Home | History | Annotate | Line # | Download | only in ic
atw.c revision 1.70
      1 /*	$NetBSD: atw.c,v 1.70 2004/07/23 07:20:44 dyoung Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *	This product includes software developed by the NetBSD
     21  *	Foundation, Inc. and its contributors.
     22  * 4. Neither the name of The NetBSD Foundation nor the names of its
     23  *    contributors may be used to endorse or promote products derived
     24  *    from this software without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     36  * POSSIBILITY OF SUCH DAMAGE.
     37  */
     38 
     39 /*
     40  * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
     41  */
     42 
     43 #include <sys/cdefs.h>
     44 __KERNEL_RCSID(0, "$NetBSD: atw.c,v 1.70 2004/07/23 07:20:44 dyoung Exp $");
     45 
     46 #include "bpfilter.h"
     47 
     48 #include <sys/param.h>
     49 #include <sys/systm.h>
     50 #include <sys/callout.h>
     51 #include <sys/mbuf.h>
     52 #include <sys/malloc.h>
     53 #include <sys/kernel.h>
     54 #include <sys/socket.h>
     55 #include <sys/ioctl.h>
     56 #include <sys/errno.h>
     57 #include <sys/device.h>
     58 #include <sys/time.h>
     59 
     60 #include <machine/endian.h>
     61 
     62 #include <uvm/uvm_extern.h>
     63 
     64 #include <net/if.h>
     65 #include <net/if_dl.h>
     66 #include <net/if_media.h>
     67 #include <net/if_ether.h>
     68 
     69 #include <net80211/ieee80211_var.h>
     70 #include <net80211/ieee80211_compat.h>
     71 #include <net80211/ieee80211_radiotap.h>
     72 
     73 #if NBPFILTER > 0
     74 #include <net/bpf.h>
     75 #endif
     76 
     77 #include <machine/bus.h>
     78 #include <machine/intr.h>
     79 
     80 #include <dev/ic/atwreg.h>
     81 #include <dev/ic/rf3000reg.h>
     82 #include <dev/ic/si4136reg.h>
     83 #include <dev/ic/atwvar.h>
     84 #include <dev/ic/smc93cx6var.h>
     85 
     86 /* XXX TBD open questions
     87  *
     88  *
     89  * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
     90  * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
     91  * handle this for me?
     92  *
     93  */
     94 /* device attachment
     95  *
     96  *    print TOFS[012]
     97  *
     98  * device initialization
     99  *
    100  *    clear ATW_FRCTL_MAXPSP to disable max power saving
    101  *    set ATW_TXBR_ALCUPDATE to enable ALC
    102  *    set TOFS[012]? (hope not)
    103  *    disable rx/tx
    104  *    set ATW_PAR_SWR (software reset)
    105  *    wait for ATW_PAR_SWR clear
    106  *    disable interrupts
    107  *    ack status register
    108  *    enable interrupts
    109  *
    110  * rx/tx initialization
    111  *
    112  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
    113  *    allocate and init descriptor rings
    114  *    write ATW_PAR_DSL (descriptor skip length)
    115  *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
    116  *    write ATW_NAR_SQ for one/both transmit descriptor rings
    117  *    write ATW_NAR_SQ for one/both transmit descriptor rings
    118  *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
    119  *
    120  * rx/tx end
    121  *
    122  *    stop DMA
    123  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
    124  *    flush tx w/ ATW_NAR_HF
    125  *
    126  * scan
    127  *
    128  *    initialize rx/tx
    129  *
    130  * BSS join: (re)association response
    131  *
    132  *    set ATW_FRCTL_AID
    133  *
    134  * optimizations ???
    135  *
    136  */
    137 
    138 #define ATW_REFSLAVE	/* slavishly do what the reference driver does */
    139 
    140 #define	VOODOO_DUR_11_ROUNDING		0x01 /* necessary */
    141 #define	VOODOO_DUR_2_4_SPECIALCASE	0x02 /* NOT necessary */
    142 int atw_voodoo = VOODOO_DUR_11_ROUNDING;
    143 
    144 int atw_pseudo_milli = 1;
    145 int atw_magic_delay1 = 100 * 1000;
    146 int atw_magic_delay2 = 100 * 1000;
    147 /* more magic multi-millisecond delays (units: microseconds) */
    148 int atw_nar_delay = 20 * 1000;
    149 int atw_magic_delay4 = 10 * 1000;
    150 int atw_rf_delay1 = 10 * 1000;
    151 int atw_rf_delay2 = 5 * 1000;
    152 int atw_plcphd_delay = 2 * 1000;
    153 int atw_bbp_io_enable_delay = 20 * 1000;
    154 int atw_bbp_io_disable_delay = 2 * 1000;
    155 int atw_writewep_delay = 1000;
    156 int atw_beacon_len_adjust = 4;
    157 int atw_dwelltime = 200;
    158 int atw_xindiv2 = 0;
    159 
    160 #ifdef ATW_DEBUG
    161 int atw_debug = 0;
    162 
    163 #define ATW_DPRINTF(x)	if (atw_debug > 0) printf x
    164 #define ATW_DPRINTF2(x)	if (atw_debug > 1) printf x
    165 #define ATW_DPRINTF3(x)	if (atw_debug > 2) printf x
    166 #define	DPRINTF(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) printf x
    167 #define	DPRINTF2(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
    168 #define	DPRINTF3(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
    169 
    170 static void atw_print_regs(struct atw_softc *, const char *);
    171 static void atw_dump_pkt(struct ifnet *, struct mbuf *);
    172 
    173 /* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
    174 #	ifdef ATW_BBPDEBUG
    175 static int atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
    176 static void atw_rf3000_print(struct atw_softc *);
    177 #	endif /* ATW_BBPDEBUG */
    178 
    179 #	ifdef ATW_SYNDEBUG
    180 static int atw_si4126_read(struct atw_softc *, u_int, u_int *);
    181 static void atw_si4126_print(struct atw_softc *);
    182 #	endif /* ATW_SYNDEBUG */
    183 
    184 #else
    185 #define ATW_DPRINTF(x)
    186 #define ATW_DPRINTF2(x)
    187 #define ATW_DPRINTF3(x)
    188 #define	DPRINTF(sc, x)	/* nothing */
    189 #define	DPRINTF2(sc, x)	/* nothing */
    190 #define	DPRINTF3(sc, x)	/* nothing */
    191 #endif
    192 
    193 /* ifnet methods */
    194 void	atw_start(struct ifnet *);
    195 void	atw_watchdog(struct ifnet *);
    196 int	atw_ioctl(struct ifnet *, u_long, caddr_t);
    197 int	atw_init(struct ifnet *);
    198 void	atw_stop(struct ifnet *, int);
    199 
    200 /* Device attachment */
    201 void	atw_attach(struct atw_softc *);
    202 int	atw_detach(struct atw_softc *);
    203 
    204 /* Rx/Tx process */
    205 void	atw_rxdrain(struct atw_softc *);
    206 void	atw_txdrain(struct atw_softc *);
    207 int	atw_add_rxbuf(struct atw_softc *, int);
    208 void	atw_idle(struct atw_softc *, u_int32_t);
    209 
    210 /* Device (de)activation and power state */
    211 int	atw_enable(struct atw_softc *);
    212 void	atw_disable(struct atw_softc *);
    213 void	atw_power(int, void *);
    214 void	atw_shutdown(void *);
    215 void	atw_reset(struct atw_softc *);
    216 
    217 /* Interrupt handlers */
    218 void	atw_rxintr(struct atw_softc *);
    219 void	atw_txintr(struct atw_softc *);
    220 void	atw_linkintr(struct atw_softc *, u_int32_t);
    221 
    222 /* 802.11 state machine */
    223 static int	atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
    224 static int	atw_tune(struct atw_softc *);
    225 static void	atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
    226 		              struct ieee80211_node *, int, int, u_int32_t);
    227 
    228 /* Device initialization */
    229 static void	atw_wcsr_init(struct atw_softc *);
    230 static void	atw_cmdr_init(struct atw_softc *);
    231 static void	atw_tofs2_init(struct atw_softc *);
    232 static void	atw_txlmt_init(struct atw_softc *);
    233 static void	atw_test1_init(struct atw_softc *);
    234 static void	atw_rf_reset(struct atw_softc *);
    235 static void	atw_cfp_init(struct atw_softc *);
    236 static void	atw_tofs0_init(struct atw_softc *);
    237 static void	atw_ifs_init(struct atw_softc *);
    238 static void	atw_response_times_init(struct atw_softc *);
    239 static void	atw_bbp_io_init(struct atw_softc *);
    240 
    241 /* RAM/ROM utilities */
    242 static void	atw_clear_sram(struct atw_softc *);
    243 static void	atw_write_sram(struct atw_softc *, u_int, u_int8_t *, u_int);
    244 static int	atw_read_srom(struct atw_softc *);
    245 
    246 /* BSS setup */
    247 static void	atw_tsf(struct atw_softc *);
    248 static void	atw_start_beacon(struct atw_softc *, int);
    249 static void	atw_write_bssid(struct atw_softc *);
    250 static void	atw_write_ssid(struct atw_softc *);
    251 static void	atw_write_sup_rates(struct atw_softc *);
    252 static void	atw_write_wep(struct atw_softc *);
    253 
    254 /* Media */
    255 static int	atw_media_change(struct ifnet *);
    256 static void	atw_media_status(struct ifnet *, struct ifmediareq *);
    257 
    258 static void	atw_filter_setup(struct atw_softc *);
    259 
    260 /* 802.11 utilities */
    261 static void	atw_frame_setdurs(struct atw_softc *,
    262 		                  struct atw_frame *, int, int);
    263 static struct ieee80211_node	*atw_node_alloc(struct ieee80211com *);
    264 static void	atw_node_free(struct ieee80211com *,
    265 		              struct ieee80211_node *);
    266 static void	atw_recv_beacon(struct ieee80211com *, struct mbuf *,
    267 		                struct ieee80211_node *, int, int,
    268 		                u_int32_t);
    269 static __inline uint32_t	atw_last_even_tsft(uint32_t, uint32_t,
    270 				                   uint32_t);
    271 static __inline void		atw_tsft(struct atw_softc *, uint32_t *,
    272 				         uint32_t *);
    273 
    274 /*
    275  * Tuner/transceiver/modem
    276  */
    277 static void	atw_bbp_io_enable(struct atw_softc *, int);
    278 
    279 /* RFMD RF3000 Baseband Processor */
    280 static int atw_rf3000_init(struct atw_softc *);
    281 static int atw_rf3000_tune(struct atw_softc *, u_int);
    282 static int atw_rf3000_write(struct atw_softc *, u_int, u_int);
    283 
    284 /* Silicon Laboratories Si4126 RF/IF Synthesizer */
    285 static void atw_si4126_tune(struct atw_softc *, u_int);
    286 static void atw_si4126_write(struct atw_softc *, u_int, u_int);
    287 
    288 const struct atw_txthresh_tab atw_txthresh_tab_lo[] = ATW_TXTHRESH_TAB_LO_RATE;
    289 const struct atw_txthresh_tab atw_txthresh_tab_hi[] = ATW_TXTHRESH_TAB_HI_RATE;
    290 
    291 const char *atw_tx_state[] = {
    292 	"STOPPED",
    293 	"RUNNING - read descriptor",
    294 	"RUNNING - transmitting",
    295 	"RUNNING - filling fifo",	/* XXX */
    296 	"SUSPENDED",
    297 	"RUNNING -- write descriptor",
    298 	"RUNNING -- write last descriptor",
    299 	"RUNNING - fifo full"
    300 };
    301 
    302 const char *atw_rx_state[] = {
    303 	"STOPPED",
    304 	"RUNNING - read descriptor",
    305 	"RUNNING - check this packet, pre-fetch next",
    306 	"RUNNING - wait for reception",
    307 	"SUSPENDED",
    308 	"RUNNING - write descriptor",
    309 	"RUNNING - flush fifo",
    310 	"RUNNING - fifo drain"
    311 };
    312 
    313 int
    314 atw_activate(struct device *self, enum devact act)
    315 {
    316 	struct atw_softc *sc = (struct atw_softc *)self;
    317 	int rv = 0, s;
    318 
    319 	s = splnet();
    320 	switch (act) {
    321 	case DVACT_ACTIVATE:
    322 		rv = EOPNOTSUPP;
    323 		break;
    324 
    325 	case DVACT_DEACTIVATE:
    326 		if_deactivate(&sc->sc_ic.ic_if);
    327 		break;
    328 	}
    329 	splx(s);
    330 	return rv;
    331 }
    332 
    333 /*
    334  * atw_enable:
    335  *
    336  *	Enable the ADM8211 chip.
