xref: /openbsd-src/sys/dev/ic/rtw.c (revision d13be5d47e4149db2549a9828e244d59dbc43f15)
1 /*	$OpenBSD: rtw.c,v 1.81 2010/09/07 16:21:43 deraadt Exp $	*/
2 /*	$NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
3 
4 /*-
5  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
6  *
7  * Programmed for NetBSD by David Young.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. The name of David Young may not be used to endorse or promote
18  *    products derived from this software without specific prior
19  *    written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
22  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
23  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
24  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
25  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
26  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
27  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
29  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
32  * OF SUCH DAMAGE.
33  */
34 /*
35  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
36  */
37 
38 #include <sys/cdefs.h>
39 #include "bpfilter.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/mbuf.h>
44 #include <sys/malloc.h>
45 #include <sys/kernel.h>
46 #include <sys/ioctl.h>
47 #include <sys/socket.h>
48 #include <sys/time.h>
49 #include <sys/types.h>
50 
51 #include <machine/endian.h>
52 #include <machine/bus.h>
53 #include <machine/intr.h>	/* splnet */
54 
55 #include <uvm/uvm_extern.h>
56 
57 #include <net/if.h>
58 #include <net/if_media.h>
59 
60 #if NBPFILTER > 0
61 #include <net/bpf.h>
62 #endif
63 
64 #ifdef INET
65 #include <netinet/in.h>
66 #include <netinet/if_ether.h>
67 #endif
68 
69 #include <net80211/ieee80211_var.h>
70 #include <net80211/ieee80211_radiotap.h>
71 
72 #include <dev/ic/rtwreg.h>
73 #include <dev/ic/rtwvar.h>
74 #include <dev/ic/max2820reg.h>
75 #include <dev/ic/sa2400reg.h>
76 #include <dev/ic/si4136reg.h>
77 #include <dev/ic/rtl8225reg.h>
78 #include <dev/ic/smc93cx6var.h>
79 
80 int rtw_rfprog_fallback = 0;
81 int rtw_do_chip_reset = 0;
82 int rtw_dwelltime = 200;	/* milliseconds per channel */
83 int rtw_macbangbits_timeout = 100;
84 
85 #ifdef RTW_DEBUG
86 int rtw_debug = 0;
87 int rtw_rxbufs_limit = RTW_RXQLEN;
88 #endif /* RTW_DEBUG */
89 
90 void	 rtw_start(struct ifnet *);
91 void	 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *);
92 void	 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *);
93 void	 rtw_txdesc_blk_init(struct rtw_txdesc_blk *);
94 void	 rtw_txdescs_sync(struct rtw_txdesc_blk *, u_int, u_int, int);
95 void	 rtw_txring_fixup(struct rtw_softc *);
96 void	 rtw_rxbufs_release(bus_dma_tag_t, struct rtw_rxsoft *);
97 void	 rtw_rxdesc_init(struct rtw_rxdesc_blk *, struct rtw_rxsoft *, int, int);
98 void	 rtw_rxring_fixup(struct rtw_softc *);
99 void	 rtw_io_enable(struct rtw_regs *, u_int8_t, int);
100 void	 rtw_intr_rx(struct rtw_softc *, u_int16_t);
101 #ifndef IEEE80211_STA_ONLY
102 void	 rtw_intr_beacon(struct rtw_softc *, u_int16_t);
103 void	 rtw_intr_atim(struct rtw_softc *);
104 #endif
105 void	 rtw_transmit_config(struct rtw_softc *);
106 void	 rtw_pktfilt_load(struct rtw_softc *);
107 void	 rtw_start(struct ifnet *);
108 void	 rtw_watchdog(struct ifnet *);
109 void	 rtw_next_scan(void *);
110 #ifndef IEEE80211_STA_ONLY
111 void	 rtw_recv_mgmt(struct ieee80211com *, struct mbuf *,
112 	    struct ieee80211_node *, struct ieee80211_rxinfo *, int);
113 #endif
114 struct ieee80211_node *rtw_node_alloc(struct ieee80211com *);
115 void	 rtw_node_free(struct ieee80211com *, struct ieee80211_node *);
116 void	 rtw_media_status(struct ifnet *, struct ifmediareq *);
117 void	 rtw_txsoft_blk_cleanup_all(struct rtw_softc *);
118 void	 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *, struct rtw_txdesc *,
119 	    u_int, bus_addr_t, bus_addr_t);
120 void	 rtw_txdesc_blk_setup_all(struct rtw_softc *);
121 void	 rtw_intr_tx(struct rtw_softc *, u_int16_t);
122 void	 rtw_intr_ioerror(struct rtw_softc *, u_int16_t);
123 void	 rtw_intr_timeout(struct rtw_softc *);
124 void	 rtw_stop(struct ifnet *, int);
125 void	 rtw_maxim_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
126 void	 rtw_philips_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
127 void	 rtw_rtl_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
128 void	 rtw_pwrstate0(struct rtw_softc *, enum rtw_pwrstate, int, int);
129 void	 rtw_join_bss(struct rtw_softc *, u_int8_t *, u_int16_t);
130 void	 rtw_set_access1(struct rtw_regs *, enum rtw_access);
131 int	 rtw_srom_parse(struct rtw_softc *);
132 int	 rtw_srom_read(struct rtw_regs *, u_int32_t, struct rtw_srom *,
133 	    const char *);
134 void	 rtw_set_rfprog(struct rtw_regs *, int, const char *);
135 u_int8_t rtw_chan2txpower(struct rtw_srom *, struct ieee80211com *,
136 	    struct ieee80211_channel *);
137 int	 rtw_txsoft_blk_init(struct rtw_txsoft_blk *);
138 int	 rtw_rxsoft_init_all(bus_dma_tag_t, struct rtw_rxsoft *,
139 	    int *, const char *);
140 void	 rtw_txsoft_release(bus_dma_tag_t, struct ieee80211com *,
141 	    struct rtw_txsoft *);
142 void	 rtw_txsofts_release(bus_dma_tag_t, struct ieee80211com *,
143 	    struct rtw_txsoft_blk *);
144 void	 rtw_hwring_setup(struct rtw_softc *);
145 int	 rtw_swring_setup(struct rtw_softc *);
146 void	 rtw_txdescs_reset(struct rtw_softc *);
147 void	 rtw_rfmd_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
148 int	 rtw_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
149 int	 rtw_tune(struct rtw_softc *);
150 void	 rtw_set_nettype(struct rtw_softc *, enum ieee80211_opmode);
151 int	 rtw_compute_duration1(int, int, uint32_t, int, struct rtw_duration *);
152 int	 rtw_compute_duration(struct ieee80211_frame *, int, uint32_t, int,
153 	    int, struct rtw_duration *, struct rtw_duration *, int *, int);
154 int	 rtw_init(struct ifnet *);
155 int	 rtw_ioctl(struct ifnet *, u_long, caddr_t);
156 int	 rtw_seg_too_short(bus_dmamap_t);
157 struct mbuf *rtw_dmamap_load_txbuf(bus_dma_tag_t, bus_dmamap_t, struct mbuf *,
158 	    u_int, short *, const char *);
159 int	 rtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
160 int	 rtw_media_change(struct ifnet *);
161 int	 rtw_txsoft_blk_setup_all(struct rtw_softc *);
162 int	 rtw_rf_attach(struct rtw_softc *, int);
163 u_int8_t rtw_check_phydelay(struct rtw_regs *, u_int32_t);
164 int	 rtw_chip_reset1(struct rtw_regs *, const char *);
165 int	 rtw_chip_reset(struct rtw_regs *, const char *);
166 int	 rtw_recall_eeprom(struct rtw_regs *, const char *);
167 int	 rtw_reset(struct rtw_softc *);
168 void	 rtw_reset_oactive(struct rtw_softc *);
169 int	 rtw_txdesc_dmamaps_create(bus_dma_tag_t, struct rtw_txsoft *, u_int);
170 int	 rtw_rxdesc_dmamaps_create(bus_dma_tag_t, struct rtw_rxsoft *, u_int);
171 void	 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t, struct rtw_rxsoft *, u_int);
172 void	 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t, struct rtw_txsoft *, u_int);
173 void	 rtw_identify_country(struct rtw_regs *, enum rtw_locale *);
174 int	 rtw_identify_sta(struct rtw_regs *, u_int8_t (*)[], const char *);
175 void	 rtw_rxdescs_sync(struct rtw_rxdesc_blk *, int, int, int);
176 int	 rtw_rxsoft_alloc(bus_dma_tag_t, struct rtw_rxsoft *);
177 void	 rtw_collect_txpkt(struct rtw_softc *, struct rtw_txdesc_blk *,
178 	    struct rtw_txsoft *, int);
179 void	 rtw_collect_txring(struct rtw_softc *, struct rtw_txsoft_blk *,
180 	    struct rtw_txdesc_blk *, int);
181 void	 rtw_suspend_ticks(struct rtw_softc *);
182 void	 rtw_resume_ticks(struct rtw_softc *);
183 void	 rtw_enable_interrupts(struct rtw_softc *);
184 int	 rtw_dequeue(struct ifnet *, struct rtw_txsoft_blk **,
185 	    struct rtw_txdesc_blk **, struct mbuf **,
186 	    struct ieee80211_node **);
187 int	 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *, u_int);
188 void	 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *, struct rtw_rxsoft *,
189 	    int);
190 int	 rtw_txring_choose(struct rtw_softc *, struct rtw_txsoft_blk **,
191 	    struct rtw_txdesc_blk **, int);
192 u_int	 rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
193 struct mbuf *rtw_80211_dequeue(struct rtw_softc *, struct ifqueue *, int,
194 	    struct rtw_txsoft_blk **, struct rtw_txdesc_blk **,
195 	    struct ieee80211_node **, short *);
196 uint64_t rtw_tsf_extend(struct rtw_regs *, u_int32_t);
197 #ifndef IEEE80211_STA_ONLY
198 void	 rtw_ibss_merge(struct rtw_softc *, struct ieee80211_node *,
199 	    u_int32_t);
200 #endif
201 void	 rtw_idle(struct rtw_regs *);
202 void	 rtw_led_attach(struct rtw_led_state *, void *);
203 void	 rtw_led_init(struct rtw_regs *);
204 void	 rtw_led_slowblink(void *);
205 void	 rtw_led_fastblink(void *);
206 void	 rtw_led_set(struct rtw_led_state *, struct rtw_regs *, u_int);
207 void	 rtw_led_newstate(struct rtw_softc *, enum ieee80211_state);
208 
209 int	 rtw_phy_init(struct rtw_softc *);
210 int	 rtw_bbp_preinit(struct rtw_regs *, u_int, int, u_int);
211 int	 rtw_bbp_init(struct rtw_regs *, struct rtw_bbpset *, int,
212 	    int, u_int8_t, u_int);
213 void	 rtw_verify_syna(u_int, u_int32_t);
214 int	 rtw_sa2400_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
215 int	 rtw_sa2400_txpower(struct rtw_softc *, u_int8_t);
216 int	 rtw_sa2400_tune(struct rtw_softc *, u_int);
217 int	 rtw_sa2400_vcocal_start(struct rtw_softc *, int);
218 int	 rtw_sa2400_vco_calibration(struct rtw_softc *);
219 int	 rtw_sa2400_filter_calibration(struct rtw_softc *);
220 int	 rtw_sa2400_dc_calibration(struct rtw_softc *);
221 int	 rtw_sa2400_calibrate(struct rtw_softc *, u_int);
222 int	 rtw_sa2400_init(struct rtw_softc *, u_int, u_int8_t,
223 	    enum rtw_pwrstate);
224 int	 rtw_max2820_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
225 int	 rtw_max2820_init(struct rtw_softc *, u_int, u_int8_t,
226 	    enum rtw_pwrstate);
227 int	 rtw_max2820_txpower(struct rtw_softc *, u_int8_t);
228 int	 rtw_max2820_tune(struct rtw_softc *, u_int);
229 int	 rtw_rtl8225_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
230 int	 rtw_rtl8225_init(struct rtw_softc *, u_int, u_int8_t,
231 	    enum rtw_pwrstate);
232 int	 rtw_rtl8225_txpower(struct rtw_softc *, u_int8_t);
233 int	 rtw_rtl8225_tune(struct rtw_softc *, u_int);
234 int	 rtw_rtl8255_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
235 int	 rtw_rtl8255_init(struct rtw_softc *, u_int, u_int8_t,
236 	    enum rtw_pwrstate);
237 int	 rtw_rtl8255_txpower(struct rtw_softc *, u_int8_t);
238 int	 rtw_rtl8255_tune(struct rtw_softc *, u_int);
239 int	 rtw_grf5101_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
240 int	 rtw_grf5101_init(struct rtw_softc *, u_int, u_int8_t,
241 	    enum rtw_pwrstate);
242 int	 rtw_grf5101_txpower(struct rtw_softc *, u_int8_t);
243 int	 rtw_grf5101_tune(struct rtw_softc *, u_int);
244 int	 rtw_rf_hostwrite(struct rtw_softc *, u_int, u_int32_t);
245 int	 rtw_rf_macwrite(struct rtw_softc *, u_int, u_int32_t);
246 int	 rtw_bbp_write(struct rtw_regs *, u_int, u_int);
247 u_int32_t rtw_grf5101_host_crypt(u_int, u_int32_t);
248 u_int32_t rtw_maxim_swizzle(u_int, uint32_t);
249 u_int32_t rtw_grf5101_mac_crypt(u_int, u_int32_t);
250 void	 rtw_rf_hostbangbits(struct rtw_regs *, u_int32_t, int, u_int);
251 void	 rtw_rf_rtl8225_hostbangbits(struct rtw_regs *, u_int32_t, int, u_int);
252 int	 rtw_rf_macbangbits(struct rtw_regs *, u_int32_t);
253 
254 u_int8_t rtw_read8(void *, u_int32_t);
255 u_int16_t rtw_read16(void *, u_int32_t);
256 u_int32_t rtw_read32(void *, u_int32_t);
257 void	 rtw_write8(void *, u_int32_t, u_int8_t);
258 void	 rtw_write16(void *, u_int32_t, u_int16_t);
259 void	 rtw_write32(void *, u_int32_t, u_int32_t);
260 void	 rtw_barrier(void *, u_int32_t, u_int32_t, int);
261 
262 #ifdef RTW_DEBUG
263 void	 rtw_print_txdesc(struct rtw_softc *, const char *,
264 	    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
265 const char *rtw_access_string(enum rtw_access);
266 void	 rtw_dump_rings(struct rtw_softc *);
267 void	 rtw_print_txdesc(struct rtw_softc *, const char *,
268 	    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
269 #endif
270 
271 struct cfdriver rtw_cd = {
272 	NULL, "rtw", DV_IFNET
273 };
274 
275 void
276 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
277 {
278 	struct rtw_regs *regs = &sc->sc_regs;
279 
280 	u_int32_t tcr;
281 	tcr = RTW_READ(regs, RTW_TCR);
282 	tcr &= ~RTW_TCR_LBK_MASK;
283 	if (enable)
284 		tcr |= RTW_TCR_LBK_CONT;
285 	else
286 		tcr |= RTW_TCR_LBK_NORMAL;
287 	RTW_WRITE(regs, RTW_TCR, tcr);
288 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
289 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
290 	rtw_txdac_enable(sc, !enable);
291 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
292 	rtw_set_access(regs, RTW_ACCESS_NONE);
293 }
294 
295 #ifdef RTW_DEBUG
296 const char *
297 rtw_access_string(enum rtw_access access)
298 {
299 	switch (access) {
300 	case RTW_ACCESS_NONE:
301 		return "none";
302 	case RTW_ACCESS_CONFIG:
303 		return "config";
304 	case RTW_ACCESS_ANAPARM:
305 		return "anaparm";
306 	default:
307 		return "unknown";
308 	}
309 }
310 #endif
311 
312 void
313 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
314 {
315 	KASSERT(naccess >= RTW_ACCESS_NONE && naccess <= RTW_ACCESS_ANAPARM);
316 	KASSERT(regs->r_access >= RTW_ACCESS_NONE &&
317 	    regs->r_access <= RTW_ACCESS_ANAPARM);
318 
319 	if (naccess == regs->r_access)
320 		return;
321 
322 	switch (naccess) {
323 	case RTW_ACCESS_NONE:
324 		switch (regs->r_access) {
325 		case RTW_ACCESS_ANAPARM:
326 			rtw_anaparm_enable(regs, 0);
327 			/*FALLTHROUGH*/
328 		case RTW_ACCESS_CONFIG:
329 			rtw_config0123_enable(regs, 0);
330 			/*FALLTHROUGH*/
331 		case RTW_ACCESS_NONE:
332 			break;
333 		}
334 		break;
335 	case RTW_ACCESS_CONFIG:
336 		switch (regs->r_access) {
337 		case RTW_ACCESS_NONE:
338 			rtw_config0123_enable(regs, 1);
339 			/*FALLTHROUGH*/
340 		case RTW_ACCESS_CONFIG:
341 			break;
342 		case RTW_ACCESS_ANAPARM:
343 			rtw_anaparm_enable(regs, 0);
344 			break;
345 		}
346 		break;
347 	case RTW_ACCESS_ANAPARM:
348 		switch (regs->r_access) {
349 		case RTW_ACCESS_NONE:
350 			rtw_config0123_enable(regs, 1);
351 			/*FALLTHROUGH*/
352 		case RTW_ACCESS_CONFIG:
353 			rtw_anaparm_enable(regs, 1);
354 			/*FALLTHROUGH*/
355 		case RTW_ACCESS_ANAPARM:
356 			break;
357 		}
358 		break;
359 	}
360 }
361 
362 void
363 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
364 {
365 	rtw_set_access1(regs, access);
366 	RTW_DPRINTF(RTW_DEBUG_ACCESS,
367 	    ("%s: access %s -> %s\n",__func__,
368 	    rtw_access_string(regs->r_access),
369 	    rtw_access_string(access)));
370 	regs->r_access = access;
371 }
372 
373 /*
374  * Enable registers, switch register banks.
375  */
376 void
377 rtw_config0123_enable(struct rtw_regs *regs, int enable)
378 {
379 	u_int8_t ecr;
380 	ecr = RTW_READ8(regs, RTW_9346CR);
381 	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
382 	if (enable)
383 		ecr |= RTW_9346CR_EEM_CONFIG;
384 	else {
385 		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
386 		ecr |= RTW_9346CR_EEM_NORMAL;
387 	}
388 	RTW_WRITE8(regs, RTW_9346CR, ecr);
389 	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
390 }
391 
392 /* requires rtw_config0123_enable(, 1) */
393 void
394 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
395 {
396 	u_int8_t cfg3;
397 
398 	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
399 	cfg3 |= RTW_CONFIG3_CLKRUNEN;
400 	if (enable)
401 		cfg3 |= RTW_CONFIG3_PARMEN;
402 	else
403 		cfg3 &= ~RTW_CONFIG3_PARMEN;
404 	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
405 	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
406 }
407 
408 /* requires rtw_anaparm_enable(, 1) */
409 void
410 rtw_txdac_enable(struct rtw_softc *sc, int enable)
411 {
412 	u_int32_t anaparm;
413 	struct rtw_regs *regs = &sc->sc_regs;
414 
415 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
416 	if (enable)
417 		anaparm &= ~RTW_ANAPARM_TXDACOFF;
418 	else
419 		anaparm |= RTW_ANAPARM_TXDACOFF;
420 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
421 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
422 }
423 
424 int
425 rtw_chip_reset1(struct rtw_regs *regs, const char *dvname)
426 {
427 	u_int8_t cr;
428 	int i;
429 
430 	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
431 
432 	RTW_WBR(regs, RTW_CR, RTW_CR);
433 
434 	for (i = 0; i < 1000; i++) {
435 		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
436 			RTW_DPRINTF(RTW_DEBUG_RESET,
437 			    ("%s: reset in %dus\n", dvname, i));
438 			return 0;
439 		}
440 		RTW_RBR(regs, RTW_CR, RTW_CR);
441 		DELAY(10); /* 10us */
442 	}
443 
444 	printf("\n%s: reset failed\n", dvname);
445 	return ETIMEDOUT;
446 }
447 
448 int
449 rtw_chip_reset(struct rtw_regs *regs, const char *dvname)
450 {
451 	uint32_t tcr;
452 
453 	/* from Linux driver */
454 	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
455 	    LSHIFT(7, RTW_TCR_SRL_MASK) | LSHIFT(7, RTW_TCR_LRL_MASK);
456 
457 	RTW_WRITE(regs, RTW_TCR, tcr);
458 
459 	RTW_WBW(regs, RTW_CR, RTW_TCR);
460 
461 	return rtw_chip_reset1(regs, dvname);
462 }
463 
464 int
465 rtw_recall_eeprom(struct rtw_regs *regs, const char *dvname)
466 {
467 	int i;
468 	u_int8_t ecr;
469 
470 	ecr = RTW_READ8(regs, RTW_9346CR);
471 	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
472 	RTW_WRITE8(regs, RTW_9346CR, ecr);
473 
474 	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
475 
476 	/* wait 10ms for completion */
477 	for (i = 0; i < 50; i++) {
478 		ecr = RTW_READ8(regs, RTW_9346CR);
479 		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
480 			RTW_DPRINTF(RTW_DEBUG_RESET,
481 			    ("%s: recall EEPROM in %dus\n", dvname, i * 200));
482 			return (0);
483 		}
484 		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
485 		DELAY(200);
486 	}
487 
488 	printf("\n%s: could not recall EEPROM in %dus\n", dvname, i * 200);
489 
490 	return (ETIMEDOUT);
491 }
492 
493 int
494 rtw_reset(struct rtw_softc *sc)
495 {
496 	int rc;
497 	uint8_t config1;
498 
499 	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
500 		return rc;
501 
502 	if ((rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
503 		;
504 
505 	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
506 	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
507 	/* TBD turn off maximum power saving? */
508 
509 	return 0;
510 }
511 
512 int
513 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
514     u_int ndescs)
515 {
516 	int i, rc = 0;
517 	for (i = 0; i < ndescs; i++) {
518 		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
519 		    0, 0, &descs[i].ts_dmamap);
520 		if (rc != 0)
521 			break;
522 	}
523 	return rc;
524 }
525 
526 int
527 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
528     u_int ndescs)
529 {
530 	int i, rc = 0;
531 	for (i = 0; i < ndescs; i++) {
532 		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
533 		    &descs[i].rs_dmamap);
534 		if (rc != 0)
535 			break;
536 	}
537 	return rc;
538 }
539 
540 void
541 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
542     u_int ndescs)
543 {
544 	int i;
545 	for (i = 0; i < ndescs; i++) {
546 		if (descs[i].rs_dmamap != NULL)
547 			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
548 	}
549 }
550 
551 void
552 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
553     u_int ndescs)
554 {
555 	int i;
556 	for (i = 0; i < ndescs; i++) {
557 		if (descs[i].ts_dmamap != NULL)
558 			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
559 	}
560 }
561 
562 int
563 rtw_srom_parse(struct rtw_softc *sc)
564 {
565 	int i;
566 	struct rtw_srom *sr = &sc->sc_srom;
567 	u_int32_t *flags = &sc->sc_flags;
568 	u_int8_t *cs_threshold = &sc->sc_csthr;
569 	int *rfchipid = &sc->sc_rfchipid;
570 	u_int32_t *rcr = &sc->sc_rcr;
571 	enum rtw_locale *locale = &sc->sc_locale;
572 	u_int16_t version;
573 	u_int8_t mac[IEEE80211_ADDR_LEN];
574 
575 	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
576 	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
577 
578 	version = RTW_SR_GET16(sr, RTW_SR_VERSION);
579 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
580 	    ("%s: SROM %d.%d\n", sc->sc_dev.dv_xname, version >> 8,
581 	    version & 0xff));
582 
583 	if (version <= 0x0101) {
584 		printf(" is not understood, limping along with defaults ");
585 		*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
586 		*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
587 		*rcr |= RTW_RCR_ENCS1;
588 		*rfchipid = RTW_RFCHIPID_PHILIPS;
589 		return 0;
590 	}
591 
592 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
593 		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
594 
595 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
596 	    ("%s: EEPROM MAC %s\n", sc->sc_dev.dv_xname, ether_sprintf(mac)));
597 
598 	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
599 
600 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW8180_CONFIG2_ANT) != 0)
601 		*flags |= RTW_F_ANTDIV;
602 
603 	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
604 	 * to be reversed.
