xref: /openbsd-src/sys/dev/ic/rtw.c (revision f2da64fbbbf1b03f09f390ab01267c93dfd77c4c)
1 /*	$OpenBSD: rtw.c,v 1.96 2016/04/13 10:49:26 mpi Exp $	*/
2 /*	$NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
3 
4 /*-
5  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
6  *
7  * Programmed for NetBSD by David Young.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. The name of David Young may not be used to endorse or promote
18  *    products derived from this software without specific prior
19  *    written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
22  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
23  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
24  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
25  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
26  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
27  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
29  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
32  * OF SUCH DAMAGE.
33  */
34 /*
35  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
36  */
37 
38 #include "bpfilter.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/malloc.h>
44 #include <sys/kernel.h>
45 #include <sys/ioctl.h>
46 #include <sys/socket.h>
47 #include <sys/time.h>
48 #include <sys/types.h>
49 #include <sys/endian.h>
50 
51 #include <machine/bus.h>
52 #include <machine/intr.h>	/* splnet */
53 
54 #include <net/if.h>
55 #include <net/if_media.h>
56 
57 #if NBPFILTER > 0
58 #include <net/bpf.h>
59 #endif
60 
61 #include <netinet/in.h>
62 #include <netinet/if_ether.h>
63 
64 #include <net80211/ieee80211_var.h>
65 #include <net80211/ieee80211_radiotap.h>
66 
67 #include <dev/ic/rtwreg.h>
68 #include <dev/ic/rtwvar.h>
69 #include <dev/ic/max2820reg.h>
70 #include <dev/ic/sa2400reg.h>
71 #include <dev/ic/si4136reg.h>
72 #include <dev/ic/rtl8225reg.h>
73 #include <dev/ic/smc93cx6var.h>
74 
75 int rtw_rfprog_fallback = 0;
76 int rtw_do_chip_reset = 0;
77 int rtw_dwelltime = 200;	/* milliseconds per channel */
78 int rtw_macbangbits_timeout = 100;
79 
80 #ifdef RTW_DEBUG
81 int rtw_debug = 0;
82 int rtw_rxbufs_limit = RTW_RXQLEN;
83 #endif /* RTW_DEBUG */
84 
85 void	 rtw_start(struct ifnet *);
86 void	 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *);
87 void	 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *);
88 void	 rtw_txdesc_blk_init(struct rtw_txdesc_blk *);
89 void	 rtw_txdescs_sync(struct rtw_txdesc_blk *, u_int, u_int, int);
90 void	 rtw_txring_fixup(struct rtw_softc *);
91 void	 rtw_rxbufs_release(bus_dma_tag_t, struct rtw_rxsoft *);
92 void	 rtw_rxdesc_init(struct rtw_rxdesc_blk *, struct rtw_rxsoft *, int, int);
93 void	 rtw_rxring_fixup(struct rtw_softc *);
94 void	 rtw_io_enable(struct rtw_regs *, u_int8_t, int);
95 void	 rtw_intr_rx(struct rtw_softc *, u_int16_t);
96 #ifndef IEEE80211_STA_ONLY
97 void	 rtw_intr_beacon(struct rtw_softc *, u_int16_t);
98 void	 rtw_intr_atim(struct rtw_softc *);
99 #endif
100 void	 rtw_transmit_config(struct rtw_softc *);
101 void	 rtw_pktfilt_load(struct rtw_softc *);
102 void	 rtw_start(struct ifnet *);
103 void	 rtw_watchdog(struct ifnet *);
104 void	 rtw_next_scan(void *);
105 #ifndef IEEE80211_STA_ONLY
106 void	 rtw_recv_mgmt(struct ieee80211com *, struct mbuf *,
107 	    struct ieee80211_node *, struct ieee80211_rxinfo *, int);
108 #endif
109 struct ieee80211_node *rtw_node_alloc(struct ieee80211com *);
110 void	 rtw_node_free(struct ieee80211com *, struct ieee80211_node *);
111 void	 rtw_media_status(struct ifnet *, struct ifmediareq *);
112 void	 rtw_txsoft_blk_cleanup_all(struct rtw_softc *);
113 void	 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *, struct rtw_txdesc *,
114 	    u_int, bus_addr_t, bus_addr_t);
115 void	 rtw_txdesc_blk_setup_all(struct rtw_softc *);
116 void	 rtw_intr_tx(struct rtw_softc *, u_int16_t);
117 void	 rtw_intr_ioerror(struct rtw_softc *, u_int16_t);
118 void	 rtw_intr_timeout(struct rtw_softc *);
119 void	 rtw_stop(struct ifnet *, int);
120 void	 rtw_maxim_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
121 void	 rtw_philips_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
122 void	 rtw_rtl_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
123 void	 rtw_pwrstate0(struct rtw_softc *, enum rtw_pwrstate, int, int);
124 void	 rtw_join_bss(struct rtw_softc *, u_int8_t *, u_int16_t);
125 void	 rtw_set_access1(struct rtw_regs *, enum rtw_access);
126 int	 rtw_srom_parse(struct rtw_softc *);
127 int	 rtw_srom_read(struct rtw_regs *, u_int32_t, struct rtw_srom *,
128 	    const char *);
129 void	 rtw_set_rfprog(struct rtw_regs *, int, const char *);
130 u_int8_t rtw_chan2txpower(struct rtw_srom *, struct ieee80211com *,
131 	    struct ieee80211_channel *);
132 int	 rtw_txsoft_blk_init(struct rtw_txsoft_blk *);
133 int	 rtw_rxsoft_init_all(bus_dma_tag_t, struct rtw_rxsoft *,
134 	    int *, const char *);
135 void	 rtw_txsoft_release(bus_dma_tag_t, struct ieee80211com *,
136 	    struct rtw_txsoft *);
137 void	 rtw_txsofts_release(bus_dma_tag_t, struct ieee80211com *,
138 	    struct rtw_txsoft_blk *);
139 void	 rtw_hwring_setup(struct rtw_softc *);
140 int	 rtw_swring_setup(struct rtw_softc *);
141 void	 rtw_txdescs_reset(struct rtw_softc *);
142 void	 rtw_rfmd_pwrstate(struct rtw_regs *, enum rtw_pwrstate, int, int);
143 int	 rtw_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
144 int	 rtw_tune(struct rtw_softc *);
145 void	 rtw_set_nettype(struct rtw_softc *, enum ieee80211_opmode);
146 int	 rtw_compute_duration1(int, int, uint32_t, int, struct rtw_duration *);
147 int	 rtw_compute_duration(struct ieee80211_frame *, int, uint32_t, int,
148 	    int, struct rtw_duration *, struct rtw_duration *, int *, int);
149 int	 rtw_init(struct ifnet *);
150 int	 rtw_ioctl(struct ifnet *, u_long, caddr_t);
151 int	 rtw_seg_too_short(bus_dmamap_t);
152 struct mbuf *rtw_dmamap_load_txbuf(bus_dma_tag_t, bus_dmamap_t, struct mbuf *,
153 	    u_int, short *, const char *);
154 int	 rtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
155 int	 rtw_media_change(struct ifnet *);
156 int	 rtw_txsoft_blk_setup_all(struct rtw_softc *);
157 int	 rtw_rf_attach(struct rtw_softc *, int);
158 u_int8_t rtw_check_phydelay(struct rtw_regs *, u_int32_t);
159 int	 rtw_chip_reset1(struct rtw_regs *, const char *);
160 int	 rtw_chip_reset(struct rtw_regs *, const char *);
161 int	 rtw_recall_eeprom(struct rtw_regs *, const char *);
162 int	 rtw_reset(struct rtw_softc *);
163 void	 rtw_reset_oactive(struct rtw_softc *);
164 int	 rtw_txdesc_dmamaps_create(bus_dma_tag_t, struct rtw_txsoft *, u_int);
165 int	 rtw_rxdesc_dmamaps_create(bus_dma_tag_t, struct rtw_rxsoft *, u_int);
166 void	 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t, struct rtw_rxsoft *, u_int);
167 void	 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t, struct rtw_txsoft *, u_int);
168 void	 rtw_identify_country(struct rtw_regs *, enum rtw_locale *);
169 int	 rtw_identify_sta(struct rtw_regs *, u_int8_t (*)[], const char *);
170 void	 rtw_rxdescs_sync(struct rtw_rxdesc_blk *, int, int, int);
171 int	 rtw_rxsoft_alloc(bus_dma_tag_t, struct rtw_rxsoft *);
172 void	 rtw_collect_txpkt(struct rtw_softc *, struct rtw_txdesc_blk *,
173 	    struct rtw_txsoft *, int);
174 void	 rtw_collect_txring(struct rtw_softc *, struct rtw_txsoft_blk *,
175 	    struct rtw_txdesc_blk *, int);
176 void	 rtw_suspend_ticks(struct rtw_softc *);
177 void	 rtw_resume_ticks(struct rtw_softc *);
178 void	 rtw_enable_interrupts(struct rtw_softc *);
179 int	 rtw_dequeue(struct ifnet *, struct rtw_txsoft_blk **,
180 	    struct rtw_txdesc_blk **, struct mbuf **,
181 	    struct ieee80211_node **);
182 int	 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *, u_int);
183 void	 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *, struct rtw_rxsoft *,
184 	    int);
185 int	 rtw_txring_choose(struct rtw_softc *, struct rtw_txsoft_blk **,
186 	    struct rtw_txdesc_blk **, int);
187 u_int	 rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
188 struct mbuf *rtw_80211_dequeue(struct rtw_softc *, struct mbuf_queue *, int,
189 	    struct rtw_txsoft_blk **, struct rtw_txdesc_blk **,
190 	    struct ieee80211_node **);
191 uint64_t rtw_tsf_extend(struct rtw_regs *, u_int32_t);
192 #ifndef IEEE80211_STA_ONLY
193 void	 rtw_ibss_merge(struct rtw_softc *, struct ieee80211_node *,
194 	    u_int32_t);
195 #endif
196 void	 rtw_idle(struct rtw_regs *);
197 void	 rtw_led_attach(struct rtw_led_state *, void *);
198 void	 rtw_led_init(struct rtw_regs *);
199 void	 rtw_led_slowblink(void *);
200 void	 rtw_led_fastblink(void *);
201 void	 rtw_led_set(struct rtw_led_state *, struct rtw_regs *, u_int);
202 void	 rtw_led_newstate(struct rtw_softc *, enum ieee80211_state);
203 
204 int	 rtw_phy_init(struct rtw_softc *);
205 int	 rtw_bbp_preinit(struct rtw_regs *, u_int, int, u_int);
206 int	 rtw_bbp_init(struct rtw_regs *, struct rtw_bbpset *, int,
207 	    int, u_int8_t, u_int);
208 void	 rtw_verify_syna(u_int, u_int32_t);
209 int	 rtw_sa2400_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
210 int	 rtw_sa2400_txpower(struct rtw_softc *, u_int8_t);
211 int	 rtw_sa2400_tune(struct rtw_softc *, u_int);
212 int	 rtw_sa2400_vcocal_start(struct rtw_softc *, int);
213 int	 rtw_sa2400_vco_calibration(struct rtw_softc *);
214 int	 rtw_sa2400_filter_calibration(struct rtw_softc *);
215 int	 rtw_sa2400_dc_calibration(struct rtw_softc *);
216 int	 rtw_sa2400_calibrate(struct rtw_softc *, u_int);
217 int	 rtw_sa2400_init(struct rtw_softc *, u_int, u_int8_t,
218 	    enum rtw_pwrstate);
219 int	 rtw_max2820_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
220 int	 rtw_max2820_init(struct rtw_softc *, u_int, u_int8_t,
221 	    enum rtw_pwrstate);
222 int	 rtw_max2820_txpower(struct rtw_softc *, u_int8_t);
223 int	 rtw_max2820_tune(struct rtw_softc *, u_int);
224 int	 rtw_rtl8225_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
225 int	 rtw_rtl8225_init(struct rtw_softc *, u_int, u_int8_t,
226 	    enum rtw_pwrstate);
227 int	 rtw_rtl8225_txpower(struct rtw_softc *, u_int8_t);
228 int	 rtw_rtl8225_tune(struct rtw_softc *, u_int);
229 int	 rtw_rtl8255_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
230 int	 rtw_rtl8255_init(struct rtw_softc *, u_int, u_int8_t,
231 	    enum rtw_pwrstate);
232 int	 rtw_rtl8255_txpower(struct rtw_softc *, u_int8_t);
233 int	 rtw_rtl8255_tune(struct rtw_softc *, u_int);
234 int	 rtw_grf5101_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
235 int	 rtw_grf5101_init(struct rtw_softc *, u_int, u_int8_t,
236 	    enum rtw_pwrstate);
237 int	 rtw_grf5101_txpower(struct rtw_softc *, u_int8_t);
238 int	 rtw_grf5101_tune(struct rtw_softc *, u_int);
239 int	 rtw_rf_hostwrite(struct rtw_softc *, u_int, u_int32_t);
240 int	 rtw_rf_macwrite(struct rtw_softc *, u_int, u_int32_t);
241 int	 rtw_bbp_write(struct rtw_regs *, u_int, u_int);
242 u_int32_t rtw_grf5101_host_crypt(u_int, u_int32_t);
243 u_int32_t rtw_maxim_swizzle(u_int, uint32_t);
244 u_int32_t rtw_grf5101_mac_crypt(u_int, u_int32_t);
245 void	 rtw_rf_hostbangbits(struct rtw_regs *, u_int32_t, int, u_int);
246 void	 rtw_rf_rtl8225_hostbangbits(struct rtw_regs *, u_int32_t, int, u_int);
247 int	 rtw_rf_macbangbits(struct rtw_regs *, u_int32_t);
248 
249 u_int8_t rtw_read8(void *, u_int32_t);
250 u_int16_t rtw_read16(void *, u_int32_t);
251 u_int32_t rtw_read32(void *, u_int32_t);
252 void	 rtw_write8(void *, u_int32_t, u_int8_t);
253 void	 rtw_write16(void *, u_int32_t, u_int16_t);
254 void	 rtw_write32(void *, u_int32_t, u_int32_t);
255 void	 rtw_barrier(void *, u_int32_t, u_int32_t, int);
256 
257 #ifdef RTW_DEBUG
258 void	 rtw_print_txdesc(struct rtw_softc *, const char *,
259 	    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
260 const char *rtw_access_string(enum rtw_access);
261 void	 rtw_dump_rings(struct rtw_softc *);
262 void	 rtw_print_txdesc(struct rtw_softc *, const char *,
263 	    struct rtw_txsoft *, struct rtw_txdesc_blk *, int);
264 #endif
265 
266 struct cfdriver rtw_cd = {
267 	NULL, "rtw", DV_IFNET
268 };
269 
270 void
271 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
272 {
273 	struct rtw_regs *regs = &sc->sc_regs;
274 
275 	u_int32_t tcr;
276 	tcr = RTW_READ(regs, RTW_TCR);
277 	tcr &= ~RTW_TCR_LBK_MASK;
278 	if (enable)
279 		tcr |= RTW_TCR_LBK_CONT;
280 	else
281 		tcr |= RTW_TCR_LBK_NORMAL;
282 	RTW_WRITE(regs, RTW_TCR, tcr);
283 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
284 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
285 	rtw_txdac_enable(sc, !enable);
286 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
287 	rtw_set_access(regs, RTW_ACCESS_NONE);
288 }
289 
290 #ifdef RTW_DEBUG
291 const char *
292 rtw_access_string(enum rtw_access access)
293 {
294 	switch (access) {
295 	case RTW_ACCESS_NONE:
296 		return "none";
297 	case RTW_ACCESS_CONFIG:
298 		return "config";
299 	case RTW_ACCESS_ANAPARM:
300 		return "anaparm";
301 	default:
302 		return "unknown";
303 	}
304 }
305 #endif
306 
307 void
308 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
309 {
310 	KASSERT(naccess >= RTW_ACCESS_NONE && naccess <= RTW_ACCESS_ANAPARM);
311 	KASSERT(regs->r_access >= RTW_ACCESS_NONE &&
312 	    regs->r_access <= RTW_ACCESS_ANAPARM);
313 
314 	if (naccess == regs->r_access)
315 		return;
316 
317 	switch (naccess) {
318 	case RTW_ACCESS_NONE:
319 		switch (regs->r_access) {
320 		case RTW_ACCESS_ANAPARM:
321 			rtw_anaparm_enable(regs, 0);
322 			/*FALLTHROUGH*/
323 		case RTW_ACCESS_CONFIG:
324 			rtw_config0123_enable(regs, 0);
325 			/*FALLTHROUGH*/
326 		case RTW_ACCESS_NONE:
327 			break;
328 		}
329 		break;
330 	case RTW_ACCESS_CONFIG:
331 		switch (regs->r_access) {
332 		case RTW_ACCESS_NONE:
333 			rtw_config0123_enable(regs, 1);
334 			/*FALLTHROUGH*/
335 		case RTW_ACCESS_CONFIG:
336 			break;
337 		case RTW_ACCESS_ANAPARM:
338 			rtw_anaparm_enable(regs, 0);
339 			break;
340 		}
341 		break;
342 	case RTW_ACCESS_ANAPARM:
343 		switch (regs->r_access) {
344 		case RTW_ACCESS_NONE:
345 			rtw_config0123_enable(regs, 1);
346 			/*FALLTHROUGH*/
347 		case RTW_ACCESS_CONFIG:
348 			rtw_anaparm_enable(regs, 1);
349 			/*FALLTHROUGH*/
350 		case RTW_ACCESS_ANAPARM:
351 			break;
352 		}
353 		break;
354 	}
355 }
356 
357 void
358 rtw_set_access(struct rtw_regs *regs, enum rtw_access access)
359 {
360 	rtw_set_access1(regs, access);
361 	RTW_DPRINTF(RTW_DEBUG_ACCESS,
362 	    ("%s: access %s -> %s\n",__func__,
363 	    rtw_access_string(regs->r_access),
364 	    rtw_access_string(access)));
365 	regs->r_access = access;
366 }
367 
368 /*
369  * Enable registers, switch register banks.
370  */
371 void
372 rtw_config0123_enable(struct rtw_regs *regs, int enable)
373 {
374 	u_int8_t ecr;
375 	ecr = RTW_READ8(regs, RTW_9346CR);
376 	ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
377 	if (enable)
378 		ecr |= RTW_9346CR_EEM_CONFIG;
379 	else {
380 		RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
381 		ecr |= RTW_9346CR_EEM_NORMAL;
382 	}
383 	RTW_WRITE8(regs, RTW_9346CR, ecr);
384 	RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
385 }
386 
387 /* requires rtw_config0123_enable(, 1) */
388 void
389 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
390 {
391 	u_int8_t cfg3;
392 
393 	cfg3 = RTW_READ8(regs, RTW_CONFIG3);
394 	cfg3 |= RTW_CONFIG3_CLKRUNEN;
395 	if (enable)
396 		cfg3 |= RTW_CONFIG3_PARMEN;
397 	else
398 		cfg3 &= ~RTW_CONFIG3_PARMEN;
399 	RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
400 	RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
401 }
402 
403 /* requires rtw_anaparm_enable(, 1) */
404 void
405 rtw_txdac_enable(struct rtw_softc *sc, int enable)
406 {
407 	u_int32_t anaparm;
408 	struct rtw_regs *regs = &sc->sc_regs;
409 
410 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
411 	if (enable)
412 		anaparm &= ~RTW_ANAPARM_TXDACOFF;
413 	else
414 		anaparm |= RTW_ANAPARM_TXDACOFF;
415 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
416 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
417 }
418 
419 int
420 rtw_chip_reset1(struct rtw_regs *regs, const char *dvname)
421 {
422 	u_int8_t cr;
423 	int i;
424 
425 	RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
426 
427 	RTW_WBR(regs, RTW_CR, RTW_CR);
428 
429 	for (i = 0; i < 1000; i++) {
430 		if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
431 			RTW_DPRINTF(RTW_DEBUG_RESET,
432 			    ("%s: reset in %dus\n", dvname, i));
433 			return 0;
434 		}
435 		RTW_RBR(regs, RTW_CR, RTW_CR);
436 		DELAY(10); /* 10us */
437 	}
438 
439 	printf("\n%s: reset failed\n", dvname);
440 	return ETIMEDOUT;
441 }
442 
443 int
444 rtw_chip_reset(struct rtw_regs *regs, const char *dvname)
445 {
446 	uint32_t tcr;
447 
448 	/* from Linux driver */
449 	tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
450 	    LSHIFT(7, RTW_TCR_SRL_MASK) | LSHIFT(7, RTW_TCR_LRL_MASK);
451 
452 	RTW_WRITE(regs, RTW_TCR, tcr);
453 
454 	RTW_WBW(regs, RTW_CR, RTW_TCR);
455 
456 	return rtw_chip_reset1(regs, dvname);
457 }
458 
459 int
460 rtw_recall_eeprom(struct rtw_regs *regs, const char *dvname)
461 {
462 	int i;
463 	u_int8_t ecr;
464 
465 	ecr = RTW_READ8(regs, RTW_9346CR);
466 	ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
467 	RTW_WRITE8(regs, RTW_9346CR, ecr);
468 
469 	RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
470 
471 	/* wait 10ms for completion */
472 	for (i = 0; i < 50; i++) {
473 		ecr = RTW_READ8(regs, RTW_9346CR);
474 		if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
475 			RTW_DPRINTF(RTW_DEBUG_RESET,
476 			    ("%s: recall EEPROM in %dus\n", dvname, i * 200));
477 			return (0);
478 		}
479 		RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
480 		DELAY(200);
481 	}
482 
483 	printf("\n%s: could not recall EEPROM in %dus\n", dvname, i * 200);
484 
485 	return (ETIMEDOUT);
486 }
487 
488 int
489 rtw_reset(struct rtw_softc *sc)
490 {
491 	int rc;
492 	uint8_t config1;
493 
494 	if ((rc = rtw_chip_reset(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
495 		return rc;
496 
497 	if ((rc = rtw_recall_eeprom(&sc->sc_regs, sc->sc_dev.dv_xname)) != 0)
498 		;
499 
500 	config1 = RTW_READ8(&sc->sc_regs, RTW_CONFIG1);
501 	RTW_WRITE8(&sc->sc_regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
502 	/* TBD turn off maximum power saving? */
503 
504 	return 0;
505 }
506 
507 int
508 rtw_txdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
509     u_int ndescs)
510 {
511 	int i, rc = 0;
512 	for (i = 0; i < ndescs; i++) {
513 		rc = bus_dmamap_create(dmat, MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
514 		    0, 0, &descs[i].ts_dmamap);
515 		if (rc != 0)
516 			break;
517 	}
518 	return rc;
519 }
520 
521 int
522 rtw_rxdesc_dmamaps_create(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
523     u_int ndescs)
524 {
525 	int i, rc = 0;
526 	for (i = 0; i < ndescs; i++) {
527 		rc = bus_dmamap_create(dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
528 		    &descs[i].rs_dmamap);
529 		if (rc != 0)
530 			break;
531 	}
532 	return rc;
533 }
534 
535 void
536 rtw_rxdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_rxsoft *descs,
537     u_int ndescs)
538 {
539 	int i;
540 	for (i = 0; i < ndescs; i++) {
541 		if (descs[i].rs_dmamap != NULL)
542 			bus_dmamap_destroy(dmat, descs[i].rs_dmamap);
543 	}
544 }
545 
546 void
547 rtw_txdesc_dmamaps_destroy(bus_dma_tag_t dmat, struct rtw_txsoft *descs,
548     u_int ndescs)
549 {
550 	int i;
551 	for (i = 0; i < ndescs; i++) {
552 		if (descs[i].ts_dmamap != NULL)
553 			bus_dmamap_destroy(dmat, descs[i].ts_dmamap);
554 	}
555 }
556 
557 int
558 rtw_srom_parse(struct rtw_softc *sc)
559 {
560 	int i;
561 	struct rtw_srom *sr = &sc->sc_srom;
562 	u_int32_t *flags = &sc->sc_flags;
563 	u_int8_t *cs_threshold = &sc->sc_csthr;
564 	int *rfchipid = &sc->sc_rfchipid;
565 	u_int32_t *rcr = &sc->sc_rcr;
566 	enum rtw_locale *locale = &sc->sc_locale;
567 	u_int16_t version;
568 	u_int8_t mac[IEEE80211_ADDR_LEN];
569 
570 	*flags &= ~(RTW_F_DIGPHY|RTW_F_DFLANTB|RTW_F_ANTDIV);
571 	*rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
572 
573 	version = RTW_SR_GET16(sr, RTW_SR_VERSION);
574 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
575 	    ("%s: SROM %d.%d\n", sc->sc_dev.dv_xname, version >> 8,
576 	    version & 0xff));
577 
578 	if (version <= 0x0101) {
579 		printf(" is not understood, limping along with defaults ");
580 		*flags |= (RTW_F_DIGPHY|RTW_F_ANTDIV);
581 		*cs_threshold = RTW_SR_ENERGYDETTHR_DEFAULT;
582 		*rcr |= RTW_RCR_ENCS1;
583 		*rfchipid = RTW_RFCHIPID_PHILIPS;
584 		return 0;
585 	}
586 
587 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
588 		mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
589 
590 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
591 	    ("%s: EEPROM MAC %s\n", sc->sc_dev.dv_xname, ether_sprintf(mac)));
592 
593 	*cs_threshold = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
594 
595 	if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW8180_CONFIG2_ANT) != 0)
596 		*flags |= RTW_F_ANTDIV;
597 
598 	/* Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
599 	 * to be reversed.
