Turn off power management.  Set Rx store-and-forward mode. */
1024 void
1025 atw_cmdr_init(struct atw_softc *sc)
1026 {
1027 	uint32_t cmdr;
1028 	cmdr = ATW_READ(sc, ATW_CMDR);
1029 	cmdr &= ~ATW_CMDR_APM;
1030 	cmdr |= ATW_CMDR_RTE;
1031 	cmdr &= ~ATW_CMDR_DRT_MASK;
1032 	cmdr |= ATW_CMDR_DRT_SF;
1033 
1034 	ATW_WRITE(sc, ATW_CMDR, cmdr);
1035 }
1036 
1037 void
1038 atw_tofs2_init(struct atw_softc *sc)
1039 {
1040 	uint32_t tofs2;
1041 	/* XXX this magic can probably be figured out from the RFMD docs */
1042 #ifndef ATW_REFSLAVE
1043 	tofs2 = LSHIFT(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1044 	      LSHIFT(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1045 	      LSHIFT(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1046 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1047 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1048 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1049 	      LSHIFT(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1050 	      LSHIFT(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1051 #else
1052 	/* XXX new magic from reference driver source */
1053 	tofs2 = LSHIFT(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1054 	      LSHIFT(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1055 	      LSHIFT(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1056 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1057 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1058 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1059 	      LSHIFT(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1060 	      LSHIFT(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1061 #endif
1062 	ATW_WRITE(sc, ATW_TOFS2, tofs2);
1063 }
1064 
1065 void
1066 atw_nar_init(struct atw_softc *sc)
1067 {
1068 	ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF|ATW_NAR_PB);
1069 }
1070 
1071 void
1072 atw_txlmt_init(struct atw_softc *sc)
1073 {
1074 	ATW_WRITE(sc, ATW_TXLMT, LSHIFT(512, ATW_TXLMT_MTMLT_MASK) |
1075 	                         LSHIFT(1, ATW_TXLMT_SRTYLIM_MASK));
1076 }
1077 
1078 void
1079 atw_test1_init(struct atw_softc *sc)
1080 {
1081 	uint32_t test1;
1082 
1083 	test1 = ATW_READ(sc, ATW_TEST1);
1084 	test1 &= ~(ATW_TEST1_DBGREAD_MASK|ATW_TEST1_CONTROL);
1085 	/* XXX magic 0x1 */
1086 	test1 |= LSHIFT(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
1087 	ATW_WRITE(sc, ATW_TEST1, test1);
1088 }
1089 
1090 void
1091 atw_rf_reset(struct atw_softc *sc)
1092 {
1093 	/* XXX this resets an Intersil RF front-end? */
1094 	/* TBD condition on Intersil RFType? */
1095 	ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
1096 	DELAY(10 * 1000);
1097 	ATW_WRITE(sc, ATW_SYNRF, 0);
1098 	DELAY(5 * 1000);
1099 }
1100 
1101 /* Set 16 TU max duration for the contention-free period (CFP). */
1102 void
1103 atw_cfp_init(struct atw_softc *sc)
1104 {
1105 	uint32_t cfpp;
1106 
1107 	cfpp = ATW_READ(sc, ATW_CFPP);
1108 	cfpp &= ~ATW_CFPP_CFPMD;
1109 	cfpp |= LSHIFT(16, ATW_CFPP_CFPMD);
1110 	ATW_WRITE(sc, ATW_CFPP, cfpp);
1111 }
1112 
1113 void
1114 atw_tofs0_init(struct atw_softc *sc)
1115 {
1116 	/* XXX I guess that the Cardbus clock is 22MHz?
1117 	 * I am assuming that the role of ATW_TOFS0_USCNT is
1118 	 * to divide the bus clock to get a 1MHz clock---the datasheet is not
1119 	 * very clear on this point. It says in the datasheet that it is
1120 	 * possible for the ADM8211 to accomodate bus speeds between 22MHz
1121 	 * and 33MHz; maybe this is the way? I see a binary-only driver write
1122 	 * these values. These values are also the power-on default.
1123 	 */
1124 	ATW_WRITE(sc, ATW_TOFS0,
1125 	    LSHIFT(22, ATW_TOFS0_USCNT_MASK) |
1126 	    ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
1127 }
1128 
1129 /* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
1130 void
1131 atw_ifs_init(struct atw_softc *sc)
1132 {
1133 	uint32_t ifst;
1134 	/* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
1135 	 * Go figure.
1136 	 */
1137 	ifst = LSHIFT(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
1138 	    LSHIFT(22 * 5 /* IEEE80211_DUR_DS_SIFS */ /* # of 22MHz cycles */,
1139 		   ATW_IFST_SIFS_MASK) |
1140 	    LSHIFT(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
1141 	    LSHIFT(0x64 /* IEEE80211_DUR_DS_EIFS */, ATW_IFST_EIFS_MASK);
1142 
1143 	ATW_WRITE(sc, ATW_IFST, ifst);
1144 }
1145 
1146 void
1147 atw_response_times_init(struct atw_softc *sc)
1148 {
1149 	/* XXX More magic. Relates to ACK timing?  The datasheet seems to
1150 	 * indicate that the MAC expects at least SIFS + MIRT microseconds
1151 	 * to pass after it transmits a frame that requires a response;
1152 	 * it waits at most SIFS + MART microseconds for the response.
1153 	 * Surely this is not the ACK timeout?
1154 	 */
1155 	ATW_WRITE(sc, ATW_RSPT, LSHIFT(0xffff, ATW_RSPT_MART_MASK) |
1156 	    LSHIFT(0xff, ATW_RSPT_MIRT_MASK));
1157 }
1158 
1159 /* Set up the MMI read/write addresses for the baseband. The Tx/Rx
1160  * engines read and write baseband registers after Rx and before
1161  * Tx, respectively.
1162  */
1163 void
1164 atw_bbp_io_init(struct atw_softc *sc)
1165 {
1166 	uint32_t mmiraddr2;
1167 
1168 	/* XXX The reference driver does this, but is it *really*
1169 	 * necessary?
1170 	 */
1171 	switch (sc->sc_rev) {
1172 	case ATW_REVISION_AB:
1173 	case ATW_REVISION_AF:
1174 		mmiraddr2 = 0x0;
1175 		break;
1176 	default:
1177 		mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
1178 		mmiraddr2 &=
1179 		    ~(ATW_MMIRADDR2_PROREXT|ATW_MMIRADDR2_PRORLEN_MASK);
1180 		break;
1181 	}
1182 
1183 	switch (sc->sc_bbptype) {
1184 	case ATW_BBPTYPE_INTERSIL:
1185 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
1186 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
1187 		mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
1188 		break;
1189 	case ATW_BBPTYPE_MARVEL:
1190 		/* TBD find out the Marvel settings. */
1191 		break;
1192 	case ATW_BBPTYPE_RFMD:
1193 	default:
1194 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
1195 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
1196 		mmiraddr2 |= ATW_MMIRADDR2_RFMD;
1197 		break;
1198 	}
1199 	ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
1200 
1201 	atw_si4126_init(sc);
1202 
1203 	ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
1204 }
1205 
1206 void
1207 atw_si4126_init(struct atw_softc *sc)
1208 {
1209 	switch (sc->sc_rftype) {
1210 	case ATW_RFTYPE_RFMD:
1211 		if (sc->sc_rev >= ATW_REVISION_BA) {
1212 			atw_si4126_write(sc, 0x1f, 0x00000);
1213 			atw_si4126_write(sc, 0x0c, 0x3001f);
1214 			atw_si4126_write(sc, SI4126_GAIN, 0x29c03);
1215 			atw_si4126_write(sc, SI4126_RF1N, 0x1ff6f);
1216 			atw_si4126_write(sc, SI4126_RF2N, 0x29403);
1217 			atw_si4126_write(sc, SI4126_RF2R, 0x1456f);
1218 			atw_si4126_write(sc, 0x09, 0x10050);
1219 			atw_si4126_write(sc, SI4126_IFR, 0x3fff8);
1220 		}
1221 		break;
1222 	default:
1223 		break;
1224 	}
1225 }
1226 
1227 /*
1228  * atw_init:		[ ifnet interface function ]
1229  *
1230  *	Initialize the interface.  Must be called at splnet().
1231  */
1232 int
1233 atw_init(struct ifnet *ifp)
1234 {
1235 	struct atw_softc *sc = ifp->if_softc;
1236 	struct ieee80211com *ic = &sc->sc_ic;
1237 	struct atw_txsoft *txs;
1238 	struct atw_rxsoft *rxs;
1239 	int i, error = 0;
1240 
1241 	if ((error = atw_enable(sc)) != 0)
1242 		goto out;
1243 
1244 	/*
1245 	 * Cancel any pending I/O. This also resets.
1246 	 */
1247 	atw_stop(ifp, 0);
1248 
1249 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1250 	DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
1251 	    __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
1252 	    ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
1253 
1254 	atw_wcsr_init(sc);
1255 
1256 	atw_cmdr_init(sc);
1257 
1258 	/* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
1259 	 *
1260 	 * XXX Set transmit power for ATIM, RTS, Beacon.
1261 	 */
1262 	ATW_WRITE(sc, ATW_PLCPHD, LSHIFT(10, ATW_PLCPHD_SIGNAL_MASK) |
1263 	    LSHIFT(0xb0, ATW_PLCPHD_SERVICE_MASK));
1264 
1265 	atw_tofs2_init(sc);
1266 
1267 	atw_nar_init(sc);
1268 
1269 	atw_txlmt_init(sc);
1270 
1271 	atw_test1_init(sc);
1272 
1273 	atw_rf_reset(sc);
1274 
1275 	atw_cfp_init(sc);
1276 
1277 	atw_tofs0_init(sc);
1278 
1279 	atw_ifs_init(sc);
1280 
1281 	/* XXX Fall asleep after one second of inactivity.
1282 	 * XXX A frame may only dribble in for 65536us.
1283 	 */
1284 	ATW_WRITE(sc, ATW_RMD,
1285 	    LSHIFT(1, ATW_RMD_PCNT) | LSHIFT(0xffff, ATW_RMD_RMRD_MASK));
1286 
1287 	atw_response_times_init(sc);
1288 
1289 	atw_bbp_io_init(sc);
1290 
1291 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1292 
1293 	if ((error = atw_rf3000_init(sc)) != 0)
1294 		goto out;
1295 
1296 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
1297 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
1298 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
1299 
1300 	/*
1301 	 * Initialize the transmit descriptor ring.
1302 	 */
1303 	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
1304 	for (i = 0; i < ATW_NTXDESC; i++) {
1305 		sc->sc_txdescs[i].at_ctl = 0;
1306 		/* no transmit chaining */
1307 		sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
1308 		sc->sc_txdescs[i].at_buf2 =
1309 		    htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
1310 	}
1311 	/* use ring mode */
1312 	sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
1313 	ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
1314 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1315 	sc->sc_txfree = ATW_NTXDESC;
1316 	sc->sc_txnext = 0;
1317 
1318 	/*
1319 	 * Initialize the transmit job descriptors.
1320 	 */
1321 	SIMPLEQ_INIT(&sc->sc_txfreeq);
1322 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
1323 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
1324 		txs = &sc->sc_txsoft[i];
1325 		txs->txs_mbuf = NULL;
1326 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
1327 	}
1328 
1329 	/*
1330 	 * Initialize the receive descriptor and receive job
1331 	 * descriptor rings.
1332 	 */
1333 	for (i = 0; i < ATW_NRXDESC; i++) {
1334 		rxs = &sc->sc_rxsoft[i];
1335 		if (rxs->rxs_mbuf == NULL) {
1336 			if ((error = atw_add_rxbuf(sc, i)) != 0) {
1337 				printf("%s: unable to allocate or map rx "
1338 				    "buffer %d, error = %d\n",
1339 				    sc->sc_dev.dv_xname, i, error);
1340 				/*
1341 				 * XXX Should attempt to run with fewer receive
1342 				 * XXX buffers instead of just failing.
1343 				 */
1344 				atw_rxdrain(sc);
1345 				goto out;
1346 			}
1347 		} else
1348 			ATW_INIT_RXDESC(sc, i);
1349 	}
1350 	sc->sc_rxptr = 0;
1351 
1352 	/*
1353 	 * Initialize the interrupt mask and enable interrupts.
1354 	 */
1355 	/* normal interrupts */
1356 	sc->sc_inten =  ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
1357 	    ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
1358 
1359 	/* abnormal interrupts */
1360 	sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
1361 	    ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
1362 	    ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1363 
1364 	sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
1365 	    ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1366 	sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
1367 	sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
1368 	    ATW_INTR_TRT;
1369 
1370 	sc->sc_linkint_mask &= sc->sc_inten;
1371 	sc->sc_rxint_mask &= sc->sc_inten;
1372 	sc->sc_txint_mask &= sc->sc_inten;
1373 
1374 	ATW_WRITE(sc, ATW_IER, sc->sc_inten);
1375 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1376 
1377 	DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
1378 	    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_IER), sc->sc_inten));
1379 
1380 	/*
1381 	 * Give the transmit and receive rings to the ADM8211.
1382 	 */
1383 	ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
1384 	ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
1385 
1386 	sc->sc_txthresh = 0;
1387 	sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
1388 	    sc->sc_txth[sc->sc_txthresh].txth_opmode;
1389 
1390 	/* common 802.11 configuration */
1391 	ic->ic_flags &= ~IEEE80211_F_IBSSON;
1392 	switch (ic->ic_opmode) {
1393 	case IEEE80211_M_STA:
1394 		break;
1395 #ifndef IEEE80211_STA_ONLY
1396 	case IEEE80211_M_AHDEMO: /* XXX */
1397 	case IEEE80211_M_IBSS:
1398 		ic->ic_flags |= IEEE80211_F_IBSSON;
1399 		/*FALLTHROUGH*/
1400 #endif
1401 	default: /* XXX */
1402 		break;
1403 	}
1404 
1405 #ifndef IEEE80211_STA_ONLY
1406 	switch (ic->ic_opmode) {
1407 	case IEEE80211_M_AHDEMO:
1408 		ic->ic_bss->ni_intval = ic->ic_lintval;
1409 		ic->ic_bss->ni_rssi = 0;
1410 		ic->ic_bss->ni_rstamp = 0;
1411 		break;
1412 	default:					/* XXX */
1413 		break;
1414 	}
1415 #endif
1416 	sc->sc_wepctl = 0;
1417 
1418 	atw_write_ssid(sc);
1419 	atw_write_sup_rates(sc);
1420 	if (ic->ic_caps & IEEE80211_C_WEP)
1421 		atw_write_wep(sc);
1422 
1423 	ic->ic_state = IEEE80211_S_INIT;
1424 
1425 	/*
1426 	 * Set the receive filter.  This will start the transmit and
1427 	 * receive processes.