605 	 */
606 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
607 		*flags |= RTW_F_DIGPHY;
608 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
609 		*flags |= RTW_F_DFLANTB;
610 
611 	*rcr |= LSHIFT(MASK_AND_RSHIFT(RTW_SR_GET(sr, RTW_SR_RFPARM),
612 	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
613 
614 	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
615 
616 	if (sc->sc_flags & RTW_F_RTL8185) {
617 		*locale = RTW_LOCALE_UNKNOWN;
618 		return (0);
619 	}
620 
621 	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW8180_CONFIG0_GL_MASK) {
622 	case RTW8180_CONFIG0_GL_USA:
623 		*locale = RTW_LOCALE_USA;
624 		break;
625 	case RTW8180_CONFIG0_GL_EUROPE:
626 		*locale = RTW_LOCALE_EUROPE;
627 		break;
628 	case RTW8180_CONFIG0_GL_JAPAN:
629 	case RTW8180_CONFIG0_GL_JAPAN2:
630 		*locale = RTW_LOCALE_JAPAN;
631 		break;
632 	default:
633 		*locale = RTW_LOCALE_UNKNOWN;
634 		break;
635 	}
636 	return 0;
637 }
638 
639 /* Returns -1 on failure. */
640 int
641 rtw_srom_read(struct rtw_regs *regs, u_int32_t flags, struct rtw_srom *sr,
642     const char *dvname)
643 {
644 	int rc;
645 	struct seeprom_descriptor sd;
646 	u_int8_t ecr;
647 
648 	bzero(&sd, sizeof(sd));
649 
650 	ecr = RTW_READ8(regs, RTW_9346CR);
651 
652 	if ((flags & RTW_F_9356SROM) != 0) {
653 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n", dvname));
654 		sr->sr_size = 256;
655 		sd.sd_chip = C56_66;
656 	} else {
657 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n", dvname));
658 		sr->sr_size = 128;
659 		sd.sd_chip = C46;
660 	}
661 
662 	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
663 	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
664 	ecr |= RTW_9346CR_EEM_PROGRAM;
665 
666 	RTW_WRITE8(regs, RTW_9346CR, ecr);
667 
668 	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT | M_ZERO);
669 
670 	if (sr->sr_content == NULL) {
671 		printf("%s: unable to allocate SROM buffer\n", dvname);
672 		return ENOMEM;
673 	}
674 
675 	/* RTL8180 has a single 8-bit register for controlling the
676 	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
677 	 * input/output sense is the reverse of read_seeprom's.
678 	 */
679 	sd.sd_tag = regs->r_bt;
680 	sd.sd_bsh = regs->r_bh;
681 	sd.sd_regsize = 1;
682 	sd.sd_control_offset = RTW_9346CR;
683 	sd.sd_status_offset = RTW_9346CR;
684 	sd.sd_dataout_offset = RTW_9346CR;
685 	sd.sd_CK = RTW_9346CR_EESK;
686 	sd.sd_CS = RTW_9346CR_EECS;
687 	sd.sd_DI = RTW_9346CR_EEDO;
688 	sd.sd_DO = RTW_9346CR_EEDI;
689 	/* make read_seeprom enter EEPROM read/write mode */
690 	sd.sd_MS = ecr;
691 	sd.sd_RDY = 0;
692 
693 	/* TBD bus barriers */
694 	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
695 		printf("\n%s: could not read SROM\n", dvname);
696 		free(sr->sr_content, M_DEVBUF);
697 		sr->sr_content = NULL;
698 		return -1;	/* XXX */
699 	}
700 
701 	/* end EEPROM read/write mode */
702 	RTW_WRITE8(regs, RTW_9346CR,
703 	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
704 	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
705 
706 	if ((rc = rtw_recall_eeprom(regs, dvname)) != 0)
707 		return rc;
708 
709 #ifdef RTW_DEBUG
710 	{
711 		int i;
712 		RTW_DPRINTF(RTW_DEBUG_ATTACH,
713 		    ("\n%s: serial ROM:\n\t", dvname));
714 		for (i = 0; i < sr->sr_size/2; i++) {
715 			if (((i % 8) == 0) && (i != 0))
716 				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
717 			RTW_DPRINTF(RTW_DEBUG_ATTACH,
718 			    (" %04x", sr->sr_content[i]));
719 		}
720 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
721 	}
722 #endif /* RTW_DEBUG */
723 	return 0;
724 }
725 
726 void
727 rtw_set_rfprog(struct rtw_regs *regs, int rfchipid,
728     const char *dvname)
729 {
730 	u_int8_t cfg4;
731 	const char *method;
732 
733 	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
734 
735 	switch (rfchipid) {
736 	default:
737 		cfg4 |= LSHIFT(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
738 		method = "fallback";
739 		break;
740 	case RTW_RFCHIPID_INTERSIL:
741 		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
742 		method = "Intersil";
743 		break;
744 	case RTW_RFCHIPID_PHILIPS:
745 		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
746 		method = "Philips";
747 		break;
748 	case RTW_RFCHIPID_RFMD2948:
749 		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
750 		method = "RFMD";
751 		break;
752 	}
753 
754 	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
755 
756 	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
757 
758 	RTW_DPRINTF(RTW_DEBUG_INIT,
759 	    ("%s: %s RF programming method, %#02x\n", dvname, method,
760 	    RTW_READ8(regs, RTW_CONFIG4)));
761 }
762 
763 void
764 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
765 {
766 	u_int8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
767 
768 	switch (cfg0 & RTW8180_CONFIG0_GL_MASK) {
769 	case RTW8180_CONFIG0_GL_USA:
770 		*locale = RTW_LOCALE_USA;
771 		break;
772 	case RTW8180_CONFIG0_GL_JAPAN:
773 	case RTW8180_CONFIG0_GL_JAPAN2:
774 		*locale = RTW_LOCALE_JAPAN;
775 		break;
776 	case RTW8180_CONFIG0_GL_EUROPE:
777 		*locale = RTW_LOCALE_EUROPE;
778 		break;
779 	default:
780 		*locale = RTW_LOCALE_UNKNOWN;
781 		break;
782 	}
783 }
784 
785 int
786 rtw_identify_sta(struct rtw_regs *regs, u_int8_t (*addr)[IEEE80211_ADDR_LEN],
787     const char *dvname)
788 {
789 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
790 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
791 	};
792 	u_int32_t idr0 = RTW_READ(regs, RTW_IDR0),
793 	    idr1 = RTW_READ(regs, RTW_IDR1);
794 
795 	(*addr)[0] = MASK_AND_RSHIFT(idr0, 0xff);
796 	(*addr)[1] = MASK_AND_RSHIFT(idr0, 0xff00);
797 	(*addr)[2] = MASK_AND_RSHIFT(idr0, 0xff0000);
798 	(*addr)[3] = MASK_AND_RSHIFT(idr0, 0xff000000);
799 
800 	(*addr)[4] = MASK_AND_RSHIFT(idr1, 0xff);
801 	(*addr)[5] = MASK_AND_RSHIFT(idr1, 0xff00);
802 
803 	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
804 		printf("\n%s: could not get mac address, attach failed\n",
805 		    dvname);
806 		return ENXIO;
807 	}
808 
809 	printf("address %s\n", ether_sprintf(*addr));
810 
811 	return 0;
812 }
813 
814 u_int8_t
815 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
816     struct ieee80211_channel *chan)
817 {
818 	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
819 	KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
820 	    ("%s: channel %d out of range", __func__,
821 	     idx - RTW_SR_TXPOWER1 + 1));
822 	return RTW_SR_GET(sr, idx);
823 }
824 
825 void
826 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
827 {
828 	int pri;
829 	/* nfree: the number of free descriptors in each ring.
830 	 * The beacon ring is a special case: I do not let the
831 	 * driver use all of the descriptors on the beacon ring.
832 	 * The reasons are two-fold:
833 	 *
834 	 * (1) A BEACON descriptor's OWN bit is (apparently) not
835 	 * updated, so the driver cannot easily know if the descriptor
836 	 * belongs to it, or if it is racing the NIC.  If the NIC
837 	 * does not OWN every descriptor, then the driver can safely
838 	 * update the descriptors when RTW_TBDA points at tdb_next.
839 	 *
840 	 * (2) I hope that the NIC will process more than one BEACON
841 	 * descriptor in a single beacon interval, since that will
842 	 * enable multiple-BSS support.  Since the NIC does not
843 	 * clear the OWN bit, there is no natural place for it to
844 	 * stop processing BEACON desciptors.  Maybe it will *not*
845 	 * stop processing them!  I do not want to chance the NIC
846 	 * looping around and around a saturated beacon ring, so
847 	 * I will leave one descriptor unOWNed at all times.
848 	 */
849 	u_int nfree[RTW_NTXPRI] =
850 	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
851 	     RTW_NTXDESCBCN - 1};
852 
853 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
854 		tdb[pri].tdb_nfree = nfree[pri];
855 		tdb[pri].tdb_next = 0;
856 	}
857 }
858 
859 int
860 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
861 {
862 	int i;
863 	struct rtw_txsoft *ts;
864 
865 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
866 	SIMPLEQ_INIT(&tsb->tsb_freeq);
867 	for (i = 0; i < tsb->tsb_ndesc; i++) {
868 		ts = &tsb->tsb_desc[i];
869 		ts->ts_mbuf = NULL;
870 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
871 	}
872 	tsb->tsb_tx_timer = 0;
873 	return 0;
874 }
875 
876 void
877 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
878 {
879 	int pri;
880 	for (pri = 0; pri < RTW_NTXPRI; pri++)
881 		rtw_txsoft_blk_init(&tsb[pri]);
882 }
883 
884 void
885 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
886 {
887 	KASSERT(nsync <= rdb->rdb_ndesc);
888 	/* sync to end of ring */
889 	if (desc0 + nsync > rdb->rdb_ndesc) {
890 		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
891 		    offsetof(struct rtw_descs, hd_rx[desc0]),
892 		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
893 		nsync -= (rdb->rdb_ndesc - desc0);
894 		desc0 = 0;
895 	}
896 
897 	KASSERT(desc0 < rdb->rdb_ndesc);
898 	KASSERT(nsync <= rdb->rdb_ndesc);
899 	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
900 
901 	/* sync what remains */
902 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
903 	    offsetof(struct rtw_descs, hd_rx[desc0]),
904 	    sizeof(struct rtw_rxdesc) * nsync, ops);
905 }
906 
907 void
908 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
909 {
910 	/* sync to end of ring */
911 	if (desc0 + nsync > tdb->tdb_ndesc) {
912 		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
913 		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
914 		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
915 		    ops);
916 		nsync -= (tdb->tdb_ndesc - desc0);
917 		desc0 = 0;
918 	}
919 
920 	/* sync what remains */
921 	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
922 	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
923 	    sizeof(struct rtw_txdesc) * nsync, ops);
924 }
925 
926 void
927 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
928 {
929 	int i;
930 	struct rtw_rxsoft *rs;
931 
932 	for (i = 0; i < RTW_RXQLEN; i++) {
933 		rs = &desc[i];
934 		if (rs->rs_mbuf == NULL)
935 			continue;
936 		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
937 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
938 		bus_dmamap_unload(dmat, rs->rs_dmamap);
939 		m_freem(rs->rs_mbuf);
940 		rs->rs_mbuf = NULL;
941 	}
942 }
943 
944 int
945 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
946 {
947 	int rc;
948 	struct mbuf *m;
949 
950 	MGETHDR(m, M_DONTWAIT, MT_DATA);
951 	if (m == NULL)
952 		return ENOBUFS;
953 
954 	MCLGET(m, M_DONTWAIT);
955 	if ((m->m_flags & M_EXT) == 0) {
956 		m_freem(m);
957 		return ENOBUFS;
958 	}
959 
960 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
961 
962 	if (rs->rs_mbuf != NULL)
963 		bus_dmamap_unload(dmat, rs->rs_dmamap);
964 
965 	rs->rs_mbuf = NULL;
966 
967 	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
968 	if (rc != 0) {
969 		m_freem(m);
970 		return -1;
971 	}
972 
973 	rs->rs_mbuf = m;
974 
975 	return 0;
976 }
977 
978 int
979 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
980     int *ndesc, const char *dvname)
981 {
982 	int i, rc = 0;
983 	struct rtw_rxsoft *rs;
984 
985 	for (i = 0; i < RTW_RXQLEN; i++) {
986 		rs = &desc[i];
987 		/* we're in rtw_init, so there should be no mbufs allocated */
988 		KASSERT(rs->rs_mbuf == NULL);
989 #ifdef RTW_DEBUG
990 		if (i == rtw_rxbufs_limit) {
991 			printf("%s: TEST hit %d-buffer limit\n", dvname, i);
992 			rc = ENOBUFS;
993 			break;
994 		}
995 #endif /* RTW_DEBUG */
996 		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
997 			printf("%s: rtw_rxsoft_alloc failed, %d buffers, "
998 			    "rc %d\n", dvname, i, rc);
999 			break;
1000 		}
1001 	}
1002 	*ndesc = i;
1003 	return rc;
1004 }
1005 
1006 void
1007 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1008     int idx, int kick)
1009 {
1010 	int is_last = (idx == rdb->rdb_ndesc - 1);
1011 	uint32_t ctl, octl, obuf;
1012 	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1013 
1014 	obuf = rd->rd_buf;
1015 	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1016 
1017 	ctl = LSHIFT(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1018 	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1019 
1020 	if (is_last)
1021 		ctl |= RTW_RXCTL_EOR;
1022 
1023 	octl = rd->rd_ctl;
1024 	rd->rd_ctl = htole32(ctl);
1025 
1026 	RTW_DPRINTF(kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1027 	    : RTW_DEBUG_RECV_DESC,
1028 	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1029 	    letoh32(obuf), letoh32(rd->rd_buf), letoh32(octl),
1030 	    letoh32(rd->rd_ctl)));
1031 
1032 	/* sync the mbuf */
1033 	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1034 	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1035 
1036 	/* sync the descriptor */
1037 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1038 	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1039 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1040 }
1041 
1042 void
1043 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl,
1044     int kick)
1045 {
1046 	int i;
1047 	struct rtw_rxsoft *rs;
1048 
1049 	for (i = 0; i < rdb->rdb_ndesc; i++) {
1050 		rs = &ctl[i];
1051 		rtw_rxdesc_init(rdb, rs, i, kick);
1052 	}
1053 }
1054 
1055 void
1056 rtw_io_enable(struct rtw_regs *regs, u_int8_t flags, int enable)
1057 {
1058 	u_int8_t cr;
1059 
1060 	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1061 	    enable ? "enable" : "disable", flags));
1062 
1063 	cr = RTW_READ8(regs, RTW_CR);
1064 
1065 	/* XXX reference source does not enable MULRW */
1066 #if 0
1067 	/* enable PCI Read/Write Multiple */
1068 	cr |= RTW_CR_MULRW;
1069 #endif
1070 
1071 	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1072 	if (enable)
1073 		cr |= flags;
1074 	else
1075 		cr &= ~flags;
1076 	RTW_WRITE8(regs, RTW_CR, cr);
1077 	RTW_SYNC(regs, RTW_CR, RTW_CR);
1078 }
1079 
1080 void
1081 rtw_intr_rx(struct rtw_softc *sc, u_int16_t isr)
1082 {
1083 #define	IS_BEACON(__fc0)						\
1084     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1085      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1086 
1087 	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1088 							 * hardware -> net80211
1089 							 */
1090 	u_int next, nproc = 0;
1091 	int hwrate, len, rate, rssi, sq;
1092 	u_int32_t hrssi, hstat, htsfth, htsftl;
1093 	struct rtw_rxdesc *rd;
1094 	struct rtw_rxsoft *rs;
1095 	struct rtw_rxdesc_blk *rdb;
1096 	struct mbuf *m;
1097 	struct ieee80211_rxinfo rxi;
1098 	struct ieee80211_node *ni;
1099 	struct ieee80211_frame *wh;
1100 
1101 	rdb = &sc->sc_rxdesc_blk;
1102 
1103 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1104 
1105 	for (next = rdb->rdb_next; ; next = (next + 1) % rdb->rdb_ndesc) {
1106 		rtw_rxdescs_sync(rdb, next, 1,
1107 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1108 		rd = &rdb->rdb_desc[next];
1109 		rs = &sc->sc_rxsoft[next];
1110 
1111 		hstat = letoh32(rd->rd_stat);
1112 		hrssi = letoh32(rd->rd_rssi);
1113 		htsfth = letoh32(rd->rd_tsfth);
1114 		htsftl = letoh32(rd->rd_tsftl);
1115 
1116 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1117 		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1118 		    __func__, next, hstat, hrssi, htsfth, htsftl));
1119 
1120 		++nproc;
1121 
1122 		/* still belongs to NIC */
1123 		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1124 			if (nproc > 1)
1125 				break;
1126 
1127 			/* sometimes the NIC skips to the 0th descriptor */
1128 			rtw_rxdescs_sync(rdb, 0, 1,
1129 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1130 			rd = &rdb->rdb_desc[0];
1131 			if ((rd->rd_stat & htole32(RTW_RXSTAT_OWN)) != 0)
1132 				break;
1133 			RTW_DPRINTF(RTW_DEBUG_BUGS,
1134 			    ("%s: NIC skipped from rxdesc[%u] to rxdesc[0]\n",
1135 			     sc->sc_dev.dv_xname, next));
1136 			next = rdb->rdb_ndesc - 1;
1137 			continue;
1138 		}
1139 
1140 #ifdef RTW_DEBUG
1141 #define PRINTSTAT(flag) do { \
1142 	if ((hstat & flag) != 0) { \
1143 		printf("%s" #flag, delim); \
1144 		delim = ","; \
1145 	} \
1146 } while (0)
1147 		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1148 			const char *delim = "<";
1149 			printf("%s: ", sc->sc_dev.dv_xname);
1150 			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1151 				printf("status %08x", hstat);
1152 				PRINTSTAT(RTW_RXSTAT_SPLCP);
1153 				PRINTSTAT(RTW_RXSTAT_MAR);
1154 				PRINTSTAT(RTW_RXSTAT_PAR);
1155 				PRINTSTAT(RTW_RXSTAT_BAR);
1156 				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1157 				PRINTSTAT(RTW_RXSTAT_CRC32);
1158 				PRINTSTAT(RTW_RXSTAT_ICV);
1159 				printf(">, ");
1160 			}
1161 		}
1162 #undef PRINTSTAT
1163 #endif /* RTW_DEBUG */
1164 
1165 		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1166 			printf("%s: DMA error/FIFO overflow %08x, "
1167 			    "rx descriptor %d\n", sc->sc_dev.dv_xname,
1168 			    hstat & RTW_RXSTAT_IOERROR, next);
1169 			sc->sc_if.if_ierrors++;
1170 			goto next;
1171 		}
1172 
1173 		len = MASK_AND_RSHIFT(hstat, RTW_RXSTAT_LENGTH_MASK);
1174 		if (len < IEEE80211_MIN_LEN) {
1175 			sc->sc_ic.ic_stats.is_rx_tooshort++;
1176 			goto next;
1177 		}
1178 
1179 		/* CRC is included with the packet; trim it off. */
1180 		len -= IEEE80211_CRC_LEN;
1181 
1182 		hwrate = MASK_AND_RSHIFT(hstat, RTW_RXSTAT_RATE_MASK);
1183 		if (hwrate >= sizeof(ratetbl) / sizeof(ratetbl[0])) {
1184 			printf("%s: unknown rate #%d\n", sc->sc_dev.dv_xname,
1185 			    MASK_AND_RSHIFT(hstat, RTW_RXSTAT_RATE_MASK));
1186 			sc->sc_if.if_ierrors++;
1187 			goto next;
1188 		}
1189 		rate = ratetbl[hwrate];
1190 
1191 #ifdef RTW_DEBUG
1192 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1193 		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1194 		     (rate * 5) % 10, htsfth, htsftl));
1195 #endif /* RTW_DEBUG */
1196 
1197 		if ((hstat & RTW_RXSTAT_RES) != 0 &&
1198 		    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
1199 			goto next;
1200 
1201 		/* if bad flags, skip descriptor */
1202 		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1203 			printf("%s: too many rx segments\n",
1204 			    sc->sc_dev.dv_xname);
1205 			goto next;
1206 		}
1207 
1208 		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1209 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1210 
1211 		m = rs->rs_mbuf;
1212 
1213 		/* if temporarily out of memory, re-use mbuf */
1214 		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1215 		case 0:
1216 			break;
1217 		case ENOBUFS:
1218 			printf("%s: rtw_rxsoft_alloc(, %d) failed, "
1219 			    "dropping this packet\n", sc->sc_dev.dv_xname,
1220 			    next);
1221 			goto next;
1222 		default:
1223 			/* XXX shorten rx ring, instead? */
1224 			panic("%s: could not load DMA map",
1225 			    sc->sc_dev.dv_xname);
1226 		}
1227 
1228 		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1229 			rssi = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_RSSI);
1230 		else {
1231 			rssi = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_IMR_RSSI);
1232 			/* TBD find out each front-end's LNA gain in the
1233 			 * front-end's units
1234 			 */
1235 			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1236 				rssi |= 0x80;
1237 		}
1238 
1239 		sq = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_SQ);
1240 
1241 		/*
1242 		 * Note well: now we cannot recycle the rs_mbuf unless
1243 		 * we restore its original length.
