sys/dev/netif/rtw/rtw.c

   1 /*
   2  * Copyright (c) 2006 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Sepherosa Ziehau <sepherosa@gmail.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  * $NetBSD: rtw.c,v 1.72 2006/03/28 00:48:10 dyoung Exp $
  35  */
  36
  37 /*
  38  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
  39  *
  40  * Programmed for NetBSD by David Young.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  * 3. The name of David Young may not be used to endorse or promote
  51  *    products derived from this software without specific prior
  52  *    written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY David Young ``AS IS'' AND ANY
  55  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  56  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
  57  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL David
  58  * Young BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  59  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  60  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  61  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  62  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  63  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  64  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
  65  * OF SUCH DAMAGE.
  66  */
  67
  68 /*
  69  * Device driver for the Realtek RTL8180 802.11 MAC/BBP.
  70  */
  71
  72 #include <sys/param.h>
  73 #include <sys/bitops.h>
  74 #include <sys/bus.h>
  75 #include <sys/endian.h>
  76 #include <sys/kernel.h>
  77 #include <sys/interrupt.h>
  78 #include <sys/rman.h>
  79 #include <sys/socket.h>
  80 #include <sys/sockio.h>
  81 #include <sys/serialize.h>
  82 #include <sys/sysctl.h>
  83
  84 #include <net/if.h>
  85 #include <net/if_arp.h>
  86 #include <net/if_dl.h>
  87 #include <net/if_media.h>
  88 #include <net/ifq_var.h>
  89 #include <net/ethernet.h>
  90 #include <net/bpf.h>
  91
  92 #include <netproto/802_11/ieee80211_var.h>
  93 #include <netproto/802_11/ieee80211_radiotap.h>
  94 #include <netproto/802_11/wlan_ratectl/onoe/ieee80211_onoe_param.h>
  95
  96 #include <dev/netif/rtw/rtwreg.h>
  97 #include <dev/netif/rtw/rtwvar.h>
  98 #include <dev/netif/rtw/rtwphyio.h>
  99 #include <dev/netif/rtw/rtwphy.h>
 100 #include <dev/netif/rtw/smc93cx6var.h>
 101 #include <dev/netif/rtw/sa2400reg.h>
 102
 103 /* XXX */
 104 #define IEEE80211_DUR_DS_LONG_PREAMBLE  144
 105 #define IEEE80211_DUR_DS_SHORT_PREAMBLE 72
 106 #define IEEE80211_DUR_DS_SLOW_PLCPHDR   48
 107 #define IEEE80211_DUR_DS_FAST_PLCPHDR   24
 108 #define IEEE80211_DUR_DS_SLOW_ACK       112
 109 #define IEEE80211_DUR_DS_SLOW_CTS       112
 110 #define IEEE80211_DUR_DS_SIFS           10
 111
 112 struct rtw_txsegs {
 113         int                     nseg;
 114         bus_dma_segment_t       segs[RTW_MAXPKTSEGS];
 115 };
 116
 117 devclass_t      rtw_devclass;
 118
 119 static const struct ieee80211_rateset rtw_rates_11b = { 4, { 2, 4, 11, 22 } };
 120
 121 SYSCTL_NODE(_hw, OID_AUTO, rtw, CTLFLAG_RD, 0,
 122             "Realtek RTL818x 802.11 controls");
 123
 124 /* [0, __SHIFTOUT(RTW_CONFIG4_RFTYPE_MASK, RTW_CONFIG4_RFTYPE_MASK)] */
 125 static int      rtw_rfprog_fallback = 0;
 126 SYSCTL_INT(_hw_rtw, OID_AUTO, rfprog_fallback, CTLFLAG_RW,
 127            &rtw_rfprog_fallback, 0, "fallback RF programming method");
 128
 129 static int      rtw_host_rfio = 0;              /* 0/1 */
 130 SYSCTL_INT(_hw_rtw, OID_AUTO, host_rfio, CTLFLAG_RW,
 131            &rtw_host_rfio, 0, "enable host control of RF I/O");
 132
 133 #ifdef RTW_DEBUG
 134 int             rtw_debug = 0;                  /* [0, RTW_DEBUG_MAX] */
 135 SYSCTL_INT(_hw_rtw, OID_AUTO, debug, CTLFLAG_RW, &rtw_debug, 0, "debug level");
 136
 137 static int      rtw_rxbufs_limit = RTW_RXQLEN;  /* [0, RTW_RXQLEN] */
 138 SYSCTL_INT(_hw_rtw, OID_AUTO, rxbufs_limit, CTLFLAG_RW, &rtw_rxbufs_limit, 0,
 139            "rx buffers limit");
 140 #endif /* RTW_DEBUG */
 141
 142 #if 0
 143 static int      rtw_xmtr_restart = 0;
 144 SYSCTL_INT(_hw_rtw, OID_AUTO, xmtr_restart, CTLFLAG_RW, &rtw_xmtr_restart, 0,
 145            "gratuitously reset xmtr on rcvr error");
 146
 147 static int      rtw_ring_reset = 0;
 148 SYSCTL_INT(_hw_rtw, OID_AUTO, ring_reset, CTLFLAG_RW, &rtw_ring_reset, 0,
 149            "reset ring pointers on rcvr error");
 150 #endif
 151
 152 static int      rtw_do_chip_reset = 0;
 153 SYSCTL_INT(_hw_rtw, OID_AUTO, chip_reset, CTLFLAG_RW, &rtw_do_chip_reset, 0,
 154            "gratuitously reset chip on rcvr error");
 155
 156 int             rtw_dwelltime = 200;    /* milliseconds */
 157
 158 /* XXX */
 159 static struct ieee80211_cipher rtw_cipher_wep;
 160
 161 static void     rtw_led_init(struct rtw_softc *);
 162 static void     rtw_led_newstate(struct rtw_softc *, enum ieee80211_state);
 163 static void     rtw_led_slowblink(void *);
 164 static void     rtw_led_fastblink(void *);
 165 static void     rtw_led_set(struct rtw_softc *);
 166
 167 static void     rtw_init(void *);
 168 static void     rtw_start(struct ifnet *);
 169 static int      rtw_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 170 static void     rtw_watchdog(struct ifnet *);
 171 static void     rtw_intr(void *);
 172
 173 static void     rtw_intr_rx(struct rtw_softc *, uint16_t);
 174 static void     rtw_intr_tx(struct rtw_softc *, uint16_t);
 175 static void     rtw_intr_beacon(struct rtw_softc *, uint16_t);
 176 static void     rtw_intr_atim(struct rtw_softc *);
 177 static void     rtw_intr_ioerror(struct rtw_softc *, uint16_t);
 178 static void     rtw_intr_timeout(struct rtw_softc *);
 179
 180 static int      rtw_dequeue(struct ifnet *, struct rtw_txsoft_blk **,
 181                             struct rtw_txdesc_blk **, struct mbuf **,
 182                             struct ieee80211_node **);
 183 static struct mbuf *rtw_load_txbuf(struct rtw_softc *, struct rtw_txsoft *,
 184                                    struct rtw_txsegs *, int, struct mbuf *);
 185
 186 static void     rtw_idle(struct rtw_softc *);
 187 static void     rtw_txring_fixup(struct rtw_softc *);
 188 static void     rtw_rxring_fixup(struct rtw_softc *);
 189 static int      rtw_txring_next(struct rtw_regs *, struct rtw_txdesc_blk *);
 190 static void     rtw_reset_oactive(struct rtw_softc *);
 191
 192 static int      rtw_enable(struct rtw_softc *);
 193 static void     rtw_disable(struct rtw_softc *);
 194 static void     rtw_io_enable(struct rtw_softc *, uint8_t, int);
 195 static int      rtw_pwrstate(struct rtw_softc *, enum rtw_pwrstate);
 196 static void     rtw_set_access(struct rtw_softc *, enum rtw_access);
 197
 198 static void     rtw_continuous_tx_enable(struct rtw_softc *, int);
 199 static void     rtw_txdac_enable(struct rtw_softc *, int);
 200 static void     rtw_anaparm_enable(struct rtw_regs *, int);
 201 static void     rtw_config0123_enable(struct rtw_regs *, int);
 202
 203 static void     rtw_transmit_config(struct rtw_regs *);
 204 static void     rtw_set_rfprog(struct rtw_softc *);
 205 static void     rtw_enable_interrupts(struct rtw_softc *);
 206 static void     rtw_pktfilt_load(struct rtw_softc *);
 207 static void     rtw_wep_setkeys(struct rtw_softc *);
 208 static void     rtw_resume_ticks(struct rtw_softc *);
 209 static void     rtw_set_nettype(struct rtw_softc *, enum ieee80211_opmode);
 210
 211 static int      rtw_reset(struct rtw_softc *);
 212 static int      rtw_chip_reset(struct rtw_softc *);
 213 static int      rtw_recall_eeprom(struct rtw_softc *);
 214 static int      rtw_srom_read(struct rtw_softc *);
 215 static int      rtw_srom_parse(struct rtw_softc *);
 216 static struct rtw_rf *rtw_rf_attach(struct rtw_softc *, enum rtw_rfchipid, int);
 217
 218 static uint8_t  rtw_check_phydelay(struct rtw_regs *, uint32_t);
 219 static void     rtw_identify_country(struct rtw_softc *);
 220 static int      rtw_identify_sta(struct rtw_softc *);
 221
 222 static int      rtw_swring_setup(struct rtw_softc *);
 223 static void     rtw_hwring_setup(struct rtw_softc *);
 224
 225 static int      rtw_desc_blk_alloc(struct rtw_softc *);
 226 static void     rtw_desc_blk_free(struct rtw_softc *);
 227 static int      rtw_soft_blk_alloc(struct rtw_softc *);
 228 static void     rtw_soft_blk_free(struct rtw_softc *);
 229
 230 static void     rtw_txdesc_blk_init_all(struct rtw_softc *);
 231 static void     rtw_txsoft_blk_init_all(struct rtw_softc *);
 232 static void     rtw_rxdesc_blk_init_all(struct rtw_softc *);
 233 static int      rtw_rxsoft_blk_init_all(struct rtw_softc *);
 234
 235 static void     rtw_txdesc_blk_reset_all(struct rtw_softc *);
 236
 237 static int      rtw_rxsoft_alloc(struct rtw_softc *, struct rtw_rxsoft *, int);
 238 static void     rtw_rxdesc_init(struct rtw_softc *, int idx, int);
 239
 240 #ifdef RTW_DEBUG
 241 static void     rtw_print_txdesc(struct rtw_softc *, const char *,
 242                                  struct rtw_txsoft *, struct rtw_txdesc_blk *,
 243                                  int);
 244 #endif /* RTW_DEBUG */
 245
 246 static int      rtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
 247 static void     rtw_next_scan(void *);
 248
 249 static int      rtw_key_delete(struct ieee80211com *,
 250                                const struct ieee80211_key *);
 251 static int      rtw_key_set(struct ieee80211com *,
 252                             const struct ieee80211_key *,
 253                             const u_int8_t[IEEE80211_ADDR_LEN]);
 254 static void     rtw_key_update_end(struct ieee80211com *);
 255 static void     rtw_key_update_begin(struct ieee80211com *);
 256 static int      rtw_wep_decap(struct ieee80211_key *, struct mbuf *, int);
 257
 258 static int      rtw_compute_duration1(int, int, uint32_t, int,
 259                                       struct rtw_duration *);
 260 static int      rtw_compute_duration(const struct ieee80211_frame_min *,
 261                                      const struct ieee80211_key *, int,
 262                                      uint32_t, int, int,
 263                                      struct rtw_duration *,
 264                                      struct rtw_duration *, int *, int);
 265
 266 static int      rtw_get_rssi(struct rtw_softc *, uint8_t, uint8_t);
 267 static int      rtw_maxim_getrssi(uint8_t, uint8_t);
 268 static int      rtw_gct_getrssi(uint8_t, uint8_t);
 269 static int      rtw_philips_getrssi(uint8_t, uint8_t);
 270
 271 static void     *rtw_ratectl_attach(struct ieee80211com *, u_int);
 272
 273 #ifdef RTW_DEBUG
 274 static void
 275 rtw_print_regs(struct rtw_regs *regs, const char *dvname, const char *where)
 276 {
 277 #define PRINTREG32(sc, reg)                             \
 278         RTW_DPRINTF(RTW_DEBUG_REGDUMP,                  \
 279             ("%s: reg[ " #reg " / %03x ] = %08x\n",     \
 280             dvname, reg, RTW_READ(regs, reg)))
 281
 282 #define PRINTREG16(sc, reg)                             \
 283         RTW_DPRINTF(RTW_DEBUG_REGDUMP,                  \
 284             ("%s: reg[ " #reg " / %03x ] = %04x\n",     \
 285             dvname, reg, RTW_READ16(regs, reg)))
 286
 287 #define PRINTREG8(sc, reg)                              \
 288         RTW_DPRINTF(RTW_DEBUG_REGDUMP,                  \
 289             ("%s: reg[ " #reg " / %03x ] = %02x\n",     \
 290             dvname, reg, RTW_READ8(regs, reg)))
 291
 292         RTW_DPRINTF(RTW_DEBUG_REGDUMP, ("%s: %s\n", dvname, where));
 293
 294         PRINTREG32(regs, RTW_IDR0);
 295         PRINTREG32(regs, RTW_IDR1);
 296         PRINTREG32(regs, RTW_MAR0);
 297         PRINTREG32(regs, RTW_MAR1);
 298         PRINTREG32(regs, RTW_TSFTRL);
 299         PRINTREG32(regs, RTW_TSFTRH);
 300         PRINTREG32(regs, RTW_TLPDA);
 301         PRINTREG32(regs, RTW_TNPDA);
 302         PRINTREG32(regs, RTW_THPDA);
 303         PRINTREG32(regs, RTW_TCR);
 304         PRINTREG32(regs, RTW_RCR);
 305         PRINTREG32(regs, RTW_TINT);
 306         PRINTREG32(regs, RTW_TBDA);
 307         PRINTREG32(regs, RTW_ANAPARM);
 308         PRINTREG32(regs, RTW_BB);
 309         PRINTREG32(regs, RTW_PHYCFG);
 310         PRINTREG32(regs, RTW_WAKEUP0L);
 311         PRINTREG32(regs, RTW_WAKEUP0H);
 312         PRINTREG32(regs, RTW_WAKEUP1L);
 313         PRINTREG32(regs, RTW_WAKEUP1H);
 314         PRINTREG32(regs, RTW_WAKEUP2LL);
 315         PRINTREG32(regs, RTW_WAKEUP2LH);
 316         PRINTREG32(regs, RTW_WAKEUP2HL);
 317         PRINTREG32(regs, RTW_WAKEUP2HH);
 318         PRINTREG32(regs, RTW_WAKEUP3LL);
 319         PRINTREG32(regs, RTW_WAKEUP3LH);
 320         PRINTREG32(regs, RTW_WAKEUP3HL);
 321         PRINTREG32(regs, RTW_WAKEUP3HH);
 322         PRINTREG32(regs, RTW_WAKEUP4LL);
 323         PRINTREG32(regs, RTW_WAKEUP4LH);
 324         PRINTREG32(regs, RTW_WAKEUP4HL);
 325         PRINTREG32(regs, RTW_WAKEUP4HH);
 326         PRINTREG32(regs, RTW_DK0);
 327         PRINTREG32(regs, RTW_DK1);
 328         PRINTREG32(regs, RTW_DK2);
 329         PRINTREG32(regs, RTW_DK3);
 330         PRINTREG32(regs, RTW_RETRYCTR);
 331         PRINTREG32(regs, RTW_RDSAR);
 332         PRINTREG32(regs, RTW_FER);
 333         PRINTREG32(regs, RTW_FEMR);
 334         PRINTREG32(regs, RTW_FPSR);
 335         PRINTREG32(regs, RTW_FFER);
 336
 337         /* 16-bit registers */
 338         PRINTREG16(regs, RTW_BRSR);
 339         PRINTREG16(regs, RTW_IMR);
 340         PRINTREG16(regs, RTW_ISR);
 341         PRINTREG16(regs, RTW_BCNITV);
 342         PRINTREG16(regs, RTW_ATIMWND);
 343         PRINTREG16(regs, RTW_BINTRITV);
 344         PRINTREG16(regs, RTW_ATIMTRITV);
 345         PRINTREG16(regs, RTW_CRC16ERR);
 346         PRINTREG16(regs, RTW_CRC0);
 347         PRINTREG16(regs, RTW_CRC1);
 348         PRINTREG16(regs, RTW_CRC2);
 349         PRINTREG16(regs, RTW_CRC3);
 350         PRINTREG16(regs, RTW_CRC4);
 351         PRINTREG16(regs, RTW_CWR);
 352
 353         /* 8-bit registers */
 354         PRINTREG8(regs, RTW_CR);
 355         PRINTREG8(regs, RTW_9346CR);
 356         PRINTREG8(regs, RTW_CONFIG0);
 357         PRINTREG8(regs, RTW_CONFIG1);
 358         PRINTREG8(regs, RTW_CONFIG2);
 359         PRINTREG8(regs, RTW_MSR);
 360         PRINTREG8(regs, RTW_CONFIG3);
 361         PRINTREG8(regs, RTW_CONFIG4);
 362         PRINTREG8(regs, RTW_TESTR);
 363         PRINTREG8(regs, RTW_PSR);
 364         PRINTREG8(regs, RTW_SCR);
 365         PRINTREG8(regs, RTW_PHYDELAY);
 366         PRINTREG8(regs, RTW_CRCOUNT);
 367         PRINTREG8(regs, RTW_PHYADDR);
 368         PRINTREG8(regs, RTW_PHYDATAW);
 369         PRINTREG8(regs, RTW_PHYDATAR);
 370         PRINTREG8(regs, RTW_CONFIG5);
 371         PRINTREG8(regs, RTW_TPPOLL);
 372
 373         PRINTREG16(regs, RTW_BSSID16);
 374         PRINTREG32(regs, RTW_BSSID32);
 375 #undef PRINTREG32
 376 #undef PRINTREG16
 377 #undef PRINTREG8
 378 }
 379 #endif /* RTW_DEBUG */
 380
 381 static void
 382 rtw_continuous_tx_enable(struct rtw_softc *sc, int enable)
 383 {
 384         struct rtw_regs *regs = &sc->sc_regs;
 385         uint32_t tcr;
 386
 387         tcr = RTW_READ(regs, RTW_TCR);
 388         tcr &= ~RTW_TCR_LBK_MASK;
 389         if (enable)
 390                 tcr |= RTW_TCR_LBK_CONT;
 391         else
 392                 tcr |= RTW_TCR_LBK_NORMAL;
 393         RTW_WRITE(regs, RTW_TCR, tcr);
 394         RTW_SYNC(regs, RTW_TCR, RTW_TCR);
 395         rtw_set_access(sc, RTW_ACCESS_ANAPARM);
 396         rtw_txdac_enable(sc, !enable);
 397         rtw_set_access(sc, RTW_ACCESS_ANAPARM);/* XXX Voodoo from Linux. */
 398         rtw_set_access(sc, RTW_ACCESS_NONE);
 399 }
 400
 401 #ifdef RTW_DEBUG
 402 static const char *
 403 rtw_access_string(enum rtw_access access)
 404 {
 405         switch (access) {
 406         case RTW_ACCESS_NONE:
 407                 return "none";
 408         case RTW_ACCESS_CONFIG:
 409                 return "config";
 410         case RTW_ACCESS_ANAPARM:
 411                 return "anaparm";
 412         default:
 413                 return "unknown";
 414         }
 415 }
 416 #endif /* RTW_DEBUG */
 417
 418 static void
 419 rtw_set_access1(struct rtw_regs *regs, enum rtw_access naccess)
 420 {
 421         KKASSERT(naccess >= RTW_ACCESS_NONE && naccess <= RTW_ACCESS_ANAPARM);
 422         KKASSERT(regs->r_access >= RTW_ACCESS_NONE &&
 423                  regs->r_access <= RTW_ACCESS_ANAPARM);
 424
 425         if (naccess == regs->r_access)
 426                 return;
 427
 428         switch (naccess) {
 429         case RTW_ACCESS_NONE:
 430                 switch (regs->r_access) {
 431                 case RTW_ACCESS_ANAPARM:
 432                         rtw_anaparm_enable(regs, 0);
 433                         /*FALLTHROUGH*/
 434                 case RTW_ACCESS_CONFIG:
 435                         rtw_config0123_enable(regs, 0);
 436                         /*FALLTHROUGH*/
 437                 case RTW_ACCESS_NONE:
 438                         break;
 439                 }
 440                 break;
 441         case RTW_ACCESS_CONFIG:
 442                 switch (regs->r_access) {
 443                 case RTW_ACCESS_NONE:
 444                         rtw_config0123_enable(regs, 1);
 445                         /*FALLTHROUGH*/
 446                 case RTW_ACCESS_CONFIG:
 447                         break;
 448                 case RTW_ACCESS_ANAPARM:
 449                         rtw_anaparm_enable(regs, 0);
 450                         break;
 451                 }
 452                 break;
 453         case RTW_ACCESS_ANAPARM:
 454                 switch (regs->r_access) {
 455                 case RTW_ACCESS_NONE:
 456                         rtw_config0123_enable(regs, 1);
 457                         /*FALLTHROUGH*/
 458                 case RTW_ACCESS_CONFIG:
 459                         rtw_anaparm_enable(regs, 1);
 460                         /*FALLTHROUGH*/
 461                 case RTW_ACCESS_ANAPARM:
 462                         break;
 463                 }
 464                 break;
 465         }
 466 }
 467
 468 static void
 469 rtw_set_access(struct rtw_softc *sc, enum rtw_access access)
 470 {
 471         struct rtw_regs *regs = &sc->sc_regs;
 472
 473         rtw_set_access1(regs, access);
 474         RTW_DPRINTF(RTW_DEBUG_ACCESS,
 475             ("%s: access %s -> %s\n", sc->sc_ic.ic_if.if_xname,
 476             rtw_access_string(regs->r_access),
 477             rtw_access_string(access)));
 478         regs->r_access = access;
 479 }
 480
 481 /*
 482  * Enable registers, switch register banks.