1428 	 */
1429 	atw_filter_setup(sc);
1430 
1431 	/*
1432 	 * Start the receive process.
1433 	 */
1434 	ATW_WRITE(sc, ATW_RDR, 0x1);
1435 
1436 	/*
1437 	 * Note that the interface is now running.
1438 	 */
1439 	ifp->if_flags |= IFF_RUNNING;
1440 	ifp->if_flags &= ~IFF_OACTIVE;
1441 
1442 	/* send no beacons, yet. */
1443 	atw_start_beacon(sc, 0);
1444 
1445 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
1446 		error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1447 	else
1448 		error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1449  out:
1450 	if (error) {
1451 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1452 		ifp->if_timer = 0;
1453 		printf("%s: interface not running\n", sc->sc_dev.dv_xname);
1454 	}
1455 #ifdef ATW_DEBUG
1456 	atw_print_regs(sc, "end of init");
1457 #endif /* ATW_DEBUG */
1458 
1459 	return (error);
1460 }
1461 
1462 /* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
1463  *           0: MAC control of RF3000/Si4126.
1464  *
1465  * Applies power, or selects RF front-end? Sets reset condition.
1466  *
1467  * TBD support non-RFMD BBP, non-SiLabs synth.
1468  */
1469 void
1470 atw_bbp_io_enable(struct atw_softc *sc, int enable)
1471 {
1472 	if (enable) {
1473 		ATW_WRITE(sc, ATW_SYNRF,
1474 		    ATW_SYNRF_SELRF|ATW_SYNRF_PE1|ATW_SYNRF_PHYRST);
1475 		DELAY(atw_bbp_io_enable_delay);
1476 	} else {
1477 		ATW_WRITE(sc, ATW_SYNRF, 0);
1478 		DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
1479 	}
1480 }
1481 
1482 int
1483 atw_tune(struct atw_softc *sc)
1484 {
1485 	int rc;
1486 	u_int chan;
1487 	struct ieee80211com *ic = &sc->sc_ic;
1488 
1489 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1490 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1491 		return 0;
1492 
1493 	if (chan == sc->sc_cur_chan)
1494 		return 0;
1495 
1496 	DPRINTF(sc, ("%s: chan %d -> %d\n", sc->sc_dev.dv_xname,
1497 	    sc->sc_cur_chan, chan));
1498 
1499 	atw_idle(sc, ATW_NAR_SR|ATW_NAR_ST);
1500 
1501 	atw_si4126_tune(sc, chan);
1502 	if ((rc = atw_rf3000_tune(sc, chan)) != 0)
1503 		printf("%s: failed to tune channel %d\n", sc->sc_dev.dv_xname,
1504 		    chan);
1505 
1506 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
1507 	DELAY(20 * 1000);
1508 	ATW_WRITE(sc, ATW_RDR, 0x1);
1509 
1510 	if (rc == 0)
1511 		sc->sc_cur_chan = chan;
1512 
1513 	return rc;
1514 }
1515 
1516 #ifdef ATW_SYNDEBUG
1517 void
1518 atw_si4126_print(struct atw_softc *sc)
1519 {
1520 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1521 	u_int addr, val;
1522 
1523 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1524 		return;
1525 
1526 	for (addr = 0; addr <= 8; addr++) {
1527 		printf("%s: synth[%d] = ", sc->sc_dev.dv_xname, addr);
1528 		if (atw_si4126_read(sc, addr, &val) == 0) {
1529 			printf("<unknown> (quitting print-out)\n");
1530 			break;
1531 		}
1532 		printf("%05x\n", val);
1533 	}
1534 }
1535 #endif /* ATW_SYNDEBUG */
1536 
1537 /* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
1538  *
1539  * The RF/IF synthesizer produces two reference frequencies for
1540  * the RF2948B transceiver.  The first frequency the RF2948B requires
1541  * is two times the so-called "intermediate frequency" (IF). Since
1542  * a SAW filter on the radio fixes the IF at 374MHz, I program the
1543  * Si4126 to generate IF LO = 374MHz x 2 = 748MHz.  The second
1544  * frequency required by the transceiver is the radio frequency
1545  * (RF). This is a superheterodyne transceiver; for f(chan) the
1546  * center frequency of the channel we are tuning, RF = f(chan) -
1547  * IF.
1548  *
1549  * XXX I am told by SiLabs that the Si4126 will accept a broader range
1550  * of XIN than the 2-25MHz mentioned by the datasheet, even *without*
1551  * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
1552  * works, but I have still programmed for XINDIV2 = 1 to be safe.
1553  */
1554 void
1555 atw_si4126_tune(struct atw_softc *sc, u_int chan)
1556 {
1557 	u_int mhz;
1558 	u_int R;
1559 	u_int32_t gpio;
1560 	u_int16_t gain;
1561 
1562 #ifdef ATW_SYNDEBUG
1563 	atw_si4126_print(sc);
1564 #endif /* ATW_SYNDEBUG */
1565 
1566 	if (sc->sc_rev >= ATW_REVISION_BA) {
1567 		atw_si4126_write(sc, SI4126_MAIN, 0x04007);
1568 		atw_si4126_write(sc, SI4126_POWER, 0x00033);
1569 		atw_si4126_write(sc, SI4126_IFN,
1570 		    atw_rfmd2958_ifn[chan - 1]);
1571 		atw_si4126_write(sc, SI4126_RF1R,
1572 		    atw_rfmd2958_rf1r[chan - 1]);
1573 #ifdef NOTYET
1574 		/* set TX POWER? */
1575 		atw_si4126_write(sc, 0x0a,
1576 		    (sc->sc_srom[ATW_SR_CSR20] & mask) |
1577 		    power << 9);
1578 #endif
1579 		/* set TX GAIN */
1580 		atw_si4126_write(sc, 0x09, 0x00050 |
1581 		    sc->sc_srom[ATW_SR_TXPOWER(chan - 1)]);
1582 		/* wait 100us from power-up for RF, IF to settle */
1583 		DELAY(100);
1584 
1585 		return;
1586 	}
1587 
1588 	if (chan == 14)
1589 		mhz = 2484;
1590 	else
1591 		mhz = 2412 + 5 * (chan - 1);
1592 
1593 	/* Tune IF to 748MHz to suit the IF LO input of the
1594 	 * RF2494B, which is 2 x IF. No need to set an IF divider
1595          * because an IF in 526MHz - 952MHz is allowed.
1596 	 *
1597 	 * XIN is 44.000MHz, so divide it by two to get allowable
1598 	 * range of 2-25MHz. SiLabs tells me that this is not
1599 	 * strictly necessary.
1600 	 */
1601 
1602 	if (atw_xindiv2)
1603 		R = 44;
1604 	else
1605 		R = 88;
1606 
1607 	/* Power-up RF, IF synthesizers. */
1608 	atw_si4126_write(sc, SI4126_POWER,
1609 	    SI4126_POWER_PDIB|SI4126_POWER_PDRB);
1610 
1611 	/* set LPWR, too? */
1612 	atw_si4126_write(sc, SI4126_MAIN,
1613 	    (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
1614 
1615 	/* Set the phase-locked loop gain.  If RF2 N > 2047, then
1616 	 * set KP2 to 1.
1617 	 *
1618 	 * REFDIF This is different from the reference driver, which
1619 	 * always sets SI4126_GAIN to 0.
1620 	 */
1621 	gain = LSHIFT(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
1622 
1623 	atw_si4126_write(sc, SI4126_GAIN, gain);
1624 
1625 	/* XIN = 44MHz.
1626 	 *
1627 	 * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
1628 	 * R = 44 so that 1496/(2 * 44) * 44MHz = 748MHz.
1629 	 *
1630 	 * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
1631 	 * so that 1496/88 * 44MHz = 748MHz.
1632 	 */
1633 	atw_si4126_write(sc, SI4126_IFN, 1496);
1634 
1635 	atw_si4126_write(sc, SI4126_IFR, R);
1636 
1637 #ifndef ATW_REFSLAVE
1638 	/* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
1639 	 * then RF1 becomes the active RF synthesizer, even on the Si4126,
1640 	 * which has no RF1!
1641 	 */
1642 	atw_si4126_write(sc, SI4126_RF1R, R);
1643 
1644 	atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
1645 #endif
1646 
1647 	/* N/R * XIN = RF. XIN = 44MHz. We desire RF = mhz - IF,
1648 	 * where IF = 374MHz.  Let's divide XIN to 1MHz. So R = 44.
1649 	 * Now let's multiply it to mhz. So mhz - IF = N.
1650 	 */
1651 	atw_si4126_write(sc, SI4126_RF2R, R);
1652 
1653 	atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
1654 
1655 	/* wait 100us from power-up for RF, IF to settle */
1656 	DELAY(100);
1657 
1658 	gpio = ATW_READ(sc, ATW_GPIO);
1659 	gpio &= ~(ATW_GPIO_EN_MASK|ATW_GPIO_O_MASK|ATW_GPIO_I_MASK);
1660 	gpio |= LSHIFT(1, ATW_GPIO_EN_MASK);
1661 
1662 	if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
1663 		/* Set a Prism RF front-end to a special mode for channel 14?
1664 		 *
1665 		 * Apparently the SMC2635W needs this, although I don't think
1666 		 * it has a Prism RF.
1667 		 */
1668 		gpio |= LSHIFT(1, ATW_GPIO_O_MASK);
1669 	}
1670 	ATW_WRITE(sc, ATW_GPIO, gpio);
1671 
1672 #ifdef ATW_SYNDEBUG
1673 	atw_si4126_print(sc);
1674 #endif /* ATW_SYNDEBUG */
1675 }
1676 
1677 /* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
1678  * diversity.
1679  *
1680  * !!!
1681  * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
1682  * !!!
1683  */
1684 int
1685 atw_rf3000_init(struct atw_softc *sc)
1686 {
1687 	int rc = 0;
1688 
1689 	atw_bbp_io_enable(sc, 1);
1690 
1691 	/* CCA is acquisition sensitive */
1692 	rc = atw_rf3000_write(sc, RF3000_CCACTL,
1693 	    LSHIFT(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
1694 
1695 	if (rc != 0)
1696 		goto out;
1697 
1698 	/* enable diversity */
1699 	rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
1700 
1701 	if (rc != 0)
1702 		goto out;
1703 
1704 	/* sensible setting from a binary-only driver */
1705 	rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1706 	    LSHIFT(0x1d, RF3000_GAINCTL_TXVGC_MASK));
1707 
1708 	if (rc != 0)
1709 		goto out;
1710 
1711 	/* magic from a binary-only driver */
1712 	rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
1713 	    LSHIFT(0x38, RF3000_LOGAINCAL_CAL_MASK));
1714 
1715 	if (rc != 0)
1716 		goto out;
1717 
1718 	rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
1719 
1720 	if (rc != 0)
1721 		goto out;
1722 
1723 	/*
1724 	 * XXX Reference driver remarks that Abocom sets this to 50.
1725 	 * Meaning 0x50, I think....  50 = 0x32, which would set a bit
1726 	 * in the "reserved" area of register RF3000_OPTIONS1.
1727 	 */
1728 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
1729 
1730 	if (rc != 0)
1731 		goto out;
1732 
1733 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
1734 
1735 	if (rc != 0)
1736 		goto out;
1737 
1738 out:
1739 	atw_bbp_io_enable(sc, 0);
1740 	return rc;
1741 }
1742 
1743 #ifdef ATW_BBPDEBUG
1744 void
1745 atw_rf3000_print(struct atw_softc *sc)
1746 {
1747 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1748 	u_int addr, val;
1749 
1750 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1751 		return;
1752 
1753 	for (addr = 0x01; addr <= 0x15; addr++) {
1754 		printf("%s: bbp[%d] = \n", sc->sc_dev.dv_xname, addr);
1755 		if (atw_rf3000_read(sc, addr, &val) != 0) {
1756 			printf("<unknown> (quitting print-out)\n");
1757 			break;
1758 		}
1759 		printf("%08x\n", val);
1760 	}
1761 }
1762 #endif /* ATW_BBPDEBUG */
1763 
1764 /* Set the power settings on the BBP for channel `chan'. */
1765 int
1766 atw_rf3000_tune(struct atw_softc *sc, u_int chan)
1767 {
1768 	int rc = 0;
1769 	u_int32_t reg;
1770 	u_int16_t txpower, lpf_cutoff, lna_gs_thresh;
1771 
1772 	txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
1773 	lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
1774 	lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
1775 
1776 	/* odd channels: LSB, even channels: MSB */
1777 	if (chan % 2 == 1) {
1778 		txpower &= 0xFF;
1779 		lpf_cutoff &= 0xFF;
1780 		lna_gs_thresh &= 0xFF;
1781 	} else {
1782 		txpower >>= 8;
1783 		lpf_cutoff >>= 8;
1784 		lna_gs_thresh >>= 8;
1785 	}
1786 
1787 #ifdef ATW_BBPDEBUG
1788 	atw_rf3000_print(sc);
1789 #endif /* ATW_BBPDEBUG */
1790 
1791 	DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
1792 	    "lna_gs_thresh %02x\n",
1793 	    sc->sc_dev.dv_xname, chan, txpower, lpf_cutoff, lna_gs_thresh));
1794 
1795 	atw_bbp_io_enable(sc, 1);
1796 
1797 	if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1798 	    LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
1799 		goto out;
1800 
1801 	if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
1802 		goto out;
1803 
1804 	if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
1805 		goto out;
1806 
1807 	if ((rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0)) != 0)
1808 		goto out;
1809 
1810 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
1811 	if (rc != 0)
1812 		goto out;
1813 
1814 #ifdef ATW_BBPDEBUG
1815 	atw_rf3000_print(sc);
1816 #endif /* ATW_BBPDEBUG */
1817 
1818 out:
1819 	atw_bbp_io_enable(sc, 0);
1820 
1821 	/* set beacon, rts, atim transmit power */
1822 	reg = ATW_READ(sc, ATW_PLCPHD);
1823 	reg &= ~ATW_PLCPHD_SERVICE_MASK;
1824 	reg |= LSHIFT(LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK),
1825 	    ATW_PLCPHD_SERVICE_MASK);
1826 	ATW_WRITE(sc, ATW_PLCPHD, reg);
1827 	DELAY(2 * 1000);
1828 
1829 	return rc;
1830 }
1831 
1832 /* Write a register on the RF3000 baseband processor using the
1833  * registers provided by the ADM8211 for this purpose.