1244 		 */
1245 		m->m_pkthdr.rcvif = &sc->sc_if;
1246 		m->m_pkthdr.len = m->m_len = len;
1247 
1248 		wh = mtod(m, struct ieee80211_frame *);
1249 
1250 		if (!IS_BEACON(wh->i_fc[0]))
1251 			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1252 		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1253 		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1254 
1255 		sc->sc_tsfth = htsfth;
1256 
1257 #ifdef RTW_DEBUG
1258 		if ((sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1259 		    (IFF_DEBUG|IFF_LINK2)) {
1260 			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1261 			    rate, rssi);
1262 		}
1263 #endif /* RTW_DEBUG */
1264 
1265 #if NBPFILTER > 0
1266 		if (sc->sc_radiobpf != NULL) {
1267 			struct mbuf mb;
1268 			struct ieee80211com *ic = &sc->sc_ic;
1269 			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1270 
1271 			rr->rr_tsft =
1272 			    htole64(((uint64_t)htsfth << 32) | htsftl);
1273 
1274 			rr->rr_flags = 0;
1275 			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1276 				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1277 
1278 			rr->rr_rate = rate;
1279 			rr->rr_chan_freq =
1280 			    htole16(ic->ic_bss->ni_chan->ic_freq);
1281 			rr->rr_chan_flags =
1282 			    htole16(ic->ic_bss->ni_chan->ic_flags);
1283 			rr->rr_antsignal = rssi;
1284 			rr->rr_barker_lock = htole16(sq);
1285 
1286 			mb.m_data = (caddr_t)rr;
1287 			mb.m_len = sizeof(sc->sc_rxtapu);
1288 			mb.m_next = m;
1289 			mb.m_nextpkt = NULL;
1290 			mb.m_type = 0;
1291 			mb.m_flags = 0;
1292 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_IN);
1293 		}
1294 #endif /* NBPFILTER > 0 */
1295 
1296 		rxi.rxi_flags = 0;
1297 		rxi.rxi_rssi = rssi;
1298 		rxi.rxi_tstamp = htsftl;
1299 		ieee80211_input(&sc->sc_if, m, ni, &rxi);
1300 		ieee80211_release_node(&sc->sc_ic, ni);
1301 next:
1302 		rtw_rxdesc_init(rdb, rs, next, 0);
1303 	}
1304 	rdb->rdb_next = next;
1305 
1306 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1307 
1308 	return;
1309 #undef IS_BEACON
1310 }
1311 
1312 void
1313 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1314     struct rtw_txsoft *ts)
1315 {
1316 	struct mbuf *m;
1317 	struct ieee80211_node *ni;
1318 
1319 	m = ts->ts_mbuf;
1320 	ni = ts->ts_ni;
1321 	KASSERT(m != NULL);
1322 	KASSERT(ni != NULL);
1323 	ts->ts_mbuf = NULL;
1324 	ts->ts_ni = NULL;
1325 
1326 	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1327 	    BUS_DMASYNC_POSTWRITE);
1328 	bus_dmamap_unload(dmat, ts->ts_dmamap);
1329 	m_freem(m);
1330 	ieee80211_release_node(ic, ni);
1331 }
1332 
1333 void
1334 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1335     struct rtw_txsoft_blk *tsb)
1336 {
1337 	struct rtw_txsoft *ts;
1338 
1339 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1340 		rtw_txsoft_release(dmat, ic, ts);
1341 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1342 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1343 	}
1344 	tsb->tsb_tx_timer = 0;
1345 }
1346 
1347 void
1348 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1349     struct rtw_txsoft *ts, int ndesc)
1350 {
1351 	uint32_t hstat;
1352 	int data_retry, rts_retry;
1353 	struct rtw_txdesc *tdn;
1354 	const char *condstring;
1355 
1356 	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1357 
1358 	tdb->tdb_nfree += ndesc;
1359 
1360 	tdn = &tdb->tdb_desc[ts->ts_last];
1361 
1362 	hstat = letoh32(tdn->td_stat);
1363 	rts_retry = MASK_AND_RSHIFT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1364 	data_retry = MASK_AND_RSHIFT(hstat, RTW_TXSTAT_DRC_MASK);
1365 
1366 	sc->sc_if.if_collisions += rts_retry + data_retry;
1367 
1368 	if ((hstat & RTW_TXSTAT_TOK) != 0)
1369 		condstring = "ok";
1370 	else {
1371 		sc->sc_if.if_oerrors++;
1372 		condstring = "error";
1373 	}
1374 
1375 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1376 	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1377 	    sc->sc_dev.dv_xname, ts, ts->ts_first, ts->ts_last,
1378 	    condstring, rts_retry, data_retry));
1379 }
1380 
1381 void
1382 rtw_reset_oactive(struct rtw_softc *sc)
1383 {
1384 	short oflags;
1385 	int pri;
1386 	struct rtw_txsoft_blk *tsb;
1387 	struct rtw_txdesc_blk *tdb;
1388 	oflags = sc->sc_if.if_flags;
1389 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1390 		tsb = &sc->sc_txsoft_blk[pri];
1391 		tdb = &sc->sc_txdesc_blk[pri];
1392 		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1393 			sc->sc_if.if_flags &= ~IFF_OACTIVE;
1394 	}
1395 	if (oflags != sc->sc_if.if_flags) {
1396 		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1397 		    ("%s: reset OACTIVE\n", __func__));
1398 	}
1399 }
1400 
1401 /* Collect transmitted packets. */
1402 void
1403 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1404     struct rtw_txdesc_blk *tdb, int force)
1405 {
1406 	int ndesc;
1407 	struct rtw_txsoft *ts;
1408 
1409 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1410 		ndesc = 1 + ts->ts_last - ts->ts_first;
1411 		if (ts->ts_last < ts->ts_first)
1412 			ndesc += tdb->tdb_ndesc;
1413 
1414 		KASSERT(ndesc > 0);
1415 
1416 		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1417 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1418 
1419 		if (force) {
1420 			int i;
1421 			for (i = ts->ts_first; ; i = RTW_NEXT_IDX(tdb, i)) {
1422 				tdb->tdb_desc[i].td_stat &=
1423 				    ~htole32(RTW_TXSTAT_OWN);
1424 				if (i == ts->ts_last)
1425 					break;
1426 			}
1427 			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1428 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1429 		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1430 		    htole32(RTW_TXSTAT_OWN)) != 0)
1431 			break;
1432 
1433 		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1434 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1435 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1436 	}
1437 	/* no more pending transmissions, cancel watchdog */
1438 	if (ts == NULL)
1439 		tsb->tsb_tx_timer = 0;
1440 	rtw_reset_oactive(sc);
1441 }
1442 
1443 void
1444 rtw_intr_tx(struct rtw_softc *sc, u_int16_t isr)
1445 {
1446 	int pri;
1447 	struct rtw_txsoft_blk	*tsb;
1448 	struct rtw_txdesc_blk	*tdb;
1449 
1450 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1451 		tsb = &sc->sc_txsoft_blk[pri];
1452 		tdb = &sc->sc_txdesc_blk[pri];
1453 
1454 		rtw_collect_txring(sc, tsb, tdb, 0);
1455 
1456 	}
1457 
1458 	if ((isr & RTW_INTR_TX) != 0)
1459 		rtw_start(&sc->sc_if);
1460 }
1461 
1462 #ifndef IEEE80211_STA_ONLY
1463 void
1464 rtw_intr_beacon(struct rtw_softc *sc, u_int16_t isr)
1465 {
1466 	u_int next;
1467 	uint32_t tsfth, tsftl;
1468 	struct ieee80211com *ic;
1469 	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1470 	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1471 	struct mbuf *m;
1472 
1473 	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1474 	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1475 
1476 	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1477 		next = rtw_txring_next(&sc->sc_regs, tdb);
1478 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1479 		    ("%s: beacon ring %sprocessed, isr = %#04hx"
1480 		     ", next %u expected %u, %llu\n", __func__,
1481 		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1482 		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1483 		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0){
1484 			rtw_collect_txring(sc, tsb, tdb, 1);
1485 			tdb->tdb_next = 0;
1486 		}
1487 	}
1488 	/* Start beacon transmission. */
1489 
1490 	if ((isr & RTW_INTR_BCNINT) != 0 &&
1491 	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1492 	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1493 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1494 		    ("%s: beacon prep. time, isr = %#04hx"
1495 		     ", %16llu\n", __func__, isr,
1496 		     (uint64_t)tsfth << 32 | tsftl));
1497 		ic = &sc->sc_ic;
1498 		if ((m = ieee80211_beacon_alloc(ic, ic->ic_bss)) != NULL) {
1499 			RTW_DPRINTF(RTW_DEBUG_BEACON,
1500 			    ("%s: m %p len %u\n", __func__, m, m->m_len));
1501 		}
1502 
1503 		if (m == NULL) {
1504 			printf("%s: could not allocate beacon\n",
1505 			    sc->sc_dev.dv_xname);
1506 			return;
1507 		}
1508 		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1509 		IF_ENQUEUE(&sc->sc_beaconq, m);
1510 		rtw_start(&sc->sc_if);
1511 	}
1512 }
1513 
1514 void
1515 rtw_intr_atim(struct rtw_softc *sc)
1516 {
1517 	/* TBD */
1518 	return;
1519 }
1520 #endif	/* IEEE80211_STA_ONLY */
1521 
1522 #ifdef RTW_DEBUG
1523 void
1524 rtw_dump_rings(struct rtw_softc *sc)
1525 {
1526 	struct rtw_txdesc_blk *tdb;
1527 	struct rtw_rxdesc *rd;
1528 	struct rtw_rxdesc_blk *rdb;
1529 	int desc, pri;
1530 
1531 	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1532 		return;
1533 
1534 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1535 		tdb = &sc->sc_txdesc_blk[pri];
1536 		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1537 		    tdb->tdb_ndesc, tdb->tdb_nfree);
1538 		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1539 			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1540 	}
1541 
1542 	rdb = &sc->sc_rxdesc_blk;
1543 
1544 	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1545 		rd = &rdb->rdb_desc[desc];
1546 		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1547 		    "rsvd1/tsfth %08x\n", __func__,
1548 		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1549 		    letoh32(rd->rd_ctl), letoh32(rd->rd_rssi),
1550 		    letoh32(rd->rd_buf), letoh32(rd->rd_tsfth));
1551 	}
1552 }
1553 #endif /* RTW_DEBUG */
1554 
1555 void
1556 rtw_hwring_setup(struct rtw_softc *sc)
1557 {
1558 	int pri;
1559 	struct rtw_regs *regs = &sc->sc_regs;
1560 	struct rtw_txdesc_blk *tdb;
1561 
1562 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1563 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1564 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1565 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1566 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1567 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1568 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1569 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1570 
1571 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1572 		tdb = &sc->sc_txdesc_blk[pri];
1573 		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1574 		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1575 		    ("%s: reg[tdb->tdb_basereg] <- %lx\n", __func__,
1576 		     (u_int *)tdb->tdb_base));
1577 	}
1578 
1579 	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1580 
1581 	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1582 	    ("%s: reg[RDSAR] <- %lx\n", __func__,
1583 	     (u_int *)RTW_RING_BASE(sc, hd_rx)));
1584 
1585 	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1586 }
1587 
1588 int
1589 rtw_swring_setup(struct rtw_softc *sc)
1590 {
1591 	int rc, pri;
1592 	struct rtw_rxdesc_blk *rdb;
1593 	struct rtw_txdesc_blk *tdb;
1594 
1595 	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1596 
1597 	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1598 
1599 	rdb = &sc->sc_rxdesc_blk;
1600 	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft,
1601 	    &rdb->rdb_ndesc, sc->sc_dev.dv_xname)) != 0 &&
1602 	    rdb->rdb_ndesc == 0) {
1603 		printf("%s: could not allocate rx buffers\n",
1604 		    sc->sc_dev.dv_xname);
1605 		return rc;
1606 	}
1607 
1608 	rdb = &sc->sc_rxdesc_blk;
1609 	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
1610 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1611 	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
1612 	rdb->rdb_next = 0;
1613 
1614 	tdb = &sc->sc_txdesc_blk[0];
1615 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1616 		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1617 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1618 	}
1619 	return 0;
1620 }
1621 
1622 void
1623 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
1624 {
1625 	int i;
1626 
1627 	bzero(tdb->tdb_desc, sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
1628 	for (i = 0; i < tdb->tdb_ndesc; i++)
1629 		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
1630 }
1631 
1632 u_int
1633 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
1634 {
1635 	return (letoh32(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
1636 	    sizeof(struct rtw_txdesc);
1637 }
1638 
1639 void
1640 rtw_txring_fixup(struct rtw_softc *sc)
1641 {
1642 	int pri;
1643 	u_int next;
1644 	struct rtw_txdesc_blk *tdb;
1645 	struct rtw_regs *regs = &sc->sc_regs;
1646 
1647 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1648 		tdb = &sc->sc_txdesc_blk[pri];
1649 		next = rtw_txring_next(regs, tdb);
1650 		if (tdb->tdb_next == next)
1651 			continue;
1652 		RTW_DPRINTF(RTW_DEBUG_BUGS,
1653 		    ("%s: tx-ring %d expected next %u, read %u\n", __func__,
1654 		    pri, tdb->tdb_next, next));
1655 		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
1656 	}
1657 }
1658 
1659 void
1660 rtw_rxring_fixup(struct rtw_softc *sc)
1661 {
1662 	u_int next;
1663 	uint32_t rdsar;
1664 	struct rtw_rxdesc_blk *rdb;
1665 
1666 	rdsar = letoh32(RTW_READ(&sc->sc_regs, RTW_RDSAR));
1667 	next = (rdsar - RTW_RING_BASE(sc, hd_rx)) / sizeof(struct rtw_rxdesc);
1668 
1669 	rdb = &sc->sc_rxdesc_blk;
1670 	if (rdb->rdb_next != next) {
1671 		RTW_DPRINTF(RTW_DEBUG_BUGS,
1672 		    ("%s: rx-ring expected next %u, read %u\n", __func__,
1673 		    rdb->rdb_next, next));
1674 		rdb->rdb_next = MIN(next, rdb->rdb_ndesc - 1);
1675 	}
1676 }
1677 
1678 void
1679 rtw_txdescs_reset(struct rtw_softc *sc)
1680 {
1681 	int pri;
1682 
1683 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1684 		rtw_collect_txring(sc, &sc->sc_txsoft_blk[pri],
1685 		    &sc->sc_txdesc_blk[pri], 1);
1686 	}
1687 }
1688 
1689 void
1690 rtw_intr_ioerror(struct rtw_softc *sc, u_int16_t isr)
1691 {
1692 	uint8_t cr = 0;
1693 	int xmtr = 0, rcvr = 0;
1694 	struct rtw_regs *regs = &sc->sc_regs;
1695 
1696 	if ((isr & RTW_INTR_TXFOVW) != 0) {
1697 		RTW_DPRINTF(RTW_DEBUG_BUGS,
1698 		    ("%s: tx fifo underflow\n", sc->sc_dev.dv_xname));
1699 		rcvr = xmtr = 1;
1700 		cr |= RTW_CR_TE | RTW_CR_RE;
1701 	}
1702 
1703 	if ((isr & (RTW_INTR_RDU|RTW_INTR_RXFOVW)) != 0) {
1704 		cr |= RTW_CR_RE;
1705 		rcvr = 1;
1706 	}
1707 
1708 	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: restarting xmit/recv, isr %hx"
1709 	    "\n", sc->sc_dev.dv_xname, isr));
1710 
1711 #ifdef RTW_DEBUG
1712 	rtw_dump_rings(sc);
1713 #endif /* RTW_DEBUG */
1714 
1715 	rtw_io_enable(regs, cr, 0);
1716 
1717 	/* Collect rx'd packets.  Refresh rx buffers. */
1718 	if (rcvr)
1719 		rtw_intr_rx(sc, 0);
1720 	/* Collect tx'd packets.  XXX let's hope this stops the transmit
1721 	 * timeouts.
1722 	 */
1723 	if (xmtr)
1724 		rtw_txdescs_reset(sc);
1725 
1726 	RTW_WRITE16(regs, RTW_IMR, 0);
1727 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
1728 
1729 	if (rtw_do_chip_reset) {
1730 		rtw_chip_reset1(regs, sc->sc_dev.dv_xname);
1731 	}
1732 
1733 	rtw_rxdesc_init_all(&sc->sc_rxdesc_blk, &sc->sc_rxsoft[0], 1);
1734 
1735 #ifdef RTW_DEBUG
1736 	rtw_dump_rings(sc);
1737 #endif /* RTW_DEBUG */
1738 
1739 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
1740 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
1741 	if (rcvr)
1742 		rtw_rxring_fixup(sc);
1743 	rtw_io_enable(regs, cr, 1);
1744 	if (xmtr)
1745 		rtw_txring_fixup(sc);
1746 }
1747 
1748 void
1749 rtw_suspend_ticks(struct rtw_softc *sc)
1750 {
1751 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
1752 	    ("%s: suspending ticks\n", sc->sc_dev.dv_xname));
1753 	sc->sc_do_tick = 0;
1754 }
1755 
1756 void
1757 rtw_resume_ticks(struct rtw_softc *sc)
1758 {
1759 	u_int32_t tsftrl0, tsftrl1, next_tick;
1760 
1761 	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1762 
1763 	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1764 	next_tick = tsftrl1 + 1000000;
1765 	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
1766 
1767 	sc->sc_do_tick = 1;
1768 
1769 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
1770 	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
1771 	    sc->sc_dev.dv_xname, tsftrl1 - tsftrl0, tsftrl1, next_tick));
1772 }
1773 
1774 void
1775 rtw_intr_timeout(struct rtw_softc *sc)
1776 {
1777 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", sc->sc_dev.dv_xname));
1778 	if (sc->sc_do_tick)
1779 		rtw_resume_ticks(sc);
1780 	return;
1781 }
1782 
1783 int
1784 rtw_intr(void *arg)
1785 {
1786 	int i;
1787 	struct rtw_softc *sc = arg;
1788 	struct rtw_regs *regs = &sc->sc_regs;
1789 	u_int16_t isr;
1790 
1791 	/*
1792 	 * If the interface isn't running, the interrupt couldn't
1793 	 * possibly have come from us.
1794 	 */
1795 	if ((sc->sc_flags & RTW_F_ENABLED) == 0 ||
1796 	    (sc->sc_if.if_flags & IFF_RUNNING) == 0 ||
1797 	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0) {
1798 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
1799 		     sc->sc_dev.dv_xname));
1800 		return (0);
1801 	}
1802 
1803 	for (i = 0; i < 10; i++) {
1804 		isr = RTW_READ16(regs, RTW_ISR);
1805 
1806 		RTW_WRITE16(regs, RTW_ISR, isr);
1807 		RTW_WBR(regs, RTW_ISR, RTW_ISR);
1808 
1809 		if (sc->sc_intr_ack != NULL)
1810 			(*sc->sc_intr_ack)(regs);
1811 
1812 		if (isr == 0)
1813 			break;
1814 
1815 #ifdef RTW_DEBUG
1816 #define PRINTINTR(flag) do { \
1817 	if ((isr & flag) != 0) { \
1818 		printf("%s" #flag, delim); \
1819 		delim = ","; \
1820 	} \
1821 } while (0)
1822 
1823 		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
1824 			const char *delim = "<";
1825 
1826 			printf("%s: reg[ISR] = %x", sc->sc_dev.dv_xname, isr);
1827 
1828 			PRINTINTR(RTW_INTR_TXFOVW);
1829 			PRINTINTR(RTW_INTR_TIMEOUT);
1830 			PRINTINTR(RTW_INTR_BCNINT);
1831 			PRINTINTR(RTW_INTR_ATIMINT);
1832 			PRINTINTR(RTW_INTR_TBDER);
1833 			PRINTINTR(RTW_INTR_TBDOK);
1834 			PRINTINTR(RTW_INTR_THPDER);
1835 			PRINTINTR(RTW_INTR_THPDOK);
1836 			PRINTINTR(RTW_INTR_TNPDER);
1837 			PRINTINTR(RTW_INTR_TNPDOK);
1838 			PRINTINTR(RTW_INTR_RXFOVW);
1839 			PRINTINTR(RTW_INTR_RDU);
1840 			PRINTINTR(RTW_INTR_TLPDER);
1841 			PRINTINTR(RTW_INTR_TLPDOK);
1842 			PRINTINTR(RTW_INTR_RER);
1843 			PRINTINTR(RTW_INTR_ROK);
1844 
1845 			printf(">\n");
1846 		}
1847 #undef PRINTINTR
1848 #endif /* RTW_DEBUG */
1849 
1850 		if ((isr & RTW_INTR_RX) != 0)
1851 			rtw_intr_rx(sc, isr & RTW_INTR_RX);
1852 		if ((isr & RTW_INTR_TX) != 0)
1853 			rtw_intr_tx(sc, isr & RTW_INTR_TX);
1854 #ifndef IEEE80211_STA_ONLY
1855 		if ((isr & RTW_INTR_BEACON) != 0)
1856 			rtw_intr_beacon(sc, isr & RTW_INTR_BEACON);
1857 		if ((isr & RTW_INTR_ATIMINT) != 0)
1858 			rtw_intr_atim(sc);
1859 #endif
1860 		if ((isr & RTW_INTR_IOERROR) != 0)
1861 			rtw_intr_ioerror(sc, isr & RTW_INTR_IOERROR);
1862 		if ((isr & RTW_INTR_TIMEOUT) != 0)
1863 			rtw_intr_timeout(sc);
1864 	}
1865 
1866 	return 1;
1867 }
1868 
1869 /* Must be called at splnet. */
1870 void
1871 rtw_stop(struct ifnet *ifp, int disable)
1872 {
1873 	int pri;
1874 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
1875 	struct ieee80211com *ic = &sc->sc_ic;
1876 	struct rtw_regs *regs = &sc->sc_regs;
1877 
1878 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
1879 		return;
1880 
1881 	rtw_suspend_ticks(sc);
1882 
1883 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1884 
1885 	if ((sc->sc_flags & RTW_F_INVALID) == 0) {
1886 		/* Disable interrupts. */
1887 		RTW_WRITE16(regs, RTW_IMR, 0);
1888 
1889 		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
1890 
1891 		/* Stop the transmit and receive processes. First stop DMA,
1892 		 * then disable receiver and transmitter.