 483  */
 484 static void
 485 rtw_config0123_enable(struct rtw_regs *regs, int enable)
 486 {
 487         uint8_t ecr;
 488
 489         ecr = RTW_READ8(regs, RTW_9346CR);
 490         ecr &= ~(RTW_9346CR_EEM_MASK | RTW_9346CR_EECS | RTW_9346CR_EESK);
 491         if (enable) {
 492                 ecr |= RTW_9346CR_EEM_CONFIG;
 493         } else {
 494                 RTW_WBW(regs, RTW_9346CR, MAX(RTW_CONFIG0, RTW_CONFIG3));
 495                 ecr |= RTW_9346CR_EEM_NORMAL;
 496         }
 497         RTW_WRITE8(regs, RTW_9346CR, ecr);
 498         RTW_SYNC(regs, RTW_9346CR, RTW_9346CR);
 499 }
 500
 501 /* requires rtw_config0123_enable(, 1) */
 502 static void
 503 rtw_anaparm_enable(struct rtw_regs *regs, int enable)
 504 {
 505         uint8_t cfg3;
 506
 507         cfg3 = RTW_READ8(regs, RTW_CONFIG3);
 508         cfg3 |= RTW_CONFIG3_CLKRUNEN;
 509         if (enable)
 510                 cfg3 |= RTW_CONFIG3_PARMEN;
 511         else
 512                 cfg3 &= ~RTW_CONFIG3_PARMEN;
 513         RTW_WRITE8(regs, RTW_CONFIG3, cfg3);
 514         RTW_SYNC(regs, RTW_CONFIG3, RTW_CONFIG3);
 515 }
 516
 517 /* requires rtw_anaparm_enable(, 1) */
 518 static void
 519 rtw_txdac_enable(struct rtw_softc *sc, int enable)
 520 {
 521         uint32_t anaparm;
 522         struct rtw_regs *regs = &sc->sc_regs;
 523
 524         anaparm = RTW_READ(regs, RTW_ANAPARM);
 525         if (enable)
 526                 anaparm &= ~RTW_ANAPARM_TXDACOFF;
 527         else
 528                 anaparm |= RTW_ANAPARM_TXDACOFF;
 529         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
 530         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
 531 }
 532
 533 static int
 534 rtw_chip_reset1(struct rtw_softc *sc)
 535 {
 536         struct rtw_regs *regs = &sc->sc_regs;
 537         uint8_t cr;
 538         int i;
 539
 540         RTW_WRITE8(regs, RTW_CR, RTW_CR_RST);
 541
 542         RTW_WBR(regs, RTW_CR, RTW_CR);
 543
 544         for (i = 0; i < 1000; i++) {
 545                 if ((cr = RTW_READ8(regs, RTW_CR) & RTW_CR_RST) == 0) {
 546                         RTW_DPRINTF(RTW_DEBUG_RESET,
 547                             ("%s: reset in %dus\n",
 548                              sc->sc_ic.ic_if.if_xname, i));
 549                         return 0;
 550                 }
 551                 RTW_RBR(regs, RTW_CR, RTW_CR);
 552                 DELAY(10); /* 10us */
 553         }
 554
 555         if_printf(&sc->sc_ic.ic_if, "reset failed\n");
 556         return ETIMEDOUT;
 557 }
 558
 559 static int
 560 rtw_chip_reset(struct rtw_softc *sc)
 561 {
 562         struct rtw_regs *regs = &sc->sc_regs;
 563         uint32_t tcr;
 564
 565         /* from Linux driver */
 566         tcr = RTW_TCR_CWMIN | RTW_TCR_MXDMA_2048 |
 567               __SHIFTIN(7, RTW_TCR_SRL_MASK) | __SHIFTIN(7, RTW_TCR_LRL_MASK);
 568
 569         RTW_WRITE(regs, RTW_TCR, tcr);
 570
 571         RTW_WBW(regs, RTW_CR, RTW_TCR);
 572
 573         return rtw_chip_reset1(sc);
 574 }
 575
 576 static int
 577 rtw_wep_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
 578 {
 579         struct ieee80211_key keycopy;
 580         const struct ieee80211_cipher *wep_cipher;
 581
 582         RTW_DPRINTF(RTW_DEBUG_KEY, ("%s:\n", __func__));
 583
 584         keycopy = *k;
 585         keycopy.wk_flags &= ~IEEE80211_KEY_SWCRYPT;
 586
 587         wep_cipher = ieee80211_crypto_cipher(IEEE80211_CIPHER_WEP);
 588         KKASSERT(wep_cipher != NULL);
 589
 590         return wep_cipher->ic_decap(&keycopy, m, hdrlen);
 591 }
 592
 593 static int
 594 rtw_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
 595 {
 596         struct rtw_softc *sc = ic->ic_ifp->if_softc;
 597         u_int keyix = k->wk_keyix;
 598
 599         DPRINTF(sc, RTW_DEBUG_KEY, ("%s: delete key %u\n", __func__, keyix));
 600
 601         if (keyix >= IEEE80211_WEP_NKID)
 602                 return 0;
 603         if (k->wk_keylen != 0)
 604                 sc->sc_flags &= ~RTW_F_DK_VALID;
 605         return 1;
 606 }
 607
 608 static int
 609 rtw_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
 610             const u_int8_t mac[IEEE80211_ADDR_LEN])
 611 {
 612         struct rtw_softc *sc = ic->ic_ifp->if_softc;
 613
 614         DPRINTF(sc, RTW_DEBUG_KEY, ("%s: set key %u\n", __func__, k->wk_keyix));
 615
 616         if (k->wk_keyix >= IEEE80211_WEP_NKID)
 617                 return 0;
 618
 619         sc->sc_flags &= ~RTW_F_DK_VALID;
 620         return 1;
 621 }
 622
 623 static void
 624 rtw_key_update_begin(struct ieee80211com *ic)
 625 {
 626 #ifdef RTW_DEBUG
 627         struct ifnet *ifp = ic->ic_ifp;
 628         struct rtw_softc *sc = ifp->if_softc;
 629 #endif
 630
 631         DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
 632 }
 633
 634 static void
 635 rtw_key_update_end(struct ieee80211com *ic)
 636 {
 637         struct ifnet *ifp = ic->ic_ifp;
 638         struct rtw_softc *sc = ifp->if_softc;
 639
 640         DPRINTF(sc, RTW_DEBUG_KEY, ("%s:\n", __func__));
 641
 642         if ((sc->sc_flags & RTW_F_DK_VALID) != 0 ||
 643             (sc->sc_flags & RTW_F_ENABLED) == 0 ||
 644             (sc->sc_flags & RTW_F_INVALID) != 0)
 645                 return;
 646
 647         rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
 648         rtw_wep_setkeys(sc);
 649         rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE,
 650                       (ifp->if_flags & IFF_RUNNING) != 0);
 651 }
 652
 653 static __inline int
 654 rtw_key_hwsupp(uint32_t flags, const struct ieee80211_key *k)
 655 {
 656         if (k->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
 657                 return 0;
 658
 659         return ((flags & RTW_C_RXWEP_40) != 0 && k->wk_keylen == 5) ||
 660                ((flags & RTW_C_RXWEP_104) != 0 && k->wk_keylen == 13);
 661 }
 662
 663 static void
 664 rtw_wep_setkeys(struct rtw_softc *sc)
 665 {
 666         struct ieee80211com *ic = &sc->sc_ic;
 667         struct ieee80211_key *wk = ic->ic_nw_keys;
 668         const struct ieee80211_cipher *wep_cipher;
 669         struct rtw_regs *regs = &sc->sc_regs;
 670         union rtw_keys *rk = &sc->sc_keys;
 671         uint8_t psr, scr;
 672         int i, keylen;
 673
 674         memset(rk->rk_keys, 0, sizeof(rk->rk_keys));
 675
 676         wep_cipher = ieee80211_crypto_cipher(IEEE80211_CIPHER_WEP);
 677         KKASSERT(wep_cipher != NULL);
 678
 679         /* Temporarily use software crypto for all keys. */
 680         for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 681                 if (wk[i].wk_cipher == &rtw_cipher_wep)
 682                         wk[i].wk_cipher = wep_cipher;
 683         }
 684
 685         rtw_set_access(sc, RTW_ACCESS_CONFIG);
 686
 687         psr = RTW_READ8(regs, RTW_PSR);
 688         scr = RTW_READ8(regs, RTW_SCR);
 689         scr &= ~(RTW_SCR_KM_MASK | RTW_SCR_TXSECON | RTW_SCR_RXSECON);
 690
 691         if ((sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) == 0)
 692                 goto out;
 693
 694         for (keylen = i = 0; i < IEEE80211_WEP_NKID; i++) {
 695                 if (!rtw_key_hwsupp(sc->sc_flags, &wk[i]))
 696                         continue;
 697                 if (i == ic->ic_def_txkey) {
 698                         keylen = wk[i].wk_keylen;
 699                         break;
 700                 }
 701                 keylen = MAX(keylen, wk[i].wk_keylen);
 702         }
 703
 704         if (keylen == 5)
 705                 scr |= RTW_SCR_KM_WEP40 | RTW_SCR_RXSECON;
 706         else if (keylen == 13)
 707                 scr |= RTW_SCR_KM_WEP104 | RTW_SCR_RXSECON;
 708
 709         for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 710                 if (wk[i].wk_keylen != keylen ||
 711                     wk[i].wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
 712                         continue;
 713                 /* h/w will decrypt, s/w still strips headers */
 714                 wk[i].wk_cipher = &rtw_cipher_wep;
 715                 memcpy(rk->rk_keys[i], wk[i].wk_key, wk[i].wk_keylen);
 716         }
 717 out:
 718         RTW_WRITE8(regs, RTW_PSR, psr & ~RTW_PSR_PSEN);
 719
 720         bus_space_write_region_4(regs->r_bt, regs->r_bh, RTW_DK0, rk->rk_words,
 721                 NELEM(rk->rk_words));
 722
 723         RTW_WBW(regs, RTW_DK0, RTW_PSR);
 724         RTW_WRITE8(regs, RTW_PSR, psr);
 725         RTW_WBW(regs, RTW_PSR, RTW_SCR);
 726         RTW_WRITE8(regs, RTW_SCR, scr);
 727         RTW_SYNC(regs, RTW_SCR, RTW_SCR);
 728         rtw_set_access(sc, RTW_ACCESS_NONE);
 729         sc->sc_flags |= RTW_F_DK_VALID;
 730 }
 731
 732 static int
 733 rtw_recall_eeprom(struct rtw_softc *sc)
 734 {
 735         struct rtw_regs *regs = &sc->sc_regs;
 736         int i;
 737         uint8_t ecr;
 738
 739         ecr = RTW_READ8(regs, RTW_9346CR);
 740         ecr = (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_AUTOLOAD;
 741         RTW_WRITE8(regs, RTW_9346CR, ecr);
 742
 743         RTW_WBR(regs, RTW_9346CR, RTW_9346CR);
 744
 745         /* wait 25ms for completion */
 746         for (i = 0; i < 250; i++) {
 747                 ecr = RTW_READ8(regs, RTW_9346CR);
 748                 if ((ecr & RTW_9346CR_EEM_MASK) == RTW_9346CR_EEM_NORMAL) {
 749                         RTW_DPRINTF(RTW_DEBUG_RESET,
 750                             ("%s: recall EEPROM in %dus\n",
 751                              sc->sc_ic.ic_if.if_xname, i * 100));
 752                         return 0;
 753                 }
 754                 RTW_RBR(regs, RTW_9346CR, RTW_9346CR);
 755                 DELAY(100);
 756         }
 757         if_printf(&sc->sc_ic.ic_if, "recall EEPROM failed\n");
 758         return ETIMEDOUT;
 759 }
 760
 761 static int
 762 rtw_reset(struct rtw_softc *sc)
 763 {
 764         struct rtw_regs *regs = &sc->sc_regs;
 765         uint8_t config1;
 766         int rc;
 767
 768         sc->sc_flags &= ~RTW_F_DK_VALID;
 769
 770         rc = rtw_chip_reset(sc);
 771         if (rc)
 772                 return rc;
 773
 774         rtw_recall_eeprom(sc);  /* ignore err */
 775
 776         config1 = RTW_READ8(regs, RTW_CONFIG1);
 777         RTW_WRITE8(regs, RTW_CONFIG1, config1 & ~RTW_CONFIG1_PMEN);
 778         /* TBD turn off maximum power saving? */
 779         return 0;
 780 }
 781
 782 static int
 783 rtw_srom_parse(struct rtw_softc *sc)
 784 {
 785         struct rtw_srom *sr = &sc->sc_srom;
 786         char scratch[sizeof("unknown 0xXX")];
 787         uint8_t mac[IEEE80211_ADDR_LEN];
 788         const char *rfname, *paname;
 789         uint16_t srom_version;
 790         int i;
 791
 792         sc->sc_flags &= ~(RTW_F_DIGPHY | RTW_F_DFLANTB | RTW_F_ANTDIV);
 793         sc->sc_rcr &= ~(RTW_RCR_ENCS1 | RTW_RCR_ENCS2);
 794
 795         srom_version = RTW_SR_GET16(sr, RTW_SR_VERSION);
 796         if_printf(&sc->sc_ic.ic_if, "SROM version %d.%d",
 797                   srom_version >> 8, srom_version & 0xff);
 798
 799         if (srom_version <= 0x0101) {
 800                 kprintf(" is not understood, limping along with defaults\n");
 801
 802                 /* Default values */
 803                 sc->sc_flags |= (RTW_F_DIGPHY | RTW_F_ANTDIV);
 804                 sc->sc_csthr = RTW_SR_ENERGYDETTHR_DEFAULT;
 805                 sc->sc_rcr |= RTW_RCR_ENCS1;
 806                 sc->sc_rfchipid = RTW_RFCHIPID_PHILIPS;
 807                 return 0;
 808         }
 809         kprintf("\n");
 810
 811         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
 812                 mac[i] = RTW_SR_GET(sr, RTW_SR_MAC + i);
 813
 814         RTW_DPRINTF(RTW_DEBUG_ATTACH,
 815                     ("%s: EEPROM MAC %6D\n", sc->sc_ic.ic_if.if_xname, mac, ":"));
 816
 817         sc->sc_csthr = RTW_SR_GET(sr, RTW_SR_ENERGYDETTHR);
 818
 819         if ((RTW_SR_GET(sr, RTW_SR_CONFIG2) & RTW_CONFIG2_ANT) != 0)
 820                 sc->sc_flags |= RTW_F_ANTDIV;
 821
 822         /*
 823          * Note well: the sense of the RTW_SR_RFPARM_DIGPHY bit seems
 824          * to be reversed.
 825          */
 826         if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DIGPHY) == 0)
 827                 sc->sc_flags |= RTW_F_DIGPHY;
 828         if ((RTW_SR_GET(sr, RTW_SR_RFPARM) & RTW_SR_RFPARM_DFLANTB) != 0)
 829                 sc->sc_flags |= RTW_F_DFLANTB;
 830
 831         sc->sc_rcr |= __SHIFTIN(__SHIFTOUT(RTW_SR_GET(sr, RTW_SR_RFPARM),
 832                                 RTW_SR_RFPARM_CS_MASK), RTW_RCR_ENCS1);
 833
 834         if ((RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_WEP104) != 0)
 835                 sc->sc_flags |= RTW_C_RXWEP_104;
 836
 837         sc->sc_flags |= RTW_C_RXWEP_40; /* XXX */
 838
 839         sc->sc_rfchipid = RTW_SR_GET(sr, RTW_SR_RFCHIPID);
 840         switch (sc->sc_rfchipid) {
 841         case RTW_RFCHIPID_GCT:          /* this combo seen in the wild */
 842                 rfname = "GCT GRF5101";
 843                 paname = "Winspring WS9901";
 844                 break;
 845         case RTW_RFCHIPID_MAXIM:
 846                 rfname = "Maxim MAX2820";       /* guess */
 847                 paname = "Maxim MAX2422";       /* guess */
 848                 break;
 849         case RTW_RFCHIPID_INTERSIL:
 850                 rfname = "Intersil HFA3873";    /* guess */
 851                 paname = "Intersil <unknown>";
 852                 break;
 853         case RTW_RFCHIPID_PHILIPS:      /* this combo seen in the wild */
 854                 rfname = "Philips SA2400A";
 855                 paname = "Philips SA2411";
 856                 break;
 857         case RTW_RFCHIPID_RFMD:
 858                 /* this is the same front-end as an atw(4)! */
 859                 rfname = "RFMD RF2948B, "       /* mentioned in Realtek docs */
 860                          "LNA: RFMD RF2494, "   /* mentioned in Realtek docs */
 861                          "SYN: Silicon Labs Si4126";    /* inferred from
 862                                                          * reference driver
 863                                                          */
 864                 paname = "RFMD RF2189";         /* mentioned in Realtek docs */
 865                 break;
 866         case RTW_RFCHIPID_RESERVED:
 867                 rfname = paname = "reserved";
 868                 break;
 869         default:
 870                 ksnprintf(scratch, sizeof(scratch), "unknown 0x%02x",
 871                          sc->sc_rfchipid);
 872                 rfname = paname = scratch;
 873         }
 874         if_printf(&sc->sc_ic.ic_if, "RF: %s, PA: %s\n", rfname, paname);
 875
 876         switch (RTW_SR_GET(sr, RTW_SR_CONFIG0) & RTW_CONFIG0_GL_MASK) {
 877         case RTW_CONFIG0_GL_USA:
 878         case _RTW_CONFIG0_GL_USA:
 879                 sc->sc_locale = RTW_LOCALE_USA;
 880                 break;
 881         case RTW_CONFIG0_GL_EUROPE:
 882                 sc->sc_locale = RTW_LOCALE_EUROPE;
 883                 break;
 884         case RTW_CONFIG0_GL_JAPAN:
 885                 sc->sc_locale = RTW_LOCALE_JAPAN;
 886                 break;
 887         default:
 888                 sc->sc_locale = RTW_LOCALE_UNKNOWN;
 889                 break;
 890         }
 891         return 0;
 892 }
 893
 894 static int
 895 rtw_srom_read(struct rtw_softc *sc)
 896 {
 897         struct rtw_regs *regs = &sc->sc_regs;
 898         struct rtw_srom *sr = &sc->sc_srom;
 899         struct seeprom_descriptor sd;
 900         uint8_t ecr;
 901         int rc;
 902
 903         memset(&sd, 0, sizeof(sd));
 904
 905         ecr = RTW_READ8(regs, RTW_9346CR);
 906
 907         if ((sc->sc_flags & RTW_F_9356SROM) != 0) {
 908                 RTW_DPRINTF(RTW_DEBUG_ATTACH,
 909                             ("%s: 93c56 SROM\n", sc->sc_ic.ic_if.if_xname));
 910                 sr->sr_size = 256;
 911                 sd.sd_chip = C56_66;
 912         } else {
 913                 RTW_DPRINTF(RTW_DEBUG_ATTACH,
 914                             ("%s: 93c46 SROM\n", sc->sc_ic.ic_if.if_xname));
 915                 sr->sr_size = 128;
 916                 sd.sd_chip = C46;
 917         }
 918
 919         ecr &= ~(RTW_9346CR_EEDI | RTW_9346CR_EEDO | RTW_9346CR_EESK |
 920             RTW_9346CR_EEM_MASK | RTW_9346CR_EECS);
 921         ecr |= RTW_9346CR_EEM_PROGRAM;
 922
 923         RTW_WRITE8(regs, RTW_9346CR, ecr);
 924
 925         sr->sr_content = kmalloc(sr->sr_size, M_DEVBUF, M_WAITOK | M_ZERO);
 926
 927         /*
 928          * RTL8180 has a single 8-bit register for controlling the
 929          * 93cx6 SROM.  There is no "ready" bit. The RTL8180
 930          * input/output sense is the reverse of read_seeprom's.
 931          */
 932         sd.sd_tag = regs->r_bt;
 933         sd.sd_bsh = regs->r_bh;
 934         sd.sd_regsize = 1;
 935         sd.sd_control_offset = RTW_9346CR;
 936         sd.sd_status_offset = RTW_9346CR;
 937         sd.sd_dataout_offset = RTW_9346CR;
 938         sd.sd_CK = RTW_9346CR_EESK;
 939         sd.sd_CS = RTW_9346CR_EECS;
 940         sd.sd_DI = RTW_9346CR_EEDO;
 941         sd.sd_DO = RTW_9346CR_EEDI;
 942         /* make read_seeprom enter EEPROM read/write mode */
 943         sd.sd_MS = ecr;
 944         sd.sd_RDY = 0;
 945
 946         /* TBD bus barriers */
 947         if (!read_seeprom(&sd, sr->sr_content, 0, sr->sr_size / 2)) {
 948                 if_printf(&sc->sc_ic.ic_if, "could not read SROM\n");
 949                 kfree(sr->sr_content, M_DEVBUF);
 950                 sr->sr_content = NULL;
 951                 return EIO;     /* XXX */
 952         }
 953
 954         /* end EEPROM read/write mode */
 955         RTW_WRITE8(regs, RTW_9346CR,
 956                    (ecr & ~RTW_9346CR_EEM_MASK) | RTW_9346CR_EEM_NORMAL);
 957         RTW_WBRW(regs, RTW_9346CR, RTW_9346CR);
 958
 959         rc = rtw_recall_eeprom(sc);
 960         if (rc)
 961                 return rc;
 962
 963 #ifdef RTW_DEBUG
 964         {
 965                 int i;
 966                 RTW_DPRINTF(RTW_DEBUG_ATTACH,
 967                     ("\n%s: serial ROM:\n\t", sc->sc_ic.ic_if.if_xname));
 968                 for (i = 0; i < sr->sr_size/2; i++) {
 969                         if (((i % 8) == 0) && (i != 0))
 970                                 RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n\t"));
 971                         RTW_DPRINTF(RTW_DEBUG_ATTACH,
 972                             (" %04x", sr->sr_content[i]));
 973                 }
 974                 RTW_DPRINTF(RTW_DEBUG_ATTACH, ("\n"));
 975         }
 976 #endif /* RTW_DEBUG */
 977         return 0;
 978 }
 979
 980 static void
 981 rtw_set_rfprog(struct rtw_softc *sc)
 982 {
 983         struct rtw_regs *regs = &sc->sc_regs;
 984         const char *method;
 985         uint8_t cfg4;
 986
 987         cfg4 = RTW_READ8(regs, RTW_CONFIG4) & ~RTW_CONFIG4_RFTYPE_MASK;
 988
 989         switch (sc->sc_rfchipid) {
 990         default:
 991                 cfg4 |= __SHIFTIN(rtw_rfprog_fallback, RTW_CONFIG4_RFTYPE_MASK);
 992                 method = "fallback";
 993                 break;
 994         case RTW_RFCHIPID_INTERSIL:
 995                 cfg4 |= RTW_CONFIG4_RFTYPE_INTERSIL;
 996                 method = "Intersil";
 997                 break;
 998         case RTW_RFCHIPID_PHILIPS:
 999                 cfg4 |= RTW_CONFIG4_RFTYPE_PHILIPS;
1000                 method = "Philips";
1001                 break;
1002         case RTW_RFCHIPID_GCT:  /* XXX a guess */
1003         case RTW_RFCHIPID_RFMD:
1004                 cfg4 |= RTW_CONFIG4_RFTYPE_RFMD;
1005                 method = "RFMD";
1006                 break;
1007         }
1008
1009         RTW_WRITE8(regs, RTW_CONFIG4, cfg4);
1010
1011         RTW_WBR(regs, RTW_CONFIG4, RTW_CONFIG4);
1012
1013         RTW_DPRINTF(RTW_DEBUG_INIT,
1014                     ("%s: %s RF programming method, %#02x\n",
1015                      sc->sc_ic.ic_if.if_xname, method,
1016                      RTW_READ8(regs, RTW_CONFIG4)));
1017 }
1018
1019 static __inline void
1020 rtw_init_channels(struct rtw_softc *sc)
1021 {
1022         const char *name = NULL;
1023         struct ieee80211_channel *chans = sc->sc_ic.ic_channels;
1024         int i;
1025 #define ADD_CHANNEL(_chans, _chan) do {                         \
1026         _chans[_chan].ic_flags = IEEE80211_CHAN_B;              \
1027         _chans[_chan].ic_freq =                                 \
1028             ieee80211_ieee2mhz(_chan, _chans[_chan].ic_flags);  \
1029 } while (0)
1030
1031         switch (sc->sc_locale) {
1032         case RTW_LOCALE_USA:    /* 1-11 */
1033                 name = "USA";
1034                 for (i = 1; i <= 11; i++)
1035                         ADD_CHANNEL(chans, i);
1036                 break;
1037         case RTW_LOCALE_JAPAN:  /* 1-14 */
1038                 name = "Japan";
1039                 ADD_CHANNEL(chans, 14);
1040                 for (i = 1; i <= 14; i++)
1041                         ADD_CHANNEL(chans, i);
1042                 break;
1043         case RTW_LOCALE_EUROPE: /* 1-13 */
1044                 name = "Europe";
1045                 for (i = 1; i <= 13; i++)
1046                         ADD_CHANNEL(chans, i);
1047                 break;
1048         default:                        /* 10-11 allowed by most countries */
1049                 name = "<unknown>";
1050                 for (i = 10; i <= 11; i++)
1051                         ADD_CHANNEL(chans, i);
1052                 break;
1053         }
1054         if_printf(&sc->sc_ic.ic_if, "Geographic Location %s\n", name);
1055 #undef ADD_CHANNEL
1056 }
1057
1058
1059 static void
1060 rtw_identify_country(struct rtw_softc *sc)
1061 {
1062         uint8_t cfg0;
1063
1064         cfg0 = RTW_READ8(&sc->sc_regs, RTW_CONFIG0);
1065         switch (cfg0 & RTW_CONFIG0_GL_MASK) {
1066         case RTW_CONFIG0_GL_USA:
1067         case _RTW_CONFIG0_GL_USA:
1068                 sc->sc_locale = RTW_LOCALE_USA;
1069                 break;
1070         case RTW_CONFIG0_GL_JAPAN:
1071                 sc->sc_locale = RTW_LOCALE_JAPAN;
1072                 break;
1073         case RTW_CONFIG0_GL_EUROPE:
1074                 sc->sc_locale = RTW_LOCALE_EUROPE;
1075                 break;
1076         default:
1077                 sc->sc_locale = RTW_LOCALE_UNKNOWN;
1078                 break;
1079         }
1080 }
1081
1082 static int
1083 rtw_identify_sta(struct rtw_softc *sc)
1084 {
1085         static const uint8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
1086                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1087         };
1088         struct rtw_regs *regs = &sc->sc_regs;
1089         uint8_t *addr = sc->sc_ic.ic_myaddr;
1090         uint32_t idr0, idr1;
1091
1092         idr0 = RTW_READ(regs, RTW_IDR0);
1093         idr1 = RTW_READ(regs, RTW_IDR1);
1094
1095         addr[0] = __SHIFTOUT(idr0, __BITS(0,  7));
1096         addr[1] = __SHIFTOUT(idr0, __BITS(8,  15));
1097         addr[2] = __SHIFTOUT(idr0, __BITS(16, 23));
1098         addr[3] = __SHIFTOUT(idr0, __BITS(24 ,31));
1099
1100         addr[4] = __SHIFTOUT(idr1, __BITS(0,  7));
1101         addr[5] = __SHIFTOUT(idr1, __BITS(8, 15));
1102
1103         if (IEEE80211_ADDR_EQ(addr, empty_macaddr)) {
1104                 if_printf(&sc->sc_ic.ic_if, "could not get mac address\n");
1105                 return ENXIO;
1106         }
1107         return 0;
1108 }
1109
1110 static uint8_t
1111 rtw_chan2txpower(struct rtw_srom *sr, struct ieee80211com *ic,
1112                  struct ieee80211_channel *chan)
1113 {
1114         u_int idx = RTW_SR_TXPOWER1 + ieee80211_chan2ieee(ic, chan) - 1;
1115
1116         KASSERT(idx >= RTW_SR_TXPOWER1 && idx <= RTW_SR_TXPOWER14,
1117                 ("%s: channel %d out of range", __func__,
1118                  idx - RTW_SR_TXPOWER1 + 1));
1119         return RTW_SR_GET(sr, idx);
1120 }
1121
1122 static void
1123 rtw_txdesc_blk_init_all(struct rtw_softc *sc)
1124 {
1125         /* nfree: the number of free descriptors in each ring.