    337  */
    338 int
    339 atw_enable(struct atw_softc *sc)
    340 {
    341 
    342 	if (ATW_IS_ENABLED(sc) == 0) {
    343 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
    344 			printf("%s: device enable failed\n",
    345 			    sc->sc_dev.dv_xname);
    346 			return (EIO);
    347 		}
    348 		sc->sc_flags |= ATWF_ENABLED;
    349 	}
    350 	return (0);
    351 }
    352 
    353 /*
    354  * atw_disable:
    355  *
    356  *	Disable the ADM8211 chip.
    357  */
    358 void
    359 atw_disable(struct atw_softc *sc)
    360 {
    361 	if (!ATW_IS_ENABLED(sc))
    362 		return;
    363 	if (sc->sc_disable != NULL)
    364 		(*sc->sc_disable)(sc);
    365 	sc->sc_flags &= ~ATWF_ENABLED;
    366 }
    367 
    368 /* Returns -1 on failure. */
    369 static int
    370 atw_read_srom(struct atw_softc *sc)
    371 {
    372 	struct seeprom_descriptor sd;
    373 	uint32_t test0, fail_bits;
    374 
    375 	(void)memset(&sd, 0, sizeof(sd));
    376 
    377 	test0 = ATW_READ(sc, ATW_TEST0);
    378 
    379 	switch (sc->sc_rev) {
    380 	case ATW_REVISION_BA:
    381 	case ATW_REVISION_CA:
    382 		fail_bits = ATW_TEST0_EPNE;
    383 		break;
    384 	default:
    385 		fail_bits = ATW_TEST0_EPNE|ATW_TEST0_EPSNM;
    386 		break;
    387 	}
    388 	if ((test0 & fail_bits) != 0) {
    389 		printf("%s: bad or missing/bad SROM\n", sc->sc_dev.dv_xname);
    390 		return -1;
    391 	}
    392 
    393 	switch (test0 & ATW_TEST0_EPTYP_MASK) {
    394 	case ATW_TEST0_EPTYP_93c66:
    395 		ATW_DPRINTF(("%s: 93c66 SROM\n", sc->sc_dev.dv_xname));
    396 		sc->sc_sromsz = 512;
    397 		sd.sd_chip = C56_66;
    398 		break;
    399 	case ATW_TEST0_EPTYP_93c46:
    400 		ATW_DPRINTF(("%s: 93c46 SROM\n", sc->sc_dev.dv_xname));
    401 		sc->sc_sromsz = 128;
    402 		sd.sd_chip = C46;
    403 		break;
    404 	default:
    405 		printf("%s: unknown SROM type %d\n", sc->sc_dev.dv_xname,
    406 		    MASK_AND_RSHIFT(test0, ATW_TEST0_EPTYP_MASK));
    407 		return -1;
    408 	}
    409 
    410 	sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_NOWAIT);
    411 
    412 	if (sc->sc_srom == NULL) {
    413 		printf("%s: unable to allocate SROM buffer\n",
    414 		    sc->sc_dev.dv_xname);
    415 		return -1;
    416 	}
    417 
    418 	(void)memset(sc->sc_srom, 0, sc->sc_sromsz);
    419 
    420 	/* ADM8211 has a single 32-bit register for controlling the
    421 	 * 93cx6 SROM.  Bit SRS enables the serial port. There is no
    422 	 * "ready" bit. The ADM8211 input/output sense is the reverse
    423 	 * of read_seeprom's.
    424 	 */
    425 	sd.sd_tag = sc->sc_st;
    426 	sd.sd_bsh = sc->sc_sh;
    427 	sd.sd_regsize = 4;
    428 	sd.sd_control_offset = ATW_SPR;
    429 	sd.sd_status_offset = ATW_SPR;
    430 	sd.sd_dataout_offset = ATW_SPR;
    431 	sd.sd_CK = ATW_SPR_SCLK;
    432 	sd.sd_CS = ATW_SPR_SCS;
    433 	sd.sd_DI = ATW_SPR_SDO;
    434 	sd.sd_DO = ATW_SPR_SDI;
    435 	sd.sd_MS = ATW_SPR_SRS;
    436 	sd.sd_RDY = 0;
    437 
    438 	if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
    439 		printf("%s: could not read SROM\n", sc->sc_dev.dv_xname);
    440 		free(sc->sc_srom, M_DEVBUF);
    441 		return -1;
    442 	}
    443 #ifdef ATW_DEBUG
    444 	{
    445 		int i;
    446 		ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
    447 		for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
    448 			if (((i % 8) == 0) && (i != 0)) {
    449 				ATW_DPRINTF(("\n\t"));
    450 			}
    451 			ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
    452 		}
    453 		ATW_DPRINTF(("\n"));
    454 	}
    455 #endif /* ATW_DEBUG */
    456 	return 0;
    457 }
    458 
    459 #ifdef ATW_DEBUG
    460 static void
    461 atw_print_regs(struct atw_softc *sc, const char *where)
    462 {
    463 #define PRINTREG(sc, reg) \
    464 	ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
    465 	    sc->sc_dev.dv_xname, reg, ATW_READ(sc, reg)))
    466 
    467 	ATW_DPRINTF2(("%s: %s\n", sc->sc_dev.dv_xname, where));
    468 
    469 	PRINTREG(sc, ATW_PAR);
    470 	PRINTREG(sc, ATW_FRCTL);
    471 	PRINTREG(sc, ATW_TDR);
    472 	PRINTREG(sc, ATW_WTDP);
    473 	PRINTREG(sc, ATW_RDR);
    474 	PRINTREG(sc, ATW_WRDP);
    475 	PRINTREG(sc, ATW_RDB);
    476 	PRINTREG(sc, ATW_CSR3A);
    477 	PRINTREG(sc, ATW_TDBD);
    478 	PRINTREG(sc, ATW_TDBP);
    479 	PRINTREG(sc, ATW_STSR);
    480 	PRINTREG(sc, ATW_CSR5A);
    481 	PRINTREG(sc, ATW_NAR);
    482 	PRINTREG(sc, ATW_CSR6A);
    483 	PRINTREG(sc, ATW_IER);
    484 	PRINTREG(sc, ATW_CSR7A);
    485 	PRINTREG(sc, ATW_LPC);
    486 	PRINTREG(sc, ATW_TEST1);
    487 	PRINTREG(sc, ATW_SPR);
    488 	PRINTREG(sc, ATW_TEST0);
    489 	PRINTREG(sc, ATW_WCSR);
    490 	PRINTREG(sc, ATW_WPDR);
    491 	PRINTREG(sc, ATW_GPTMR);
    492 	PRINTREG(sc, ATW_GPIO);
    493 	PRINTREG(sc, ATW_BBPCTL);
    494 	PRINTREG(sc, ATW_SYNCTL);
    495 	PRINTREG(sc, ATW_PLCPHD);
    496 	PRINTREG(sc, ATW_MMIWADDR);
    497 	PRINTREG(sc, ATW_MMIRADDR1);
    498 	PRINTREG(sc, ATW_MMIRADDR2);
    499 	PRINTREG(sc, ATW_TXBR);
    500 	PRINTREG(sc, ATW_CSR15A);
    501 	PRINTREG(sc, ATW_ALCSTAT);
    502 	PRINTREG(sc, ATW_TOFS2);
    503 	PRINTREG(sc, ATW_CMDR);
    504 	PRINTREG(sc, ATW_PCIC);
    505 	PRINTREG(sc, ATW_PMCSR);
    506 	PRINTREG(sc, ATW_PAR0);
    507 	PRINTREG(sc, ATW_PAR1);
    508 	PRINTREG(sc, ATW_MAR0);
    509 	PRINTREG(sc, ATW_MAR1);
    510 	PRINTREG(sc, ATW_ATIMDA0);
    511 	PRINTREG(sc, ATW_ABDA1);
    512 	PRINTREG(sc, ATW_BSSID0);
    513 	PRINTREG(sc, ATW_TXLMT);
    514 	PRINTREG(sc, ATW_MIBCNT);
    515 	PRINTREG(sc, ATW_BCNT);
    516 	PRINTREG(sc, ATW_TSFTH);
    517 	PRINTREG(sc, ATW_TSC);
    518 	PRINTREG(sc, ATW_SYNRF);
    519 	PRINTREG(sc, ATW_BPLI);
    520 	PRINTREG(sc, ATW_CAP0);
    521 	PRINTREG(sc, ATW_CAP1);
    522 	PRINTREG(sc, ATW_RMD);
    523 	PRINTREG(sc, ATW_CFPP);
    524 	PRINTREG(sc, ATW_TOFS0);
    525 	PRINTREG(sc, ATW_TOFS1);
    526 	PRINTREG(sc, ATW_IFST);
    527 	PRINTREG(sc, ATW_RSPT);
    528 	PRINTREG(sc, ATW_TSFTL);
    529 	PRINTREG(sc, ATW_WEPCTL);
    530 	PRINTREG(sc, ATW_WESK);
    531 	PRINTREG(sc, ATW_WEPCNT);
    532 	PRINTREG(sc, ATW_MACTEST);
    533 	PRINTREG(sc, ATW_FER);
    534 	PRINTREG(sc, ATW_FEMR);
    535 	PRINTREG(sc, ATW_FPSR);
    536 	PRINTREG(sc, ATW_FFER);
    537 #undef PRINTREG
    538 }
    539 #endif /* ATW_DEBUG */
    540 
    541 /*
    542  * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
    543  */
    544 void
    545 atw_attach(struct atw_softc *sc)
    546 {
    547 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
    548 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    549 	};
    550 	struct ieee80211com *ic = &sc->sc_ic;
    551 	struct ifnet *ifp = &ic->ic_if;
    552 	int country_code, error, i, nrate, srom_major;
    553 	u_int32_t reg;
    554 	static const char *type_strings[] = {"Intersil (not supported)",
    555 	    "RFMD", "Marvel (not supported)"};
    556 
    557 	sc->sc_txth = atw_txthresh_tab_lo;
    558 
    559 	SIMPLEQ_INIT(&sc->sc_txfreeq);
    560 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
    561 
    562 #ifdef ATW_DEBUG
    563 	atw_print_regs(sc, "atw_attach");
    564 #endif /* ATW_DEBUG */
    565 
    566 	/*
    567 	 * Allocate the control data structures, and create and load the
    568 	 * DMA map for it.
    569 	 */
    570 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
    571 	    sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
    572 	    1, &sc->sc_cdnseg, 0)) != 0) {
    573 		printf("%s: unable to allocate control data, error = %d\n",
    574 		    sc->sc_dev.dv_xname, error);
    575 		goto fail_0;
    576 	}
    577 
    578 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
    579 	    sizeof(struct atw_control_data), (caddr_t *)&sc->sc_control_data,
    580 	    BUS_DMA_COHERENT)) != 0) {
    581 		printf("%s: unable to map control data, error = %d\n",
    582 		    sc->sc_dev.dv_xname, error);
    583 		goto fail_1;
    584 	}
    585 
    586 	if ((error = bus_dmamap_create(sc->sc_dmat,
    587 	    sizeof(struct atw_control_data), 1,
    588 	    sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
    589 		printf("%s: unable to create control data DMA map, "
    590 		    "error = %d\n", sc->sc_dev.dv_xname, error);
    591 		goto fail_2;
    592 	}
    593 
    594 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
    595 	    sc->sc_control_data, sizeof(struct atw_control_data), NULL,
    596 	    0)) != 0) {
    597 		printf("%s: unable to load control data DMA map, error = %d\n",
    598 		    sc->sc_dev.dv_xname, error);
    599 		goto fail_3;
    600 	}
    601 
    602 	/*
    603 	 * Create the transmit buffer DMA maps.
    604 	 */
    605 	sc->sc_ntxsegs = ATW_NTXSEGS;
    606 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
    607 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
    608 		    sc->sc_ntxsegs, MCLBYTES, 0, 0,
    609 		    &sc->sc_txsoft[i].txs_dmamap)) != 0) {
    610 			printf("%s: unable to create tx DMA map %d, "
    611 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
    612 			goto fail_4;
    613 		}
    614 	}
    615 
    616 	/*
    617 	 * Create the receive buffer DMA maps.