600 	 */
601 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
602 		*flags |= RTW_F_DIGPHY;
603 	if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
604 		*flags |= RTW_F_DFLANTB;
605 
606 	*rcr |= LSHIFT(MASK_AND_RSHIFT(RTW_SR_GET(sr, RTW_SR_RFPARM),
607 	    RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
608 
609 	*rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
610 
611 	if (sc->sc_flags & RTW_F_RTL8185) {
612 		*locale = RTW_LOCALE_UNKNOWN;
613 		return (0);
614 	}
615 
616 	switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW8180_CONFIG0_GL_MASK) {
617 	case RTW8180_CONFIG0_GL_USA:
618 		*locale = RTW_LOCALE_USA;
619 		break;
620 	case RTW8180_CONFIG0_GL_EUROPE:
621 		*locale = RTW_LOCALE_EUROPE;
622 		break;
623 	case RTW8180_CONFIG0_GL_JAPAN:
624 	case RTW8180_CONFIG0_GL_JAPAN2:
625 		*locale = RTW_LOCALE_JAPAN;
626 		break;
627 	default:
628 		*locale = RTW_LOCALE_UNKNOWN;
629 		break;
630 	}
631 	return 0;
632 }
633 
634 /* Returns -1 on failure. */
635 int
636 rtw_srom_read(struct rtw_regs *regs, u_int32_t flags, struct rtw_srom *sr,
637     const char *dvname)
638 {
639 	int rc;
640 	struct seeprom_descriptor sd;
641 	u_int8_t ecr;
642 
643 	bzero(&sd, sizeof(sd));
644 
645 	ecr = RTW_READ8(regs, RTW_9346CR);
646 
647 	if ((flags & RTW_F_9356SROM) != 0) {
648 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c56 SROM\n", dvname));
649 		sr->sr_size = 256;
650 		sd.sd_chip = C56_66;
651 	} else {
652 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: 93c46 SROM\n", dvname));
653 		sr->sr_size = 128;
654 		sd.sd_chip = C46;
655 	}
656 
657 	ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
658 	    RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
659 	ecr |= RTW_9346CR_EEM_PROGRAM;
660 
661 	RTW_WRITE8(regs, RTW_9346CR, ecr);
662 
663 	sr->sr_content = malloc(sr->sr_size, M_DEVBUF, M_NOWAIT | M_ZERO);
664 
665 	if (sr->sr_content == NULL) {
666 		printf("%s: unable to allocate SROM buffer\n", dvname);
667 		return ENOMEM;
668 	}
669 
670 	/* RTL8180 has a single 8-bit register for controlling the
671 	 * 93cx6 SROM.  There is no "ready" bit. The RTL8180
672 	 * input/output sense is the reverse of read_seeprom's.
673 	 */
674 	sd.sd_tag = regs->r_bt;
675 	sd.sd_bsh = regs->r_bh;
676 	sd.sd_regsize = 1;
677 	sd.sd_control_offset = RTW_9346CR;
678 	sd.sd_status_offset = RTW_9346CR;
679 	sd.sd_dataout_offset = RTW_9346CR;
680 	sd.sd_CK = RTW_9346CR_EESK;
681 	sd.sd_CS = RTW_9346CR_EECS;
682 	sd.sd_DI = RTW_9346CR_EEDO;
683 	sd.sd_DO = RTW_9346CR_EEDI;
684 	/* make read_seeprom enter EEPROM read/write mode */
685 	sd.sd_MS = ecr;
686 	sd.sd_RDY = 0;
687 
688 	/* TBD bus barriers */
689 	if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size/2)) {
690 		printf("\n%s: could not read SROM\n", dvname);
691 		free(sr->sr_content, M_DEVBUF, 0);
692 		sr->sr_content = NULL;
693 		return -1;	/* XXX */
694 	}
695 
696 	/* end EEPROM read/write mode */
697 	RTW_WRITE8(regs, RTW_9346CR,
698 	    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
699 	RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
700 
701 	if ((rc = rtw_recall_eeprom(regs, dvname)) != 0)
702 		return rc;
703 
704 #ifdef RTW_DEBUG
705 	{
706 		int i;
707 		RTW_DPRINTF(RTW_DEBUG_ATTACH,
708 		    ("\n%s: serial ROM:\n\t", dvname));
709 		for (i = 0; i < sr->sr_size/2; i++) {
710 			if (((i % 8) == 0) && (i != 0))
711 				RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
712 			RTW_DPRINTF(RTW_DEBUG_ATTACH,
713 			    (" %04x", sr->sr_content[i]));
714 		}
715 		RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
716 	}
717 #endif /* RTW_DEBUG */
718 	return 0;
719 }
720 
721 void
722 rtw_set_rfprog(struct rtw_regs *regs, int rfchipid,
723     const char *dvname)
724 {
725 	u_int8_t cfg4;
726 	const char *method;
727 
728 	cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
729 
730 	switch (rfchipid) {
731 	default:
732 		cfg4 |= LSHIFT(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
733 		method = "fallback";
734 		break;
735 	case RTW_RFCHIPID_INTERSIL:
736 		cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
737 		method = "Intersil";
738 		break;
739 	case RTW_RFCHIPID_PHILIPS:
740 		cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
741 		method = "Philips";
742 		break;
743 	case RTW_RFCHIPID_RFMD2948:
744 		cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
745 		method = "RFMD";
746 		break;
747 	}
748 
749 	RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
750 
751 	RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
752 
753 	RTW_DPRINTF(RTW_DEBUG_INIT,
754 	    ("%s: %s RF programming method, %#02x\n", dvname, method,
755 	    RTW_READ8(regs, RTW_CONFIG4)));
756 }
757 
758 void
759 rtw_identify_country(struct rtw_regs *regs, enum rtw_locale *locale)
760 {
761 	u_int8_t cfg0 = RTW_READ8(regs, RTW_CONFIG0);
762 
763 	switch (cfg0 & RTW8180_CONFIG0_GL_MASK) {
764 	case RTW8180_CONFIG0_GL_USA:
765 		*locale = RTW_LOCALE_USA;
766 		break;
767 	case RTW8180_CONFIG0_GL_JAPAN:
768 	case RTW8180_CONFIG0_GL_JAPAN2:
769 		*locale = RTW_LOCALE_JAPAN;
770 		break;
771 	case RTW8180_CONFIG0_GL_EUROPE:
772 		*locale = RTW_LOCALE_EUROPE;
773 		break;
774 	default:
775 		*locale = RTW_LOCALE_UNKNOWN;
776 		break;
777 	}
778 }
779 
780 int
781 rtw_identify_sta(struct rtw_regs *regs, u_int8_t (*addr)[IEEE80211_ADDR_LEN],
782     const char *dvname)
783 {
784 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
785 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
786 	};
787 	u_int32_t idr0 = RTW_READ(regs, RTW_IDR0),
788 	    idr1 = RTW_READ(regs, RTW_IDR1);
789 
790 	(*addr)[0] = MASK_AND_RSHIFT(idr0, 0xff);
791 	(*addr)[1] = MASK_AND_RSHIFT(idr0, 0xff00);
792 	(*addr)[2] = MASK_AND_RSHIFT(idr0, 0xff0000);
793 	(*addr)[3] = MASK_AND_RSHIFT(idr0, 0xff000000);
794 
795 	(*addr)[4] = MASK_AND_RSHIFT(idr1, 0xff);
796 	(*addr)[5] = MASK_AND_RSHIFT(idr1, 0xff00);
797 
798 	if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
799 		printf("\n%s: could not get mac address, attach failed\n",
800 		    dvname);
801 		return ENXIO;
802 	}
803 
804 	printf("address %s\n", ether_sprintf(*addr));
805 
806 	return 0;
807 }
808 
809 u_int8_t
810 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
811     struct ieee80211_channel *chan)
812 {
813 	u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
814 	KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
815 	    ("%s: channel %d out of range", __func__,
816 	     idx - RTW_SR_TXPOWER1 + 1));
817 	return RTW_SR_GET(sr, idx);
818 }
819 
820 void
821 rtw_txdesc_blk_init_all(struct rtw_txdesc_blk *tdb)
822 {
823 	int pri;
824 	/* nfree: the number of free descriptors in each ring.
825 	 * The beacon ring is a special case: I do not let the
826 	 * driver use all of the descriptors on the beacon ring.
827 	 * The reasons are two-fold:
828 	 *
829 	 * (1) A BEACON descriptor's OWN bit is (apparently) not
830 	 * updated, so the driver cannot easily know if the descriptor
831 	 * belongs to it, or if it is racing the NIC.  If the NIC
832 	 * does not OWN every descriptor, then the driver can safely
833 	 * update the descriptors when RTW_TBDA points at tdb_next.
834 	 *
835 	 * (2) I hope that the NIC will process more than one BEACON
836 	 * descriptor in a single beacon interval, since that will
837 	 * enable multiple-BSS support.  Since the NIC does not
838 	 * clear the OWN bit, there is no natural place for it to
839 	 * stop processing BEACON desciptors.  Maybe it will *not*
840 	 * stop processing them!  I do not want to chance the NIC
841 	 * looping around and around a saturated beacon ring, so
842 	 * I will leave one descriptor unOWNed at all times.
843 	 */
844 	u_int nfree[RTW_NTXPRI] =
845 	    {RTW_NTXDESCLO, RTW_NTXDESCMD, RTW_NTXDESCHI,
846 	     RTW_NTXDESCBCN - 1};
847 
848 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
849 		tdb[pri].tdb_nfree = nfree[pri];
850 		tdb[pri].tdb_next = 0;
851 	}
852 }
853 
854 int
855 rtw_txsoft_blk_init(struct rtw_txsoft_blk *tsb)
856 {
857 	int i;
858 	struct rtw_txsoft *ts;
859 
860 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
861 	SIMPLEQ_INIT(&tsb->tsb_freeq);
862 	for (i = 0; i < tsb->tsb_ndesc; i++) {
863 		ts = &tsb->tsb_desc[i];
864 		ts->ts_mbuf = NULL;
865 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
866 	}
867 	tsb->tsb_tx_timer = 0;
868 	return 0;
869 }
870 
871 void
872 rtw_txsoft_blk_init_all(struct rtw_txsoft_blk *tsb)
873 {
874 	int pri;
875 	for (pri = 0; pri < RTW_NTXPRI; pri++)
876 		rtw_txsoft_blk_init(&tsb[pri]);
877 }
878 
879 void
880 rtw_rxdescs_sync(struct rtw_rxdesc_blk *rdb, int desc0, int nsync, int ops)
881 {
882 	KASSERT(nsync <= rdb->rdb_ndesc);
883 	/* sync to end of ring */
884 	if (desc0 + nsync > rdb->rdb_ndesc) {
885 		bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
886 		    offsetof(struct rtw_descs, hd_rx[desc0]),
887 		    sizeof(struct rtw_rxdesc) * (rdb->rdb_ndesc - desc0), ops);
888 		nsync -= (rdb->rdb_ndesc - desc0);
889 		desc0 = 0;
890 	}
891 
892 	KASSERT(desc0 < rdb->rdb_ndesc);
893 	KASSERT(nsync <= rdb->rdb_ndesc);
894 	KASSERT(desc0 + nsync <= rdb->rdb_ndesc);
895 
896 	/* sync what remains */
897 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
898 	    offsetof(struct rtw_descs, hd_rx[desc0]),
899 	    sizeof(struct rtw_rxdesc) * nsync, ops);
900 }
901 
902 void
903 rtw_txdescs_sync(struct rtw_txdesc_blk *tdb, u_int desc0, u_int nsync, int ops)
904 {
905 	/* sync to end of ring */
906 	if (desc0 + nsync > tdb->tdb_ndesc) {
907 		bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
908 		    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
909 		    sizeof(struct rtw_txdesc) * (tdb->tdb_ndesc - desc0),
910 		    ops);
911 		nsync -= (tdb->tdb_ndesc - desc0);
912 		desc0 = 0;
913 	}
914 
915 	/* sync what remains */
916 	bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
917 	    tdb->tdb_ofs + sizeof(struct rtw_txdesc) * desc0,
918 	    sizeof(struct rtw_txdesc) * nsync, ops);
919 }
920 
921 void
922 rtw_rxbufs_release(bus_dma_tag_t dmat, struct rtw_rxsoft *desc)
923 {
924 	int i;
925 	struct rtw_rxsoft *rs;
926 
927 	for (i = 0; i < RTW_RXQLEN; i++) {
928 		rs = &desc[i];
929 		if (rs->rs_mbuf == NULL)
930 			continue;
931 		bus_dmamap_sync(dmat, rs->rs_dmamap, 0,
932 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
933 		bus_dmamap_unload(dmat, rs->rs_dmamap);
934 		m_freem(rs->rs_mbuf);
935 		rs->rs_mbuf = NULL;
936 	}
937 }
938 
939 int
940 rtw_rxsoft_alloc(bus_dma_tag_t dmat, struct rtw_rxsoft *rs)
941 {
942 	int rc;
943 	struct mbuf *m;
944 
945 	MGETHDR(m, M_DONTWAIT, MT_DATA);
946 	if (m == NULL)
947 		return ENOBUFS;
948 
949 	MCLGET(m, M_DONTWAIT);
950 	if ((m->m_flags & M_EXT) == 0) {
951 		m_freem(m);
952 		return ENOBUFS;
953 	}
954 
955 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
956 
957 	if (rs->rs_mbuf != NULL)
958 		bus_dmamap_unload(dmat, rs->rs_dmamap);
959 
960 	rs->rs_mbuf = NULL;
961 
962 	rc = bus_dmamap_load_mbuf(dmat, rs->rs_dmamap, m, BUS_DMA_NOWAIT);
963 	if (rc != 0) {
964 		m_freem(m);
965 		return -1;
966 	}
967 
968 	rs->rs_mbuf = m;
969 
970 	return 0;
971 }
972 
973 int
974 rtw_rxsoft_init_all(bus_dma_tag_t dmat, struct rtw_rxsoft *desc,
975     int *ndesc, const char *dvname)
976 {
977 	int i, rc = 0;
978 	struct rtw_rxsoft *rs;
979 
980 	for (i = 0; i < RTW_RXQLEN; i++) {
981 		rs = &desc[i];
982 		/* we're in rtw_init, so there should be no mbufs allocated */
983 		KASSERT(rs->rs_mbuf == NULL);
984 #ifdef RTW_DEBUG
985 		if (i == rtw_rxbufs_limit) {
986 			printf("%s: TEST hit %d-buffer limit\n", dvname, i);
987 			rc = ENOBUFS;
988 			break;
989 		}
990 #endif /* RTW_DEBUG */
991 		if ((rc = rtw_rxsoft_alloc(dmat, rs)) != 0) {
992 			printf("%s: rtw_rxsoft_alloc failed, %d buffers, "
993 			    "rc %d\n", dvname, i, rc);
994 			break;
995 		}
996 	}
997 	*ndesc = i;
998 	return rc;
999 }
1000 
1001 void
1002 rtw_rxdesc_init(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *rs,
1003     int idx, int kick)
1004 {
1005 	int is_last = (idx == rdb->rdb_ndesc - 1);
1006 	uint32_t ctl, octl, obuf;
1007 	struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1008 
1009 	obuf = rd->rd_buf;
1010 	rd->rd_buf = htole32(rs->rs_dmamap->dm_segs[0].ds_addr);
1011 
1012 	ctl = LSHIFT(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1013 	    RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1014 
1015 	if (is_last)
1016 		ctl |= RTW_RXCTL_EOR;
1017 
1018 	octl = rd->rd_ctl;
1019 	rd->rd_ctl = htole32(ctl);
1020 
1021 	RTW_DPRINTF(kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1022 	    : RTW_DEBUG_RECV_DESC,
1023 	    ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n", __func__, rd,
1024 	    letoh32(obuf), letoh32(rd->rd_buf), letoh32(octl),
1025 	    letoh32(rd->rd_ctl)));
1026 
1027 	/* sync the mbuf */
1028 	bus_dmamap_sync(rdb->rdb_dmat, rs->rs_dmamap, 0,
1029 	    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1030 
1031 	/* sync the descriptor */
1032 	bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1033 	    RTW_DESC_OFFSET(hd_rx, idx), sizeof(struct rtw_rxdesc),
1034 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1035 }
1036 
1037 void
1038 rtw_rxdesc_init_all(struct rtw_rxdesc_blk *rdb, struct rtw_rxsoft *ctl,
1039     int kick)
1040 {
1041 	int i;
1042 	struct rtw_rxsoft *rs;
1043 
1044 	for (i = 0; i < rdb->rdb_ndesc; i++) {
1045 		rs = &ctl[i];
1046 		rtw_rxdesc_init(rdb, rs, i, kick);
1047 	}
1048 }
1049 
1050 void
1051 rtw_io_enable(struct rtw_regs *regs, u_int8_t flags, int enable)
1052 {
1053 	u_int8_t cr;
1054 
1055 	RTW_DPRINTF(RTW_DEBUG_IOSTATE, ("%s: %s 0x%02x\n", __func__,
1056 	    enable ? "enable" : "disable", flags));
1057 
1058 	cr = RTW_READ8(regs, RTW_CR);
1059 
1060 	/* XXX reference source does not enable MULRW */
1061 #if 0
1062 	/* enable PCI Read/Write Multiple */
1063 	cr |= RTW_CR_MULRW;
1064 #endif
1065 
1066 	RTW_RBW(regs, RTW_CR, RTW_CR);	/* XXX paranoia? */
1067 	if (enable)
1068 		cr |= flags;
1069 	else
1070 		cr &= ~flags;
1071 	RTW_WRITE8(regs, RTW_CR, cr);
1072 	RTW_SYNC(regs, RTW_CR, RTW_CR);
1073 }
1074 
1075 void
1076 rtw_intr_rx(struct rtw_softc *sc, u_int16_t isr)
1077 {
1078 #define	IS_BEACON(__fc0)						\
1079     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1080      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1081 
1082 	static const int ratetbl[4] = {2, 4, 11, 22};	/* convert rates:
1083 							 * hardware -> net80211
1084 							 */
1085 	u_int next, nproc = 0;
1086 	int hwrate, len, rate, rssi, sq;
1087 	u_int32_t hrssi, hstat, htsfth, htsftl;
1088 	struct rtw_rxdesc *rd;
1089 	struct rtw_rxsoft *rs;
1090 	struct rtw_rxdesc_blk *rdb;
1091 	struct mbuf *m;
1092 	struct ieee80211_rxinfo rxi;
1093 	struct ieee80211_node *ni;
1094 	struct ieee80211_frame *wh;
1095 
1096 	rdb = &sc->sc_rxdesc_blk;
1097 
1098 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1099 
1100 	for (next = rdb->rdb_next; ; next = (next + 1) % rdb->rdb_ndesc) {
1101 		rtw_rxdescs_sync(rdb, next, 1,
1102 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1103 		rd = &rdb->rdb_desc[next];
1104 		rs = &sc->sc_rxsoft[next];
1105 
1106 		hstat = letoh32(rd->rd_stat);
1107 		hrssi = letoh32(rd->rd_rssi);
1108 		htsfth = letoh32(rd->rd_tsfth);
1109 		htsftl = letoh32(rd->rd_tsftl);
1110 
1111 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1112 		    ("%s: rxdesc[%d] hstat %08x hrssi %08x htsft %08x%08x\n",
1113 		    __func__, next, hstat, hrssi, htsfth, htsftl));
1114 
1115 		++nproc;
1116 
1117 		/* still belongs to NIC */
1118 		if ((hstat & RTW_RXSTAT_OWN) != 0) {
1119 			if (nproc > 1)
1120 				break;
1121 
1122 			/* sometimes the NIC skips to the 0th descriptor */
1123 			rtw_rxdescs_sync(rdb, 0, 1,
1124 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1125 			rd = &rdb->rdb_desc[0];
1126 			if ((rd->rd_stat & htole32(RTW_RXSTAT_OWN)) != 0)
1127 				break;
1128 			RTW_DPRINTF(RTW_DEBUG_BUGS,
1129 			    ("%s: NIC skipped from rxdesc[%u] to rxdesc[0]\n",
1130 			     sc->sc_dev.dv_xname, next));
1131 			next = rdb->rdb_ndesc - 1;
1132 			continue;
1133 		}
1134 
1135 #ifdef RTW_DEBUG
1136 #define PRINTSTAT(flag) do { \
1137 	if ((hstat & flag) != 0) { \
1138 		printf("%s" #flag, delim); \
1139 		delim = ","; \
1140 	} \
1141 } while (0)
1142 		if ((rtw_debug & RTW_DEBUG_RECV_DESC) != 0) {
1143 			const char *delim = "<";
1144 			printf("%s: ", sc->sc_dev.dv_xname);
1145 			if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1146 				printf("status %08x", hstat);
1147 				PRINTSTAT(RTW_RXSTAT_SPLCP);
1148 				PRINTSTAT(RTW_RXSTAT_MAR);
1149 				PRINTSTAT(RTW_RXSTAT_PAR);
1150 				PRINTSTAT(RTW_RXSTAT_BAR);
1151 				PRINTSTAT(RTW_RXSTAT_PWRMGT);
1152 				PRINTSTAT(RTW_RXSTAT_CRC32);
1153 				PRINTSTAT(RTW_RXSTAT_ICV);
1154 				printf(">, ");
1155 			}
1156 		}
1157 #undef PRINTSTAT
1158 #endif /* RTW_DEBUG */
1159 
1160 		if ((hstat & RTW_RXSTAT_IOERROR) != 0) {
1161 			printf("%s: DMA error/FIFO overflow %08x, "
1162 			    "rx descriptor %d\n", sc->sc_dev.dv_xname,
1163 			    hstat & RTW_RXSTAT_IOERROR, next);
1164 			sc->sc_if.if_ierrors++;
1165 			goto next;
1166 		}
1167 
1168 		len = MASK_AND_RSHIFT(hstat, RTW_RXSTAT_LENGTH_MASK);
1169 		if (len < IEEE80211_MIN_LEN) {
1170 			sc->sc_ic.ic_stats.is_rx_tooshort++;
1171 			goto next;
1172 		}
1173 
1174 		/* CRC is included with the packet; trim it off. */
1175 		len -= IEEE80211_CRC_LEN;
1176 
1177 		hwrate = MASK_AND_RSHIFT(hstat, RTW_RXSTAT_RATE_MASK);
1178 		if (hwrate >= sizeof(ratetbl) / sizeof(ratetbl[0])) {
1179 			printf("%s: unknown rate #%d\n", sc->sc_dev.dv_xname,
1180 			    MASK_AND_RSHIFT(hstat, RTW_RXSTAT_RATE_MASK));
1181 			sc->sc_if.if_ierrors++;
1182 			goto next;
1183 		}
1184 		rate = ratetbl[hwrate];
1185 
1186 #ifdef RTW_DEBUG
1187 		RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1188 		    ("rate %d.%d Mb/s, time %08x%08x\n", (rate * 5) / 10,
1189 		     (rate * 5) % 10, htsfth, htsftl));
1190 #endif /* RTW_DEBUG */
1191 
1192 		if ((hstat & RTW_RXSTAT_RES) != 0 &&
1193 		    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
1194 			goto next;
1195 
1196 		/* if bad flags, skip descriptor */
1197 		if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1198 			printf("%s: too many rx segments\n",
1199 			    sc->sc_dev.dv_xname);
1200 			goto next;
1201 		}
1202 
1203 		bus_dmamap_sync(sc->sc_dmat, rs->rs_dmamap, 0,
1204 		    rs->rs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1205 
1206 		m = rs->rs_mbuf;
1207 
1208 		/* if temporarily out of memory, re-use mbuf */
1209 		switch (rtw_rxsoft_alloc(sc->sc_dmat, rs)) {
1210 		case 0:
1211 			break;
1212 		case ENOBUFS:
1213 			printf("%s: rtw_rxsoft_alloc(, %d) failed, "
1214 			    "dropping this packet\n", sc->sc_dev.dv_xname,
1215 			    next);
1216 			goto next;
1217 		default:
1218 			/* XXX shorten rx ring, instead? */
1219 			panic("%s: could not load DMA map",
1220 			    sc->sc_dev.dv_xname);
1221 		}
1222 
1223 		if (sc->sc_rfchipid == RTW_RFCHIPID_PHILIPS)
1224 			rssi = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_RSSI);
1225 		else {
1226 			rssi = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_IMR_RSSI);
1227 			/* TBD find out each front-end's LNA gain in the
1228 			 * front-end's units
1229 			 */
1230 			if ((hrssi & RTW_RXRSSI_IMR_LNA) == 0)
1231 				rssi |= 0x80;
1232 		}
1233 
1234 		sq = MASK_AND_RSHIFT(hrssi, RTW_RXRSSI_SQ);
1235 
1236 		/*
1237 		 * Note well: now we cannot recycle the rs_mbuf unless
1238 		 * we restore its original length.