1126          * The beacon ring is a special case: I do not let the
1127          * driver use all of the descriptors on the beacon ring.
1128          * The reasons are two-fold:
1129          *
1130          * (1) A BEACON descriptor's OWN bit is (apparently) not
1131          * updated, so the driver cannot easily know if the descriptor
1132          * belongs to it, or if it is racing the NIC.  If the NIC
1133          * does not OWN every descriptor, then the driver can safely
1134          * update the descriptors when RTW_TBDA points at tdb_next.
1135          *
1136          * (2) I hope that the NIC will process more than one BEACON
1137          * descriptor in a single beacon interval, since that will
1138          * enable multiple-BSS support.  Since the NIC does not
1139          * clear the OWN bit, there is no natural place for it to
1140          * stop processing BEACON desciptors.  Maybe it will *not*
1141          * stop processing them!  I do not want to chance the NIC
1142          * looping around and around a saturated beacon ring, so
1143          * I will leave one descriptor unOWNed at all times.
1144          */
1145         int nfree[RTW_NTXPRI] = {
1146                 RTW_NTXDESCLO,
1147                 RTW_NTXDESCMD,
1148                 RTW_NTXDESCHI,
1149                 RTW_NTXDESCBCN - 1
1150         };
1151         struct rtw_txdesc_blk *tdb;
1152         int pri;
1153
1154         for (tdb = sc->sc_txdesc_blk, pri = 0; pri < RTW_NTXPRI; tdb++, pri++) {
1155                 tdb->tdb_nfree = nfree[pri];
1156                 tdb->tdb_next = 0;
1157
1158                 bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1159                                 BUS_DMASYNC_PREWRITE);
1160         }
1161 }
1162
1163 static void
1164 rtw_txsoft_blk_init_all(struct rtw_softc *sc)
1165 {
1166         struct rtw_txsoft_blk *tsb;
1167         int pri;
1168
1169         for (tsb = sc->sc_txsoft_blk, pri = 0; pri < RTW_NTXPRI; tsb++, pri++) {
1170                 int i;
1171
1172                 STAILQ_INIT(&tsb->tsb_dirtyq);
1173                 STAILQ_INIT(&tsb->tsb_freeq);
1174                 for (i = 0; i < tsb->tsb_ndesc; i++) {
1175                         struct rtw_txsoft *ts;
1176
1177                         ts = &tsb->tsb_desc[i];
1178                         ts->ts_mbuf = NULL;
1179                         STAILQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1180                 }
1181                 tsb->tsb_tx_timer = 0;
1182         }
1183 }
1184
1185 static void
1186 rtw_rxbuf_dma_map(void *arg, bus_dma_segment_t *seg, int nseg,
1187                   bus_size_t mapsize, int error)
1188 {
1189         if (error)
1190                 return;
1191
1192         KASSERT(nseg == 1, ("too many rx mbuf seg\n"));
1193
1194         *((bus_addr_t *)arg) = seg->ds_addr;
1195 }
1196
1197 static int
1198 rtw_rxsoft_alloc(struct rtw_softc *sc, struct rtw_rxsoft *rs, int waitok)
1199 {
1200         bus_addr_t paddr;
1201         bus_dmamap_t map;
1202         struct mbuf *m;
1203         int rc;
1204
1205         m = m_getcl(waitok ? MB_WAIT : MB_DONTWAIT, MT_DATA, M_PKTHDR);
1206         if (m == NULL)
1207                 return ENOBUFS;
1208
1209         m->m_pkthdr.len = m->m_len = MCLBYTES;
1210
1211         rc = bus_dmamap_load_mbuf(sc->sc_rxsoft_dmat, sc->sc_rxsoft_dmamap, m,
1212                                   rtw_rxbuf_dma_map, &paddr,
1213                                   waitok ? BUS_DMA_NOWAIT : BUS_DMA_WAITOK);
1214         if (rc) {
1215                 if_printf(&sc->sc_ic.ic_if, "can't load rx mbuf\n");
1216                 m_freem(m);
1217                 return rc;
1218         }
1219
1220         if (rs->rs_mbuf != NULL)
1221                 bus_dmamap_unload(sc->sc_rxsoft_dmat, rs->rs_dmamap);
1222
1223         /* Swap DMA map */
1224         map = rs->rs_dmamap;
1225         rs->rs_dmamap = sc->sc_rxsoft_dmamap;
1226         sc->sc_rxsoft_dmamap = map;
1227
1228         rs->rs_mbuf = m;
1229         rs->rs_phyaddr = paddr;
1230
1231         bus_dmamap_sync(sc->sc_rxsoft_dmat, rs->rs_dmamap, BUS_DMASYNC_PREREAD);
1232         return 0;
1233 }
1234
1235 static int
1236 rtw_rxsoft_blk_init_all(struct rtw_softc *sc)
1237 {
1238         int i, rc = 0;
1239
1240         for (i = 0; i < RTW_RXQLEN; i++) {
1241                 struct rtw_rxsoft *rs;
1242
1243                 rs = &sc->sc_rxsoft[i];
1244                 /* we're in rtw_init, so there should be no mbufs allocated */
1245                 KKASSERT(rs->rs_mbuf == NULL);
1246 #ifdef RTW_DEBUG
1247                 if (i == rtw_rxbufs_limit) {
1248                         if_printf(&sc->sc_ic.ic_if,
1249                                   "TEST hit %d-buffer limit\n", i);
1250                         rc = ENOBUFS;
1251                         break;
1252                 }
1253 #endif /* RTW_DEBUG */
1254                 rc = rtw_rxsoft_alloc(sc, rs, 1);
1255                 if (rc)
1256                         break;
1257         }
1258         return rc;
1259 }
1260
1261 static void
1262 rtw_rxdesc_init(struct rtw_softc *sc, int idx, int kick)
1263 {
1264         struct rtw_rxdesc_blk *rdb = &sc->sc_rxdesc_blk;
1265         struct rtw_rxdesc *rd = &rdb->rdb_desc[idx];
1266         struct rtw_rxsoft *rs = &sc->sc_rxsoft[idx];
1267         uint32_t ctl;
1268
1269 #ifdef RTW_DEBUG
1270         uint32_t octl, obuf;
1271
1272         obuf = rd->rd_buf;
1273         octl = rd->rd_ctl;
1274 #endif  /* RTW_DEBUG */
1275
1276         rd->rd_buf = htole32(rs->rs_phyaddr);
1277
1278         ctl = __SHIFTIN(rs->rs_mbuf->m_len, RTW_RXCTL_LENGTH_MASK) |
1279               RTW_RXCTL_OWN | RTW_RXCTL_FS | RTW_RXCTL_LS;
1280
1281         if (idx == rdb->rdb_ndesc - 1)
1282                 ctl |= RTW_RXCTL_EOR;
1283
1284         rd->rd_ctl = htole32(ctl);
1285
1286         RTW_DPRINTF(kick ? (RTW_DEBUG_RECV_DESC | RTW_DEBUG_IO_KICK)
1287                          : RTW_DEBUG_RECV_DESC,
1288                     ("%s: rd %p buf %08x -> %08x ctl %08x -> %08x\n",
1289                      sc->sc_ic.ic_if.if_xname, rd, le32toh(obuf),
1290                      le32toh(rd->rd_buf), le32toh(octl), le32toh(rd->rd_ctl)));
1291 }
1292
1293 static void
1294 rtw_rxdesc_blk_init_all(struct rtw_softc *sc)
1295 {
1296         struct rtw_rxdesc_blk *rdb = &sc->sc_rxdesc_blk;
1297         int i;
1298
1299         for (i = 0; i < rdb->rdb_ndesc; i++)
1300                 rtw_rxdesc_init(sc, i, 1);
1301
1302         bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap, BUS_DMASYNC_PREWRITE);
1303 }
1304
1305 static void
1306 rtw_io_enable(struct rtw_softc *sc, uint8_t flags, int enable)
1307 {
1308         struct rtw_regs *regs = &sc->sc_regs;
1309         uint8_t cr;
1310
1311         RTW_DPRINTF(RTW_DEBUG_IOSTATE,
1312                     ("%s: %s 0x%02x\n", sc->sc_ic.ic_if.if_xname,
1313                      enable ? "enable" : "disable", flags));
1314
1315         cr = RTW_READ8(regs, RTW_CR);
1316
1317         /* XXX reference source does not enable MULRW */
1318 #if 0
1319         /* enable PCI Read/Write Multiple */
1320         cr |= RTW_CR_MULRW;
1321 #endif
1322
1323         RTW_RBW(regs, RTW_CR, RTW_CR);  /* XXX paranoia? */
1324         if (enable)
1325                 cr |= flags;
1326         else
1327                 cr &= ~flags;
1328         RTW_WRITE8(regs, RTW_CR, cr);
1329         RTW_SYNC(regs, RTW_CR, RTW_CR);
1330 }
1331
1332 static void
1333 rtw_intr_rx(struct rtw_softc *sc, uint16_t isr)
1334 {
1335 #define IS_BEACON(__fc0)                                                \
1336     ((__fc0 & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==\
1337      (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON))
1338
1339         /*
1340          * convert rates:
1341          * hardware -> net80211
1342          */
1343         static const int ratetbl[4] = { 2, 4, 11, 22 };
1344         struct ifnet *ifp = &sc->sc_if;
1345         struct rtw_rxdesc_blk *rdb = &sc->sc_rxdesc_blk;
1346         int next, nproc = 0, sync = 0;
1347
1348         KKASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1349
1350         bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap, BUS_DMASYNC_POSTREAD);
1351
1352         for (next = rdb->rdb_next; ; next = (next + 1) % rdb->rdb_ndesc) {
1353                 struct ieee80211_node *ni;
1354                 struct ieee80211_frame_min *wh;
1355                 struct rtw_rxdesc *rd;
1356                 struct rtw_rxsoft *rs;
1357                 struct mbuf *m;
1358                 int hwrate, len, rate, rssi, sq, error;
1359                 uint32_t hrssi, hstat, htsfth, htsftl;
1360
1361                 rd = &rdb->rdb_desc[next];
1362                 rs = &sc->sc_rxsoft[next];
1363
1364                 hstat = le32toh(rd->rd_stat);
1365                 hrssi = le32toh(rd->rd_rssi);
1366                 htsfth = le32toh(rd->rd_tsfth);
1367                 htsftl = le32toh(rd->rd_tsftl);
1368
1369                 RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1370                             ("%s: rxdesc[%d] hstat %08x hrssi %08x "
1371                              "htsft %08x%08x\n", ifp->if_xname,
1372                              next, hstat, hrssi, htsfth, htsftl));
1373
1374                 ++nproc;
1375
1376                 /* still belongs to NIC */
1377                 if (hstat & RTW_RXSTAT_OWN) {
1378                         if (nproc > 1)
1379                                 break;
1380
1381                         /* sometimes the NIC skips to the 0th descriptor */
1382                         rd = &rdb->rdb_desc[0];
1383                         if (rd->rd_stat & htole32(RTW_RXSTAT_OWN))
1384                                 break;
1385                         RTW_DPRINTF(RTW_DEBUG_BUGS,
1386                                     ("%s: NIC skipped from rxdesc[%u] "
1387                                      "to rxdesc[0]\n", ifp->if_xname, next));
1388                         next = rdb->rdb_ndesc - 1;
1389                         continue;
1390                 }
1391
1392 #ifdef RTW_DEBUG
1393 #define PRINTSTAT(flag) do { \
1394         if ((hstat & flag) != 0) { \
1395                 kprintf("%s" #flag, delim); \
1396                 delim = ","; \
1397         } \
1398 } while (0)
1399                 if (rtw_debug & RTW_DEBUG_RECV_DESC) {
1400                         const char *delim = "<";
1401
1402                         if_printf(ifp, "%s", "");
1403                         if ((hstat & RTW_RXSTAT_DEBUG) != 0) {
1404                                 kprintf("status %08x", hstat);
1405                                 PRINTSTAT(RTW_RXSTAT_SPLCP);
1406                                 PRINTSTAT(RTW_RXSTAT_MAR);
1407                                 PRINTSTAT(RTW_RXSTAT_PAR);
1408                                 PRINTSTAT(RTW_RXSTAT_BAR);
1409                                 PRINTSTAT(RTW_RXSTAT_PWRMGT);
1410                                 PRINTSTAT(RTW_RXSTAT_CRC32);
1411                                 PRINTSTAT(RTW_RXSTAT_ICV);
1412                                 kprintf(">, ");
1413                         }
1414                 }
1415 #endif /* RTW_DEBUG */
1416
1417                 if (hstat & RTW_RXSTAT_IOERROR) {
1418                         if_printf(ifp, "DMA error/FIFO overflow %08x, "
1419                                   "rx descriptor %d\n",
1420                                   hstat & RTW_RXSTAT_IOERROR, next);
1421                         ifp->if_ierrors++;
1422                         goto next;
1423                 }
1424
1425                 len = __SHIFTOUT(hstat, RTW_RXSTAT_LENGTH_MASK);
1426                 if (len < IEEE80211_MIN_LEN) {
1427                         sc->sc_ic.ic_stats.is_rx_tooshort++;
1428                         goto next;
1429                 }
1430
1431                 /* CRC is included with the packet; trim it off. */
1432                 len -= IEEE80211_CRC_LEN;
1433
1434                 hwrate = __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK);
1435                 if (hwrate >= NELEM(ratetbl)) {
1436                         if_printf(ifp, "unknown rate #%d\n",
1437                                   __SHIFTOUT(hstat, RTW_RXSTAT_RATE_MASK));
1438                         ifp->if_ierrors++;
1439                         goto next;
1440                 }
1441                 rate = ratetbl[hwrate];
1442
1443 #ifdef RTW_DEBUG
1444                 RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1445                             ("%s rate %d.%d Mb/s, time %08x%08x\n",
1446                              ifp->if_xname, (rate * 5) / 10,
1447                              (rate * 5) % 10, htsfth, htsftl));
1448 #endif /* RTW_DEBUG */
1449
1450                 if ((hstat & RTW_RXSTAT_RES) &&
1451                     sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
1452                         goto next;
1453
1454                 /* if bad flags, skip descriptor */
1455                 if ((hstat & RTW_RXSTAT_ONESEG) != RTW_RXSTAT_ONESEG) {
1456                         if_printf(ifp, "too many rx segments\n");
1457                         goto next;
1458                 }
1459
1460                 bus_dmamap_sync(sc->sc_rxsoft_dmat, rs->rs_dmamap,
1461                                 BUS_DMASYNC_POSTREAD);
1462
1463                 m = rs->rs_mbuf;
1464
1465                 /* if temporarily out of memory, re-use mbuf */
1466                 error = rtw_rxsoft_alloc(sc, rs, 0);
1467                 if (error) {
1468                         if_printf(ifp, "%s: rtw_rxsoft_alloc(, %d) failed, "
1469                             "dropping packet\n", ifp->if_xname, next);
1470                         goto next;
1471                 }
1472
1473                 rssi = __SHIFTOUT(hrssi, RTW_RXRSSI_RSSI);
1474                 sq = __SHIFTOUT(hrssi, RTW_RXRSSI_SQ);
1475
1476                 rssi = rtw_get_rssi(sc, rssi, sq);
1477
1478                 /*
1479                  * Note well: now we cannot recycle the rs_mbuf unless
1480                  * we restore its original length.