1893 		 */
1894 		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
1895 
1896 		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
1897 
1898 		rtw_io_enable(&sc->sc_regs, RTW_CR_RE|RTW_CR_TE, 0);
1899 	}
1900 
1901 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1902 		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
1903 		    &sc->sc_txsoft_blk[pri]);
1904 	}
1905 
1906 	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
1907 
1908 	if (disable)
1909 		rtw_disable(sc);
1910 
1911 	/* Mark the interface as not running.  Cancel the watchdog timer. */
1912 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1913 	ifp->if_timer = 0;
1914 
1915 	return;
1916 }
1917 
1918 #ifdef RTW_DEBUG
1919 const char *
1920 rtw_pwrstate_string(enum rtw_pwrstate power)
1921 {
1922 	switch (power) {
1923 	case RTW_ON:
1924 		return "on";
1925 	case RTW_SLEEP:
1926 		return "sleep";
1927 	case RTW_OFF:
1928 		return "off";
1929 	default:
1930 		return "unknown";
1931 	}
1932 }
1933 #endif
1934 
1935 /* XXX For Maxim, I am using the RFMD settings gleaned from the
1936  * reference driver, plus a magic Maxim "ON" value that comes from
1937  * the Realtek document "Windows PG for Rtl8180."
1938  */
1939 void
1940 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
1941     int before_rf, int digphy)
1942 {
1943 	u_int32_t anaparm;
1944 
1945 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
1946 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
1947 
1948 	switch (power) {
1949 	case RTW_OFF:
1950 		if (before_rf)
1951 			return;
1952 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
1953 		anaparm |= RTW_ANAPARM_TXDACOFF;
1954 		break;
1955 	case RTW_SLEEP:
1956 		if (!before_rf)
1957 			return;
1958 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
1959 		anaparm |= RTW_ANAPARM_TXDACOFF;
1960 		break;
1961 	case RTW_ON:
1962 		if (!before_rf)
1963 			return;
1964 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
1965 		break;
1966 	}
1967 	RTW_DPRINTF(RTW_DEBUG_PWR,
1968 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
1969 	    __func__, rtw_pwrstate_string(power),
1970 	    (before_rf) ? "before" : "after", anaparm));
1971 
1972 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
1973 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
1974 }
1975 
1976 /* XXX I am using the RFMD settings gleaned from the reference
1977  * driver.  They agree
1978  */
1979 void
1980 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
1981     int before_rf, int digphy)
1982 {
1983 	u_int32_t anaparm;
1984 
1985 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
1986 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
1987 
1988 	switch (power) {
1989 	case RTW_OFF:
1990 		if (before_rf)
1991 			return;
1992 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
1993 		anaparm |= RTW_ANAPARM_TXDACOFF;
1994 		break;
1995 	case RTW_SLEEP:
1996 		if (!before_rf)
1997 			return;
1998 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
1999 		anaparm |= RTW_ANAPARM_TXDACOFF;
2000 		break;
2001 	case RTW_ON:
2002 		if (!before_rf)
2003 			return;
2004 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2005 		break;
2006 	}
2007 	RTW_DPRINTF(RTW_DEBUG_PWR,
2008 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2009 	    __func__, rtw_pwrstate_string(power),
2010 	    (before_rf) ? "before" : "after", anaparm));
2011 
2012 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
2013 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
2014 }
2015 
2016 void
2017 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2018     int before_rf, int digphy)
2019 {
2020 	u_int32_t anaparm;
2021 
2022 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
2023 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2024 
2025 	switch (power) {
2026 	case RTW_OFF:
2027 		if (before_rf)
2028 			return;
2029 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2030 		anaparm |= RTW_ANAPARM_TXDACOFF;
2031 		break;
2032 	case RTW_SLEEP:
2033 		if (!before_rf)
2034 			return;
2035 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2036 		anaparm |= RTW_ANAPARM_TXDACOFF;
2037 		break;
2038 	case RTW_ON:
2039 		if (!before_rf)
2040 			return;
2041 		if (digphy) {
2042 			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2043 			/* XXX guess */
2044 			anaparm |= RTW_ANAPARM_TXDACOFF;
2045 		} else
2046 			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2047 		break;
2048 	}
2049 	RTW_DPRINTF(RTW_DEBUG_PWR,
2050 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2051 	    __func__, rtw_pwrstate_string(power),
2052 	    (before_rf) ? "before" : "after", anaparm));
2053 
2054 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
2055 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
2056 }
2057 
2058 void
2059 rtw_rtl_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2060     int before_rf, int digphy)
2061 {
2062 	/* empty */
2063 }
2064 
2065 void
2066 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2067     int digphy)
2068 {
2069 	struct rtw_regs *regs = &sc->sc_regs;
2070 
2071 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2072 
2073 	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2074 
2075 	rtw_set_access(regs, RTW_ACCESS_NONE);
2076 
2077 	return;
2078 }
2079 
2080 int
2081 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2082 {
2083 	int rc;
2084 
2085 	RTW_DPRINTF(RTW_DEBUG_PWR,
2086 	    ("%s: %s->%s\n", __func__,
2087 	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2088 
2089 	if (sc->sc_pwrstate == power)
2090 		return 0;
2091 
2092 	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2093 	rc = (*sc->sc_rf_pwrstate)(sc, power);
2094 	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2095 
2096 	switch (power) {
2097 	case RTW_ON:
2098 		/* TBD set LEDs */
2099 		break;
2100 	case RTW_SLEEP:
2101 		/* TBD */
2102 		break;
2103 	case RTW_OFF:
2104 		/* TBD */
2105 		break;
2106 	}
2107 	if (rc == 0)
2108 		sc->sc_pwrstate = power;
2109 	else
2110 		sc->sc_pwrstate = RTW_OFF;
2111 	return rc;
2112 }
2113 
2114 int
2115 rtw_tune(struct rtw_softc *sc)
2116 {
2117 	struct ieee80211com *ic = &sc->sc_ic;
2118 	u_int chan, idx;
2119 	u_int8_t txpower;
2120 	int rc;
2121 
2122 	KASSERT(ic->ic_bss->ni_chan != NULL);
2123 
2124 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
2125 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2126 		return 0;
2127 
2128 	if (chan == sc->sc_cur_chan) {
2129 		RTW_DPRINTF(RTW_DEBUG_TUNE,
2130 		    ("%s: already tuned chan #%d\n", __func__, chan));
2131 		return 0;
2132 	}
2133 
2134 	rtw_suspend_ticks(sc);
2135 
2136 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
2137 
2138 	/* TBD wait for Tx to complete */
2139 
2140 	KASSERT((sc->sc_flags & RTW_F_ENABLED) != 0);
2141 
2142 	idx = RTW_SR_TXPOWER1 +
2143 	    ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan) - 1;
2144 	KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
2145 	    ("%s: channel %d out of range", __func__,
2146 	     idx - RTW_SR_TXPOWER1 + 1));
2147 	txpower =  RTW_SR_GET(&sc->sc_srom, idx);
2148 
2149 	if ((rc = rtw_phy_init(sc)) != 0) {
2150 		/* XXX condition on powersaving */
2151 		printf("%s: phy init failed\n", sc->sc_dev.dv_xname);
2152 	}
2153 
2154 	sc->sc_cur_chan = chan;
2155 
2156 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 1);
2157 
2158 	rtw_resume_ticks(sc);
2159 
2160 	return rc;
2161 }
2162 
2163 void
2164 rtw_disable(struct rtw_softc *sc)
2165 {
2166 	int rc;
2167 
2168 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2169 		return;
2170 
2171 	/* turn off PHY */
2172 	if ((sc->sc_flags & RTW_F_INVALID) == 0 &&
2173 	    (rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2174 		printf("%s: failed to turn off PHY (%d)\n",
2175 		    sc->sc_dev.dv_xname, rc);
2176 	}
2177 
2178 	if (sc->sc_disable != NULL)
2179 		(*sc->sc_disable)(sc);
2180 
2181 	sc->sc_flags &= ~RTW_F_ENABLED;
2182 }
2183 
2184 int
2185 rtw_enable(struct rtw_softc *sc)
2186 {
2187 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
2188 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2189 			printf("%s: device enable failed\n",
2190 			    sc->sc_dev.dv_xname);
2191 			return (EIO);
2192 		}
2193 		sc->sc_flags |= RTW_F_ENABLED;
2194 	}
2195 	return (0);
2196 }
2197 
2198 void
2199 rtw_transmit_config(struct rtw_softc *sc)
2200 {
2201 	struct rtw_regs *regs = &sc->sc_regs;
2202 	u_int32_t tcr;
2203 
2204 	tcr = RTW_READ(regs, RTW_TCR);
2205 
2206 	tcr |= RTW_TCR_CWMIN;
2207 	tcr &= ~RTW_TCR_MXDMA_MASK;
2208 	tcr |= RTW_TCR_MXDMA_256;
2209 	if ((sc->sc_flags & RTW_F_RTL8185) == 0)
2210 		tcr |= RTW8180_TCR_SAT;		/* send ACK as fast as possible */
2211 	tcr &= ~RTW_TCR_LBK_MASK;
2212 	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2213 
2214 	/* set short/long retry limits */
2215 	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2216 	tcr |= LSHIFT(4, RTW_TCR_SRL_MASK) | LSHIFT(4, RTW_TCR_LRL_MASK);
2217 
2218 	tcr &= ~RTW_TCR_CRC;    /* NIC appends CRC32 */
2219 
2220 	RTW_WRITE(regs, RTW_TCR, tcr);
2221 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2222 }
2223 
2224 void
2225 rtw_enable_interrupts(struct rtw_softc *sc)
2226 {
2227 	struct rtw_regs *regs = &sc->sc_regs;
2228 
2229 	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2230 	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2231 
2232 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2233 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2234 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2235 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2236 
2237 	/* XXX necessary? */
2238 	if (sc->sc_intr_ack != NULL)
2239 		(*sc->sc_intr_ack)(regs);
2240 }
2241 
2242 void
2243 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2244 {
2245 	uint8_t msr;
2246 
2247 	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2248 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2249 
2250 	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2251 
2252 	switch (opmode) {
2253 #ifndef IEEE80211_STA_ONLY
2254 	case IEEE80211_M_AHDEMO:
2255 	case IEEE80211_M_IBSS:
2256 		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2257 		break;
2258 	case IEEE80211_M_HOSTAP:
2259 		msr |= RTW_MSR_NETYPE_AP_OK;
2260 		break;
2261 #endif
2262 	case IEEE80211_M_MONITOR:
2263 		/* XXX */
2264 		msr |= RTW_MSR_NETYPE_NOLINK;
2265 		break;
2266 	case IEEE80211_M_STA:
2267 		msr |= RTW_MSR_NETYPE_INFRA_OK;
2268 		break;
2269 	default:
2270 		break;
2271 	}
2272 	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2273 
2274 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2275 }
2276 
2277 void
2278 rtw_pktfilt_load(struct rtw_softc *sc)
2279 {
2280 	struct rtw_regs *regs = &sc->sc_regs;
2281 	struct ieee80211com *ic = &sc->sc_ic;
2282 	struct arpcom *ec = &ic->ic_ac;
2283 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2284 	int hash;
2285 	u_int32_t hashes[2] = { 0, 0 };
2286 	struct ether_multi *enm;
2287 	struct ether_multistep step;
2288 
2289 	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2290 
2291 	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2292 	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW8180_RCR_RXFTH_MASK);
2293 
2294 	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2295 	/* MAC auto-reset PHY (huh?) */
2296 	sc->sc_rcr |= RTW_RCR_ENMARP;
2297 	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2298 	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW8180_RCR_RXFTH_WHOLE;
2299 
2300 	switch (ic->ic_opmode) {
2301 	case IEEE80211_M_MONITOR:
2302 		sc->sc_rcr |= RTW_RCR_MONITOR;
2303 		break;
2304 #ifndef IEEE80211_STA_ONLY
2305 	case IEEE80211_M_AHDEMO:
2306 	case IEEE80211_M_IBSS:
2307 		/* receive broadcasts in our BSS */
2308 		sc->sc_rcr |= RTW_RCR_ADD3;
2309 		break;
2310 #endif
2311 	default:
2312 		break;
2313 	}
2314 
2315 	ifp->if_flags &= ~IFF_ALLMULTI;
2316 
2317 	/* XXX accept all broadcast if scanning */
2318 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2319 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2320 
2321 	if (ifp->if_flags & IFF_PROMISC) {
2322 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2323 allmulti:
2324 		ifp->if_flags |= IFF_ALLMULTI;
2325 		goto setit;
2326 	}
2327 
2328 	/*
2329 	 * Program the 64-bit multicast hash filter.
2330 	 */
2331 	ETHER_FIRST_MULTI(step, ec, enm);
2332 	while (enm != NULL) {
2333 		/* XXX */
2334 		if (bcmp(enm->enm_addrlo, enm->enm_addrhi,
2335 		    ETHER_ADDR_LEN) != 0)
2336 			goto allmulti;
2337 
2338 		hash = ether_crc32_be((enm->enm_addrlo),
2339 		    IEEE80211_ADDR_LEN) >> 26;
2340 		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2341 		sc->sc_rcr |= RTW_RCR_AM;
2342 		ETHER_NEXT_MULTI(step, enm);
2343 	}
2344 
2345 	/* all bits set => hash is useless */
2346 	if (~(hashes[0] & hashes[1]) == 0)
2347 		goto allmulti;
2348 
2349  setit:
2350 	if (ifp->if_flags & IFF_ALLMULTI) {
2351 		sc->sc_rcr |= RTW_RCR_AM;	/* accept all multicast */
2352 		hashes[0] = hashes[1] = 0xffffffff;
2353 	}
2354 
2355 	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2356 	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2357 	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2358 	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2359 
2360 	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2361 	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2362 	    sc->sc_dev.dv_xname, RTW_READ(regs, RTW_MAR0),
2363 	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2364 
2365 	return;
2366 }
2367 
2368 /* Must be called at splnet. */
2369 int
2370 rtw_init(struct ifnet *ifp)
2371 {
2372 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2373 	struct ieee80211com *ic = &sc->sc_ic;
2374 	struct rtw_regs *regs = &sc->sc_regs;
2375 	int rc = 0;
2376 
2377 	if ((rc = rtw_enable(sc)) != 0)
2378 		goto out;
2379 
2380 	/* Cancel pending I/O and reset. */
2381 	rtw_stop(ifp, 0);
2382 
2383 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2384 	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2385 	    __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
2386 	    ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
2387 
2388 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2389 		goto out;
2390 
2391 	if ((rc = rtw_swring_setup(sc)) != 0)
2392 		goto out;
2393 
2394 	rtw_transmit_config(sc);
2395 
2396 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2397 
2398 	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2399 	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2400 
2401 	/* long PLCP header, 1Mb/2Mb basic rate */
2402 	if (sc->sc_flags & RTW_F_RTL8185)
2403 		RTW_WRITE16(regs, RTW_BRSR, RTW8185_BRSR_MBR_2MBPS);
2404 	else
2405 		RTW_WRITE16(regs, RTW_BRSR, RTW8180_BRSR_MBR_2MBPS);
2406 	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2407 
2408 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2409 	rtw_set_access(regs, RTW_ACCESS_NONE);
2410 
2411 	/* XXX from reference sources */
2412 	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2413 	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2414 
2415 	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev.dv_xname);
2416 
2417 	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2418 	/* from Linux driver */
2419 	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2420 
2421 	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2422 
2423 	rtw_enable_interrupts(sc);
2424 
2425 	rtw_pktfilt_load(sc);
2426 
2427 	rtw_hwring_setup(sc);
2428 
2429 	rtw_io_enable(regs, RTW_CR_RE|RTW_CR_TE, 1);
2430 
2431 	ifp->if_flags |= IFF_RUNNING;
2432 	ic->ic_state = IEEE80211_S_INIT;
2433 
2434 	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2435 	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2436 
2437 	rtw_resume_ticks(sc);
2438 
2439 	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2440 
2441 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2442 		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2443 	else
2444 		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2445 
2446 out:
2447 	printf("%s: interface not running\n", sc->sc_dev.dv_xname);
2448 	return rc;
2449 }
2450 
2451 void
2452 rtw_led_init(struct rtw_regs *regs)
2453 {
2454 	u_int8_t cfg0, cfg1;
2455 
2456 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2457 
2458 	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2459 	cfg0 |= RTW8180_CONFIG0_LEDGPOEN;
2460 	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2461 
2462 	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2463 	RTW_DPRINTF(RTW_DEBUG_LED,
2464 	    ("%s: read % from reg[CONFIG1]\n", __func__, cfg1));
2465 
2466 	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2467 	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2468 	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2469 
2470 	rtw_set_access(regs, RTW_ACCESS_NONE);
2471 }
2472 
2473 /*
2474  * IEEE80211_S_INIT: 		LED1 off
2475  *
2476  * IEEE80211_S_AUTH,
2477  * IEEE80211_S_ASSOC,
2478  * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2479  *
2480  * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2481  */
2482 void
2483 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2484 {
2485 	struct rtw_led_state *ls;
2486 
2487 	ls = &sc->sc_led_state;
2488 
2489 	switch (nstate) {
2490 	case IEEE80211_S_INIT:
2491 		rtw_led_init(&sc->sc_regs);
2492 		timeout_del(&ls->ls_slow_ch);
2493 		timeout_del(&ls->ls_fast_ch);
2494 		ls->ls_slowblink = 0;
2495 		ls->ls_actblink = 0;
2496 		ls->ls_default = 0;
2497 		break;
2498 	case IEEE80211_S_SCAN:
2499 		timeout_add_msec(&ls->ls_slow_ch, RTW_LED_SLOW_MSEC);
2500 		timeout_add_msec(&ls->ls_fast_ch, RTW_LED_FAST_MSEC);
2501 		/*FALLTHROUGH*/
2502 	case IEEE80211_S_AUTH:
2503 	case IEEE80211_S_ASSOC:
2504 		ls->ls_default = RTW_LED1;
2505 		ls->ls_actblink = RTW_LED1;
2506 		ls->ls_slowblink = RTW_LED1;
2507 		break;
2508 	case IEEE80211_S_RUN:
2509 		ls->ls_slowblink = 0;
2510 		break;
2511 	}
2512 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2513 }
2514 
2515 void
2516 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, u_int hwverid)
2517 {
2518 	u_int8_t led_condition;
2519 	bus_size_t ofs;
2520 	u_int8_t mask, newval, val;
2521 
2522 	led_condition = ls->ls_default;
2523 
2524 	if (ls->ls_state & RTW_LED_S_SLOW)
2525 		led_condition ^= ls->ls_slowblink;
2526 	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2527 		led_condition ^= ls->ls_actblink;
2528 
2529 	RTW_DPRINTF(RTW_DEBUG_LED,
2530 	    ("%s: LED condition %\n", __func__, led_condition));
2531 
2532 	switch (hwverid) {
2533 	default:
2534 	case RTW_TCR_HWVERID_RTL8180F:
2535 		ofs = RTW_PSR;
2536 		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2537 		if (led_condition & RTW_LED0)
2538 			newval &= ~RTW_PSR_LEDGPO0;
2539 		if (led_condition & RTW_LED1)
2540 			newval &= ~RTW_PSR_LEDGPO1;
2541 		break;
2542 	case RTW_TCR_HWVERID_RTL8180D:
2543 		ofs = RTW_9346CR;
2544 		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2545 		newval = RTW_9346CR_EEM_PROGRAM;
2546 		if (led_condition & RTW_LED0)
2547 			newval |= RTW_9346CR_EEDI;
2548 		if (led_condition & RTW_LED1)
2549 			newval |= RTW_9346CR_EECS;
2550 		break;
2551 	}
2552 	val = RTW_READ8(regs, ofs);
2553 	RTW_DPRINTF(RTW_DEBUG_LED,
2554 	    ("%s: read % from reg[%#02]\n", __func__, val,
2555 	     (u_int *)ofs));
2556 	val &= ~mask;
2557 	val |= newval;
2558 	RTW_WRITE8(regs, ofs, val);
2559 	RTW_DPRINTF(RTW_DEBUG_LED,
2560 	    ("%s: wrote % to reg[%#02]\n", __func__, val,
2561 	     (u_int *)ofs));
2562 	RTW_SYNC(regs, ofs, ofs);
2563 }
2564 
2565 void
2566 rtw_led_fastblink(void *arg)
2567 {
2568 	int ostate, s;
2569 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2570 	struct rtw_led_state *ls = &sc->sc_led_state;
2571 
2572 	s = splnet();
2573 	ostate = ls->ls_state;
2574 	ls->ls_state ^= ls->ls_event;
2575 
2576 	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2577 		ls->ls_state &= ~RTW_LED_S_TX;
2578 
2579 	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2580 		ls->ls_state &= ~RTW_LED_S_RX;
2581 
2582 	ls->ls_event = 0;
2583 
2584 	if (ostate != ls->ls_state)
2585 		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2586 	splx(s);
2587 
2588 	timeout_add_msec(&ls->ls_fast_ch, RTW_LED_FAST_MSEC);
2589 }
2590 
2591 void
2592 rtw_led_slowblink(void *arg)
2593 {
2594 	int s;
2595 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2596 	struct rtw_led_state *ls = &sc->sc_led_state;
2597 
2598 	s = splnet();
2599 	ls->ls_state ^= RTW_LED_S_SLOW;
2600 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2601 	splx(s);
2602 	timeout_add_msec(&ls->ls_slow_ch, RTW_LED_SLOW_MSEC);
2603 }
2604 
2605 void
2606 rtw_led_attach(struct rtw_led_state *ls, void *arg)
2607 {
2608 	timeout_set(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2609 	timeout_set(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2610 }
2611 
2612 int
2613 rtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2614 {
2615 	struct rtw_softc *sc = ifp->if_softc;
2616 	struct ieee80211com *ic = &sc->sc_ic;
2617 	struct ifaddr *ifa = (struct ifaddr *)data;
2618 	struct ifreq *ifr = (struct ifreq *)data;
2619 	int rc = 0, s;
2620 
2621 	s = splnet();
2622 
2623 	switch (cmd) {
2624 	case SIOCSIFADDR:
2625 		ifp->if_flags |= IFF_UP;
2626 #ifdef INET
2627 		if (ifa->ifa_addr->sa_family == AF_INET) {
2628 			arp_ifinit(&ic->ic_ac, ifa);
2629 		}
2630 #endif  /* INET */
2631 		/* FALLTHROUGH */
2632 
2633 	case SIOCSIFFLAGS:
2634 		if ((ifp->if_flags & IFF_UP) != 0) {
2635 			if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
2636 				rtw_pktfilt_load(sc);
2637 			} else
2638 				rc = rtw_init(ifp);
2639 		} else if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2640 			rtw_stop(ifp, 1);
2641 		break;
2642 
2643 	case SIOCADDMULTI:
2644 	case SIOCDELMULTI:
2645 		if (cmd == SIOCADDMULTI)
2646 			rc = ether_addmulti(ifr, &sc->sc_ic.ic_ac);
2647 		else
2648 			rc = ether_delmulti(ifr, &sc->sc_ic.ic_ac);
2649 		if (rc != ENETRESET)
2650 			break;
2651 		if (ifp->if_flags & IFF_RUNNING)
2652 			rtw_pktfilt_load(sc);
2653 		rc = 0;
2654 		break;
2655 
2656 	default:
2657 		if ((rc = ieee80211_ioctl(ifp, cmd, data)) == ENETRESET) {
2658 			if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2659 				rc = rtw_init(ifp);
2660 			else
2661 				rc = 0;
2662 		}
2663 		break;
2664 	}
2665 
2666 	splx(s);
2667 	return rc;
2668 }
2669 
2670 /* Select a transmit ring with at least one h/w and s/w descriptor free.