1239 		 */
1240 		m->m_pkthdr.len = m->m_len = len;
1241 
1242 		wh = mtod(m, struct ieee80211_frame *);
1243 
1244 		if (!IS_BEACON(wh->i_fc[0]))
1245 			sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1246 		/* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1247 		ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1248 
1249 		sc->sc_tsfth = htsfth;
1250 
1251 #ifdef RTW_DEBUG
1252 		if ((sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1253 		    (IFF_DEBUG|IFF_LINK2)) {
1254 			ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1255 			    rate, rssi);
1256 		}
1257 #endif /* RTW_DEBUG */
1258 
1259 #if NBPFILTER > 0
1260 		if (sc->sc_radiobpf != NULL) {
1261 			struct mbuf mb;
1262 			struct ieee80211com *ic = &sc->sc_ic;
1263 			struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1264 
1265 			rr->rr_tsft =
1266 			    htole64(((uint64_t)htsfth << 32) | htsftl);
1267 
1268 			rr->rr_flags = 0;
1269 			if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1270 				rr->rr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1271 
1272 			rr->rr_rate = rate;
1273 			rr->rr_chan_freq =
1274 			    htole16(ic->ic_bss->ni_chan->ic_freq);
1275 			rr->rr_chan_flags =
1276 			    htole16(ic->ic_bss->ni_chan->ic_flags);
1277 			rr->rr_antsignal = rssi;
1278 			rr->rr_barker_lock = htole16(sq);
1279 
1280 			mb.m_data = (caddr_t)rr;
1281 			mb.m_len = sizeof(sc->sc_rxtapu);
1282 			mb.m_next = m;
1283 			mb.m_nextpkt = NULL;
1284 			mb.m_type = 0;
1285 			mb.m_flags = 0;
1286 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_IN);
1287 		}
1288 #endif /* NBPFILTER > 0 */
1289 
1290 		rxi.rxi_flags = 0;
1291 		rxi.rxi_rssi = rssi;
1292 		rxi.rxi_tstamp = htsftl;
1293 		ieee80211_input(&sc->sc_if, m, ni, &rxi);
1294 		ieee80211_release_node(&sc->sc_ic, ni);
1295 next:
1296 		rtw_rxdesc_init(rdb, rs, next, 0);
1297 	}
1298 	rdb->rdb_next = next;
1299 
1300 	KASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1301 
1302 	return;
1303 #undef IS_BEACON
1304 }
1305 
1306 void
1307 rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1308     struct rtw_txsoft *ts)
1309 {
1310 	struct mbuf *m;
1311 	struct ieee80211_node *ni;
1312 
1313 	m = ts->ts_mbuf;
1314 	ni = ts->ts_ni;
1315 	KASSERT(m != NULL);
1316 	KASSERT(ni != NULL);
1317 	ts->ts_mbuf = NULL;
1318 	ts->ts_ni = NULL;
1319 
1320 	bus_dmamap_sync(dmat, ts->ts_dmamap, 0, ts->ts_dmamap->dm_mapsize,
1321 	    BUS_DMASYNC_POSTWRITE);
1322 	bus_dmamap_unload(dmat, ts->ts_dmamap);
1323 	m_freem(m);
1324 	ieee80211_release_node(ic, ni);
1325 }
1326 
1327 void
1328 rtw_txsofts_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
1329     struct rtw_txsoft_blk *tsb)
1330 {
1331 	struct rtw_txsoft *ts;
1332 
1333 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1334 		rtw_txsoft_release(dmat, ic, ts);
1335 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1336 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1337 	}
1338 	tsb->tsb_tx_timer = 0;
1339 }
1340 
1341 void
1342 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1343     struct rtw_txsoft *ts, int ndesc)
1344 {
1345 	uint32_t hstat;
1346 	int data_retry, rts_retry;
1347 	struct rtw_txdesc *tdn;
1348 	const char *condstring;
1349 
1350 	rtw_txsoft_release(sc->sc_dmat, &sc->sc_ic, ts);
1351 
1352 	tdb->tdb_nfree += ndesc;
1353 
1354 	tdn = &tdb->tdb_desc[ts->ts_last];
1355 
1356 	hstat = letoh32(tdn->td_stat);
1357 	rts_retry = MASK_AND_RSHIFT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1358 	data_retry = MASK_AND_RSHIFT(hstat, RTW_TXSTAT_DRC_MASK);
1359 
1360 	sc->sc_if.if_collisions += rts_retry + data_retry;
1361 
1362 	if ((hstat & RTW_TXSTAT_TOK) != 0)
1363 		condstring = "ok";
1364 	else {
1365 		sc->sc_if.if_oerrors++;
1366 		condstring = "error";
1367 	}
1368 
1369 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1370 	    ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1371 	    sc->sc_dev.dv_xname, ts, ts->ts_first, ts->ts_last,
1372 	    condstring, rts_retry, data_retry));
1373 }
1374 
1375 void
1376 rtw_reset_oactive(struct rtw_softc *sc)
1377 {
1378 	int oactive;
1379 	int pri;
1380 	struct rtw_txsoft_blk *tsb;
1381 	struct rtw_txdesc_blk *tdb;
1382 	oactive = ifq_is_oactive(&sc->sc_if.if_snd);
1383 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1384 		tsb = &sc->sc_txsoft_blk[pri];
1385 		tdb = &sc->sc_txdesc_blk[pri];
1386 		if (!SIMPLEQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1387 			ifq_set_oactive(&sc->sc_if.if_snd);
1388 	}
1389 	if (oactive != ifq_is_oactive(&sc->sc_if.if_snd)) {
1390 		DPRINTF(sc, RTW_DEBUG_OACTIVE,
1391 		    ("%s: reset OACTIVE\n", __func__));
1392 	}
1393 }
1394 
1395 /* Collect transmitted packets. */
1396 void
1397 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1398     struct rtw_txdesc_blk *tdb, int force)
1399 {
1400 	int ndesc;
1401 	struct rtw_txsoft *ts;
1402 
1403 	while ((ts = SIMPLEQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1404 		ndesc = 1 + ts->ts_last - ts->ts_first;
1405 		if (ts->ts_last < ts->ts_first)
1406 			ndesc += tdb->tdb_ndesc;
1407 
1408 		KASSERT(ndesc > 0);
1409 
1410 		rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1411 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1412 
1413 		if (force) {
1414 			int i;
1415 			for (i = ts->ts_first; ; i = RTW_NEXT_IDX(tdb, i)) {
1416 				tdb->tdb_desc[i].td_stat &=
1417 				    ~htole32(RTW_TXSTAT_OWN);
1418 				if (i == ts->ts_last)
1419 					break;
1420 			}
1421 			rtw_txdescs_sync(tdb, ts->ts_first, ndesc,
1422 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1423 		} else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1424 		    htole32(RTW_TXSTAT_OWN)) != 0)
1425 			break;
1426 
1427 		rtw_collect_txpkt(sc, tdb, ts, ndesc);
1428 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1429 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1430 	}
1431 	/* no more pending transmissions, cancel watchdog */
1432 	if (ts == NULL)
1433 		tsb->tsb_tx_timer = 0;
1434 	rtw_reset_oactive(sc);
1435 }
1436 
1437 void
1438 rtw_intr_tx(struct rtw_softc *sc, u_int16_t isr)
1439 {
1440 	int pri;
1441 	struct rtw_txsoft_blk	*tsb;
1442 	struct rtw_txdesc_blk	*tdb;
1443 
1444 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1445 		tsb = &sc->sc_txsoft_blk[pri];
1446 		tdb = &sc->sc_txdesc_blk[pri];
1447 
1448 		rtw_collect_txring(sc, tsb, tdb, 0);
1449 
1450 	}
1451 
1452 	if ((isr & RTW_INTR_TX) != 0)
1453 		rtw_start(&sc->sc_if);
1454 }
1455 
1456 #ifndef IEEE80211_STA_ONLY
1457 void
1458 rtw_intr_beacon(struct rtw_softc *sc, u_int16_t isr)
1459 {
1460 	u_int next;
1461 	uint32_t tsfth, tsftl;
1462 	struct ieee80211com *ic;
1463 	struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1464 	struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1465 	struct mbuf *m;
1466 
1467 	tsfth = RTW_READ(&sc->sc_regs, RTW_TSFTRH);
1468 	tsftl = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1469 
1470 	if ((isr & (RTW_INTR_TBDOK|RTW_INTR_TBDER)) != 0) {
1471 		next = rtw_txring_next(&sc->sc_regs, tdb);
1472 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1473 		    ("%s: beacon ring %sprocessed, isr = %#04hx"
1474 		     ", next %u expected %u, %llu\n", __func__,
1475 		     (next == tdb->tdb_next) ? "" : "un", isr, next,
1476 		     tdb->tdb_next, (uint64_t)tsfth << 32 | tsftl));
1477 		if ((RTW_READ8(&sc->sc_regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0){
1478 			rtw_collect_txring(sc, tsb, tdb, 1);
1479 			tdb->tdb_next = 0;
1480 		}
1481 	}
1482 	/* Start beacon transmission. */
1483 
1484 	if ((isr & RTW_INTR_BCNINT) != 0 &&
1485 	    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
1486 	    SIMPLEQ_EMPTY(&tsb->tsb_dirtyq)) {
1487 		RTW_DPRINTF(RTW_DEBUG_BEACON,
1488 		    ("%s: beacon prep. time, isr = %#04hx"
1489 		     ", %16llu\n", __func__, isr,
1490 		     (uint64_t)tsfth << 32 | tsftl));
1491 		ic = &sc->sc_ic;
1492 		if ((m = ieee80211_beacon_alloc(ic, ic->ic_bss)) != NULL) {
1493 			RTW_DPRINTF(RTW_DEBUG_BEACON,
1494 			    ("%s: m %p len %u\n", __func__, m, m->m_len));
1495 		}
1496 
1497 		if (m == NULL) {
1498 			printf("%s: could not allocate beacon\n",
1499 			    sc->sc_dev.dv_xname);
1500 			return;
1501 		}
1502 		m->m_pkthdr.ph_cookie = ieee80211_ref_node(ic->ic_bss);
1503 		mq_enqueue(&sc->sc_beaconq, m);
1504 		rtw_start(&sc->sc_if);
1505 	}
1506 }
1507 
1508 void
1509 rtw_intr_atim(struct rtw_softc *sc)
1510 {
1511 	/* TBD */
1512 	return;
1513 }
1514 #endif	/* IEEE80211_STA_ONLY */
1515 
1516 #ifdef RTW_DEBUG
1517 void
1518 rtw_dump_rings(struct rtw_softc *sc)
1519 {
1520 	struct rtw_txdesc_blk *tdb;
1521 	struct rtw_rxdesc *rd;
1522 	struct rtw_rxdesc_blk *rdb;
1523 	int desc, pri;
1524 
1525 	if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1526 		return;
1527 
1528 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1529 		tdb = &sc->sc_txdesc_blk[pri];
1530 		printf("%s: txpri %d ndesc %d nfree %d\n", __func__, pri,
1531 		    tdb->tdb_ndesc, tdb->tdb_nfree);
1532 		for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1533 			rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1534 	}
1535 
1536 	rdb = &sc->sc_rxdesc_blk;
1537 
1538 	for (desc = 0; desc < RTW_RXQLEN; desc++) {
1539 		rd = &rdb->rdb_desc[desc];
1540 		printf("%s: %sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1541 		    "rsvd1/tsfth %08x\n", __func__,
1542 		    (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1543 		    letoh32(rd->rd_ctl), letoh32(rd->rd_rssi),
1544 		    letoh32(rd->rd_buf), letoh32(rd->rd_tsfth));
1545 	}
1546 }
1547 #endif /* RTW_DEBUG */
1548 
1549 void
1550 rtw_hwring_setup(struct rtw_softc *sc)
1551 {
1552 	int pri;
1553 	struct rtw_regs *regs = &sc->sc_regs;
1554 	struct rtw_txdesc_blk *tdb;
1555 
1556 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_basereg = RTW_TLPDA;
1557 	sc->sc_txdesc_blk[RTW_TXPRILO].tdb_base = RTW_RING_BASE(sc, hd_txlo);
1558 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_basereg = RTW_TNPDA;
1559 	sc->sc_txdesc_blk[RTW_TXPRIMD].tdb_base = RTW_RING_BASE(sc, hd_txmd);
1560 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_basereg = RTW_THPDA;
1561 	sc->sc_txdesc_blk[RTW_TXPRIHI].tdb_base = RTW_RING_BASE(sc, hd_txhi);
1562 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_basereg = RTW_TBDA;
1563 	sc->sc_txdesc_blk[RTW_TXPRIBCN].tdb_base = RTW_RING_BASE(sc, hd_bcn);
1564 
1565 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1566 		tdb = &sc->sc_txdesc_blk[pri];
1567 		RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1568 		RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1569 		    ("%s: reg[tdb->tdb_basereg] <- %lx\n", __func__,
1570 		     (u_int *)tdb->tdb_base));
1571 	}
1572 
1573 	RTW_WRITE(regs, RTW_RDSAR, RTW_RING_BASE(sc, hd_rx));
1574 
1575 	RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1576 	    ("%s: reg[RDSAR] <- %lx\n", __func__,
1577 	     (u_int *)RTW_RING_BASE(sc, hd_rx)));
1578 
1579 	RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1580 }
1581 
1582 int
1583 rtw_swring_setup(struct rtw_softc *sc)
1584 {
1585 	int rc, pri;
1586 	struct rtw_rxdesc_blk *rdb;
1587 	struct rtw_txdesc_blk *tdb;
1588 
1589 	rtw_txdesc_blk_init_all(&sc->sc_txdesc_blk[0]);
1590 
1591 	rtw_txsoft_blk_init_all(&sc->sc_txsoft_blk[0]);
1592 
1593 	rdb = &sc->sc_rxdesc_blk;
1594 	if ((rc = rtw_rxsoft_init_all(sc->sc_dmat, sc->sc_rxsoft,
1595 	    &rdb->rdb_ndesc, sc->sc_dev.dv_xname)) != 0 &&
1596 	    rdb->rdb_ndesc == 0) {
1597 		printf("%s: could not allocate rx buffers\n",
1598 		    sc->sc_dev.dv_xname);
1599 		return rc;
1600 	}
1601 
1602 	rdb = &sc->sc_rxdesc_blk;
1603 	rtw_rxdescs_sync(rdb, 0, rdb->rdb_ndesc,
1604 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1605 	rtw_rxdesc_init_all(rdb, sc->sc_rxsoft, 1);
1606 	rdb->rdb_next = 0;
1607 
1608 	tdb = &sc->sc_txdesc_blk[0];
1609 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1610 		rtw_txdescs_sync(&tdb[pri], 0, tdb[pri].tdb_ndesc,
1611 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1612 	}
1613 	return 0;
1614 }
1615 
1616 void
1617 rtw_txdesc_blk_init(struct rtw_txdesc_blk *tdb)
1618 {
1619 	int i;
1620 
1621 	bzero(tdb->tdb_desc, sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
1622 	for (i = 0; i < tdb->tdb_ndesc; i++)
1623 		tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
1624 }
1625 
1626 u_int
1627 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
1628 {
1629 	return (letoh32(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
1630 	    sizeof(struct rtw_txdesc);
1631 }
1632 
1633 void
1634 rtw_txring_fixup(struct rtw_softc *sc)
1635 {
1636 	int pri;
1637 	u_int next;
1638 	struct rtw_txdesc_blk *tdb;
1639 	struct rtw_regs *regs = &sc->sc_regs;
1640 
1641 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1642 		tdb = &sc->sc_txdesc_blk[pri];
1643 		next = rtw_txring_next(regs, tdb);
1644 		if (tdb->tdb_next == next)
1645 			continue;
1646 		RTW_DPRINTF(RTW_DEBUG_BUGS,
1647 		    ("%s: tx-ring %d expected next %u, read %u\n", __func__,
1648 		    pri, tdb->tdb_next, next));
1649 		tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
1650 	}
1651 }
1652 
1653 void
1654 rtw_rxring_fixup(struct rtw_softc *sc)
1655 {
1656 	u_int next;
1657 	uint32_t rdsar;
1658 	struct rtw_rxdesc_blk *rdb;
1659 
1660 	rdsar = letoh32(RTW_READ(&sc->sc_regs, RTW_RDSAR));
1661 	next = (rdsar - RTW_RING_BASE(sc, hd_rx)) / sizeof(struct rtw_rxdesc);
1662 
1663 	rdb = &sc->sc_rxdesc_blk;
1664 	if (rdb->rdb_next != next) {
1665 		RTW_DPRINTF(RTW_DEBUG_BUGS,
1666 		    ("%s: rx-ring expected next %u, read %u\n", __func__,
1667 		    rdb->rdb_next, next));
1668 		rdb->rdb_next = MIN(next, rdb->rdb_ndesc - 1);
1669 	}
1670 }
1671 
1672 void
1673 rtw_txdescs_reset(struct rtw_softc *sc)
1674 {
1675 	int pri;
1676 
1677 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1678 		rtw_collect_txring(sc, &sc->sc_txsoft_blk[pri],
1679 		    &sc->sc_txdesc_blk[pri], 1);
1680 	}
1681 }
1682 
1683 void
1684 rtw_intr_ioerror(struct rtw_softc *sc, u_int16_t isr)
1685 {
1686 	uint8_t cr = 0;
1687 	int xmtr = 0, rcvr = 0;
1688 	struct rtw_regs *regs = &sc->sc_regs;
1689 
1690 	if ((isr & RTW_INTR_TXFOVW) != 0) {
1691 		RTW_DPRINTF(RTW_DEBUG_BUGS,
1692 		    ("%s: tx fifo underflow\n", sc->sc_dev.dv_xname));
1693 		rcvr = xmtr = 1;
1694 		cr |= RTW_CR_TE | RTW_CR_RE;
1695 	}
1696 
1697 	if ((isr & (RTW_INTR_RDU|RTW_INTR_RXFOVW)) != 0) {
1698 		cr |= RTW_CR_RE;
1699 		rcvr = 1;
1700 	}
1701 
1702 	RTW_DPRINTF(RTW_DEBUG_BUGS, ("%s: restarting xmit/recv, isr %hx"
1703 	    "\n", sc->sc_dev.dv_xname, isr));
1704 
1705 #ifdef RTW_DEBUG
1706 	rtw_dump_rings(sc);
1707 #endif /* RTW_DEBUG */
1708 
1709 	rtw_io_enable(regs, cr, 0);
1710 
1711 	/* Collect rx'd packets.  Refresh rx buffers. */
1712 	if (rcvr)
1713 		rtw_intr_rx(sc, 0);
1714 	/* Collect tx'd packets.  XXX let's hope this stops the transmit
1715 	 * timeouts.
1716 	 */
1717 	if (xmtr)
1718 		rtw_txdescs_reset(sc);
1719 
1720 	RTW_WRITE16(regs, RTW_IMR, 0);
1721 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
1722 
1723 	if (rtw_do_chip_reset) {
1724 		rtw_chip_reset1(regs, sc->sc_dev.dv_xname);
1725 	}
1726 
1727 	rtw_rxdesc_init_all(&sc->sc_rxdesc_blk, &sc->sc_rxsoft[0], 1);
1728 
1729 #ifdef RTW_DEBUG
1730 	rtw_dump_rings(sc);
1731 #endif /* RTW_DEBUG */
1732 
1733 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
1734 	RTW_SYNC(regs, RTW_IMR, RTW_IMR);
1735 	if (rcvr)
1736 		rtw_rxring_fixup(sc);
1737 	rtw_io_enable(regs, cr, 1);
1738 	if (xmtr)
1739 		rtw_txring_fixup(sc);
1740 }
1741 
1742 void
1743 rtw_suspend_ticks(struct rtw_softc *sc)
1744 {
1745 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
1746 	    ("%s: suspending ticks\n", sc->sc_dev.dv_xname));
1747 	sc->sc_do_tick = 0;
1748 }
1749 
1750 void
1751 rtw_resume_ticks(struct rtw_softc *sc)
1752 {
1753 	u_int32_t tsftrl0, tsftrl1, next_tick;
1754 
1755 	tsftrl0 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1756 
1757 	tsftrl1 = RTW_READ(&sc->sc_regs, RTW_TSFTRL);
1758 	next_tick = tsftrl1 + 1000000;
1759 	RTW_WRITE(&sc->sc_regs, RTW_TINT, next_tick);
1760 
1761 	sc->sc_do_tick = 1;
1762 
1763 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
1764 	    ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
1765 	    sc->sc_dev.dv_xname, tsftrl1 - tsftrl0, tsftrl1, next_tick));
1766 }
1767 
1768 void
1769 rtw_intr_timeout(struct rtw_softc *sc)
1770 {
1771 	RTW_DPRINTF(RTW_DEBUG_TIMEOUT, ("%s: timeout\n", sc->sc_dev.dv_xname));
1772 	if (sc->sc_do_tick)
1773 		rtw_resume_ticks(sc);
1774 	return;
1775 }
1776 
1777 int
1778 rtw_intr(void *arg)
1779 {
1780 	int i;
1781 	struct rtw_softc *sc = arg;
1782 	struct rtw_regs *regs = &sc->sc_regs;
1783 	u_int16_t isr;
1784 
1785 	/*
1786 	 * If the interface isn't running, the interrupt couldn't
1787 	 * possibly have come from us.
1788 	 */
1789 	if ((sc->sc_flags & RTW_F_ENABLED) == 0 ||
1790 	    (sc->sc_if.if_flags & IFF_RUNNING) == 0 ||
1791 	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0) {
1792 		RTW_DPRINTF(RTW_DEBUG_INTR, ("%s: stray interrupt\n",
1793 		     sc->sc_dev.dv_xname));
1794 		return (0);
1795 	}
1796 
1797 	for (i = 0; i < 10; i++) {
1798 		isr = RTW_READ16(regs, RTW_ISR);
1799 
1800 		RTW_WRITE16(regs, RTW_ISR, isr);
1801 		RTW_WBR(regs, RTW_ISR, RTW_ISR);
1802 
1803 		if (sc->sc_intr_ack != NULL)
1804 			(*sc->sc_intr_ack)(regs);
1805 
1806 		if (isr == 0)
1807 			break;
1808 
1809 #ifdef RTW_DEBUG
1810 #define PRINTINTR(flag) do { \
1811 	if ((isr & flag) != 0) { \
1812 		printf("%s" #flag, delim); \
1813 		delim = ","; \
1814 	} \
1815 } while (0)
1816 
1817 		if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
1818 			const char *delim = "<";
1819 
1820 			printf("%s: reg[ISR] = %x", sc->sc_dev.dv_xname, isr);
1821 
1822 			PRINTINTR(RTW_INTR_TXFOVW);
1823 			PRINTINTR(RTW_INTR_TIMEOUT);
1824 			PRINTINTR(RTW_INTR_BCNINT);
1825 			PRINTINTR(RTW_INTR_ATIMINT);
1826 			PRINTINTR(RTW_INTR_TBDER);
1827 			PRINTINTR(RTW_INTR_TBDOK);
1828 			PRINTINTR(RTW_INTR_THPDER);
1829 			PRINTINTR(RTW_INTR_THPDOK);
1830 			PRINTINTR(RTW_INTR_TNPDER);
1831 			PRINTINTR(RTW_INTR_TNPDOK);
1832 			PRINTINTR(RTW_INTR_RXFOVW);
1833 			PRINTINTR(RTW_INTR_RDU);
1834 			PRINTINTR(RTW_INTR_TLPDER);
1835 			PRINTINTR(RTW_INTR_TLPDOK);
1836 			PRINTINTR(RTW_INTR_RER);
1837 			PRINTINTR(RTW_INTR_ROK);
1838 
1839 			printf(">\n");
1840 		}
1841 #undef PRINTINTR
1842 #endif /* RTW_DEBUG */
1843 
1844 		if ((isr & RTW_INTR_RX) != 0)
1845 			rtw_intr_rx(sc, isr & RTW_INTR_RX);
1846 		if ((isr & RTW_INTR_TX) != 0)
1847 			rtw_intr_tx(sc, isr & RTW_INTR_TX);
1848 #ifndef IEEE80211_STA_ONLY
1849 		if ((isr & RTW_INTR_BEACON) != 0)
1850 			rtw_intr_beacon(sc, isr & RTW_INTR_BEACON);
1851 		if ((isr & RTW_INTR_ATIMINT) != 0)
1852 			rtw_intr_atim(sc);
1853 #endif
1854 		if ((isr & RTW_INTR_IOERROR) != 0)
1855 			rtw_intr_ioerror(sc, isr & RTW_INTR_IOERROR);
1856 		if ((isr & RTW_INTR_TIMEOUT) != 0)
1857 			rtw_intr_timeout(sc);
1858 	}
1859 
1860 	return 1;
1861 }
1862 
1863 /* Must be called at splnet. */
1864 void
1865 rtw_stop(struct ifnet *ifp, int disable)
1866 {
1867 	int pri;
1868 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
1869 	struct ieee80211com *ic = &sc->sc_ic;
1870 	struct rtw_regs *regs = &sc->sc_regs;
1871 
1872 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
1873 		return;
1874 
1875 	rtw_suspend_ticks(sc);
1876 
1877 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1878 
1879 	if ((sc->sc_flags & RTW_F_INVALID) == 0) {
1880 		/* Disable interrupts. */
1881 		RTW_WRITE16(regs, RTW_IMR, 0);
1882 
1883 		RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
1884 
1885 		/* Stop the transmit and receive processes. First stop DMA,
1886 		 * then disable receiver and transmitter.