1481                  */
1482                 m->m_pkthdr.rcvif = ifp;
1483                 m->m_pkthdr.len = m->m_len = len;
1484
1485                 wh = mtod(m, struct ieee80211_frame_min *);
1486
1487                 if (!IS_BEACON(wh->i_fc[0]))
1488                         sc->sc_led_state.ls_event |= RTW_LED_S_RX;
1489
1490                 /* TBD use _MAR, _BAR, _PAR flags as hints to _find_rxnode? */
1491                 ni = ieee80211_find_rxnode(&sc->sc_ic, wh);
1492
1493                 sc->sc_tsfth = htsfth;
1494
1495 #ifdef RTW_DEBUG
1496                 if ((ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==
1497                     (IFF_DEBUG | IFF_LINK2)) {
1498                         ieee80211_dump_pkt(mtod(m, uint8_t *), m->m_pkthdr.len,
1499                                            rate, rssi);
1500                 }
1501 #endif /* RTW_DEBUG */
1502
1503                 if (sc->sc_radiobpf != NULL) {
1504                         struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
1505
1506                         rr->rr_tsft =
1507                             htole64(((uint64_t)htsfth << 32) | htsftl);
1508
1509                         if ((hstat & RTW_RXSTAT_SPLCP) != 0)
1510                                 rr->rr_flags = IEEE80211_RADIOTAP_F_SHORTPRE;
1511
1512                         rr->rr_flags = 0;
1513                         rr->rr_rate = rate;
1514                         rr->rr_antsignal = rssi;
1515                         rr->rr_barker_lock = htole16(sq);
1516
1517                         bpf_ptap(sc->sc_radiobpf, m, rr, sizeof(sc->sc_rxtapu));
1518                 }
1519
1520                 ieee80211_input(&sc->sc_ic, m, ni, rssi, htsftl);
1521                 ieee80211_free_node(ni);
1522 next:
1523                 rtw_rxdesc_init(sc, next, 0);
1524                 sync = 1;
1525         }
1526
1527         if (sync) {
1528                 bus_dmamap_sync(rdb->rdb_dmat, rdb->rdb_dmamap,
1529                                 BUS_DMASYNC_PREWRITE);
1530         }
1531
1532         rdb->rdb_next = next;
1533         KKASSERT(rdb->rdb_next < rdb->rdb_ndesc);
1534 #undef IS_BEACON
1535 }
1536
1537 static __inline void
1538 rtw_txsoft_release(bus_dma_tag_t dmat, struct rtw_txsoft *ts,
1539                    int data_retry, int rts_retry, int error, int ratectl)
1540 {
1541         struct mbuf *m;
1542         struct ieee80211_node *ni;
1543
1544         if (!ts->ts_ratectl)
1545                 ratectl = 0;
1546
1547         m = ts->ts_mbuf;
1548         ni = ts->ts_ni;
1549         KKASSERT(m != NULL);
1550         KKASSERT(ni != NULL);
1551         ts->ts_mbuf = NULL;
1552         ts->ts_ni = NULL;
1553
1554         if (ratectl) {
1555                 struct ieee80211_ratectl_res rc_res;
1556
1557                 rc_res.rc_res_rateidx = ts->ts_rateidx;
1558                 rc_res.rc_res_tries = data_retry + 1;
1559
1560                 ieee80211_ratectl_tx_complete(ni, m->m_pkthdr.len,
1561                                               &rc_res, 1,
1562                                               data_retry, rts_retry,
1563                                               error);
1564         }
1565
1566         bus_dmamap_sync(dmat, ts->ts_dmamap, BUS_DMASYNC_POSTWRITE);
1567         bus_dmamap_unload(dmat, ts->ts_dmamap);
1568         m_freem(m);
1569         ieee80211_free_node(ni);
1570 }
1571
1572 static __inline void
1573 rtw_collect_txpkt(struct rtw_softc *sc, struct rtw_txdesc_blk *tdb,
1574                   struct rtw_txsoft *ts, int ndesc)
1575 {
1576         uint32_t hstat;
1577         int data_retry, rts_retry, error;
1578         struct rtw_txdesc *tdn;
1579         const char *condstring;
1580         struct ifnet *ifp = &sc->sc_if;
1581
1582         tdb->tdb_nfree += ndesc;
1583
1584         tdn = &tdb->tdb_desc[ts->ts_last];
1585
1586         hstat = le32toh(tdn->td_stat);
1587         rts_retry = __SHIFTOUT(hstat, RTW_TXSTAT_RTSRETRY_MASK);
1588         data_retry = __SHIFTOUT(hstat, RTW_TXSTAT_DRC_MASK);
1589
1590         ifp->if_collisions += rts_retry + data_retry;
1591
1592         if ((hstat & RTW_TXSTAT_TOK) != 0) {
1593                 condstring = "ok";
1594                 error = 0;
1595         } else {
1596                 ifp->if_oerrors++;
1597                 condstring = "error";
1598                 error = 1;
1599         }
1600
1601         rtw_txsoft_release(sc->sc_txsoft_dmat, ts, data_retry, rts_retry,
1602                            error, 1);
1603
1604         DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
1605                 ("%s: ts %p txdesc[%d, %d] %s tries rts %u data %u\n",
1606                  ifp->if_xname, ts, ts->ts_first, ts->ts_last,
1607                  condstring, rts_retry, data_retry));
1608 }
1609
1610 static void
1611 rtw_reset_oactive(struct rtw_softc *sc)
1612 {
1613         int pri;
1614 #ifdef RTW_DEBUG
1615         short oflags = sc->sc_if.if_flags;
1616 #endif
1617
1618         for (pri = 0; pri < RTW_NTXPRI; pri++) {
1619                 struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[pri];
1620                 struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[pri];
1621
1622                 if (!STAILQ_EMPTY(&tsb->tsb_freeq) && tdb->tdb_nfree > 0)
1623                         sc->sc_if.if_flags &= ~IFF_OACTIVE;
1624         }
1625
1626 #ifdef RTW_DEBUG
1627         if (oflags != sc->sc_if.if_flags) {
1628                 DPRINTF(sc, RTW_DEBUG_OACTIVE,
1629                         ("%s: reset OACTIVE\n", sc->sc_ic.ic_if.if_xname));
1630         }
1631 #endif
1632 }
1633
1634 /* Collect transmitted packets. */
1635 static __inline void
1636 rtw_collect_txring(struct rtw_softc *sc, struct rtw_txsoft_blk *tsb,
1637                    struct rtw_txdesc_blk *tdb, int force)
1638 {
1639         struct rtw_txsoft *ts;
1640         int ndesc;
1641
1642         while ((ts = STAILQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
1643                 ndesc = 1 + ts->ts_last - ts->ts_first;
1644                 if (ts->ts_last < ts->ts_first)
1645                         ndesc += tdb->tdb_ndesc;
1646
1647                 KKASSERT(ndesc > 0);
1648
1649                 bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1650                                 BUS_DMASYNC_POSTREAD);
1651
1652                 if (force) {
1653                         int i;
1654
1655                         for (i = ts->ts_first; ; i = RTW_NEXT_IDX(tdb, i)) {
1656                                 tdb->tdb_desc[i].td_stat &=
1657                                         ~htole32(RTW_TXSTAT_OWN);
1658                                 if (i == ts->ts_last)
1659                                         break;
1660                         }
1661                         bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
1662                                         BUS_DMASYNC_PREWRITE);
1663                 } else if ((tdb->tdb_desc[ts->ts_last].td_stat &
1664                             htole32(RTW_TXSTAT_OWN)) != 0) {
1665                         break;
1666                 }
1667
1668                 rtw_collect_txpkt(sc, tdb, ts, ndesc);
1669                 STAILQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
1670                 STAILQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
1671         }
1672         /* no more pending transmissions, cancel watchdog */
1673         if (ts == NULL)
1674                 tsb->tsb_tx_timer = 0;
1675         rtw_reset_oactive(sc);
1676 }
1677
1678 static void
1679 rtw_intr_tx(struct rtw_softc *sc, uint16_t isr)
1680 {
1681         int pri;
1682
1683         for (pri = 0; pri < RTW_NTXPRI; pri++) {
1684                 rtw_collect_txring(sc, &sc->sc_txsoft_blk[pri],
1685                                    &sc->sc_txdesc_blk[pri], 0);
1686         }
1687         if (isr)
1688                 rtw_start(&sc->sc_ic.ic_if);
1689 }
1690
1691 static __inline struct mbuf *
1692 rtw_beacon_alloc(struct rtw_softc *sc, struct ieee80211_node *ni)
1693 {
1694         struct ieee80211com *ic = &sc->sc_ic;
1695         struct ieee80211_beacon_offsets boff;
1696         struct mbuf *m;
1697
1698         m = ieee80211_beacon_alloc(ic, ni, &boff);
1699         if (m != NULL) {
1700                 RTW_DPRINTF(RTW_DEBUG_BEACON,
1701                             ("%s: m %p len %u\n", ic->ic_if.if_xname, m,
1702                              m->m_len));
1703         }
1704         return m;
1705 }
1706
1707 static void
1708 rtw_intr_beacon(struct rtw_softc *sc, uint16_t isr)
1709 {
1710         struct ieee80211com *ic = &sc->sc_ic;
1711         struct rtw_regs *regs = &sc->sc_regs;
1712         struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[RTW_TXPRIBCN];
1713         struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[RTW_TXPRIBCN];
1714
1715 #ifdef RTW_DEBUG
1716         uint32_t tsfth, tsftl;
1717
1718         tsfth = RTW_READ(regs, RTW_TSFTRH);
1719         tsftl = RTW_READ(regs, RTW_TSFTRL);
1720 #endif
1721
1722         if (isr & (RTW_INTR_TBDOK | RTW_INTR_TBDER)) {
1723 #ifdef RTW_DEBUG
1724                 int next = rtw_txring_next(regs, tdb);
1725 #endif
1726
1727                 RTW_DPRINTF(RTW_DEBUG_BEACON,
1728                             ("%s: beacon ring %sprocessed, "
1729                              "isr = %#04x, next %d expected %d, %llu\n",
1730                              ic->ic_if.if_xname,
1731                              (next == tdb->tdb_next) ? "" : "un",
1732                              isr, next, tdb->tdb_next,
1733                              (uint64_t)tsfth << 32 | tsftl));
1734
1735                 if ((RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_BQ) == 0){
1736                         rtw_collect_txring(sc, tsb, tdb, 1);
1737                         tdb->tdb_next = 0;
1738                 }
1739         }
1740         /* Start beacon transmission. */
1741
1742         if ((isr & RTW_INTR_BCNINT) && ic->ic_state == IEEE80211_S_RUN &&
1743             STAILQ_EMPTY(&tsb->tsb_dirtyq)) {
1744                 struct mbuf *m;
1745
1746                 RTW_DPRINTF(RTW_DEBUG_BEACON,
1747                             ("%s: beacon prep. time, isr = %#04x, %llu\n",
1748                              ic->ic_if.if_xname, isr,
1749                              (uint64_t)tsfth << 32 | tsftl));
1750
1751                 m = rtw_beacon_alloc(sc, ic->ic_bss);
1752                 if (m == NULL) {
1753                         if_printf(&ic->ic_if, "could not allocate beacon\n");
1754                         return;
1755                 }
1756
1757                 m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
1758
1759                 IF_ENQUEUE(&sc->sc_beaconq, m);
1760
1761                 rtw_start(&ic->ic_if);
1762         }
1763 }
1764
1765 static void
1766 rtw_intr_atim(struct rtw_softc *sc)
1767 {
1768         /* TBD */
1769         return;
1770 }
1771
1772 #ifdef RTW_DEBUG
1773 static void
1774 rtw_dump_rings(struct rtw_softc *sc)
1775 {
1776         struct rtw_rxdesc_blk *rdb;
1777         int desc, pri;
1778
1779         if ((rtw_debug & RTW_DEBUG_IO_KICK) == 0)
1780                 return;
1781
1782         for (pri = 0; pri < RTW_NTXPRI; pri++) {
1783                 struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[pri];
1784
1785                 if_printf(&sc->sc_ic.ic_if, "txpri %d ndesc %d nfree %d\n",
1786                           pri, tdb->tdb_ndesc, tdb->tdb_nfree);
1787                 for (desc = 0; desc < tdb->tdb_ndesc; desc++)
1788                         rtw_print_txdesc(sc, ".", NULL, tdb, desc);
1789         }
1790
1791         rdb = &sc->sc_rxdesc_blk;
1792
1793         for (desc = 0; desc < RTW_RXQLEN; desc++) {
1794                 struct rtw_rxdesc *rd = &rdb->rdb_desc[desc];
1795
1796                 if_printf(&sc->sc_ic.ic_if,
1797                           "%sctl %08x rsvd0/rssi %08x buf/tsftl %08x "
1798                           "rsvd1/tsfth %08x\n",
1799                           (desc >= rdb->rdb_ndesc) ? "UNUSED " : "",
1800                           le32toh(rd->rd_ctl), le32toh(rd->rd_rssi),
1801                           le32toh(rd->rd_buf), le32toh(rd->rd_tsfth));
1802         }
1803 }
1804 #endif /* RTW_DEBUG */
1805
1806 static void
1807 rtw_hwring_setup(struct rtw_softc *sc)
1808 {
1809         struct rtw_regs *regs = &sc->sc_regs;
1810         struct rtw_rxdesc_blk *rdb = &sc->sc_rxdesc_blk;
1811         int pri;
1812
1813         for (pri = 0; pri < RTW_NTXPRI; pri++) {
1814                 struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[pri];
1815
1816                 RTW_WRITE(regs, tdb->tdb_basereg, tdb->tdb_base);
1817                 RTW_DPRINTF(RTW_DEBUG_XMIT_DESC,
1818                             ("%s: reg[tdb->tdb_basereg] <- %u\n",
1819                              sc->sc_ic.ic_if.if_xname, tdb->tdb_base));
1820         }
1821
1822         RTW_WRITE(regs, RTW_RDSAR, rdb->rdb_base);
1823         RTW_DPRINTF(RTW_DEBUG_RECV_DESC,
1824                     ("%s: reg[RDSAR] <- %u\n", sc->sc_ic.ic_if.if_xname,
1825                      rdb->rdb_base));
1826
1827         RTW_SYNC(regs, RTW_TLPDA, RTW_RDSAR);
1828 }
1829
1830 static int
1831 rtw_swring_setup(struct rtw_softc *sc)
1832 {
1833         int rc;
1834
1835         rtw_txdesc_blk_init_all(sc);
1836         rtw_txsoft_blk_init_all(sc);
1837
1838         rc = rtw_rxsoft_blk_init_all(sc);
1839         if (rc) {
1840                 if_printf(&sc->sc_ic.ic_if, "could not allocate rx buffers\n");
1841                 return rc;
1842         }
1843
1844         rtw_rxdesc_blk_init_all(sc);
1845         sc->sc_rxdesc_blk.rdb_next = 0;
1846         return 0;
1847 }
1848
1849 static int
1850 rtw_txring_next(struct rtw_regs *regs, struct rtw_txdesc_blk *tdb)
1851 {
1852         return (le32toh(RTW_READ(regs, tdb->tdb_basereg)) - tdb->tdb_base) /
1853                 sizeof(struct rtw_txdesc);
1854 }
1855
1856 static void
1857 rtw_txring_fixup(struct rtw_softc *sc)
1858 {
1859         struct rtw_regs *regs = &sc->sc_regs;
1860         int pri;
1861
1862         for (pri = 0; pri < RTW_NTXPRI; pri++) {
1863                 struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[pri];
1864                 int next;
1865
1866                 next = rtw_txring_next(regs, tdb);
1867                 if (tdb->tdb_next == next)
1868                         continue;
1869                 if_printf(&sc->sc_ic.ic_if,
1870                           "tx-ring %d expected next %d, read %d\n",
1871                           pri, tdb->tdb_next, next);
1872                 tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
1873         }
1874 }
1875
1876 static void
1877 rtw_rxring_fixup(struct rtw_softc *sc)
1878 {
1879         struct rtw_rxdesc_blk *rdb = &sc->sc_rxdesc_blk;
1880         uint32_t rdsar;
1881         int next;
1882
1883         rdsar = le32toh(RTW_READ(&sc->sc_regs, RTW_RDSAR));
1884         next = (rdsar - rdb->rdb_base) / sizeof(struct rtw_rxdesc);
1885
1886         if (rdb->rdb_next != next) {
1887                 if_printf(&sc->sc_ic.ic_if,
1888                           "rx-ring expected next %d, read %d\n",
1889                           rdb->rdb_next, next);
1890                 rdb->rdb_next = MIN(next, rdb->rdb_ndesc - 1);
1891         }
1892 }
1893
1894 static void
1895 rtw_txdesc_blk_reset_all(struct rtw_softc *sc)
1896 {
1897         int pri;
1898
1899         for (pri = 0; pri < RTW_NTXPRI; pri++) {
1900                 rtw_collect_txring(sc, &sc->sc_txsoft_blk[pri],
1901                                    &sc->sc_txdesc_blk[pri], 1);
1902         }
1903 }
1904
1905 static void
1906 rtw_intr_ioerror(struct rtw_softc *sc, uint16_t isr)
1907 {
1908         struct rtw_regs *regs = &sc->sc_regs;
1909         int xmtr = 0, rcvr = 0;
1910         uint8_t cr = 0;
1911
1912         if (isr & RTW_INTR_TXFOVW) {
1913                 if_printf(&sc->sc_ic.ic_if, "tx fifo underflow\n");
1914                 rcvr = xmtr = 1;
1915                 cr |= RTW_CR_TE | RTW_CR_RE;
1916         }
1917
1918         if (isr & (RTW_INTR_RDU | RTW_INTR_RXFOVW)) {
1919                 cr |= RTW_CR_RE;
1920                 rcvr = 1;
1921         }
1922
1923         RTW_DPRINTF(RTW_DEBUG_BUGS,
1924                     ("%s: restarting xmit/recv, isr %04x\n",
1925                      sc->sc_ic.ic_if.if_xname, isr));
1926
1927 #ifdef RTW_DEBUG
1928         rtw_dump_rings(sc);
1929 #endif /* RTW_DEBUG */
1930
1931         rtw_io_enable(sc, cr, 0);
1932
1933         /* Collect rx'd packets.  Refresh rx buffers. */
1934         if (rcvr)
1935                 rtw_intr_rx(sc, 0);
1936
1937         /*
1938          * Collect tx'd packets.
1939          * XXX let's hope this stops the transmit timeouts.
1940          */
1941         if (xmtr)
1942                 rtw_txdesc_blk_reset_all(sc);
1943
1944         RTW_WRITE16(regs, RTW_IMR, 0);
1945         RTW_SYNC(regs, RTW_IMR, RTW_IMR);
1946
1947         if (rtw_do_chip_reset) {
1948                 rtw_chip_reset1(sc);
1949                 rtw_wep_setkeys(sc);
1950         }
1951
1952         rtw_rxdesc_blk_init_all(sc);
1953
1954 #ifdef RTW_DEBUG
1955         rtw_dump_rings(sc);
1956 #endif /* RTW_DEBUG */
1957
1958         RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
1959         RTW_SYNC(regs, RTW_IMR, RTW_IMR);
1960
1961         if (rcvr)
1962                 rtw_rxring_fixup(sc);
1963
1964         rtw_io_enable(sc, cr, 1);
1965
1966         if (xmtr)
1967                 rtw_txring_fixup(sc);
1968 }
1969
1970 static __inline void
1971 rtw_suspend_ticks(struct rtw_softc *sc)
1972 {
1973         RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
1974                     ("%s: suspending ticks\n", sc->sc_ic.ic_if.if_xname));
1975         sc->sc_do_tick = 0;
1976 }
1977
1978 static void
1979 rtw_resume_ticks(struct rtw_softc *sc)
1980 {
1981         uint32_t tsftrl0, tsftrl1, next_tick;
1982         struct rtw_regs *regs = &sc->sc_regs;
1983
1984         tsftrl0 = RTW_READ(regs, RTW_TSFTRL);
1985
1986         tsftrl1 = RTW_READ(regs, RTW_TSFTRL);
1987         next_tick = tsftrl1 + 1000000;
1988         RTW_WRITE(regs, RTW_TINT, next_tick);
1989
1990         sc->sc_do_tick = 1;
1991
1992         RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
1993                     ("%s: resume ticks delta %#08x now %#08x next %#08x\n",
1994                      sc->sc_ic.ic_if.if_xname, tsftrl1 - tsftrl0, tsftrl1,
1995                      next_tick));
1996 }
1997
1998 static void
1999 rtw_intr_timeout(struct rtw_softc *sc)
2000 {
2001         RTW_DPRINTF(RTW_DEBUG_TIMEOUT,
2002                     ("%s: timeout\n", sc->sc_ic.ic_if.if_xname));
2003         if (sc->sc_do_tick)
2004                 rtw_resume_ticks(sc);
2005 }
2006
2007 static void
2008 rtw_intr(void *arg)
2009 {
2010         struct rtw_softc *sc = arg;
2011         struct rtw_regs *regs = &sc->sc_regs;
2012         struct ifnet *ifp = &sc->sc_if;
2013         int i;
2014
2015         /*
2016          * If the interface isn't running, the interrupt couldn't
2017          * possibly have come from us.
2018          */
2019         if ((sc->sc_flags & RTW_F_ENABLED) == 0 ||
2020             (ifp->if_flags & IFF_RUNNING) == 0) {
2021                 RTW_DPRINTF(RTW_DEBUG_INTR,
2022                             ("%s: stray interrupt\n", ifp->if_xname));
2023                 return;
2024         }
2025
2026         for (i = 0; i < 10; i++) {
2027                 uint16_t isr;
2028
2029                 isr = RTW_READ16(regs, RTW_ISR);
2030
2031                 RTW_WRITE16(regs, RTW_ISR, isr);
2032                 RTW_WBR(regs, RTW_ISR, RTW_ISR);
2033
2034                 if (sc->sc_intr_ack != NULL)
2035                         sc->sc_intr_ack(regs);
2036
2037                 if (isr == 0)
2038                         break;
2039
2040 #ifdef RTW_DEBUG
2041 #define PRINTINTR(flag) do { \
2042         if ((isr & flag) != 0) { \
2043                 kprintf("%s" #flag, delim); \
2044                 delim = ","; \
2045         } \
2046 } while (0)
2047
2048                 if ((rtw_debug & RTW_DEBUG_INTR) != 0 && isr != 0) {
2049                         const char *delim = "<";
2050
2051                         if_printf(ifp, "reg[ISR] = %x", isr);
2052
2053                         PRINTINTR(RTW_INTR_TXFOVW);
2054                         PRINTINTR(RTW_INTR_TIMEOUT);
2055                         PRINTINTR(RTW_INTR_BCNINT);
2056                         PRINTINTR(RTW_INTR_ATIMINT);
2057                         PRINTINTR(RTW_INTR_TBDER);
2058                         PRINTINTR(RTW_INTR_TBDOK);
2059                         PRINTINTR(RTW_INTR_THPDER);
2060                         PRINTINTR(RTW_INTR_THPDOK);
2061                         PRINTINTR(RTW_INTR_TNPDER);
2062                         PRINTINTR(RTW_INTR_TNPDOK);
2063                         PRINTINTR(RTW_INTR_RXFOVW);
2064                         PRINTINTR(RTW_INTR_RDU);
2065                         PRINTINTR(RTW_INTR_TLPDER);
2066                         PRINTINTR(RTW_INTR_TLPDOK);
2067                         PRINTINTR(RTW_INTR_RER);
2068                         PRINTINTR(RTW_INTR_ROK);
2069
2070                         kprintf(">\n");
2071                 }
2072 #undef PRINTINTR
2073 #endif /* RTW_DEBUG */
2074
2075                 if (isr & RTW_INTR_RX)
2076                         rtw_intr_rx(sc, isr & RTW_INTR_RX);
2077                 if (isr & RTW_INTR_TX)
2078                         rtw_intr_tx(sc, isr & RTW_INTR_TX);
2079                 if (isr & RTW_INTR_BEACON)
2080                         rtw_intr_beacon(sc, isr & RTW_INTR_BEACON);
2081                 if (isr & RTW_INTR_ATIMINT)
2082                         rtw_intr_atim(sc);
2083                 if (isr & RTW_INTR_IOERROR)
2084                         rtw_intr_ioerror(sc, isr & RTW_INTR_IOERROR);
2085                 if (isr & RTW_INTR_TIMEOUT)
2086                         rtw_intr_timeout(sc);
2087         }
2088 }
2089
2090 /* Must be called at splnet. */
2091 void
2092 rtw_stop(struct rtw_softc *sc, int disable)
2093 {
2094         struct ieee80211com *ic = &sc->sc_ic;
2095         struct ifnet *ifp = &ic->ic_if;
2096         struct rtw_regs *regs = &sc->sc_regs;
2097         int i;
2098
2099         if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2100                 return;
2101
2102         rtw_suspend_ticks(sc);
2103
2104         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2105
2106         if ((sc->sc_flags & RTW_F_INVALID) == 0) {
2107                 /* Disable interrupts. */
2108                 RTW_WRITE16(regs, RTW_IMR, 0);
2109
2110                 RTW_WBW(regs, RTW_TPPOLL, RTW_IMR);
2111
2112                 /*
2113                  * Stop the transmit and receive processes. First stop DMA,
2114                  * then disable receiver and transmitter.
2115                  */
2116                 RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
2117
2118                 RTW_SYNC(regs, RTW_TPPOLL, RTW_IMR);
2119
2120                 rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2121         }
2122
2123         /* Free pending TX mbufs */
2124         for (i = 0; i < RTW_NTXPRI; ++i) {
2125                 struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[i];
2126                 struct rtw_txsoft *ts;
2127
2128                 while ((ts = STAILQ_FIRST(&tsb->tsb_dirtyq)) != NULL) {
2129                         rtw_txsoft_release(sc->sc_txsoft_dmat, ts, 0, 0, 0, 0);
2130                         STAILQ_REMOVE_HEAD(&tsb->tsb_dirtyq, ts_q);
2131                         STAILQ_INSERT_TAIL(&tsb->tsb_freeq, ts, ts_q);
2132                 }
2133                 tsb->tsb_tx_timer = 0;
2134         }
2135
2136         /* Free pending RX mbufs */
2137         for (i = 0; i < RTW_RXQLEN; i++) {
2138                 struct rtw_rxsoft *rs = &sc->sc_rxsoft[i];
2139
2140                 if (rs->rs_mbuf != NULL) {
2141                         bus_dmamap_sync(sc->sc_rxsoft_dmat, rs->rs_dmamap,
2142                                         BUS_DMASYNC_POSTREAD);
2143                         bus_dmamap_unload(sc->sc_rxsoft_dmat, rs->rs_dmamap);
2144                         m_freem(rs->rs_mbuf);
2145                         rs->rs_mbuf = NULL;
2146                 }
2147         }
2148
2149         if (disable)
2150                 rtw_disable(sc);
2151
2152         /* Mark the interface as not running.  Cancel the watchdog timer. */
2153         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2154         ifp->if_timer = 0;
2155 }
2156
2157 #ifdef RTW_DEBUG
2158 const char *
2159 rtw_pwrstate_string(enum rtw_pwrstate power)
2160 {
2161         switch (power) {
2162         case RTW_ON:
2163                 return "on";
2164         case RTW_SLEEP:
2165                 return "sleep";
2166         case RTW_OFF:
2167                 return "off";
2168         default:
2169                 return "unknown";
2170         }
2171 }
2172 #endif  /* RTW_DEBUG */
2173
2174 /*
2175  * XXX For Maxim, I am using the RFMD settings gleaned from the
2176  * reference driver, plus a magic Maxim "ON" value that comes from
2177  * the Realtek document "Windows PG for Rtl8180."