1834  *
1835  * Return 0 on success.
1836  */
1837 int
1838 atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
1839 {
1840 	u_int32_t reg;
1841 	int i;
1842 
1843 	reg = sc->sc_bbpctl_wr |
1844 	     LSHIFT(val & 0xff, ATW_BBPCTL_DATA_MASK) |
1845 	     LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1846 
1847 	for (i = 10; --i >= 0; ) {
1848 		ATW_WRITE(sc, ATW_BBPCTL, reg);
1849 		DELAY(2000);
1850 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
1851 			break;
1852 	}
1853 
1854 	if (i < 0) {
1855 		printf("%s: BBPCTL still busy\n", sc->sc_dev.dv_xname);
1856 		return ETIMEDOUT;
1857 	}
1858 	return 0;
1859 }
1860 
1861 /* Read a register on the RF3000 baseband processor using the registers
1862  * the ADM8211 provides for this purpose.
1863  *
1864  * The 7-bit register address is addr.  Record the 8-bit data in the register
1865  * in *val.
1866  *
1867  * Return 0 on success.
1868  *
1869  * XXX This does not seem to work. The ADM8211 must require more or
1870  * different magic to read the chip than to write it. Possibly some
1871  * of the magic I have derived from a binary-only driver concerns
1872  * the "chip address" (see the RF3000 manual).
1873  */
1874 #ifdef ATW_BBPDEBUG
1875 int
1876 atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
1877 {
1878 	u_int32_t reg;
1879 	int i;
1880 
1881 	for (i = 1000; --i >= 0; ) {
1882 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD|ATW_BBPCTL_WR) == 0)
1883 			break;
1884 		DELAY(100);
1885 	}
1886 
1887 	if (i < 0) {
1888 		printf("%s: start atw_rf3000_read, BBPCTL busy\n",
1889 		    sc->sc_dev.dv_xname);
1890 		return ETIMEDOUT;
1891 	}
1892 
1893 	reg = sc->sc_bbpctl_rd | LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1894 
1895 	ATW_WRITE(sc, ATW_BBPCTL, reg);
1896 
1897 	for (i = 1000; --i >= 0; ) {
1898 		DELAY(100);
1899 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
1900 			break;
1901 	}
1902 
1903 	ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
1904 
1905 	if (i < 0) {
1906 		printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
1907 		    sc->sc_dev.dv_xname, reg);
1908 		return ETIMEDOUT;
1909 	}
1910 	if (val != NULL)
1911 		*val = MASK_AND_RSHIFT(reg, ATW_BBPCTL_DATA_MASK);
1912 	return 0;
1913 }
1914 #endif /* ATW_BBPDEBUG */
1915 
1916 /* Write a register on the Si4126 RF/IF synthesizer using the registers
1917  * provided by the ADM8211 for that purpose.
1918  *
1919  * val is 18 bits of data, and val is the 4-bit address of the register.
1920  *
1921  * Return 0 on success.
1922  */
1923 void
1924 atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
1925 {
1926 	uint32_t bits, mask, reg;
1927 	int nbits;
1928 
1929 	if (sc->sc_rev >= ATW_REVISION_BA) {
1930 		nbits = 24;
1931 
1932 		val &= 0x3ffff;
1933 		addr &= 0x1f;
1934 		bits = val | (addr << 18);
1935 	} else {
1936 		nbits = 22;
1937 
1938 		KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1939 		KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
1940 
1941 		bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
1942 		    LSHIFT(addr, SI4126_TWI_ADDR_MASK);
1943 	}
1944 
1945 	reg = ATW_SYNRF_SELSYN;
1946 	/* reference driver: reset Si4126 serial bus to initial
1947 	 * conditions?
1948 	 */
1949 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1950 	ATW_WRITE(sc, ATW_SYNRF, reg);
1951 
1952 	for (mask = (1 << (nbits - 1)); mask != 0; mask >>= 1) {
1953 		if ((bits & mask) != 0)
1954 			reg |= ATW_SYNRF_SYNDATA;
1955 		else
1956 			reg &= ~ATW_SYNRF_SYNDATA;
1957 		ATW_WRITE(sc, ATW_SYNRF, reg);
1958 		ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
1959 		ATW_WRITE(sc, ATW_SYNRF, reg);
1960 	}
1961 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1962 	ATW_WRITE(sc, ATW_SYNRF, 0x0);
1963 }
1964 
1965 /* Read 18-bit data from the 4-bit address addr in Si4126
1966  * RF synthesizer and write the data to *val. Return 0 on success.
1967  *
1968  * XXX This does not seem to work. The ADM8211 must require more or
1969  * different magic to read the chip than to write it.
1970  */
1971 #ifdef ATW_SYNDEBUG
1972 int
1973 atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
1974 {
1975 	u_int32_t reg;
1976 	int i;
1977 
1978 	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1979 
1980 	for (i = 1000; --i >= 0; ) {
1981 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD|ATW_SYNCTL_WR) == 0)
1982 			break;
1983 		DELAY(100);
1984 	}
1985 
1986 	if (i < 0) {
1987 		printf("%s: start atw_si4126_read, SYNCTL busy\n",
1988 		    sc->sc_dev.dv_xname);
1989 		return ETIMEDOUT;
1990 	}
1991 
1992 	reg = sc->sc_synctl_rd | LSHIFT(addr, ATW_SYNCTL_DATA_MASK);
1993 
1994 	ATW_WRITE(sc, ATW_SYNCTL, reg);
1995 
1996 	for (i = 1000; --i >= 0; ) {
1997 		DELAY(100);
1998 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
1999 			break;
2000 	}
2001 
2002 	ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
2003 
2004 	if (i < 0) {
2005 		printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
2006 		    sc->sc_dev.dv_xname, reg);
2007 		return ETIMEDOUT;
2008 	}
2009 	if (val != NULL)
2010 		*val = MASK_AND_RSHIFT(ATW_READ(sc, ATW_SYNCTL),
2011 		                       ATW_SYNCTL_DATA_MASK);
2012 	return 0;
2013 }
2014 #endif /* ATW_SYNDEBUG */
2015 
2016 /* XXX is the endianness correct? test. */
2017 #define	atw_calchash(addr) \
2018 	(ether_crc32_le((addr), IEEE80211_ADDR_LEN) & 0x3f)
2019 
2020 /*
2021  * atw_filter_setup:
2022  *
2023  *	Set the ADM8211's receive filter.
2024  */
2025 void
2026 atw_filter_setup(struct atw_softc *sc)
2027 {
2028 	struct ieee80211com *ic = &sc->sc_ic;
2029 	struct arpcom *ac = &ic->ic_ac;
2030 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2031 	int hash;
2032 	u_int32_t hashes[2];
2033 	struct ether_multi *enm;
2034 	struct ether_multistep step;
2035 
2036 	/* According to comments in tlp_al981_filter_setup
2037 	 * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
2038 	 * multicast filter to be set while it is running.  Hopefully
2039 	 * the ADM8211 is not the same!
2040 	 */
2041 	if ((ifp->if_flags & IFF_RUNNING) != 0)
2042 		atw_idle(sc, ATW_NAR_SR);
2043 
2044 	sc->sc_opmode &= ~(ATW_NAR_PR|ATW_NAR_MM);
2045 
2046 	/* XXX in scan mode, do not filter packets.  Maybe this is
2047 	 * unnecessary.
2048 	 */
2049 	if (ic->ic_state == IEEE80211_S_SCAN ||
2050 	    (ifp->if_flags & IFF_PROMISC) != 0) {
2051 		sc->sc_opmode |= ATW_NAR_PR;
2052 		goto allmulti;
2053 	}
2054 
2055 	hashes[0] = hashes[1] = 0x0;
2056 
2057 	if (ac->ac_multirangecnt > 0)
2058 		goto allmulti;
2059 
2060 	/*
2061 	 * Program the 64-bit multicast hash filter.
2062 	 */
2063 	ETHER_FIRST_MULTI(step, ac, enm);
2064 	while (enm != NULL) {
2065 		hash = atw_calchash(enm->enm_addrlo);
2066 		hashes[hash >> 5] |= 1 << (hash & 0x1f);
2067 		ETHER_NEXT_MULTI(step, enm);
2068 		sc->sc_opmode |= ATW_NAR_MM;
2069 	}
2070 	ifp->if_flags &= ~IFF_ALLMULTI;
2071 	goto setit;
2072 
2073 allmulti:
2074 	sc->sc_opmode |= ATW_NAR_MM;
2075 	ifp->if_flags |= IFF_ALLMULTI;
2076 	hashes[0] = hashes[1] = 0xffffffff;
2077 
2078 setit:
2079 	ATW_WRITE(sc, ATW_MAR0, hashes[0]);
2080 	ATW_WRITE(sc, ATW_MAR1, hashes[1]);
2081 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2082 	DELAY(20 * 1000);
2083 	ATW_WRITE(sc, ATW_RDR, 0x1);
2084 
2085 	DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", sc->sc_dev.dv_xname,
2086 	    ATW_READ(sc, ATW_NAR), sc->sc_opmode));
2087 }
2088 
2089 /* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
2090  * a beacon's BSSID and SSID against the preferred BSSID and SSID
2091  * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
2092  * no beacon with the preferred BSSID and SSID in the number of
2093  * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
2094  */
2095 void
2096 atw_write_bssid(struct atw_softc *sc)
2097 {
2098 	struct ieee80211com *ic = &sc->sc_ic;
2099 	u_int8_t *bssid;
2100 
2101 	bssid = ic->ic_bss->ni_bssid;
2102 
2103 	ATW_WRITE(sc, ATW_BSSID0,
2104 	    LSHIFT(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
2105 	    LSHIFT(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
2106 	    LSHIFT(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
2107 	    LSHIFT(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
2108 
2109 	ATW_WRITE(sc, ATW_ABDA1,
2110 	    (ATW_READ(sc, ATW_ABDA1) &
2111 	    ~(ATW_ABDA1_BSSIDB4_MASK|ATW_ABDA1_BSSIDB5_MASK)) |
2112 	    LSHIFT(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
2113 	    LSHIFT(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
2114 
2115 	DPRINTF(sc, ("%s: BSSID %s -> ", sc->sc_dev.dv_xname,
2116 	    ether_sprintf(sc->sc_bssid)));
2117 	DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
2118 
2119 	memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
2120 }
2121 
2122 /* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
2123  * 16-bit word.