1887 		 */
1888 		RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
1889 
1890 		RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
1891 
1892 		rtw_io_enable(&sc->sc_regs, RTW_CR_RE|RTW_CR_TE, 0);
1893 	}
1894 
1895 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
1896 		rtw_txsofts_release(sc->sc_dmat, &sc->sc_ic,
1897 		    &sc->sc_txsoft_blk[pri]);
1898 	}
1899 
1900 	rtw_rxbufs_release(sc->sc_dmat, &sc->sc_rxsoft[0]);
1901 
1902 	if (disable)
1903 		rtw_disable(sc);
1904 
1905 	/* Mark the interface as not running.  Cancel the watchdog timer. */
1906 	ifp->if_flags &= ~IFF_RUNNING;
1907 	ifq_clr_oactive(&ifp->if_snd);
1908 	ifp->if_timer = 0;
1909 
1910 	return;
1911 }
1912 
1913 #ifdef RTW_DEBUG
1914 const char *
1915 rtw_pwrstate_string(enum rtw_pwrstate power)
1916 {
1917 	switch (power) {
1918 	case RTW_ON:
1919 		return "on";
1920 	case RTW_SLEEP:
1921 		return "sleep";
1922 	case RTW_OFF:
1923 		return "off";
1924 	default:
1925 		return "unknown";
1926 	}
1927 }
1928 #endif
1929 
1930 /* XXX For Maxim, I am using the RFMD settings gleaned from the
1931  * reference driver, plus a magic Maxim "ON" value that comes from
1932  * the Realtek document "Windows PG for Rtl8180."
1933  */
1934 void
1935 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
1936     int before_rf, int digphy)
1937 {
1938 	u_int32_t anaparm;
1939 
1940 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
1941 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
1942 
1943 	switch (power) {
1944 	case RTW_OFF:
1945 		if (before_rf)
1946 			return;
1947 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
1948 		anaparm |= RTW_ANAPARM_TXDACOFF;
1949 		break;
1950 	case RTW_SLEEP:
1951 		if (!before_rf)
1952 			return;
1953 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
1954 		anaparm |= RTW_ANAPARM_TXDACOFF;
1955 		break;
1956 	case RTW_ON:
1957 		if (!before_rf)
1958 			return;
1959 		anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
1960 		break;
1961 	}
1962 	RTW_DPRINTF(RTW_DEBUG_PWR,
1963 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
1964 	    __func__, rtw_pwrstate_string(power),
1965 	    (before_rf) ? "before" : "after", anaparm));
1966 
1967 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
1968 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
1969 }
1970 
1971 /* XXX I am using the RFMD settings gleaned from the reference
1972  * driver.  They agree
1973  */
1974 void
1975 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
1976     int before_rf, int digphy)
1977 {
1978 	u_int32_t anaparm;
1979 
1980 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
1981 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
1982 
1983 	switch (power) {
1984 	case RTW_OFF:
1985 		if (before_rf)
1986 			return;
1987 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
1988 		anaparm |= RTW_ANAPARM_TXDACOFF;
1989 		break;
1990 	case RTW_SLEEP:
1991 		if (!before_rf)
1992 			return;
1993 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
1994 		anaparm |= RTW_ANAPARM_TXDACOFF;
1995 		break;
1996 	case RTW_ON:
1997 		if (!before_rf)
1998 			return;
1999 		anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2000 		break;
2001 	}
2002 	RTW_DPRINTF(RTW_DEBUG_PWR,
2003 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2004 	    __func__, rtw_pwrstate_string(power),
2005 	    (before_rf) ? "before" : "after", anaparm));
2006 
2007 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
2008 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
2009 }
2010 
2011 void
2012 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2013     int before_rf, int digphy)
2014 {
2015 	u_int32_t anaparm;
2016 
2017 	anaparm = RTW_READ(regs, RTW_ANAPARM_0);
2018 	anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2019 
2020 	switch (power) {
2021 	case RTW_OFF:
2022 		if (before_rf)
2023 			return;
2024 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2025 		anaparm |= RTW_ANAPARM_TXDACOFF;
2026 		break;
2027 	case RTW_SLEEP:
2028 		if (!before_rf)
2029 			return;
2030 		anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2031 		anaparm |= RTW_ANAPARM_TXDACOFF;
2032 		break;
2033 	case RTW_ON:
2034 		if (!before_rf)
2035 			return;
2036 		if (digphy) {
2037 			anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2038 			/* XXX guess */
2039 			anaparm |= RTW_ANAPARM_TXDACOFF;
2040 		} else
2041 			anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2042 		break;
2043 	}
2044 	RTW_DPRINTF(RTW_DEBUG_PWR,
2045 	    ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2046 	    __func__, rtw_pwrstate_string(power),
2047 	    (before_rf) ? "before" : "after", anaparm));
2048 
2049 	RTW_WRITE(regs, RTW_ANAPARM_0, anaparm);
2050 	RTW_SYNC(regs, RTW_ANAPARM_0, RTW_ANAPARM_0);
2051 }
2052 
2053 void
2054 rtw_rtl_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2055     int before_rf, int digphy)
2056 {
2057 	/* empty */
2058 }
2059 
2060 void
2061 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2062     int digphy)
2063 {
2064 	struct rtw_regs *regs = &sc->sc_regs;
2065 
2066 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2067 
2068 	(*sc->sc_pwrstate_cb)(regs, power, before_rf, digphy);
2069 
2070 	rtw_set_access(regs, RTW_ACCESS_NONE);
2071 
2072 	return;
2073 }
2074 
2075 int
2076 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2077 {
2078 	int rc;
2079 
2080 	RTW_DPRINTF(RTW_DEBUG_PWR,
2081 	    ("%s: %s->%s\n", __func__,
2082 	    rtw_pwrstate_string(sc->sc_pwrstate), rtw_pwrstate_string(power)));
2083 
2084 	if (sc->sc_pwrstate == power)
2085 		return 0;
2086 
2087 	rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2088 	rc = (*sc->sc_rf_pwrstate)(sc, power);
2089 	rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2090 
2091 	switch (power) {
2092 	case RTW_ON:
2093 		/* TBD set LEDs */
2094 		break;
2095 	case RTW_SLEEP:
2096 		/* TBD */
2097 		break;
2098 	case RTW_OFF:
2099 		/* TBD */
2100 		break;
2101 	}
2102 	if (rc == 0)
2103 		sc->sc_pwrstate = power;
2104 	else
2105 		sc->sc_pwrstate = RTW_OFF;
2106 	return rc;
2107 }
2108 
2109 int
2110 rtw_tune(struct rtw_softc *sc)
2111 {
2112 	struct ieee80211com *ic = &sc->sc_ic;
2113 	u_int chan, idx;
2114 	u_int8_t txpower;
2115 	int rc;
2116 
2117 	KASSERT(ic->ic_bss->ni_chan != NULL);
2118 
2119 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
2120 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2121 		return 0;
2122 
2123 	if (chan == sc->sc_cur_chan) {
2124 		RTW_DPRINTF(RTW_DEBUG_TUNE,
2125 		    ("%s: already tuned chan #%d\n", __func__, chan));
2126 		return 0;
2127 	}
2128 
2129 	rtw_suspend_ticks(sc);
2130 
2131 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 0);
2132 
2133 	/* TBD wait for Tx to complete */
2134 
2135 	KASSERT((sc->sc_flags & RTW_F_ENABLED) != 0);
2136 
2137 	idx = RTW_SR_TXPOWER1 +
2138 	    ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan) - 1;
2139 	KASSERT2(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
2140 	    ("%s: channel %d out of range", __func__,
2141 	     idx - RTW_SR_TXPOWER1 + 1));
2142 	txpower =  RTW_SR_GET(&sc->sc_srom, idx);
2143 
2144 	if ((rc = rtw_phy_init(sc)) != 0) {
2145 		/* XXX condition on powersaving */
2146 		printf("%s: phy init failed\n", sc->sc_dev.dv_xname);
2147 	}
2148 
2149 	sc->sc_cur_chan = chan;
2150 
2151 	rtw_io_enable(&sc->sc_regs, RTW_CR_RE | RTW_CR_TE, 1);
2152 
2153 	rtw_resume_ticks(sc);
2154 
2155 	return rc;
2156 }
2157 
2158 void
2159 rtw_disable(struct rtw_softc *sc)
2160 {
2161 	int rc;
2162 
2163 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2164 		return;
2165 
2166 	/* turn off PHY */
2167 	if ((sc->sc_flags & RTW_F_INVALID) == 0 &&
2168 	    (rc = rtw_pwrstate(sc, RTW_OFF)) != 0) {
2169 		printf("%s: failed to turn off PHY (%d)\n",
2170 		    sc->sc_dev.dv_xname, rc);
2171 	}
2172 
2173 	if (sc->sc_disable != NULL)
2174 		(*sc->sc_disable)(sc);
2175 
2176 	sc->sc_flags &= ~RTW_F_ENABLED;
2177 }
2178 
2179 int
2180 rtw_enable(struct rtw_softc *sc)
2181 {
2182 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
2183 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2184 			printf("%s: device enable failed\n",
2185 			    sc->sc_dev.dv_xname);
2186 			return (EIO);
2187 		}
2188 		sc->sc_flags |= RTW_F_ENABLED;
2189 	}
2190 	return (0);
2191 }
2192 
2193 void
2194 rtw_transmit_config(struct rtw_softc *sc)
2195 {
2196 	struct rtw_regs *regs = &sc->sc_regs;
2197 	u_int32_t tcr;
2198 
2199 	tcr = RTW_READ(regs, RTW_TCR);
2200 
2201 	tcr |= RTW_TCR_CWMIN;
2202 	tcr &= ~RTW_TCR_MXDMA_MASK;
2203 	tcr |= RTW_TCR_MXDMA_256;
2204 	if ((sc->sc_flags & RTW_F_RTL8185) == 0)
2205 		tcr |= RTW8180_TCR_SAT;		/* send ACK as fast as possible */
2206 	tcr &= ~RTW_TCR_LBK_MASK;
2207 	tcr |= RTW_TCR_LBK_NORMAL;	/* normal operating mode */
2208 
2209 	/* set short/long retry limits */
2210 	tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2211 	tcr |= LSHIFT(4, RTW_TCR_SRL_MASK) | LSHIFT(4, RTW_TCR_LRL_MASK);
2212 
2213 	tcr &= ~RTW_TCR_CRC;    /* NIC appends CRC32 */
2214 
2215 	RTW_WRITE(regs, RTW_TCR, tcr);
2216 	RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2217 }
2218 
2219 void
2220 rtw_enable_interrupts(struct rtw_softc *sc)
2221 {
2222 	struct rtw_regs *regs = &sc->sc_regs;
2223 
2224 	sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2225 	sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2226 
2227 	RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2228 	RTW_WBW(regs, RTW_IMR, RTW_ISR);
2229 	RTW_WRITE16(regs, RTW_ISR, 0xffff);
2230 	RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2231 
2232 	/* XXX necessary? */
2233 	if (sc->sc_intr_ack != NULL)
2234 		(*sc->sc_intr_ack)(regs);
2235 }
2236 
2237 void
2238 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2239 {
2240 	uint8_t msr;
2241 
2242 	/* I'm guessing that MSR is protected as CONFIG[0123] are. */
2243 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_CONFIG);
2244 
2245 	msr = RTW_READ8(&sc->sc_regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2246 
2247 	switch (opmode) {
2248 #ifndef IEEE80211_STA_ONLY
2249 	case IEEE80211_M_AHDEMO:
2250 	case IEEE80211_M_IBSS:
2251 		msr |= RTW_MSR_NETYPE_ADHOC_OK;
2252 		break;
2253 	case IEEE80211_M_HOSTAP:
2254 		msr |= RTW_MSR_NETYPE_AP_OK;
2255 		break;
2256 #endif
2257 	case IEEE80211_M_MONITOR:
2258 		/* XXX */
2259 		msr |= RTW_MSR_NETYPE_NOLINK;
2260 		break;
2261 	case IEEE80211_M_STA:
2262 		msr |= RTW_MSR_NETYPE_INFRA_OK;
2263 		break;
2264 	default:
2265 		break;
2266 	}
2267 	RTW_WRITE8(&sc->sc_regs, RTW_MSR, msr);
2268 
2269 	rtw_set_access(&sc->sc_regs, RTW_ACCESS_NONE);
2270 }
2271 
2272 void
2273 rtw_pktfilt_load(struct rtw_softc *sc)
2274 {
2275 	struct rtw_regs *regs = &sc->sc_regs;
2276 	struct ieee80211com *ic = &sc->sc_ic;
2277 	struct arpcom *ac = &ic->ic_ac;
2278 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2279 	int hash;
2280 	u_int32_t hashes[2] = { 0, 0 };
2281 	struct ether_multi *enm;
2282 	struct ether_multistep step;
2283 
2284 	/* XXX might be necessary to stop Rx/Tx engines while setting filters */
2285 
2286 	sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2287 	sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW8180_RCR_RXFTH_MASK);
2288 
2289 	sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2290 	/* MAC auto-reset PHY (huh?) */
2291 	sc->sc_rcr |= RTW_RCR_ENMARP;
2292 	/* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2293 	sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW8180_RCR_RXFTH_WHOLE;
2294 
2295 	switch (ic->ic_opmode) {
2296 	case IEEE80211_M_MONITOR:
2297 		sc->sc_rcr |= RTW_RCR_MONITOR;
2298 		break;
2299 #ifndef IEEE80211_STA_ONLY
2300 	case IEEE80211_M_AHDEMO:
2301 	case IEEE80211_M_IBSS:
2302 		/* receive broadcasts in our BSS */
2303 		sc->sc_rcr |= RTW_RCR_ADD3;
2304 		break;
2305 #endif
2306 	default:
2307 		break;
2308 	}
2309 
2310 	ifp->if_flags &= ~IFF_ALLMULTI;
2311 
2312 	/* XXX accept all broadcast if scanning */
2313 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2314 		sc->sc_rcr |= RTW_RCR_AB;	/* accept all broadcast */
2315 
2316 	if (ifp->if_flags & IFF_PROMISC || ac->ac_multirangecnt > 0) {
2317 		if (ifp->if_flags & IFF_PROMISC)
2318 			sc->sc_rcr |= RTW_RCR_AB; /* accept all broadcast */
2319 allmulti:
2320 		ifp->if_flags |= IFF_ALLMULTI;
2321 		goto setit;
2322 	}
2323 
2324 	/*
2325 	 * Program the 64-bit multicast hash filter.
2326 	 */
2327 	ETHER_FIRST_MULTI(step, ac, enm);
2328 	while (enm != NULL) {
2329 		hash = ether_crc32_be((enm->enm_addrlo),
2330 		    IEEE80211_ADDR_LEN) >> 26;
2331 		hashes[hash >> 5] |= (1 << (hash & 0x1f));
2332 		sc->sc_rcr |= RTW_RCR_AM;
2333 		ETHER_NEXT_MULTI(step, enm);
2334 	}
2335 
2336 	/* all bits set => hash is useless */
2337 	if (~(hashes[0] & hashes[1]) == 0)
2338 		goto allmulti;
2339 
2340  setit:
2341 	if (ifp->if_flags & IFF_ALLMULTI) {
2342 		sc->sc_rcr |= RTW_RCR_AM;	/* accept all multicast */
2343 		hashes[0] = hashes[1] = 0xffffffff;
2344 	}
2345 
2346 	RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2347 	RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2348 	RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2349 	RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2350 
2351 	DPRINTF(sc, RTW_DEBUG_PKTFILT,
2352 	    ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2353 	    sc->sc_dev.dv_xname, RTW_READ(regs, RTW_MAR0),
2354 	    RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2355 
2356 	return;
2357 }
2358 
2359 /* Must be called at splnet. */
2360 int
2361 rtw_init(struct ifnet *ifp)
2362 {
2363 	struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
2364 	struct ieee80211com *ic = &sc->sc_ic;
2365 	struct rtw_regs *regs = &sc->sc_regs;
2366 	int rc = 0;
2367 
2368 	if ((rc = rtw_enable(sc)) != 0)
2369 		goto out;
2370 
2371 	/* Cancel pending I/O and reset. */
2372 	rtw_stop(ifp, 0);
2373 
2374 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2375 	DPRINTF(sc, RTW_DEBUG_TUNE, ("%s: channel %d freq %d flags 0x%04x\n",
2376 	    __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
2377 	    ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
2378 
2379 	if ((rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2380 		goto out;
2381 
2382 	if ((rc = rtw_swring_setup(sc)) != 0)
2383 		goto out;
2384 
2385 	rtw_transmit_config(sc);
2386 
2387 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2388 
2389 	RTW_WRITE8(regs, RTW_MSR, 0x0);	/* no link */
2390 	RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2391 
2392 	/* long PLCP header, 1Mb/2Mb basic rate */
2393 	if (sc->sc_flags & RTW_F_RTL8185)
2394 		RTW_WRITE16(regs, RTW_BRSR, RTW8185_BRSR_MBR_2MBPS);
2395 	else
2396 		RTW_WRITE16(regs, RTW_BRSR, RTW8180_BRSR_MBR_2MBPS);
2397 	RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2398 
2399 	rtw_set_access(regs, RTW_ACCESS_ANAPARM);
2400 	rtw_set_access(regs, RTW_ACCESS_NONE);
2401 
2402 	/* XXX from reference sources */
2403 	RTW_WRITE(regs, RTW_FEMR, 0xffff);
2404 	RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2405 
2406 	rtw_set_rfprog(regs, sc->sc_rfchipid, sc->sc_dev.dv_xname);
2407 
2408 	RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2409 	/* from Linux driver */
2410 	RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2411 
2412 	RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2413 
2414 	rtw_enable_interrupts(sc);
2415 
2416 	rtw_pktfilt_load(sc);
2417 
2418 	rtw_hwring_setup(sc);
2419 
2420 	rtw_io_enable(regs, RTW_CR_RE|RTW_CR_TE, 1);
2421 
2422 	ifp->if_flags |= IFF_RUNNING;
2423 	ic->ic_state = IEEE80211_S_INIT;
2424 
2425 	RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2426 	RTW_WRITE(regs, RTW_BSSID32, 0x0);
2427 
2428 	rtw_resume_ticks(sc);
2429 
2430 	rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2431 
2432 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2433 		return ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2434 	else
2435 		return ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2436 
2437 out:
2438 	printf("%s: interface not running\n", sc->sc_dev.dv_xname);
2439 	return rc;
2440 }
2441 
2442 void
2443 rtw_led_init(struct rtw_regs *regs)
2444 {
2445 	u_int8_t cfg0, cfg1;
2446 
2447 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
2448 
2449 	cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2450 	cfg0 |= RTW8180_CONFIG0_LEDGPOEN;
2451 	RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2452 
2453 	cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2454 	RTW_DPRINTF(RTW_DEBUG_LED,
2455 	    ("%s: read % from reg[CONFIG1]\n", __func__, cfg1));
2456 
2457 	cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2458 	cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2459 	RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2460 
2461 	rtw_set_access(regs, RTW_ACCESS_NONE);
2462 }
2463 
2464 /*
2465  * IEEE80211_S_INIT: 		LED1 off
2466  *
2467  * IEEE80211_S_AUTH,
2468  * IEEE80211_S_ASSOC,
2469  * IEEE80211_S_SCAN: 		LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2470  *
2471  * IEEE80211_S_RUN: 		LED1 on, blinks @ 5Hz for tx/rx
2472  */
2473 void
2474 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2475 {
2476 	struct rtw_led_state *ls;
2477 
2478 	ls = &sc->sc_led_state;
2479 
2480 	switch (nstate) {
2481 	case IEEE80211_S_INIT:
2482 		rtw_led_init(&sc->sc_regs);
2483 		timeout_del(&ls->ls_slow_ch);
2484 		timeout_del(&ls->ls_fast_ch);
2485 		ls->ls_slowblink = 0;
2486 		ls->ls_actblink = 0;
2487 		ls->ls_default = 0;
2488 		break;
2489 	case IEEE80211_S_SCAN:
2490 		timeout_add_msec(&ls->ls_slow_ch, RTW_LED_SLOW_MSEC);
2491 		timeout_add_msec(&ls->ls_fast_ch, RTW_LED_FAST_MSEC);
2492 		/*FALLTHROUGH*/
2493 	case IEEE80211_S_AUTH:
2494 	case IEEE80211_S_ASSOC:
2495 		ls->ls_default = RTW_LED1;
2496 		ls->ls_actblink = RTW_LED1;
2497 		ls->ls_slowblink = RTW_LED1;
2498 		break;
2499 	case IEEE80211_S_RUN:
2500 		ls->ls_slowblink = 0;
2501 		break;
2502 	}
2503 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2504 }
2505 
2506 void
2507 rtw_led_set(struct rtw_led_state *ls, struct rtw_regs *regs, u_int hwverid)
2508 {
2509 	u_int8_t led_condition;
2510 	bus_size_t ofs;
2511 	u_int8_t mask, newval, val;
2512 
2513 	led_condition = ls->ls_default;
2514 
2515 	if (ls->ls_state & RTW_LED_S_SLOW)
2516 		led_condition ^= ls->ls_slowblink;
2517 	if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2518 		led_condition ^= ls->ls_actblink;
2519 
2520 	RTW_DPRINTF(RTW_DEBUG_LED,
2521 	    ("%s: LED condition %\n", __func__, led_condition));
2522 
2523 	switch (hwverid) {
2524 	default:
2525 	case RTW_TCR_HWVERID_RTL8180F:
2526 		ofs = RTW_PSR;
2527 		newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2528 		if (led_condition & RTW_LED0)
2529 			newval &= ~RTW_PSR_LEDGPO0;
2530 		if (led_condition & RTW_LED1)
2531 			newval &= ~RTW_PSR_LEDGPO1;
2532 		break;
2533 	case RTW_TCR_HWVERID_RTL8180D:
2534 		ofs = RTW_9346CR;
2535 		mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2536 		newval = RTW_9346CR_EEM_PROGRAM;
2537 		if (led_condition & RTW_LED0)
2538 			newval |= RTW_9346CR_EEDI;
2539 		if (led_condition & RTW_LED1)
2540 			newval |= RTW_9346CR_EECS;
2541 		break;
2542 	}
2543 	val = RTW_READ8(regs, ofs);
2544 	RTW_DPRINTF(RTW_DEBUG_LED,
2545 	    ("%s: read % from reg[%#02]\n", __func__, val,
2546 	     (u_int *)ofs));
2547 	val &= ~mask;
2548 	val |= newval;
2549 	RTW_WRITE8(regs, ofs, val);
2550 	RTW_DPRINTF(RTW_DEBUG_LED,
2551 	    ("%s: wrote % to reg[%#02]\n", __func__, val,
2552 	     (u_int *)ofs));
2553 	RTW_SYNC(regs, ofs, ofs);
2554 }
2555 
2556 void
2557 rtw_led_fastblink(void *arg)
2558 {
2559 	int ostate, s;
2560 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2561 	struct rtw_led_state *ls = &sc->sc_led_state;
2562 
2563 	s = splnet();
2564 	ostate = ls->ls_state;
2565 	ls->ls_state ^= ls->ls_event;
2566 
2567 	if ((ls->ls_event & RTW_LED_S_TX) == 0)
2568 		ls->ls_state &= ~RTW_LED_S_TX;
2569 
2570 	if ((ls->ls_event & RTW_LED_S_RX) == 0)
2571 		ls->ls_state &= ~RTW_LED_S_RX;
2572 
2573 	ls->ls_event = 0;
2574 
2575 	if (ostate != ls->ls_state)
2576 		rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2577 	splx(s);
2578 
2579 	timeout_add_msec(&ls->ls_fast_ch, RTW_LED_FAST_MSEC);
2580 }
2581 
2582 void
2583 rtw_led_slowblink(void *arg)
2584 {
2585 	int s;
2586 	struct rtw_softc *sc = (struct rtw_softc *)arg;
2587 	struct rtw_led_state *ls = &sc->sc_led_state;
2588 
2589 	s = splnet();
2590 	ls->ls_state ^= RTW_LED_S_SLOW;
2591 	rtw_led_set(ls, &sc->sc_regs, sc->sc_hwverid);
2592 	splx(s);
2593 	timeout_add_msec(&ls->ls_slow_ch, RTW_LED_SLOW_MSEC);
2594 }
2595 
2596 void
2597 rtw_led_attach(struct rtw_led_state *ls, void *arg)
2598 {
2599 	timeout_set(&ls->ls_fast_ch, rtw_led_fastblink, arg);
2600 	timeout_set(&ls->ls_slow_ch, rtw_led_slowblink, arg);
2601 }
2602 
2603 int
2604 rtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2605 {
2606 	struct rtw_softc *sc = ifp->if_softc;
2607 	struct ifreq *ifr = (struct ifreq *)data;
2608 	int rc = 0, s;
2609 
2610 	s = splnet();
2611 
2612 	switch (cmd) {
2613 	case SIOCSIFADDR:
2614 		ifp->if_flags |= IFF_UP;
2615 		/* FALLTHROUGH */
2616 
2617 	case SIOCSIFFLAGS:
2618 		if ((ifp->if_flags & IFF_UP) != 0) {
2619 			if ((sc->sc_flags & RTW_F_ENABLED) != 0) {
2620 				rtw_pktfilt_load(sc);
2621 			} else
2622 				rc = rtw_init(ifp);
2623 		} else if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2624 			rtw_stop(ifp, 1);
2625 		break;
2626 
2627 	case SIOCADDMULTI:
2628 	case SIOCDELMULTI:
2629 		if (cmd == SIOCADDMULTI)
2630 			rc = ether_addmulti(ifr, &sc->sc_ic.ic_ac);
2631 		else
2632 			rc = ether_delmulti(ifr, &sc->sc_ic.ic_ac);
2633 		if (rc != ENETRESET)
2634 			break;
2635 		if (ifp->if_flags & IFF_RUNNING)
2636 			rtw_pktfilt_load(sc);
2637 		rc = 0;
2638 		break;
2639 
2640 	default:
2641 		if ((rc = ieee80211_ioctl(ifp, cmd, data)) == ENETRESET) {
2642 			if ((sc->sc_flags & RTW_F_ENABLED) != 0)
2643 				rc = rtw_init(ifp);
2644 			else
2645 				rc = 0;
2646 		}
2647 		break;
2648 	}
2649 
2650 	splx(s);
2651 	return rc;
2652 }
2653 
2654 /* Select a transmit ring with at least one h/w and s/w descriptor free.