2178  */
2179 static void
2180 rtw_maxim_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2181                    int before_rf, int digphy)
2182 {
2183         uint32_t anaparm;
2184
2185         anaparm = RTW_READ(regs, RTW_ANAPARM);
2186         anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2187
2188         switch (power) {
2189         case RTW_OFF:
2190                 if (before_rf)
2191                         return;
2192                 anaparm |= RTW_ANAPARM_RFPOW_MAXIM_OFF;
2193                 anaparm |= RTW_ANAPARM_TXDACOFF;
2194                 break;
2195         case RTW_SLEEP:
2196                 if (!before_rf)
2197                         return;
2198                 anaparm |= RTW_ANAPARM_RFPOW_MAXIM_SLEEP;
2199                 anaparm |= RTW_ANAPARM_TXDACOFF;
2200                 break;
2201         case RTW_ON:
2202                 if (!before_rf)
2203                         return;
2204                 anaparm |= RTW_ANAPARM_RFPOW_MAXIM_ON;
2205                 break;
2206         }
2207         RTW_DPRINTF(RTW_DEBUG_PWR,
2208             ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2209             __func__, rtw_pwrstate_string(power),
2210             (before_rf) ? "before" : "after", anaparm));
2211
2212         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2213         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2214 }
2215
2216 /* XXX I am using the RFMD settings gleaned from the reference
2217  * driver.  They agree
2218  */
2219 static void
2220 rtw_rfmd_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2221                   int before_rf, int digphy)
2222 {
2223         uint32_t anaparm;
2224
2225         anaparm = RTW_READ(regs, RTW_ANAPARM);
2226         anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2227
2228         switch (power) {
2229         case RTW_OFF:
2230                 if (before_rf)
2231                         return;
2232                 anaparm |= RTW_ANAPARM_RFPOW_RFMD_OFF;
2233                 anaparm |= RTW_ANAPARM_TXDACOFF;
2234                 break;
2235         case RTW_SLEEP:
2236                 if (!before_rf)
2237                         return;
2238                 anaparm |= RTW_ANAPARM_RFPOW_RFMD_SLEEP;
2239                 anaparm |= RTW_ANAPARM_TXDACOFF;
2240                 break;
2241         case RTW_ON:
2242                 if (!before_rf)
2243                         return;
2244                 anaparm |= RTW_ANAPARM_RFPOW_RFMD_ON;
2245                 break;
2246         }
2247         RTW_DPRINTF(RTW_DEBUG_PWR,
2248             ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2249             __func__, rtw_pwrstate_string(power),
2250             (before_rf) ? "before" : "after", anaparm));
2251
2252         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2253         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2254 }
2255
2256 static void
2257 rtw_philips_pwrstate(struct rtw_regs *regs, enum rtw_pwrstate power,
2258                      int before_rf, int digphy)
2259 {
2260         uint32_t anaparm;
2261
2262         anaparm = RTW_READ(regs, RTW_ANAPARM);
2263         anaparm &= ~(RTW_ANAPARM_RFPOW_MASK | RTW_ANAPARM_TXDACOFF);
2264
2265         switch (power) {
2266         case RTW_OFF:
2267                 if (before_rf)
2268                         return;
2269                 anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_OFF;
2270                 anaparm |= RTW_ANAPARM_TXDACOFF;
2271                 break;
2272         case RTW_SLEEP:
2273                 if (!before_rf)
2274                         return;
2275                 anaparm |= RTW_ANAPARM_RFPOW_PHILIPS_SLEEP;
2276                 anaparm |= RTW_ANAPARM_TXDACOFF;
2277                 break;
2278         case RTW_ON:
2279                 if (!before_rf)
2280                         return;
2281                 if (digphy) {
2282                         anaparm |= RTW_ANAPARM_RFPOW_DIG_PHILIPS_ON;
2283                         /* XXX guess */
2284                         anaparm |= RTW_ANAPARM_TXDACOFF;
2285                 } else
2286                         anaparm |= RTW_ANAPARM_RFPOW_ANA_PHILIPS_ON;
2287                 break;
2288         }
2289         RTW_DPRINTF(RTW_DEBUG_PWR,
2290             ("%s: power state %s, %s RF, reg[ANAPARM] <- %08x\n",
2291             __func__, rtw_pwrstate_string(power),
2292             (before_rf) ? "before" : "after", anaparm));
2293
2294         RTW_WRITE(regs, RTW_ANAPARM, anaparm);
2295         RTW_SYNC(regs, RTW_ANAPARM, RTW_ANAPARM);
2296 }
2297
2298 static __inline void
2299 rtw_pwrstate0(struct rtw_softc *sc, enum rtw_pwrstate power, int before_rf,
2300               int digphy)
2301 {
2302         rtw_set_access(sc, RTW_ACCESS_ANAPARM);
2303         sc->sc_pwrstate_cb(&sc->sc_regs, power, before_rf, digphy);
2304         rtw_set_access(sc, RTW_ACCESS_NONE);
2305 }
2306
2307 static int
2308 rtw_pwrstate(struct rtw_softc *sc, enum rtw_pwrstate power)
2309 {
2310         int rc;
2311
2312         RTW_DPRINTF(RTW_DEBUG_PWR,
2313                     ("%s: %s->%s\n", sc->sc_ic.ic_if.if_xname,
2314                     rtw_pwrstate_string(sc->sc_pwrstate),
2315                     rtw_pwrstate_string(power)));
2316
2317         if (sc->sc_pwrstate == power)
2318                 return 0;
2319
2320         rtw_pwrstate0(sc, power, 1, sc->sc_flags & RTW_F_DIGPHY);
2321         rc = rtw_rf_pwrstate(sc->sc_rf, power);
2322         rtw_pwrstate0(sc, power, 0, sc->sc_flags & RTW_F_DIGPHY);
2323
2324         switch (power) {
2325         case RTW_ON:
2326                 /* TBD set LEDs */
2327                 break;
2328         case RTW_SLEEP:
2329                 /* TBD */
2330                 break;
2331         case RTW_OFF:
2332                 /* TBD */
2333                 break;
2334         }
2335         if (rc == 0)
2336                 sc->sc_pwrstate = power;
2337         else
2338                 sc->sc_pwrstate = RTW_OFF;
2339         return rc;
2340 }
2341
2342 static int
2343 rtw_tune(struct rtw_softc *sc)
2344 {
2345         struct ieee80211com *ic = &sc->sc_ic;
2346         struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
2347         struct rtw_rx_radiotap_header *rr = &sc->sc_rxtap;
2348         u_int chan;
2349         int rc, antdiv, dflantb;
2350
2351         antdiv = sc->sc_flags & RTW_F_ANTDIV;
2352         dflantb = sc->sc_flags & RTW_F_DFLANTB;
2353
2354         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2355         if (chan == IEEE80211_CHAN_ANY)
2356                 panic("%s: chan == IEEE80211_CHAN_ANY\n", ic->ic_if.if_xname);
2357
2358         rt->rt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2359         rt->rt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2360
2361         rr->rr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2362         rr->rr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2363
2364         if (chan == sc->sc_cur_chan) {
2365                 RTW_DPRINTF(RTW_DEBUG_TUNE,
2366                             ("%s: already tuned chan #%d\n",
2367                              ic->ic_if.if_xname, chan));
2368                 return 0;
2369         }
2370
2371         rtw_suspend_ticks(sc);
2372
2373         rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 0);
2374
2375         /* TBD wait for Tx to complete */
2376
2377         KKASSERT((sc->sc_flags & RTW_F_ENABLED) != 0);
2378
2379         rc = rtw_phy_init(&sc->sc_regs, sc->sc_rf,
2380                           rtw_chan2txpower(&sc->sc_srom, ic, ic->ic_curchan),
2381                           sc->sc_csthr, ic->ic_curchan->ic_freq, antdiv,
2382                           dflantb, RTW_ON);
2383         if (rc != 0) {
2384                 /* XXX condition on powersaving */
2385                 kprintf("%s: phy init failed\n", ic->ic_if.if_xname);
2386         }
2387
2388         sc->sc_cur_chan = chan;
2389
2390         rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2391
2392         rtw_resume_ticks(sc);
2393
2394         return rc;
2395 }
2396
2397 static void
2398 rtw_disable(struct rtw_softc *sc)
2399 {
2400         int rc;
2401
2402         if ((sc->sc_flags & RTW_F_ENABLED) == 0)
2403                 return;
2404
2405         /* turn off PHY */
2406         if ((sc->sc_flags & RTW_F_INVALID) == 0 &&
2407             (rc = rtw_pwrstate(sc, RTW_OFF)) != 0)
2408                 if_printf(&sc->sc_ic.ic_if, "failed to turn off PHY\n");
2409
2410         sc->sc_flags &= ~RTW_F_ENABLED;
2411 }
2412
2413 static int
2414 rtw_enable(struct rtw_softc *sc)
2415 {
2416         if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
2417                 sc->sc_flags |= RTW_F_ENABLED;
2418                 /*
2419                  * Power may have been removed, and WEP keys thus reset.
2420                  */
2421                 sc->sc_flags &= ~RTW_F_DK_VALID;
2422         }
2423         return (0);
2424 }
2425
2426 static void
2427 rtw_transmit_config(struct rtw_regs *regs)
2428 {
2429         uint32_t tcr;
2430
2431         tcr = RTW_READ(regs, RTW_TCR);
2432
2433         tcr |= RTW_TCR_CWMIN;
2434         tcr &= ~RTW_TCR_MXDMA_MASK;
2435         tcr |= RTW_TCR_MXDMA_256;
2436         tcr |= RTW_TCR_SAT;             /* send ACK as fast as possible */
2437         tcr &= ~RTW_TCR_LBK_MASK;
2438         tcr |= RTW_TCR_LBK_NORMAL;      /* normal operating mode */
2439
2440         /* set short/long retry limits */
2441         tcr &= ~(RTW_TCR_SRL_MASK|RTW_TCR_LRL_MASK);
2442         tcr |= __SHIFTIN(4, RTW_TCR_SRL_MASK) | __SHIFTIN(4, RTW_TCR_LRL_MASK);
2443
2444         tcr &= ~RTW_TCR_CRC;    /* NIC appends CRC32 */
2445
2446         RTW_WRITE(regs, RTW_TCR, tcr);
2447         RTW_SYNC(regs, RTW_TCR, RTW_TCR);
2448 }
2449
2450 static void
2451 rtw_enable_interrupts(struct rtw_softc *sc)
2452 {
2453         struct rtw_regs *regs = &sc->sc_regs;
2454
2455         sc->sc_inten = RTW_INTR_RX|RTW_INTR_TX|RTW_INTR_BEACON|RTW_INTR_ATIMINT;
2456         sc->sc_inten |= RTW_INTR_IOERROR|RTW_INTR_TIMEOUT;
2457
2458         RTW_WRITE16(regs, RTW_IMR, sc->sc_inten);
2459         RTW_WBW(regs, RTW_IMR, RTW_ISR);
2460         RTW_WRITE16(regs, RTW_ISR, 0xffff);
2461         RTW_SYNC(regs, RTW_IMR, RTW_ISR);
2462
2463         /* XXX necessary? */
2464         if (sc->sc_intr_ack != NULL)
2465                 sc->sc_intr_ack(regs);
2466 }
2467
2468 static void
2469 rtw_set_nettype(struct rtw_softc *sc, enum ieee80211_opmode opmode)
2470 {
2471         struct rtw_regs *regs = &sc->sc_regs;
2472         uint8_t msr;
2473
2474         /* I'm guessing that MSR is protected as CONFIG[0123] are. */
2475         rtw_set_access(sc, RTW_ACCESS_CONFIG);
2476
2477         msr = RTW_READ8(regs, RTW_MSR) & ~RTW_MSR_NETYPE_MASK;
2478
2479         switch (opmode) {
2480         case IEEE80211_M_AHDEMO:
2481         case IEEE80211_M_IBSS:
2482                 msr |= RTW_MSR_NETYPE_ADHOC_OK;
2483                 break;
2484         case IEEE80211_M_HOSTAP:
2485                 msr |= RTW_MSR_NETYPE_AP_OK;
2486                 break;
2487         case IEEE80211_M_MONITOR:
2488                 /* XXX */
2489                 msr |= RTW_MSR_NETYPE_NOLINK;
2490                 break;
2491         case IEEE80211_M_STA:
2492                 msr |= RTW_MSR_NETYPE_INFRA_OK;
2493                 break;
2494         }
2495         RTW_WRITE8(regs, RTW_MSR, msr);
2496
2497         rtw_set_access(sc, RTW_ACCESS_NONE);
2498 }
2499
2500 #define rtw_calchash(addr) \
2501         (ether_crc32_be((addr), IEEE80211_ADDR_LEN) >> 26)
2502
2503 static void
2504 rtw_pktfilt_load(struct rtw_softc *sc)
2505 {
2506         struct rtw_regs *regs = &sc->sc_regs;
2507         struct ieee80211com *ic = &sc->sc_ic;
2508         struct ifnet *ifp = &ic->ic_if;
2509         struct ifmultiaddr *ifma;
2510         uint32_t hashes[2] = { 0, 0 };
2511         int hash;
2512
2513         /* XXX might be necessary to stop Rx/Tx engines while setting filters */
2514
2515         sc->sc_rcr &= ~RTW_RCR_PKTFILTER_MASK;
2516         sc->sc_rcr &= ~(RTW_RCR_MXDMA_MASK | RTW_RCR_RXFTH_MASK);
2517
2518         sc->sc_rcr |= RTW_RCR_PKTFILTER_DEFAULT;
2519         /* MAC auto-reset PHY (huh?) */
2520         sc->sc_rcr |= RTW_RCR_ENMARP;
2521         /* DMA whole Rx packets, only.  Set Tx DMA burst size to 1024 bytes. */
2522         sc->sc_rcr |= RTW_RCR_MXDMA_1024 | RTW_RCR_RXFTH_WHOLE;
2523
2524         switch (ic->ic_opmode) {
2525         case IEEE80211_M_MONITOR:
2526                 sc->sc_rcr |= RTW_RCR_MONITOR;
2527                 break;
2528         case IEEE80211_M_AHDEMO:
2529         case IEEE80211_M_IBSS:
2530                 /* receive broadcasts in our BSS */
2531                 sc->sc_rcr |= RTW_RCR_ADD3;
2532                 break;
2533         default:
2534                 break;
2535         }
2536
2537         ifp->if_flags &= ~IFF_ALLMULTI;
2538
2539         /* XXX accept all broadcast if scanning */
2540         if ((ifp->if_flags & IFF_BROADCAST) != 0)
2541                 sc->sc_rcr |= RTW_RCR_AB;       /* accept all broadcast */
2542
2543         if (ifp->if_flags & IFF_PROMISC) {
2544                 sc->sc_rcr |= RTW_RCR_AB;       /* accept all broadcast */
2545 allmulti:
2546                 ifp->if_flags |= IFF_ALLMULTI;
2547                 goto setit;
2548         }
2549
2550         /*
2551          * Program the 64-bit multicast hash filter.
2552          */
2553         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
2554                 if (ifma->ifma_addr->sa_family != AF_LINK)
2555                         continue;
2556
2557                 hash = rtw_calchash(
2558                         LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
2559                 hashes[hash >> 5] |= (1 << (hash & 0x1f));
2560                 sc->sc_rcr |= RTW_RCR_AM;
2561         }
2562
2563         /* all bits set => hash is useless */
2564         if (~(hashes[0] & hashes[1]) == 0)
2565                 goto allmulti;
2566
2567 setit:
2568         if (ifp->if_flags & IFF_ALLMULTI) {
2569                 sc->sc_rcr |= RTW_RCR_AM;       /* accept all multicast */
2570                 hashes[0] = hashes[1] = 0xffffffff;
2571         }
2572
2573         RTW_WRITE(regs, RTW_MAR0, hashes[0]);
2574         RTW_WRITE(regs, RTW_MAR1, hashes[1]);
2575         RTW_WRITE(regs, RTW_RCR, sc->sc_rcr);
2576         RTW_SYNC(regs, RTW_MAR0, RTW_RCR); /* RTW_MAR0 < RTW_MAR1 < RTW_RCR */
2577
2578         DPRINTF(sc, RTW_DEBUG_PKTFILT,
2579                 ("%s: RTW_MAR0 %08x RTW_MAR1 %08x RTW_RCR %08x\n",
2580                  ifp->if_xname, RTW_READ(regs, RTW_MAR0),
2581                  RTW_READ(regs, RTW_MAR1), RTW_READ(regs, RTW_RCR)));
2582 }
2583
2584 /* Must be called at splnet. */
2585 static void
2586 rtw_init(void *xsc)
2587 {
2588         struct rtw_softc *sc = xsc;
2589         struct ieee80211com *ic = &sc->sc_ic;
2590         struct ifnet *ifp = &ic->ic_if;
2591         struct rtw_regs *regs = &sc->sc_regs;
2592         int rc = 0;
2593
2594         rc = rtw_enable(sc);
2595         if (rc)
2596                 goto out;
2597
2598         /* Cancel pending I/O and reset. */
2599         rtw_stop(sc, 0);
2600
2601         DPRINTF(sc, RTW_DEBUG_TUNE,
2602                 ("%s: channel %d freq %d flags 0x%04x\n", ifp->if_xname,
2603                 ieee80211_chan2ieee(ic, ic->ic_curchan),
2604                 ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags));
2605
2606         rc = rtw_pwrstate(sc, RTW_OFF);
2607         if (rc)
2608                 goto out;
2609
2610         rc = rtw_swring_setup(sc);
2611         if (rc)
2612                 goto out;
2613
2614         rtw_transmit_config(regs);
2615
2616         rtw_set_access(sc, RTW_ACCESS_CONFIG);
2617
2618         RTW_WRITE8(regs, RTW_MSR, 0x0); /* no link */
2619         RTW_WBW(regs, RTW_MSR, RTW_BRSR);
2620
2621         /* long PLCP header, 1Mb/2Mb basic rate */
2622         RTW_WRITE16(regs, RTW_BRSR, RTW_BRSR_MBR8180_2MBPS);
2623         RTW_SYNC(regs, RTW_BRSR, RTW_BRSR);
2624
2625         rtw_set_access(sc, RTW_ACCESS_ANAPARM);
2626         rtw_set_access(sc, RTW_ACCESS_NONE);
2627
2628         /* XXX from reference sources */
2629         RTW_WRITE(regs, RTW_FEMR, 0xffff);
2630         RTW_SYNC(regs, RTW_FEMR, RTW_FEMR);
2631
2632         rtw_set_rfprog(sc);
2633
2634         RTW_WRITE8(regs, RTW_PHYDELAY, sc->sc_phydelay);
2635         /* from Linux driver */
2636         RTW_WRITE8(regs, RTW_CRCOUNT, RTW_CRCOUNT_MAGIC);
2637
2638         RTW_SYNC(regs, RTW_PHYDELAY, RTW_CRCOUNT);
2639
2640         rtw_enable_interrupts(sc);
2641
2642         rtw_pktfilt_load(sc);
2643
2644         rtw_hwring_setup(sc);
2645
2646         rtw_wep_setkeys(sc);
2647
2648         rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
2649
2650         ifp->if_flags |= IFF_RUNNING;
2651         ic->ic_state = IEEE80211_S_INIT;
2652
2653         RTW_WRITE16(regs, RTW_BSSID16, 0x0);
2654         RTW_WRITE(regs, RTW_BSSID32, 0x0);
2655
2656         rtw_resume_ticks(sc);
2657
2658         rtw_set_nettype(sc, IEEE80211_M_MONITOR);
2659
2660         if (ic->ic_opmode == IEEE80211_M_MONITOR)
2661                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2662         else
2663                 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2664
2665 out:
2666         if (rc)
2667                 if_printf(ifp, "interface not running\n");
2668 }
2669
2670 static void
2671 rtw_led_init(struct rtw_softc *sc)
2672 {
2673         struct rtw_regs *regs = &sc->sc_regs;
2674         uint8_t cfg0, cfg1;
2675
2676         rtw_set_access(sc, RTW_ACCESS_CONFIG);
2677
2678         cfg0 = RTW_READ8(regs, RTW_CONFIG0);
2679         cfg0 |= RTW_CONFIG0_LEDGPOEN;
2680         RTW_WRITE8(regs, RTW_CONFIG0, cfg0);
2681
2682         cfg1 = RTW_READ8(regs, RTW_CONFIG1);
2683         RTW_DPRINTF(RTW_DEBUG_LED,
2684                     ("%s: read %02x from reg[CONFIG1]\n",
2685                      sc->sc_ic.ic_if.if_xname, cfg1));
2686
2687         cfg1 &= ~RTW_CONFIG1_LEDS_MASK;
2688         cfg1 |= RTW_CONFIG1_LEDS_TX_RX;
2689         RTW_WRITE8(regs, RTW_CONFIG1, cfg1);
2690
2691         rtw_set_access(sc, RTW_ACCESS_NONE);
2692 }
2693
2694 /*
2695  * IEEE80211_S_INIT:            LED1 off
2696  *
2697  * IEEE80211_S_AUTH,
2698  * IEEE80211_S_ASSOC,
2699  * IEEE80211_S_SCAN:            LED1 blinks @ 1 Hz, blinks at 5Hz for tx/rx
2700  *
2701  * IEEE80211_S_RUN:             LED1 on, blinks @ 5Hz for tx/rx
2702  */
2703 static void
2704 rtw_led_newstate(struct rtw_softc *sc, enum ieee80211_state nstate)
2705 {
2706         struct rtw_led_state *ls = &sc->sc_led_state;
2707
2708         switch (nstate) {
2709         case IEEE80211_S_INIT:
2710                 rtw_led_init(sc);
2711                 callout_stop(&ls->ls_slow_ch);
2712                 callout_stop(&ls->ls_fast_ch);
2713                 ls->ls_slowblink = 0;
2714                 ls->ls_actblink = 0;
2715                 ls->ls_default = 0;
2716                 break;
2717         case IEEE80211_S_SCAN:
2718                 callout_reset(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS,
2719                               rtw_led_slowblink, sc);
2720                 callout_reset(&ls->ls_fast_ch, RTW_LED_FAST_TICKS,
2721                               rtw_led_fastblink, sc);
2722                 /*FALLTHROUGH*/
2723         case IEEE80211_S_AUTH:
2724         case IEEE80211_S_ASSOC:
2725                 ls->ls_default = RTW_LED1;
2726                 ls->ls_actblink = RTW_LED1;
2727                 ls->ls_slowblink = RTW_LED1;
2728                 break;
2729         case IEEE80211_S_RUN:
2730                 ls->ls_slowblink = 0;
2731                 break;
2732         }
2733         rtw_led_set(sc);
2734 }
2735
2736 static void
2737 rtw_led_set(struct rtw_softc *sc)
2738 {
2739         struct rtw_led_state *ls = &sc->sc_led_state;
2740         struct rtw_regs *regs = &sc->sc_regs;
2741         uint8_t led_condition, mask, newval, val;
2742         bus_size_t ofs;
2743
2744         led_condition = ls->ls_default;
2745
2746         if (ls->ls_state & RTW_LED_S_SLOW)
2747                 led_condition ^= ls->ls_slowblink;
2748         if (ls->ls_state & (RTW_LED_S_RX|RTW_LED_S_TX))
2749                 led_condition ^= ls->ls_actblink;
2750
2751         RTW_DPRINTF(RTW_DEBUG_LED,
2752                     ("%s: LED condition %02x\n", sc->sc_ic.ic_if.if_xname,
2753                      led_condition));
2754
2755         switch (sc->sc_hwverid) {
2756         default:
2757         case 'F':
2758                 ofs = RTW_PSR;
2759                 newval = mask = RTW_PSR_LEDGPO0 | RTW_PSR_LEDGPO1;
2760                 if (led_condition & RTW_LED0)
2761                         newval &= ~RTW_PSR_LEDGPO0;
2762                 if (led_condition & RTW_LED1)
2763                         newval &= ~RTW_PSR_LEDGPO1;
2764                 break;
2765         case 'D':
2766                 ofs = RTW_9346CR;
2767                 mask = RTW_9346CR_EEM_MASK | RTW_9346CR_EEDI | RTW_9346CR_EECS;
2768                 newval = RTW_9346CR_EEM_PROGRAM;
2769                 if (led_condition & RTW_LED0)
2770                         newval |= RTW_9346CR_EEDI;
2771                 if (led_condition & RTW_LED1)
2772                         newval |= RTW_9346CR_EECS;
2773                 break;
2774         }
2775         val = RTW_READ8(regs, ofs);
2776         RTW_DPRINTF(RTW_DEBUG_LED,
2777                     ("%s: read %02x from reg[%02x]\n",
2778                      sc->sc_ic.ic_if.if_xname, val, ofs));
2779         val &= ~mask;
2780         val |= newval;
2781         RTW_WRITE8(regs, ofs, val);
2782         RTW_DPRINTF(RTW_DEBUG_LED,
2783                     ("%s: wrote %02x to reg[%02x]\n",
2784                      sc->sc_ic.ic_if.if_xname, val, ofs));
2785         RTW_SYNC(regs, ofs, ofs);
2786 }
2787
2788 static void
2789 rtw_led_fastblink(void *arg)
2790 {
2791         struct rtw_softc *sc = arg;
2792         struct ifnet *ifp = &sc->sc_ic.ic_if;
2793         struct rtw_led_state *ls = &sc->sc_led_state;
2794         int ostate;
2795
2796         lwkt_serialize_enter(ifp->if_serializer);
2797
2798         ostate = ls->ls_state;
2799         ls->ls_state ^= ls->ls_event;
2800
2801         if ((ls->ls_event & RTW_LED_S_TX) == 0)
2802                 ls->ls_state &= ~RTW_LED_S_TX;
2803
2804         if ((ls->ls_event & RTW_LED_S_RX) == 0)
2805                 ls->ls_state &= ~RTW_LED_S_RX;
2806
2807         ls->ls_event = 0;
2808
2809         if (ostate != ls->ls_state)
2810                 rtw_led_set(sc);
2811
2812         callout_reset(&ls->ls_fast_ch, RTW_LED_FAST_TICKS,
2813                       rtw_led_fastblink, sc);
2814
2815         lwkt_serialize_exit(ifp->if_serializer);
2816 }
2817
2818 static void
2819 rtw_led_slowblink(void *arg)
2820 {
2821         struct rtw_softc *sc = arg;
2822         struct ifnet *ifp = &sc->sc_ic.ic_if;
2823         struct rtw_led_state *ls = &sc->sc_led_state;
2824
2825         lwkt_serialize_enter(ifp->if_serializer);
2826
2827         ls->ls_state ^= RTW_LED_S_SLOW;
2828         rtw_led_set(sc);
2829         callout_reset(&ls->ls_slow_ch, RTW_LED_SLOW_TICKS,
2830                       rtw_led_slowblink, sc);
2831
2832         lwkt_serialize_exit(ifp->if_serializer);
2833 }
2834
2835 static int
2836 rtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
2837 {
2838         struct rtw_softc *sc = ifp->if_softc;
2839         int rc = 0;
2840
2841         switch (cmd) {
2842         case SIOCSIFFLAGS:
2843                 if (ifp->if_flags & IFF_UP) {
2844                         if ((ifp->if_flags & IFF_RUNNING) == 0)
2845                                 rtw_init(sc);
2846                         RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2847                 } else if (sc->sc_flags & RTW_F_ENABLED) {
2848                         RTW_PRINT_REGS(&sc->sc_regs, ifp->if_xname, __func__);
2849                         rtw_stop(sc, 1);
2850                 }
2851                 break;
2852         case SIOCADDMULTI:
2853         case SIOCDELMULTI:
2854                 if (ifp->if_flags & IFF_RUNNING)
2855                         rtw_pktfilt_load(sc);
2856                 break;
2857         default:
2858                 rc = ieee80211_ioctl(&sc->sc_ic, cmd, data, cr);
2859                 if (rc == ENETRESET) {
2860                         if (sc->sc_flags & RTW_F_ENABLED)
2861                                 rtw_init(sc);
2862                         rc = 0;
2863                 }
2864                 break;
2865         }
2866         return rc;
2867 }
2868
2869 /*
2870  * Select a transmit ring with at least one h/w and s/w descriptor free.