2124  */
2125 void
2126 atw_write_sram(struct atw_softc *sc, u_int ofs, u_int8_t *buf, u_int buflen)
2127 {
2128 	u_int i;
2129 	u_int8_t *ptr;
2130 
2131 	memcpy(&sc->sc_sram[ofs], buf, buflen);
2132 
2133 	KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
2134 
2135 	KASSERT(buflen + ofs <= sc->sc_sramlen);
2136 
2137 	ptr = &sc->sc_sram[ofs];
2138 
2139 	for (i = 0; i < buflen; i += 2) {
2140 		ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
2141 		    LSHIFT((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
2142 		DELAY(atw_writewep_delay);
2143 
2144 		ATW_WRITE(sc, ATW_WESK,
2145 		    LSHIFT((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
2146 		DELAY(atw_writewep_delay);
2147 	}
2148 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
2149 
2150 	if (sc->sc_if.if_flags & IFF_DEBUG) {
2151 		int n_octets = 0;
2152 		printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
2153 		    sc->sc_dev.dv_xname, buflen, ofs, sc->sc_wepctl);
2154 		for (i = 0; i < buflen; i++) {
2155 			printf(" %02x", ptr[i]);
2156 			if (++n_octets % 24 == 0)
2157 				printf("\n");
2158 		}
2159 		if (n_octets % 24 != 0)
2160 			printf("\n");
2161 	}
2162 }
2163 
2164 /* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
2165 void
2166 atw_write_wep(struct atw_softc *sc)
2167 {
2168 	struct ieee80211com *ic = &sc->sc_ic;
2169 #if 0
2170 	u_int32_t reg;
2171 	int i;
2172 #endif
2173 	/* SRAM shared-key record format: key0 flags key1 ... key12 */
2174 	u_int8_t buf[IEEE80211_WEP_NKID]
2175 	            [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
2176 
2177 	sc->sc_wepctl = 0;
2178 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
2179 
2180 	if ((ic->ic_flags & IEEE80211_F_WEPON) == 0)
2181 		return;
2182 
2183 	memset(&buf[0][0], 0, sizeof(buf));
2184 
2185 #if 0
2186 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2187 		if (ic->ic_nw_keys[i].k_len > 5) {
2188 			buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
2189 		} else if (ic->ic_nw_keys[i].k_len != 0) {
2190 			buf[i][1] = ATW_WEP_ENABLED;
2191 		} else {
2192 			buf[i][1] = 0;
2193 			continue;
2194 		}
2195 		buf[i][0] = ic->ic_nw_keys[i].k_key[0];
2196 		memcpy(&buf[i][2], &ic->ic_nw_keys[i].k_key[1],
2197 		    ic->ic_nw_keys[i].k_len - 1);
2198 	}
2199 
2200 	reg = ATW_READ(sc, ATW_MACTEST);
2201 	reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
2202 	reg &= ~ATW_MACTEST_KEYID_MASK;
2203 	reg |= LSHIFT(ic->ic_wep_txkey, ATW_MACTEST_KEYID_MASK);
2204 	ATW_WRITE(sc, ATW_MACTEST, reg);
2205 
2206 	sc->sc_wepctl = ATW_WEPCTL_WEPENABLE;
2207 
2208 	switch (sc->sc_rev) {
2209 	case ATW_REVISION_AB:
2210 	case ATW_REVISION_AF:
2211 		/* Bypass WEP on Rx. */
2212 		sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
2213 		break;
2214 	default:
2215 		break;
2216 	}
2217 #endif
2218 
2219 	atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (u_int8_t*)&buf[0][0],
2220 	    sizeof(buf));
2221 }
2222 
2223 void
2224 atw_change_ibss(struct atw_softc *sc)
2225 {
2226 	atw_predict_beacon(sc);
2227 	atw_write_bssid(sc);
2228 	atw_start_beacon(sc, 1);
2229 }
2230 
2231 #ifndef IEEE80211_STA_ONLY
2232 void
2233 atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
2234     struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, int subtype)
2235 {
2236 	struct atw_softc *sc = (struct atw_softc*)ic->ic_softc;
2237 
2238 	/* The ADM8211A answers probe requests. */
2239 	if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_REQ &&
2240 	    sc->sc_rev < ATW_REVISION_BA)
2241 		return;
2242 
2243 	(*sc->sc_recv_mgmt)(ic, m, ni, rxi, subtype);
2244 
2245 	switch (subtype) {
2246 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2247 	case IEEE80211_FC0_SUBTYPE_BEACON:
2248 		if (ic->ic_opmode != IEEE80211_M_IBSS ||
2249 		    ic->ic_state != IEEE80211_S_RUN)
2250 			break;
2251 		if (ieee80211_ibss_merge(ic, ni, atw_get_tsft(sc)) == ENETRESET)
2252 			atw_change_ibss(sc);
2253 		break;
2254 	default:
2255 		break;
2256 	}
2257 	return;
2258 }
2259 #endif
2260 
2261 /* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
2262  * In ad hoc mode, the SSID is written to the beacons sent by the
2263  * ADM8211. In both ad hoc and infrastructure mode, beacons received
2264  * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
2265  * indications.
2266  */
2267 void
2268 atw_write_ssid(struct atw_softc *sc)
2269 {
2270 	struct ieee80211com *ic = &sc->sc_ic;
2271 	/* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
2272 	 * it only expects the element length, not its ID.
2273 	 */
2274 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
2275 
2276 	memset(buf, 0, sizeof(buf));
2277 	buf[0] = ic->ic_bss->ni_esslen;
2278 	memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
2279 
2280 	atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
2281 	    roundup(1 + ic->ic_bss->ni_esslen, 2));
2282 }
2283 
2284 /* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
2285  * In ad hoc mode, the supported rates are written to beacons sent by the
2286  * ADM8211.
2287  */
2288 void
2289 atw_write_sup_rates(struct atw_softc *sc)
2290 {
2291 	struct ieee80211com *ic = &sc->sc_ic;
2292 	/*
2293 	 * There is not enough space in the ADM8211 SRAM for the
2294 	 * full IEEE80211_RATE_MAXSIZE
2295 	 */
2296 	u_int8_t buf[12];
2297 	u_int8_t nrates;
2298 
2299 	memset(buf, 0, sizeof(buf));
2300 	if (ic->ic_bss->ni_rates.rs_nrates > sizeof(buf) - 1)
2301 		nrates = sizeof(buf) - 1;
2302 	else
2303 		nrates = ic->ic_bss->ni_rates.rs_nrates;
2304 	buf[0] = nrates;
2305 	memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates, nrates);
2306 
2307 	/* XXX deal with rev BA bug linux driver talks of? */
2308 
2309 	atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
2310 }
2311 
2312 /* Start/stop sending beacons. */
2313 void
2314 atw_start_beacon(struct atw_softc *sc, int start)
2315 {
2316 	struct ieee80211com *ic = &sc->sc_ic;
2317 #ifndef IEEE80211_STA_ONLY
2318 	uint16_t chan;
2319 	uint32_t bpli;
2320 #endif
2321 	uint32_t bcnt, cap0, cap1, capinfo;
2322 	size_t len;
2323 
2324 	if (ATW_IS_ENABLED(sc) == 0)
2325 		return;
2326 
2327 	/* start beacons */
2328 	len = sizeof(struct ieee80211_frame) +
2329 	    8 /* timestamp */ + 2 /* beacon interval */ +
2330 	    2 /* capability info */ +
2331 	    2 + ic->ic_bss->ni_esslen /* SSID element */ +
2332 	    2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
2333 	    3 /* DS parameters */ +
2334 	    IEEE80211_CRC_LEN;
2335 
2336 	bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
2337 	cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
2338 	cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
2339 
2340 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2341 	ATW_WRITE(sc, ATW_CAP1, cap1);
2342 
2343 	if (!start)
2344 		return;
2345 
2346 	/* TBD use ni_capinfo */
2347 
2348 	capinfo = 0;
2349 	if (sc->sc_flags & ATWF_SHORT_PREAMBLE)
2350 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2351 	if (ic->ic_flags & IEEE80211_F_WEPON)
2352 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2353 
2354 #ifndef IEEE80211_STA_ONLY
2355 	switch (ic->ic_opmode) {
2356 	case IEEE80211_M_IBSS:
2357 		len += 4; /* IBSS parameters */
2358 		capinfo |= IEEE80211_CAPINFO_IBSS;
2359 		break;
2360 	default:
2361 		return;
2362 	}
2363 
2364 	/* set listen interval
2365 	 * XXX do software units agree w/ hardware?
2366 	 */
2367 	bpli = LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2368 	    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
2369 
2370 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
2371 
2372 	bcnt |= LSHIFT(len, ATW_BCNT_BCNT_MASK);
2373 	cap0 |= LSHIFT(chan, ATW_CAP0_CHN_MASK);
2374 	cap1 |= LSHIFT(capinfo, ATW_CAP1_CAPI_MASK);
2375 
2376 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2377 	ATW_WRITE(sc, ATW_BPLI, bpli);
2378 	ATW_WRITE(sc, ATW_CAP0, cap0);
2379 	ATW_WRITE(sc, ATW_CAP1, cap1);
2380 
2381 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
2382 	    sc->sc_dev.dv_xname, bcnt));
2383 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
2384 	    sc->sc_dev.dv_xname, cap1));
2385 #endif
2386 }
2387 
2388 /* Return the 32 lsb of the last TSFT divisible by ival. */
2389 static __inline uint32_t
2390 atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
2391 {
2392 	/* Following the reference driver's lead, I compute
2393 	 *
2394 	 *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
2395 	 *
2396 	 * without using 64-bit arithmetic, using the following
2397 	 * relationship:
2398 	 *
2399 	 *     (0x100000000 * H + L) % m
2400 	 *   = ((0x100000000 % m) * H + L) % m
2401 	 *   = (((0xffffffff + 1) % m) * H + L) % m
2402 	 *   = ((0xffffffff % m + 1 % m) * H + L) % m
2403 	 *   = ((0xffffffff % m + 1) * H + L) % m
2404 	 */
2405 	return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
2406 }
2407 
2408 uint64_t
2409 atw_get_tsft(struct atw_softc *sc)
2410 {
2411 	int i;
2412 	uint32_t tsfth, tsftl;
2413 	for (i = 0; i < 2; i++) {
2414 		tsfth = ATW_READ(sc, ATW_TSFTH);
2415 		tsftl = ATW_READ(sc, ATW_TSFTL);
2416 		if (ATW_READ(sc, ATW_TSFTH) == tsfth)
2417 			break;
2418 	}
2419 	return ((uint64_t)tsfth << 32) | tsftl;
2420 }
2421 
2422 /* If we've created an IBSS, write the TSF time in the ADM8211 to
2423  * the ieee80211com.
2424  *
2425  * Predict the next target beacon transmission time (TBTT) and
2426  * write it to the ADM8211.
2427  */
2428 void
2429 atw_predict_beacon(struct atw_softc *sc)
2430 {
2431 #define TBTTOFS 20 /* TU */
2432 
2433 	struct ieee80211com *ic = &sc->sc_ic;
2434 	uint64_t tsft;
2435 	uint32_t ival, past_even, tbtt, tsfth, tsftl;
2436 	union {
2437 		uint64_t	word;
2438 		uint8_t		tstamp[8];
2439 	} u;
2440 
2441 #ifndef IEEE80211_STA_ONLY
2442 	if ((ic->ic_opmode == IEEE80211_M_IBSS) &&
2443 	    (ic->ic_flags & IEEE80211_F_SIBSS)) {
2444 		tsft = atw_get_tsft(sc);
2445 		u.word = htole64(tsft);
2446 		(void)memcpy(&ic->ic_bss->ni_tstamp[0], &u.tstamp[0],
2447 		    sizeof(ic->ic_bss->ni_tstamp));
2448 	} else
2449 #endif
2450 	{
2451 		(void)memcpy(&u, &ic->ic_bss->ni_tstamp[0], sizeof(u));
2452 		tsft = letoh64(u.word);
2453 	}
2454 
2455 	ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
2456 
2457 	tsftl = tsft & 0xFFFFFFFF;
2458 	tsfth = tsft >> 32;
2459 
2460 	/* We sent/received the last beacon `past' microseconds
2461 	 * after the interval divided the TSF timer.
2462 	 */
2463 	past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
2464 
2465 	/* Skip ten beacons so that the TBTT cannot pass before
2466 	 * we've programmed it.  Ten is an arbitrary number.
2467 	 */
2468 	tbtt = past_even + ival * 10;
2469 
2470 	ATW_WRITE(sc, ATW_TOFS1,
2471 	    LSHIFT(1, ATW_TOFS1_TSFTOFSR_MASK) |
2472 	    LSHIFT(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
2473 	    LSHIFT(MASK_AND_RSHIFT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
2474 	        ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
2475 #undef TBTTOFS
2476 }
2477 
2478 void
2479 atw_next_scan(void *arg)
2480 {
2481 	struct atw_softc *sc = arg;
2482 	struct ieee80211com *ic = &sc->sc_ic;
2483 	struct ifnet *ifp = &ic->ic_if;
2484 	int s;
2485 
2486 	/* don't call atw_start w/o network interrupts blocked */
2487 	s = splnet();
2488 	if (ic->ic_state == IEEE80211_S_SCAN)
2489 		ieee80211_next_scan(ifp);
2490 	splx(s);
2491 }
2492 
2493 /* Synchronize the hardware state with the software state. */
2494 int
2495 atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2496 {
2497 	struct ifnet *ifp = &ic->ic_if;
2498 	struct atw_softc *sc = ifp->if_softc;
2499 	enum ieee80211_state ostate = ic->ic_state;
2500 	int error;
2501 
2502 	if (nstate == IEEE80211_S_INIT) {
2503 		timeout_del(&sc->sc_scan_to);
2504 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
2505 		atw_start_beacon(sc, 0);
2506 		return (*sc->sc_newstate)(ic, nstate, arg);
2507 	}
2508 
2509 	if ((error = atw_tune(sc)) != 0)
2510 		return error;
2511 
2512 	switch (nstate) {
2513 	case IEEE80211_S_ASSOC:
2514 		break;
2515 	case IEEE80211_S_INIT:
2516 		panic("%s: unexpected state IEEE80211_S_INIT", __func__);
2517 		break;
2518 	case IEEE80211_S_SCAN:
2519 		timeout_add_msec(&sc->sc_scan_to, atw_dwelltime);
2520 		break;
2521 	case IEEE80211_S_RUN:
2522 		if (ic->ic_opmode == IEEE80211_M_STA)
2523 			break;
2524 		/*FALLTHROUGH*/
2525 	case IEEE80211_S_AUTH:
2526 		atw_write_bssid(sc);
2527 		atw_write_ssid(sc);
2528 		atw_write_sup_rates(sc);
2529 
2530 		if (
2531 #ifndef IEEE80211_STA_ONLY
2532 		    ic->ic_opmode == IEEE80211_M_AHDEMO ||
2533 #endif
2534 		    ic->ic_opmode == IEEE80211_M_MONITOR)
2535 			break;
2536 
2537 		/* set listen interval
2538 		 * XXX do software units agree w/ hardware?
2539 		 */
2540 		ATW_WRITE(sc, ATW_BPLI,
2541 		    LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2542 		    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval,
2543 			   ATW_BPLI_LI_MASK));
2544 
2545 		DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n",
2546 		    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_BPLI)));
2547 
2548 		atw_predict_beacon(sc);
2549 		break;
2550 	}
2551 
2552 	if (nstate != IEEE80211_S_SCAN)
2553 		timeout_del(&sc->sc_scan_to);
2554 
2555 #ifndef IEEE80211_STA_ONLY
2556 	if (nstate == IEEE80211_S_RUN &&
2557 	    ic->ic_opmode == IEEE80211_M_IBSS)
2558 		atw_start_beacon(sc, 1);
2559 	else
2560 #endif
2561 		atw_start_beacon(sc, 0);
2562 
2563 	error = (*sc->sc_newstate)(ic, nstate, arg);
2564 
2565 	if (ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_SCAN)
2566 		atw_write_bssid(sc);
2567 
2568 	return error;
2569 }
2570 
2571 /*
2572  * atw_add_rxbuf:
2573  *
2574  *	Add a receive buffer to the indicated descriptor.