    618 	 */
    619 	for (i = 0; i < ATW_NRXDESC; i++) {
    620 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
    621 		    MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
    622 			printf("%s: unable to create rx DMA map %d, "
    623 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
    624 			goto fail_5;
    625 		}
    626 	}
    627 	for (i = 0; i < ATW_NRXDESC; i++) {
    628 		sc->sc_rxsoft[i].rxs_mbuf = NULL;
    629 	}
    630 
    631 	switch (sc->sc_rev) {
    632 	case ATW_REVISION_AB:
    633 	case ATW_REVISION_AF:
    634 		sc->sc_sramlen = ATW_SRAM_A_SIZE;
    635 		break;
    636 	case ATW_REVISION_BA:
    637 	case ATW_REVISION_CA:
    638 		sc->sc_sramlen = ATW_SRAM_B_SIZE;
    639 		break;
    640 	}
    641 
    642 	/* Reset the chip to a known state. */
    643 	atw_reset(sc);
    644 
    645 	if (atw_read_srom(sc) == -1)
    646 		return;
    647 
    648 	sc->sc_rftype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
    649 	    ATW_SR_RFTYPE_MASK);
    650 
    651 	sc->sc_bbptype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
    652 	    ATW_SR_BBPTYPE_MASK);
    653 
    654 	if (sc->sc_rftype > sizeof(type_strings)/sizeof(type_strings[0])) {
    655 		printf("%s: unknown RF\n", sc->sc_dev.dv_xname);
    656 		return;
    657 	}
    658 	if (sc->sc_bbptype > sizeof(type_strings)/sizeof(type_strings[0])) {
    659 		printf("%s: unknown BBP\n", sc->sc_dev.dv_xname);
    660 		return;
    661 	}
    662 
    663 	printf("%s: %s RF, %s BBP", sc->sc_dev.dv_xname,
    664 	    type_strings[sc->sc_rftype], type_strings[sc->sc_bbptype]);
    665 
    666 	/* XXX There exists a Linux driver which seems to use RFType = 0 for
    667 	 * MARVEL. My bug, or theirs?
    668 	 */
    669 
    670 	reg = LSHIFT(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
    671 
    672 	switch (sc->sc_rftype) {
    673 	case ATW_RFTYPE_INTERSIL:
    674 		reg |= ATW_SYNCTL_CS1;
    675 		break;
    676 	case ATW_RFTYPE_RFMD:
    677 		reg |= ATW_SYNCTL_CS0;
    678 		break;
    679 	case ATW_RFTYPE_MARVEL:
    680 		break;
    681 	}
    682 
    683 	sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
    684 	sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
    685 
    686 	reg = LSHIFT(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
    687 
    688 	switch (sc->sc_bbptype) {
    689 	case ATW_BBPTYPE_INTERSIL:
    690 		reg |= ATW_BBPCTL_TWI;
    691 		break;
    692 	case ATW_BBPTYPE_RFMD:
    693 		reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
    694 		    ATW_BBPCTL_CCA_ACTLO;
    695 		break;
    696 	case ATW_BBPTYPE_MARVEL:
    697 		break;
    698 	case ATW_C_BBPTYPE_RFMD:
    699 		printf("%s: ADM8211C MAC/RFMD BBP not supported yet.\n",
    700 		    sc->sc_dev.dv_xname);
    701 		break;
    702 	}
    703 
    704 	sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
    705 	sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
    706 
    707 	/*
    708 	 * From this point forward, the attachment cannot fail.  A failure
    709 	 * before this point releases all resources that may have been
    710 	 * allocated.
    711 	 */
    712 	sc->sc_flags |= ATWF_ATTACHED /* | ATWF_RTSCTS */;
    713 
    714 	ATW_DPRINTF((" SROM MAC %04x%04x%04x",
    715 	    htole16(sc->sc_srom[ATW_SR_MAC00]),
    716 	    htole16(sc->sc_srom[ATW_SR_MAC01]),
    717 	    htole16(sc->sc_srom[ATW_SR_MAC10])));
    718 
    719 	srom_major = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
    720 	    ATW_SR_MAJOR_MASK);
    721 
    722 	if (srom_major < 2)
    723 		sc->sc_rf3000_options1 = 0;
    724 	else if (sc->sc_rev == ATW_REVISION_BA) {
    725 		sc->sc_rf3000_options1 =
    726 		    MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CR28_CR03],
    727 		    ATW_SR_CR28_MASK);
    728 	} else
    729 		sc->sc_rf3000_options1 = 0;
    730 
    731 	sc->sc_rf3000_options2 = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
    732 	    ATW_SR_CR29_MASK);
    733 
    734 	country_code = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
    735 	    ATW_SR_CTRY_MASK);
    736 
    737 #define ADD_CHANNEL(_ic, _chan) do {					\
    738 	_ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;		\
    739 	_ic->ic_channels[_chan].ic_freq =				\
    740 	    ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
    741 } while (0)
    742 
    743 	/* Find available channels */
    744 	switch (country_code) {
    745 	case COUNTRY_MMK2:	/* 1-14 */
    746 		ADD_CHANNEL(ic, 14);
    747 		/*FALLTHROUGH*/
    748 	case COUNTRY_ETSI:	/* 1-13 */
    749 		for (i = 1; i <= 13; i++)
    750 			ADD_CHANNEL(ic, i);
    751 		break;
    752 	case COUNTRY_FCC:	/* 1-11 */
    753 	case COUNTRY_IC:	/* 1-11 */
    754 		for (i = 1; i <= 11; i++)
    755 			ADD_CHANNEL(ic, i);
    756 		break;
    757 	case COUNTRY_MMK:	/* 14 */
    758 		ADD_CHANNEL(ic, 14);
    759 		break;
    760 	case COUNTRY_FRANCE:	/* 10-13 */
    761 		for (i = 10; i <= 13; i++)
    762 			ADD_CHANNEL(ic, i);
    763 		break;
    764 	default:	/* assume channels 10-11 */
    765 	case COUNTRY_SPAIN:	/* 10-11 */
    766 		for (i = 10; i <= 11; i++)
    767 			ADD_CHANNEL(ic, i);
    768 		break;
    769 	}
    770 
    771 	/* Read the MAC address. */
    772 	reg = ATW_READ(sc, ATW_PAR0);
    773 	ic->ic_myaddr[0] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB0_MASK);
    774 	ic->ic_myaddr[1] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB1_MASK);
    775 	ic->ic_myaddr[2] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB2_MASK);
    776 	ic->ic_myaddr[3] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB3_MASK);
    777 	reg = ATW_READ(sc, ATW_PAR1);
    778 	ic->ic_myaddr[4] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB4_MASK);
    779 	ic->ic_myaddr[5] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB5_MASK);
    780 
    781 	if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
    782 		printf(" could not get mac address, attach failed\n");
    783 		return;
    784 	}
    785 
    786 	printf(" 802.11 address %s\n", ether_sprintf(ic->ic_myaddr));
    787 
    788 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
    789 	ifp->if_softc = sc;
    790 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
    791 	    IFF_NOTRAILERS;
    792 	ifp->if_ioctl = atw_ioctl;
    793 	ifp->if_start = atw_start;
    794 	ifp->if_watchdog = atw_watchdog;
    795 	ifp->if_init = atw_init;
    796 	ifp->if_stop = atw_stop;
    797 	IFQ_SET_READY(&ifp->if_snd);
    798 
    799 	ic->ic_phytype = IEEE80211_T_DS;
    800 	ic->ic_opmode = IEEE80211_M_STA;
    801 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_IBSS |
    802 	    IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
    803 
    804 	nrate = 0;
    805 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 2;
    806 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 4;
    807 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 11;
    808 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[nrate++] = 22;
    809 	ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates = nrate;
    810 
    811 	/*
    812 	 * Call MI attach routines.
    813 	 */
    814 
    815 	if_attach(ifp);
    816 	ieee80211_ifattach(ifp);
    817 
    818 	sc->sc_newstate = ic->ic_newstate;
    819 	ic->ic_newstate = atw_newstate;
    820 
    821 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
    822 	ic->ic_recv_mgmt = atw_recv_mgmt;
    823 
    824 	sc->sc_node_free = ic->ic_node_free;
    825 	ic->ic_node_free = atw_node_free;
    826 
    827 	sc->sc_node_alloc = ic->ic_node_alloc;
    828 	ic->ic_node_alloc = atw_node_alloc;
    829 
    830 	/* possibly we should fill in our own sc_send_prresp, since
    831 	 * the ADM8211 is probably sending probe responses in ad hoc
    832 	 * mode.
    833 	 */
    834 
    835 	/* complete initialization */
    836 	ieee80211_media_init(ifp, atw_media_change, atw_media_status);
    837 	callout_init(&sc->sc_scan_ch);
    838 
    839 #if NBPFILTER > 0
    840 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
    841 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_radiobpf);
    842 #endif
    843 
    844 	/*
    845 	 * Make sure the interface is shutdown during reboot.
    846 	 */
    847 	sc->sc_sdhook = shutdownhook_establish(atw_shutdown, sc);
    848 	if (sc->sc_sdhook == NULL)
    849 		printf("%s: WARNING: unable to establish shutdown hook\n",
    850 		    sc->sc_dev.dv_xname);
    851 
    852 	/*
    853 	 * Add a suspend hook to make sure we come back up after a
    854 	 * resume.
    855 	 */
    856 	sc->sc_powerhook = powerhook_establish(atw_power, sc);
    857 	if (sc->sc_powerhook == NULL)
    858 		printf("%s: WARNING: unable to establish power hook\n",
    859 		    sc->sc_dev.dv_xname);
    860 
    861 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
    862 	sc->sc_rxtap.ar_ihdr.it_len = sizeof(sc->sc_rxtapu);
    863 	sc->sc_rxtap.ar_ihdr.it_present = ATW_RX_RADIOTAP_PRESENT;
    864 
    865 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
    866 	sc->sc_txtap.at_ihdr.it_len = sizeof(sc->sc_txtapu);
    867 	sc->sc_txtap.at_ihdr.it_present = ATW_TX_RADIOTAP_PRESENT;
    868 
    869 	return;
    870 
    871 	/*
    872 	 * Free any resources we've allocated during the failed attach
    873 	 * attempt.  Do this in reverse order and fall through.
    874 	 */
    875  fail_5:
    876 	for (i = 0; i < ATW_NRXDESC; i++) {
    877 		if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
    878 			continue;
    879 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
    880 	}
    881  fail_4:
    882 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
    883 		if (sc->sc_txsoft[i].txs_dmamap == NULL)
    884 			continue;
    885 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
    886 	}
    887 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
    888  fail_3:
    889 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
    890  fail_2:
    891 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
    892 	    sizeof(struct atw_control_data));
    893  fail_1:
    894 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
    895  fail_0:
    896 	return;
    897 }
    898 
    899 static struct ieee80211_node *
    900 atw_node_alloc(struct ieee80211com *ic)
    901 {
    902 	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
    903 	struct ieee80211_node *ni = (*sc->sc_node_alloc)(ic);
    904 
    905 	DPRINTF(sc, ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
    906 	return ni;
    907 }
    908 
    909 static void
    910 atw_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
    911 {
    912 	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
    913 
    914 	DPRINTF(sc, ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
    915 	    ether_sprintf(ni->ni_bssid)));
    916 	(*sc->sc_node_free)(ic, ni);
    917 }
    918 
    919 
    920 static void
    921 atw_test1_reset(struct atw_softc *sc)
    922 {
    923 	switch (sc->sc_rev) {
    924 	case ATW_REVISION_BA:
    925 		if (1 /* XXX condition on transceiver type */) {
    926 			ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
    927 		}
    928 		break;
    929 	case ATW_REVISION_CA:
    930 		ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
    931 		break;
    932 	default:
    933 		break;
    934 	}
    935 }
    936 
    937 /*
    938  * atw_reset:
    939  *
    940  *	Perform a soft reset on the ADM8211.
    941  */
    942 void
    943 atw_reset(struct atw_softc *sc)
    944 {
    945 	int i;
    946 	uint32_t lpc;
    947 
    948 	ATW_WRITE(sc, ATW_NAR, 0x0);
    949 	DELAY(atw_nar_delay);
    950 
    951 	/* Reference driver has a cryptic remark indicating that this might
    952 	 * power-on the chip.  I know that it turns off power-saving....