2871  * Return 0 on success, -1 on failure.
2872  */
2873 static __inline int
2874 rtw_txring_choose(struct rtw_softc *sc, struct rtw_txsoft_blk **tsbp,
2875                   struct rtw_txdesc_blk **tdbp, int pri)
2876 {
2877         struct rtw_txsoft_blk *tsb;
2878         struct rtw_txdesc_blk *tdb;
2879
2880         KKASSERT(pri >= 0 && pri < RTW_NTXPRI);
2881
2882         tsb = &sc->sc_txsoft_blk[pri];
2883         tdb = &sc->sc_txdesc_blk[pri];
2884
2885         if (STAILQ_EMPTY(&tsb->tsb_freeq) || tdb->tdb_nfree == 0) {
2886                 if (tsb->tsb_tx_timer == 0)
2887                         tsb->tsb_tx_timer = 5;
2888                 *tsbp = NULL;
2889                 *tdbp = NULL;
2890                 return -1;
2891         }
2892         *tsbp = tsb;
2893         *tdbp = tdb;
2894         return 0;
2895 }
2896
2897 static __inline struct mbuf *
2898 rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
2899                   struct rtw_txsoft_blk **tsbp, struct rtw_txdesc_blk **tdbp,
2900                   struct ieee80211_node **nip, int *if_flagsp)
2901 {
2902         struct mbuf *m;
2903         struct ifnet *ifp = &sc->sc_if;
2904
2905         if (IF_QEMPTY(ifq))
2906                 return NULL;
2907         if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
2908                 DPRINTF(sc, RTW_DEBUG_XMIT_RSRC,
2909                         ("%s: no ring %d descriptor\n", ifp->if_xname, pri));
2910                 *if_flagsp |= IFF_OACTIVE;
2911                 ifp->if_timer = 1;
2912                 return NULL;
2913         }
2914         IF_DEQUEUE(ifq, m);
2915         *nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2916         m->m_pkthdr.rcvif = NULL;
2917         KKASSERT(*nip != NULL);
2918         return m;
2919 }
2920
2921 /*
2922  * Point *mp at the next 802.11 frame to transmit.  Point *tsbp
2923  * at the driver's selection of transmit control block for the packet.
2924  */
2925 static int
2926 rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
2927             struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
2928             struct ieee80211_node **nip)
2929 {
2930         struct rtw_softc *sc = ifp->if_softc;
2931         int *if_flagsp = &ifp->if_flags;
2932         struct ether_header *eh;
2933         struct mbuf *m0;
2934         int pri;
2935
2936         DPRINTF(sc, RTW_DEBUG_XMIT,
2937                 ("%s: enter %s\n", ifp->if_xname, __func__));
2938
2939         if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
2940             (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
2941                                      tdbp, nip, if_flagsp)) != NULL) {
2942                 DPRINTF(sc, RTW_DEBUG_XMIT,
2943                         ("%s: dequeue beacon frame\n", ifp->if_xname));
2944                 return 0;
2945         }
2946
2947         if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
2948                                      tdbp, nip, if_flagsp)) != NULL) {
2949                 DPRINTF(sc, RTW_DEBUG_XMIT,
2950                         ("%s: dequeue mgt frame\n", ifp->if_xname));
2951                 return 0;
2952         }
2953
2954         *mp = NULL;
2955
2956         if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
2957                 ifq_purge(&ifp->if_snd);
2958                 DPRINTF(sc, RTW_DEBUG_XMIT,
2959                         ("%s: not running\n", ifp->if_xname));
2960                 return 0;
2961         }
2962
2963         m0 = ifq_dequeue(&ifp->if_snd, NULL);
2964         if (m0 == NULL) {
2965                 DPRINTF(sc, RTW_DEBUG_XMIT,
2966                         ("%s: no frame ready\n", ifp->if_xname));
2967                 return 0;
2968         }
2969         DPRINTF(sc, RTW_DEBUG_XMIT,
2970                 ("%s: dequeue data frame\n", ifp->if_xname));
2971
2972         pri = ((m0->m_flags & M_PWR_SAV) != 0) ? RTW_TXPRIHI : RTW_TXPRIMD;
2973
2974         if (rtw_txring_choose(sc, tsbp, tdbp, pri) == -1) {
2975                 DPRINTF(sc, RTW_DEBUG_XMIT_RSRC,
2976                         ("%s: no ring %d descriptor\n", ifp->if_xname, pri));
2977                 *if_flagsp |= IFF_OACTIVE;
2978                 ifq_prepend(&ifp->if_snd, m0);
2979                 sc->sc_if.if_timer = 1;
2980                 return 0;
2981         }
2982
2983         BPF_MTAP(ifp, m0);
2984
2985         eh = mtod(m0, struct ether_header *);
2986         *nip = ieee80211_find_txnode(&sc->sc_ic, eh->ether_dhost);
2987         if (*nip == NULL) {
2988                 /* NB: ieee80211_find_txnode does stat+msg */
2989                 m_freem(m0);
2990                 return -1;
2991         }
2992
2993         if ((m0 = ieee80211_encap(&sc->sc_ic, m0, *nip)) == NULL) {
2994                 DPRINTF(sc, RTW_DEBUG_XMIT,
2995                         ("%s: encap error\n", ifp->if_xname));
2996                 ieee80211_free_node(*nip);
2997                 ifp->if_oerrors++;
2998                 return -1;
2999         }
3000
3001         ifp->if_opackets++;
3002         DPRINTF(sc, RTW_DEBUG_XMIT,
3003                 ("%s: leave %s\n", ifp->if_xname, __func__));
3004         *mp = m0;
3005         return 0;
3006 }
3007
3008 static __inline int
3009 rtw_txsegs_too_short(struct rtw_txsegs *segs)
3010 {
3011         int i;
3012
3013         for (i = 0; i < segs->nseg; i++) {
3014                 if (segs->segs[i].ds_len < 4)
3015                         return 1;
3016         }
3017         return 0;
3018 }
3019
3020 static __inline int
3021 rtw_txsegs_too_long(struct rtw_txsegs *segs)
3022 {
3023         int i;
3024
3025         for (i = 0; i < segs->nseg; i++) {
3026                 if (segs->segs[i].ds_len > RTW_TXLEN_LENGTH_MASK)
3027                         return 1;
3028         }
3029         return 0;
3030 }
3031
3032 static void
3033 rtw_txbuf_dma_map(void *arg, bus_dma_segment_t *seg, int nseg,
3034                   bus_size_t mapsize, int error)
3035 {
3036         struct rtw_txsegs *s = arg;
3037
3038         if (error)
3039                 return;
3040
3041         KASSERT(nseg <= RTW_MAXPKTSEGS, ("too many tx mbuf seg\n"));
3042
3043         s->nseg = nseg;
3044         bcopy(seg, s->segs, sizeof(*seg) * nseg);
3045 }
3046
3047 static struct mbuf *
3048 rtw_load_txbuf(struct rtw_softc *sc, struct rtw_txsoft *ts,
3049                struct rtw_txsegs *segs, int ndesc_free, struct mbuf *m)
3050 {
3051         int unload = 0, error;
3052
3053         error = bus_dmamap_load_mbuf(sc->sc_txsoft_dmat, ts->ts_dmamap, m,
3054                                      rtw_txbuf_dma_map, segs, BUS_DMA_NOWAIT);
3055         if (error && error != EFBIG) {
3056                 if_printf(&sc->sc_ic.ic_if, "can't load tx mbuf1\n");
3057                 goto back;
3058         }
3059
3060         if (error || segs->nseg > ndesc_free || rtw_txsegs_too_short(segs)) {
3061                 struct mbuf *m_new;
3062
3063                 if (error == 0)
3064                         bus_dmamap_unload(sc->sc_txsoft_dmat, ts->ts_dmamap);
3065
3066                 m_new = m_defrag(m, MB_DONTWAIT);
3067                 if (m_new == NULL) {
3068                         if_printf(&sc->sc_ic.ic_if, "can't defrag tx mbuf\n");
3069                         error = ENOBUFS;
3070                         goto back;
3071                 }
3072                 m = m_new;
3073
3074                 error = bus_dmamap_load_mbuf(sc->sc_txsoft_dmat, ts->ts_dmamap,
3075                                              m, rtw_txbuf_dma_map, segs,
3076                                              BUS_DMA_NOWAIT);
3077                 if (error) {
3078                         if_printf(&sc->sc_ic.ic_if, "can't load tx mbuf2\n");
3079                         goto back;
3080                 }
3081                 unload = 1;
3082
3083                 error = EFBIG;
3084                 if (segs->nseg > ndesc_free) {
3085                         if_printf(&sc->sc_ic.ic_if, "not enough free txdesc\n");
3086                         goto back;
3087                 }
3088                 if (rtw_txsegs_too_short(segs)) {
3089                         if_printf(&sc->sc_ic.ic_if, "segment too short\n");
3090                         goto back;
3091                 }
3092                 error = 0;
3093         }
3094
3095         if (rtw_txsegs_too_long(segs)) {
3096                 if_printf(&sc->sc_ic.ic_if, "segment too long\n");
3097                 unload = 1;
3098                 error = EFBIG;
3099         }
3100
3101 back:
3102         if (error) {
3103                 if (unload)
3104                         bus_dmamap_unload(sc->sc_txsoft_dmat, ts->ts_dmamap);
3105                 m_freem(m);
3106                 m = NULL;
3107         } else {
3108                 bus_dmamap_sync(sc->sc_txsoft_dmat, ts->ts_dmamap,
3109                                 BUS_DMASYNC_PREWRITE);
3110         }
3111         return m;
3112 }
3113
3114 #ifdef RTW_DEBUG
3115 static void
3116 rtw_print_txdesc(struct rtw_softc *sc, const char *action,
3117                  struct rtw_txsoft *ts, struct rtw_txdesc_blk *tdb, int desc)
3118 {
3119         struct rtw_txdesc *td = &tdb->tdb_desc[desc];
3120
3121         DPRINTF(sc, RTW_DEBUG_XMIT_DESC,
3122                 ("%s: %p %s txdesc[%d] "
3123                  "next %#08x buf %#08x "
3124                  "ctl0 %#08x ctl1 %#08x len %#08x\n",
3125                  sc->sc_ic.ic_if.if_xname, ts, action,
3126                  desc, le32toh(td->td_buf), le32toh(td->td_next),
3127                  le32toh(td->td_ctl0), le32toh(td->td_ctl1),
3128                  le32toh(td->td_len)));
3129 }
3130 #endif /* RTW_DEBUG */
3131
3132 static void
3133 rtw_start(struct ifnet *ifp)
3134 {
3135         struct rtw_softc *sc = ifp->if_softc;
3136         struct ieee80211com *ic = &sc->sc_ic;
3137         struct ieee80211_node *ni;
3138         struct rtw_txsoft *ts;
3139         struct mbuf *m0;
3140         uint32_t proto_ctl0;
3141
3142         DPRINTF(sc, RTW_DEBUG_XMIT,
3143                 ("%s: enter %s\n", ifp->if_xname, __func__));
3144
3145         if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
3146                 goto out;
3147
3148         /* XXX do real rate control */
3149         proto_ctl0 = RTW_TXCTL0_RTSRATE_1MBPS;
3150
3151         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
3152                 proto_ctl0 |= RTW_TXCTL0_SPLCP;
3153
3154         for (;;) {
3155                 struct rtw_txsegs segs;
3156                 struct rtw_duration *d0;
3157                 struct ieee80211_frame_min *wh;
3158                 struct rtw_txsoft_blk *tsb;
3159                 struct rtw_txdesc_blk *tdb;
3160                 struct rtw_txdesc *td;
3161                 struct ieee80211_key *k;
3162                 uint32_t ctl0, ctl1;
3163                 uint8_t tppoll;
3164                 int desc, i, lastdesc, npkt, rate, rateidx, ratectl;
3165
3166                 if (rtw_dequeue(ifp, &tsb, &tdb, &m0, &ni) == -1)
3167                         continue;
3168                 if (m0 == NULL)
3169                         break;
3170
3171                 wh = mtod(m0, struct ieee80211_frame_min *);
3172
3173                 if ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0 &&
3174                     (k = ieee80211_crypto_encap(ic, ni, m0)) == NULL) {
3175                         ieee80211_free_node(ni);
3176                         m_freem(m0);
3177                         break;
3178                 } else {
3179                         k = NULL;
3180                 }
3181
3182                 ts = STAILQ_FIRST(&tsb->tsb_freeq);
3183
3184                 m0 = rtw_load_txbuf(sc, ts, &segs, tdb->tdb_nfree, m0);
3185                 if (m0 == NULL || segs.nseg == 0) {
3186                         DPRINTF(sc, RTW_DEBUG_XMIT,
3187                                 ("%s: %s failed\n", ifp->if_xname, __func__));
3188                         goto post_dequeue_err;
3189                 }
3190
3191                 /*
3192                  * Note well: rtw_load_txbuf may have created a new chain,
3193                  * so we must find the header once more.
3194                  */
3195                 wh = mtod(m0, struct ieee80211_frame_min *);
3196
3197                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3198                     IEEE80211_FC0_TYPE_MGT) {
3199                         rateidx = 0;
3200                         rate = 2;       /* 1Mbit/s */
3201                         ratectl = 0;
3202                 } else {
3203                         ieee80211_ratectl_findrate(ni, m0->m_pkthdr.len,
3204                                                    &rateidx, 1);
3205                         rate = IEEE80211_RS_RATE(&ni->ni_rates, rateidx);
3206                         ratectl =1;
3207
3208                         if (rate == 0) {
3209                                 if_printf(ifp, "incorrect rate\n");
3210                                 rateidx = 0;
3211                                 rate = 2;       /* 1Mbit/s */
3212                                 ratectl = 0;
3213                         }
3214                 }
3215
3216 #ifdef RTW_DEBUG
3217                 if ((ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==
3218                     (IFF_DEBUG | IFF_LINK2)) {
3219                         ieee80211_dump_pkt(mtod(m0, uint8_t *),
3220                                            (segs.nseg == 1) ? m0->m_pkthdr.len
3221                                                             : sizeof(wh),
3222                                            rate, 0);
3223                 }
3224 #endif /* RTW_DEBUG */
3225                 ctl0 = proto_ctl0 |
3226                        __SHIFTIN(m0->m_pkthdr.len, RTW_TXCTL0_TPKTSIZE_MASK);
3227
3228                 switch (rate) {
3229                 default:
3230                 case 2:
3231                         ctl0 |= RTW_TXCTL0_RATE_1MBPS;
3232                         break;
3233                 case 4:
3234                         ctl0 |= RTW_TXCTL0_RATE_2MBPS;
3235                         break;
3236                 case 11:
3237                         ctl0 |= RTW_TXCTL0_RATE_5MBPS;
3238                         break;
3239                 case 22:
3240                         ctl0 |= RTW_TXCTL0_RATE_11MBPS;
3241                         break;
3242                 }
3243                 /* XXX >= ? Compare after fragmentation? */
3244                 if (m0->m_pkthdr.len > ic->ic_rtsthreshold)
3245                         ctl0 |= RTW_TXCTL0_RTSEN;
3246
3247                 /*
3248                  * XXX Sometimes writes a bogus keyid; h/w doesn't
3249                  * seem to care, since we don't activate h/w Tx
3250                  * encryption.
3251                  */
3252                 if (k != NULL) {
3253                         ctl0 |= __SHIFTIN(k->wk_keyix, RTW_TXCTL0_KEYID_MASK) &
3254                                 RTW_TXCTL0_KEYID_MASK;
3255                 }
3256
3257                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3258                     IEEE80211_FC0_TYPE_MGT) {
3259                         ctl0 &= ~(RTW_TXCTL0_SPLCP | RTW_TXCTL0_RTSEN);
3260                         if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
3261                             IEEE80211_FC0_SUBTYPE_BEACON)
3262                                 ctl0 |= RTW_TXCTL0_BEACON;
3263                 }
3264
3265                 if (rtw_compute_duration(wh, k, m0->m_pkthdr.len,
3266                     ic->ic_flags, ic->ic_fragthreshold,
3267                     rate, &ts->ts_d0, &ts->ts_dn, &npkt,
3268                     (ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3269                     (IFF_DEBUG|IFF_LINK2)) == -1) {
3270                         DPRINTF(sc, RTW_DEBUG_XMIT,
3271                             ("%s: fail compute duration\n", __func__));
3272                         goto post_load_err;
3273                 }
3274
3275                 d0 = &ts->ts_d0;
3276
3277                 *(uint16_t*)wh->i_dur = htole16(d0->d_data_dur);
3278
3279                 ctl1 = __SHIFTIN(d0->d_plcp_len, RTW_TXCTL1_LENGTH_MASK) |
3280                        __SHIFTIN(d0->d_rts_dur, RTW_TXCTL1_RTSDUR_MASK);
3281
3282                 if (d0->d_residue)
3283                         ctl1 |= RTW_TXCTL1_LENGEXT;
3284
3285                 /* TBD fragmentation */
3286
3287                 ts->ts_first = tdb->tdb_next;
3288                 KKASSERT(ts->ts_first < tdb->tdb_ndesc);
3289
3290                 if (ic->ic_rawbpf != NULL)
3291                         bpf_mtap(ic->ic_rawbpf, m0);
3292
3293                 if (sc->sc_radiobpf != NULL) {
3294                         struct rtw_tx_radiotap_header *rt = &sc->sc_txtap;
3295
3296                         rt->rt_flags = 0;
3297                         rt->rt_rate = rate;
3298
3299                         bpf_ptap(sc->sc_radiobpf, m0, rt,
3300                                  sizeof(sc->sc_txtapu));
3301                 }
3302
3303                 for (i = 0, lastdesc = desc = ts->ts_first; i < segs.nseg;
3304                      i++, desc = RTW_NEXT_IDX(tdb, desc)) {
3305                         td = &tdb->tdb_desc[desc];
3306                         td->td_ctl0 = htole32(ctl0);
3307                         if (i != 0)
3308                                 td->td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3309                         td->td_ctl1 = htole32(ctl1);
3310                         td->td_buf = htole32(segs.segs[i].ds_addr);
3311                         td->td_len = htole32(segs.segs[i].ds_len);
3312                         lastdesc = desc;
3313 #ifdef RTW_DEBUG
3314                         rtw_print_txdesc(sc, "load", ts, tdb, desc);
3315 #endif /* RTW_DEBUG */
3316                 }
3317
3318                 KKASSERT(desc < tdb->tdb_ndesc);
3319
3320                 ts->ts_ni = ni;
3321                 KKASSERT(ni != NULL);
3322                 ts->ts_mbuf = m0;
3323                 ts->ts_rateidx = rateidx;
3324                 ts->ts_ratectl = ratectl;
3325                 ts->ts_last = lastdesc;
3326                 tdb->tdb_desc[ts->ts_last].td_ctl0 |= htole32(RTW_TXCTL0_LS);
3327                 tdb->tdb_desc[ts->ts_first].td_ctl0 |= htole32(RTW_TXCTL0_FS);
3328
3329 #ifdef RTW_DEBUG
3330                 rtw_print_txdesc(sc, "FS on", ts, tdb, ts->ts_first);
3331                 rtw_print_txdesc(sc, "LS on", ts, tdb, ts->ts_last);
3332 #endif /* RTW_DEBUG */
3333
3334                 tdb->tdb_nfree -= segs.nseg;
3335                 tdb->tdb_next = desc;
3336
3337                 tdb->tdb_desc[ts->ts_first].td_ctl0 |= htole32(RTW_TXCTL0_OWN);
3338
3339 #ifdef RTW_DEBUG
3340                 rtw_print_txdesc(sc, "OWN on", ts, tdb, ts->ts_first);
3341 #endif /* RTW_DEBUG */
3342
3343                 STAILQ_REMOVE_HEAD(&tsb->tsb_freeq, ts_q);
3344                 STAILQ_INSERT_TAIL(&tsb->tsb_dirtyq, ts, ts_q);
3345
3346                 if (tsb != &sc->sc_txsoft_blk[RTW_TXPRIBCN])
3347                         sc->sc_led_state.ls_event |= RTW_LED_S_TX;
3348                 tsb->tsb_tx_timer = 5;
3349                 ifp->if_timer = 1;
3350                 tppoll = RTW_READ8(&sc->sc_regs, RTW_TPPOLL);
3351                 tppoll &= ~RTW_TPPOLL_SALL;
3352                 tppoll |= tsb->tsb_poll & RTW_TPPOLL_ALL;
3353                 RTW_WRITE8(&sc->sc_regs, RTW_TPPOLL, tppoll);
3354                 RTW_SYNC(&sc->sc_regs, RTW_TPPOLL, RTW_TPPOLL);
3355
3356                 bus_dmamap_sync(tdb->tdb_dmat, tdb->tdb_dmamap,
3357                                 BUS_DMASYNC_PREWRITE);
3358         }
3359 out:
3360         DPRINTF(sc, RTW_DEBUG_XMIT,
3361                 ("%s: leave %s\n", ifp->if_xname, __func__));
3362         return;
3363
3364 post_load_err:
3365         bus_dmamap_unload(sc->sc_txsoft_dmat, ts->ts_dmamap);
3366         m_freem(m0);
3367 post_dequeue_err:
3368         ieee80211_free_node(ni);
3369
3370         DPRINTF(sc, RTW_DEBUG_XMIT,
3371                 ("%s: leave %s\n", ifp->if_xname, __func__));
3372 }
3373
3374 static void
3375 rtw_idle(struct rtw_softc *sc)
3376 {
3377         struct rtw_regs *regs = &sc->sc_regs;
3378         int active;
3379
3380         /* request stop DMA; wait for packets to stop transmitting. */
3381
3382         RTW_WRITE8(regs, RTW_TPPOLL, RTW_TPPOLL_SALL);
3383         RTW_WBR(regs, RTW_TPPOLL, RTW_TPPOLL);
3384
3385         for (active = 0;
3386              active < 300 &&
3387              (RTW_READ8(regs, RTW_TPPOLL) & RTW_TPPOLL_ACTIVE) != 0;
3388              active++)
3389                 DELAY(10);
3390         if_printf(&sc->sc_ic.ic_if, "transmit DMA idle in %dus\n", active * 10);
3391 }
3392
3393 static void
3394 rtw_watchdog(struct ifnet *ifp)
3395 {
3396         int pri, tx_timeouts = 0;
3397         struct rtw_softc *sc = ifp->if_softc;
3398
3399         ifp->if_timer = 0;
3400
3401         if ((sc->sc_flags & RTW_F_ENABLED) == 0)
3402                 return;
3403
3404         for (pri = 0; pri < RTW_NTXPRI; pri++) {
3405                 struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[pri];
3406
3407                 if (tsb->tsb_tx_timer == 0)
3408                         continue;
3409                 else if (--tsb->tsb_tx_timer == 0) {
3410                         if (STAILQ_EMPTY(&tsb->tsb_dirtyq))
3411                                 continue;
3412                         if_printf(ifp, "transmit timeout, priority %d\n", pri);
3413                         ifp->if_oerrors++;
3414                         tx_timeouts++;
3415                 } else {
3416                         ifp->if_timer = 1;
3417                 }
3418         }
3419
3420         if (tx_timeouts > 0) {
3421                 /*
3422                  * Stop Tx DMA, disable xmtr, flush Tx rings, enable xmtr,
3423                  * reset s/w tx-ring pointers, and start transmission.