2655  * Return 0 on success, -1 on failure.
2656  */
2657 int
2658 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
2659     struct rtw_txdesc_blk **tdbp, int pri)
2660 {
2661 	struct rtw_txsoft_blk *tsb;
2662 	struct rtw_txdesc_blk *tdb;
2663 
2664 	KASSERT(pri >= 0 && pri < RTW_NTXPRI);
2665 
2666 	tsb = &sc->sc_txsoft_blk[pri];
2667 	tdb = &sc->sc_txdesc_blk[pri];
2668 
2669 	if (SIMPLEQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
2670 		if (tsb->tsb_tx_timer == 0)
2671 			tsb->tsb_tx_timer = 5;
2672 		*tsbp = NULL;
2673 		*tdbp = NULL;
2674 		return -1;
2675 	}
2676 	*tsbp = tsb;
2677 	*tdbp = tdb;
2678 	return 0;
2679 }
2680 
2681 struct mbuf *
2682 rtw_80211_dequeue(struct rtw_softc *sc, struct mbuf_queue *ifq, int pri,
2683     struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
2684     struct ieee80211_node **nip)
2685 {
2686 	struct mbuf *m;
2687 
2688 	if (mq_empty(ifq))
2689 		return NULL;
2690 	if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
2691 		DPRINTF(sc, RTW_DEBUG_XMIT_RSRC, ("%s: no ring %d descriptor\n",
2692 		    __func__, pri));
2693 		ifq_set_oactive(&sc->sc_if.if_snd);
2694 		sc->sc_if.if_timer = 1;
2695 		return NULL;
2696 	}
2697 	m = mq_dequeue(ifq);
2698 	*nip = m->m_pkthdr.ph_cookie;
2699 	return m;
2700 }
2701 
2702 /* Point *mp at the next 802.11 frame to transmit.  Point *tsbp
2703  * at the driver's selection of transmit control block for the packet.
2704  */
2705 int
2706 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
2707     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
2708     struct ieee80211_node **nip)
2709 {
2710 	struct ieee80211com *ic;
2711 	struct ieee80211_frame *wh;
2712 	struct ieee80211_key *k;
2713 	struct mbuf *m0;
2714 	struct rtw_softc *sc;
2715 
2716 	sc = (struct rtw_softc *)ifp->if_softc;
2717 	ic = &sc->sc_ic;
2718 
2719 	DPRINTF(sc, RTW_DEBUG_XMIT,
2720 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
2721 
2722 	if (ic->ic_state == IEEE80211_S_RUN &&
2723 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
2724 	    tdbp, nip)) != NULL) {
2725 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
2726 		    __func__));
2727 		return 0;
2728 	}
2729 
2730 	if ((*mp = rtw_80211_dequeue(sc, &ic->ic_mgtq, RTW_TXPRIMD, tsbp,
2731 	    tdbp, nip)) != NULL) {
2732 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
2733 		    __func__));
2734 		return 0;
2735 	}
2736 
2737 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
2738 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
2739 		return 0;
2740 	}
2741 
2742 	if ((*mp = rtw_80211_dequeue(sc, &ic->ic_pwrsaveq, RTW_TXPRIHI,
2743 	    tsbp, tdbp, nip)) != NULL) {
2744 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue pwrsave frame\n",
2745 		    __func__));
2746 		return 0;
2747 	}
2748 
2749 	if (ic->ic_state != IEEE80211_S_RUN) {
2750 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
2751 		return 0;
2752 	}
2753 
2754 	*mp = NULL;
2755 
2756 	m0 = ifq_deq_begin(&ifp->if_snd);
2757 	if (m0 == NULL) {
2758 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
2759 		    __func__));
2760 		return 0;
2761 	}
2762 
2763 	if (rtw_txring_choose(sc, tsbp, tdbp, RTW_TXPRIMD) == -1) {
2764 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no descriptor\n", __func__));
2765 		ifq_deq_rollback(&ifp->if_snd, m0);
2766 		ifq_set_oactive(&ifp->if_snd);
2767 		sc->sc_if.if_timer = 1;
2768 		return 0;
2769 	}
2770 
2771 	ifq_deq_commit(&ifp->if_snd, m0);
2772 	if (m0 == NULL) {
2773 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame/ring ready\n",
2774 		    __func__));
2775 		return 0;
2776 	}
2777 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue data frame\n", __func__));
2778 	ifp->if_opackets++;
2779 #if NBPFILTER > 0
2780 	if (ifp->if_bpf)
2781 		bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
2782 #endif
2783 	if ((m0 = ieee80211_encap(ifp, m0, nip)) == NULL) {
2784 		DPRINTF(sc, RTW_DEBUG_XMIT,
2785 		    ("%s: encap error\n", __func__));
2786 		ifp->if_oerrors++;
2787 		return -1;
2788 	}
2789 
2790 	/* XXX should do WEP in hardware */
2791 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2792 		wh = mtod(m0, struct ieee80211_frame *);
2793 		k = ieee80211_get_txkey(ic, wh, *nip);
2794 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
2795 			return -1;
2796 	}
2797 
2798 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
2799 	*mp = m0;
2800 	return 0;
2801 }
2802 
2803 int
2804 rtw_seg_too_short(bus_dmamap_t dmamap)
2805 {
2806 	int i;
2807 	for (i = 0; i < dmamap->dm_nsegs; i++) {
2808 		if (dmamap->dm_segs[i].ds_len < 4) {
2809 			printf("%s: segment too short\n", __func__);
2810 			return 1;
2811 		}
2812 	}
2813 	return 0;
2814 }
2815 
2816 /* TBD factor with atw_start */
2817 struct mbuf *
2818 rtw_dmamap_load_txbuf(bus_dma_tag_t dmat, bus_dmamap_t dmam, struct mbuf *chain,
2819     u_int ndescfree, short *ifflagsp, const char *dvname)
2820 {
2821 	int first, rc;
2822 	struct mbuf *m, *m0;
2823 
2824 	m0 = chain;
2825 
2826 	/*
2827 	 * Load the DMA map.  Copy and try (once) again if the packet
2828 	 * didn't fit in the alloted number of segments.
2829 	 */
2830 	for (first = 1;
2831 	     ((rc = bus_dmamap_load_mbuf(dmat, dmam, m0,
2832 	     BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 ||
2833 	     dmam->dm_nsegs > ndescfree || rtw_seg_too_short(dmam)) && first;
2834 	     first = 0) {
2835 		if (rc == 0)
2836 			bus_dmamap_unload(dmat, dmam);
2837 		MGETHDR(m, M_DONTWAIT, MT_DATA);
2838 		if (m == NULL) {
2839 			printf("%s: unable to allocate Tx mbuf\n",
2840 			    dvname);
2841 			break;
2842 		}
2843 		if (m0->m_pkthdr.len > MHLEN) {
2844 			MCLGET(m, M_DONTWAIT);
2845 			if ((m->m_flags & M_EXT) == 0) {
2846 				printf("%s: cannot allocate Tx cluster\n",
2847 				    dvname);
2848 				m_freem(m);
2849 				break;
2850 			}
2851 		}
2852 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
2853 		m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
2854 		m_freem(m0);
2855 		m0 = m;
2856 		m = NULL;
2857 	}
2858 	if (rc != 0) {
2859 		printf("%s: cannot load Tx buffer, rc = %d\n", dvname, rc);
2860 		m_freem(m0);
2861 		return NULL;
2862 	} else if (rtw_seg_too_short(dmam)) {
2863 		printf("%s: cannot load Tx buffer, segment too short\n",
2864 		    dvname);
2865 		bus_dmamap_unload(dmat, dmam);
2866 		m_freem(m0);
2867 		return NULL;
2868 	} else if (dmam->dm_nsegs > ndescfree) {
2869 		printf("%s: too many tx segments\n", dvname);
2870 		bus_dmamap_unload(dmat, dmam);
2871 		m_freem(m0);
2872 		return NULL;
2873 	}
2874 	return m0;
2875 }
2876 
2877 
2878 /*
2879  * Arguments in:
2880  *
2881  * paylen:  payload length (no FCS, no WEP header)
2882  *
2883  * hdrlen:  header length
2884  *
2885  * rate:    MSDU speed, units 500kb/s
2886  *
2887  * flags:   IEEE80211_F_SHPREAMBLE (use short preamble),
2888  *          IEEE80211_F_SHSLOT (use short slot length)
2889  *
2890  * Arguments out:
2891  *
2892  * d:       802.11 Duration field for RTS,
2893  *          802.11 Duration field for data frame,
2894  *          PLCP Length for data frame,
2895  *          residual octets at end of data slot
2896  */
2897 int
2898 rtw_compute_duration1(int len, int use_ack, uint32_t flags, int rate,
2899     struct rtw_duration *d)
2900 {
2901 	int pre, ctsrate;
2902 	int ack, bitlen, data_dur, remainder;
2903 
2904 	/* RTS reserves medium for SIFS | CTS | SIFS | (DATA) | SIFS | ACK
2905 	 * DATA reserves medium for SIFS | ACK
2906 	 *
2907 	 * XXXMYC: no ACK on multicast/broadcast or control packets
2908 	 */
2909 
2910 	bitlen = len * 8;
2911 
2912 	pre = IEEE80211_DUR_DS_SIFS;
2913 	if ((flags & IEEE80211_F_SHPREAMBLE) != 0)
2914 		pre += IEEE80211_DUR_DS_SHORT_PREAMBLE +
2915 		    IEEE80211_DUR_DS_FAST_PLCPHDR;
2916 	else
2917 		pre += IEEE80211_DUR_DS_LONG_PREAMBLE +
2918 		    IEEE80211_DUR_DS_SLOW_PLCPHDR;
2919 
2920 	d->d_residue = 0;
2921 	data_dur = (bitlen * 2) / rate;
2922 	remainder = (bitlen * 2) % rate;
2923 	if (remainder != 0) {
2924 		d->d_residue = (rate - remainder) / 16;
2925 		data_dur++;
2926 	}
2927 
2928 	switch (rate) {
2929 	case 2:		/* 1 Mb/s */
2930 	case 4:		/* 2 Mb/s */
2931 		/* 1 - 2 Mb/s WLAN: send ACK/CTS at 1 Mb/s */
2932 		ctsrate = 2;
2933 		break;
2934 	case 11:	/* 5.5 Mb/s */
2935 	case 22:	/* 11  Mb/s */
2936 	case 44:	/* 22  Mb/s */
2937 		/* 5.5 - 11 Mb/s WLAN: send ACK/CTS at 2 Mb/s */
2938 		ctsrate = 4;
2939 		break;
2940 	default:
2941 		/* TBD */
2942 		return -1;
2943 	}
2944 
2945 	d->d_plcp_len = data_dur;
2946 
2947 	ack = (use_ack) ? pre + (IEEE80211_DUR_DS_SLOW_ACK * 2) / ctsrate : 0;
2948 
2949 	d->d_rts_dur =
2950 	    pre + (IEEE80211_DUR_DS_SLOW_CTS * 2) / ctsrate +
2951 	    pre + data_dur +
2952 	    ack;
2953 
2954 	d->d_data_dur = ack;
2955 
2956 	return 0;
2957 }
2958 
2959 /*
2960  * Arguments in:
2961  *
2962  * wh:      802.11 header
2963  *
2964  * len: packet length
2965  *
2966  * rate:    MSDU speed, units 500kb/s
2967  *
2968  * fraglen: fragment length, set to maximum (or higher) for no
2969  *          fragmentation
2970  *
2971  * flags:   IEEE80211_F_WEPON (hardware adds WEP),
2972  *          IEEE80211_F_SHPREAMBLE (use short preamble),
2973  *          IEEE80211_F_SHSLOT (use short slot length)
2974  *
2975  * Arguments out:
2976  *
2977  * d0: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
2978  *     of first/only fragment
2979  *
2980  * dn: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
2981  *     of first/only fragment
2982  */
2983 int
2984 rtw_compute_duration(struct ieee80211_frame *wh, int len, uint32_t flags,
2985     int fraglen, int rate, struct rtw_duration *d0, struct rtw_duration *dn,
2986     int *npktp, int debug)
2987 {
2988 	int ack, rc;
2989 	int firstlen, hdrlen, lastlen, lastlen0, npkt, overlen, paylen;
2990 
2991 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
2992 		hdrlen = sizeof(struct ieee80211_frame_addr4);
2993 	else
2994 		hdrlen = sizeof(struct ieee80211_frame);
2995 
2996 	paylen = len - hdrlen;
2997 
2998 	if ((flags & IEEE80211_F_WEPON) != 0)
2999 		overlen = IEEE80211_WEP_TOTLEN + IEEE80211_CRC_LEN;
3000 	else
3001 		overlen = IEEE80211_CRC_LEN;
3002 
3003 	npkt = paylen / fraglen;
3004 	lastlen0 = paylen % fraglen;
3005 
3006 	if (npkt == 0)			/* no fragments */
3007 		lastlen = paylen + overlen;
3008 	else if (lastlen0 != 0) {	/* a short "tail" fragment */
3009 		lastlen = lastlen0 + overlen;
3010 		npkt++;
3011 	} else				/* full-length "tail" fragment */
3012 		lastlen = fraglen + overlen;
3013 
3014 	if (npktp != NULL)
3015 		*npktp = npkt;
3016 
3017 	if (npkt > 1)
3018 		firstlen = fraglen + overlen;
3019 	else
3020 		firstlen = paylen + overlen;
3021 
3022 	if (debug) {
3023 		printf("%s: npkt %d firstlen %d lastlen0 %d lastlen %d "
3024 		    "fraglen %d overlen %d len %d rate %d flags %08x\n",
3025 		    __func__, npkt, firstlen, lastlen0, lastlen, fraglen,
3026 		    overlen, len, rate, flags);
3027 	}
3028 
3029 	ack = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3030 	    (wh->i_fc[1] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL;
3031 
3032 	rc = rtw_compute_duration1(firstlen + hdrlen, ack, flags, rate, d0);
3033 	if (rc == -1)
3034 		return rc;
3035 
3036 	if (npkt <= 1) {
3037 		*dn = *d0;
3038 		return 0;
3039 	}
3040 	return rtw_compute_duration1(lastlen + hdrlen, ack, flags, rate, dn);
3041 }
3042 
3043 #ifdef RTW_DEBUG
3044 void
3045 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3046     struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3047 {
3048 	struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3049 	DPRINTF(sc, RTW_DEBUG_XMIT_DESC, ("%s: %p %s txdesc[%d] next %#08x "
3050 	    "buf %#08x ctl0 %#08x ctl1 %#08x len %#08x\n",
3051 	    sc->sc_dev.dv_xname, ts, action, desc,
3052 	    letoh32(td->td_buf), letoh32(td->td_next),
3053 	    letoh32(td->td_ctl0), letoh32(td->td_ctl1),
3054 	    letoh32(td->td_len)));
3055 }
3056 #endif /* RTW_DEBUG */
3057 
3058 void
3059 rtw_start(struct ifnet *ifp)
3060 {
3061 	uint8_t tppoll;
3062 	int desc, i, lastdesc, npkt, rate;
3063 	uint32_t proto_ctl0, ctl0, ctl1;
3064 	bus_dmamap_t		dmamap;
3065 	struct ieee80211com	*ic;
3066 	struct ieee80211_frame	*wh;
3067 	struct ieee80211_node	*ni;
3068 	struct mbuf		*m0;
3069 	struct rtw_softc	*sc;
3070 	struct rtw_duration	*d0;
3071 	struct rtw_txsoft_blk	*tsb;
3072 	struct rtw_txdesc_blk	*tdb;
3073 	struct rtw_txsoft	*ts;
3074 	struct rtw_txdesc	*td;
3075 
3076 	sc = (struct rtw_softc *)ifp->if_softc;
3077 	ic = &sc->sc_ic;
3078 
3079 	DPRINTF(sc, RTW_DEBUG_XMIT,
3080 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
3081 
3082 	if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
3083 		goto out;
3084 
3085 	/* XXX do real rate control */
3086 	proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3087 
3088 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0)
3089 		proto_ctl0 |= RTW_TXCTL0_SPLCP;
3090 
3091 	for (;;) {
3092 		if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3093 			continue;
3094 		if (m0 == NULL)
3095 			break;
3096 		ts = SIMPLEQ_FIRST(&tsb->tsb_freeq);
3097 
3098 		dmamap = ts->ts_dmamap;
3099 
3100 		m0 = rtw_dmamap_load_txbuf(sc->sc_dmat, dmamap, m0,
3101 		    tdb->tdb_nfree, &ifp->if_flags, sc->sc_dev.dv_xname);
3102 
3103 		if (m0 == NULL || dmamap->dm_nsegs == 0) {
3104 			DPRINTF(sc, RTW_DEBUG_XMIT,
3105 			    ("%s: fail dmamap load\n", __func__));
3106 			goto post_dequeue_err;
3107 		}
3108 
3109 		wh = mtod(m0, struct ieee80211_frame *);
3110 
3111 		/* XXX do real rate control */
3112 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3113 		    IEEE80211_FC0_TYPE_MGT)
3114 			rate = 2;
3115 		else
3116 			rate = MAX(2, ieee80211_get_rate(ic));
3117 
3118 #ifdef RTW_DEBUG
3119 		if ((sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3120 		    (IFF_DEBUG|IFF_LINK2)) {
3121 			ieee80211_dump_pkt(mtod(m0, uint8_t *),
3122 			    (dmamap->dm_nsegs == 1) ? m0->m_pkthdr.len
3123 			    : sizeof(wh), rate, 0);
3124 		}
3125 #endif /* RTW_DEBUG */
3126 		ctl0 = proto_ctl0 |
3127 		    LSHIFT(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3128 
3129 		switch (rate) {
3130 		default:
3131 		case 2:
3132 			ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3133 			break;
3134 		case 4:
3135 			ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3136 			break;
3137 		case 11:
3138 			ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3139 			break;
3140 		case 22:
3141 			ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3142 			break;
3143 		}
3144 
3145 		/* XXX >= ? Compare after fragmentation? */
3146 		if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3147 			ctl0 |= RTW_TXCTL0_RTSEN;
3148 
3149 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3150 		    IEEE80211_FC0_TYPE_MGT) {
3151 			ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3152 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3153 			    IEEE80211_FC0_SUBTYPE_BEACON)
3154 				ctl0 |= RTW_TXCTL0_BEACON;
3155 		}
3156 
3157 		if (rtw_compute_duration(wh, m0->m_pkthdr.len,
3158 		    ic->ic_flags & ~IEEE80211_F_WEPON, ic->ic_fragthreshold,
3159 		    rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3160 		    (sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3161 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3162 			DPRINTF(sc, RTW_DEBUG_XMIT,
3163 			    ("%s: fail compute duration\n", __func__));
3164 			goto post_load_err;
3165 		}
3166 
3167 		d0 = &ts->ts_d0;
3168 
3169 		*(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3170 
3171 		ctl1 = LSHIFT(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3172 		    LSHIFT(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3173 
3174 		if (d0->d_residue)
3175 			ctl1 |= RTW_TXCTL1_LENGEXT;
3176 
3177 		/* TBD fragmentation */
3178 
3179 		ts->ts_first = tdb->tdb_next;
3180 
3181 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3182 		    BUS_DMASYNC_PREWRITE);
3183 
3184 		KASSERT(ts->ts_first < tdb->tdb_ndesc);
3185 
3186 #if NBPFILTER > 0
3187 		if (ic->ic_rawbpf != NULL)
3188 			bpf_mtap((caddr_t)ic->ic_rawbpf, m0,
3189 			    BPF_DIRECTION_OUT);
3190 
3191 		if (sc->sc_radiobpf != NULL) {
3192 			struct mbuf mb;
3193 			struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3194 
3195 			rt->rt_flags = 0;
3196 			rt->rt_rate = rate;
3197 			rt->rt_chan_freq =
3198 			    htole16(ic->ic_bss->ni_chan->ic_freq);
3199 			rt->rt_chan_flags =
3200 			    htole16(ic->ic_bss->ni_chan->ic_flags);
3201 
3202 			mb.m_data = (caddr_t)rt;
3203 			mb.m_len = sizeof(sc->sc_txtapu);
3204 			mb.m_next = m0;
3205 			mb.m_nextpkt = NULL;
3206 			mb.m_type = 0;
3207 			mb.m_flags = 0;
3208 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_OUT);
3209 
3210 		}
3211 #endif /* NBPFILTER > 0 */
3212 
3213 		for (i = 0, lastdesc = desc = ts->ts_first;
3214 		     i < dmamap->dm_nsegs;
3215 		     i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3216 			if (dmamap->dm_segs[i].ds_len > RTW_TXLEN_LENGTH_MASK) {
3217 				DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3218 				    ("%s: seg too long\n", __func__));
3219 				goto post_load_err;
3220 			}
3221 			td = &tdb->tdb_desc[desc];
3222 			td->td_ctl0 = htole32(ctl0);
3223 			if (i != 0)
3224 				td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3225 			td->td_ctl1 = htole32(ctl1);
3226 			td->td_buf = htole32(dmamap->dm_segs[i].ds_addr);
3227 			td->td_len = htole32(dmamap->dm_segs[i].ds_len);
3228 			lastdesc = desc;
3229 #ifdef RTW_DEBUG
3230 			rtw_print_txdesc(sc, "load", ts, tdb, desc);
3231 #endif /* RTW_DEBUG */
3232 		}
3233 
3234 		KASSERT(desc < tdb->tdb_ndesc);
3235 
3236 		ts->ts_ni = ni;
3237 		ts->ts_mbuf = m0;
3238 		ts->ts_last = lastdesc;
3239 		tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3240 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3241 		    htole32(RTW_TXCTL0_FS);
3242 
3243 #ifdef RTW_DEBUG
3244 		rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3245 		rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3246 #endif /* RTW_DEBUG */
3247 
3248 		tdb->tdb_nfree -= dmamap->dm_nsegs;
3249 		tdb->tdb_next = desc;
3250 
3251 		rtw_txdescs_sync(tdb, ts->ts_first, dmamap->dm_nsegs,
3252 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3253 
3254 		tdb->tdb_desc[ts->ts_first].td_ctl0 |=
3255 		    htole32(RTW_TXCTL0_OWN);
3256 
3257 #ifdef RTW_DEBUG
3258 		rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3259 #endif /* RTW_DEBUG */
3260 
3261 		rtw_txdescs_sync(tdb, ts->ts_first, 1,
3262 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3263 
3264 		SIMPLEQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3265 		SIMPLEQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3266 
3267 		if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3268 			sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3269 		tsb->tsb_tx_timer = 5;
3270 		ifp->if_timer = 1;
3271 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3272 		tppoll &= ~RTW_TPPOLL_SALL;
3273 		tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
3274 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3275 		RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
3276 	}
3277 out:
3278 	DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: leave\n", __func__));
3279 	return;
3280 post_load_err:
3281 	bus_dmamap_unload(sc->sc_dmat, dmamap);
3282 	m_freem(m0);
3283 post_dequeue_err:
3284 	ieee80211_release_node(&sc->sc_ic, ni);
3285 	return;
3286 }
3287 
3288 void
3289 rtw_idle(struct rtw_regs *regs)
3290 {
3291 	int active;
3292 
3293 	/* request stop DMA; wait for packets to stop transmitting. */
3294 
3295 	RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3296 	RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3297 
3298 	for (active = 0; active < 300 &&
3299 	     (RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0; active++)
3300 		DELAY(10);
3301 	RTW_DPRINTF(RTW_DEBUG_BUGS,
3302 	    ("%s: transmit DMA idle in %dus\n", __func__, active * 10));
3303 }
3304 
3305 void
3306 rtw_watchdog(struct ifnet *ifp)
3307 {
3308 	int pri, tx_timeouts = 0;
3309 	struct rtw_softc *sc;
3310 	struct rtw_txsoft_blk *tsb;
3311 
3312 	sc = ifp->if_softc;
3313 
3314 	ifp->if_timer = 0;
3315 
3316 	if ((sc->sc_flags & RTW_F_ENABLED) == 0)
3317 		return;
3318 
3319 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3320 		tsb = &sc->sc_txsoft_blk[pri];
3321 
3322 		if (tsb->tsb_tx_timer == 0)
3323 			continue;
3324 		else if (--tsb->tsb_tx_timer == 0) {
3325 			if (SIMPLEQ_EMPTY(&tsb->tsb_dirtyq))
3326 				continue;
3327 			RTW_DPRINTF(RTW_DEBUG_BUGS,
3328 			    ("%s: transmit timeout, priority %d\n",
3329 			    ifp->if_xname, pri));
3330 			ifp->if_oerrors++;
3331 			tx_timeouts++;
3332 		} else
3333 			ifp->if_timer = 1;
3334 	}
3335 
3336 	if (tx_timeouts > 0) {
3337 		/* Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3338 		 * reset s/w tx-ring pointers, and start transmission.