    953 	 */
    954 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
    955 
    956 	ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
    957 
    958 	for (i = 0; i < 50000 / atw_pseudo_milli; i++) {
    959 		if (ATW_READ(sc, ATW_PAR) == 0)
    960 			break;
    961 		DELAY(atw_pseudo_milli);
    962 	}
    963 
    964 	/* ... and then pause 100ms longer for good measure. */
    965 	DELAY(atw_magic_delay1);
    966 
    967 	DPRINTF2(sc, ("%s: atw_reset %d iterations\n", sc->sc_dev.dv_xname, i));
    968 
    969 	if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
    970 		printf("%s: reset failed to complete\n", sc->sc_dev.dv_xname);
    971 
    972 	atw_test1_reset(sc);
    973 	/*
    974 	 * Initialize the PCI Access Register.
    975 	 */
    976 	sc->sc_busmode = ATW_PAR_PBL_8DW;
    977 
    978 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
    979 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
    980 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
    981 
    982 	/* Turn off maximum power saving, etc.
    983 	 *
    984 	 * XXX Following example of reference driver, should I set
    985 	 * an AID of 1?  It didn't seem to help....
    986 	 */
    987 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
    988 
    989 	DELAY(atw_magic_delay2);
    990 
    991 	/* Recall EEPROM. */
    992 	ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
    993 
    994 	DELAY(atw_magic_delay4);
    995 
    996 	lpc = ATW_READ(sc, ATW_LPC);
    997 
    998 	DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
    999 
   1000 	/* A reset seems to affect the SRAM contents, so put them into
   1001 	 * a known state.
   1002 	 */
   1003 	atw_clear_sram(sc);
   1004 
   1005 	memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
   1006 }
   1007 
   1008 static void
   1009 atw_clear_sram(struct atw_softc *sc)
   1010 {
   1011 	memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
   1012 	/* XXX not for revision 0x20. */
   1013 	atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
   1014 }
   1015 
   1016 /* TBD atw_init
   1017  *
   1018  * set MAC based on ic->ic_bss->myaddr
   1019  * write WEP keys
   1020  * set TX rate
   1021  */
   1022 
   1023 /* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
   1024  * without receiving a beacon with the preferred BSSID & SSID.
   1025  * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
   1026  */
   1027 static void
   1028 atw_wcsr_init(struct atw_softc *sc)
   1029 {
   1030 	uint32_t wcsr;
   1031 
   1032 	wcsr = ATW_READ(sc, ATW_WCSR);
   1033 	wcsr &= ~(ATW_WCSR_BLN_MASK|ATW_WCSR_LSOE|ATW_WCSR_MPRE|ATW_WCSR_LSOE);
   1034 	wcsr |= LSHIFT(7, ATW_WCSR_BLN_MASK);
   1035 	ATW_WRITE(sc, ATW_WCSR, wcsr);	/* XXX resets wake-up status bits */
   1036 
   1037 	DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
   1038 	    sc->sc_dev.dv_xname, __func__, ATW_READ(sc, ATW_WCSR)));
   1039 }
   1040 
   1041 /* Turn off power management.  Set Rx store-and-forward mode. */
   1042 static void
   1043 atw_cmdr_init(struct atw_softc *sc)
   1044 {
   1045 	uint32_t cmdr;
   1046 	cmdr = ATW_READ(sc, ATW_CMDR);
   1047 	cmdr &= ~ATW_CMDR_APM;
   1048 	cmdr |= ATW_CMDR_RTE;
   1049 	cmdr &= ~ATW_CMDR_DRT_MASK;
   1050 	cmdr |= ATW_CMDR_DRT_SF;
   1051 
   1052 	ATW_WRITE(sc, ATW_CMDR, cmdr);
   1053 }
   1054 
   1055 static void
   1056 atw_tofs2_init(struct atw_softc *sc)
   1057 {
   1058 	uint32_t tofs2;
   1059 	/* XXX this magic can probably be figured out from the RFMD docs */
   1060 #ifndef ATW_REFSLAVE
   1061 	tofs2 = LSHIFT(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
   1062 	      LSHIFT(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
   1063 	      LSHIFT(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
   1064 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
   1065 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
   1066 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
   1067 	      LSHIFT(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
   1068 	      LSHIFT(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
   1069 #else
   1070 	/* XXX new magic from reference driver source */
   1071 	tofs2 = LSHIFT(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
   1072 	      LSHIFT(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
   1073 	      LSHIFT(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
   1074 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
   1075 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
   1076 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
   1077 	      LSHIFT(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
   1078 	      LSHIFT(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
   1079 #endif
   1080 	ATW_WRITE(sc, ATW_TOFS2, tofs2);
   1081 }
   1082 
   1083 static void
   1084 atw_nar_init(struct atw_softc *sc)
   1085 {
   1086 	ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF|ATW_NAR_PB);
   1087 }
   1088 
   1089 static void
   1090 atw_txlmt_init(struct atw_softc *sc)
   1091 {
   1092 	ATW_WRITE(sc, ATW_TXLMT, LSHIFT(512, ATW_TXLMT_MTMLT_MASK) |
   1093 	                         LSHIFT(1, ATW_TXLMT_SRTYLIM_MASK));
   1094 }
   1095 
   1096 static void
   1097 atw_test1_init(struct atw_softc *sc)
   1098 {
   1099 	uint32_t test1;
   1100 
   1101 	test1 = ATW_READ(sc, ATW_TEST1);
   1102 	test1 &= ~(ATW_TEST1_DBGREAD_MASK|ATW_TEST1_CONTROL);
   1103 	/* XXX magic 0x1 */
   1104 	test1 |= LSHIFT(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
   1105 	ATW_WRITE(sc, ATW_TEST1, test1);
   1106 }
   1107 
   1108 static void
   1109 atw_rf_reset(struct atw_softc *sc)
   1110 {
   1111 	/* XXX this resets an Intersil RF front-end? */
   1112 	/* TBD condition on Intersil RFType? */
   1113 	ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
   1114 	DELAY(atw_rf_delay1);
   1115 	ATW_WRITE(sc, ATW_SYNRF, 0);
   1116 	DELAY(atw_rf_delay2);
   1117 }
   1118 
   1119 /* Set 16 TU max duration for the contention-free period (CFP). */
   1120 static void
   1121 atw_cfp_init(struct atw_softc *sc)
   1122 {
   1123 	uint32_t cfpp;
   1124 
   1125 	cfpp = ATW_READ(sc, ATW_CFPP);
   1126 	cfpp &= ~ATW_CFPP_CFPMD;
   1127 	cfpp |= LSHIFT(16, ATW_CFPP_CFPMD);
   1128 	ATW_WRITE(sc, ATW_CFPP, cfpp);
   1129 }
   1130 
   1131 static void
   1132 atw_tofs0_init(struct atw_softc *sc)
   1133 {
   1134 	/* XXX I guess that the Cardbus clock is 22MHz?
   1135 	 * I am assuming that the role of ATW_TOFS0_USCNT is
   1136 	 * to divide the bus clock to get a 1MHz clock---the datasheet is not
   1137 	 * very clear on this point. It says in the datasheet that it is
   1138 	 * possible for the ADM8211 to accomodate bus speeds between 22MHz
   1139 	 * and 33MHz; maybe this is the way? I see a binary-only driver write
   1140 	 * these values. These values are also the power-on default.
   1141 	 */
   1142 	ATW_WRITE(sc, ATW_TOFS0,
   1143 	    LSHIFT(22, ATW_TOFS0_USCNT_MASK) |
   1144 	    ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
   1145 }
   1146 
   1147 /* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
   1148 static void
   1149 atw_ifs_init(struct atw_softc *sc)
   1150 {
   1151 	uint32_t ifst;
   1152 	/* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
   1153 	 * Go figure.
   1154 	 */
   1155 	ifst = LSHIFT(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
   1156 	      LSHIFT(22 * 5 /* IEEE80211_DUR_DS_SIFS */ /* # of 22MHz cycles */,
   1157 	             ATW_IFST_SIFS_MASK) |
   1158 	      LSHIFT(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
   1159 	      LSHIFT(0x64 /* IEEE80211_DUR_DS_EIFS */, ATW_IFST_EIFS_MASK);
   1160 
   1161 	ATW_WRITE(sc, ATW_IFST, ifst);
   1162 }
   1163 
   1164 static void
   1165 atw_response_times_init(struct atw_softc *sc)
   1166 {
   1167 	/* XXX More magic. Relates to ACK timing?  The datasheet seems to
   1168 	 * indicate that the MAC expects at least SIFS + MIRT microseconds
   1169 	 * to pass after it transmits a frame that requires a response;
   1170 	 * it waits at most SIFS + MART microseconds for the response.
   1171 	 * Surely this is not the ACK timeout?
   1172 	 */
   1173 	ATW_WRITE(sc, ATW_RSPT, LSHIFT(0xffff, ATW_RSPT_MART_MASK) |
   1174 	    LSHIFT(0xff, ATW_RSPT_MIRT_MASK));
   1175 }
   1176 
   1177 /* Set up the MMI read/write addresses for the baseband. The Tx/Rx
   1178  * engines read and write baseband registers after Rx and before
   1179  * Tx, respectively.
   1180  */
   1181 static void
   1182 atw_bbp_io_init(struct atw_softc *sc)
   1183 {
   1184 	uint32_t mmiraddr2;
   1185 
   1186 	/* XXX The reference driver does this, but is it *really*
   1187 	 * necessary?
   1188 	 */
   1189 	switch (sc->sc_rev) {
   1190 	case ATW_REVISION_AB:
   1191 	case ATW_REVISION_AF:
   1192 		mmiraddr2 = 0x0;
   1193 		break;
   1194 	default:
   1195 		mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
   1196 		mmiraddr2 &=
   1197 		    ~(ATW_MMIRADDR2_PROREXT|ATW_MMIRADDR2_PRORLEN_MASK);
   1198 		break;
   1199 	}
   1200 
   1201 	switch (sc->sc_bbptype) {
   1202 	case ATW_BBPTYPE_INTERSIL:
   1203 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
   1204 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
   1205 		mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
   1206 		break;
   1207 	case ATW_BBPTYPE_MARVEL:
   1208 		/* TBD find out the Marvel settings. */
   1209 		break;
   1210 	case ATW_BBPTYPE_RFMD:
   1211 	default:
   1212 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
   1213 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
   1214 		mmiraddr2 |= ATW_MMIRADDR2_RFMD;
   1215 		break;
   1216 	}
   1217 	ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
   1218 	ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
   1219 }
   1220 
   1221 /*
   1222  * atw_init:		[ ifnet interface function ]
   1223  *
   1224  *	Initialize the interface.  Must be called at splnet().
   1225  */
   1226 int
   1227 atw_init(struct ifnet *ifp)
   1228 {
   1229 	struct atw_softc *sc = ifp->if_softc;
   1230 	struct ieee80211com *ic = &sc->sc_ic;
   1231 	struct atw_txsoft *txs;
   1232 	struct atw_rxsoft *rxs;
   1233 	int i, error = 0;
   1234 
   1235 	if ((error = atw_enable(sc)) != 0)
   1236 		goto out;
   1237 
   1238 	/*
   1239 	 * Cancel any pending I/O. This also resets.
   1240 	 */
   1241 	atw_stop(ifp, 0);
   1242 
   1243 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
   1244 	DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
   1245 	    __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
   1246 	    ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
   1247 
   1248 	atw_wcsr_init(sc);
   1249 
   1250 	atw_cmdr_init(sc);
   1251 
   1252 	/* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
   1253 	 *
   1254 	 * XXX Set transmit power for ATIM, RTS, Beacon.
   1255 	 */
   1256 	ATW_WRITE(sc, ATW_PLCPHD, LSHIFT(10, ATW_PLCPHD_SIGNAL_MASK) |
   1257 	    LSHIFT(0xb0, ATW_PLCPHD_SERVICE_MASK));
   1258 
   1259 	atw_tofs2_init(sc);
   1260 
   1261 	atw_nar_init(sc);
   1262 
   1263 	atw_txlmt_init(sc);
   1264 
   1265 	atw_test1_init(sc);
   1266 
   1267 	atw_rf_reset(sc);
   1268 
   1269 	atw_cfp_init(sc);
   1270 
   1271 	atw_tofs0_init(sc);
   1272 
   1273 	atw_ifs_init(sc);
   1274 
   1275 	/* XXX Fall asleep after one second of inactivity.