3424                  *
3425                  * TBD Stop/restart just the broken rings?
3426                  */
3427                 rtw_idle(sc);
3428                 rtw_io_enable(sc, RTW_CR_TE, 0);
3429                 rtw_txdesc_blk_reset_all(sc);
3430                 rtw_io_enable(sc, RTW_CR_TE, 1);
3431                 rtw_txring_fixup(sc);
3432                 rtw_start(ifp);
3433         }
3434         ieee80211_watchdog(&sc->sc_ic);
3435 }
3436
3437 static void
3438 rtw_next_scan(void *arg)
3439 {
3440         struct ieee80211com *ic = arg;
3441         struct ifnet *ifp = &ic->ic_if;
3442
3443         lwkt_serialize_enter(ifp->if_serializer);
3444
3445         /* don't call rtw_start w/o network interrupts blocked */
3446         if (ic->ic_state == IEEE80211_S_SCAN)
3447                 ieee80211_next_scan(ic);
3448
3449         lwkt_serialize_exit(ifp->if_serializer);
3450 }
3451
3452 static void
3453 rtw_join_bss(struct rtw_softc *sc, uint8_t *bssid, uint16_t intval0)
3454 {
3455         uint16_t bcnitv, bintritv, intval;
3456         int i;
3457         struct rtw_regs *regs = &sc->sc_regs;
3458
3459         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3460                 RTW_WRITE8(regs, RTW_BSSID + i, bssid[i]);
3461
3462         RTW_SYNC(regs, RTW_BSSID16, RTW_BSSID32);
3463
3464         rtw_set_access(sc, RTW_ACCESS_CONFIG);
3465
3466         intval = MIN(intval0, __SHIFTOUT_MASK(RTW_BCNITV_BCNITV_MASK));
3467
3468         bcnitv = RTW_READ16(regs, RTW_BCNITV) & ~RTW_BCNITV_BCNITV_MASK;
3469         bcnitv |= __SHIFTIN(intval, RTW_BCNITV_BCNITV_MASK);
3470         RTW_WRITE16(regs, RTW_BCNITV, bcnitv);
3471         /* interrupt host 1ms before the TBTT */
3472         bintritv = RTW_READ16(regs, RTW_BINTRITV) & ~RTW_BINTRITV_BINTRITV;
3473         bintritv |= __SHIFTIN(1000, RTW_BINTRITV_BINTRITV);
3474         RTW_WRITE16(regs, RTW_BINTRITV, bintritv);
3475         /* magic from Linux */
3476         RTW_WRITE16(regs, RTW_ATIMWND, __SHIFTIN(1, RTW_ATIMWND_ATIMWND));
3477         RTW_WRITE16(regs, RTW_ATIMTRITV, __SHIFTIN(2, RTW_ATIMTRITV_ATIMTRITV));
3478         rtw_set_access(sc, RTW_ACCESS_NONE);
3479
3480         rtw_io_enable(sc, RTW_CR_RE | RTW_CR_TE, 1);
3481 }
3482
3483 /* Synchronize the hardware state with the software state. */
3484 static int
3485 rtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3486 {
3487         struct ifnet *ifp = ic->ic_ifp;
3488         struct rtw_softc *sc = ifp->if_softc;
3489         enum ieee80211_state ostate;
3490         int error;
3491
3492         ostate = ic->ic_state;
3493
3494         ieee80211_ratectl_newstate(ic, nstate);
3495         rtw_led_newstate(sc, nstate);
3496
3497         if (nstate == IEEE80211_S_INIT) {
3498                 callout_stop(&sc->sc_scan_ch);
3499                 sc->sc_cur_chan = IEEE80211_CHAN_ANY;
3500                 return sc->sc_mtbl.mt_newstate(ic, nstate, arg);
3501         }
3502
3503         if (ostate == IEEE80211_S_INIT && nstate != IEEE80211_S_INIT)
3504                 rtw_pwrstate(sc, RTW_ON);
3505
3506         error = rtw_tune(sc);
3507         if (error != 0)
3508                 return error;
3509
3510         switch (nstate) {
3511         case IEEE80211_S_INIT:
3512                 panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
3513                 break;
3514         case IEEE80211_S_SCAN:
3515                 if (ostate != IEEE80211_S_SCAN) {
3516                         memset(ic->ic_bss->ni_bssid, 0, IEEE80211_ADDR_LEN);
3517                         rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3518                 }
3519
3520                 callout_reset(&sc->sc_scan_ch, rtw_dwelltime * hz / 1000,
3521                               rtw_next_scan, ic);
3522
3523                 break;
3524         case IEEE80211_S_RUN:
3525                 switch (ic->ic_opmode) {
3526                 case IEEE80211_M_HOSTAP:
3527                 case IEEE80211_M_IBSS:
3528                         rtw_set_nettype(sc, IEEE80211_M_MONITOR);
3529                         /*FALLTHROUGH*/
3530                 case IEEE80211_M_AHDEMO:
3531                 case IEEE80211_M_STA:
3532                         rtw_join_bss(sc, ic->ic_bss->ni_bssid,
3533                                      ic->ic_bss->ni_intval);
3534                         break;
3535                 case IEEE80211_M_MONITOR:
3536                         break;
3537                 }
3538                 rtw_set_nettype(sc, ic->ic_opmode);
3539                 break;
3540         case IEEE80211_S_ASSOC:
3541         case IEEE80211_S_AUTH:
3542                 break;
3543         }
3544
3545         if (nstate != IEEE80211_S_SCAN)
3546                 callout_stop(&sc->sc_scan_ch);
3547
3548         return sc->sc_mtbl.mt_newstate(ic, nstate, arg);
3549 }
3550
3551 /* Extend a 32-bit TSF timestamp to a 64-bit timestamp. */
3552 static uint64_t
3553 rtw_tsf_extend(struct rtw_regs *regs, uint32_t rstamp)
3554 {
3555         uint32_t tsftl, tsfth;
3556
3557         tsfth = RTW_READ(regs, RTW_TSFTRH);
3558         tsftl = RTW_READ(regs, RTW_TSFTRL);
3559         if (tsftl < rstamp)     /* Compensate for rollover. */
3560                 tsfth--;
3561         return ((uint64_t)tsfth << 32) | rstamp;
3562 }
3563
3564 static void
3565 rtw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
3566               struct ieee80211_node *ni, int subtype, int rssi, uint32_t rstamp)
3567 {
3568         struct ifnet *ifp = &ic->ic_if;
3569         struct rtw_softc *sc = ifp->if_softc;
3570
3571         sc->sc_mtbl.mt_recv_mgmt(ic, m, ni, subtype, rssi, rstamp);
3572
3573         switch (subtype) {
3574         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3575         case IEEE80211_FC0_SUBTYPE_BEACON:
3576                 if (ic->ic_opmode == IEEE80211_M_IBSS &&
3577                     ic->ic_state == IEEE80211_S_RUN) {
3578                         uint64_t tsf = rtw_tsf_extend(&sc->sc_regs, rstamp);
3579
3580                         if (le64toh(ni->ni_tstamp.tsf) >= tsf)
3581                                 ieee80211_ibss_merge(ni);
3582                 }
3583                 break;
3584         default:
3585                 break;
3586         }
3587 }
3588
3589 #ifdef foo
3590 static struct ieee80211_node *
3591 rtw_node_alloc(struct ieee80211_node_table *nt)
3592 {
3593         struct ifnet *ifp = nt->nt_ic->ic_ifp;
3594         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3595         struct ieee80211_node *ni = (*sc->sc_mtbl.mt_node_alloc)(nt);
3596
3597         DPRINTF(sc, RTW_DEBUG_NODE,
3598             ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
3599         return ni;
3600 }
3601
3602 static void
3603 rtw_node_free(struct ieee80211_node *ni)
3604 {
3605         struct ieee80211com *ic = ni->ni_ic;
3606         struct ifnet *ifp = ic->ic_ifp;
3607         struct rtw_softc *sc = (struct rtw_softc *)ifp->if_softc;
3608
3609         DPRINTF(sc, RTW_DEBUG_NODE,
3610             ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
3611             ether_sprintf(ni->ni_bssid)));
3612         sc->sc_mtbl.mt_node_free(ni);
3613 }
3614 #endif
3615
3616 static int
3617 rtw_media_change(struct ifnet *ifp)
3618 {
3619         int error;
3620
3621         error = ieee80211_media_change(ifp);
3622         if (error == ENETRESET) {
3623                 if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
3624                     (IFF_RUNNING|IFF_UP))
3625                         rtw_init(ifp);          /* XXX lose error */
3626                 error = 0;
3627         }
3628         return error;
3629 }
3630
3631 static void
3632 rtw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
3633 {
3634         struct rtw_softc *sc = ifp->if_softc;
3635
3636         if ((sc->sc_flags & RTW_F_ENABLED) == 0) {
3637                 imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
3638                 imr->ifm_status = 0;
3639                 return;
3640         }
3641         ieee80211_media_status(ifp, imr);
3642 }
3643
3644 static __inline void
3645 rtw_set80211methods(struct rtw_mtbl *mtbl, struct ieee80211com *ic)
3646 {
3647         mtbl->mt_newstate = ic->ic_newstate;
3648         ic->ic_newstate = rtw_newstate;
3649
3650         mtbl->mt_recv_mgmt = ic->ic_recv_mgmt;
3651         ic->ic_recv_mgmt = rtw_recv_mgmt;
3652
3653 #ifdef foo
3654         mtbl->mt_node_free = ic->ic_node_free;
3655         ic->ic_node_free = rtw_node_free;
3656
3657         mtbl->mt_node_alloc = ic->ic_node_alloc;
3658         ic->ic_node_alloc = rtw_node_alloc;
3659 #endif
3660
3661         ic->ic_crypto.cs_key_delete = rtw_key_delete;
3662         ic->ic_crypto.cs_key_set = rtw_key_set;
3663         ic->ic_crypto.cs_key_update_begin = rtw_key_update_begin;
3664         ic->ic_crypto.cs_key_update_end = rtw_key_update_end;
3665 }
3666
3667 static __inline void
3668 rtw_init_radiotap(struct rtw_softc *sc)
3669 {
3670         sc->sc_rxtap.rr_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
3671         sc->sc_rxtap.rr_ihdr.it_present = htole32(RTW_RX_RADIOTAP_PRESENT);
3672
3673         sc->sc_txtap.rt_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
3674         sc->sc_txtap.rt_ihdr.it_present = htole32(RTW_TX_RADIOTAP_PRESENT);
3675 }
3676
3677 static struct rtw_rf *
3678 rtw_rf_attach(struct rtw_softc *sc, enum rtw_rfchipid rfchipid, int digphy)
3679 {
3680         rtw_rf_write_t rf_write;
3681         struct rtw_rf *rf;
3682
3683         switch (rfchipid) {
3684         default:
3685                 rf_write = rtw_rf_hostwrite;
3686                 break;
3687         case RTW_RFCHIPID_INTERSIL:
3688         case RTW_RFCHIPID_PHILIPS:
3689         case RTW_RFCHIPID_GCT:  /* XXX a guess */
3690         case RTW_RFCHIPID_RFMD:
3691                 rf_write = (rtw_host_rfio) ? rtw_rf_hostwrite : rtw_rf_macwrite;
3692                 break;
3693         }
3694
3695         switch (rfchipid) {
3696         case RTW_RFCHIPID_GCT:
3697                 rf = rtw_grf5101_create(&sc->sc_regs, rf_write, 0);
3698                 sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3699                 sc->sc_getrssi = rtw_gct_getrssi;
3700                 break;
3701         case RTW_RFCHIPID_MAXIM:
3702                 rf = rtw_max2820_create(&sc->sc_regs, rf_write, 0);
3703                 sc->sc_pwrstate_cb = rtw_maxim_pwrstate;
3704                 sc->sc_getrssi = rtw_maxim_getrssi;
3705                 break;
3706         case RTW_RFCHIPID_PHILIPS:
3707                 rf = rtw_sa2400_create(&sc->sc_regs, rf_write, digphy);
3708                 sc->sc_pwrstate_cb = rtw_philips_pwrstate;
3709                 sc->sc_getrssi = rtw_philips_getrssi;
3710                 break;
3711         case RTW_RFCHIPID_RFMD:
3712                 /* XXX RFMD has no RF constructor */
3713                 sc->sc_pwrstate_cb = rtw_rfmd_pwrstate;
3714                 /*FALLTHROUGH*/
3715         default:
3716                 return NULL;
3717         }
3718         rf->rf_continuous_tx_cb =
3719             (rtw_continuous_tx_cb_t)rtw_continuous_tx_enable;
3720         rf->rf_continuous_tx_arg = sc;
3721         return rf;
3722 }
3723
3724 /* Revision C and later use a different PHY delay setting than
3725  * revisions A and B.
3726  */
3727 static uint8_t
3728 rtw_check_phydelay(struct rtw_regs *regs, uint32_t old_rcr)
3729 {
3730 #define REVAB (RTW_RCR_MXDMA_UNLIMITED | RTW_RCR_AICV)
3731 #define REVC (REVAB | RTW_RCR_RXFTH_WHOLE)
3732
3733         uint8_t phydelay = __SHIFTIN(0x6, RTW_PHYDELAY_PHYDELAY);
3734
3735         RTW_WRITE(regs, RTW_RCR, REVAB);
3736         RTW_WBW(regs, RTW_RCR, RTW_RCR);
3737         RTW_WRITE(regs, RTW_RCR, REVC);
3738
3739         RTW_WBR(regs, RTW_RCR, RTW_RCR);
3740         if ((RTW_READ(regs, RTW_RCR) & REVC) == REVC)
3741                 phydelay |= RTW_PHYDELAY_REVC_MAGIC;
3742
3743         RTW_WRITE(regs, RTW_RCR, old_rcr);      /* restore RCR */
3744         RTW_SYNC(regs, RTW_RCR, RTW_RCR);
3745
3746         return phydelay;
3747 #undef REVC
3748 #undef REVAB
3749 }
3750
3751 int
3752 rtw_attach(device_t dev)
3753 {
3754         struct rtw_softc *sc = device_get_softc(dev);
3755         struct ieee80211com *ic = &sc->sc_ic;
3756         const struct ieee80211_cipher *wep_cipher;
3757         struct ifnet *ifp = &ic->ic_if;
3758         int rc;
3759
3760         wep_cipher = ieee80211_crypto_cipher(IEEE80211_CIPHER_WEP);
3761         KKASSERT(wep_cipher != NULL);
3762
3763         memcpy(&rtw_cipher_wep, wep_cipher, sizeof(rtw_cipher_wep));
3764         rtw_cipher_wep.ic_decap = rtw_wep_decap;
3765
3766         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
3767
3768         switch (RTW_READ(&sc->sc_regs, RTW_TCR) & RTW_TCR_HWVERID_MASK) {
3769         case RTW_TCR_HWVERID_F:
3770                 sc->sc_hwverid = 'F';
3771                 break;
3772         case RTW_TCR_HWVERID_D:
3773                 sc->sc_hwverid = 'D';
3774                 break;
3775         default:
3776                 sc->sc_hwverid = '?';
3777                 break;
3778         }
3779
3780         sc->sc_irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ,
3781                                                 &sc->sc_irq_rid,
3782                                                 RF_ACTIVE | RF_SHAREABLE);
3783         if (sc->sc_irq_res == NULL) {
3784                 device_printf(dev, "could not alloc irq res\n");
3785                 return ENXIO;
3786         }
3787
3788         /* Allocate h/w desc blocks */
3789         rc = rtw_desc_blk_alloc(sc);
3790         if (rc)
3791                 goto err;
3792
3793         /* Allocate s/w desc blocks */
3794         rc = rtw_soft_blk_alloc(sc);
3795         if (rc)
3796                 goto err;
3797
3798         /* Reset the chip to a known state. */
3799         rc = rtw_reset(sc);
3800         if (rc) {
3801                 device_printf(dev, "could not reset\n");
3802                 goto err;
3803         }
3804
3805         sc->sc_rcr = RTW_READ(&sc->sc_regs, RTW_RCR);
3806
3807         if ((sc->sc_rcr & RTW_RCR_9356SEL) != 0)
3808                 sc->sc_flags |= RTW_F_9356SROM;
3809
3810         rc = rtw_srom_read(sc);
3811         if (rc)
3812                 goto err;
3813
3814         rc = rtw_srom_parse(sc);
3815         if (rc) {
3816                 device_printf(dev, "malformed serial ROM\n");
3817                 goto err;
3818         }
3819
3820         device_printf(dev, "%s PHY\n",
3821                       ((sc->sc_flags & RTW_F_DIGPHY) != 0) ? "digital"
3822                                                            : "analog");
3823
3824         device_printf(dev, "CS threshold %u\n", sc->sc_csthr);
3825
3826         sc->sc_rf = rtw_rf_attach(sc, sc->sc_rfchipid,
3827                                   sc->sc_flags & RTW_F_DIGPHY);
3828         if (sc->sc_rf == NULL) {
3829                 device_printf(dev, "could not attach RF\n");
3830                 rc = ENXIO;
3831                 goto err;
3832         }
3833
3834         sc->sc_phydelay = rtw_check_phydelay(&sc->sc_regs, sc->sc_rcr);
3835
3836         RTW_DPRINTF(RTW_DEBUG_ATTACH,
3837                     ("%s: PHY delay %d\n", ifp->if_xname, sc->sc_phydelay));
3838
3839         if (sc->sc_locale == RTW_LOCALE_UNKNOWN)
3840                 rtw_identify_country(sc);
3841
3842         rtw_init_channels(sc);
3843
3844         rc = rtw_identify_sta(sc);
3845         if (rc)
3846                 goto err;
3847
3848         ifp->if_softc = sc;
3849         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
3850         ifp->if_init = rtw_init;
3851         ifp->if_ioctl = rtw_ioctl;
3852         ifp->if_start = rtw_start;
3853         ifp->if_watchdog = rtw_watchdog;
3854         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
3855         ifq_set_ready(&ifp->if_snd);
3856
3857         ic->ic_phytype = IEEE80211_T_DS;
3858         ic->ic_opmode = IEEE80211_M_STA;
3859         ic->ic_caps = IEEE80211_C_PMGT |
3860                       IEEE80211_C_IBSS |
3861                       IEEE80211_C_HOSTAP |
3862                       IEEE80211_C_MONITOR;
3863         ic->ic_sup_rates[IEEE80211_MODE_11B] = rtw_rates_11b;
3864
3865         /* initialize led callout */
3866         callout_init(&sc->sc_led_state.ls_fast_ch);
3867         callout_init(&sc->sc_led_state.ls_slow_ch);
3868
3869         IEEE80211_ONOE_PARAM_SETUP(&sc->sc_onoe_param);
3870         ic->ic_ratectl.rc_st_ratectl_cap = IEEE80211_RATECTL_CAP_ONOE;
3871         ic->ic_ratectl.rc_st_ratectl = IEEE80211_RATECTL_ONOE;
3872         ic->ic_ratectl.rc_st_attach = rtw_ratectl_attach;
3873
3874         /*
3875          * Call MI attach routines.
3876          */
3877         ieee80211_ifattach(&sc->sc_ic);
3878
3879         /* Override some ieee80211 methods */
3880         rtw_set80211methods(&sc->sc_mtbl, &sc->sc_ic);
3881
3882         /*
3883          * possibly we should fill in our own sc_send_prresp, since
3884          * the RTL8180 is probably sending probe responses in ad hoc
3885          * mode.