2671  * Return 0 on success, -1 on failure.
2672  */
2673 int
2674 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
2675     struct rtw_txdesc_blk **tdbp, int pri)
2676 {
2677 	struct rtw_txsoft_blk *tsb;
2678 	struct rtw_txdesc_blk *tdb;
2679 
2680 	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
2681 
2682 	tsb = &sc->sc_txsoft_blk[pri];
2683 	tdb = &sc->sc_txdesc_blk[pri];
2684 
2685 	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
2686 		if (tsb->tsb_tx_timer == 0)
2687 			tsb->tsb_tx_timer = 5;
2688 		*tsbp = NULL;
2689 		*tdbp = NULL;
2690 		return -1;
2691 	}
2692 	*tsbp = tsb;
2693 	*tdbp = tdb;
2694 	return 0;
2695 }
2696 
2697 struct mbuf *
2698 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
2699     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
2700     struct ieee80211_node **nip, short *if_flagsp)
2701 {
2702 	struct mbuf *m;
2703 
2704 	if (IF_IS_EMPTY(ifq))
2705 		return NULL;
2706 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
2707 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
2708 		    __func__, pri));
2709 		*if_flagsp |= IFF_OACTIVE;
2710 		sc->sc_if.if_timer = 1;
2711 		return NULL;
2712 	}
2713 	IF_DEQUEUE(ifq, m);
2714 	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2715 	m->m_pkthdr.rcvif = NULL;
2716 	return m;
2717 }
2718 
2719 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
2720  * at the driver's selection of transmit control block for the packet.
2721  */
2722 int
2723 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
2724     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
2725     struct ieee80211_node **nip)
2726 {
2727 	struct ieee80211com *ic;
2728 	struct ieee80211_frame *wh;
2729 	struct ieee80211_key *k;
2730 	struct mbuf *m0;
2731 	struct rtw_softc *sc;
2732 	short *if_flagsp;
2733 
2734 	sc = (struct rtw_softc *)ifp->if_softc;
2735 	ic = &sc->sc_ic;
2736 
2737 	DPRINTF(sc, RTW_DEBUG_XMIT,
2738 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
2739 
2740 	if_flagsp = &ifp->if_flags;
2741 
2742 	if (ic->ic_state == IEEE80211_S_RUN &&
2743 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
2744 	    tdbp, nip, if_flagsp)) != NULL) {
2745 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
2746 		    __func__));
2747 		return 0;
2748 	}
2749 
2750 	if ((*mp = rtw_80211_dequeue(sc, &ic->ic_mgtq, RTW_TXPRIMD, tsbp,
2751 	    tdbp, nip, if_flagsp)) != NULL) {
2752 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
2753 		    __func__));
2754 		return 0;
2755 	}
2756 
2757 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
2758 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
2759 		return 0;
2760 	}
2761 
2762 	if ((*mp = rtw_80211_dequeue(sc, &ic->ic_pwrsaveq, RTW_TXPRIHI,
2763 	    tsbp, tdbp, nip, if_flagsp)) != NULL) {
2764 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue pwrsave frame\n",
2765 		    __func__));
2766 		return 0;
2767 	}
2768 
2769 	if (ic->ic_state != IEEE80211_S_RUN) {
2770 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
2771 		return 0;
2772 	}
2773 
2774 	*mp = NULL;
2775 
2776 	IFQ_POLL(&ifp->if_snd, m0);
2777 	if (m0 == NULL) {
2778 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
2779 		    __func__));
2780 		return 0;
2781 	}
2782 
2783 	if (rtw_txring_choose(sc, tsbp, tdbp, RTW_TXPRIMD) == -1) {
2784 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no descriptor\n", __func__));
2785 		*if_flagsp |= IFF_OACTIVE;
2786 		sc->sc_if.if_timer = 1;
2787 		return 0;
2788 	}
2789 
2790 	IFQ_DEQUEUE(&ifp->if_snd, m0);
2791 	if (m0 == NULL) {
2792 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame/ring ready\n",
2793 		    __func__));
2794 		return 0;
2795 	}
2796 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
2797 	ifp->if_opackets++;
2798 #if NBPFILTER > 0
2799 	if (ifp->if_bpf)
2800 		bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
2801 #endif
2802 	if ((m0 = ieee80211_encap(ifp, m0, nip)) == NULL) {
2803 		DPRINTF(sc, RTW_DEBUG_XMIT,
2804 		    ("%s: encap error\n", __func__));
2805 		ifp->if_oerrors++;
2806 		return -1;
2807 	}
2808 
2809 	/* XXX should do WEP in hardware */
2810 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2811 		wh = mtod(m0, struct ieee80211_frame *);
2812 		k = ieee80211_get_txkey(ic, wh, *nip);
2813 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
2814 			return -1;
2815 	}
2816 
2817 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
2818 	*mp = m0;
2819 	return 0;
2820 }
2821 
2822 int
2823 rtw_seg_too_short(bus_dmamap_t dmamap)
2824 {
2825 	int i;
2826 	for (i = 0; i < dmamap->dm_nsegs; i++) {
2827 		if (dmamap->dm_segs[i].ds_len < 4) {
2828 			printf("%s: segment too short\n", __func__);
2829 			return 1;
2830 		}
2831 	}
2832 	return 0;
2833 }
2834 
2835 /* TBD factor with atw_start */
2836 struct mbuf *
2837 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
2838     u_int ndescfree, short *ifflagsp, const char *dvname)
2839 {
2840 	int first, rc;
2841 	struct mbuf *m, *m0;
2842 
2843 	m0 = chain;
2844 
2845 	/*
2846 	 * Load the DMA map.  Copy and try (once) again if the packet
2847 	 * didn't fit in the alloted number of segments.
2848 	 */
2849 	for (first = 1;
2850 	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
2851 	     BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
2852 	     dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
2853 	     first = 0) {
2854 		if (rc == 0)
2855 			bus_dmamap_unload(dmat, dmam);
2856 		MGETHDR(m, M_DONTWAIT, MT_DATA);
2857 		if (m == NULL) {
2858 			printf("%s: unable to allocate Tx mbuf\n",
2859 			    dvname);
2860 			break;
2861 		}
2862 		if (m0->m_pkthdr.len > MHLEN) {
2863 			MCLGET(m, M_DONTWAIT);
2864 			if ((m->m_flags & M_EXT) == 0) {
2865 				printf("%s: cannot allocate Tx cluster\n",
2866 				    dvname);
2867 				m_freem(m);
2868 				break;
2869 			}
2870 		}
2871 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
2872 		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
2873 		m_freem(m0);
2874 		m0 = m;
2875 		m = NULL;
2876 	}
2877 	if (rc != 0) {
2878 		printf("%s: cannot load Tx buffer, rc = %d\n", dvname, rc);
2879 		m_freem(m0);
2880 		return NULL;
2881 	} else if (rtw_seg_too_short(dmam)) {
2882 		printf("%s: cannot load Tx buffer, segment too short\n",
2883 		    dvname);
2884 		bus_dmamap_unload(dmat, dmam);
2885 		m_freem(m0);
2886 		return NULL;
2887 	} else if (dmam->dm_nsegs > ndescfree) {
2888 		printf("%s: too many tx segments\n", dvname);
2889 		bus_dmamap_unload(dmat, dmam);
2890 		m_freem(m0);
2891 		return NULL;
2892 	}
2893 	return m0;
2894 }
2895 
2896 
2897 /*
2898  * Arguments in:
2899  *
2900  * paylen:  payload length (no FCS, no WEP header)
2901  *
2902  * hdrlen:  header length
2903  *
2904  * rate:    MSDU speed, units 500kb/s
2905  *
2906  * flags:   IEEE80211_F_SHPREAMBLE (use short preamble),
2907  *          IEEE80211_F_SHSLOT (use short slot length)
2908  *
2909  * Arguments out:
2910  *
2911  * d:       802.11 Duration field for RTS,
2912  *          802.11 Duration field for data frame,
2913  *          PLCP Length for data frame,
2914  *          residual octets at end of data slot
2915  */
2916 int
2917 rtw_compute_duration1(int len, int use_ack, uint32_t flags, int rate,
2918     struct rtw_duration *d)
2919 {
2920 	int pre, ctsrate;
2921 	int ack, bitlen, data_dur, remainder;
2922 
2923 	/* RTS reserves medium for SIFS | CTS | SIFS | (DATA) | SIFS | ACK
2924 	 * DATA reserves medium for SIFS | ACK
2925 	 *
2926 	 * XXXMYC: no ACK on multicast/broadcast or control packets
2927 	 */
2928 
2929 	bitlen = len * 8;
2930 
2931 	pre = IEEE80211_DUR_DS_SIFS;
2932 	if ((flags & IEEE80211_F_SHPREAMBLE) != 0)
2933 		pre += IEEE80211_DUR_DS_SHORT_PREAMBLE +
2934 		    IEEE80211_DUR_DS_FAST_PLCPHDR;
2935 	else
2936 		pre += IEEE80211_DUR_DS_LONG_PREAMBLE +
2937 		    IEEE80211_DUR_DS_SLOW_PLCPHDR;
2938 
2939 	d->d_residue = 0;
2940 	data_dur = (bitlen * 2) / rate;
2941 	remainder = (bitlen * 2) % rate;
2942 	if (remainder != 0) {
2943 		d->d_residue = (rate - remainder) / 16;
2944 		data_dur++;
2945 	}
2946 
2947 	switch (rate) {
2948 	case 2:		/* 1 Mb/s */
2949 	case 4:		/* 2 Mb/s */
2950 		/* 1 - 2 Mb/s WLAN: send ACK/CTS at 1 Mb/s */
2951 		ctsrate = 2;
2952 		break;
2953 	case 11:	/* 5.5 Mb/s */
2954 	case 22:	/* 11  Mb/s */
2955 	case 44:	/* 22  Mb/s */
2956 		/* 5.5 - 11 Mb/s WLAN: send ACK/CTS at 2 Mb/s */
2957 		ctsrate = 4;
2958 		break;
2959 	default:
2960 		/* TBD */
2961 		return -1;
2962 	}
2963 
2964 	d->d_plcp_len = data_dur;
2965 
2966 	ack = (use_ack) ? pre + (IEEE80211_DUR_DS_SLOW_ACK * 2) / ctsrate : 0;
2967 
2968 	d->d_rts_dur =
2969 	    pre + (IEEE80211_DUR_DS_SLOW_CTS * 2) / ctsrate +
2970 	    pre + data_dur +
2971 	    ack;
2972 
2973 	d->d_data_dur = ack;
2974 
2975 	return 0;
2976 }
2977 
2978 /*
2979  * Arguments in:
2980  *
2981  * wh:      802.11 header
2982  *
2983  * len: packet length
2984  *
2985  * rate:    MSDU speed, units 500kb/s
2986  *
2987  * fraglen: fragment length, set to maximum (or higher) for no
2988  *          fragmentation
2989  *
2990  * flags:   IEEE80211_F_WEPON (hardware adds WEP),
2991  *          IEEE80211_F_SHPREAMBLE (use short preamble),
2992  *          IEEE80211_F_SHSLOT (use short slot length)
2993  *
2994  * Arguments out:
2995  *
2996  * d0: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
2997  *     of first/only fragment
2998  *
2999  * dn: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
3000  *     of first/only fragment
3001  */
3002 int
3003 rtw_compute_duration(struct ieee80211_frame *wh, int len, uint32_t flags,
3004     int fraglen, int rate, struct rtw_duration *d0, struct rtw_duration *dn,
3005     int *npktp, int debug)
3006 {
3007 	int ack, rc;
3008 	int firstlen, hdrlen, lastlen, lastlen0, npkt, overlen, paylen;
3009 
3010 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
3011 		hdrlen = sizeof(struct ieee80211_frame_addr4);
3012 	else
3013 		hdrlen = sizeof(struct ieee80211_frame);
3014 
3015 	paylen = len - hdrlen;
3016 
3017 	if ((flags & IEEE80211_F_WEPON) != 0)
3018 		overlen = IEEE80211_WEP_TOTLEN + IEEE80211_CRC_LEN;
3019 	else
3020 		overlen = IEEE80211_CRC_LEN;
3021 
3022 	npkt = paylen / fraglen;
3023 	lastlen0 = paylen % fraglen;
3024 
3025 	if (npkt == 0)			/* no fragments */
3026 		lastlen = paylen + overlen;
3027 	else if (lastlen0 != 0) {	/* a short "tail" fragment */
3028 		lastlen = lastlen0 + overlen;
3029 		npkt++;
3030 	} else				/* full-length "tail" fragment */
3031 		lastlen = fraglen + overlen;
3032 
3033 	if (npktp != NULL)
3034 		*npktp = npkt;
3035 
3036 	if (npkt > 1)
3037 		firstlen = fraglen + overlen;
3038 	else
3039 		firstlen = paylen + overlen;
3040 
3041 	if (debug) {
3042 		printf("%s: npkt %d firstlen %d lastlen0 %d lastlen %d "
3043 		    "fraglen %d overlen %d len %d rate %d flags %08x\n",
3044 		    __func__, npkt, firstlen, lastlen0, lastlen, fraglen,
3045 		    overlen, len, rate, flags);
3046 	}
3047 
3048 	ack = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3049 	    (wh->i_fc[1] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL;
3050 
3051 	rc = rtw_compute_duration1(firstlen + hdrlen, ack, flags, rate, d0);
3052 	if (rc == -1)
3053 		return rc;
3054 
3055 	if (npkt <= 1) {
3056 		*dn = *d0;
3057 		return 0;
3058 	}
3059 	return rtw_compute_duration1(lastlen + hdrlen, ack, flags, rate, dn);
3060 }
3061 
3062 #ifdef RTW_DEBUG
3063 void
3064 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3065     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3066 {
3067 	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3068 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3069 	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3070 	    sc->sc_dev.dv_xname, ts, action, desc,
3071 	    letoh32(td->td_buf), letoh32(td->td_next),
3072 	    letoh32(td->td_ctl0), letoh32(td->td_ctl1),
3073 	    letoh32(td->td_len)));
3074 }
3075 #endif /* RTW_DEBUG */
3076 
3077 void
3078 rtw_start(struct ifnet *ifp)
3079 {
3080 	uint8_t tppoll;
3081 	int desc, i, lastdesc, npkt, rate;
3082 	uint32_t proto_ctl0, ctl0, ctl1;
3083 	bus_dmamap_t		dmamap;
3084 	struct ieee80211com	*ic;
3085 	struct ieee80211_frame	*wh;
3086 	struct ieee80211_node	*ni;
3087 	struct mbuf		*m0;
3088 	struct rtw_softc	*sc;
3089 	struct rtw_duration	*d0;
3090 	struct rtw_txsoft_blk	*tsb;
3091 	struct rtw_txdesc_blk	*tdb;
3092 	struct rtw_txsoft	*ts;
3093 	struct rtw_txdesc	*td;
3094 
3095 	sc = (struct rtw_softc *)ifp->if_softc;
3096 	ic = &sc->sc_ic;
3097 
3098 	DPRINTF(sc, RTW_DEBUG_XMIT,
3099 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3100 
3101 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3102 		goto out;
3103 
3104 	/* XXX do real rate control */
3105 	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3106 
3107 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3108 		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3109 
3110 	for (;;) {
3111 		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3112 			continue;
3113 		if (m0 == NULL)
3114 			break;
3115 		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3116 
3117 		dmamap = ts->ts_dmamap;
3118 
3119 		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3120 		    tdb->tdb_nfree, &ifp->if_flags, sc->sc_dev.dv_xname);
3121 
3122 		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3123 			DPRINTF(sc, RTW_DEBUG_XMIT,
3124 			    ("%s: fail dmamap load\n", __func__));
3125 			goto post_dequeue_err;
3126 		}
3127 
3128 		wh = mtod(m0, struct ieee80211_frame *);
3129 
3130 		/* XXX do real rate control */
3131 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3132 		    IEEE80211_FC0_TYPE_MGT)
3133 			rate = 2;
3134 		else
3135 			rate = MAX(2, ieee80211_get_rate(ic));
3136 
3137 #ifdef RTW_DEBUG
3138 		if ((sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3139 		    (IFF_DEBUG|IFF_LINK2)) {
3140 			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3141 			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3142 			    : sizeof(wh), rate, 0);
3143 		}
3144 #endif /* RTW_DEBUG */
3145 		ctl0 = proto_ctl0 |
3146 		    LSHIFT(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3147 
3148 		switch (rate) {
3149 		default:
3150 		case 2:
3151 			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3152 			break;
3153 		case 4:
3154 			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3155 			break;
3156 		case 11:
3157 			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3158 			break;
3159 		case 22:
3160 			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3161 			break;
3162 		}
3163 
3164 		/* XXX >= ? Compare after fragmentation? */
3165 		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3166 			ctl0 |= RTW_TXCTL0_RTSEN;
3167 
3168 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3169 		    IEEE80211_FC0_TYPE_MGT) {
3170 			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3171 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3172 			    IEEE80211_FC0_SUBTYPE_BEACON)
3173 				ctl0 |= RTW_TXCTL0_BEACON;
3174 		}
3175 
3176 		if (rtw_compute_duration(wh, m0->m_pkthdr.len,
3177 		    ic->ic_flags & ~IEEE80211_F_WEPON, ic->ic_fragthreshold,
3178 		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3179 		    (sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3180 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3181 			DPRINTF(sc, RTW_DEBUG_XMIT,
3182 			    ("%s: fail compute duration\n", __func__));
3183 			goto post_load_err;
3184 		}
3185 
3186 		d0 = &ts->ts_d0;
3187 
3188 		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3189 
3190 		ctl1 = LSHIFT(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3191 		    LSHIFT(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3192 
3193 		if (d0->d_residue)
3194 			ctl1 |= RTW_TXCTL1_LENGEXT;
3195 
3196 		/* TBD fragmentation */
3197 
3198 		ts->ts_first = tdb->tdb_next;
3199 
3200 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3201 		    BUS_DMASYNC_PREWRITE);
3202 
3203 		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3204 
3205 #if NBPFILTER > 0
3206 		if (ic->ic_rawbpf != NULL)
3207 			bpf_mtap((caddr_t)ic->ic_rawbpf, m0,
3208 			    BPF_DIRECTION_OUT);
3209 
3210 		if (sc->sc_radiobpf != NULL) {
3211 			struct mbuf mb;
3212 			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3213 
3214 			rt->rt_flags = 0;
3215 			rt->rt_rate = rate;
3216 			rt->rt_chan_freq =
3217 			    htole16(ic->ic_bss->ni_chan->ic_freq);
3218 			rt->rt_chan_flags =
3219 			    htole16(ic->ic_bss->ni_chan->ic_flags);
3220 
3221 			mb.m_data = (caddr_t)rt;
3222 			mb.m_len = sizeof(sc->sc_txtapu);
3223 			mb.m_next = m0;
3224 			mb.m_nextpkt = NULL;
3225 			mb.m_type = 0;
3226 			mb.m_flags = 0;
3227 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_OUT);
3228 
3229 		}
3230 #endif /* NBPFILTER > 0 */
3231 
3232 		for (i = 0, lastdesc = desc = ts->ts_first;
3233 		     i < dmamap->dm_nsegs;
3234 		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3235 			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3236 				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3237 				    ("%s: seg too long\n", __func__));
3238 				goto post_load_err;
3239 			}
3240 			td = &tdb->tdb_desc[desc];
3241 			td->td_ctl0 = htole32(ctl0);
3242 			if (i != 0)
3243 				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3244 			td->td_ctl1 = htole32(ctl1);
3245 			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3246 			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3247 			lastdesc = desc;
3248 #ifdef RTW_DEBUG
3249 			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3250 #endif /* RTW_DEBUG */
3251 		}
3252 
3253 		KASSERT(desc < tdb->tdb_ndesc);
3254 
3255 		ts->ts_ni = ni;
3256 		ts->ts_mbuf = m0;
3257 		ts->ts_last = lastdesc;
3258 		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3259 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3260 		    htole32(RTW_TXCTL0_FS);
3261 
3262 #ifdef RTW_DEBUG
3263 		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3264 		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3265 #endif /* RTW_DEBUG */
3266 
3267 		tdb->tdb_nfree -= dmamap->dm_nsegs;
3268 		tdb->tdb_next = desc;
3269 
3270 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3271 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3272 
3273 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3274 		    htole32(RTW_TXCTL0_OWN);
3275 
3276 #ifdef RTW_DEBUG
3277 		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3278 #endif /* RTW_DEBUG */
3279 
3280 		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3281 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3282 
3283 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3284 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3285 
3286 		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3287 			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3288 		tsb->tsb_tx_timer = 5;
3289 		ifp->if_timer = 1;
3290 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3291 		tppoll &= ~RTW_TPPOLL_SALL;
3292 		tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
3293 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3294 		RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
3295 	}
3296 out:
3297 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3298 	return;
3299 post_load_err:
3300 	bus_dmamap_unload(sc->sc_dmat, dmamap);
3301 	m_freem(m0);
3302 post_dequeue_err:
3303 	ieee80211_release_node(&sc->sc_ic, ni);
3304 	return;
3305 }
3306 
3307 void
3308 rtw_idle(struct rtw_regs *regs)
3309 {
3310 	int active;
3311 
3312 	/* request stop DMA; wait for packets to stop transmitting. */
3313 
3314 	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3315 	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3316 
3317 	for (active = 0; active < 300 &&
3318 	     (RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0; active++)
3319 		DELAY(10);
3320 	RTW_DPRINTF(RTW_DEBUG_BUGS,
3321 	    ("%s: transmit DMA idle in %dus\n", __func__, active * 10));
3322 }
3323 
3324 void
3325 rtw_watchdog(struct ifnet *ifp)
3326 {
3327 	int pri, tx_timeouts = 0;
3328 	struct rtw_softc *sc;
3329 	struct rtw_txsoft_blk *tsb;
3330 
3331 	sc = ifp->if_softc;
3332 
3333 	ifp->if_timer = 0;
3334 
3335 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
3336 		return;
3337 
3338 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3339 		tsb = &sc->sc_txsoft_blk[pri];
3340 
3341 		if (tsb->tsb_tx_timer == 0)
3342 			continue;
3343 		else if (--tsb->tsb_tx_timer == 0) {
3344 			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3345 				continue;
3346 			RTW_DPRINTF(RTW_DEBUG_BUGS,
3347 			    ("%s: transmit timeout, priority %d\n",
3348 			    ifp->if_xname, pri));
3349 			ifp->if_oerrors++;
3350 			tx_timeouts++;
3351 		} else
3352 			ifp->if_timer = 1;
3353 	}
3354 
3355 	if (tx_timeouts > 0) {
3356 		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3357 		 * reset s/w tx-ring pointers, and start transmission.