   1276 	 * XXX A frame may only dribble in for 65536us.
   1277 	 */
   1278 	ATW_WRITE(sc, ATW_RMD,
   1279 	    LSHIFT(1, ATW_RMD_PCNT) | LSHIFT(0xffff, ATW_RMD_RMRD_MASK));
   1280 
   1281 	atw_response_times_init(sc);
   1282 
   1283 	atw_bbp_io_init(sc);
   1284 
   1285 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
   1286 
   1287 	if ((error = atw_rf3000_init(sc)) != 0)
   1288 		goto out;
   1289 
   1290 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
   1291 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
   1292 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
   1293 
   1294 	/*
   1295 	 * Initialize the transmit descriptor ring.
   1296 	 */
   1297 	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
   1298 	for (i = 0; i < ATW_NTXDESC; i++) {
   1299 		sc->sc_txdescs[i].at_ctl = 0;
   1300 		/* no transmit chaining */
   1301 		sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
   1302 		sc->sc_txdescs[i].at_buf2 =
   1303 		    htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
   1304 	}
   1305 	/* use ring mode */
   1306 	sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
   1307 	ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
   1308 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
   1309 	sc->sc_txfree = ATW_NTXDESC;
   1310 	sc->sc_txnext = 0;
   1311 
   1312 	/*
   1313 	 * Initialize the transmit job descriptors.
   1314 	 */
   1315 	SIMPLEQ_INIT(&sc->sc_txfreeq);
   1316 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
   1317 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
   1318 		txs = &sc->sc_txsoft[i];
   1319 		txs->txs_mbuf = NULL;
   1320 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
   1321 	}
   1322 
   1323 	/*
   1324 	 * Initialize the receive descriptor and receive job
   1325 	 * descriptor rings.
   1326 	 */
   1327 	for (i = 0; i < ATW_NRXDESC; i++) {
   1328 		rxs = &sc->sc_rxsoft[i];
   1329 		if (rxs->rxs_mbuf == NULL) {
   1330 			if ((error = atw_add_rxbuf(sc, i)) != 0) {
   1331 				printf("%s: unable to allocate or map rx "
   1332 				    "buffer %d, error = %d\n",
   1333 				    sc->sc_dev.dv_xname, i, error);
   1334 				/*
   1335 				 * XXX Should attempt to run with fewer receive
   1336 				 * XXX buffers instead of just failing.
   1337 				 */
   1338 				atw_rxdrain(sc);
   1339 				goto out;
   1340 			}
   1341 		} else
   1342 			ATW_INIT_RXDESC(sc, i);
   1343 	}
   1344 	sc->sc_rxptr = 0;
   1345 
   1346 	/*
   1347 	 * Initialize the interrupt mask and enable interrupts.
   1348 	 */
   1349 	/* normal interrupts */
   1350 	sc->sc_inten =  ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
   1351 	    ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
   1352 
   1353 	/* abnormal interrupts */
   1354 	sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
   1355 	    ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
   1356 	    ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
   1357 
   1358 	sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
   1359 	    ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
   1360 	sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
   1361 	sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
   1362 	    ATW_INTR_TRT;
   1363 
   1364 	sc->sc_linkint_mask &= sc->sc_inten;
   1365 	sc->sc_rxint_mask &= sc->sc_inten;
   1366 	sc->sc_txint_mask &= sc->sc_inten;
   1367 
   1368 	ATW_WRITE(sc, ATW_IER, sc->sc_inten);
   1369 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
   1370 
   1371 	DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
   1372 	    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_IER), sc->sc_inten));
   1373 
   1374 	/*
   1375 	 * Give the transmit and receive rings to the ADM8211.
   1376 	 */
   1377 	ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
   1378 	ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
   1379 
   1380 	sc->sc_txthresh = 0;
   1381 	sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
   1382 	    sc->sc_txth[sc->sc_txthresh].txth_opmode;
   1383 
   1384 	/* common 802.11 configuration */
   1385 	ic->ic_flags &= ~IEEE80211_F_IBSSON;
   1386 	switch (ic->ic_opmode) {
   1387 	case IEEE80211_M_STA:
   1388 		break;
   1389 	case IEEE80211_M_AHDEMO: /* XXX */
   1390 	case IEEE80211_M_IBSS:
   1391 		ic->ic_flags |= IEEE80211_F_IBSSON;
   1392 		/*FALLTHROUGH*/
   1393 	case IEEE80211_M_HOSTAP: /* XXX */
   1394 		break;
   1395 	case IEEE80211_M_MONITOR: /* XXX */
   1396 		break;
   1397 	}
   1398 
   1399 	switch (ic->ic_opmode) {
   1400 	case IEEE80211_M_AHDEMO:
   1401 	case IEEE80211_M_HOSTAP:
   1402 		ic->ic_bss->ni_intval = ic->ic_lintval;
   1403 		ic->ic_bss->ni_rssi = 0;
   1404 		ic->ic_bss->ni_rstamp = 0;
   1405 		break;
   1406 	default:					/* XXX */
   1407 		break;
   1408 	}
   1409 
   1410 	sc->sc_wepctl = 0;
   1411 
   1412 	atw_write_ssid(sc);
   1413 	atw_write_sup_rates(sc);
   1414 	if (ic->ic_caps & IEEE80211_C_WEP)
   1415 		atw_write_wep(sc);
   1416 
   1417 	ic->ic_state = IEEE80211_S_INIT;
   1418 
   1419 	/*
   1420 	 * Set the receive filter.  This will start the transmit and
   1421 	 * receive processes.
   1422 	 */
   1423 	atw_filter_setup(sc);
   1424 
   1425 	/*
   1426 	 * Start the receive process.
   1427 	 */
   1428 	ATW_WRITE(sc, ATW_RDR, 0x1);
   1429 
   1430 	/*
   1431 	 * Note that the interface is now running.
   1432 	 */
   1433 	ifp->if_flags |= IFF_RUNNING;
   1434 	ifp->if_flags &= ~IFF_OACTIVE;
   1435 
   1436 	/* send no beacons, yet. */
   1437 	atw_start_beacon(sc, 0);
   1438 
   1439 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
   1440 		error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
   1441 	else
   1442 		error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
   1443  out:
   1444 	if (error) {
   1445 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
   1446 		ifp->if_timer = 0;
   1447 		printf("%s: interface not running\n", sc->sc_dev.dv_xname);
   1448 	}
   1449 #ifdef ATW_DEBUG
   1450 	atw_print_regs(sc, "end of init");
   1451 #endif /* ATW_DEBUG */
   1452 
   1453 	return (error);
   1454 }
   1455 
   1456 /* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
   1457  *           0: MAC control of RF3000/Si4126.
   1458  *
   1459  * Applies power, or selects RF front-end? Sets reset condition.
   1460  *
   1461  * TBD support non-RFMD BBP, non-SiLabs synth.
   1462  */
   1463 static void
   1464 atw_bbp_io_enable(struct atw_softc *sc, int enable)
   1465 {
   1466 	if (enable) {
   1467 		ATW_WRITE(sc, ATW_SYNRF,
   1468 		    ATW_SYNRF_SELRF|ATW_SYNRF_PE1|ATW_SYNRF_PHYRST);
   1469 		DELAY(atw_bbp_io_enable_delay);
   1470 	} else {
   1471 		ATW_WRITE(sc, ATW_SYNRF, 0);
   1472 		DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
   1473 	}
   1474 }
   1475 
   1476 static int
   1477 atw_tune(struct atw_softc *sc)
   1478 {
   1479 	int rc;
   1480 	u_int chan;
   1481 	struct ieee80211com *ic = &sc->sc_ic;
   1482 
   1483 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
   1484 	if (chan == IEEE80211_CHAN_ANY)
   1485 		panic("%s: chan == IEEE80211_CHAN_ANY\n", __func__);
   1486 
   1487 	if (chan == sc->sc_cur_chan)
   1488 		return 0;
   1489 
   1490 	DPRINTF(sc, ("%s: chan %d -> %d\n", sc->sc_dev.dv_xname,
   1491 	    sc->sc_cur_chan, chan));
   1492 
   1493 	atw_idle(sc, ATW_NAR_SR|ATW_NAR_ST);
   1494 
   1495 	atw_si4126_tune(sc, chan);
   1496 	if ((rc = atw_rf3000_tune(sc, chan)) != 0)
   1497 		printf("%s: failed to tune channel %d\n", sc->sc_dev.dv_xname,
   1498 		    chan);
   1499 
   1500 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
   1501 	DELAY(atw_nar_delay);
   1502 	ATW_WRITE(sc, ATW_RDR, 0x1);
   1503 
   1504 	if (rc == 0)
   1505 		sc->sc_cur_chan = chan;
   1506 
   1507 	return rc;
   1508 }
   1509 
   1510 #ifdef ATW_SYNDEBUG
   1511 static void
   1512 atw_si4126_print(struct atw_softc *sc)
   1513 {
   1514 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   1515 	u_int addr, val;
   1516 
   1517 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
   1518 		return;
   1519 
   1520 	for (addr = 0; addr <= 8; addr++) {
   1521 		printf("%s: synth[%d] = ", sc->sc_dev.dv_xname, addr);
   1522 		if (atw_si4126_read(sc, addr, &val) == 0) {
   1523 			printf("<unknown> (quitting print-out)\n");
   1524 			break;
   1525 		}
   1526 		printf("%05x\n", val);
   1527 	}
   1528 }
   1529 #endif /* ATW_SYNDEBUG */
   1530 
   1531 /* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
   1532  *
   1533  * The RF/IF synthesizer produces two reference frequencies for
   1534  * the RF2948B transceiver.  The first frequency the RF2948B requires
   1535  * is two times the so-called "intermediate frequency" (IF). Since
   1536  * a SAW filter on the radio fixes the IF at 374MHz, I program the
   1537  * Si4126 to generate IF LO = 374MHz x 2 = 748MHz.  The second
   1538  * frequency required by the transceiver is the radio frequency
   1539  * (RF). This is a superheterodyne transceiver; for f(chan) the
   1540  * center frequency of the channel we are tuning, RF = f(chan) -
   1541  * IF.
   1542  *
   1543  * XXX I am told by SiLabs that the Si4126 will accept a broader range
   1544  * of XIN than the 2-25MHz mentioned by the datasheet, even *without*
   1545  * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
   1546  * works, but I have still programmed for XINDIV2 = 1 to be safe.
   1547  */
   1548 static void
   1549 atw_si4126_tune(struct atw_softc *sc, u_int chan)
   1550 {
   1551 	u_int mhz;
   1552 	u_int R;
   1553 	u_int32_t gpio;
   1554 	u_int16_t gain;
   1555 
   1556 #ifdef ATW_SYNDEBUG
   1557 	atw_si4126_print(sc);
   1558 #endif /* ATW_SYNDEBUG */
   1559 
   1560 	if (chan == 14)
   1561 		mhz = 2484;
   1562 	else
   1563 		mhz = 2412 + 5 * (chan - 1);
   1564 
   1565 	/* Tune IF to 748MHz to suit the IF LO input of the
   1566 	 * RF2494B, which is 2 x IF. No need to set an IF divider
   1567          * because an IF in 526MHz - 952MHz is allowed.
   1568 	 *
   1569 	 * XIN is 44.000MHz, so divide it by two to get allowable
   1570 	 * range of 2-25MHz. SiLabs tells me that this is not
   1571 	 * strictly necessary.
   1572 	 */
   1573 
   1574 	if (atw_xindiv2)
   1575 		R = 44;
   1576 	else
   1577 		R = 88;
   1578 
   1579 	/* Power-up RF, IF synthesizers. */
   1580 	atw_si4126_write(sc, SI4126_POWER,
   1581 	    SI4126_POWER_PDIB|SI4126_POWER_PDRB);
   1582 
   1583 	/* set LPWR, too? */
   1584 	atw_si4126_write(sc, SI4126_MAIN,
   1585 	    (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
   1586 
   1587 	/* Set the phase-locked loop gain.  If RF2 N > 2047, then
   1588 	 * set KP2 to 1.