3339 		 *
3340 		 * TBD Stop/restart just the broken rings?
3341 		 */
3342 		rtw_idle(&sc->sc_regs);
3343 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 0);
3344 		rtw_txdescs_reset(sc);
3345 		rtw_io_enable(&sc->sc_regs, RTW_CR_TE, 1);
3346 		rtw_txring_fixup(sc);
3347 		rtw_start(ifp);
3348 	}
3349 	ieee80211_watchdog(ifp);
3350 }
3351 
3352 void
3353 rtw_next_scan(void *arg)
3354 {
3355 	struct rtw_softc *sc = arg;
3356 	struct ieee80211com *ic = &sc->sc_ic;
3357 	struct ifnet *ifp = &ic->ic_if;
3358 	int s;
3359 
3360 	/* don't call rtw_start w/o network interrupts blocked */
3361 	s = splnet();
3362 	if (ic->ic_state == IEEE80211_S_SCAN)
3363 		ieee80211_next_scan(ifp);
3364 	splx(s);
3365 }
3366 
3367 void
3368 rtw_join_bss(struct rtw_softc *sc, u_int8_t *bssid, u_int16_t intval0)
3369 {
3370 	uint16_t bcnitv, bintritv, intval;
3371 	int i;
3372 	struct rtw_regs *regs = &sc->sc_regs;
3373 
3374 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3375 		RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3376 
3377 	RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3378 
3379 	rtw_set_access(regs, RTW_ACCESS_CONFIG);
3380 
3381 	intval = MIN(intval0, PRESHIFT(RTW_BCNITV_BCNITV_MASK));
3382 
3383 	bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3384 	bcnitv |= LSHIFT(intval, RTW_BCNITV_BCNITV_MASK);
3385 	RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3386 	/* interrupt host 1ms before the TBTT */
3387 	bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3388 	bintritv |= LSHIFT(1000, RTW_BINTRITV_BINTRITV);
3389 	RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3390 	/* magic from Linux */
3391 	RTW_WRITE16(regs, RTW_ATIMWND, LSHIFT(1, RTW_ATIMWND_ATIMWND));
3392 	RTW_WRITE16(regs, RTW_ATIMTRITV, LSHIFT(2, RTW_ATIMTRITV_ATIMTRITV));
3393 	rtw_set_access(regs, RTW_ACCESS_NONE);
3394 
3395 	/* TBD WEP */
3396 	RTW_WRITE8(regs, RTW8180_SCR, 0);
3397 
3398 	rtw_io_enable(regs, RTW_CR_RE | RTW_CR_TE, 1);
3399 }
3400 
3401 /* Synchronize the hardware state with the software state. */
3402 int
3403 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3404 {
3405 	struct ifnet *ifp = &ic->ic_if;
3406 	struct rtw_softc *sc = ifp->if_softc;
3407 	enum ieee80211_state ostate;
3408 	int error;
3409 
3410 	ostate = ic->ic_state;
3411 
3412 	rtw_led_newstate(sc, nstate);
3413 
3414 	if (nstate == IEEE80211_S_INIT) {
3415 		timeout_del(&sc->sc_scan_to);
3416 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3417 		return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3418 	}
3419 
3420 	if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3421 		rtw_pwrstate(sc, RTW_ON);
3422 
3423 	if ((error = rtw_tune(sc)) != 0)
3424 		return error;
3425 
3426 	switch (nstate) {
3427 	case IEEE80211_S_INIT:
3428 		panic("%s: unexpected state IEEE80211_S_INIT", __func__);
3429 		break;
3430 	case IEEE80211_S_SCAN:
3431 		if (ostate != IEEE80211_S_SCAN) {
3432 			bzero(ic->ic_bss->ni_bssid, IEEE80211_ADDR_LEN);
3433 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3434 		}
3435 
3436 		timeout_add_msec(&sc->sc_scan_to, rtw_dwelltime);
3437 
3438 		break;
3439 	case IEEE80211_S_RUN:
3440 		switch (ic->ic_opmode) {
3441 #ifndef IEEE80211_STA_ONLY
3442 		case IEEE80211_M_HOSTAP:
3443 		case IEEE80211_M_IBSS:
3444 			rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3445 			/*FALLTHROUGH*/
3446 		case IEEE80211_M_AHDEMO:
3447 #endif
3448 		case IEEE80211_M_STA:
3449 			rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3450 			    ic->ic_bss->ni_intval);
3451 			break;
3452 		default:
3453 			break;
3454 		}
3455 		rtw_set_nettype(sc, ic->ic_opmode);
3456 		break;
3457 	case IEEE80211_S_ASSOC:
3458 	case IEEE80211_S_AUTH:
3459 		break;
3460 	}
3461 
3462 	if (nstate != IEEE80211_S_SCAN)
3463 		timeout_del(&sc->sc_scan_to);
3464 
3465 	return (*sc->sc_mtbl.mt_newstate)(ic, nstate, arg);
3466 }
3467 
3468 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3469 uint64_t
3470 rtw_tsf_extend(struct rtw_regs *regs, u_int32_t rstamp)
3471 {
3472 	u_int32_t tsftl, tsfth;
3473 
3474 	tsfth = RTW_READ(regs, RTW_TSFTRH);
3475 	tsftl = RTW_READ(regs, RTW_TSFTRL);
3476 	if (tsftl < rstamp)	/* Compensate for rollover. */
3477 		tsfth--;
3478 	return ((u_int64_t)tsfth << 32) | rstamp;
3479 }
3480 
3481 #ifndef IEEE80211_STA_ONLY
3482 void
3483 rtw_ibss_merge(struct rtw_softc *sc, struct ieee80211_node *ni,
3484     u_int32_t rstamp)
3485 {
3486 	u_int8_t tppoll;
3487 	struct ieee80211com *ic = &sc->sc_ic;
3488 
3489 	if (ieee80211_ibss_merge(ic, ni,
3490 	    rtw_tsf_extend(&sc->sc_regs, rstamp)) == ENETRESET) {
3491 		/* Stop beacon queue.  Kick state machine to synchronize
3492 		 * with the new IBSS.
3493 		 */
3494 		tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3495 		tppoll |= RTW_TPPOLL_SBQ;
3496 		RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3497 		(void)ieee80211_new_state(&sc->sc_ic, IEEE80211_S_RUN, -1);
3498 	}
3499 	return;
3500 }
3501 
3502 void
3503 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3504     struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, int subtype)
3505 {
3506 	struct rtw_softc *sc = (struct rtw_softc*)ic->ic_softc;
3507 
3508 	(*sc->sc_mtbl.mt_recv_mgmt)(ic, m, ni, rxi, subtype);
3509 
3510 	switch (subtype) {
3511 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3512 	case IEEE80211_FC0_SUBTYPE_BEACON:
3513 		if (ic->ic_opmode != IEEE80211_M_IBSS ||
3514 		    ic->ic_state != IEEE80211_S_RUN)
3515 			return;
3516 		rtw_ibss_merge(sc, ni, rxi->rxi_tstamp);
3517 		break;
3518 	default:
3519 		break;
3520 	}
3521 	return;
3522 }
3523 #endif	/* IEEE80211_STA_ONLY */
3524 
3525 struct ieee80211_node *
3526 rtw_node_alloc(struct ieee80211com *ic)
3527 {
3528 	struct rtw_softc *sc = (struct rtw_softc *)ic->ic_if.if_softc;
3529 	struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(ic);
3530 
3531 	DPRINTF(sc, RTW_DEBUG_NODE,
3532 	    ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
3533 	return ni;
3534 }
3535 
3536 void
3537 rtw_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
3538 {
3539 	struct rtw_softc *sc = (struct rtw_softc *)ic->ic_if.if_softc;
3540 
3541 	DPRINTF(sc, RTW_DEBUG_NODE,
3542 	    ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
3543 	    ether_sprintf(ni->ni_bssid)));
3544 	(*sc->sc_mtbl.mt_node_free)(ic, ni);
3545 }
3546 
3547 int
3548 rtw_media_change(struct ifnet *ifp)
3549 {
3550 	int error;
3551 
3552 	error = ieee80211_media_change(ifp);
3553 	if (error == ENETRESET) {
3554 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3555 		    (IFF_RUNNING|IFF_UP))
3556 			rtw_init(ifp);		/* XXX lose error */
3557 		error = 0;
3558 	}
3559 	return error;
3560 }
3561 
3562 void
3563 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3564 {
3565 	struct rtw_softc *sc = ifp->if_softc;
3566 
3567 	if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
3568 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3569 		imr->ifm_status = 0;
3570 		return;
3571 	}
3572 	ieee80211_media_status(ifp, imr);
3573 }
3574 
3575 int
3576 rtw_activate(struct device *self, int act)
3577 {
3578 	struct rtw_softc *sc = (struct rtw_softc *)self;
3579 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3580 
3581 	switch (act) {
3582 	case DVACT_SUSPEND:
3583 		if (ifp->if_flags & IFF_RUNNING) {
3584 			rtw_stop(ifp, 1);
3585 			if (sc->sc_power != NULL)
3586 				(*sc->sc_power)(sc, act);
3587 		}
3588 		break;
3589 	case DVACT_RESUME:
3590 		if (ifp->if_flags & IFF_UP) {
3591 			if (sc->sc_power != NULL)
3592 				(*sc->sc_power)(sc, act);
3593 			rtw_init(ifp);
3594 		}
3595 		break;
3596 	}
3597 	return 0;
3598 }
3599 
3600 int
3601 rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
3602 {
3603 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
3604 	SIMPLEQ_INIT(&tsb->tsb_freeq);
3605 	tsb->tsb_ndesc = qlen;
3606 	tsb->tsb_desc = mallocarray(qlen, sizeof(*tsb->tsb_desc), M_DEVBUF,
3607 	    M_NOWAIT);
3608 	if (tsb->tsb_desc == NULL)
3609 		return ENOMEM;
3610 	return 0;
3611 }
3612 
3613 void
3614 rtw_txsoft_blk_cleanup_all(struct rtw_softc *sc)
3615 {
3616 	int pri;
3617 	struct rtw_txsoft_blk *tsb;
3618 
3619 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3620 		tsb = &sc->sc_txsoft_blk[pri];
3621 		free(tsb->tsb_desc, M_DEVBUF, 0);
3622 		tsb->tsb_desc = NULL;
3623 	}
3624 }
3625 
3626 int
3627 rtw_txsoft_blk_setup_all(struct rtw_softc *sc)
3628 {
3629 	int pri, rc = 0;
3630 	int qlen[RTW_NTXPRI] =
3631 	     {RTW_TXQLENLO, RTW_TXQLENMD, RTW_TXQLENHI, RTW_TXQLENBCN};
3632 	struct rtw_txsoft_blk *tsbs;
3633 
3634 	tsbs = sc->sc_txsoft_blk;
3635 
3636 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3637 		rc = rtw_txsoft_blk_setup(&tsbs[pri], qlen[pri]);
3638 		if (rc != 0)
3639 			break;
3640 	}
3641 	tsbs[RTW_TXPRILO].tsb_poll = RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ;
3642 	tsbs[RTW_TXPRIMD].tsb_poll = RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ;
3643 	tsbs[RTW_TXPRIHI].tsb_poll = RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ;
3644 	tsbs[RTW_TXPRIBCN].tsb_poll = RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ;
3645 	return rc;
3646 }
3647 
3648 void
3649 rtw_txdesc_blk_setup(struct rtw_txdesc_blk *tdb, struct rtw_txdesc *desc,
3650     u_int ndesc, bus_addr_t ofs, bus_addr_t physbase)
3651 {
3652 	tdb->tdb_ndesc = ndesc;
3653 	tdb->tdb_desc = desc;
3654 	tdb->tdb_physbase = physbase;
3655 	tdb->tdb_ofs = ofs;
3656 
3657 	bzero(tdb->tdb_desc, sizeof(tdb->tdb_desc[0]) * tdb->tdb_ndesc);
3658 
3659 	rtw_txdesc_blk_init(tdb);
3660 	tdb->tdb_next = 0;
3661 }
3662 
3663 void
3664 rtw_txdesc_blk_setup_all(struct rtw_softc *sc)
3665 {
3666 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRILO],
3667 	    &sc->sc_descs->hd_txlo[0], RTW_NTXDESCLO,
3668 	    RTW_RING_OFFSET(hd_txlo), RTW_RING_BASE(sc, hd_txlo));
3669 
3670 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIMD],
3671 	    &sc->sc_descs->hd_txmd[0], RTW_NTXDESCMD,
3672 	    RTW_RING_OFFSET(hd_txmd), RTW_RING_BASE(sc, hd_txmd));
3673 
3674 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIHI],
3675 	    &sc->sc_descs->hd_txhi[0], RTW_NTXDESCHI,
3676 	    RTW_RING_OFFSET(hd_txhi), RTW_RING_BASE(sc, hd_txhi));
3677 
3678 	rtw_txdesc_blk_setup(&sc->sc_txdesc_blk[RTW_TXPRIBCN],
3679 	    &sc->sc_descs->hd_bcn[0], RTW_NTXDESCBCN,
3680 	    RTW_RING_OFFSET(hd_bcn), RTW_RING_BASE(sc, hd_bcn));
3681 }
3682 
3683 int
3684 rtw_rf_attach(struct rtw_softc *sc, int rfchipid)
3685 {
3686 	struct rtw_bbpset *bb = &sc->sc_bbpset;
3687 	int notsup = 0;
3688 	const char *rfname, *paname = NULL;
3689 	char scratch[sizeof("unknown 0xXX")];
3690 
3691 	switch (rfchipid) {
3692 	case RTW_RFCHIPID_RTL8225:
3693 		rfname = "RTL8225";
3694 		sc->sc_pwrstate_cb = rtw_rtl_pwrstate;
3695 		sc->sc_rf_init = rtw_rtl8255_init;
3696 		sc->sc_rf_pwrstate = rtw_rtl8225_pwrstate;
3697 		sc->sc_rf_tune = rtw_rtl8225_tune;
3698 		sc->sc_rf_txpower = rtw_rtl8225_txpower;
3699 		break;
3700 	case RTW_RFCHIPID_RTL8255:
3701 		rfname = "RTL8255";
3702 		sc->sc_pwrstate_cb = rtw_rtl_pwrstate;
3703 		sc->sc_rf_init = rtw_rtl8255_init;
3704 		sc->sc_rf_pwrstate = rtw_rtl8255_pwrstate;
3705 		sc->sc_rf_tune = rtw_rtl8255_tune;
3706 		sc->sc_rf_txpower = rtw_rtl8255_txpower;
3707 		break;
3708 	case RTW_RFCHIPID_MAXIM2820:
3709 		rfname = "MAX2820";	/* guess */
3710 		paname = "MAX2422";	/* guess */
3711 		/* XXX magic */
3712 		bb->bb_antatten = RTW_BBP_ANTATTEN_MAXIM_MAGIC;
3713 		bb->bb_chestlim =	0x00;
3714 		bb->bb_chsqlim =	0x9f;
3715 		bb->bb_ifagcdet =	0x64;
3716 		bb->bb_ifagcini =	0x90;
3717 		bb->bb_ifagclimit =	0x1a;
3718 		bb->bb_lnadet =		0xf8;
3719 		bb->bb_sys1 =		0x88;
3720 		bb->bb_sys2 =		0x47;
3721 		bb->bb_sys3 =		0x9b;
3722 		bb->bb_trl =		0x88;
3723 		bb->bb_txagc =		0x08;
3724 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3725 		sc->sc_rf_init = rtw_max2820_init;
3726 		sc->sc_rf_pwrstate = rtw_max2820_pwrstate;
3727 		sc->sc_rf_tune = rtw_max2820_tune;
3728 		sc->sc_rf_txpower = rtw_max2820_txpower;
3729 		break;
3730 	case RTW_RFCHIPID_PHILIPS:
3731 		rfname = "SA2400A";
3732 		paname = "SA2411";
3733 		/* XXX magic */
3734 		bb->bb_antatten = RTW_BBP_ANTATTEN_PHILIPS_MAGIC;
3735 		bb->bb_chestlim =	0x00;
3736 		bb->bb_chsqlim =	0xa0;
3737 		bb->bb_ifagcdet =	0x64;
3738 		bb->bb_ifagcini =	0x90;
3739 		bb->bb_ifagclimit =	0x1a;
3740 		bb->bb_lnadet =		0xe0;
3741 		bb->bb_sys1 =		0x98;
3742 		bb->bb_sys2 =		0x47;
3743 		bb->bb_sys3 =		0x90;
3744 		bb->bb_trl =		0x88;
3745 		bb->bb_txagc =		0x38;
3746 		sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3747 		sc->sc_rf_init = rtw_sa2400_init;
3748 		sc->sc_rf_pwrstate = rtw_sa2400_pwrstate;
3749 		sc->sc_rf_tune = rtw_sa2400_tune;
3750 		sc->sc_rf_txpower = rtw_sa2400_txpower;
3751 		break;
3752 	case RTW_RFCHIPID_RFMD2948:
3753 		/* this is the same front-end as an atw(4)! */
3754 		rfname = "RFMD RF2948B, "	/* mentioned in Realtek docs */
3755 			 "LNA: RFMD RF2494, "	/* mentioned in Realtek docs */
3756 			 "SYN: Silicon Labs Si4126";	 /* inferred from
3757 							  * reference driver
3758 							  */
3759 		paname = "RF2189";		/* mentioned in Realtek docs */
3760 		/* XXX RFMD has no RF constructor */
3761 		sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3762 		notsup =  1;
3763 		break;
3764 	case RTW_RFCHIPID_GCT:		/* this combo seen in the wild */
3765 		rfname = "GRF5101";
3766 		paname = "WS9901";
3767 		/* XXX magic */
3768 		bb->bb_antatten = RTW_BBP_ANTATTEN_GCT_MAGIC;
3769 		bb->bb_chestlim =	0x00;
3770 		bb->bb_chsqlim =	0xa0;
3771 		bb->bb_ifagcdet =	0x64;
3772 		bb->bb_ifagcini =	0x90;
3773 		bb->bb_ifagclimit =	0x1e;
3774 		bb->bb_lnadet =		0xc0;
3775 		bb->bb_sys1 =		0xa8;
3776 		bb->bb_sys2 =		0x47;
3777 		bb->bb_sys3 =		0x9b;
3778 		bb->bb_trl =		0x88;
3779 		bb->bb_txagc =		0x08;
3780 		sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3781 		sc->sc_rf_init = rtw_grf5101_init;
3782 		sc->sc_rf_pwrstate = rtw_grf5101_pwrstate;
3783 		sc->sc_rf_tune = rtw_grf5101_tune;
3784 		sc->sc_rf_txpower = rtw_grf5101_txpower;
3785 		break;
3786 	case RTW_RFCHIPID_INTERSIL:
3787 		rfname = "HFA3873";	/* guess */
3788 		paname = "Intersil <unknown>";
3789 		notsup = 1;
3790 		break;
3791 	default:
3792 		snprintf(scratch, sizeof(scratch), "unknown 0x%02x", rfchipid);
3793 		rfname = scratch;
3794 		notsup = 1;
3795 	}
3796 
3797 	printf("radio %s, ", rfname);
3798 	if (paname != NULL)
3799 		printf("amp %s, ", paname);
3800 
3801 	return (notsup);
3802 }
3803 
3804 /* Revision C and later use a different PHY delay setting than
3805  * revisions A and B.