3358 		 *
3359 		 * TBD Stop/restart just the broken rings?
3360 		 */
3361 		rtw_idle(&sc->sc_regs);
3362 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 0);
3363 		rtw_txdescs_reset(sc);
3364 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 1);
3365 		rtw_txring_fixup(sc);
3366 		rtw_start(ifp);
3367 	}
3368 	ieee80211_watchdog(ifp);
3369 }
3370 
3371 void
3372 rtw_next_scan(void *arg)
3373 {
3374 	struct rtw_softc *sc = arg;
3375 	struct ieee80211com *ic = &sc->sc_ic;
3376 	struct ifnet *ifp = &ic->ic_if;
3377 	int s;
3378 
3379 	/* don't call rtw_start w/o network interrupts blocked */
3380 	s = splnet();
3381 	if (ic->ic_state == IEEE80211_S_SCAN)
3382 		ieee80211_next_scan(ifp);
3383 	splx(s);
3384 }
3385 
3386 void
3387 rtw_join_bss(struct rtw_softc *sc, u_int8_t *bssid, u_int16_t intval0)
3388 {
3389 	uint16_t bcnitv, bintritv, intval;
3390 	int i;
3391 	struct rtw_regs *regs = &sc->sc_regs;
3392 
3393 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3394 		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3395 
3396 	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3397 
3398 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3399 
3400 	intval = MIN(intval0, PRESHIFT(RTW_BCNITV_BCNITV_MASK));
3401 
3402 	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3403 	bcnitv |= LSHIFT(intval, RTW_BCNITV_BCNITV_MASK);
3404 	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3405 	/* interrupt host 1ms before the TBTT */
3406 	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3407 	bintritv |= LSHIFT(1000, RTW_BINTRITV_BINTRITV);
3408 	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3409 	/* magic from Linux */
3410 	RTW_WRITE16(regs, RTW_ATIMWND, LSHIFT(1, RTW_ATIMWND_ATIMWND));
3411 	RTW_WRITE16(regs, RTW_ATIMTRITV, LSHIFT(2, RTW_ATIMTRITV_ATIMTRITV));
3412 	rtw_set_access(regs, RTW_ACCESS_NONE);
3413 
3414 	/* TBD WEP */
3415 	RTW_WRITE8(regs, RTW8180_SCR, 0);
3416 
3417 	rtw_io_enable(regs, RTW_CR_RE | RTW_CR_TE, 1);
3418 }
3419 
3420 /* Synchronize the hardware state with the software state. */
3421 int
3422 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3423 {
3424 	struct ifnet *ifp = &ic->ic_if;
3425 	struct rtw_softc *sc = ifp->if_softc;
3426 	enum ieee80211_state ostate;
3427 	int error;
3428 
3429 	ostate = ic->ic_state;
3430 
3431 	rtw_led_newstate(sc, nstate);
3432 
3433 	if (nstate == IEEE80211_S_INIT) {
3434 		timeout_del(&sc->sc_scan_to);
3435 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3436 		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3437 	}
3438 
3439 	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3440 		rtw_pwrstate(sc, RTW_ON);
3441 
3442 	if ((error = rtw_tune(sc)) != 0)
3443 		return error;
3444 
3445 	switch (nstate) {
3446 	case IEEE80211_S_INIT:
3447 		panic("%s: unexpected state IEEE80211_S_INIT", __func__);
3448 		break;
3449 	case IEEE80211_S_SCAN:
3450 		if (ostate != IEEE80211_S_SCAN) {
3451 			bzero(ic->ic_bss->ni_bssid, IEEE80211_ADDR_LEN);
3452 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3453 		}
3454 
3455 		timeout_add_msec(&sc->sc_scan_to, rtw_dwelltime);
3456 
3457 		break;
3458 	case IEEE80211_S_RUN:
3459 		switch (ic->ic_opmode) {
3460 #ifndef IEEE80211_STA_ONLY
3461 		case IEEE80211_M_HOSTAP:
3462 		case IEEE80211_M_IBSS:
3463 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3464 			/*FALLTHROUGH*/
3465 		case IEEE80211_M_AHDEMO:
3466 #endif
3467 		case IEEE80211_M_STA:
3468 			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3469 			    ic->ic_bss->ni_intval);
3470 			break;
3471 		default:
3472 			break;
3473 		}
3474 		rtw_set_nettype(sc, ic->ic_opmode);
3475 		break;
3476 	case IEEE80211_S_ASSOC:
3477 	case IEEE80211_S_AUTH:
3478 		break;
3479 	}
3480 
3481 	if (nstate != IEEE80211_S_SCAN)
3482 		timeout_del(&sc->sc_scan_to);
3483 
3484 	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3485 }
3486 
3487 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3488 uint64_t
3489 rtw_tsf_extend(struct rtw_regs *regs, u_int32_t rstamp)
3490 {
3491 	u_int32_t tsftl, tsfth;
3492 
3493 	tsfth = RTW_READ(regs, RTW_TSFTRH);
3494 	tsftl = RTW_READ(regs, RTW_TSFTRL);
3495 	if (tsftl < rstamp)	/* Compensate for rollover. */
3496 		tsfth--;
3497 	return ((u_int64_t)tsfth << 32) | rstamp;
3498 }
3499 
3500 #ifndef IEEE80211_STA_ONLY
3501 void
3502 rtw_ibss_merge(struct rtw_softc *sc, struct ieee80211_node *ni,
3503     u_int32_t rstamp)
3504 {
3505 	u_int8_t tppoll;
3506 	struct ieee80211com *ic = &sc->sc_ic;
3507 
3508 	if (ieee80211_ibss_merge(ic, ni,
3509 	    rtw_tsf_extend(&sc->sc_regs, rstamp)) == ENETRESET) {
3510 		/* Stop beacon queue.  Kick state machine to synchronize
3511 		 * with the new IBSS.
3512 		 */
3513 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3514 		tppoll |= RTW_TPPOLL_SBQ;
3515 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3516 		(void)ieee80211_new_state(&sc->sc_ic, IEEE80211_S_RUN, -1);
3517 	}
3518 	return;
3519 }
3520 
3521 void
3522 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3523     struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, int subtype)
3524 {
3525 	struct rtw_softc *sc = (struct rtw_softc*)ic->ic_softc;
3526 
3527 	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, rxi, subtype);
3528 
3529 	switch (subtype) {
3530 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3531 	case IEEE80211_FC0_SUBTYPE_BEACON:
3532 		if (ic->ic_opmode != IEEE80211_M_IBSS ||
3533 		    ic->ic_state != IEEE80211_S_RUN)
3534 			return;
3535 		rtw_ibss_merge(sc, ni, rxi->rxi_tstamp);
3536 		break;
3537 	default:
3538 		break;
3539 	}
3540 	return;
3541 }
3542 #endif	/* IEEE80211_STA_ONLY */
3543 
3544 struct ieee80211_node *
3545 rtw_node_alloc(struct ieee80211com *ic)
3546 {
3547 	struct rtw_softc *sc = (struct rtw_softc *)ic->ic_if.if_softc;
3548 	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(ic);
3549 
3550 	DPRINTF(sc, RTW_DEBUG_NODE,
3551 	    ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
3552 	return ni;
3553 }
3554 
3555 void
3556 rtw_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
3557 {
3558 	struct rtw_softc *sc = (struct rtw_softc *)ic->ic_if.if_softc;
3559 
3560 	DPRINTF(sc, RTW_DEBUG_NODE,
3561 	    ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
3562 	    ether_sprintf(ni->ni_bssid)));
3563 	(*sc->sc_mtbl.mt_node_free)(ic, ni);
3564 }
3565 
3566 int
3567 rtw_media_change(struct ifnet *ifp)
3568 {
3569 	int error;
3570 
3571 	error = ieee80211_media_change(ifp);
3572 	if (error == ENETRESET) {
3573 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3574 		    (IFF_RUNNING|IFF_UP))
3575 			rtw_init(ifp);		/* XXX lose error */
3576 		error = 0;
3577 	}
3578 	return error;
3579 }
3580 
3581 void
3582 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3583 {
3584 	struct rtw_softc *sc = ifp->if_softc;
3585 
3586 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
3587 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3588 		imr->ifm_status = 0;
3589 		return;
3590 	}
3591 	ieee80211_media_status(ifp, imr);
3592 }
3593 
3594 int
3595 rtw_activate(struct device *self, int act)
3596 {
3597 	struct rtw_softc *sc = (struct rtw_softc *)self;
3598 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3599 
3600 	switch (act) {
3601 	case DVACT_SUSPEND:
3602 		if (ifp->if_flags & IFF_RUNNING) {
3603 			rtw_stop(ifp, 1);
3604 			if (sc->sc_power != NULL)
3605 				(*sc->sc_power)(sc, act);
3606 		}
3607 		break;
3608 	case DVACT_RESUME:
3609 		if (ifp->if_flags & IFF_UP) {
3610 			if (sc->sc_power != NULL)
3611 				(*sc->sc_power)(sc, act);
3612 			rtw_init(ifp);
3613 		}
3614 		break;
3615 	}
3616 	return 0;
3617 }
3618 
3619 int
3620 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3621 {
3622 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3623 	SIMPLEQ_INIT(&tsb->tsb_freeq);
3624 	tsb->tsb_ndesc = qlen;
3625 	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
3626 	    M_NOWAIT);
3627 	if (tsb->tsb_desc == NULL)
3628 		return ENOMEM;
3629 	return 0;
3630 }
3631 
3632 void
3633 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3634 {
3635 	int pri;
3636 	struct rtw_txsoft_blk *tsb;
3637 
3638 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3639 		tsb = &sc->sc_txsoft_blk[pri];
3640 		free(tsb->tsb_desc, M_DEVBUF);
3641 		tsb->tsb_desc = NULL;
3642 	}
3643 }
3644 
3645 int
3646 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3647 {
3648 	int pri, rc = 0;
3649 	int qlen[RTW_NTXPRI] =
3650 	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3651 	struct rtw_txsoft_blk *tsbs;
3652 
3653 	tsbs = sc->sc_txsoft_blk;
3654 
3655 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3656 		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3657 		if (rc != 0)
3658 			break;
3659 	}
3660 	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3661 	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3662 	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3663 	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3664 	return rc;
3665 }
3666 
3667 void
3668 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3669     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3670 {
3671 	tdb->tdb_ndesc = ndesc;
3672 	tdb->tdb_desc = desc;
3673 	tdb->tdb_physbase = physbase;
3674 	tdb->tdb_ofs = ofs;
3675 
3676 	bzero(tdb->tdb_desc, sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3677 
3678 	rtw_txdesc_blk_init(tdb);
3679 	tdb->tdb_next = 0;
3680 }
3681 
3682 void
3683 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3684 {
3685 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3686 	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3687 	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3688 
3689 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3690 	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3691 	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3692 
3693 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3694 	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3695 	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3696 
3697 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3698 	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3699 	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3700 }
3701 
3702 int
3703 rtw_rf_attach(struct rtw_softc *sc, int rfchipid)
3704 {
3705 	struct rtw_bbpset *bb = &sc->sc_bbpset;
3706 	int notsup = 0;
3707 	const char *rfname, *paname = NULL;
3708 	char scratch[sizeof("unknown 0xXX")];
3709 
3710 	switch (rfchipid) {
3711 	case RTW_RFCHIPID_RTL8225:
3712 		rfname = "RTL8225";
3713 		sc->sc_pwrstate_cb = rtw_rtl_pwrstate;
3714 		sc->sc_rf_init = rtw_rtl8255_init;
3715 		sc->sc_rf_pwrstate = rtw_rtl8225_pwrstate;
3716 		sc->sc_rf_tune = rtw_rtl8225_tune;
3717 		sc->sc_rf_txpower = rtw_rtl8225_txpower;
3718 		break;
3719 	case RTW_RFCHIPID_RTL8255:
3720 		rfname = "RTL8255";
3721 		sc->sc_pwrstate_cb = rtw_rtl_pwrstate;
3722 		sc->sc_rf_init = rtw_rtl8255_init;
3723 		sc->sc_rf_pwrstate = rtw_rtl8255_pwrstate;
3724 		sc->sc_rf_tune = rtw_rtl8255_tune;
3725 		sc->sc_rf_txpower = rtw_rtl8255_txpower;
3726 		break;
3727 	case RTW_RFCHIPID_MAXIM2820:
3728 		rfname = "MAX2820";	/* guess */
3729 		paname = "MAX2422";	/* guess */
3730 		/* XXX magic */
3731 		bb->bb_antatten = RTW_BBP_ANTATTEN_MAXIM_MAGIC;
3732 		bb->bb_chestlim =	0x00;
3733 		bb->bb_chsqlim =	0x9f;
3734 		bb->bb_ifagcdet =	0x64;
3735 		bb->bb_ifagcini =	0x90;
3736 		bb->bb_ifagclimit =	0x1a;
3737 		bb->bb_lnadet =		0xf8;
3738 		bb->bb_sys1 =		0x88;
3739 		bb->bb_sys2 =		0x47;
3740 		bb->bb_sys3 =		0x9b;
3741 		bb->bb_trl =		0x88;
3742 		bb->bb_txagc =		0x08;
3743 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3744 		sc->sc_rf_init = rtw_max2820_init;
3745 		sc->sc_rf_pwrstate = rtw_max2820_pwrstate;
3746 		sc->sc_rf_tune = rtw_max2820_tune;
3747 		sc->sc_rf_txpower = rtw_max2820_txpower;
3748 		break;
3749 	case RTW_RFCHIPID_PHILIPS:
3750 		rfname = "SA2400A";
3751 		paname = "SA2411";
3752 		/* XXX magic */
3753 		bb->bb_antatten = RTW_BBP_ANTATTEN_PHILIPS_MAGIC;
3754 		bb->bb_chestlim =	0x00;
3755 		bb->bb_chsqlim =	0xa0;
3756 		bb->bb_ifagcdet =	0x64;
3757 		bb->bb_ifagcini =	0x90;
3758 		bb->bb_ifagclimit =	0x1a;
3759 		bb->bb_lnadet =		0xe0;
3760 		bb->bb_sys1 =		0x98;
3761 		bb->bb_sys2 =		0x47;
3762 		bb->bb_sys3 =		0x90;
3763 		bb->bb_trl =		0x88;
3764 		bb->bb_txagc =		0x38;
3765 		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3766 		sc->sc_rf_init = rtw_sa2400_init;
3767 		sc->sc_rf_pwrstate = rtw_sa2400_pwrstate;
3768 		sc->sc_rf_tune = rtw_sa2400_tune;
3769 		sc->sc_rf_txpower = rtw_sa2400_txpower;
3770 		break;
3771 	case RTW_RFCHIPID_RFMD2948:
3772 		/* this is the same front-end as an atw(4)! */
3773 		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
3774 			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
3775 			 "SYN: Silicon Labs Si4126";	 /* inferred from
3776 							  * reference driver
3777 							  */
3778 		paname = "RF2189";		/* mentioned in Realtek docs */
3779 		/* XXX RFMD has no RF constructor */
3780 		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3781 		notsup =  1;
3782 		break;
3783 	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
3784 		rfname = "GRF5101";
3785 		paname = "WS9901";
3786 		/* XXX magic */
3787 		bb->bb_antatten = RTW_BBP_ANTATTEN_GCT_MAGIC;
3788 		bb->bb_chestlim =	0x00;
3789 		bb->bb_chsqlim =	0xa0;
3790 		bb->bb_ifagcdet =	0x64;
3791 		bb->bb_ifagcini =	0x90;
3792 		bb->bb_ifagclimit =	0x1e;
3793 		bb->bb_lnadet =		0xc0;
3794 		bb->bb_sys1 =		0xa8;
3795 		bb->bb_sys2 =		0x47;
3796 		bb->bb_sys3 =		0x9b;
3797 		bb->bb_trl =		0x88;
3798 		bb->bb_txagc =		0x08;
3799 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3800 		sc->sc_rf_init = rtw_grf5101_init;
3801 		sc->sc_rf_pwrstate = rtw_grf5101_pwrstate;
3802 		sc->sc_rf_tune = rtw_grf5101_tune;
3803 		sc->sc_rf_txpower = rtw_grf5101_txpower;
3804 		break;
3805 	case RTW_RFCHIPID_INTERSIL:
3806 		rfname = "HFA3873";	/* guess */
3807 		paname = "Intersil <unknown>";
3808 		notsup = 1;
3809 		break;
3810 	default:
3811 		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", rfchipid);
3812 		rfname = scratch;
3813 		notsup = 1;
3814 	}
3815 
3816 	printf("radio %s, ", rfname);
3817 	if (paname != NULL)
3818 		printf("amp %s, ", paname);
3819 
3820 	return (notsup);
3821 }
3822 
3823 /* Revision C and later use a different PHY delay setting than
3824  * revisions A and B.
3825  */
3826 u_int8_t
3827 rtw_check_phydelay(struct rtw_regs *regs, u_int32_t rcr0)
3828 {
3829 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
3830 #define REVC (REVAB | RTW8180_RCR_RXFTH_WHOLE)
3831 
3832 	u_int8_t phydelay = LSHIFT(0x6, RTW_PHYDELAY_PHYDELAY);
3833 
3834 	RTW_WRITE(regs, RTW_RCR, REVAB);
3835 	RTW_WBW(regs, RTW_RCR, RTW_RCR);
3836 	RTW_WRITE(regs, RTW_RCR, REVC);
3837 
3838 	RTW_WBR(regs, RTW_RCR, RTW_RCR);
3839 	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
3840 		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
3841 
3842 	RTW_WRITE(regs, RTW_RCR, rcr0);	/* restore RCR */
3843 	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
3844 
3845 	return phydelay;
3846 #undef REVC
3847 }
3848 
3849 void
3850 rtw_attach(struct rtw_softc *sc)
3851 {
3852 	struct ieee80211com *ic = &sc->sc_ic;
3853 	struct rtw_txsoft_blk *tsb;
3854 	struct rtw_mtbl *mtbl;
3855 	struct rtw_srom *sr;
3856 	const char *vername;
3857 	struct ifnet *ifp;
3858 	char scratch[sizeof("unknown 0xXXXXXXXX")];
3859 	int pri, rc, i;
3860 
3861 
3862 	/* Use default DMA memory access */
3863 	if (sc->sc_regs.r_read8 == NULL) {
3864 		sc->sc_regs.r_read8 = rtw_read8;
3865 		sc->sc_regs.r_read16 = rtw_read16;
3866 		sc->sc_regs.r_read32 = rtw_read32;
3867 		sc->sc_regs.r_write8 = rtw_write8;
3868 		sc->sc_regs.r_write16 = rtw_write16;
3869 		sc->sc_regs.r_write32 = rtw_write32;
3870 		sc->sc_regs.r_barrier = rtw_barrier;
3871 	}
3872 
3873 	sc->sc_hwverid = RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK;
3874 	switch (sc->sc_hwverid) {
3875 	case RTW_TCR_HWVERID_RTL8185:
3876 		vername = "RTL8185";
3877 		sc->sc_flags |= RTW_F_RTL8185;
3878 		break;
3879 	case RTW_TCR_HWVERID_RTL8180F:
3880 		vername = "RTL8180F";
3881 		break;
3882 	case RTW_TCR_HWVERID_RTL8180D:
3883 		vername = "RTL8180D";
3884 		break;
3885 	default:
3886 		snprintf(scratch, sizeof(scratch), "unknown 0x%08x",
3887 		    sc->sc_hwverid);
3888 		vername = scratch;
3889 		break;
3890 	}
3891 
3892 	printf("%s: ver %s, ", sc->sc_dev.dv_xname, vername);
3893 
3894 	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
3895 	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
3896 	    0);
3897 
3898 	if (rc != 0) {
3899 		printf("\n%s: could not allocate hw descriptors, error %d\n",
3900 		     sc->sc_dev.dv_xname, rc);
3901 		goto fail0;
3902 	}
3903 
3904 	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
3905 	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
3906 	    (caddr_t*)&sc->sc_descs, BUS_DMA_COHERENT);
3907 
3908 	if (rc != 0) {
3909 		printf("\n%s: can't map hw descriptors, error %d\n",
3910 		    sc->sc_dev.dv_xname, rc);
3911 		goto fail1;
3912 	}
3913 
3914 	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
3915 	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
3916 
3917 	if (rc != 0) {
3918 		printf("\n%s: could not create DMA map for hw descriptors, "
3919 		    "error %d\n", sc->sc_dev.dv_xname, rc);
3920 		goto fail2;
3921 	}
3922 
3923 	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
3924 	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
3925 
3926 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3927 		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
3928 		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
3929 	}
3930 
3931 	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
3932 	    sizeof(struct rtw_descs), NULL, 0);
3933 
3934 	if (rc != 0) {
3935 		printf("\n%s: could not load DMA map for hw descriptors, "
3936 		    "error %d\n", sc->sc_dev.dv_xname, rc);
3937 		goto fail3;
3938 	}
3939 
3940 	if (rtw_txsoft_blk_setup_all(sc) != 0)
3941 		goto fail4;
3942 
3943 	rtw_txdesc_blk_setup_all(sc);
3944 
3945 	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
3946 
3947 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3948 		tsb = &sc->sc_txsoft_blk[pri];
3949 
3950 		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
3951 		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
3952 			printf("\n%s: could not load DMA map for "
3953 			    "hw tx descriptors, error %d\n",
3954 			    sc->sc_dev.dv_xname, rc);
3955 			goto fail5;
3956 		}
3957 	}
3958 
3959 	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
3960 	    RTW_RXQLEN)) != 0) {
3961 		printf("\n%s: could not load DMA map for hw rx descriptors, "
3962 		    "error %d\n", sc->sc_dev.dv_xname, rc);
3963 		goto fail6;
3964 	}
3965 
3966 	/* Reset the chip to a known state. */
3967 	if (rtw_reset(sc) != 0)
3968 		goto fail7;
3969 
3970 	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
3971 
3972 	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
3973 		sc->sc_flags |= RTW_F_9356SROM;
3974 
3975 	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
3976 	    sc->sc_dev.dv_xname) != 0)
3977 		goto fail7;
3978 
3979 	if (rtw_srom_parse(sc) != 0) {
3980 		printf("\n%s: attach failed, malformed serial ROM\n",
3981 		    sc->sc_dev.dv_xname);
3982 		goto fail8;
3983 	}
3984 
3985 	RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: %s PHY\n", sc->sc_dev.dv_xname,
3986 	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog"));
3987 
3988 	RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: CS threshold %u\n",
3989 	    sc->sc_dev.dv_xname, sc->sc_csthr));
3990 
3991 	if ((rtw_rf_attach(sc, sc->sc_rfchipid)) != 0) {
3992 		printf("\n%s: attach failed, could not attach RF\n",
3993 		    sc->sc_dev.dv_xname);
3994 		goto fail8;
3995 	}
3996 
3997 	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
3998 
3999 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
4000 	    ("%s: PHY delay %d\n", sc->sc_dev.dv_xname, sc->sc_phydelay));
4001 
4002 	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
4003 		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
4004 
4005 	for (i = 1; i <= 14; i++) {
4006 		sc->sc_ic.ic_channels[i].ic_flags = IEEE80211_CHAN_B;
4007 		sc->sc_ic.ic_channels[i].ic_freq =
4008 		    ieee80211_ieee2mhz(i, sc->sc_ic.ic_channels[i].ic_flags);
4009 	}
4010 
4011 	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
4012 	    sc->sc_dev.dv_xname) != 0)
4013 		goto fail8;
4014 
4015 	ifp = &sc->sc_if;
4016 	(void)memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
4017 	ifp->if_softc = sc;
4018 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
4019 	    IFF_NOTRAILERS;
4020 	ifp->if_ioctl = rtw_ioctl;
4021 	ifp->if_start = rtw_start;
4022 	ifp->if_watchdog = rtw_watchdog;
4023 
4024 	IFQ_SET_READY(&sc->sc_if.if_snd);
4025 
4026 	ic->ic_phytype = IEEE80211_T_DS;
4027 	ic->ic_opmode = IEEE80211_M_STA;
4028 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
4029 #ifndef IEEE80211_STA_ONLY
4030 	ic->ic_caps |= IEEE80211_C_HOSTAP | IEEE80211_C_IBSS;
4031 #endif
4032 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
4033 
4034 	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4035 
4036 	/*
4037 	 * Call MI attach routines.