   1589 	 *
   1590 	 * REFDIF This is different from the reference driver, which
   1591 	 * always sets SI4126_GAIN to 0.
   1592 	 */
   1593 	gain = LSHIFT(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
   1594 
   1595 	atw_si4126_write(sc, SI4126_GAIN, gain);
   1596 
   1597 	/* XIN = 44MHz.
   1598 	 *
   1599 	 * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
   1600 	 * R = 44 so that 1496/(2 * 44) * 44MHz = 748MHz.
   1601 	 *
   1602 	 * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
   1603 	 * so that 1496/88 * 44MHz = 748MHz.
   1604 	 */
   1605 	atw_si4126_write(sc, SI4126_IFN, 1496);
   1606 
   1607 	atw_si4126_write(sc, SI4126_IFR, R);
   1608 
   1609 #ifndef ATW_REFSLAVE
   1610 	/* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
   1611 	 * then RF1 becomes the active RF synthesizer, even on the Si4126,
   1612 	 * which has no RF1!
   1613 	 */
   1614 	atw_si4126_write(sc, SI4126_RF1R, R);
   1615 
   1616 	atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
   1617 #endif
   1618 
   1619 	/* N/R * XIN = RF. XIN = 44MHz. We desire RF = mhz - IF,
   1620 	 * where IF = 374MHz.  Let's divide XIN to 1MHz. So R = 44.
   1621 	 * Now let's multiply it to mhz. So mhz - IF = N.
   1622 	 */
   1623 	atw_si4126_write(sc, SI4126_RF2R, R);
   1624 
   1625 	atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
   1626 
   1627 	/* wait 100us from power-up for RF, IF to settle */
   1628 	DELAY(100);
   1629 
   1630 	gpio = ATW_READ(sc, ATW_GPIO);
   1631 	gpio &= ~(ATW_GPIO_EN_MASK|ATW_GPIO_O_MASK|ATW_GPIO_I_MASK);
   1632 	gpio |= LSHIFT(1, ATW_GPIO_EN_MASK);
   1633 
   1634 	if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
   1635 		/* Set a Prism RF front-end to a special mode for channel 14?
   1636 		 *
   1637 		 * Apparently the SMC2635W needs this, although I don't think
   1638 		 * it has a Prism RF.
   1639 		 */
   1640 		gpio |= LSHIFT(1, ATW_GPIO_O_MASK);
   1641 	}
   1642 	ATW_WRITE(sc, ATW_GPIO, gpio);
   1643 
   1644 #ifdef ATW_SYNDEBUG
   1645 	atw_si4126_print(sc);
   1646 #endif /* ATW_SYNDEBUG */
   1647 }
   1648 
   1649 /* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
   1650  * diversity.
   1651  *
   1652  * !!!
   1653  * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
   1654  * !!!
   1655  */
   1656 static int
   1657 atw_rf3000_init(struct atw_softc *sc)
   1658 {
   1659 	int rc = 0;
   1660 
   1661 	atw_bbp_io_enable(sc, 1);
   1662 
   1663 	/* CCA is acquisition sensitive */
   1664 	rc = atw_rf3000_write(sc, RF3000_CCACTL,
   1665 	    LSHIFT(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
   1666 
   1667 	if (rc != 0)
   1668 		goto out;
   1669 
   1670 	/* enable diversity */
   1671 	rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
   1672 
   1673 	if (rc != 0)
   1674 		goto out;
   1675 
   1676 	/* sensible setting from a binary-only driver */
   1677 	rc = atw_rf3000_write(sc, RF3000_GAINCTL,
   1678 	    LSHIFT(0x1d, RF3000_GAINCTL_TXVGC_MASK));
   1679 
   1680 	if (rc != 0)
   1681 		goto out;
   1682 
   1683 	/* magic from a binary-only driver */
   1684 	rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
   1685 	    LSHIFT(0x38, RF3000_LOGAINCAL_CAL_MASK));
   1686 
   1687 	if (rc != 0)
   1688 		goto out;
   1689 
   1690 	rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
   1691 
   1692 	if (rc != 0)
   1693 		goto out;
   1694 
   1695 	/* XXX Reference driver remarks that Abocom sets this to 50.
   1696 	 * Meaning 0x50, I think....  50 = 0x32, which would set a bit
   1697 	 * in the "reserved" area of register RF3000_OPTIONS1.
   1698 	 */
   1699 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
   1700 
   1701 	if (rc != 0)
   1702 		goto out;
   1703 
   1704 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
   1705 
   1706 	if (rc != 0)
   1707 		goto out;
   1708 
   1709 out:
   1710 	atw_bbp_io_enable(sc, 0);
   1711 	return rc;
   1712 }
   1713 
   1714 #ifdef ATW_BBPDEBUG
   1715 static void
   1716 atw_rf3000_print(struct atw_softc *sc)
   1717 {
   1718 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   1719 	u_int addr, val;
   1720 
   1721 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
   1722 		return;
   1723 
   1724 	for (addr = 0x01; addr <= 0x15; addr++) {
   1725 		printf("%s: bbp[%d] = \n", sc->sc_dev.dv_xname, addr);
   1726 		if (atw_rf3000_read(sc, addr, &val) != 0) {
   1727 			printf("<unknown> (quitting print-out)\n");
   1728 			break;
   1729 		}
   1730 		printf("%08x\n", val);
   1731 	}
   1732 }
   1733 #endif /* ATW_BBPDEBUG */
   1734 
   1735 /* Set the power settings on the BBP for channel `chan'. */
   1736 static int
   1737 atw_rf3000_tune(struct atw_softc *sc, u_int chan)
   1738 {
   1739 	int rc = 0;
   1740 	u_int32_t reg;
   1741 	u_int16_t txpower, lpf_cutoff, lna_gs_thresh;
   1742 
   1743 	txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
   1744 	lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
   1745 	lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
   1746 
   1747 	/* odd channels: LSB, even channels: MSB */
   1748 	if (chan % 2 == 1) {
   1749 		txpower &= 0xFF;
   1750 		lpf_cutoff &= 0xFF;
   1751 		lna_gs_thresh &= 0xFF;
   1752 	} else {
   1753 		txpower >>= 8;
   1754 		lpf_cutoff >>= 8;
   1755 		lna_gs_thresh >>= 8;
   1756 	}
   1757 
   1758 #ifdef ATW_BBPDEBUG
   1759 	atw_rf3000_print(sc);
   1760 #endif /* ATW_BBPDEBUG */
   1761 
   1762 	DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
   1763 	    "lna_gs_thresh %02x\n",
   1764 	    sc->sc_dev.dv_xname, chan, txpower, lpf_cutoff, lna_gs_thresh));
   1765 
   1766 	atw_bbp_io_enable(sc, 1);
   1767 
   1768 	if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
   1769 	    LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
   1770 		goto out;
   1771 
   1772 	if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
   1773 		goto out;
   1774 
   1775 	if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
   1776 		goto out;
   1777 
   1778 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0);
   1779 
   1780 	if (rc != 0)
   1781 		goto out;
   1782 
   1783 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
   1784 
   1785 	if (rc != 0)
   1786 		goto out;
   1787 
   1788 #ifdef ATW_BBPDEBUG
   1789 	atw_rf3000_print(sc);
   1790 #endif /* ATW_BBPDEBUG */
   1791 
   1792 out:
   1793 	atw_bbp_io_enable(sc, 0);
   1794 
   1795 	/* set beacon, rts, atim transmit power */
   1796 	reg = ATW_READ(sc, ATW_PLCPHD);
   1797 	reg &= ~ATW_PLCPHD_SERVICE_MASK;
   1798 	reg |= LSHIFT(LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK),
   1799 	    ATW_PLCPHD_SERVICE_MASK);
   1800 	ATW_WRITE(sc, ATW_PLCPHD, reg);
   1801 	DELAY(atw_plcphd_delay);
   1802 
   1803 	return rc;
   1804 }
   1805 
   1806 /* Write a register on the RF3000 baseband processor using the
   1807  * registers provided by the ADM8211 for this purpose.
   1808  *
   1809  * Return 0 on success.
   1810  */
   1811 static int
   1812 atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
   1813 {
   1814 	u_int32_t reg;
   1815 	int i;
   1816 
   1817 	reg = sc->sc_bbpctl_wr |
   1818 	     LSHIFT(val & 0xff, ATW_BBPCTL_DATA_MASK) |
   1819 	     LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
   1820 
   1821 	for (i = 20000 / atw_pseudo_milli; --i >= 0; ) {
   1822 		ATW_WRITE(sc, ATW_BBPCTL, reg);
   1823 		DELAY(2 * atw_pseudo_milli);
   1824 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
   1825 			break;
   1826 	}
   1827 
   1828 	if (i < 0) {
   1829 		printf("%s: BBPCTL still busy\n", sc->sc_dev.dv_xname);
   1830 		return ETIMEDOUT;
   1831 	}
   1832 	return 0;
   1833 }
   1834 
   1835 /* Read a register on the RF3000 baseband processor using the registers
   1836  * the ADM8211 provides for this purpose.
   1837  *
   1838  * The 7-bit register address is addr.  Record the 8-bit data in the register
   1839  * in *val.
   1840  *
   1841  * Return 0 on success.
   1842  *
   1843  * XXX This does not seem to work. The ADM8211 must require more or
   1844  * different magic to read the chip than to write it. Possibly some
   1845  * of the magic I have derived from a binary-only driver concerns
   1846  * the "chip address" (see the RF3000 manual).
   1847  */
   1848 #ifdef ATW_BBPDEBUG
   1849 static int
   1850 atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
   1851 {
   1852 	u_int32_t reg;
   1853 	int i;
   1854 
   1855 	for (i = 1000; --i >= 0; ) {
   1856 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD|ATW_BBPCTL_WR) == 0)
   1857 			break;
   1858 		DELAY(100);
   1859 	}
   1860 
   1861 	if (i < 0) {
   1862 		printf("%s: start atw_rf3000_read, BBPCTL busy\n",
   1863 		    sc->sc_dev.dv_xname);
   1864 		return ETIMEDOUT;
   1865 	}
   1866 
   1867 	reg = sc->sc_bbpctl_rd | LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
   1868 
   1869 	ATW_WRITE(sc, ATW_BBPCTL, reg);
   1870 
   1871 	for (i = 1000; --i >= 0; ) {
   1872 		DELAY(100);
   1873 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
   1874 			break;
   1875 	}
   1876 
   1877 	ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
   1878 
   1879 	if (i < 0) {
   1880 		printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
   1881 		    sc->sc_dev.dv_xname, reg);
   1882 		return ETIMEDOUT;
   1883 	}
   1884 	if (val != NULL)
   1885 		*val = MASK_AND_RSHIFT(reg, ATW_BBPCTL_DATA_MASK);
   1886 	return 0;
   1887 }
   1888 #endif /* ATW_BBPDEBUG */
   1889 
   1890 /* Write a register on the Si4126 RF/IF synthesizer using the registers
   1891  * provided by the ADM8211 for that purpose.
   1892  *
   1893  * val is 18 bits of data, and val is the 4-bit address of the register.
   1894  *
   1895  * Return 0 on success.
   1896  */
   1897 static void
   1898 atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
   1899 {
   1900 	uint32_t bits, mask, reg;
   1901 	const int nbits = 22;
   1902 
   1903 	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
   1904 	KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
   1905 
   1906 	bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
   1907 	       LSHIFT(addr, SI4126_TWI_ADDR_MASK);
   1908 
   1909 	reg = ATW_SYNRF_SELSYN;
   1910 	/* reference driver: reset Si4126 serial bus to initial
   1911 	 * conditions?
   1912 	 */
   1913 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
   1914 	ATW_WRITE(sc, ATW_SYNRF, reg);
   1915 
   1916 	for (mask = BIT(nbits - 1); mask != 0; mask >>= 1) {
   1917 		if ((bits & mask) != 0)
   1918 			reg |= ATW_SYNRF_SYNDATA;
   1919 		else
   1920 			reg &= ~ATW_SYNRF_SYNDATA;
   1921 		ATW_WRITE(sc, ATW_SYNRF, reg);
   1922 		ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
   1923 		ATW_WRITE(sc, ATW_SYNRF, reg);
   1924 	}
   1925 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
   1926 	ATW_WRITE(sc, ATW_SYNRF, 0x0);
   1927 }
   1928 
   1929 /* Read 18-bit data from the 4-bit address addr in Si4126
   1930  * RF synthesizer and write the data to *val. Return 0 on success.