3806  */
3807 u_int8_t
3808 rtw_check_phydelay(struct rtw_regs *regs, u_int32_t rcr0)
3809 {
3810 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
3811 #define REVC (REVAB | RTW8180_RCR_RXFTH_WHOLE)
3812 
3813 	u_int8_t phydelay = LSHIFT(0x6, RTW_PHYDELAY_PHYDELAY);
3814 
3815 	RTW_WRITE(regs, RTW_RCR, REVAB);
3816 	RTW_WBW(regs, RTW_RCR, RTW_RCR);
3817 	RTW_WRITE(regs, RTW_RCR, REVC);
3818 
3819 	RTW_WBR(regs, RTW_RCR, RTW_RCR);
3820 	if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
3821 		phydelay |= RTW_PHYDELAY_REVC_MAGIC;
3822 
3823 	RTW_WRITE(regs, RTW_RCR, rcr0);	/* restore RCR */
3824 	RTW_SYNC(regs, RTW_RCR, RTW_RCR);
3825 
3826 	return phydelay;
3827 #undef REVC
3828 }
3829 
3830 void
3831 rtw_attach(struct rtw_softc *sc)
3832 {
3833 	struct ieee80211com *ic = &sc->sc_ic;
3834 	struct rtw_txsoft_blk *tsb;
3835 	struct rtw_mtbl *mtbl;
3836 	struct rtw_srom *sr;
3837 	const char *vername;
3838 	struct ifnet *ifp;
3839 	char scratch[sizeof("unknown 0xXXXXXXXX")];
3840 	int pri, rc, i;
3841 
3842 
3843 	/* Use default DMA memory access */
3844 	if (sc->sc_regs.r_read8 == NULL) {
3845 		sc->sc_regs.r_read8 = rtw_read8;
3846 		sc->sc_regs.r_read16 = rtw_read16;
3847 		sc->sc_regs.r_read32 = rtw_read32;
3848 		sc->sc_regs.r_write8 = rtw_write8;
3849 		sc->sc_regs.r_write16 = rtw_write16;
3850 		sc->sc_regs.r_write32 = rtw_write32;
3851 		sc->sc_regs.r_barrier = rtw_barrier;
3852 	}
3853 
3854 	sc->sc_hwverid = RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK;
3855 	switch (sc->sc_hwverid) {
3856 	case RTW_TCR_HWVERID_RTL8185:
3857 		vername = "RTL8185";
3858 		sc->sc_flags |= RTW_F_RTL8185;
3859 		break;
3860 	case RTW_TCR_HWVERID_RTL8180F:
3861 		vername = "RTL8180F";
3862 		break;
3863 	case RTW_TCR_HWVERID_RTL8180D:
3864 		vername = "RTL8180D";
3865 		break;
3866 	default:
3867 		snprintf(scratch, sizeof(scratch), "unknown 0x%08x",
3868 		    sc->sc_hwverid);
3869 		vername = scratch;
3870 		break;
3871 	}
3872 
3873 	printf("%s: ver %s, ", sc->sc_dev.dv_xname, vername);
3874 
3875 	rc = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct rtw_descs),
3876 	    RTW_DESC_ALIGNMENT, 0, &sc->sc_desc_segs, 1, &sc->sc_desc_nsegs,
3877 	    0);
3878 
3879 	if (rc != 0) {
3880 		printf("\n%s: could not allocate hw descriptors, error %d\n",
3881 		     sc->sc_dev.dv_xname, rc);
3882 		goto fail0;
3883 	}
3884 
3885 	rc = bus_dmamem_map(sc->sc_dmat, &sc->sc_desc_segs,
3886 	    sc->sc_desc_nsegs, sizeof(struct rtw_descs),
3887 	    (caddr_t*)&sc->sc_descs, BUS_DMA_COHERENT);
3888 
3889 	if (rc != 0) {
3890 		printf("\n%s: can't map hw descriptors, error %d\n",
3891 		    sc->sc_dev.dv_xname, rc);
3892 		goto fail1;
3893 	}
3894 
3895 	rc = bus_dmamap_create(sc->sc_dmat, sizeof(struct rtw_descs), 1,
3896 	    sizeof(struct rtw_descs), 0, 0, &sc->sc_desc_dmamap);
3897 
3898 	if (rc != 0) {
3899 		printf("\n%s: could not create DMA map for hw descriptors, "
3900 		    "error %d\n", sc->sc_dev.dv_xname, rc);
3901 		goto fail2;
3902 	}
3903 
3904 	sc->sc_rxdesc_blk.rdb_dmat = sc->sc_dmat;
3905 	sc->sc_rxdesc_blk.rdb_dmamap = sc->sc_desc_dmamap;
3906 
3907 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3908 		sc->sc_txdesc_blk[pri].tdb_dmat = sc->sc_dmat;
3909 		sc->sc_txdesc_blk[pri].tdb_dmamap = sc->sc_desc_dmamap;
3910 	}
3911 
3912 	rc = bus_dmamap_load(sc->sc_dmat, sc->sc_desc_dmamap, sc->sc_descs,
3913 	    sizeof(struct rtw_descs), NULL, 0);
3914 
3915 	if (rc != 0) {
3916 		printf("\n%s: could not load DMA map for hw descriptors, "
3917 		    "error %d\n", sc->sc_dev.dv_xname, rc);
3918 		goto fail3;
3919 	}
3920 
3921 	if (rtw_txsoft_blk_setup_all(sc) != 0)
3922 		goto fail4;
3923 
3924 	rtw_txdesc_blk_setup_all(sc);
3925 
3926 	sc->sc_rxdesc_blk.rdb_desc = &sc->sc_descs->hd_rx[0];
3927 
3928 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
3929 		tsb = &sc->sc_txsoft_blk[pri];
3930 
3931 		if ((rc = rtw_txdesc_dmamaps_create(sc->sc_dmat,
3932 		    &tsb->tsb_desc[0], tsb->tsb_ndesc)) != 0) {
3933 			printf("\n%s: could not load DMA map for "
3934 			    "hw tx descriptors, error %d\n",
3935 			    sc->sc_dev.dv_xname, rc);
3936 			goto fail5;
3937 		}
3938 	}
3939 
3940 	if ((rc = rtw_rxdesc_dmamaps_create(sc->sc_dmat, &sc->sc_rxsoft[0],
3941 	    RTW_RXQLEN)) != 0) {
3942 		printf("\n%s: could not load DMA map for hw rx descriptors, "
3943 		    "error %d\n", sc->sc_dev.dv_xname, rc);
3944 		goto fail6;
3945 	}
3946 
3947 	/* Reset the chip to a known state. */
3948 	if (rtw_reset(sc) != 0)
3949 		goto fail7;
3950 
3951 	sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
3952 
3953 	if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
3954 		sc->sc_flags |= RTW_F_9356SROM;
3955 
3956 	if (rtw_srom_read(&sc->sc_regs, sc->sc_flags, &sc->sc_srom,
3957 	    sc->sc_dev.dv_xname) != 0)
3958 		goto fail7;
3959 
3960 	if (rtw_srom_parse(sc) != 0) {
3961 		printf("\n%s: attach failed, malformed serial ROM\n",
3962 		    sc->sc_dev.dv_xname);
3963 		goto fail8;
3964 	}
3965 
3966 	RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: %s PHY\n", sc->sc_dev.dv_xname,
3967 	    ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital" : "analog"));
3968 
3969 	RTW_DPRINTF(RTW_DEBUG_ATTACH, ("%s: CS threshold %u\n",
3970 	    sc->sc_dev.dv_xname, sc->sc_csthr));
3971 
3972 	if ((rtw_rf_attach(sc, sc->sc_rfchipid)) != 0) {
3973 		printf("\n%s: attach failed, could not attach RF\n",
3974 		    sc->sc_dev.dv_xname);
3975 		goto fail8;
3976 	}
3977 
3978 	sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
3979 
3980 	RTW_DPRINTF(RTW_DEBUG_ATTACH,
3981 	    ("%s: PHY delay %d\n", sc->sc_dev.dv_xname, sc->sc_phydelay));
3982 
3983 	if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
3984 		rtw_identify_country(&sc->sc_regs, &sc->sc_locale);
3985 
3986 	for (i = 1; i <= 14; i++) {
3987 		sc->sc_ic.ic_channels[i].ic_flags = IEEE80211_CHAN_B;
3988 		sc->sc_ic.ic_channels[i].ic_freq =
3989 		    ieee80211_ieee2mhz(i, sc->sc_ic.ic_channels[i].ic_flags);
3990 	}
3991 
3992 	if (rtw_identify_sta(&sc->sc_regs, &sc->sc_ic.ic_myaddr,
3993 	    sc->sc_dev.dv_xname) != 0)
3994 		goto fail8;
3995 
3996 	ifp = &sc->sc_if;
3997 	(void)memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
3998 	ifp->if_softc = sc;
3999 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
4000 	ifp->if_ioctl = rtw_ioctl;
4001 	ifp->if_start = rtw_start;
4002 	ifp->if_watchdog = rtw_watchdog;
4003 
4004 
4005 	ic->ic_phytype = IEEE80211_T_DS;
4006 	ic->ic_opmode = IEEE80211_M_STA;
4007 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
4008 #ifndef IEEE80211_STA_ONLY
4009 	ic->ic_caps |= IEEE80211_C_HOSTAP | IEEE80211_C_IBSS;
4010 #endif
4011 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
4012 
4013 	rtw_led_attach(&sc->sc_led_state, (void *)sc);
4014 
4015 	/*
4016 	 * Call MI attach routines.
4017 	 */
4018 	if_attach(&sc->sc_if);
4019 	ieee80211_ifattach(&sc->sc_if);
4020 
4021 	mtbl = &sc->sc_mtbl;
4022 	mtbl->mt_newstate = ic->ic_newstate;
4023 	ic->ic_newstate = rtw_newstate;
4024 
4025 #ifndef IEEE80211_STA_ONLY
4026 	mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
4027 	ic->ic_recv_mgmt = rtw_recv_mgmt;
4028 #endif
4029 
4030 	mtbl->mt_node_free = ic->ic_node_free;
4031 	ic->ic_node_free = rtw_node_free;
4032 
4033 	mtbl->mt_node_alloc = ic->ic_node_alloc;
4034 	ic->ic_node_alloc = rtw_node_alloc;
4035 
4036 	/* possibly we should fill in our own sc_send_prresp, since
4037 	 * the RTL8180 is probably sending probe responses in ad hoc
4038 	 * mode.
4039 	 */
4040 
4041 	/* complete initialization */
4042 	ieee80211_media_init(&sc->sc_if, rtw_media_change, rtw_media_status);
4043 	timeout_set(&sc->sc_scan_to, rtw_next_scan, sc);
4044 
4045 #if NBPFILTER > 0
4046 	bzero(&sc->sc_rxtapu, sizeof(sc->sc_rxtapu));
4047 	sc->sc_rxtap.rr_ihdr.it_len = sizeof(sc->sc_rxtapu);
4048 	sc->sc_rxtap.rr_ihdr.it_present = RTW_RX_RADIOTAP_PRESENT;
4049 
4050 	bzero(&sc->sc_txtapu, sizeof(sc->sc_txtapu));
4051 	sc->sc_txtap.rt_ihdr.it_len = sizeof(sc->sc_txtapu);
4052 	sc->sc_txtap.rt_ihdr.it_present = RTW_TX_RADIOTAP_PRESENT;
4053 
4054 	bpfattach(&sc->sc_radiobpf, &sc->sc_ic.ic_if, DLT_IEEE802_11_RADIO,
4055 	    sizeof(struct ieee80211_frame) + 64);
4056 #endif
4057 	return;
4058 
4059 fail8:
4060 	sr = &sc->sc_srom;
4061 	sr->sr_size = 0;
4062 	if (sr->sr_content != NULL) {
4063 		free(sr->sr_content, M_DEVBUF, 0);
4064 		sr->sr_content = NULL;
4065 	}
4066 
4067 fail7:
4068 	rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],
4069 	    RTW_RXQLEN);
4070 
4071 fail6:
4072 	for (pri = 0; pri < RTW_NTXPRI; pri++) {
4073 		rtw_txdesc_dmamaps_destroy(sc->sc_dmat,
4074 		    sc->sc_txsoft_blk[pri].tsb_desc,
4075 		    sc->sc_txsoft_blk[pri].tsb_ndesc);
4076 	}
4077 
4078 fail5:
4079 	rtw_txsoft_blk_cleanup_all(sc);
4080 
4081 fail4:
4082 	bus_dmamap_unload(sc->sc_dmat, sc->sc_desc_dmamap);
4083 fail3:
4084 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_desc_dmamap);
4085 fail2:
4086 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_descs,
4087 	    sizeof(struct rtw_descs));
4088 fail1:
4089 	bus_dmamem_free(sc->sc_dmat, &sc->sc_desc_segs,
4090 	    sc->sc_desc_nsegs);
4091 fail0:
4092 	return;
4093 }
4094 
4095 int
4096 rtw_detach(struct rtw_softc *sc)
4097 {
4098 	sc->sc_flags |= RTW_F_INVALID;
4099 
4100 	timeout_del(&sc->sc_scan_to);
4101 
4102 	rtw_stop(&sc->sc_if, 1);
4103 
4104 	ieee80211_ifdetach(&sc->sc_if);
4105 	if_detach(&sc->sc_if);
4106 
4107 	return 0;
4108 }
4109 
4110 /*
4111  * PHY specific functions
4112  */
4113 
4114 int
4115 rtw_bbp_preinit(struct rtw_regs *regs, u_int antatten0, int dflantb,
4116     u_int freq)
4117 {
4118 	u_int antatten = antatten0;
4119 	if (dflantb)
4120 		antatten |= RTW_BBP_ANTATTEN_DFLANTB;
4121 	if (freq == 2484) /* channel 14 */
4122 		antatten |= RTW_BBP_ANTATTEN_CHAN14;
4123 	return rtw_bbp_write(regs, RTW_BBP_ANTATTEN, antatten);
4124 }
4125 
4126 int
4127 rtw_bbp_init(struct rtw_regs *regs, struct rtw_bbpset *bb, int antdiv,
4128     int dflantb, u_int8_t cs_threshold, u_int freq)
4129 {
4130 	int rc;
4131 	u_int32_t sys2, sys3;
4132 
4133 	sys2 = bb->bb_sys2;
4134 	if (antdiv)
4135 		sys2 |= RTW_BBP_SYS2_ANTDIV;
4136 	sys3 = bb->bb_sys3 |
4137 	    LSHIFT(cs_threshold, RTW_BBP_SYS3_CSTHRESH_MASK);
4138 
4139 #define	RTW_BBP_WRITE_OR_RETURN(reg, val) \
4140 	if ((rc = rtw_bbp_write(regs, reg, val)) != 0) \
4141 		return rc;
4142 
4143 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_SYS1,		bb->bb_sys1);
4144 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_TXAGC,		bb->bb_txagc);
4145 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_LNADET,		bb->bb_lnadet);
4146 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_IFAGCINI,	bb->bb_ifagcini);
4147 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_IFAGCLIMIT,	bb->bb_ifagclimit);
4148 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_IFAGCDET,	bb->bb_ifagcdet);
4149 
4150 	if ((rc = rtw_bbp_preinit(regs, bb->bb_antatten, dflantb, freq)) != 0)
4151 		return rc;
4152 
4153 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_TRL,		bb->bb_trl);
4154 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_SYS2,		sys2);
4155 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_SYS3,		sys3);
4156 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_CHESTLIM,	bb->bb_chestlim);
4157 	RTW_BBP_WRITE_OR_RETURN(RTW_BBP_CHSQLIM,	bb->bb_chsqlim);
4158 	return 0;
4159 }
4160 
4161 int
4162 rtw_sa2400_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4163 {
4164 	return rtw_rf_macwrite(sc, SA2400_TX, opaque_txpower);
4165 }
4166 
4167 /* make sure we're using the same settings as the reference driver */
4168 void
4169 rtw_verify_syna(u_int freq, u_int32_t val)
4170 {
4171 	u_int32_t expected_val = ~val;
4172 
4173 	switch (freq) {
4174 	case 2412:
4175 		expected_val = 0x0000096c; /* ch 1 */
4176 		break;
4177 	case 2417:
4178 		expected_val = 0x00080970; /* ch 2 */
4179 		break;
4180 	case 2422:
4181 		expected_val = 0x00100974; /* ch 3 */
4182 		break;
4183 	case 2427:
4184 		expected_val = 0x00180978; /* ch 4 */
4185 		break;
4186 	case 2432:
4187 		expected_val = 0x00000980; /* ch 5 */
4188 		break;
4189 	case 2437:
4190 		expected_val = 0x00080984; /* ch 6 */
4191 		break;
4192 	case 2442:
4193 		expected_val = 0x00100988; /* ch 7 */
4194 		break;
4195 	case 2447:
4196 		expected_val = 0x0018098c; /* ch 8 */
4197 		break;
4198 	case 2452:
4199 		expected_val = 0x00000994; /* ch 9 */
4200 		break;
4201 	case 2457:
4202 		expected_val = 0x00080998; /* ch 10 */
4203 		break;
4204 	case 2462:
4205 		expected_val = 0x0010099c; /* ch 11 */
4206 		break;
4207 	case 2467:
4208 		expected_val = 0x001809a0; /* ch 12 */
4209 		break;
4210 	case 2472:
4211 		expected_val = 0x000009a8; /* ch 13 */
4212 		break;
4213 	case 2484:
4214 		expected_val = 0x000009b4; /* ch 14 */
4215 		break;
4216 	}
4217 	KASSERT(val == expected_val);
4218 }
4219 
4220 /* freq is in MHz */
4221 int
4222 rtw_sa2400_tune(struct rtw_softc *sc, u_int freq)
4223 {
4224 	int rc;
4225 	u_int32_t syna, synb, sync;
4226 
4227 	/* XO = 44MHz, R = 11, hence N is in units of XO / R = 4MHz.
4228 	 *
4229 	 * The channel spacing (5MHz) is not divisible by 4MHz, so
4230 	 * we set the fractional part of N to compensate.
4231 	 */
4232 	int n = freq / 4, nf = (freq % 4) * 2;
4233 
4234 	syna = LSHIFT(nf, SA2400_SYNA_NF_MASK) | LSHIFT(n, SA2400_SYNA_N_MASK);
4235 	rtw_verify_syna(freq, syna);
4236 
4237 	/* Divide the 44MHz crystal down to 4MHz. Set the fractional
4238 	 * compensation charge pump value to agree with the fractional
4239 	 * modulus.
4240 	 */
4241 	synb = LSHIFT(11, SA2400_SYNB_R_MASK) | SA2400_SYNB_L_NORMAL |
4242 	    SA2400_SYNB_ON | SA2400_SYNB_ONE |
4243 	    LSHIFT(80, SA2400_SYNB_FC_MASK); /* agrees w/ SA2400_SYNA_FM = 0 */
4244 
4245 	sync = SA2400_SYNC_CP_NORMAL;
4246 
4247 	if ((rc = rtw_rf_macwrite(sc, SA2400_SYNA, syna)) != 0)
4248 		return rc;
4249 	if ((rc = rtw_rf_macwrite(sc, SA2400_SYNB, synb)) != 0)
4250 		return rc;
4251 	if ((rc = rtw_rf_macwrite(sc, SA2400_SYNC, sync)) != 0)
4252 		return rc;
4253 	return rtw_rf_macwrite(sc, SA2400_SYND, 0x0);
4254 }
4255 
4256 int
4257 rtw_sa2400_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4258 {
4259 	u_int32_t opmode;
4260 	opmode = SA2400_OPMODE_DEFAULTS;
4261 	switch (power) {
4262 	case RTW_ON:
4263 		opmode |= SA2400_OPMODE_MODE_TXRX;
4264 		break;
4265 	case RTW_SLEEP:
4266 		opmode |= SA2400_OPMODE_MODE_WAIT;
4267 		break;
4268 	case RTW_OFF:
4269 		opmode |= SA2400_OPMODE_MODE_SLEEP;
4270 		break;
4271 	}
4272 
4273 	if (sc->sc_flags & RTW_F_DIGPHY)
4274 		opmode |= SA2400_OPMODE_DIGIN;
4275 
4276 	return rtw_rf_macwrite(sc, SA2400_OPMODE, opmode);
4277 }
4278 
4279 int
4280 rtw_sa2400_vcocal_start(struct rtw_softc *sc, int start)
4281 {
4282 	u_int32_t opmode;
4283 
4284 	opmode = SA2400_OPMODE_DEFAULTS;
4285 	if (start)
4286 		opmode |= SA2400_OPMODE_MODE_VCOCALIB;
4287 	else
4288 		opmode |= SA2400_OPMODE_MODE_SLEEP;
4289 
4290 	if (sc->sc_flags & RTW_F_DIGPHY)
4291 		opmode |= SA2400_OPMODE_DIGIN;
4292 
4293 	return rtw_rf_macwrite(sc, SA2400_OPMODE, opmode);
4294 }
4295 
4296 int
4297 rtw_sa2400_vco_calibration(struct rtw_softc *sc)
4298 {
4299 	int rc;
4300 	/* calibrate VCO */
4301 	if ((rc = rtw_sa2400_vcocal_start(sc, 1)) != 0)
4302 		return rc;
4303 	DELAY(2200);	/* 2.2 milliseconds */
4304 	/* XXX superfluous: SA2400 automatically entered SLEEP mode. */
4305 	return rtw_sa2400_vcocal_start(sc, 0);
4306 }
4307 
4308 int
4309 rtw_sa2400_filter_calibration(struct rtw_softc *sc)
4310 {
4311 	u_int32_t opmode;
4312 
4313 	opmode = SA2400_OPMODE_DEFAULTS | SA2400_OPMODE_MODE_FCALIB;
4314 	if (sc->sc_flags & RTW_F_DIGPHY)
4315 		opmode |= SA2400_OPMODE_DIGIN;
4316 
4317 	return rtw_rf_macwrite(sc, SA2400_OPMODE, opmode);
4318 }
4319 
4320 int
4321 rtw_sa2400_dc_calibration(struct rtw_softc *sc)
4322 {
4323 	int rc;
4324 	u_int32_t dccal;
4325 
4326 	rtw_continuous_tx_enable(sc, 1);
4327 
4328 	dccal = SA2400_OPMODE_DEFAULTS | SA2400_OPMODE_MODE_TXRX;
4329 
4330 	rc = rtw_rf_macwrite(sc, SA2400_OPMODE, dccal);
4331 
4332 	if (rc != 0)
4333 		return rc;
4334 
4335 	DELAY(5);	/* DCALIB after being in Tx mode for 5
4336 			 * microseconds
4337 			 */
4338 
4339 	dccal &= ~SA2400_OPMODE_MODE_MASK;
4340 	dccal |= SA2400_OPMODE_MODE_DCALIB;
4341 
4342 	rc = rtw_rf_macwrite(sc, SA2400_OPMODE, dccal);
4343 	if (rc != 0)
4344 		return rc;
4345 
4346 	DELAY(20);	/* calibration takes at most 20 microseconds */
4347 
4348 	rtw_continuous_tx_enable(sc, 0);
4349 
4350 	return 0;
4351 }
4352 
4353 int
4354 rtw_sa2400_calibrate(struct rtw_softc *sc, u_int freq)
4355 {
4356 	int i, rc;
4357 
4358 	/* XXX reference driver calibrates VCO twice. Is it a bug? */
4359 	for (i = 0; i < 2; i++) {
4360 		if ((rc = rtw_sa2400_vco_calibration(sc)) != 0)
4361 			return rc;
4362 	}
4363 	/* VCO calibration erases synthesizer registers, so re-tune */
4364 	if ((rc = rtw_sa2400_tune(sc, freq)) != 0)
4365 		return rc;
4366 	if ((rc = rtw_sa2400_filter_calibration(sc)) != 0)
4367 		return rc;
4368 	/* analog PHY needs DC calibration */
4369 	if (!(sc->sc_flags & RTW_F_DIGPHY))
4370 		return rtw_sa2400_dc_calibration(sc);
4371 	return 0;
4372 }
4373 
4374 int
4375 rtw_sa2400_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4376     enum rtw_pwrstate power)
4377 {
4378 	int rc;
4379 	u_int32_t agc, manrx;
4380 
4381 	if ((rc = rtw_sa2400_txpower(sc, opaque_txpower)) != 0)
4382 		return rc;
4383 
4384 	/* skip configuration if it's time to sleep or to power-down. */
4385 	if (power == RTW_SLEEP || power == RTW_OFF)
4386 		return rtw_sa2400_pwrstate(sc, power);
4387 
4388 	/* go to sleep for configuration */
4389 	if ((rc = rtw_sa2400_pwrstate(sc, RTW_SLEEP)) != 0)
4390 		return rc;
4391 
4392 	if ((rc = rtw_sa2400_tune(sc, freq)) != 0)
4393 		return rc;
4394 
4395 	agc = LSHIFT(25, SA2400_AGC_MAXGAIN_MASK);
4396 	agc |= LSHIFT(7, SA2400_AGC_BBPDELAY_MASK);
4397 	agc |= LSHIFT(15, SA2400_AGC_LNADELAY_MASK);
4398 	agc |= LSHIFT(27, SA2400_AGC_RXONDELAY_MASK);
4399 
4400 	if ((rc = rtw_rf_macwrite(sc, SA2400_AGC, agc)) != 0)
4401 		return rc;
4402 
4403 	/* XXX we are not supposed to be in RXMGC mode when we do this? */
4404 	manrx = SA2400_MANRX_AHSN;
4405 	manrx |= SA2400_MANRX_TEN;
4406 	manrx |= LSHIFT(1023, SA2400_MANRX_RXGAIN_MASK);
4407 
4408 	if ((rc = rtw_rf_macwrite(sc, SA2400_MANRX, manrx)) != 0)
4409 		return rc;
4410 
4411 	if ((rc = rtw_sa2400_calibrate(sc, freq)) != 0)
4412 		return rc;
4413 
4414 	/* enter Tx/Rx mode */
4415 	return rtw_sa2400_pwrstate(sc, power);
4416 }
4417 
4418 /* freq is in MHz */
4419 int
4420 rtw_max2820_tune(struct rtw_softc *sc, u_int freq)
4421 {
4422 	if (freq < 2400 || freq > 2499)
4423 		return -1;
4424 
4425 	return rtw_rf_hostwrite(sc, MAX2820_CHANNEL,
4426 	    LSHIFT(freq - 2400, MAX2820_CHANNEL_CF_MASK));
4427 }
4428 
4429 int
4430 rtw_max2820_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4431     enum rtw_pwrstate power)
4432 {
4433 	int rc;
4434 
4435 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_TEST,
4436 	    MAX2820_TEST_DEFAULT)) != 0)
4437 		return rc;
4438 
4439 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_ENABLE,
4440 	    MAX2820_ENABLE_DEFAULT)) != 0)
4441 		return rc;
4442 
4443 	/* skip configuration if it's time to sleep or to power-down. */
4444 	if ((rc = rtw_max2820_pwrstate(sc, power)) != 0)
4445 		return rc;
4446 	else if (power == RTW_OFF || power == RTW_SLEEP)
4447 		return 0;
4448 
4449 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_SYNTH,
4450 	    MAX2820_SYNTH_R_44MHZ)) != 0)
4451 		return rc;
4452 
4453 	if ((rc = rtw_max2820_tune(sc, freq)) != 0)
4454 		return rc;
4455 
4456 	/* XXX The MAX2820 datasheet indicates that 1C and 2C should not
4457 	 * be changed from 7, however, the reference driver sets them
4458 	 * to 4 and 1, respectively.
4459 	 */
4460 	if ((rc = rtw_rf_hostwrite(sc, MAX2820_RECEIVE,
4461 	    MAX2820_RECEIVE_DL_DEFAULT |
4462 	    LSHIFT(4, MAX2820A_RECEIVE_1C_MASK) |
4463 	    LSHIFT(1, MAX2820A_RECEIVE_2C_MASK))) != 0)
4464 		return rc;
4465 
4466 	return rtw_rf_hostwrite(sc, MAX2820_TRANSMIT,
4467 	    MAX2820_TRANSMIT_PA_DEFAULT);
4468 }
4469 
4470 int
4471 rtw_max2820_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4472 {
4473 	/* TBD */
4474 	return 0;
4475 }
4476 
4477 int
4478 rtw_max2820_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4479 {
4480 	uint32_t enable;
4481 
4482 	switch (power) {
4483 	case RTW_OFF:
4484 	case RTW_SLEEP:
4485 	default:
4486 		enable = 0x0;
4487 		break;
4488 	case RTW_ON:
4489 		enable = MAX2820_ENABLE_DEFAULT;
4490 		break;
4491 	}
4492 	return rtw_rf_hostwrite(sc, MAX2820_ENABLE, enable);
4493 }
4494 
4495 int
4496 rtw_grf5101_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4497     enum rtw_pwrstate power)
4498 {
4499 	int rc;
4500 
4501 	/*
4502 	 * These values have been derived from the rtl8180-sa2400 Linux driver.