4038 	 */
4039 	if_attach(&sc->sc_if);
4040 	ieee80211_ifattach(&sc->sc_if);
4041 
4042 	mtbl = &sc->sc_mtbl;
4043 	mtbl->mt_newstate = ic->ic_newstate;
4044 	ic->ic_newstate = rtw_newstate;
4045 
4046 #ifndef IEEE80211_STA_ONLY
4047 	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
4048 	ic->ic_recv_mgmt = rtw_recv_mgmt;
4049 #endif
4050 
4051 	mtbl->mt_node_free = ic->ic_node_free;
4052 	ic->ic_node_free = rtw_node_free;
4053 
4054 	mtbl->mt_node_alloc = ic->ic_node_alloc;
4055 	ic->ic_node_alloc = rtw_node_alloc;
4056 
4057 	/* possibly we should fill in our own sc_send_prresp, since
4058 	 * the RTL8180 is probably sending probe responses in ad hoc
4059 	 * mode.
4060 	 */
4061 
4062 	/* complete initialization */
4063 	ieee80211_media_init(&sc->sc_if, rtw_media_change, rtw_media_status);
4064 	timeout_set(&sc->sc_scan_to, rtw_next_scan, sc);
4065 
4066 #if NBPFILTER > 0
4067 	bzero(&sc->sc_rxtapu, sizeof(sc->sc_rxtapu));
4068 	sc->sc_rxtap.rr_ihdr.it_len = sizeof(sc->sc_rxtapu);
4069 	sc->sc_rxtap.rr_ihdr.it_present = RTW_RX_RADIOTAP_PRESENT;
4070 
4071 	bzero(&sc->sc_txtapu, sizeof(sc->sc_txtapu));
4072 	sc->sc_txtap.rt_ihdr.it_len = sizeof(sc->sc_txtapu);
4073 	sc->sc_txtap.rt_ihdr.it_present = RTW_TX_RADIOTAP_PRESENT;
4074 
4075 	bpfattach(&sc->sc_radiobpf, &sc->sc_ic.ic_if, DLT_IEEE802_11_RADIO,
4076 	    sizeof(struct ieee80211_frame) + 64);
4077 #endif
4078 	return;
4079 
4080 fail8:
4081 	sr = &sc->sc_srom;
4082 	sr->sr_size = 0;
4083 	if (sr->sr_content != NULL) {
4084 		free(sr->sr_content, M_DEVBUF);
4085 		sr->sr_content = NULL;
4086 	}
4087 
4088 fail7:
4089 	rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4090 	    RTW_RXQLEN);
4091 
4092 fail6:
4093 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4094 		rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4095 		    sc->sc_txsoft_blk[pri].tsb_desc,
4096 		    sc->sc_txsoft_blk[pri].tsb_ndesc);
4097 	}
4098 
4099 fail5:
4100 	rtw_txsoft_blk_cleanup_all(sc);
4101 
4102 fail4:
4103 	bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4104 fail3:
4105 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4106 fail2:
4107 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_descs,
4108 	    sizeof(struct rtw_descs));
4109 fail1:
4110 	bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4111 	    sc->sc_desc_nsegs);
4112 fail0:
4113 	return;
4114 }
4115 
4116 int
4117 rtw_detach(struct rtw_softc *sc)
4118 {
4119 	sc->sc_flags |= RTW_F_INVALID;
4120 
4121 	timeout_del(&sc->sc_scan_to);
4122 
4123 	rtw_stop(&sc->sc_if, 1);
4124 
4125 	ieee80211_ifdetach(&sc->sc_if);
4126 	if_detach(&sc->sc_if);
4127 
4128 	return 0;
4129 }
4130 
4131 /*
4132  * PHY specific functions
4133  */
4134 
4135 int
4136 rtw_bbp_preinit(struct rtw_regs *regs, u_int antatten0, int dflantb,
4137     u_int freq)
4138 {
4139 	u_int antatten = antatten0;
4140 	if (dflantb)
4141 		antatten |= RTW_BBP_ANTATTEN_DFLANTB;
4142 	if (freq == 2484) /* channel 14 */
4143 		antatten |= RTW_BBP_ANTATTEN_CHAN14;
4144 	return rtw_bbp_write(regs, RTW_BBP_ANTATTEN, antatten);
4145 }
4146 
4147 int
4148 rtw_bbp_init(struct rtw_regs *regs, struct rtw_bbpset *bb, int antdiv,
4149     int dflantb, u_int8_t cs_threshold, u_int freq)
4150 {
4151 	int rc;
4152 	u_int32_t sys2, sys3;
4153 
4154 	sys2 = bb->bb_sys2;
4155 	if (antdiv)
4156 		sys2 |= RTW_BBP_SYS2_ANTDIV;
4157 	sys3 = bb->bb_sys3 |
4158 	    LSHIFT(cs_threshold, RTW_BBP_SYS3_CSTHRESH_MASK);
4159 
4160 #define	RTW_BBP_WRITE_OR_RETURN(reg, val) \
4161 	if ((rc = rtw_bbp_write(regs, reg, val)) != 0) \
4162 		return rc;
4163 
4164 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_SYS1,		bb->bb_sys1);
4165 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_TXAGC,		bb->bb_txagc);
4166 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_LNADET,		bb->bb_lnadet);
4167 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_IFAGCINI,	bb->bb_ifagcini);
4168 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_IFAGCLIMIT,	bb->bb_ifagclimit);
4169 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_IFAGCDET,	bb->bb_ifagcdet);
4170 
4171 	if ((rc = rtw_bbp_preinit(regs, bb->bb_antatten, dflantb, freq)) != 0)
4172 		return rc;
4173 
4174 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_TRL,		bb->bb_trl);
4175 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_SYS2,		sys2);
4176 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_SYS3,		sys3);
4177 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_CHESTLIM,	bb->bb_chestlim);
4178 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_CHSQLIM,	bb->bb_chsqlim);
4179 	return 0;
4180 }
4181 
4182 int
4183 rtw_sa2400_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4184 {
4185 	return rtw_rf_macwrite(sc, SA2400_TX, opaque_txpower);
4186 }
4187 
4188 /* make sure we're using the same settings as the reference driver */
4189 void
4190 rtw_verify_syna(u_int freq, u_int32_t val)
4191 {
4192 	u_int32_t expected_val = ~val;
4193 
4194 	switch (freq) {
4195 	case 2412:
4196 		expected_val = 0x0000096c; /* ch 1 */
4197 		break;
4198 	case 2417:
4199 		expected_val = 0x00080970; /* ch 2 */
4200 		break;
4201 	case 2422:
4202 		expected_val = 0x00100974; /* ch 3 */
4203 		break;
4204 	case 2427:
4205 		expected_val = 0x00180978; /* ch 4 */
4206 		break;
4207 	case 2432:
4208 		expected_val = 0x00000980; /* ch 5 */
4209 		break;
4210 	case 2437:
4211 		expected_val = 0x00080984; /* ch 6 */
4212 		break;
4213 	case 2442:
4214 		expected_val = 0x00100988; /* ch 7 */
4215 		break;
4216 	case 2447:
4217 		expected_val = 0x0018098c; /* ch 8 */
4218 		break;
4219 	case 2452:
4220 		expected_val = 0x00000994; /* ch 9 */
4221 		break;
4222 	case 2457:
4223 		expected_val = 0x00080998; /* ch 10 */
4224 		break;
4225 	case 2462:
4226 		expected_val = 0x0010099c; /* ch 11 */
4227 		break;
4228 	case 2467:
4229 		expected_val = 0x001809a0; /* ch 12 */
4230 		break;
4231 	case 2472:
4232 		expected_val = 0x000009a8; /* ch 13 */
4233 		break;
4234 	case 2484:
4235 		expected_val = 0x000009b4; /* ch 14 */
4236 		break;
4237 	}
4238 	KASSERT(val == expected_val);
4239 }
4240 
4241 /* freq is in MHz */
4242 int
4243 rtw_sa2400_tune(struct rtw_softc *sc, u_int freq)
4244 {
4245 	int rc;
4246 	u_int32_t syna, synb, sync;
4247 
4248 	/* XO = 44MHz, R = 11, hence N is in units of XO / R = 4MHz.
4249 	 *
4250 	 * The channel spacing (5MHz) is not divisible by 4MHz, so
4251 	 * we set the fractional part of N to compensate.
4252 	 */
4253 	int n = freq / 4, nf = (freq % 4) * 2;
4254 
4255 	syna = LSHIFT(nf, SA2400_SYNA_NF_MASK) | LSHIFT(n, SA2400_SYNA_N_MASK);
4256 	rtw_verify_syna(freq, syna);
4257 
4258 	/* Divide the 44MHz crystal down to 4MHz. Set the fractional
4259 	 * compensation charge pump value to agree with the fractional
4260 	 * modulus.
4261 	 */
4262 	synb = LSHIFT(11, SA2400_SYNB_R_MASK) | SA2400_SYNB_L_NORMAL |
4263 	    SA2400_SYNB_ON | SA2400_SYNB_ONE |
4264 	    LSHIFT(80, SA2400_SYNB_FC_MASK); /* agrees w/ SA2400_SYNA_FM = 0 */
4265 
4266 	sync = SA2400_SYNC_CP_NORMAL;
4267 
4268 	if ((rc = rtw_rf_macwrite(sc, SA2400_SYNA, syna)) != 0)
4269 		return rc;
4270 	if ((rc = rtw_rf_macwrite(sc, SA2400_SYNB, synb)) != 0)
4271 		return rc;
4272 	if ((rc = rtw_rf_macwrite(sc, SA2400_SYNC, sync)) != 0)
4273 		return rc;
4274 	return rtw_rf_macwrite(sc, SA2400_SYND, 0x0);
4275 }
4276 
4277 int
4278 rtw_sa2400_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4279 {
4280 	u_int32_t opmode;
4281 	opmode = SA2400_OPMODE_DEFAULTS;
4282 	switch (power) {
4283 	case RTW_ON:
4284 		opmode |= SA2400_OPMODE_MODE_TXRX;
4285 		break;
4286 	case RTW_SLEEP:
4287 		opmode |= SA2400_OPMODE_MODE_WAIT;
4288 		break;
4289 	case RTW_OFF:
4290 		opmode |= SA2400_OPMODE_MODE_SLEEP;
4291 		break;
4292 	}
4293 
4294 	if (sc->sc_flags & RTW_F_DIGPHY)
4295 		opmode |= SA2400_OPMODE_DIGIN;
4296 
4297 	return rtw_rf_macwrite(sc, SA2400_OPMODE, opmode);
4298 }
4299 
4300 int
4301 rtw_sa2400_vcocal_start(struct rtw_softc *sc, int start)
4302 {
4303 	u_int32_t opmode;
4304 
4305 	opmode = SA2400_OPMODE_DEFAULTS;
4306 	if (start)
4307 		opmode |= SA2400_OPMODE_MODE_VCOCALIB;
4308 	else
4309 		opmode |= SA2400_OPMODE_MODE_SLEEP;
4310 
4311 	if (sc->sc_flags & RTW_F_DIGPHY)
4312 		opmode |= SA2400_OPMODE_DIGIN;
4313 
4314 	return rtw_rf_macwrite(sc, SA2400_OPMODE, opmode);
4315 }
4316 
4317 int
4318 rtw_sa2400_vco_calibration(struct rtw_softc *sc)
4319 {
4320 	int rc;
4321 	/* calibrate VCO */
4322 	if ((rc = rtw_sa2400_vcocal_start(sc, 1)) != 0)
4323 		return rc;
4324 	DELAY(2200);	/* 2.2 milliseconds */
4325 	/* XXX superfluous: SA2400 automatically entered SLEEP mode. */
4326 	return rtw_sa2400_vcocal_start(sc, 0);
4327 }
4328 
4329 int
4330 rtw_sa2400_filter_calibration(struct rtw_softc *sc)
4331 {
4332 	u_int32_t opmode;
4333 
4334 	opmode = SA2400_OPMODE_DEFAULTS | SA2400_OPMODE_MODE_FCALIB;
4335 	if (sc->sc_flags & RTW_F_DIGPHY)
4336 		opmode |= SA2400_OPMODE_DIGIN;
4337 
4338 	return rtw_rf_macwrite(sc, SA2400_OPMODE, opmode);
4339 }
4340 
4341 int
4342 rtw_sa2400_dc_calibration(struct rtw_softc *sc)
4343 {
4344 	int rc;
4345 	u_int32_t dccal;
4346 
4347 	rtw_continuous_tx_enable(sc, 1);
4348 
4349 	dccal = SA2400_OPMODE_DEFAULTS | SA2400_OPMODE_MODE_TXRX;
4350 
4351 	rc = rtw_rf_macwrite(sc, SA2400_OPMODE, dccal);
4352 
4353 	if (rc != 0)
4354 		return rc;
4355 
4356 	DELAY(5);	/* DCALIB after being in Tx mode for 5
4357 			 * microseconds
4358 			 */
4359 
4360 	dccal &= ~SA2400_OPMODE_MODE_MASK;
4361 	dccal |= SA2400_OPMODE_MODE_DCALIB;
4362 
4363 	rc = rtw_rf_macwrite(sc, SA2400_OPMODE, dccal);
4364 	if (rc != 0)
4365 		return rc;
4366 
4367 	DELAY(20);	/* calibration takes at most 20 microseconds */
4368 
4369 	rtw_continuous_tx_enable(sc, 0);
4370 
4371 	return 0;
4372 }
4373 
4374 int
4375 rtw_sa2400_calibrate(struct rtw_softc *sc, u_int freq)
4376 {
4377 	int i, rc;
4378 
4379 	/* XXX reference driver calibrates VCO twice. Is it a bug? */
4380 	for (i = 0; i < 2; i++) {
4381 		if ((rc = rtw_sa2400_vco_calibration(sc)) != 0)
4382 			return rc;
4383 	}
4384 	/* VCO calibration erases synthesizer registers, so re-tune */
4385 	if ((rc = rtw_sa2400_tune(sc, freq)) != 0)
4386 		return rc;
4387 	if ((rc = rtw_sa2400_filter_calibration(sc)) != 0)
4388 		return rc;
4389 	/* analog PHY needs DC calibration */
4390 	if (!(sc->sc_flags & RTW_F_DIGPHY))
4391 		return rtw_sa2400_dc_calibration(sc);
4392 	return 0;
4393 }
4394 
4395 int
4396 rtw_sa2400_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4397     enum rtw_pwrstate power)
4398 {
4399 	int rc;
4400 	u_int32_t agc, manrx;
4401 
4402 	if ((rc = rtw_sa2400_txpower(sc, opaque_txpower)) != 0)
4403 		return rc;
4404 
4405 	/* skip configuration if it's time to sleep or to power-down. */
4406 	if (power == RTW_SLEEP || power == RTW_OFF)
4407 		return rtw_sa2400_pwrstate(sc, power);
4408 
4409 	/* go to sleep for configuration */
4410 	if ((rc = rtw_sa2400_pwrstate(sc, RTW_SLEEP)) != 0)
4411 		return rc;
4412 
4413 	if ((rc = rtw_sa2400_tune(sc, freq)) != 0)
4414 		return rc;
4415 
4416 	agc = LSHIFT(25, SA2400_AGC_MAXGAIN_MASK);
4417 	agc |= LSHIFT(7, SA2400_AGC_BBPDELAY_MASK);
4418 	agc |= LSHIFT(15, SA2400_AGC_LNADELAY_MASK);
4419 	agc |= LSHIFT(27, SA2400_AGC_RXONDELAY_MASK);
4420 
4421 	if ((rc = rtw_rf_macwrite(sc, SA2400_AGC, agc)) != 0)
4422 		return rc;
4423 
4424 	/* XXX we are not supposed to be in RXMGC mode when we do this? */
4425 	manrx = SA2400_MANRX_AHSN;
4426 	manrx |= SA2400_MANRX_TEN;
4427 	manrx |= LSHIFT(1023, SA2400_MANRX_RXGAIN_MASK);
4428 
4429 	if ((rc = rtw_rf_macwrite(sc, SA2400_MANRX, manrx)) != 0)
4430 		return rc;
4431 
4432 	if ((rc = rtw_sa2400_calibrate(sc, freq)) != 0)
4433 		return rc;
4434 
4435 	/* enter Tx/Rx mode */
4436 	return rtw_sa2400_pwrstate(sc, power);
4437 }
4438 
4439 /* freq is in MHz */
4440 int
4441 rtw_max2820_tune(struct rtw_softc *sc, u_int freq)
4442 {
4443 	if (freq < 2400 || freq > 2499)
4444 		return -1;
4445 
4446 	return rtw_rf_hostwrite(sc, MAX2820_CHANNEL,
4447 	    LSHIFT(freq - 2400, MAX2820_CHANNEL_CF_MASK));
4448 }
4449 
4450 int
4451 rtw_max2820_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4452     enum rtw_pwrstate power)
4453 {
4454 	int rc;
4455 
4456 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_TEST,
4457 	    MAX2820_TEST_DEFAULT)) != 0)
4458 		return rc;
4459 
4460 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_ENABLE,
4461 	    MAX2820_ENABLE_DEFAULT)) != 0)
4462 		return rc;
4463 
4464 	/* skip configuration if it's time to sleep or to power-down. */
4465 	if ((rc = rtw_max2820_pwrstate(sc, power)) != 0)
4466 		return rc;
4467 	else if (power == RTW_OFF || power == RTW_SLEEP)
4468 		return 0;
4469 
4470 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_SYNTH,
4471 	    MAX2820_SYNTH_R_44MHZ)) != 0)
4472 		return rc;
4473 
4474 	if ((rc = rtw_max2820_tune(sc, freq)) != 0)
4475 		return rc;
4476 
4477 	/* XXX The MAX2820 datasheet indicates that 1C and 2C should not
4478 	 * be changed from 7, however, the reference driver sets them
4479 	 * to 4 and 1, respectively.
4480 	 */
4481 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_RECEIVE,
4482 	    MAX2820_RECEIVE_DL_DEFAULT |
4483 	    LSHIFT(4, MAX2820A_RECEIVE_1C_MASK) |
4484 	    LSHIFT(1, MAX2820A_RECEIVE_2C_MASK))) != 0)
4485 		return rc;
4486 
4487 	return rtw_rf_hostwrite(sc, MAX2820_TRANSMIT,
4488 	    MAX2820_TRANSMIT_PA_DEFAULT);
4489 }
4490 
4491 int
4492 rtw_max2820_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4493 {
4494 	/* TBD */
4495 	return 0;
4496 }
4497 
4498 int
4499 rtw_max2820_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4500 {
4501 	uint32_t enable;
4502 
4503 	switch (power) {
4504 	case RTW_OFF:
4505 	case RTW_SLEEP:
4506 	default:
4507 		enable = 0x0;
4508 		break;
4509 	case RTW_ON:
4510 		enable = MAX2820_ENABLE_DEFAULT;
4511 		break;
4512 	}
4513 	return rtw_rf_hostwrite(sc, MAX2820_ENABLE, enable);
4514 }
4515 
4516 int
4517 rtw_grf5101_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4518     enum rtw_pwrstate power)
4519 {
4520 	int rc;
4521 
4522 	/*
4523 	 * These values have been derived from the rtl8180-sa2400 Linux driver.