   1931  *
   1932  * XXX This does not seem to work. The ADM8211 must require more or
   1933  * different magic to read the chip than to write it.
   1934  */
   1935 #ifdef ATW_SYNDEBUG
   1936 static int
   1937 atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
   1938 {
   1939 	u_int32_t reg;
   1940 	int i;
   1941 
   1942 	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
   1943 
   1944 	for (i = 1000; --i >= 0; ) {
   1945 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD|ATW_SYNCTL_WR) == 0)
   1946 			break;
   1947 		DELAY(100);
   1948 	}
   1949 
   1950 	if (i < 0) {
   1951 		printf("%s: start atw_si4126_read, SYNCTL busy\n",
   1952 		    sc->sc_dev.dv_xname);
   1953 		return ETIMEDOUT;
   1954 	}
   1955 
   1956 	reg = sc->sc_synctl_rd | LSHIFT(addr, ATW_SYNCTL_DATA_MASK);
   1957 
   1958 	ATW_WRITE(sc, ATW_SYNCTL, reg);
   1959 
   1960 	for (i = 1000; --i >= 0; ) {
   1961 		DELAY(100);
   1962 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
   1963 			break;
   1964 	}
   1965 
   1966 	ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
   1967 
   1968 	if (i < 0) {
   1969 		printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
   1970 		    sc->sc_dev.dv_xname, reg);
   1971 		return ETIMEDOUT;
   1972 	}
   1973 	if (val != NULL)
   1974 		*val = MASK_AND_RSHIFT(ATW_READ(sc, ATW_SYNCTL),
   1975 		                       ATW_SYNCTL_DATA_MASK);
   1976 	return 0;
   1977 }
   1978 #endif /* ATW_SYNDEBUG */
   1979 
   1980 /* XXX is the endianness correct? test. */
   1981 #define	atw_calchash(addr) \
   1982 	(ether_crc32_le((addr), IEEE80211_ADDR_LEN) & BITS(5, 0))
   1983 
   1984 /*
   1985  * atw_filter_setup:
   1986  *
   1987  *	Set the ADM8211's receive filter.
   1988  */
   1989 static void
   1990 atw_filter_setup(struct atw_softc *sc)
   1991 {
   1992 	struct ieee80211com *ic = &sc->sc_ic;
   1993 	struct ethercom *ec = &ic->ic_ec;
   1994 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   1995 	int hash;
   1996 	u_int32_t hashes[2];
   1997 	struct ether_multi *enm;
   1998 	struct ether_multistep step;
   1999 
   2000 	/* According to comments in tlp_al981_filter_setup
   2001 	 * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
   2002 	 * multicast filter to be set while it is running.  Hopefully
   2003 	 * the ADM8211 is not the same!
   2004 	 */
   2005 	if ((ifp->if_flags & IFF_RUNNING) != 0)
   2006 		atw_idle(sc, ATW_NAR_SR);
   2007 
   2008 	sc->sc_opmode &= ~(ATW_NAR_PR|ATW_NAR_MM);
   2009 
   2010 	/* XXX in scan mode, do not filter packets.  Maybe this is
   2011 	 * unnecessary.
   2012 	 */
   2013 	if (ic->ic_state == IEEE80211_S_SCAN ||
   2014 	    (ifp->if_flags & IFF_PROMISC) != 0) {
   2015 		sc->sc_opmode |= ATW_NAR_PR;
   2016 		goto allmulti;
   2017 	}
   2018 
   2019 	hashes[0] = hashes[1] = 0x0;
   2020 
   2021 	/*
   2022 	 * Program the 64-bit multicast hash filter.
   2023 	 */
   2024 	ETHER_FIRST_MULTI(step, ec, enm);
   2025 	while (enm != NULL) {
   2026 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
   2027 		    ETHER_ADDR_LEN) != 0)
   2028 			goto allmulti;
   2029 
   2030 		hash = atw_calchash(enm->enm_addrlo);
   2031 		hashes[hash >> 5] |= 1 << (hash & 0x1f);
   2032 		ETHER_NEXT_MULTI(step, enm);
   2033 	}
   2034 	ifp->if_flags &= ~IFF_ALLMULTI;
   2035 	goto setit;
   2036 
   2037 allmulti:
   2038 	ifp->if_flags |= IFF_ALLMULTI;
   2039 	hashes[0] = hashes[1] = 0xffffffff;
   2040 
   2041 setit:
   2042 	ATW_WRITE(sc, ATW_MAR0, hashes[0]);
   2043 	ATW_WRITE(sc, ATW_MAR1, hashes[1]);
   2044 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
   2045 	DELAY(atw_nar_delay);
   2046 
   2047 	DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", sc->sc_dev.dv_xname,
   2048 	    ATW_READ(sc, ATW_NAR), sc->sc_opmode));
   2049 }
   2050 
   2051 /* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
   2052  * a beacon's BSSID and SSID against the preferred BSSID and SSID
   2053  * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
   2054  * no beacon with the preferred BSSID and SSID in the number of
   2055  * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
   2056  */
   2057 static void
   2058 atw_write_bssid(struct atw_softc *sc)
   2059 {
   2060 	struct ieee80211com *ic = &sc->sc_ic;
   2061 	u_int8_t *bssid;
   2062 
   2063 	bssid = ic->ic_bss->ni_bssid;
   2064 
   2065 	ATW_WRITE(sc, ATW_BSSID0,
   2066 	    LSHIFT(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
   2067 	    LSHIFT(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
   2068 	    LSHIFT(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
   2069 	    LSHIFT(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
   2070 
   2071 	ATW_WRITE(sc, ATW_ABDA1,
   2072 	    (ATW_READ(sc, ATW_ABDA1) &
   2073 	    ~(ATW_ABDA1_BSSIDB4_MASK|ATW_ABDA1_BSSIDB5_MASK)) |
   2074 	    LSHIFT(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
   2075 	    LSHIFT(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
   2076 
   2077 	DPRINTF(sc, ("%s: BSSID %s -> ", sc->sc_dev.dv_xname,
   2078 	    ether_sprintf(sc->sc_bssid)));
   2079 	DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
   2080 
   2081 	memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
   2082 }
   2083 
   2084 /* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
   2085  * 16-bit word.
   2086  */
   2087 static void
   2088 atw_write_sram(struct atw_softc *sc, u_int ofs, u_int8_t *buf, u_int buflen)
   2089 {
   2090 	u_int i;
   2091 	u_int8_t *ptr;
   2092 
   2093 	memcpy(&sc->sc_sram[ofs], buf, buflen);
   2094 
   2095 	KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
   2096 
   2097 	KASSERT(buflen + ofs <= sc->sc_sramlen);
   2098 
   2099 	ptr = &sc->sc_sram[ofs];
   2100 
   2101 	for (i = 0; i < buflen; i += 2) {
   2102 		ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
   2103 		    LSHIFT((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
   2104 		DELAY(atw_writewep_delay);
   2105 
   2106 		ATW_WRITE(sc, ATW_WESK,
   2107 		    LSHIFT((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
   2108 		DELAY(atw_writewep_delay);
   2109 	}
   2110 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
   2111 
   2112 	if (sc->sc_if.if_flags & IFF_DEBUG) {
   2113 		int n_octets = 0;
   2114 		printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
   2115 		    sc->sc_dev.dv_xname, buflen, ofs, sc->sc_wepctl);
   2116 		for (i = 0; i < buflen; i++) {
   2117 			printf(" %02x", ptr[i]);
   2118 			if (++n_octets % 24 == 0)
   2119 				printf("\n");
   2120 		}
   2121 		if (n_octets % 24 != 0)
   2122 			printf("\n");
   2123 	}
   2124 }
   2125 
   2126 /* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
   2127 static void
   2128 atw_write_wep(struct atw_softc *sc)
   2129 {
   2130 	struct ieee80211com *ic = &sc->sc_ic;
   2131 	/* SRAM shared-key record format: key0 flags key1 ... key12 */
   2132 	u_int8_t buf[IEEE80211_WEP_NKID]
   2133 	            [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
   2134 	u_int32_t reg;
   2135 	int i;
   2136 
   2137 	sc->sc_wepctl = 0;
   2138 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
   2139 
   2140 	if ((ic->ic_flags & IEEE80211_F_WEPON) == 0)
   2141 		return;
   2142 
   2143 	memset(&buf[0][0], 0, sizeof(buf));
   2144 
   2145 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   2146 		if (ic->ic_nw_keys[i].wk_len > 5) {
   2147 			buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
   2148 		} else if (ic->ic_nw_keys[i].wk_len != 0) {
   2149 			buf[i][1] = ATW_WEP_ENABLED;
   2150 		} else {
   2151 			buf[i][1] = 0;
   2152 			continue;
   2153 		}
   2154 		buf[i][0] = ic->ic_nw_keys[i].wk_key[0];
   2155 		memcpy(&buf[i][2], &ic->ic_nw_keys[i].wk_key[1],
   2156 		    ic->ic_nw_keys[i].wk_len - 1);
   2157 	}
   2158 
   2159 	reg = ATW_READ(sc, ATW_MACTEST);
   2160 	reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
   2161 	reg &= ~ATW_MACTEST_KEYID_MASK;
   2162 	reg |= LSHIFT(ic->ic_wep_txkey, ATW_MACTEST_KEYID_MASK);
   2163 	ATW_WRITE(sc, ATW_MACTEST, reg);
   2164 
   2165 	sc->sc_wepctl = ATW_WEPCTL_WEPENABLE;
   2166 
   2167 	switch (sc->sc_rev) {
   2168 	case ATW_REVISION_AB:
   2169 	case ATW_REVISION_AF:
   2170 		/* Bypass WEP on Rx. */
   2171 		sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
   2172 		break;
   2173 	default:
   2174 		break;
   2175 	}
   2176 
   2177 	atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (u_int8_t*)&buf[0][0],
   2178 	    sizeof(buf));
   2179 }
   2180 
   2181 const struct timeval atw_beacon_mininterval = {.tv_sec = 1, .tv_usec = 0};
   2182 
   2183 static void
   2184 atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
   2185     struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
   2186 {
   2187 	struct atw_softc *sc = (struct atw_softc*)ic->ic_softc;
   2188 
   2189 	switch (subtype) {
   2190 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
   2191 		/* do nothing: hardware answers probe request */
   2192 		break;
   2193 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
   2194 	case IEEE80211_FC0_SUBTYPE_BEACON:
   2195 		atw_recv_beacon(ic, m, ni, subtype, rssi, rstamp);
   2196 		break;
   2197 	default:
   2198 		(*sc->sc_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
   2199 		break;
   2200 	}
   2201 	return;
   2202 }
   2203 
   2204 static int
   2205 do_slow_print(struct atw_softc *sc, int *did_print)
   2206 {
   2207 	if ((sc->sc_if.if_flags & IFF_LINK0) == 0)
   2208 		return 0;
   2209 	if (!*did_print && (sc->sc_if.if_flags & IFF_DEBUG) == 0 &&
   2210 	    !ratecheck(&sc->sc_last_beacon, &atw_beacon_mininterval))
   2211 		return 0;
   2212 
   2213 	*did_print = 1;
   2214 	return 1;
   2215 }
   2216 
   2217 /* In ad hoc mode, atw_recv_beacon is responsible for the coalescence
   2218  * of IBSSs with like SSID/channel but different BSSID. It joins the
   2219  * oldest IBSS (i.e., with greatest TSF time), since that is the WECA
   2220  * convention. Possibly the ADMtek chip does this for us; I will have
   2221  * to test to find out.
   2222  *
   2223  * XXX we should add the duration field of the received beacon to
   2224  * the TSF time it contains before comparing it with the ADM8211's
   2225  * TSF.