2575  */
2576 int
2577 atw_add_rxbuf(struct atw_softc *sc, int idx)
2578 {
2579 	struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
2580 	struct mbuf *m;
2581 	int error;
2582 
2583 	MGETHDR(m, M_DONTWAIT, MT_DATA);
2584 	if (m == NULL)
2585 		return (ENOBUFS);
2586 
2587 	MCLGET(m, M_DONTWAIT);
2588 	if ((m->m_flags & M_EXT) == 0) {
2589 		m_freem(m);
2590 		return (ENOBUFS);
2591 	}
2592 
2593 	if (rxs->rxs_mbuf != NULL)
2594 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2595 
2596 	rxs->rxs_mbuf = m;
2597 
2598 	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
2599 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
2600 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
2601 	if (error) {
2602 		printf("%s: can't load rx DMA map %d, error = %d\n",
2603 		    sc->sc_dev.dv_xname, idx, error);
2604 		panic("atw_add_rxbuf");	/* XXX */
2605 	}
2606 
2607 	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
2608 	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
2609 
2610 	ATW_INIT_RXDESC(sc, idx);
2611 
2612 	return (0);
2613 }
2614 
2615 /*
2616  * Release any queued transmit buffers.
2617  */
2618 void
2619 atw_txdrain(struct atw_softc *sc)
2620 {
2621 	struct atw_txsoft *txs;
2622 
2623 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
2624 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
2625 		if (txs->txs_mbuf != NULL) {
2626 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2627 			m_freem(txs->txs_mbuf);
2628 			txs->txs_mbuf = NULL;
2629 		}
2630 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
2631 	}
2632 	sc->sc_tx_timer = 0;
2633 }
2634 
2635 /*
2636  * atw_stop:		[ ifnet interface function ]
2637  *
2638  *	Stop transmission on the interface.
2639  */
2640 void
2641 atw_stop(struct ifnet *ifp, int disable)
2642 {
2643 	struct atw_softc *sc = ifp->if_softc;
2644 	struct ieee80211com *ic = &sc->sc_ic;
2645 
2646 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2647 
2648 	/*
2649 	 * Mark the interface down and cancel the watchdog timer.
2650 	*/
2651 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2652 	ifp->if_timer = 0;
2653 
2654 	/* Disable interrupts. */
2655 	ATW_WRITE(sc, ATW_IER, 0);
2656 
2657 	/* Stop the transmit and receive processes. */
2658 	sc->sc_opmode = 0;
2659 	ATW_WRITE(sc, ATW_NAR, 0);
2660 	DELAY(20 * 1000);
2661 	ATW_WRITE(sc, ATW_TDBD, 0);
2662 	ATW_WRITE(sc, ATW_TDBP, 0);
2663 	ATW_WRITE(sc, ATW_RDB, 0);
2664 
2665 	atw_txdrain(sc);
2666 
2667 	if (disable) {
2668 		atw_rxdrain(sc);
2669 		atw_disable(sc);
2670 	}
2671 
2672 	if (!disable)
2673 		atw_reset(sc);
2674 }
2675 
2676 /*
2677  * atw_rxdrain:
2678  *
2679  *	Drain the receive queue.
2680  */
2681 void
2682 atw_rxdrain(struct atw_softc *sc)
2683 {
2684 	struct atw_rxsoft *rxs;
2685 	int i;
2686 
2687 	for (i = 0; i < ATW_NRXDESC; i++) {
2688 		rxs = &sc->sc_rxsoft[i];
2689 		if (rxs->rxs_mbuf == NULL)
2690 			continue;
2691 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2692 		m_freem(rxs->rxs_mbuf);
2693 		rxs->rxs_mbuf = NULL;
2694 	}
2695 }
2696 
2697 /*
2698  * atw_detach:
2699  *
2700  *	Detach an ADM8211 interface.
2701  */
2702 int
2703 atw_detach(struct atw_softc *sc)
2704 {
2705 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2706 	struct atw_rxsoft *rxs;
2707 	struct atw_txsoft *txs;
2708 	int i;
2709 
2710 	/*
2711 	 * Succeed now if there isn't any work to do.
2712 	 */
2713 	if ((sc->sc_flags & ATWF_ATTACHED) == 0)
2714 		return (0);
2715 
2716 	timeout_del(&sc->sc_scan_to);
2717 
2718 	ieee80211_ifdetach(ifp);
2719 	if_detach(ifp);
2720 
2721 	for (i = 0; i < ATW_NRXDESC; i++) {
2722 		rxs = &sc->sc_rxsoft[i];
2723 		if (rxs->rxs_mbuf != NULL) {
2724 			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2725 			m_freem(rxs->rxs_mbuf);
2726 			rxs->rxs_mbuf = NULL;
2727 		}
2728 		bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
2729 	}
2730 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
2731 		txs = &sc->sc_txsoft[i];
2732 		if (txs->txs_mbuf != NULL) {
2733 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2734 			m_freem(txs->txs_mbuf);
2735 			txs->txs_mbuf = NULL;
2736 		}
2737 		bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
2738 	}
2739 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
2740 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
2741 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
2742 	    sizeof(struct atw_control_data));
2743 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
2744 
2745 	if (sc->sc_srom)
2746 		free(sc->sc_srom, M_DEVBUF, 0);
2747 
2748 	return (0);
2749 }
2750 
2751 int
2752 atw_intr(void *arg)
2753 {
2754 	struct atw_softc *sc = arg;
2755 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2756 	u_int32_t status, rxstatus, txstatus, linkstatus;
2757 	int handled = 0, txthresh;
2758 
2759 #ifdef DEBUG
2760 	if (ATW_IS_ENABLED(sc) == 0)
2761 		panic("%s: atw_intr: not enabled", sc->sc_dev.dv_xname);
2762 #endif
2763 
2764 	/*
2765 	 * If the interface isn't running, the interrupt couldn't
2766 	 * possibly have come from us.
2767 	 */
2768 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2769 	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
2770 		return (0);
2771 
2772 	for (;;) {
2773 		status = ATW_READ(sc, ATW_STSR);
2774 
2775 		if (status)
2776 			ATW_WRITE(sc, ATW_STSR, status);
2777 
2778 #ifdef ATW_DEBUG
2779 #define PRINTINTR(flag) do { \
2780 	if ((status & flag) != 0) { \
2781 		printf("%s" #flag, delim); \
2782 		delim = ","; \
2783 	} \
2784 } while (0)
2785 
2786 		if (atw_debug > 1 && status) {
2787 			const char *delim = "<";
2788 
2789 			printf("%s: reg[STSR] = %x",
2790 			    sc->sc_dev.dv_xname, status);
2791 
2792 			PRINTINTR(ATW_INTR_FBE);
2793 			PRINTINTR(ATW_INTR_LINKOFF);
2794 			PRINTINTR(ATW_INTR_LINKON);
2795 			PRINTINTR(ATW_INTR_RCI);
2796 			PRINTINTR(ATW_INTR_RDU);
2797 			PRINTINTR(ATW_INTR_REIS);
2798 			PRINTINTR(ATW_INTR_RPS);
2799 			PRINTINTR(ATW_INTR_TCI);
2800 			PRINTINTR(ATW_INTR_TDU);
2801 			PRINTINTR(ATW_INTR_TLT);
2802 			PRINTINTR(ATW_INTR_TPS);
2803 			PRINTINTR(ATW_INTR_TRT);
2804 			PRINTINTR(ATW_INTR_TUF);
2805 			PRINTINTR(ATW_INTR_BCNTC);
2806 			PRINTINTR(ATW_INTR_ATIME);
2807 			PRINTINTR(ATW_INTR_TBTT);
2808 			PRINTINTR(ATW_INTR_TSCZ);
2809 			PRINTINTR(ATW_INTR_TSFTF);
2810 			printf(">\n");
2811 		}
2812 #undef PRINTINTR
2813 #endif /* ATW_DEBUG */
2814 
2815 		if ((status & sc->sc_inten) == 0)
2816 			break;
2817 
2818 		handled = 1;
2819 
2820 		rxstatus = status & sc->sc_rxint_mask;
2821 		txstatus = status & sc->sc_txint_mask;
2822 		linkstatus = status & sc->sc_linkint_mask;
2823 
2824 		if (linkstatus) {
2825 			atw_linkintr(sc, linkstatus);
2826 		}
2827 
2828 		if (rxstatus) {
2829 			/* Grab any new packets. */
2830 			atw_rxintr(sc);
2831 
2832 			if (rxstatus & ATW_INTR_RDU) {
2833 				printf("%s: receive ring overrun\n",
2834 				    sc->sc_dev.dv_xname);
2835 				/* Get the receive process going again. */
2836 				ATW_WRITE(sc, ATW_RDR, 0x1);
2837 				break;
2838 			}
2839 		}
2840 
2841 		if (txstatus) {
2842 			/* Sweep up transmit descriptors. */
2843 			atw_txintr(sc);
2844 
2845 			if (txstatus & ATW_INTR_TLT)
2846 				DPRINTF(sc, ("%s: tx lifetime exceeded\n",
2847 				    sc->sc_dev.dv_xname));
2848 
2849 			if (txstatus & ATW_INTR_TRT)
2850 				DPRINTF(sc, ("%s: tx retry limit exceeded\n",
2851 				    sc->sc_dev.dv_xname));
2852 
2853 			/* If Tx under-run, increase our transmit threshold
2854 			 * if another is available.
2855 			 */
2856 			txthresh = sc->sc_txthresh + 1;
2857 			if ((txstatus & ATW_INTR_TUF) &&
2858 			    sc->sc_txth[txthresh].txth_name != NULL) {
2859 				/* Idle the transmit process. */
2860 				atw_idle(sc, ATW_NAR_ST);
2861 
2862 				sc->sc_txthresh = txthresh;
2863 				sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
2864 				sc->sc_opmode |=
2865 				    sc->sc_txth[txthresh].txth_opmode;
2866 				printf("%s: transmit underrun; new "
2867 				    "threshold: %s\n", sc->sc_dev.dv_xname,
2868 				    sc->sc_txth[txthresh].txth_name);
2869 
2870 				/* Set the new threshold and restart
2871 				 * the transmit process.
2872 				 */
2873 				ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2874 				DELAY(20 * 1000);
2875 				ATW_WRITE(sc, ATW_RDR, 0x1);
2876 				/* XXX Log every Nth underrun from
2877 				 * XXX now on?
2878 				 */
2879 			}
2880 		}
2881 
2882 		if (status & (ATW_INTR_TPS|ATW_INTR_RPS)) {
2883 			if (status & ATW_INTR_TPS)
2884 				printf("%s: transmit process stopped\n",
2885 				    sc->sc_dev.dv_xname);
2886 			if (status & ATW_INTR_RPS)
2887 				printf("%s: receive process stopped\n",
2888 				    sc->sc_dev.dv_xname);
2889 			(void)atw_init(ifp);
2890 			break;
2891 		}
2892 
2893 		if (status & ATW_INTR_FBE) {
2894 			printf("%s: fatal bus error\n", sc->sc_dev.dv_xname);
2895 			(void)atw_init(ifp);
2896 			break;
2897 		}
2898 
2899 		/*
2900 		 * Not handled:
2901 		 *
2902 		 *	Transmit buffer unavailable -- normal
2903 		 *	condition, nothing to do, really.
2904 		 *
2905 		 *	Early receive interrupt -- not available on
2906 		 *	all chips, we just use RI.  We also only
2907 		 *	use single-segment receive DMA, so this
2908 		 *	is mostly useless.
2909 		 *
2910 		 *      TBD others
2911 		 */
2912 	}
2913 
2914 	/* Try to get more packets going. */
2915 	atw_start(ifp);
2916 
2917 	return (handled);
2918 }
2919 
2920 /*
2921  * atw_idle:
2922  *
2923  *	Cause the transmit and/or receive processes to go idle.
2924  *
2925  *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
2926  *	process in STSR if I clear SR or ST after the process has already
2927  *	ceased. Fair enough. But the Rx process status bits in ATW_TEST0
2928  *      do not seem to be too reliable. Perhaps I have the sense of the
2929  *	Rx bits switched with the Tx bits?
2930  */
2931 void
2932 atw_idle(struct atw_softc *sc, u_int32_t bits)
2933 {
2934 	u_int32_t ackmask = 0, opmode, stsr, test0;
2935 	int i, s;
2936 
2937 	s = splnet();
2938 
2939 	opmode = sc->sc_opmode & ~bits;
2940 
2941 	if (bits & ATW_NAR_SR)
2942 		ackmask |= ATW_INTR_RPS;
2943 
2944 	if (bits & ATW_NAR_ST) {
2945 		ackmask |= ATW_INTR_TPS;
2946 		/* set ATW_NAR_HF to flush TX FIFO. */
2947 		opmode |= ATW_NAR_HF;
2948 	}
2949 
2950 	ATW_WRITE(sc, ATW_NAR, opmode);
2951 	DELAY(20 * 1000);
2952 
2953 	for (i = 0; i < 10; i++) {
2954 		stsr = ATW_READ(sc, ATW_STSR);
2955 		if ((stsr & ackmask) == ackmask)
2956 			break;
2957 		DELAY(1000);
2958 	}
2959 
2960 	ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
2961 
2962 	if ((stsr & ackmask) == ackmask)
2963 		goto out;
2964 
2965 	test0 = ATW_READ(sc, ATW_TEST0);
2966 
2967 	if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
2968 	    (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
2969 		DPRINTF2(sc, ("%s: transmit process not idle [%s]\n",
2970 		    sc->sc_dev.dv_xname,
2971 		    atw_tx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_TS_MASK)]));
2972 		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
2973 		    sc->sc_dev.dv_xname, bits, test0, stsr));
2974 	}
2975 
2976 	if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
2977 	    (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
2978 		DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
2979 		    sc->sc_dev.dv_xname,
2980 		    atw_rx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_RS_MASK)]));
2981 		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
2982 		    sc->sc_dev.dv_xname, bits, test0, stsr));
2983 	}
2984 out:
2985 	if ((bits & ATW_NAR_ST) != 0)
2986 		atw_txdrain(sc);
2987 	splx(s);
2988 	return;
2989 }
2990 
2991 /*
2992  * atw_linkintr:
2993  *
2994  *	Helper; handle link-status interrupts.