4503 	 * It is unknown what they all do, GCT refuse to release any documentation
4504 	 * so these are more than likely sub optimal settings
4505 	 */
4506 
4507 	rtw_rf_macwrite(sc, 0x01, 0x1a23);
4508 	rtw_rf_macwrite(sc, 0x02, 0x4971);
4509 	rtw_rf_macwrite(sc, 0x03, 0x41de);
4510 	rtw_rf_macwrite(sc, 0x04, 0x2d80);
4511 
4512 	rtw_rf_macwrite(sc, 0x05, 0x61ff);
4513 
4514 	rtw_rf_macwrite(sc, 0x06, 0x0);
4515 
4516 	rtw_rf_macwrite(sc, 0x08, 0x7533);
4517 	rtw_rf_macwrite(sc, 0x09, 0xc401);
4518 	rtw_rf_macwrite(sc, 0x0a, 0x0);
4519 	rtw_rf_macwrite(sc, 0x0c, 0x1c7);
4520 	rtw_rf_macwrite(sc, 0x0d, 0x29d3);
4521 	rtw_rf_macwrite(sc, 0x0e, 0x2e8);
4522 	rtw_rf_macwrite(sc, 0x10, 0x192);
4523 	rtw_rf_macwrite(sc, 0x11, 0x248);
4524 	rtw_rf_macwrite(sc, 0x12, 0x0);
4525 	rtw_rf_macwrite(sc, 0x13, 0x20c4);
4526 	rtw_rf_macwrite(sc, 0x14, 0xf4fc);
4527 	rtw_rf_macwrite(sc, 0x15, 0x0);
4528 	rtw_rf_macwrite(sc, 0x16, 0x1500);
4529 
4530 	if ((rc = rtw_grf5101_txpower(sc, opaque_txpower)) != 0)
4531 		return rc;
4532 
4533 	if ((rc = rtw_grf5101_tune(sc, freq)) != 0)
4534 		return rc;
4535 
4536 	return (0);
4537 }
4538 
4539 int
4540 rtw_grf5101_tune(struct rtw_softc *sc, u_int freq)
4541 {
4542 	struct ieee80211com *ic = &sc->sc_ic;
4543 	u_int channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
4544 
4545 	/* set channel */
4546 	rtw_rf_macwrite(sc, 0x07, 0);
4547 	rtw_rf_macwrite(sc, 0x0b, channel - 1);
4548 	rtw_rf_macwrite(sc, 0x07, 0x1000);
4549 
4550 	return (0);
4551 }
4552 
4553 int
4554 rtw_grf5101_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4555 {
4556 	rtw_rf_macwrite(sc, 0x15, 0);
4557 	rtw_rf_macwrite(sc, 0x06, opaque_txpower);
4558 	rtw_rf_macwrite(sc, 0x15, 0x10);
4559 	rtw_rf_macwrite(sc, 0x15, 0x00);
4560 
4561 	return (0);
4562 }
4563 
4564 int
4565 rtw_grf5101_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4566 {
4567 	switch (power) {
4568 	case RTW_OFF:
4569 		/* FALLTHROUGH */
4570 	case RTW_SLEEP:
4571 		rtw_rf_macwrite(sc, 0x07, 0x0000);
4572 		rtw_rf_macwrite(sc, 0x1f, 0x0045);
4573 		rtw_rf_macwrite(sc, 0x1f, 0x0005);
4574 		rtw_rf_macwrite(sc, 0x00, 0x08e4);
4575 		break;
4576 	case RTW_ON:
4577 		rtw_rf_macwrite(sc, 0x1f, 0x0001);
4578 		DELAY(10);
4579 		rtw_rf_macwrite(sc, 0x1f, 0x0001);
4580 		DELAY(10);
4581 		rtw_rf_macwrite(sc, 0x1f, 0x0041);
4582 		DELAY(10);
4583 		rtw_rf_macwrite(sc, 0x1f, 0x0061);
4584 		DELAY(10);
4585 		rtw_rf_macwrite(sc, 0x00, 0x0ae4);
4586 		DELAY(10);
4587 		rtw_rf_macwrite(sc, 0x07, 0x1000);
4588 		DELAY(100);
4589 		break;
4590 	}
4591 
4592 	return 0;
4593 }
4594 
4595 int
4596 rtw_rtl8225_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4597 {
4598 	return (0);
4599 }
4600 
4601 int
4602 rtw_rtl8225_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4603     enum rtw_pwrstate power)
4604 {
4605 	return (0);
4606 }
4607 
4608 int
4609 rtw_rtl8225_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4610 {
4611 	return (0);
4612 }
4613 
4614 int
4615 rtw_rtl8225_tune(struct rtw_softc *sc, u_int freq)
4616 {
4617 	return (0);
4618 }
4619 
4620 int
4621 rtw_rtl8255_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
4622 {
4623 	return (0);
4624 }
4625 
4626 int
4627 rtw_rtl8255_init(struct rtw_softc *sc, u_int freq, u_int8_t opaque_txpower,
4628     enum rtw_pwrstate power)
4629 {
4630 	return (0);
4631 }
4632 
4633 int
4634 rtw_rtl8255_txpower(struct rtw_softc *sc, u_int8_t opaque_txpower)
4635 {
4636 	return (0);
4637 }
4638 
4639 int
4640 rtw_rtl8255_tune(struct rtw_softc *sc, u_int freq)
4641 {
4642 	return (0);
4643 }
4644 
4645 int
4646 rtw_phy_init(struct rtw_softc *sc)
4647 {
4648 	int rc;
4649 	struct ieee80211com *ic = &sc->sc_ic;
4650 	struct rtw_regs *regs = &sc->sc_regs;
4651 	int antdiv = sc->sc_flags & RTW_F_ANTDIV;
4652 	int dflantb = sc->sc_flags & RTW_F_DFLANTB;
4653 	u_int freq = ic->ic_bss->ni_chan->ic_freq;	/* freq is in MHz */
4654 	u_int8_t opaque_txpower = rtw_chan2txpower(&sc->sc_srom, ic,
4655 	    ic->ic_bss->ni_chan);
4656 	u_int8_t cs_threshold = sc->sc_csthr;
4657 	enum rtw_pwrstate power = RTW_ON;
4658 
4659 	RTW_DPRINTF(RTW_DEBUG_PHY,
4660 	    ("%s: txpower %u csthresh %u freq %u antdiv %u dflantb %u "
4661 	     "pwrstate %s\n", __func__, opaque_txpower, cs_threshold, freq,
4662 	     antdiv, dflantb, rtw_pwrstate_string(power)));
4663 
4664 	/* XXX is this really necessary? */
4665 	if ((rc = (*sc->sc_rf_txpower)(sc, opaque_txpower)) != 0)
4666 		return rc;
4667 	if ((rc = rtw_bbp_preinit(regs, sc->sc_bbpset.bb_antatten, dflantb,
4668 	    freq)) != 0)
4669 		return rc;
4670 	if ((rc = (*sc->sc_rf_tune)(sc, freq)) != 0)
4671 		return rc;
4672 	/* initialize RF  */
4673 	if ((rc = (*sc->sc_rf_init)(sc, freq, opaque_txpower, power)) != 0)
4674 		return rc;
4675 #if 0	/* what is this redundant tx power setting here for? */
4676 	if ((rc = (*sc->sc_rf_txpower)(sc, opaque_txpower)) != 0)
4677 		return rc;
4678 #endif
4679 	return rtw_bbp_init(regs, &sc->sc_bbpset, antdiv, dflantb,
4680 	    cs_threshold, freq);
4681 }
4682 
4683 /*
4684  * Generic PHY I/O functions
4685  */
4686 
4687 int
4688 rtw_bbp_write(struct rtw_regs *regs, u_int addr, u_int val)
4689 {
4690 #define	BBP_WRITE_ITERS	50
4691 #define	BBP_WRITE_DELAY	1
4692 	int i;
4693 	u_int32_t wrbbp, rdbbp;
4694 
4695 	RTW_DPRINTF(RTW_DEBUG_PHYIO,
4696 	    ("%s: bbp[%u] <- %u\n", __func__, addr, val));
4697 
4698 	KASSERT((addr & ~PRESHIFT(RTW_BB_ADDR_MASK)) == 0);
4699 	KASSERT((val & ~PRESHIFT(RTW_BB_WR_MASK)) == 0);
4700 
4701 	wrbbp = LSHIFT(addr, RTW_BB_ADDR_MASK) | RTW_BB_WREN |
4702 	    LSHIFT(val, RTW_BB_WR_MASK) | RTW_BB_RD_MASK,
4703 
4704 	rdbbp = LSHIFT(addr, RTW_BB_ADDR_MASK) |
4705 	    RTW_BB_WR_MASK | RTW_BB_RD_MASK;
4706 
4707 	RTW_DPRINTF(RTW_DEBUG_PHYIO,
4708 	    ("%s: rdbbp = %#08x, wrbbp = %#08x\n", __func__, rdbbp, wrbbp));
4709 
4710 	for (i = BBP_WRITE_ITERS; --i >= 0; ) {
4711 		RTW_RBW(regs, RTW_BB, RTW_BB);
4712 		RTW_WRITE(regs, RTW_BB, wrbbp);
4713 		RTW_SYNC(regs, RTW_BB, RTW_BB);
4714 		RTW_WRITE(regs, RTW_BB, rdbbp);
4715 		RTW_SYNC(regs, RTW_BB, RTW_BB);
4716 		delay(BBP_WRITE_DELAY);	/* 1 microsecond */
4717 		if (MASK_AND_RSHIFT(RTW_READ(regs, RTW_BB),
4718 		    RTW_BB_RD_MASK) == val) {
4719 			RTW_DPRINTF(RTW_DEBUG_PHYIO,
4720 			    ("%s: finished in %dus\n", __func__,
4721 			    BBP_WRITE_DELAY * (BBP_WRITE_ITERS - i)));
4722 			return 0;
4723 		}
4724 		delay(BBP_WRITE_DELAY);	/* again */
4725 	}
4726 	printf("%s: timeout\n", __func__);
4727 	return -1;
4728 }
4729 
4730 /* Help rtw_rf_hostwrite bang bits to RF over 3-wire interface. */
4731 void
4732 rtw_rf_hostbangbits(struct rtw_regs *regs, u_int32_t bits, int lo_to_hi,
4733     u_int nbits)
4734 {
4735 	int i;
4736 	u_int32_t mask, reg;
4737 
4738 	KASSERT(nbits <= 32);
4739 
4740 	RTW_DPRINTF(RTW_DEBUG_PHYIO,
4741 	    ("%s: %u bits, %#08x, %s\n", __func__, nbits, bits,
4742 	    (lo_to_hi) ? "lo to hi" : "hi to lo"));
4743 
4744 	reg = RTW8180_PHYCFG_HST;
4745 	RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4746 	RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4747 
4748 	if (lo_to_hi)
4749 		mask = 0x1;
4750 	else
4751 		mask = 1 << (nbits - 1);
4752 
4753 	for (i = 0; i < nbits; i++) {
4754 		RTW_DPRINTF(RTW_DEBUG_PHYBITIO,
4755 		    ("%s: bits %#08x mask %#08x -> bit %#08x\n",
4756 		    __func__, bits, mask, bits & mask));
4757 
4758 		if ((bits & mask) != 0)
4759 			reg |= RTW8180_PHYCFG_HST_DATA;
4760 		else
4761 			reg &= ~RTW8180_PHYCFG_HST_DATA;
4762 
4763 		reg |= RTW8180_PHYCFG_HST_CLK;
4764 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4765 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4766 
4767 		DELAY(2);	/* arbitrary delay */
4768 
4769 		reg &= ~RTW8180_PHYCFG_HST_CLK;
4770 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4771 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4772 
4773 		if (lo_to_hi)
4774 			mask <<= 1;
4775 		else
4776 			mask >>= 1;
4777 	}
4778 
4779 	reg |= RTW8180_PHYCFG_HST_EN;
4780 	KASSERT((reg & RTW8180_PHYCFG_HST_CLK) == 0);
4781 	RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4782 	RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4783 }
4784 
4785 #if 0
4786 void
4787 rtw_rf_rtl8225_hostbangbits(struct rtw_regs *regs, u_int32_t bits, int lo_to_hi,
4788     u_int nbits)
4789 {
4790 	int i;
4791 	u_int8_t page;
4792 	u_int16_t reg0, reg1, reg2;
4793 	u_int32_t mask;
4794 
4795 	/* enable page 0 */
4796 	page = RTW_READ8(regs, RTW_PSR);
4797 	RTW_WRITE8(regs, RTW_PSR, page & ~RTW_PSR_PSEN);
4798 
4799 	/* enable RF access */
4800 	reg0 = RTW_READ16(regs, RTW8185_RFPINSOUTPUT) &
4801 	    RTW8185_RFPINSOUTPUT_MASK;
4802 	reg1 = RTW_READ16(regs, RTW8185_RFPINSENABLE);
4803 	RTW_WRITE16(regs, RTW8185_RFPINSENABLE,
4804 	    RTW8185_RFPINSENABLE_ENABLE | reg0);
4805 	reg2 = RTW_READ16(regs, RTW8185_RFPINSSELECT);
4806 	RTW_WRITE16(regs, RTW8185_RFPINSSELECT,
4807 	    RTW8185_RFPINSSELECT_ENABLE | reg1 /* XXX | SW_GPIO_CTL */);
4808 	DELAY(10);
4809 
4810 	RTW_WRITE16(regs, RTW8185_RFPINSOUTPUT, reg0);
4811 	DELAY(10);
4812 
4813 	if (lo_to_hi)
4814 		mask = 0x1;
4815 	else
4816 		mask = 1 << (nbits - 1);
4817 
4818 	for (i = 0; i < nbits; i++) {
4819 		RTW_DPRINTF(RTW_DEBUG_PHYBITIO,
4820 		    ("%s: bits %#08x mask %#08x -> bit %#08x\n",
4821 		    __func__, bits, mask, bits & mask));
4822 
4823 		if ((bits & mask) != 0)
4824 			reg |= RTW8180_PHYCFG_HST_DATA;
4825 		else
4826 			reg &= ~RTW8180_PHYCFG_HST_DATA;
4827 
4828 		reg |= RTW8180_PHYCFG_HST_CLK;
4829 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4830 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4831 
4832 		DELAY(2);	/* arbitrary delay */
4833 
4834 		reg &= ~RTW8180_PHYCFG_HST_CLK;
4835 		RTW_WRITE(regs, RTW8180_PHYCFG, reg);
4836 		RTW_SYNC(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4837 
4838 		if (lo_to_hi)
4839 			mask <<= 1;
4840 		else
4841 			mask >>= 1;
4842 	}
4843 
4844 	/* reset the page */
4845 	RTW_WRITE8(regs, RTW_PSR, page);
4846 }
4847 #endif
4848 
4849 /* Help rtw_rf_macwrite: tell MAC to bang bits to RF over the 3-wire
4850  * interface.
4851  */
4852 int
4853 rtw_rf_macbangbits(struct rtw_regs *regs, u_int32_t reg)
4854 {
4855 	int i;
4856 
4857 	RTW_DPRINTF(RTW_DEBUG_PHY, ("%s: %#08x\n", __func__, reg));
4858 
4859 	RTW_WRITE(regs, RTW8180_PHYCFG, RTW8180_PHYCFG_MAC_POLL | reg);
4860 
4861 	RTW_WBR(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4862 
4863 	for (i = rtw_macbangbits_timeout; --i >= 0; delay(1)) {
4864 		if ((RTW_READ(regs, RTW8180_PHYCFG) &
4865 		    RTW8180_PHYCFG_MAC_POLL) == 0) {
4866 			RTW_DPRINTF(RTW_DEBUG_PHY,
4867 			    ("%s: finished in %dus\n", __func__,
4868 			    rtw_macbangbits_timeout - i));
4869 			return 0;
4870 		}
4871 		RTW_RBR(regs, RTW8180_PHYCFG, RTW8180_PHYCFG);
4872 	}
4873 
4874 	printf("%s: RTW8180_PHYCFG_MAC_POLL still set.\n", __func__);
4875 	return -1;
4876 }
4877 
4878 u_int32_t
4879 rtw_grf5101_host_crypt(u_int addr, u_int32_t val)
4880 {
4881 	/* TBD */
4882 	return 0;
4883 }
4884 
4885 u_int32_t
4886 rtw_grf5101_mac_crypt(u_int addr, u_int32_t val)
4887 {
4888 	u_int32_t data_and_addr;
4889 #define EXTRACT_NIBBLE(d, which) (((d) >> (4 * (which))) & 0xf)
4890 	static u_int8_t caesar[16] = {
4891 		0x0, 0x8, 0x4, 0xc,
4892 		0x2, 0xa, 0x6, 0xe,
4893 		0x1, 0x9, 0x5, 0xd,
4894 		0x3, 0xb, 0x7, 0xf
4895 	};
4896 	data_and_addr =
4897 	    caesar[EXTRACT_NIBBLE(val, 2)] |
4898 	    (caesar[EXTRACT_NIBBLE(val, 1)] <<  4) |
4899 	    (caesar[EXTRACT_NIBBLE(val, 0)] <<  8) |
4900 	    (caesar[(addr >> 1) & 0xf]      << 12) |
4901 	    ((addr & 0x1)                   << 16) |
4902 	    (caesar[EXTRACT_NIBBLE(val, 3)] << 24);
4903 	return LSHIFT(data_and_addr, RTW8180_PHYCFG_MAC_PHILIPS_ADDR_MASK |
4904 	    RTW8180_PHYCFG_MAC_PHILIPS_DATA_MASK);
4905 #undef EXTRACT_NIBBLE
4906 }
4907 
4908 /* Bang bits over the 3-wire interface. */
4909 int
4910 rtw_rf_hostwrite(struct rtw_softc *sc, u_int addr, u_int32_t val)
4911 {
4912 	u_int nbits;
4913 	int lo_to_hi;
4914 	u_int32_t bits;
4915 	void(*rf_bangbits)(struct rtw_regs *, u_int32_t, int, u_int) =
4916 	    rtw_rf_hostbangbits;
4917 
4918 	RTW_DPRINTF(RTW_DEBUG_PHYIO, ("%s: [%u] <- %#08x\n", __func__,
4919 	    addr, val));
4920 
4921 	switch (sc->sc_rfchipid) {
4922 	case RTW_RFCHIPID_MAXIM2820:
4923 		nbits = 16;
4924 		lo_to_hi = 0;
4925 		bits = LSHIFT(val, MAX2820_TWI_DATA_MASK) |
4926 		    LSHIFT(addr, MAX2820_TWI_ADDR_MASK);
4927 		break;
4928 	case RTW_RFCHIPID_PHILIPS:
4929 		KASSERT((addr & ~PRESHIFT(SA2400_TWI_ADDR_MASK)) == 0);
4930 		KASSERT((val & ~PRESHIFT(SA2400_TWI_DATA_MASK)) == 0);
4931 		bits = LSHIFT(val, SA2400_TWI_DATA_MASK) |
4932 		    LSHIFT(addr, SA2400_TWI_ADDR_MASK) | SA2400_TWI_WREN;
4933 		nbits = 32;
4934 		lo_to_hi = 1;
4935 		break;
4936 	case RTW_RFCHIPID_GCT:
4937 		KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
4938 		KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
4939 		bits = rtw_grf5101_host_crypt(addr, val);
4940 		nbits = 21;
4941 		lo_to_hi = 1;
4942 		break;
4943 	case RTW_RFCHIPID_RFMD2948:
4944 		KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
4945 		KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
4946 		bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
4947 		    LSHIFT(addr, SI4126_TWI_ADDR_MASK);
4948 		nbits = 22;
4949 		lo_to_hi = 0;
4950 		break;
4951 	case RTW_RFCHIPID_RTL8225:
4952 	case RTW_RFCHIPID_RTL8255:
4953 		nbits = 16;
4954 		lo_to_hi = 0;
4955 		bits = LSHIFT(val, RTL8225_TWI_DATA_MASK) |
4956 		    LSHIFT(addr, RTL8225_TWI_ADDR_MASK);
4957 
4958 		/* the RTL8225 uses a slightly modified RF interface */
4959 		rf_bangbits = rtw_rf_hostbangbits;
4960 		break;
4961 	case RTW_RFCHIPID_INTERSIL:
4962 	default:
4963 		printf("%s: unknown rfchipid %d\n", __func__, sc->sc_rfchipid);
4964 		return -1;
4965 	}
4966 
4967 	(*rf_bangbits)(&sc->sc_regs, bits, lo_to_hi, nbits);
4968 
4969 	return 0;
4970 }
4971 
4972 u_int32_t
4973 rtw_maxim_swizzle(u_int addr, u_int32_t val)
4974 {
4975 	u_int32_t hidata, lodata;
4976 
4977 	KASSERT((val & ~(RTW_MAXIM_LODATA_MASK|RTW_MAXIM_HIDATA_MASK)) == 0);
4978 	lodata = MASK_AND_RSHIFT(val, RTW_MAXIM_LODATA_MASK);
4979 	hidata = MASK_AND_RSHIFT(val, RTW_MAXIM_HIDATA_MASK);
4980 	return LSHIFT(lodata, RTW8180_PHYCFG_MAC_MAXIM_LODATA_MASK) |
4981 	    LSHIFT(hidata, RTW8180_PHYCFG_MAC_MAXIM_HIDATA_MASK) |
4982 	    LSHIFT(addr, RTW8180_PHYCFG_MAC_MAXIM_ADDR_MASK);
4983 }
4984 
4985 /* Tell the MAC what to bang over the 3-wire interface. */
4986 int
4987 rtw_rf_macwrite(struct rtw_softc *sc, u_int addr, u_int32_t val)
4988 {
4989 	u_int32_t reg;
4990 
4991 	RTW_DPRINTF(RTW_DEBUG_PHYIO, ("%s: %s[%u] <- %#08x\n", __func__,
4992 	    addr, val));
4993 
4994 	switch (sc->sc_rfchipid) {
4995 	case RTW_RFCHIPID_GCT:
4996 		reg = rtw_grf5101_mac_crypt(addr, val);
4997 		break;
4998 	case RTW_RFCHIPID_MAXIM2820:
4999 		reg = rtw_maxim_swizzle(addr, val);
5000 		break;
5001 	default:		/* XXX */
5002 	case RTW_RFCHIPID_PHILIPS:
5003 		KASSERT((addr &
5004 		    ~PRESHIFT(RTW8180_PHYCFG_MAC_PHILIPS_ADDR_MASK)) == 0);
5005 		KASSERT((val &
5006 		    ~PRESHIFT(RTW8180_PHYCFG_MAC_PHILIPS_DATA_MASK)) == 0);
5007 
5008 		reg = LSHIFT(addr, RTW8180_PHYCFG_MAC_PHILIPS_ADDR_MASK) |
5009 		    LSHIFT(val, RTW8180_PHYCFG_MAC_PHILIPS_DATA_MASK);
5010 	}
5011 
5012 	switch (sc->sc_rfchipid) {
5013 	case RTW_RFCHIPID_GCT:
5014 	case RTW_RFCHIPID_MAXIM2820:
5015 	case RTW_RFCHIPID_RFMD2948:
5016 		reg |= RTW8180_PHYCFG_MAC_RFTYPE_RFMD;
5017 		break;
5018 	case RTW_RFCHIPID_INTERSIL:
5019 		reg |= RTW8180_PHYCFG_MAC_RFTYPE_INTERSIL;
5020 		break;
5021 	case RTW_RFCHIPID_PHILIPS:
5022 		reg |= RTW8180_PHYCFG_MAC_RFTYPE_PHILIPS;
5023 		break;
5024 	default:
5025 		printf("%s: unknown rfchipid %d\n", __func__, sc->sc_rfchipid);
5026 		return -1;
5027 	}
5028 
5029 	return rtw_rf_macbangbits(&sc->sc_regs, reg);
5030 }
5031 
5032 
5033 u_int8_t
5034 rtw_read8(void *arg, u_int32_t off)
5035 {
5036 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5037 	return (bus_space_read_1(regs->r_bt, regs->r_bh, off));
5038 }
5039 
5040 u_int16_t
5041 rtw_read16(void *arg, u_int32_t off)
5042 {
5043 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5044 	return (bus_space_read_2(regs->r_bt, regs->r_bh, off));
5045 }
5046 
5047 u_int32_t
5048 rtw_read32(void *arg, u_int32_t off)
5049 {
5050 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5051 	return (bus_space_read_4(regs->r_bt, regs->r_bh, off));
5052 }
5053 
5054 void
5055 rtw_write8(void *arg, u_int32_t off, u_int8_t val)
5056 {
5057 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5058 	bus_space_write_1(regs->r_bt, regs->r_bh, off, val);
5059 }
5060 
5061 void
5062 rtw_write16(void *arg, u_int32_t off, u_int16_t val)
5063 {
5064 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5065 	bus_space_write_2(regs->r_bt, regs->r_bh, off, val);
5066 }
5067 
5068 void
5069 rtw_write32(void *arg, u_int32_t off, u_int32_t val)
5070 {
5071 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5072 	bus_space_write_4(regs->r_bt, regs->r_bh, off, val);
5073 }
5074 
5075 void
5076 rtw_barrier(void *arg, u_int32_t reg0, u_int32_t reg1, int flags)
5077 {
5078 	struct rtw_regs *regs = (struct rtw_regs *)arg;
5079 	bus_space_barrier(regs->r_bt, regs->r_bh, MIN(reg0, reg1),
5080 	    MAX(reg0, reg1) - MIN(reg0, reg1) + 4, flags);
5081 }
5082