4524 	 * It is unknown what they all do, GCT refuse to release any documentation
4525 	 * so these are more than likely sub optimal settings
4526 	 */
4527 
4528 	rtw_rf_macwrite(sc, 0x01, 0x1a23);
4529 	rtw_rf_macwrite(sc, 0x02, 0x4971);
4530 	rtw_rf_macwrite(sc, 0x03, 0x41de);
4531 	rtw_rf_macwrite(sc, 0x04, 0x2d80);
4532 
4533 	rtw_rf_macwrite(sc, 0x05, 0x61ff);
4534 
4535 	rtw_rf_macwrite(sc, 0x06, 0x0);
4536 
4537 	rtw_rf_macwrite(sc, 0x08, 0x7533);
4538 	rtw_rf_macwrite(sc, 0x09, 0xc401);
4539 	rtw_rf_macwrite(sc, 0x0a, 0x0);
4540 	rtw_rf_macwrite(sc, 0x0c, 0x1c7);
4541 	rtw_rf_macwrite(sc, 0x0d, 0x29d3);
4542 	rtw_rf_macwrite(sc, 0x0e, 0x2e8);
4543 	rtw_rf_macwrite(sc, 0x10, 0x192);
4544 	rtw_rf_macwrite(sc, 0x11, 0x248);
4545 	rtw_rf_macwrite(sc, 0x12, 0x0);
4546 	rtw_rf_macwrite(sc, 0x13, 0x20c4);
4547 	rtw_rf_macwrite(sc, 0x14, 0xf4fc);
4548 	rtw_rf_macwrite(sc, 0x15, 0x0);
4549 	rtw_rf_macwrite(sc, 0x16, 0x1500);
4550 
4551 	if ((rc = rtw_grf5101_txpower(sc, opaque_txpower)) != 0)
4552 		return rc;
4553 
4554 	if ((rc = rtw_grf5101_tune(sc, freq)) != 0)
4555 		return rc;
4556 
4557 	return (0);
4558 }
4559 
4560 int
4561 rtw_grf5101_tune(struct rtw_softc *sc, u_int freq)
4562 {
4563 	struct ieee80211com *ic = &sc->sc_ic;
4564 	u_int channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
4565 
4566 	/* set channel */
4567 	rtw_rf_macwrite(sc, 0x07, 0);
4568 	rtw_rf_macwrite(sc, 0x0b, channel - 1);
4569 	rtw_rf_macwrite(sc, 0x07, 0x1000);
4570 
4571 	return (0);
4572 }
4573 
4574 int
4575 rtw_grf5101_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4576 {
4577 	rtw_rf_macwrite(sc, 0x15, 0);
4578 	rtw_rf_macwrite(sc, 0x06, opaque_txpower);
4579 	rtw_rf_macwrite(sc, 0x15, 0x10);
4580 	rtw_rf_macwrite(sc, 0x15, 0x00);
4581 
4582 	return (0);
4583 }
4584 
4585 int
4586 rtw_grf5101_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4587 {
4588 	switch (power) {
4589 	case RTW_OFF:
4590 		/* FALLTHROUGH */
4591 	case RTW_SLEEP:
4592 		rtw_rf_macwrite(sc, 0x07, 0x0000);
4593 		rtw_rf_macwrite(sc, 0x1f, 0x0045);
4594 		rtw_rf_macwrite(sc, 0x1f, 0x0005);
4595 		rtw_rf_macwrite(sc, 0x00, 0x08e4);
4596 		break;
4597 	case RTW_ON:
4598 		rtw_rf_macwrite(sc, 0x1f, 0x0001);
4599 		DELAY(10);
4600 		rtw_rf_macwrite(sc, 0x1f, 0x0001);
4601 		DELAY(10);
4602 		rtw_rf_macwrite(sc, 0x1f, 0x0041);
4603 		DELAY(10);
4604 		rtw_rf_macwrite(sc, 0x1f, 0x0061);
4605 		DELAY(10);
4606 		rtw_rf_macwrite(sc, 0x00, 0x0ae4);
4607 		DELAY(10);
4608 		rtw_rf_macwrite(sc, 0x07, 0x1000);
4609 		DELAY(100);
4610 		break;
4611 	}
4612 
4613 	return 0;
4614 }
4615 
4616 int
4617 rtw_rtl8225_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4618 {
4619 	return (0);
4620 }
4621 
4622 int
4623 rtw_rtl8225_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4624     enum rtw_pwrstate power)
4625 {
4626 	return (0);
4627 }
4628 
4629 int
4630 rtw_rtl8225_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4631 {
4632 	return (0);
4633 }
4634 
4635 int
4636 rtw_rtl8225_tune(struct rtw_softc *sc, u_int freq)
4637 {
4638 	return (0);
4639 }
4640 
4641 int
4642 rtw_rtl8255_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4643 {
4644 	return (0);
4645 }
4646 
4647 int
4648 rtw_rtl8255_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4649     enum rtw_pwrstate power)
4650 {
4651 	return (0);
4652 }
4653 
4654 int
4655 rtw_rtl8255_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4656 {
4657 	return (0);
4658 }
4659 
4660 int
4661 rtw_rtl8255_tune(struct rtw_softc *sc, u_int freq)
4662 {
4663 	return (0);
4664 }
4665 
4666 int
4667 rtw_phy_init(struct rtw_softc *sc)
4668 {
4669 	int rc;
4670 	struct ieee80211com *ic = &sc->sc_ic;
4671 	struct rtw_regs *regs = &sc->sc_regs;
4672 	int antdiv = sc->sc_flags & RTW_F_ANTDIV;
4673 	int dflantb = sc->sc_flags & RTW_F_DFLANTB;
4674 	u_int freq = ic->ic_bss->ni_chan->ic_freq;	/* freq is in MHz */
4675 	u_int8_t opaque_txpower = rtw_chan2txpower(&sc->sc_srom, ic,
4676 	    ic->ic_bss->ni_chan);
4677 	u_int8_t cs_threshold = sc->sc_csthr;
4678 	enum rtw_pwrstate power = RTW_ON;
4679 
4680 	RTW_DPRINTF(RTW_DEBUG_PHY,
4681 	    ("%s: txpower %u csthresh %u freq %u antdiv %u dflantb %u "
4682 	     "pwrstate %s\n", __func__, opaque_txpower, cs_threshold, freq,
4683 	     antdiv, dflantb, rtw_pwrstate_string(power)));
4684 
4685 	/* XXX is this really necessary? */
4686 	if ((rc = (*sc->sc_rf_txpower)(sc, opaque_txpower)) != 0)
4687 		return rc;
4688 	if ((rc = rtw_bbp_preinit(regs, sc->sc_bbpset.bb_antatten, dflantb,
4689 	    freq)) != 0)
4690 		return rc;
4691 	if ((rc = (*sc->sc_rf_tune)(sc, freq)) != 0)
4692 		return rc;
4693 	/* initialize RF  */
4694 	if ((rc = (*sc->sc_rf_init)(sc, freq, opaque_txpower, power)) != 0)
4695 		return rc;
4696 #if 0	/* what is this redundant tx power setting here for? */
4697 	if ((rc = (*sc->sc_rf_txpower)(sc, opaque_txpower)) != 0)
4698 		return rc;
4699 #endif
4700 	return rtw_bbp_init(regs, &sc->sc_bbpset, antdiv, dflantb,
4701 	    cs_threshold, freq);
4702 }
4703 
4704 /*
4705  * Generic PHY I/O functions
4706  */
4707 
4708 int
4709 rtw_bbp_write(struct rtw_regs *regs, u_int addr, u_int val)
4710 {
4711 #define	BBP_WRITE_ITERS	50
4712 #define	BBP_WRITE_DELAY	1
4713 	int i;
4714 	u_int32_t wrbbp, rdbbp;
4715 
4716 	RTW_DPRINTF(RTW_DEBUG_PHYIO,
4717 	    ("%s: bbp[%u] <- %u\n", __func__, addr, val));
4718 
4719 	KASSERT((addr & ~PRESHIFT(RTW_BB_ADDR_MASK)) == 0);
4720 	KASSERT((val & ~PRESHIFT(RTW_BB_WR_MASK)) == 0);
4721 
4722 	wrbbp = LSHIFT(addr, RTW_BB_ADDR_MASK) | RTW_BB_WREN |
4723 	    LSHIFT(val, RTW_BB_WR_MASK) | RTW_BB_RD_MASK,
4724 
4725 	rdbbp = LSHIFT(addr, RTW_BB_ADDR_MASK) |
4726 	    RTW_BB_WR_MASK | RTW_BB_RD_MASK;
4727 
4728 	RTW_DPRINTF(RTW_DEBUG_PHYIO,
4729 	    ("%s: rdbbp = %#08x, wrbbp = %#08x\n", __func__, rdbbp, wrbbp));
4730 
4731 	for (i = BBP_WRITE_ITERS; --i >= 0; ) {
4732 		RTW_RBW(regs, RTW_BB, RTW_BB);
4733 		RTW_WRITE(regs, RTW_BB, wrbbp);
4734 		RTW_SYNC(regs, RTW_BB, RTW_BB);
4735 		RTW_WRITE(regs, RTW_BB, rdbbp);
4736 		RTW_SYNC(regs, RTW_BB, RTW_BB);
4737 		delay(BBP_WRITE_DELAY);	/* 1 microsecond */
4738 		if (MASK_AND_RSHIFT(RTW_READ(regs, RTW_BB),
4739 		    RTW_BB_RD_MASK) == val) {
4740 			RTW_DPRINTF(RTW_DEBUG_PHYIO,
4741 			    ("%s: finished in %dus\n", __func__,
4742 			    BBP_WRITE_DELAY * (BBP_WRITE_ITERS - i)));
4743 			return 0;
4744 		}
4745 		delay(BBP_WRITE_DELAY);	/* again */
4746 	}
4747 	printf("%s: timeout\n", __func__);
4748 	return -1;
4749 }
4750 
4751 /* Help rtw_rf_hostwrite bang bits to RF over 3-wire interface. */
4752 void
4753 rtw_rf_hostbangbits(struct rtw_regs *regs, u_int32_t bits, int lo_to_hi,
4754     u_int nbits)
4755 {
4756 	int i;
4757 	u_int32_t mask, reg;
4758 
4759 	KASSERT(nbits <= 32);
4760 
4761 	RTW_DPRINTF(RTW_DEBUG_PHYIO,
4762 	    ("%s: %u bits, %#08x, %s\n", __func__, nbits, bits,
4763 	    (lo_to_hi) ? "lo to hi" : "hi to lo"));
4764 
4765 	reg = RTW8180_PHYCFG_HST;
4766 	RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4767 	RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4768 
4769 	if (lo_to_hi)
4770 		mask = 0x1;
4771 	else
4772 		mask = 1 << (nbits - 1);
4773 
4774 	for (i = 0; i < nbits; i++) {
4775 		RTW_DPRINTF(RTW_DEBUG_PHYBITIO,
4776 		    ("%s: bits %#08x mask %#08x -> bit %#08x\n",
4777 		    __func__, bits, mask, bits & mask));
4778 
4779 		if ((bits & mask) != 0)
4780 			reg |= RTW8180_PHYCFG_HST_DATA;
4781 		else
4782 			reg &= ~RTW8180_PHYCFG_HST_DATA;
4783 
4784 		reg |= RTW8180_PHYCFG_HST_CLK;
4785 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4786 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4787 
4788 		DELAY(2);	/* arbitrary delay */
4789 
4790 		reg &= ~RTW8180_PHYCFG_HST_CLK;
4791 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4792 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4793 
4794 		if (lo_to_hi)
4795 			mask <<= 1;
4796 		else
4797 			mask >>= 1;
4798 	}
4799 
4800 	reg |= RTW8180_PHYCFG_HST_EN;
4801 	KASSERT((reg & RTW8180_PHYCFG_HST_CLK) == 0);
4802 	RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4803 	RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4804 }
4805 
4806 #if 0
4807 void
4808 rtw_rf_rtl8225_hostbangbits(struct rtw_regs *regs, u_int32_t bits, int lo_to_hi,
4809     u_int nbits)
4810 {
4811 	int i;
4812 	u_int8_t page;
4813 	u_int16_t reg0, reg1, reg2;
4814 	u_int32_t mask;
4815 
4816 	/* enable page 0 */
4817 	page = RTW_READ8(regs, RTW_PSR);
4818 	RTW_WRITE8(regs, RTW_PSR, page & ~RTW_PSR_PSEN);
4819 
4820 	/* enable RF access */
4821 	reg0 = RTW_READ16(regs, RTW8185_RFPINSOUTPUT) &
4822 	    RTW8185_RFPINSOUTPUT_MASK;
4823 	reg1 = RTW_READ16(regs, RTW8185_RFPINSENABLE);
4824 	RTW_WRITE16(regs, RTW8185_RFPINSENABLE,
4825 	    RTW8185_RFPINSENABLE_ENABLE | reg0);
4826 	reg2 = RTW_READ16(regs, RTW8185_RFPINSSELECT);
4827 	RTW_WRITE16(regs, RTW8185_RFPINSSELECT,
4828 	    RTW8185_RFPINSSELECT_ENABLE | reg1 /* XXX | SW_GPIO_CTL */);
4829 	DELAY(10);
4830 
4831 	RTW_WRITE16(regs, RTW8185_RFPINSOUTPUT, reg0);
4832 	DELAY(10);
4833 
4834 	if (lo_to_hi)
4835 		mask = 0x1;
4836 	else
4837 		mask = 1 << (nbits - 1);
4838 
4839 	for (i = 0; i < nbits; i++) {
4840 		RTW_DPRINTF(RTW_DEBUG_PHYBITIO,
4841 		    ("%s: bits %#08x mask %#08x -> bit %#08x\n",
4842 		    __func__, bits, mask, bits & mask));
4843 
4844 		if ((bits & mask) != 0)
4845 			reg |= RTW8180_PHYCFG_HST_DATA;
4846 		else
4847 			reg &= ~RTW8180_PHYCFG_HST_DATA;
4848 
4849 		reg |= RTW8180_PHYCFG_HST_CLK;
4850 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4851 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4852 
4853 		DELAY(2);	/* arbitrary delay */
4854 
4855 		reg &= ~RTW8180_PHYCFG_HST_CLK;
4856 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4857 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4858 
4859 		if (lo_to_hi)
4860 			mask <<= 1;
4861 		else
4862 			mask >>= 1;
4863 	}
4864 
4865 	/* reset the page */
4866 	RTW_WRITE8(regs, RTW_PSR, page);
4867 }
4868 #endif
4869 
4870 /* Help rtw_rf_macwrite: tell MAC to bang bits to RF over the 3-wire
4871  * interface.
4872  */
4873 int
4874 rtw_rf_macbangbits(struct rtw_regs *regs, u_int32_t reg)
4875 {
4876 	int i;
4877 
4878 	RTW_DPRINTF(RTW_DEBUG_PHY, ("%s: %#08x\n", __func__, reg));
4879 
4880 	RTW_WRITE(regs, RTW8180_PHYCFG, RTW8180_PHYCFG_MAC_POLL | reg);
4881 
4882 	RTW_WBR(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4883 
4884 	for (i = rtw_macbangbits_timeout; --i >= 0; delay(1)) {
4885 		if ((RTW_READ(regs, RTW8180_PHYCFG) &
4886 		    RTW8180_PHYCFG_MAC_POLL) == 0) {
4887 			RTW_DPRINTF(RTW_DEBUG_PHY,
4888 			    ("%s: finished in %dus\n", __func__,
4889 			    rtw_macbangbits_timeout - i));
4890 			return 0;
4891 		}
4892 		RTW_RBR(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4893 	}
4894 
4895 	printf("%s: RTW8180_PHYCFG_MAC_POLL still set.\n", __func__);
4896 	return -1;
4897 }
4898 
4899 u_int32_t
4900 rtw_grf5101_host_crypt(u_int addr, u_int32_t val)
4901 {
4902 	/* TBD */
4903 	return 0;
4904 }
4905 
4906 u_int32_t
4907 rtw_grf5101_mac_crypt(u_int addr, u_int32_t val)
4908 {
4909 	u_int32_t data_and_addr;
4910 #define EXTRACT_NIBBLE(d, which) (((d) >> (4 * (which))) & 0xf)
4911 	static u_int8_t caesar[16] = {
4912 		0x0, 0x8, 0x4, 0xc,
4913 		0x2, 0xa, 0x6, 0xe,
4914 		0x1, 0x9, 0x5, 0xd,
4915 		0x3, 0xb, 0x7, 0xf
4916 	};
4917 	data_and_addr =
4918 	    caesar[EXTRACT_NIBBLE(val, 2)] |
4919 	    (caesar[EXTRACT_NIBBLE(val, 1)] <<  4) |
4920 	    (caesar[EXTRACT_NIBBLE(val, 0)] <<  8) |
4921 	    (caesar[(addr >> 1) & 0xf]      << 12) |
4922 	    ((addr & 0x1)                   << 16) |
4923 	    (caesar[EXTRACT_NIBBLE(val, 3)] << 24);
4924 	return LSHIFT(data_and_addr, RTW8180_PHYCFG_MAC_PHILIPS_ADDR_MASK |
4925 	    RTW8180_PHYCFG_MAC_PHILIPS_DATA_MASK);
4926 #undef EXTRACT_NIBBLE
4927 }
4928 
4929 /* Bang bits over the 3-wire interface. */
4930 int
4931 rtw_rf_hostwrite(struct rtw_softc *sc, u_int addr, u_int32_t val)
4932 {
4933 	u_int nbits;
4934 	int lo_to_hi;
4935 	u_int32_t bits;
4936 	void(*rf_bangbits)(struct rtw_regs *, u_int32_t, int, u_int) =
4937 	    rtw_rf_hostbangbits;
4938 
4939 	RTW_DPRINTF(RTW_DEBUG_PHYIO, ("%s: [%u] <- %#08x\n", __func__,
4940 	    addr, val));
4941 
4942 	switch (sc->sc_rfchipid) {
4943 	case RTW_RFCHIPID_MAXIM2820:
4944 		nbits = 16;
4945 		lo_to_hi = 0;
4946 		bits = LSHIFT(val, MAX2820_TWI_DATA_MASK) |
4947 		    LSHIFT(addr, MAX2820_TWI_ADDR_MASK);
4948 		break;
4949 	case RTW_RFCHIPID_PHILIPS:
4950 		KASSERT((addr & ~PRESHIFT(SA2400_TWI_ADDR_MASK)) == 0);
4951 		KASSERT((val & ~PRESHIFT(SA2400_TWI_DATA_MASK)) == 0);
4952 		bits = LSHIFT(val, SA2400_TWI_DATA_MASK) |
4953 		    LSHIFT(addr, SA2400_TWI_ADDR_MASK) | SA2400_TWI_WREN;
4954 		nbits = 32;
4955 		lo_to_hi = 1;
4956 		break;
4957 	case RTW_RFCHIPID_GCT:
4958 		KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
4959 		KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
4960 		bits = rtw_grf5101_host_crypt(addr, val);
4961 		nbits = 21;
4962 		lo_to_hi = 1;
4963 		break;
4964 	case RTW_RFCHIPID_RFMD2948:
4965 		KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
4966 		KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
4967 		bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
4968 		    LSHIFT(addr, SI4126_TWI_ADDR_MASK);
4969 		nbits = 22;
4970 		lo_to_hi = 0;
4971 		break;
4972 	case RTW_RFCHIPID_RTL8225:
4973 	case RTW_RFCHIPID_RTL8255:
4974 		nbits = 16;
4975 		lo_to_hi = 0;
4976 		bits = LSHIFT(val, RTL8225_TWI_DATA_MASK) |
4977 		    LSHIFT(addr, RTL8225_TWI_ADDR_MASK);
4978 
4979 		/* the RTL8225 uses a slightly modified RF interface */
4980 		rf_bangbits = rtw_rf_hostbangbits;
4981 		break;
4982 	case RTW_RFCHIPID_INTERSIL:
4983 	default:
4984 		printf("%s: unknown rfchipid %d\n", __func__, sc->sc_rfchipid);
4985 		return -1;
4986 	}
4987 
4988 	(*rf_bangbits)(&sc->sc_regs, bits, lo_to_hi, nbits);
4989 
4990 	return 0;
4991 }
4992 
4993 u_int32_t
4994 rtw_maxim_swizzle(u_int addr, u_int32_t val)
4995 {
4996 	u_int32_t hidata, lodata;
4997 
4998 	KASSERT((val & ~(RTW_MAXIM_LODATA_MASK|RTW_MAXIM_HIDATA_MASK)) == 0);
4999 	lodata = MASK_AND_RSHIFT(val, RTW_MAXIM_LODATA_MASK);
5000 	hidata = MASK_AND_RSHIFT(val, RTW_MAXIM_HIDATA_MASK);
5001 	return LSHIFT(lodata, RTW8180_PHYCFG_MAC_MAXIM_LODATA_MASK) |
5002 	    LSHIFT(hidata, RTW8180_PHYCFG_MAC_MAXIM_HIDATA_MASK) |
5003 	    LSHIFT(addr, RTW8180_PHYCFG_MAC_MAXIM_ADDR_MASK);
5004 }
5005 
5006 /* Tell the MAC what to bang over the 3-wire interface. */
5007 int
5008 rtw_rf_macwrite(struct rtw_softc *sc, u_int addr, u_int32_t val)
5009 {
5010 	u_int32_t reg;
5011 
5012 	RTW_DPRINTF(RTW_DEBUG_PHYIO, ("%s: %s[%u] <- %#08x\n", __func__,
5013 	    addr, val));
5014 
5015 	switch (sc->sc_rfchipid) {
5016 	case RTW_RFCHIPID_GCT:
5017 		reg = rtw_grf5101_mac_crypt(addr, val);
5018 		break;
5019 	case RTW_RFCHIPID_MAXIM2820:
5020 		reg = rtw_maxim_swizzle(addr, val);
5021 		break;
5022 	default:		/* XXX */
5023 	case RTW_RFCHIPID_PHILIPS:
5024 		KASSERT((addr &
5025 		    ~PRESHIFT(RTW8180_PHYCFG_MAC_PHILIPS_ADDR_MASK)) == 0);
5026 		KASSERT((val &
5027 		    ~PRESHIFT(RTW8180_PHYCFG_MAC_PHILIPS_DATA_MASK)) == 0);
5028 
5029 		reg = LSHIFT(addr, RTW8180_PHYCFG_MAC_PHILIPS_ADDR_MASK) |
5030 		    LSHIFT(val, RTW8180_PHYCFG_MAC_PHILIPS_DATA_MASK);
5031 	}
5032 
5033 	switch (sc->sc_rfchipid) {
5034 	case RTW_RFCHIPID_GCT:
5035 	case RTW_RFCHIPID_MAXIM2820:
5036 	case RTW_RFCHIPID_RFMD2948:
5037 		reg |= RTW8180_PHYCFG_MAC_RFTYPE_RFMD;
5038 		break;
5039 	case RTW_RFCHIPID_INTERSIL:
5040 		reg |= RTW8180_PHYCFG_MAC_RFTYPE_INTERSIL;
5041 		break;
5042 	case RTW_RFCHIPID_PHILIPS:
5043 		reg |= RTW8180_PHYCFG_MAC_RFTYPE_PHILIPS;
5044 		break;
5045 	default:
5046 		printf("%s: unknown rfchipid %d\n", __func__, sc->sc_rfchipid);
5047 		return -1;
5048 	}
5049 
5050 	return rtw_rf_macbangbits(&sc->sc_regs, reg);
5051 }
5052 
5053 
5054 u_int8_t
5055 rtw_read8(void *arg, u_int32_t off)
5056 {
5057 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5058 	return (bus_space_read_1(regs->r_bt, regs->r_bh, off));
5059 }
5060 
5061 u_int16_t
5062 rtw_read16(void *arg, u_int32_t off)
5063 {
5064 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5065 	return (bus_space_read_2(regs->r_bt, regs->r_bh, off));
5066 }
5067 
5068 u_int32_t
5069 rtw_read32(void *arg, u_int32_t off)
5070 {
5071 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5072 	return (bus_space_read_4(regs->r_bt, regs->r_bh, off));
5073 }
5074 
5075 void
5076 rtw_write8(void *arg, u_int32_t off, u_int8_t val)
5077 {
5078 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5079 	bus_space_write_1(regs->r_bt, regs->r_bh, off, val);
5080 }
5081 
5082 void
5083 rtw_write16(void *arg, u_int32_t off, u_int16_t val)
5084 {
5085 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5086 	bus_space_write_2(regs->r_bt, regs->r_bh, off, val);
5087 }
5088 
5089 void
5090 rtw_write32(void *arg, u_int32_t off, u_int32_t val)
5091 {
5092 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5093 	bus_space_write_4(regs->r_bt, regs->r_bh, off, val);
5094 }
5095 
5096 void
5097 rtw_barrier(void *arg, u_int32_t reg0, u_int32_t reg1, int flags)
5098 {
5099 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5100 	bus_space_barrier(regs->r_bt, regs->r_bh, MIN(reg0, reg1),
5101 	    MAX(reg0, reg1) - MIN(reg0, reg1) + 4, flags);
5102 }
5103