2995  */
2996 void
2997 atw_linkintr(struct atw_softc *sc, u_int32_t linkstatus)
2998 {
2999 	struct ieee80211com *ic = &sc->sc_ic;
3000 
3001 	if (ic->ic_state != IEEE80211_S_RUN)
3002 		return;
3003 
3004 	if (linkstatus & ATW_INTR_LINKON) {
3005 		DPRINTF(sc, ("%s: link on\n", sc->sc_dev.dv_xname));
3006 		sc->sc_rescan_timer = 0;
3007 	} else if (linkstatus & ATW_INTR_LINKOFF) {
3008 		DPRINTF(sc, ("%s: link off\n", sc->sc_dev.dv_xname));
3009 		if (ic->ic_opmode != IEEE80211_M_STA)
3010 			return;
3011 		sc->sc_rescan_timer = 3;
3012 		ic->ic_if.if_timer = 1;
3013 	}
3014 }
3015 
3016 #if 0
3017 static __inline int
3018 atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame *wh)
3019 {
3020 	if ((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) == 0)
3021 		return 0;
3022 	if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
3023 		return 0;
3024 	return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
3025 }
3026 #endif
3027 
3028 /*
3029  * atw_rxintr:
3030  *
3031  *	Helper; handle receive interrupts.
3032  */
3033 void
3034 atw_rxintr(struct atw_softc *sc)
3035 {
3036 	static int rate_tbl[] = {2, 4, 11, 22, 44};
3037 	struct ieee80211com *ic = &sc->sc_ic;
3038 	struct ieee80211_rxinfo rxi;
3039 	struct ieee80211_node *ni;
3040 	struct ieee80211_frame *wh;
3041 	struct ifnet *ifp = &ic->ic_if;
3042 	struct atw_rxsoft *rxs;
3043 	struct mbuf *m;
3044 	u_int32_t rxstat;
3045 	int i, len, rate, rate0;
3046 	u_int32_t rssi, rssi0;
3047 
3048 	for (i = sc->sc_rxptr;; i = ATW_NEXTRX(i)) {
3049 		rxs = &sc->sc_rxsoft[i];
3050 
3051 		ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3052 
3053 		rxstat = letoh32(sc->sc_rxdescs[i].ar_stat);
3054 		rssi0 = letoh32(sc->sc_rxdescs[i].ar_rssi);
3055 		rate0 = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_RXDR_MASK);
3056 
3057 		if (rxstat & ATW_RXSTAT_OWN)
3058 			break; /* We have processed all receive buffers. */
3059 
3060 		DPRINTF3(sc,
3061 		    ("%s: rx stat %08x rssi0 %08x buf1 %08x buf2 %08x\n",
3062 		    sc->sc_dev.dv_xname,
3063 		    rxstat, rssi0,
3064 		    letoh32(sc->sc_rxdescs[i].ar_buf1),
3065 		    letoh32(sc->sc_rxdescs[i].ar_buf2)));
3066 
3067 		/*
3068 		 * Make sure the packet fits in one buffer.  This should
3069 		 * always be the case.
3070 		 */
3071 		if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=
3072 		    (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {
3073 			printf("%s: incoming packet spilled, resetting\n",
3074 			    sc->sc_dev.dv_xname);
3075 			(void)atw_init(ifp);
3076 			return;
3077 		}
3078 
3079 		/*
3080 		 * If an error occurred, update stats, clear the status
3081 		 * word, and leave the packet buffer in place.  It will
3082 		 * simply be reused the next time the ring comes around.
3083 	 	 * If 802.1Q VLAN MTU is enabled, ignore the Frame Too Long
3084 		 * error.
3085 		 */
3086 
3087 		if ((rxstat & ATW_RXSTAT_ES) != 0 &&
3088 		    ((sc->sc_ic.ic_if.if_capabilities & IFCAP_VLAN_MTU) == 0 ||
3089 		     (rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_SFDE |
3090 		                ATW_RXSTAT_SIGE | ATW_RXSTAT_CRC16E |
3091 				ATW_RXSTAT_RXTOE | ATW_RXSTAT_CRC32E |
3092 				ATW_RXSTAT_ICVE)) != 0)) {
3093 #define	PRINTERR(bit, str)						\
3094 			if (rxstat & (bit))				\
3095 				printf("%s: receive error: %s\n",	\
3096 				    sc->sc_dev.dv_xname, str)
3097 			ifp->if_ierrors++;
3098 			PRINTERR(ATW_RXSTAT_DE, "descriptor error");
3099 			PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
3100 			PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
3101 			PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
3102 			PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
3103 			PRINTERR(ATW_RXSTAT_CRC32E, "FCS error");
3104 			PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
3105 #undef PRINTERR
3106 			ATW_INIT_RXDESC(sc, i);
3107 			continue;
3108 		}
3109 
3110 		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3111 		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
3112 
3113 		/*
3114 		 * No errors; receive the packet.  Note the ADM8211
3115 		 * includes the CRC in promiscuous mode.
3116 		 */
3117 		len = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_FL_MASK);
3118 
3119 		/*
3120 		 * Allocate a new mbuf cluster.  If that fails, we are
3121 		 * out of memory, and must drop the packet and recycle
3122 		 * the buffer that's already attached to this descriptor.
3123 		 */
3124 		m = rxs->rxs_mbuf;
3125 		if (atw_add_rxbuf(sc, i) != 0) {
3126 			ifp->if_ierrors++;
3127 			ATW_INIT_RXDESC(sc, i);
3128 			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3129 			    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
3130 			continue;
3131 		}
3132 
3133 		if (sc->sc_opmode & ATW_NAR_PR)
3134 			len -= IEEE80211_CRC_LEN;
3135 		m->m_pkthdr.rcvif = ifp;
3136 		m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
3137 
3138 		if (rate0 >= sizeof(rate_tbl) / sizeof(rate_tbl[0]))
3139 			rate = 0;
3140 		else
3141 			rate = rate_tbl[rate0];
3142 
3143 		/* The RSSI comes straight from a register in the
3144 		 * baseband processor.  I know that for the RF3000,
3145 		 * the RSSI register also contains the antenna-selection
3146 		 * bits.  Mask those off.
3147 		 *
3148 		 * TBD Treat other basebands.
3149 		 */
3150 		if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
3151 			rssi = rssi0 & RF3000_RSSI_MASK;
3152 		else
3153 			rssi = rssi0;
3154 
3155 #if NBPFILTER > 0
3156 		/* Pass this up to any BPF listeners. */
3157 		if (sc->sc_radiobpf != NULL) {
3158 			struct mbuf mb;
3159 
3160 			struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
3161 
3162 			tap->ar_rate = rate;
3163 			tap->ar_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3164 			tap->ar_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3165 
3166 			/* TBD verify units are dB */
3167 			tap->ar_antsignal = (int)rssi;
3168 			/* TBD tap->ar_flags */
3169 
3170 			mb.m_data = (caddr_t)tap;
3171 			mb.m_len = tap->ar_ihdr.it_len;
3172 			mb.m_next = m;
3173 			mb.m_nextpkt = NULL;
3174 			mb.m_type = 0;
3175 			mb.m_flags = 0;
3176 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_IN);
3177  		}
3178 #endif /* NBPFILTER > 0 */
3179 
3180 		wh = mtod(m, struct ieee80211_frame *);
3181 		ni = ieee80211_find_rxnode(ic, wh);
3182 		rxi.rxi_flags = 0;
3183 #if 0
3184 		if (atw_hw_decrypted(sc, wh)) {
3185 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
3186 			rxi.rxi_flags |= IEEE80211_RXI_HWDEC;
3187 		}
3188 #endif
3189 		rxi.rxi_rssi = (int)rssi;
3190 		rxi.rxi_tstamp = 0;
3191 		ieee80211_input(ifp, m, ni, &rxi);
3192 		/*
3193 		 * The frame may have caused the node to be marked for
3194 		 * reclamation (e.g. in response to a DEAUTH message)
3195 		 * so use release_node here instead of unref_node.
3196 		 */
3197 		ieee80211_release_node(ic, ni);
3198 	}
3199 
3200 	/* Update the receive pointer. */
3201 	sc->sc_rxptr = i;
3202 }
3203 
3204 /*
3205  * atw_txintr:
3206  *
3207  *	Helper; handle transmit interrupts.
3208  */
3209 void
3210 atw_txintr(struct atw_softc *sc)
3211 {
3212 #define TXSTAT_ERRMASK (ATW_TXSTAT_TUF | ATW_TXSTAT_TLT | ATW_TXSTAT_TRT | \
3213     ATW_TXSTAT_TRO | ATW_TXSTAT_SOFBR)
3214 #define TXSTAT_FMT "\20\31ATW_TXSTAT_SOFBR\32ATW_TXSTAT_TRO\33ATW_TXSTAT_TUF" \
3215     "\34ATW_TXSTAT_TRT\35ATW_TXSTAT_TLT"
3216 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3217 	struct atw_txsoft *txs;
3218 	u_int32_t txstat;
3219 
3220 	DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
3221 	    sc->sc_dev.dv_xname, sc->sc_flags));
3222 
3223 	ifp->if_flags &= ~IFF_OACTIVE;
3224 
3225 	/*
3226 	 * Go through our Tx list and free mbufs for those
3227 	 * frames that have been transmitted.
3228 	 */
3229 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
3230 		ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
3231 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3232 
3233 #ifdef ATW_DEBUG
3234 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3235 			int i;
3236 			printf("    txsoft %p transmit chain:\n", txs);
3237 			ATW_CDTXSYNC(sc, txs->txs_firstdesc,
3238 			    txs->txs_ndescs - 1,
3239 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3240 			for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
3241 				printf("     descriptor %d:\n", i);
3242 				printf("       at_status:   0x%08x\n",
3243 				    letoh32(sc->sc_txdescs[i].at_stat));
3244 				printf("       at_flags:      0x%08x\n",
3245 				    letoh32(sc->sc_txdescs[i].at_flags));
3246 				printf("       at_buf1: 0x%08x\n",
3247 				    letoh32(sc->sc_txdescs[i].at_buf1));
3248 				printf("       at_buf2: 0x%08x\n",
3249 				    letoh32(sc->sc_txdescs[i].at_buf2));
3250 				if (i == txs->txs_lastdesc)
3251 					break;
3252 			}
3253 		}
3254 #endif
3255 
3256 		txstat = letoh32(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
3257 		if (txstat & ATW_TXSTAT_OWN)
3258 			break;
3259 
3260 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
3261 
3262 		sc->sc_txfree += txs->txs_ndescs;
3263 
3264 		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
3265 		    0, txs->txs_dmamap->dm_mapsize,
3266 		    BUS_DMASYNC_POSTWRITE);
3267 		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
3268 		m_freem(txs->txs_mbuf);
3269 		txs->txs_mbuf = NULL;
3270 
3271 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
3272 
3273 		if ((ifp->if_flags & IFF_DEBUG) != 0 &&
3274 		    (txstat & TXSTAT_ERRMASK) != 0) {
3275 			printf("%s: txstat %b %d\n", sc->sc_dev.dv_xname,
3276 			    txstat & TXSTAT_ERRMASK, TXSTAT_FMT,
3277 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK));
3278 		}
3279 
3280 		/*
3281 		 * Check for errors and collisions.
3282 		 */
3283 		if (txstat & ATW_TXSTAT_TUF)
3284 			sc->sc_stats.ts_tx_tuf++;
3285 		if (txstat & ATW_TXSTAT_TLT)
3286 			sc->sc_stats.ts_tx_tlt++;
3287 		if (txstat & ATW_TXSTAT_TRT)
3288 			sc->sc_stats.ts_tx_trt++;
3289 		if (txstat & ATW_TXSTAT_TRO)
3290 			sc->sc_stats.ts_tx_tro++;
3291 		if (txstat & ATW_TXSTAT_SOFBR) {
3292 			sc->sc_stats.ts_tx_sofbr++;
3293 		}
3294 
3295 		if ((txstat & ATW_TXSTAT_ES) == 0)
3296 			ifp->if_collisions +=
3297 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK);
3298 		else
3299 			ifp->if_oerrors++;
3300 
3301 		ifp->if_opackets++;
3302 	}
3303 
3304 	/*
3305 	 * If there are no more pending transmissions, cancel the watchdog
3306 	 * timer.
3307 	 */
3308 	if (txs == NULL)
3309 		sc->sc_tx_timer = 0;
3310 #undef TXSTAT_ERRMASK
3311 #undef TXSTAT_FMT
3312 }
3313 
3314 /*
3315  * atw_watchdog:	[ifnet interface function]
3316  *
3317  *	Watchdog timer handler.
3318  */
3319 void
3320 atw_watchdog(struct ifnet *ifp)
3321 {
3322 	struct atw_softc *sc = ifp->if_softc;
3323 	struct ieee80211com *ic = &sc->sc_ic;
3324 	uint32_t test1, rra, rwa;
3325 
3326 	ifp->if_timer = 0;
3327 	if (ATW_IS_ENABLED(sc) == 0)
3328 		return;
3329 
3330 	if (sc->sc_rescan_timer) {
3331 		if (--sc->sc_rescan_timer == 0)
3332 			(void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3333 	}
3334 	if (sc->sc_tx_timer) {
3335 		if (--sc->sc_tx_timer == 0 &&
3336 		    !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
3337 			printf("%s: transmit timeout\n", ifp->if_xname);
3338 			ifp->if_oerrors++;
3339 			(void)atw_init(ifp);
3340 			atw_start(ifp);
3341 		}
3342 	}
3343 	if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
3344 		ifp->if_timer = 1;
3345 
3346 	/*
3347 	 * ADM8211B seems to stall every so often, check for this.
3348 	 * These bits are what the Linux driver checks, they don't
3349 	 * seem to be documented by ADMTek/Infineon?