3886          */
3887
3888         /* complete initialization */
3889         ieee80211_media_init(&sc->sc_ic, rtw_media_change, rtw_media_status);
3890         callout_init(&sc->sc_scan_ch);
3891
3892         rtw_init_radiotap(sc);
3893
3894         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
3895                       sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
3896
3897         rc = bus_setup_intr(dev, sc->sc_irq_res, INTR_MPSAFE, rtw_intr, sc,
3898                             &sc->sc_irq_handle, ifp->if_serializer);
3899         if (rc) {
3900                 device_printf(dev, "can't set up interrupt\n");
3901                 bpfdetach(ifp);
3902                 ieee80211_ifdetach(ic);
3903                 goto err;
3904         }
3905
3906         ifp->if_cpuid = rman_get_cpuid(sc->sc_irq_res);
3907         KKASSERT(ifp->if_cpuid >= 0 && ifp->if_cpuid < ncpus);
3908
3909         device_printf(dev, "hardware version %c\n", sc->sc_hwverid);
3910         if (bootverbose)
3911                 ieee80211_announce(ic);
3912         return 0;
3913 err:
3914         rtw_detach(dev);
3915         return rc;
3916 }
3917
3918 int
3919 rtw_detach(device_t dev)
3920 {
3921         struct rtw_softc *sc = device_get_softc(dev);
3922         struct ifnet *ifp = &sc->sc_ic.ic_if;
3923
3924         if (device_is_attached(dev)) {
3925                 lwkt_serialize_enter(ifp->if_serializer);
3926
3927                 rtw_stop(sc, 1);
3928                 sc->sc_flags |= RTW_F_INVALID;
3929
3930                 callout_stop(&sc->sc_scan_ch);
3931                 bus_teardown_intr(dev, sc->sc_irq_res, sc->sc_irq_handle);
3932
3933                 lwkt_serialize_exit(ifp->if_serializer);
3934
3935                 ieee80211_ifdetach(&sc->sc_ic);
3936         }
3937
3938         if (sc->sc_rf != NULL)
3939                 rtw_rf_destroy(sc->sc_rf);
3940
3941         if (sc->sc_srom.sr_content != NULL)
3942                 kfree(sc->sc_srom.sr_content, M_DEVBUF);
3943
3944         if (sc->sc_irq_res != NULL) {
3945                 bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
3946                                      sc->sc_irq_res);
3947         }
3948
3949         rtw_soft_blk_free(sc);
3950         rtw_desc_blk_free(sc);
3951         return 0;
3952 }
3953
3954 static void
3955 rtw_desc_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3956 {
3957         if (error)
3958                 return;
3959
3960         KASSERT(nseg == 1, ("too many desc segments\n"));
3961         *((uint32_t *)arg) = seg->ds_addr;      /* XXX bus_addr_t */
3962 }
3963
3964 static int
3965 rtw_dma_alloc(struct rtw_softc *sc, bus_dma_tag_t *dmat, int len,
3966               void **desc, uint32_t *phyaddr, bus_dmamap_t *dmamap)
3967 {
3968         int error;
3969
3970         error = bus_dma_tag_create(NULL, RTW_DESC_ALIGNMENT, 0,
3971                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
3972                                    NULL, NULL, len, 1, len, 0, dmat);
3973         if (error) {
3974                 if_printf(&sc->sc_ic.ic_if, "could not alloc desc DMA tag");
3975                 return error;
3976         }
3977
3978         error = bus_dmamem_alloc(*dmat, desc, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3979                                  dmamap);
3980         if (error) {
3981                 if_printf(&sc->sc_ic.ic_if, "could not alloc desc DMA mem");
3982                 return error;
3983         }
3984
3985         error = bus_dmamap_load(*dmat, *dmamap, *desc, len,
3986                                 rtw_desc_dma_addr, phyaddr, BUS_DMA_WAITOK);
3987         if (error) {
3988                 if_printf(&sc->sc_ic.ic_if, "could not load desc DMA mem");
3989                 bus_dmamem_free(*dmat, *desc, *dmamap);
3990                 *desc = NULL;
3991                 return error;
3992         }
3993         return 0;
3994 }
3995
3996 static void
3997 rtw_dma_free(struct rtw_softc *sc __unused, bus_dma_tag_t *dmat, void **desc,
3998              bus_dmamap_t *dmamap)
3999 {
4000         if (*desc != NULL) {
4001                 bus_dmamap_unload(*dmat, *dmamap);
4002                 bus_dmamem_free(*dmat, *desc, *dmamap);
4003                 *desc = NULL;
4004         }
4005
4006         if (*dmat != NULL) {
4007                 bus_dma_tag_destroy(*dmat);
4008                 *dmat = NULL;
4009         }
4010 }
4011
4012 static void
4013 rtw_txdesc_blk_free(struct rtw_softc *sc, int q_no)
4014 {
4015         struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[q_no];
4016
4017         rtw_dma_free(sc, &tdb->tdb_dmat, (void **)&tdb->tdb_desc,
4018                      &tdb->tdb_dmamap);
4019 }
4020
4021 static int
4022 rtw_txdesc_blk_alloc(struct rtw_softc *sc, int q_len, int q_no,
4023                      bus_size_t q_basereg)
4024 {
4025         struct rtw_txdesc_blk *tdb = &sc->sc_txdesc_blk[q_no];
4026         int i, error;
4027
4028         /*
4029          * Setup TX h/w desc
4030          */
4031         error = rtw_dma_alloc(sc, &tdb->tdb_dmat,
4032                               q_len * sizeof(*tdb->tdb_desc),
4033                               (void **)&tdb->tdb_desc, &tdb->tdb_base,
4034                               &tdb->tdb_dmamap);
4035         if (error) {
4036                 kprintf("%dth tx\n", q_no);
4037                 return error;
4038         }
4039         tdb->tdb_basereg = q_basereg;
4040
4041         tdb->tdb_ndesc = q_len;
4042         for (i = 0; i < tdb->tdb_ndesc; ++i)
4043                 tdb->tdb_desc[i].td_next = htole32(RTW_NEXT_DESC(tdb, i));
4044
4045         return 0;
4046 }
4047
4048 static void
4049 rtw_rxdesc_blk_free(struct rtw_softc *sc)
4050 {
4051         struct rtw_rxdesc_blk *rdb = &sc->sc_rxdesc_blk;
4052
4053         rtw_dma_free(sc, &rdb->rdb_dmat, (void **)&rdb->rdb_desc,
4054                      &rdb->rdb_dmamap);
4055 }
4056
4057 static int
4058 rtw_rxdesc_blk_alloc(struct rtw_softc *sc, int q_len)
4059 {
4060         struct rtw_rxdesc_blk *rdb = &sc->sc_rxdesc_blk;
4061         int error;
4062
4063         /*
4064          * Setup RX h/w desc
4065          */
4066         error = rtw_dma_alloc(sc, &rdb->rdb_dmat,
4067                               q_len * sizeof(*rdb->rdb_desc),
4068                               (void **)&rdb->rdb_desc, &rdb->rdb_base,
4069                               &rdb->rdb_dmamap);
4070         if (error) {
4071                 kprintf("rx\n");
4072         } else {
4073                 rdb->rdb_ndesc = q_len;
4074         }
4075
4076         return error;
4077 }
4078
4079 static void
4080 rtw_txsoft_blk_free(struct rtw_softc *sc, int n_sd, int q_no)
4081 {
4082         struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[q_no];
4083
4084         if (tsb->tsb_desc != NULL) {
4085                 int i;
4086
4087                 for (i = 0; i < n_sd; ++i) {
4088                         bus_dmamap_destroy(sc->sc_txsoft_dmat,
4089                                            tsb->tsb_desc[i].ts_dmamap);
4090                 }
4091                 kfree(tsb->tsb_desc, M_DEVBUF);
4092                 tsb->tsb_desc = NULL;
4093         }
4094 }
4095
4096 static int
4097 rtw_txsoft_blk_alloc(struct rtw_softc *sc, int q_len, int q_no, uint8_t q_poll)
4098 {
4099         struct rtw_txsoft_blk *tsb = &sc->sc_txsoft_blk[q_no];
4100         int i, error;
4101
4102         STAILQ_INIT(&tsb->tsb_dirtyq);
4103         STAILQ_INIT(&tsb->tsb_freeq);
4104         tsb->tsb_ndesc = q_len;
4105         tsb->tsb_desc = kmalloc(q_len * sizeof(*tsb->tsb_desc), M_DEVBUF,
4106                                M_WAITOK | M_ZERO);
4107         tsb->tsb_poll = q_poll;
4108
4109         for (i = 0; i < tsb->tsb_ndesc; ++i) {
4110                 error = bus_dmamap_create(sc->sc_txsoft_dmat, 0,
4111                                           &tsb->tsb_desc[i].ts_dmamap);
4112                 if (error) {
4113                         if_printf(&sc->sc_ic.ic_if, "could not create DMA map "
4114                                   "for soft tx desc\n");
4115                         rtw_txsoft_blk_free(sc, i, q_no);
4116                         return error;
4117                 }
4118         }
4119         return 0;
4120 }
4121
4122 static void
4123 rtw_rxsoft_blk_free(struct rtw_softc *sc, int n_sd)
4124 {
4125         if (sc->sc_rxsoft_free) {
4126                 int i;
4127
4128                 for (i = 0; i < n_sd; ++i) {
4129                         bus_dmamap_destroy(sc->sc_rxsoft_dmat,
4130                                            sc->sc_rxsoft[i].rs_dmamap);
4131                 }
4132                 sc->sc_rxsoft_free = 0;
4133         }
4134 }
4135
4136 static int
4137 rtw_rxsoft_blk_alloc(struct rtw_softc *sc, int q_len)
4138 {
4139         int i, error;
4140
4141         sc->sc_rxsoft_free = 1;
4142
4143         /*
4144          * Setup RX s/w desc
4145          */
4146         for (i = 0; i < q_len; ++i) {
4147                 error = bus_dmamap_create(sc->sc_rxsoft_dmat, 0,
4148                                           &sc->sc_rxsoft[i].rs_dmamap);
4149                 if (error) {
4150                         if_printf(&sc->sc_ic.ic_if, "could not create DMA map "
4151                                   "for soft rx desc\n");
4152                         rtw_rxsoft_blk_free(sc, i);
4153                         return error;
4154                 }
4155         }
4156         return 0;
4157 }
4158
4159 #define TXQ_PARAM(q, poll, breg)                        \
4160         [RTW_TXPRI ## q] = {                            \
4161                 .txq_len        = RTW_TXQLEN ## q,      \
4162                 .txq_poll       = poll,                 \
4163                 .txq_basereg    = breg                  \
4164         }
4165 static const struct {
4166         int             txq_len;
4167         uint8_t         txq_poll;
4168         bus_size_t      txq_basereg;
4169 } txq_params[RTW_NTXPRI] = {
4170         TXQ_PARAM(LO, RTW_TPPOLL_LPQ | RTW_TPPOLL_SLPQ, RTW_TLPDA),
4171         TXQ_PARAM(MD, RTW_TPPOLL_NPQ | RTW_TPPOLL_SNPQ, RTW_TNPDA),
4172         TXQ_PARAM(HI, RTW_TPPOLL_HPQ | RTW_TPPOLL_SHPQ, RTW_THPDA),
4173         TXQ_PARAM(BCN, RTW_TPPOLL_BQ | RTW_TPPOLL_SBQ, RTW_TBDA)
4174 };
4175 #undef TXQ_PARAM
4176
4177 static int
4178 rtw_desc_blk_alloc(struct rtw_softc *sc)
4179 {
4180         int i, error;
4181
4182         /* Create h/w TX desc */
4183         for (i = 0; i < RTW_NTXPRI; ++i) {
4184                 error = rtw_txdesc_blk_alloc(sc, txq_params[i].txq_len, i,
4185                                              txq_params[i].txq_basereg);
4186                 if (error)
4187                         return error;
4188         }
4189
4190         /* Create h/w RX desc */
4191         return rtw_rxdesc_blk_alloc(sc, RTW_RXQLEN);
4192 }
4193
4194 static void
4195 rtw_desc_blk_free(struct rtw_softc *sc)
4196 {
4197         int i;
4198
4199         for (i = 0; i < RTW_NTXPRI; ++i)
4200                 rtw_txdesc_blk_free(sc, i);
4201         rtw_rxdesc_blk_free(sc);
4202 }
4203
4204 static int
4205 rtw_soft_blk_alloc(struct rtw_softc *sc)
4206 {
4207         int i, error;
4208
4209         /* Create DMA tag for TX mbuf */
4210         error = bus_dma_tag_create(NULL, 1, 0,
4211                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
4212                                    NULL, NULL,
4213                                    MCLBYTES, RTW_MAXPKTSEGS, MCLBYTES,
4214                                    0, &sc->sc_txsoft_dmat);
4215         if (error) {
4216                 if_printf(&sc->sc_ic.ic_if, "could not alloc txsoft DMA tag\n");
4217                 return error;
4218         }
4219
4220         /* Create DMA tag for RX mbuf */
4221         error = bus_dma_tag_create(NULL, 1, 0,
4222                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
4223                                    NULL, NULL,
4224                                    MCLBYTES, 1, MCLBYTES,
4225                                    0, &sc->sc_rxsoft_dmat);
4226         if (error) {
4227                 if_printf(&sc->sc_ic.ic_if, "could not alloc rxsoft DMA tag\n");
4228                 return error;
4229         }
4230
4231         /* Create a spare DMA map for RX mbuf */
4232         error = bus_dmamap_create(sc->sc_rxsoft_dmat, 0, &sc->sc_rxsoft_dmamap);
4233         if (error) {
4234                 if_printf(&sc->sc_ic.ic_if, "could not alloc spare rxsoft "
4235                           "DMA map\n");
4236                 bus_dma_tag_destroy(sc->sc_rxsoft_dmat);
4237                 sc->sc_rxsoft_dmat = NULL;
4238                 return error;
4239         }
4240
4241         /* Create s/w TX desc */
4242         for (i = 0; i < RTW_NTXPRI; ++i) {
4243                 error = rtw_txsoft_blk_alloc(sc, txq_params[i].txq_len, i,
4244                                              txq_params[i].txq_poll);
4245                 if (error)
4246                         return error;
4247         }
4248
4249         /* Create s/w RX desc */
4250         return rtw_rxsoft_blk_alloc(sc, RTW_RXQLEN);
4251 }
4252
4253 static void
4254 rtw_soft_blk_free(struct rtw_softc *sc)
4255 {
4256         int i;
4257
4258         for (i = 0; i < RTW_NTXPRI; ++i)
4259                 rtw_txsoft_blk_free(sc, txq_params[i].txq_len, i);
4260
4261         rtw_rxsoft_blk_free(sc, RTW_RXQLEN);
4262
4263         if (sc->sc_txsoft_dmat != NULL) {
4264                 bus_dma_tag_destroy(sc->sc_txsoft_dmat);
4265                 sc->sc_txsoft_dmat = NULL;
4266         }
4267
4268         if (sc->sc_rxsoft_dmat != NULL) {
4269                 bus_dmamap_destroy(sc->sc_rxsoft_dmat, sc->sc_rxsoft_dmamap);
4270                 bus_dma_tag_destroy(sc->sc_rxsoft_dmat);
4271                 sc->sc_rxsoft_dmat = NULL;
4272         }
4273 }
4274
4275 /*
4276  * Arguments in:
4277  *
4278  * paylen:  payload length (no FCS, no WEP header)
4279  *
4280  * hdrlen:  header length
4281  *
4282  * rate:    MSDU speed, units 500kb/s
4283  *
4284  * flags:   IEEE80211_F_SHPREAMBLE (use short preamble),
4285  *          IEEE80211_F_SHSLOT (use short slot length)
4286  *
4287  * Arguments out:
4288  *
4289  * d:       802.11 Duration field for RTS,
4290  *          802.11 Duration field for data frame,
4291  *          PLCP Length for data frame,
4292  *          residual octets at end of data slot
4293  */
4294 static int
4295 rtw_compute_duration1(int len, int use_ack, uint32_t icflags, int rate,
4296                       struct rtw_duration *d)
4297 {
4298         int pre, ctsrate;
4299         int ack, bitlen, data_dur, remainder;
4300
4301         /*
4302          * RTS reserves medium for SIFS | CTS | SIFS | (DATA) | SIFS | ACK
4303          * DATA reserves medium for SIFS | ACK
4304          *
4305          * XXXMYC: no ACK on multicast/broadcast or control packets
4306          */
4307
4308         bitlen = len * 8;
4309
4310         pre = IEEE80211_DUR_DS_SIFS;
4311         if (icflags & IEEE80211_F_SHPREAMBLE) {
4312                 pre += IEEE80211_DUR_DS_SHORT_PREAMBLE +
4313                        IEEE80211_DUR_DS_FAST_PLCPHDR;
4314         } else {
4315                 pre += IEEE80211_DUR_DS_LONG_PREAMBLE +
4316                        IEEE80211_DUR_DS_SLOW_PLCPHDR;
4317         }
4318
4319         d->d_residue = 0;
4320         data_dur = (bitlen * 2) / rate;
4321         remainder = (bitlen * 2) % rate;
4322         if (remainder != 0) {
4323                 d->d_residue = (rate - remainder) / 16;
4324                 data_dur++;
4325         }
4326
4327         switch (rate) {
4328         case 2:         /* 1 Mb/s */
4329         case 4:         /* 2 Mb/s */
4330                 /* 1 - 2 Mb/s WLAN: send ACK/CTS at 1 Mb/s */
4331                 ctsrate = 2;
4332                 break;
4333         case 11:        /* 5.5 Mb/s */
4334         case 22:        /* 11  Mb/s */
4335         case 44:        /* 22  Mb/s */
4336                 /* 5.5 - 11 Mb/s WLAN: send ACK/CTS at 2 Mb/s */
4337                 ctsrate = 4;
4338                 break;
4339         default:
4340                 /* TBD */
4341                 return -1;
4342         }
4343
4344         d->d_plcp_len = data_dur;
4345
4346         ack = (use_ack) ? pre + (IEEE80211_DUR_DS_SLOW_ACK * 2) / ctsrate : 0;
4347
4348         d->d_rts_dur = pre + (IEEE80211_DUR_DS_SLOW_CTS * 2) / ctsrate +
4349                        pre + data_dur +
4350                        ack;
4351
4352         d->d_data_dur = ack;
4353         return 0;
4354 }
4355
4356 /*
4357  * Arguments in:
4358  *
4359  * wh:      802.11 header
4360  *
4361  * paylen:  payload length (no FCS, no WEP header)
4362  *
4363  * rate:    MSDU speed, units 500kb/s
4364  *
4365  * fraglen: fragment length, set to maximum (or higher) for no
4366  *          fragmentation
4367  *
4368  * flags:   IEEE80211_F_PRIVACY (hardware adds WEP),
4369  *          IEEE80211_F_SHPREAMBLE (use short preamble),
4370  *          IEEE80211_F_SHSLOT (use short slot length)
4371  *
4372  * Arguments out:
4373  *
4374  * d0: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
4375  *     of first/only fragment
4376  *
4377  * dn: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
4378  *     of last fragment
4379  *
4380  * rtw_compute_duration assumes crypto-encapsulation, if any,
4381  * has already taken place.
4382  */
4383 static int
4384 rtw_compute_duration(const struct ieee80211_frame_min *wh,
4385                      const struct ieee80211_key *wk, int len,
4386                      uint32_t icflags, int fraglen, int rate,
4387                      struct rtw_duration *d0, struct rtw_duration *dn,
4388                      int *npktp, int debug)
4389 {
4390         int ack, rc;
4391         int cryptolen,  /* crypto overhead: header+trailer */
4392             firstlen,   /* first fragment's payload + overhead length */
4393             hdrlen,     /* header length w/o driver padding */
4394             lastlen,    /* last fragment's payload length w/ overhead */
4395             lastlen0,   /* last fragment's payload length w/o overhead */
4396             npkt,       /* number of fragments */
4397             overlen,    /* non-802.11 header overhead per fragment */
4398             paylen;     /* payload length w/o overhead */
4399
4400         hdrlen = ieee80211_anyhdrsize((const void *)wh);
4401
4402         /* Account for padding required by the driver. */
4403         if (icflags & IEEE80211_F_DATAPAD)
4404                 paylen = len - roundup(hdrlen, sizeof(u_int32_t));
4405         else
4406                 paylen = len - hdrlen;
4407
4408         overlen = IEEE80211_CRC_LEN;
4409
4410         if (wk != NULL) {
4411                 cryptolen = wk->wk_cipher->ic_header +
4412                             wk->wk_cipher->ic_trailer;
4413                 paylen -= cryptolen;
4414                 overlen += cryptolen;
4415         }
4416
4417         npkt = paylen / fraglen;
4418         lastlen0 = paylen % fraglen;
4419
4420         if (npkt == 0) {                /* no fragments */
4421                 lastlen = paylen + overlen;
4422         } else if (lastlen0 != 0) {     /* a short "tail" fragment */
4423                 lastlen = lastlen0 + overlen;
4424                 npkt++;
4425         } else {                        /* full-length "tail" fragment */
4426                 lastlen = fraglen + overlen;
4427         }
4428
4429         if (npktp != NULL)
4430                 *npktp = npkt;
4431
4432         if (npkt > 1)
4433                 firstlen = fraglen + overlen;
4434         else
4435                 firstlen = paylen + overlen;
4436
4437         if (debug) {
4438                 kprintf("%s: npkt %d firstlen %d lastlen0 %d lastlen %d "
4439                     "fraglen %d overlen %d len %d rate %d icflags %08x\n",
4440                     __func__, npkt, firstlen, lastlen0, lastlen, fraglen,
4441                     overlen, len, rate, icflags);
4442         }
4443
4444         ack = (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
4445                (wh->i_fc[1] & IEEE80211_FC0_TYPE_MASK) !=
4446                IEEE80211_FC0_TYPE_CTL);
4447
4448         rc = rtw_compute_duration1(firstlen + hdrlen, ack, icflags, rate, d0);
4449         if (rc == -1)
4450                 return rc;
4451
4452         if (npkt <= 1) {
4453                 *dn = *d0;
4454                 return 0;
4455         }
4456         return rtw_compute_duration1(lastlen + hdrlen, ack, icflags, rate, dn);
4457 }
4458
4459 static int
4460 rtw_get_rssi(struct rtw_softc *sc, uint8_t raw, uint8_t sq)
4461 {
4462         int rssi;
4463
4464         rssi = sc->sc_getrssi(raw, sq);
4465
4466         if (rssi == 0)
4467                 rssi = 1;
4468         else if (rssi > 100)
4469                 rssi = 100;
4470
4471         if (rssi > (RTW_NOISE_FLOOR + RTW_RSSI_CORR))
4472                 rssi -= (RTW_NOISE_FLOOR + RTW_RSSI_CORR);
4473         else
4474                 rssi = 0;
4475
4476         return rssi;
4477 }
4478
4479 static int
4480 rtw_maxim_getrssi(uint8_t raw, uint8_t sq __unused)
4481 {
4482         int rssi = raw;
4483
4484         rssi &= 0x7e;
4485         rssi >>= 1;
4486         rssi += 0x42;
4487         if (raw & 0x1)
4488                 rssi += 0xa;
4489         rssi &= 0xff;
4490
4491         return rssi;
4492 }
4493
4494 static int
4495 rtw_gct_getrssi(uint8_t raw, uint8_t sq __unused)
4496 {
4497         int rssi = raw;
4498
4499         rssi &= 0x7e;
4500         if ((raw & 0x1) == 0 || rssi > 0x3c)
4501                 rssi = 100;
4502         else
4503                 rssi = (100 * rssi) / 0x3c;
4504         rssi &= 0xff;
4505
4506         return rssi;
4507 }
4508
4509 static int
4510 rtw_philips_getrssi(uint8_t raw, uint8_t sq)
4511 {
4512         static const uint8_t sq_rssi_map[SA2400_SQ_RSSI_MAP_MAX] =
4513         { SA2400_SQ_RSSI_MAP };
4514
4515         if (sq < SA2400_SQ_RSSI_MAP_MAX - 1)    /* NB: -1 is intended */
4516                 return sq_rssi_map[sq];
4517
4518         if (sq == 0x80)
4519                 return 1;
4520         else
4521                 return 0x32;
4522 }
4523
4524 static void *
4525 rtw_ratectl_attach(struct ieee80211com *ic, u_int rc)
4526 {
4527         struct rtw_softc *sc = ic->ic_if.if_softc;
4528
4529         switch (rc) {
4530         case IEEE80211_RATECTL_ONOE:
4531                 return &sc->sc_onoe_param;
4532         case IEEE80211_RATECTL_NONE:
4533                 /* This could only happen during detaching */
4534                 return NULL;
4535         default:
4536                 panic("unknown rate control algo %u\n", rc);
4537                 return NULL;
4538         }
4539 }