3350 	 */
3351 	if (sc->sc_rev == ATW_REVISION_BA) {
3352 		test1 = ATW_READ(sc, ATW_TEST1);
3353 		rra = (test1 >> 12) & 0x1ff;
3354 		rwa = (test1 >> 2) & 0x1ff;
3355 
3356 		if ((rra != rwa) && !(test1 & 0x2)) {
3357 			atw_init(ifp);
3358 			atw_start(ifp);
3359 		}
3360 	}
3361 
3362 	ieee80211_watchdog(ifp);
3363 }
3364 
3365 /*
3366  * Arguments in:
3367  *
3368  * paylen:  payload length (no FCS, no WEP header)
3369  *
3370  * hdrlen:  header length
3371  *
3372  * rate:    MSDU speed, units 500kb/s
3373  *
3374  * flags:   IEEE80211_F_SHPREAMBLE (use short preamble),
3375  *          IEEE80211_F_SHSLOT (use short slot length)
3376  *
3377  * Arguments out:
3378  *
3379  * d:       802.11 Duration field for RTS,
3380  *          802.11 Duration field for data frame,
3381  *          PLCP Length for data frame,
3382  *          residual octets at end of data slot
3383  */
3384 int
3385 atw_compute_duration1(int len, int use_ack, uint32_t flags, int rate,
3386     struct atw_duration *d)
3387 {
3388 	int pre, ctsrate;
3389 	int ack, bitlen, data_dur, remainder;
3390 
3391 	/* RTS reserves medium for SIFS | CTS | SIFS | (DATA) | SIFS | ACK
3392 	 * DATA reserves medium for SIFS | ACK
3393 	 *
3394 	 * XXXMYC: no ACK on multicast/broadcast or control packets
3395 	 */
3396 
3397 	bitlen = len * 8;
3398 
3399 	pre = IEEE80211_DUR_DS_SIFS;
3400 	if ((flags & IEEE80211_F_SHPREAMBLE) != 0)
3401 		pre += IEEE80211_DUR_DS_SHORT_PREAMBLE +
3402 		    IEEE80211_DUR_DS_FAST_PLCPHDR;
3403 	else
3404 		pre += IEEE80211_DUR_DS_LONG_PREAMBLE +
3405 		    IEEE80211_DUR_DS_SLOW_PLCPHDR;
3406 
3407 	d->d_residue = 0;
3408 	data_dur = (bitlen * 2) / rate;
3409 	remainder = (bitlen * 2) % rate;
3410 	if (remainder != 0) {
3411 		d->d_residue = (rate - remainder) / 16;
3412 		data_dur++;
3413 	}
3414 
3415 	switch (rate) {
3416 	case 2:		/* 1 Mb/s */
3417 	case 4:		/* 2 Mb/s */
3418 		/* 1 - 2 Mb/s WLAN: send ACK/CTS at 1 Mb/s */
3419 		ctsrate = 2;
3420 		break;
3421 	case 11:	/* 5.5 Mb/s */
3422 	case 22:	/* 11  Mb/s */
3423 	case 44:	/* 22  Mb/s */
3424 		/* 5.5 - 11 Mb/s WLAN: send ACK/CTS at 2 Mb/s */
3425 		ctsrate = 4;
3426 		break;
3427 	default:
3428 		/* TBD */
3429 		return -1;
3430 	}
3431 
3432 	d->d_plcp_len = data_dur;
3433 
3434 	ack = (use_ack) ? pre + (IEEE80211_DUR_DS_SLOW_ACK * 2) / ctsrate : 0;
3435 
3436 	d->d_rts_dur =
3437 	    pre + (IEEE80211_DUR_DS_SLOW_CTS * 2) / ctsrate +
3438 	    pre + data_dur +
3439 	    ack;
3440 
3441 	d->d_data_dur = ack;
3442 
3443 	return 0;
3444 }
3445 
3446 /*
3447  * Arguments in:
3448  *
3449  * wh:      802.11 header
3450  *
3451  * len: packet length
3452  *
3453  * rate:    MSDU speed, units 500kb/s
3454  *
3455  * fraglen: fragment length, set to maximum (or higher) for no
3456  *          fragmentation
3457  *
3458  * flags:   IEEE80211_F_WEPON (hardware adds WEP),
3459  *          IEEE80211_F_SHPREAMBLE (use short preamble),
3460  *          IEEE80211_F_SHSLOT (use short slot length)
3461  *
3462  * Arguments out:
3463  *
3464  * d0: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
3465  *     of first/only fragment
3466  *
3467  * dn: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
3468  *     of first/only fragment
3469  */
3470 int
3471 atw_compute_duration(struct ieee80211_frame *wh, int len, uint32_t flags,
3472     int fraglen, int rate, struct atw_duration *d0, struct atw_duration *dn,
3473     int *npktp, int debug)
3474 {
3475 	int ack, rc;
3476 	int firstlen, hdrlen, lastlen, lastlen0, npkt, overlen, paylen;
3477 
3478 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
3479 		hdrlen = sizeof(struct ieee80211_frame_addr4);
3480 	else
3481 		hdrlen = sizeof(struct ieee80211_frame);
3482 
3483 	paylen = len - hdrlen;
3484 
3485 	if ((flags & IEEE80211_F_WEPON) != 0)
3486 		overlen = IEEE80211_WEP_TOTLEN + IEEE80211_CRC_LEN;
3487 	else
3488 		overlen = IEEE80211_CRC_LEN;
3489 
3490 	npkt = paylen / fraglen;
3491 	lastlen0 = paylen % fraglen;
3492 
3493 	if (npkt == 0)			/* no fragments */
3494 		lastlen = paylen + overlen;
3495 	else if (lastlen0 != 0) {	/* a short "tail" fragment */
3496 		lastlen = lastlen0 + overlen;
3497 		npkt++;
3498 	} else				/* full-length "tail" fragment */
3499 		lastlen = fraglen + overlen;
3500 
3501 	if (npktp != NULL)
3502 		*npktp = npkt;
3503 
3504 	if (npkt > 1)
3505 		firstlen = fraglen + overlen;
3506 	else
3507 		firstlen = paylen + overlen;
3508 
3509 	if (debug) {
3510 		printf("%s: npkt %d firstlen %d lastlen0 %d lastlen %d "
3511 		    "fraglen %d overlen %d len %d rate %d flags %08x\n",
3512 		    __func__, npkt, firstlen, lastlen0, lastlen, fraglen,
3513 		    overlen, len, rate, flags);
3514 	}
3515 
3516 	ack = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3517 	    (wh->i_fc[1] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL;
3518 
3519 	rc = atw_compute_duration1(firstlen + hdrlen, ack, flags, rate, d0);
3520 	if (rc == -1)
3521 		return rc;
3522 
3523 	if (npkt <= 1) {
3524 		*dn = *d0;
3525 		return 0;
3526 	}
3527 	return atw_compute_duration1(lastlen + hdrlen, ack, flags, rate, dn);
3528 }
3529 
3530 #ifdef ATW_DEBUG
3531 void
3532 atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
3533 {
3534 	struct atw_softc *sc = ifp->if_softc;
3535 	struct mbuf *m;
3536 	int i, noctets = 0;
3537 
3538 	printf("%s: %d-byte packet\n", sc->sc_dev.dv_xname,
3539 	    m0->m_pkthdr.len);
3540 
3541 	for (m = m0; m; m = m->m_next) {
3542 		if (m->m_len == 0)
3543 			continue;
3544 		for (i = 0; i < m->m_len; i++) {
3545 			printf(" %02x", ((u_int8_t*)m->m_data)[i]);
3546 			if (++noctets % 24 == 0)
3547 				printf("\n");
3548 		}
3549 	}
3550 	printf("%s%s: %d bytes emitted\n",
3551 	    (noctets % 24 != 0) ? "\n" : "", sc->sc_dev.dv_xname, noctets);
3552 }
3553 #endif /* ATW_DEBUG */
3554 
3555 /*
3556  * atw_start:		[ifnet interface function]
3557  *
3558  *	Start packet transmission on the interface.
3559  */
3560 void
3561 atw_start(struct ifnet *ifp)
3562 {
3563 	struct atw_softc *sc = ifp->if_softc;
3564 	struct ieee80211com *ic = &sc->sc_ic;
3565 	struct ieee80211_node *ni;
3566 	struct ieee80211_frame *wh;
3567 	struct ieee80211_key *k;
3568 	struct atw_frame *hh;
3569 	struct mbuf *m0, *m;
3570 	struct atw_txsoft *txs, *last_txs;
3571 	struct atw_txdesc *txd;
3572 	int do_encrypt, npkt, rate;
3573 	bus_dmamap_t dmamap;
3574 	int ctl, error, firsttx, nexttx, lasttx = -1, first, ofree, seg;
3575 
3576 	DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
3577 	    sc->sc_dev.dv_xname, sc->sc_flags, ifp->if_flags));
3578 
3579 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3580 		return;
3581 
3582 	/*
3583 	 * Remember the previous number of free descriptors and
3584 	 * the first descriptor we'll use.
3585 	 */
3586 	ofree = sc->sc_txfree;
3587 	firsttx = sc->sc_txnext;
3588 
3589 	DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
3590 	    sc->sc_dev.dv_xname, ofree, firsttx));
3591 
3592 	/*
3593 	 * Loop through the send queue, setting up transmit descriptors
3594 	 * until we drain the queue, or use up all available transmit
3595 	 * descriptors.
3596 	 */
3597 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
3598 	       sc->sc_txfree != 0) {
3599 
3600 		/*
3601 		 * Grab a packet off the management queue, if it
3602 		 * is not empty. Otherwise, from the data queue.
3603 		 */
3604 		IF_DEQUEUE(&ic->ic_mgtq, m0);
3605 		if (m0 != NULL) {
3606 			ni = m0->m_pkthdr.ph_cookie;
3607 		} else {
3608 			/* send no data packets until we are associated */
3609 			if (ic->ic_state != IEEE80211_S_RUN)
3610 				break;
3611 			IFQ_DEQUEUE(&ifp->if_snd, m0);
3612 			if (m0 == NULL)
3613 				break;
3614 #if NBPFILTER > 0
3615 			if (ifp->if_bpf != NULL)
3616 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
3617 #endif /* NBPFILTER > 0 */
3618 			if ((m0 = ieee80211_encap(ifp, m0, &ni)) == NULL) {
3619 				ifp->if_oerrors++;
3620 				break;
3621 			}
3622 
3623 			if (ic->ic_flags & IEEE80211_F_WEPON) {
3624 				wh = mtod(m0, struct ieee80211_frame *);
3625 				k = ieee80211_get_txkey(ic, wh, ni);
3626 				m0 = ieee80211_encrypt(ic, m0, k);
3627 				if (m0 == NULL) {
3628 					ifp->if_oerrors++;
3629 					break;
3630 				}
3631 			}
3632 		}
3633 
3634 		wh = mtod(m0, struct ieee80211_frame *);
3635 
3636 		/* XXX do real rate control */
3637 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3638 		    IEEE80211_FC0_TYPE_MGT)
3639 			rate = 2;
3640 		else
3641 			rate = MAX(2, ieee80211_get_rate(ic));
3642 
3643 		if (atw_compute_duration(wh, m0->m_pkthdr.len,
3644 		    ic->ic_flags & ~IEEE80211_F_WEPON, ic->ic_fragthreshold,
3645 		    rate, &txs->txs_d0, &txs->txs_dn, &npkt,
3646 		    (sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3647 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3648 			DPRINTF2(sc, ("%s: fail compute duration\n", __func__));
3649 			m_freem(m0);
3650 			break;
3651 		}
3652 
3653 		/*
3654 		 * XXX Misleading if fragmentation is enabled.  Better
3655 		 * to fragment in software?
3656 		 */
3657 		*(uint16_t *)wh->i_dur = htole16(txs->txs_d0.d_rts_dur);
3658 
3659 #if NBPFILTER > 0
3660 		/*
3661 		 * Pass the packet to any BPF listeners.
3662 		 */
3663 		if (ic->ic_rawbpf != NULL)
3664 			bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
3665 
3666 		if (sc->sc_radiobpf != NULL) {
3667 			struct mbuf mb;
3668 			struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
3669 
3670 			tap->at_rate = rate;
3671 			tap->at_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3672 			tap->at_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3673 
3674 			/* TBD tap->at_flags */
3675 
3676 			mb.m_data = (caddr_t)tap;
3677 			mb.m_len = tap->at_ihdr.it_len;
3678 			mb.m_next = m0;
3679 			mb.m_nextpkt = NULL;
3680 			mb.m_type = 0;
3681 			mb.m_flags = 0;
3682 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_OUT);
3683 		}
3684 #endif /* NBPFILTER > 0 */
3685 
3686 		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
3687 
3688 		if (ni != NULL)
3689 			ieee80211_release_node(ic, ni);
3690 
3691 		if (m0 == NULL) {
3692 			ifp->if_oerrors++;
3693 			break;
3694 		}
3695 
3696 		/* just to make sure. */
3697 		m0 = m_pullup(m0, sizeof(struct atw_frame));
3698 
3699 		if (m0 == NULL) {
3700 			ifp->if_oerrors++;
3701 			break;
3702 		}
3703 
3704 		hh = mtod(m0, struct atw_frame *);
3705 		wh = &hh->atw_ihdr;
3706 
3707 		do_encrypt = ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0) ? 1 : 0;
3708 
3709 		/* Copy everything we need from the 802.11 header:
3710 		 * Frame Control; address 1, address 3, or addresses
3711 		 * 3 and 4. NIC fills in BSSID, SA.
3712 		 */
3713 		if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
3714 			if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
3715 				panic("%s: illegal WDS frame",
3716 				    sc->sc_dev.dv_xname);
3717 			memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
3718 		} else
3719 			memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
3720 
3721 		*(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;
3722 
3723 		/* initialize remaining Tx parameters */
3724 		memset(&hh->u, 0, sizeof(hh->u));
3725 
3726 		hh->atw_rate = rate * 5;
3727 		/* XXX this could be incorrect if M_FCS. _encap should
3728 		 * probably strip FCS just in case it sticks around in
3729 		 * bridged packets.
3730 		 */
3731 		hh->atw_service = IEEE80211_PLCP_SERVICE; /* XXX guess */
3732 		hh->atw_paylen = htole16(m0->m_pkthdr.len -
3733 		    sizeof(struct atw_frame));
3734 
3735 		hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3736 		hh->atw_rtylmt = 3;
3737 		hh->atw_hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
3738 #if 0
3739 		if (do_encrypt) {
3740 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_WEP);
3741 			hh->atw_keyid = ic->ic_wep_txkey;
3742 		}
3743 #endif
3744 
3745 		hh->atw_head_plcplen = htole16(txs->txs_d0.d_plcp_len);
3746 		hh->atw_tail_plcplen = htole16(txs->txs_dn.d_plcp_len);
3747 		if (txs->txs_d0.d_residue)
3748 			hh->atw_head_plcplen |= htole16(0x8000);
3749 		if (txs->txs_dn.d_residue)
3750 			hh->atw_tail_plcplen |= htole16(0x8000);
3751 		hh->atw_head_dur = htole16(txs->txs_d0.d_rts_dur);
3752 		hh->atw_tail_dur = htole16(txs->txs_dn.d_rts_dur);
3753 
3754 		/* never fragment multicast frames */
3755 		if (IEEE80211_IS_MULTICAST(hh->atw_dst)) {
3756 			hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3757 		} else if (sc->sc_flags & ATWF_RTSCTS) {
3758 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
3759 		}
3760 
3761 #ifdef ATW_DEBUG
3762 		hh->atw_fragnum = 0;
3763 
3764 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3765 			printf("%s: dst = %s, rate = 0x%02x, "
3766 			    "service = 0x%02x, paylen = 0x%04x\n",
3767 			    sc->sc_dev.dv_xname, ether_sprintf(hh->atw_dst),
3768 			    hh->atw_rate, hh->atw_service, hh->atw_paylen);
3769 
3770 			printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
3771 			    "dur1 = 0x%04x, dur2 = 0x%04x, "
3772 			    "dur3 = 0x%04x, rts_dur = 0x%04x\n",
3773 			    sc->sc_dev.dv_xname, hh->atw_fc[0], hh->atw_fc[1],
3774 			    hh->atw_tail_plcplen, hh->atw_head_plcplen,
3775 			    hh->atw_tail_dur, hh->atw_head_dur);
3776 
3777 			printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
3778 			    "fragnum = 0x%02x, rtylmt = 0x%04x\n",
3779 			    sc->sc_dev.dv_xname, hh->atw_hdrctl,
3780 			    hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
3781 
3782 			printf("%s: keyid = %d\n",
3783 			    sc->sc_dev.dv_xname, hh->atw_keyid);
3784 
3785 			atw_dump_pkt(ifp, m0);
3786 		}
3787 #endif /* ATW_DEBUG */
3788 
3789 		dmamap = txs->txs_dmamap;
3790 
3791 		/*
3792 		 * Load the DMA map.  Copy and try (once) again if the packet
3793 		 * didn't fit in the alloted number of segments.
3794 		 */
3795 		for (first = 1;
3796 		     (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
3797 		                  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;
3798 		     first = 0) {
3799 			MGETHDR(m, M_DONTWAIT, MT_DATA);
3800 			if (m == NULL) {
3801 				printf("%s: unable to allocate Tx mbuf\n",
3802 				    sc->sc_dev.dv_xname);
3803 				break;
3804 			}
3805 			if (m0->m_pkthdr.len > MHLEN) {
3806 				MCLGET(m, M_DONTWAIT);
3807 				if ((m->m_flags & M_EXT) == 0) {
3808 					printf("%s: unable to allocate Tx "
3809 					    "cluster\n", sc->sc_dev.dv_xname);
3810 					m_freem(m);
3811 					break;
3812 				}
3813 			}
3814 			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
3815 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3816 			m_freem(m0);
3817 			m0 = m;
3818 			m = NULL;
3819 		}
3820 		if (error != 0) {
3821 			printf("%s: unable to load Tx buffer, "
3822 			    "error = %d\n", sc->sc_dev.dv_xname, error);
3823 			m_freem(m0);
3824 			break;
3825 		}
3826 
3827 		/*
3828 		 * Ensure we have enough descriptors free to describe
3829 		 * the packet.
3830 		 */
3831 		if (dmamap->dm_nsegs > sc->sc_txfree) {
3832 			/*
3833 			 * Not enough free descriptors to transmit
3834 			 * this packet.  Unload the DMA map and
3835 			 * drop the packet.  Notify the upper layer
3836 			 * that there are no more slots left.
3837 			 *
3838 			 * XXX We could allocate an mbuf and copy, but
3839 			 * XXX it is worth it?
3840 			 */
3841 			ifp->if_flags |= IFF_OACTIVE;
3842 			bus_dmamap_unload(sc->sc_dmat, dmamap);
3843 			m_freem(m0);
3844 			break;
3845 		}
3846 
3847 		/*
3848 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
3849 		 */
3850 
3851 		/* Sync the DMA map. */
3852 		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
3853 		    BUS_DMASYNC_PREWRITE);
3854 
3855 		/* XXX arbitrary retry limit; 8 because I have seen it in
3856 		 * use already and maybe 0 means "no tries" !
3857 		 */
3858 		ctl = htole32(LSHIFT(8, ATW_TXCTL_TL_MASK));
3859 
3860 		DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
3861 		    sc->sc_dev.dv_xname, rate * 5));
3862 		ctl |= htole32(LSHIFT(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
3863 
3864 		/*
3865 		 * Initialize the transmit descriptors.
3866 		 */
3867 		for (nexttx = sc->sc_txnext, seg = 0;
3868 		     seg < dmamap->dm_nsegs;
3869 		     seg++, nexttx = ATW_NEXTTX(nexttx)) {
3870 			/*
3871 			 * If this is the first descriptor we're
3872 			 * enqueueing, don't set the OWN bit just
3873 			 * yet.  That could cause a race condition.
3874 			 * We'll do it below.
3875 			 */
3876 			txd = &sc->sc_txdescs[nexttx];
3877 			txd->at_ctl = ctl |
3878 			    ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
3879 
3880 			txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
3881 			txd->at_flags =
3882 			    htole32(LSHIFT(dmamap->dm_segs[seg].ds_len,
3883 			                   ATW_TXFLAG_TBS1_MASK)) |
3884 			    ((nexttx == (ATW_NTXDESC - 1))
3885 			        ? htole32(ATW_TXFLAG_TER) : 0);
3886 			lasttx = nexttx;
3887 		}
3888 
3889 		if (lasttx == -1)
3890 			panic("%s: bad lastx", ifp->if_xname);
3891 		/* Set `first segment' and `last segment' appropriately. */
3892 		sc->sc_txdescs[sc->sc_txnext].at_flags |=
3893 		    htole32(ATW_TXFLAG_FS);
3894 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
3895 
3896 #ifdef ATW_DEBUG
3897 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3898 			printf("     txsoft %p transmit chain:\n", txs);
3899 			for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
3900 				printf("     descriptor %d:\n", seg);
3901 				printf("       at_ctl:   0x%08x\n",
3902 				    letoh32(sc->sc_txdescs[seg].at_ctl));
3903 				printf("       at_flags:      0x%08x\n",
3904 				    letoh32(sc->sc_txdescs[seg].at_flags));
3905 				printf("       at_buf1: 0x%08x\n",
3906 				    letoh32(sc->sc_txdescs[seg].at_buf1));
3907 				printf("       at_buf2: 0x%08x\n",
3908 				    letoh32(sc->sc_txdescs[seg].at_buf2));
3909 				if (seg == lasttx)
3910 					break;
3911 			}
3912 		}
3913 #endif
3914 
3915 		/* Sync the descriptors we're using. */
3916 		ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
3917 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3918 
3919 		/*
3920 		 * Store a pointer to the packet so we can free it later,
3921 		 * and remember what txdirty will be once the packet is
3922 		 * done.
3923 		 */
3924 		txs->txs_mbuf = m0;
3925 		txs->txs_firstdesc = sc->sc_txnext;
3926 		txs->txs_lastdesc = lasttx;
3927 		txs->txs_ndescs = dmamap->dm_nsegs;
3928 
3929 		/* Advance the tx pointer. */
3930 		sc->sc_txfree -= dmamap->dm_nsegs;
3931 		sc->sc_txnext = nexttx;
3932 
3933 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
3934 		SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
3935 
3936 		last_txs = txs;
3937 	}
3938 
3939 	if (txs == NULL || sc->sc_txfree == 0) {
3940 		/* No more slots left; notify upper layer. */
3941 		ifp->if_flags |= IFF_OACTIVE;
3942 	}
3943 
3944 	if (sc->sc_txfree != ofree) {
3945 		DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
3946 		    sc->sc_dev.dv_xname, lasttx, firsttx));
3947 		/*
3948 		 * Cause a transmit interrupt to happen on the
3949 		 * last packet we enqueued.
3950 		 */
3951 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
3952 		ATW_CDTXSYNC(sc, lasttx, 1,
3953 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3954 
3955 		/*
3956 		 * The entire packet chain is set up.  Give the
3957 		 * first descriptor to the chip now.
3958 		 */
3959 		sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
3960 		ATW_CDTXSYNC(sc, firsttx, 1,
3961 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3962 
3963 		/* Wake up the transmitter. */
3964 		ATW_WRITE(sc, ATW_TDR, 0x1);
3965 
3966 		/* Set a watchdog timer in case the chip flakes out. */
3967 		sc->sc_tx_timer = 5;
3968 		ifp->if_timer = 1;
3969 	}
3970 }
3971 
3972 int
3973 atw_activate(struct device *self, int act)
3974 {
3975 	struct atw_softc *sc = (struct atw_softc *)self;
3976 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3977 
3978 	switch (act) {
3979 	case DVACT_SUSPEND:
3980 		if (ifp->if_flags & IFF_RUNNING)
3981 			atw_stop(ifp, 1);
3982 		if (sc->sc_power != NULL)
3983 			(*sc->sc_power)(sc, act);
3984 		break;
3985 	case DVACT_WAKEUP:
3986 		atw_wakeup(sc);
3987 		break;
3988 	}
3989 	return 0;
3990 }
3991 
3992 void
3993 atw_wakeup(struct atw_softc *sc)
3994 {
3995 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3996 
3997 	if (sc->sc_power != NULL)
3998 		(*sc->sc_power)(sc, DVACT_RESUME);
3999 	if (ifp->if_flags & IFF_UP)
4000 		atw_init(ifp);
4001 }
4002 
4003 /*
4004  * atw_ioctl:		[ifnet interface function]
4005  *
4006  *	Handle control requests from the operator.
4007  */
4008 int
4009 atw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
4010 {
4011 	struct atw_softc *sc = ifp->if_softc;
4012 	struct ieee80211com *ic = &sc->sc_ic;
4013 	struct ifreq *ifr = (struct ifreq *)data;
4014    	struct ifaddr *ifa = (struct ifaddr *)data;
4015 	int s, error = 0;
4016 
4017 	/* XXX monkey see, monkey do. comes from wi_ioctl. */
4018 	if ((sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
4019 		return ENXIO;
4020 
4021 	s = splnet();
4022 
4023 	switch (cmd) {
4024         case SIOCSIFADDR:
4025                 ifp->if_flags |= IFF_UP;
4026 #ifdef INET
4027                 if (ifa->ifa_addr->sa_family == AF_INET) {
4028                         arp_ifinit(&ic->ic_ac, ifa);
4029                 }
4030 #endif  /* INET */
4031 		/* FALLTHROUGH */
4032 
4033 	case SIOCSIFFLAGS:
4034 		if (ifp->if_flags & IFF_UP) {
4035 			if (ATW_IS_ENABLED(sc)) {
4036 				/*
4037 				 * To avoid rescanning another access point,
4038 				 * do not call atw_init() here.  Instead,
4039 				 * only reflect media settings.
4040 				 */
4041 				atw_filter_setup(sc);
4042 			} else
4043 				error = atw_init(ifp);
4044 		} else if (ATW_IS_ENABLED(sc))
4045 			atw_stop(ifp, 1);
4046 		break;
4047 
4048 	case SIOCADDMULTI:
4049 	case SIOCDELMULTI:
4050 		error = (cmd == SIOCADDMULTI) ?
4051 		    ether_addmulti(ifr, &sc->sc_ic.ic_ac) :
4052 		    ether_delmulti(ifr, &sc->sc_ic.ic_ac);
4053 
4054 		if (error == ENETRESET) {
4055 			if (ifp->if_flags & IFF_RUNNING)
4056 				atw_filter_setup(sc); /* do not rescan */
4057 			error = 0;
4058 		}
4059 		break;
4060 
4061 	default:
4062 		error = ieee80211_ioctl(ifp, cmd, data);
4063 		if (error == ENETRESET) {
4064 			if (ATW_IS_ENABLED(sc))
4065 				error = atw_init(ifp);
4066 			else
4067 				error = 0;
4068 		}
4069 		break;
4070 	}
4071 
4072 	/* Try to get more packets going. */
4073 	if (ATW_IS_ENABLED(sc))
4074 		atw_start(ifp);
4075 
4076 	splx(s);
4077 	return (error);
4078 }
4079 
4080 int
4081 atw_media_change(struct ifnet *ifp)
4082 {
4083 	int error;
4084 
4085 	error = ieee80211_media_change(ifp);
4086 	if (error == ENETRESET) {
4087 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
4088 		    (IFF_RUNNING|IFF_UP))
4089 			atw_init(ifp);		/* XXX lose error */
4090 		error = 0;
4091 	}
4092 	return error;
4093 }
4094 
4095 void
4096 atw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
4097 {
4098 	struct atw_softc *sc = ifp->if_softc;
4099 
4100 	if (ATW_IS_ENABLED(sc) == 0) {
4101 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
4102 		imr->ifm_status = 0;
4103 		return;
4104 	}
4105 	ieee80211_media_status(ifp, imr);
4106 }
4107