   2226  */
   2227 static void
   2228 atw_recv_beacon(struct ieee80211com *ic, struct mbuf *m0,
   2229     struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
   2230 {
   2231 	struct atw_softc *sc;
   2232 	struct ieee80211_frame *wh;
   2233 	uint32_t tsftl, tsfth;
   2234 	uint32_t bcn_tsftl, bcn_tsfth;
   2235 	int did_print = 0, sign;
   2236 	union {
   2237 		uint32_t	words[2];
   2238 		uint8_t		tstamp[8];
   2239 	} u;
   2240 
   2241 	sc = (struct atw_softc*)ic->ic_if.if_softc;
   2242 
   2243 	(*sc->sc_recv_mgmt)(ic, m0, ni, subtype, rssi, rstamp);
   2244 
   2245 	if (ic->ic_state != IEEE80211_S_RUN)
   2246 		return;
   2247 
   2248 	atw_tsft(sc, &tsfth, &tsftl);
   2249 
   2250 	(void)memcpy(&u, &ni->ni_tstamp[0], sizeof(u));
   2251 	bcn_tsftl = le32toh(u.words[0]);
   2252 	bcn_tsfth = le32toh(u.words[1]);
   2253 
   2254 	/* we are faster, let the other guy catch up */
   2255 	if (bcn_tsfth < tsfth)
   2256 		sign = -1;
   2257 	else if (bcn_tsfth == tsfth && bcn_tsftl < tsftl)
   2258 		sign = -1;
   2259 	else
   2260 		sign = 1;
   2261 
   2262 	if (memcmp(ni->ni_bssid, ic->ic_bss->ni_bssid,
   2263 	    IEEE80211_ADDR_LEN) == 0) {
   2264 		if (!do_slow_print(sc, &did_print))
   2265 			return;
   2266 		printf("%s: tsft offset %s%" PRIu64 "\n", sc->sc_dev.dv_xname,
   2267 		    (sign < 0) ? "-" : "",
   2268 		    (sign < 0)
   2269 			? ((((uint64_t)tsfth << 32) | tsftl) -
   2270 			   (((uint64_t)bcn_tsfth << 32) | bcn_tsftl))
   2271 			: ((((uint64_t)bcn_tsfth << 32) | bcn_tsftl) -
   2272 			   (((uint64_t)tsfth << 32) | tsftl)));
   2273 		return;
   2274 	}
   2275 
   2276 	if (sign < 0)
   2277 		return;
   2278 
   2279 	if (ieee80211_match_bss(ic, ni) != 0)
   2280 		return;
   2281 
   2282 	if (do_slow_print(sc, &did_print)) {
   2283 		printf("%s: atw_recv_beacon: bssid mismatch %s\n",
   2284 		    sc->sc_dev.dv_xname, ether_sprintf(ni->ni_bssid));
   2285 	}
   2286 
   2287 	if (ic->ic_opmode != IEEE80211_M_IBSS)
   2288 		return;
   2289 
   2290 	if (do_slow_print(sc, &did_print)) {
   2291 		printf("%s: my tsft %" PRIu64 " beacon tsft %" PRIu64 "\n",
   2292 		    sc->sc_dev.dv_xname, ((uint64_t)tsfth << 32) | tsftl,
   2293 		    ((uint64_t)bcn_tsfth << 32) | bcn_tsftl);
   2294 	}
   2295 
   2296 	wh = mtod(m0, struct ieee80211_frame *);
   2297 
   2298 	if (do_slow_print(sc, &did_print)) {
   2299 		printf("%s: sync TSF with %s\n",
   2300 		    sc->sc_dev.dv_xname, ether_sprintf(wh->i_addr2));
   2301 	}
   2302 
   2303 	ic->ic_flags &= ~IEEE80211_F_SIBSS;
   2304 
   2305 	(void)memcpy(&ic->ic_bss->ni_tstamp[0], &u, sizeof(u));
   2306 
   2307 	atw_tsf(sc);
   2308 
   2309 	/* negotiate rates with new IBSS */
   2310 	ieee80211_fix_rate(ic, ni, IEEE80211_F_DOFRATE |
   2311 	    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
   2312 	if (ni->ni_rates.rs_nrates == 0) {
   2313 		if (do_slow_print(sc, &did_print)) {
   2314 			printf("%s: rates mismatch, BSSID %s\n",
   2315 			    sc->sc_dev.dv_xname, ether_sprintf(ni->ni_bssid));
   2316 		}
   2317 		return;
   2318 	}
   2319 
   2320 	if (do_slow_print(sc, &did_print)) {
   2321 		printf("%s: sync BSSID %s -> ",
   2322 		    sc->sc_dev.dv_xname, ether_sprintf(ic->ic_bss->ni_bssid));
   2323 		printf("%s ", ether_sprintf(ni->ni_bssid));
   2324 		printf("(from %s)\n", ether_sprintf(wh->i_addr2));
   2325 	}
   2326 
   2327 	(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
   2328 
   2329 	atw_write_bssid(sc);
   2330 	atw_start_beacon(sc, 1);
   2331 }
   2332 
   2333 /* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
   2334  * In ad hoc mode, the SSID is written to the beacons sent by the
   2335  * ADM8211. In both ad hoc and infrastructure mode, beacons received
   2336  * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
   2337  * indications.
   2338  */
   2339 static void
   2340 atw_write_ssid(struct atw_softc *sc)
   2341 {
   2342 	struct ieee80211com *ic = &sc->sc_ic;
   2343 	/* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
   2344 	 * it only expects the element length, not its ID.
   2345 	 */
   2346 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
   2347 
   2348 	memset(buf, 0, sizeof(buf));
   2349 	buf[0] = ic->ic_bss->ni_esslen;
   2350 	memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
   2351 
   2352 	atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
   2353 	    roundup(1 + ic->ic_bss->ni_esslen, 2));
   2354 }
   2355 
   2356 /* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
   2357  * In ad hoc mode, the supported rates are written to beacons sent by the
   2358  * ADM8211.
   2359  */
   2360 static void
   2361 atw_write_sup_rates(struct atw_softc *sc)
   2362 {
   2363 	struct ieee80211com *ic = &sc->sc_ic;
   2364 	/* 14 bytes are probably (XXX) reserved in the ADM8211 SRAM for
   2365 	 * supported rates
   2366 	 */
   2367 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_RATE_SIZE, 2)];
   2368 
   2369 	memset(buf, 0, sizeof(buf));
   2370 
   2371 	buf[0] = ic->ic_bss->ni_rates.rs_nrates;
   2372 
   2373 	memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates,
   2374 	    ic->ic_bss->ni_rates.rs_nrates);
   2375 
   2376 	atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
   2377 }
   2378 
   2379 /* Start/stop sending beacons. */
   2380 void
   2381 atw_start_beacon(struct atw_softc *sc, int start)
   2382 {
   2383 	struct ieee80211com *ic = &sc->sc_ic;
   2384 	uint16_t chan;
   2385 	uint32_t bcnt, bpli, cap0, cap1, capinfo;
   2386 	size_t len;
   2387 
   2388 	if (ATW_IS_ENABLED(sc) == 0)
   2389 		return;
   2390 
   2391 	/* start beacons */
   2392 	len = sizeof(struct ieee80211_frame) +
   2393 	    8 /* timestamp */ + 2 /* beacon interval */ +
   2394 	    2 /* capability info */ +
   2395 	    2 + ic->ic_bss->ni_esslen /* SSID element */ +
   2396 	    2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
   2397 	    3 /* DS parameters */ +
   2398 	    IEEE80211_CRC_LEN;
   2399 
   2400 	bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
   2401 	cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
   2402 	cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
   2403 
   2404 	ATW_WRITE(sc, ATW_BCNT, bcnt);
   2405 	ATW_WRITE(sc, ATW_CAP1, cap1);
   2406 
   2407 	if (!start)
   2408 		return;
   2409 
   2410 	/* TBD use ni_capinfo */
   2411 
   2412 	capinfo = 0;
   2413 	if (sc->sc_flags & ATWF_SHORT_PREAMBLE)
   2414 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
   2415 	if (ic->ic_flags & IEEE80211_F_WEPON)
   2416 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
   2417 
   2418 	switch (ic->ic_opmode) {
   2419 	case IEEE80211_M_IBSS:
   2420 		len += 4; /* IBSS parameters */
   2421 		capinfo |= IEEE80211_CAPINFO_IBSS;
   2422 		break;
   2423 	case IEEE80211_M_HOSTAP:
   2424 		/* XXX 6-byte minimum TIM */
   2425 		len += atw_beacon_len_adjust;
   2426 		capinfo |= IEEE80211_CAPINFO_ESS;
   2427 		break;
   2428 	default:
   2429 		return;
   2430 	}
   2431 
   2432 	/* set listen interval
   2433 	 * XXX do software units agree w/ hardware?
   2434 	 */
   2435 	bpli = LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
   2436 	    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
   2437 
   2438 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
   2439 
   2440 	bcnt |= LSHIFT(len, ATW_BCNT_BCNT_MASK);
   2441 	cap0 |= LSHIFT(chan, ATW_CAP0_CHN_MASK);
   2442 	cap1 |= LSHIFT(capinfo, ATW_CAP1_CAPI_MASK);
   2443 
   2444 	ATW_WRITE(sc, ATW_BCNT, bcnt);
   2445 	ATW_WRITE(sc, ATW_BPLI, bpli);
   2446 	ATW_WRITE(sc, ATW_CAP0, cap0);
   2447 	ATW_WRITE(sc, ATW_CAP1, cap1);
   2448 
   2449 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
   2450 	    sc->sc_dev.dv_xname, bcnt));
   2451 
   2452 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
   2453 	    sc->sc_dev.dv_xname, cap1));
   2454 }
   2455 
   2456 /* Return the 32 lsb of the last TSFT divisible by ival. */
   2457 static __inline uint32_t
   2458 atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
   2459 {
   2460 	/* Following the reference driver's lead, I compute
   2461 	 *
   2462 	 *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
   2463 	 *
   2464 	 * without using 64-bit arithmetic, using the following
   2465 	 * relationship:
   2466 	 *
   2467 	 *     (0x100000000 * H + L) % m
   2468 	 *   = ((0x100000000 % m) * H + L) % m
   2469 	 *   = (((0xffffffff + 1) % m) * H + L) % m
   2470 	 *   = ((0xffffffff % m + 1 % m) * H + L) % m
   2471 	 *   = ((0xffffffff % m + 1) * H + L) % m
   2472 	 */
   2473 	return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
   2474 }
   2475 
   2476 static __inline void
   2477 atw_tsft(struct atw_softc *sc, uint32_t *tsfth, uint32_t *tsftl)
   2478 {
   2479 	int i;
   2480 	for (i = 0; i < 2; i++) {
   2481 		*tsfth = ATW_READ(sc, ATW_TSFTH);
   2482 		*tsftl = ATW_READ(sc, ATW_TSFTL);
   2483 		if (ATW_READ(sc, ATW_TSFTH) == *tsfth)
   2484 			break;
   2485 	}
   2486 }
   2487 
   2488 /* If we've created an IBSS, write the TSF time in the ADM8211 to
   2489  * the ieee80211com.
   2490  *
   2491  * Predict the next target beacon transmission time (TBTT) and
   2492  * write it to the ADM8211.
   2493  */
   2494 static void
   2495 atw_tsf(struct atw_softc *sc)
   2496 {
   2497 #define TBTTOFS 20 /* TU */
   2498 
   2499 	struct ieee80211com *ic = &sc->sc_ic;
   2500 	uint32_t ival, past_even, tbtt, tsfth, tsftl;
   2501 	union {
   2502 		uint32_t	words[2];
   2503 		uint8_t		tstamp[8];
   2504 	} u;
   2505 
   2506 	if ((ic->ic_opmode == IEEE80211_M_HOSTAP) ||
   2507 	    ((ic->ic_opmode == IEEE80211_M_IBSS) &&
   2508 	     (ic->ic_flags & IEEE80211_F_SIBSS))) {
   2509 		atw_tsft(sc, &tsfth, &tsftl);
   2510 		u.words[0] = htole32(tsftl);
   2511 		u.words[1] = htole32(tsfth);
   2512 		(void)memcpy(&ic->ic_bss->ni_tstamp[0], &u,
   2513 		    sizeof(ic->ic_bss->ni_tstamp));
   2514 	} else {
   2515 		(void)memcpy(&u, &ic->ic_bss->ni_tstamp[0], sizeof(u));
   2516 		tsftl = le32toh(u.words[0]);
   2517 		tsfth = le32toh(u.words[1]);
   2518 	}
   2519 
   2520 	ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
   2521 
   2522 	/* We sent/received the last beacon `past' microseconds
   2523 	 * after the interval divided the TSF timer.
   2524 	 */
   2525 	past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
   2526 
   2527 	/* Skip ten beacons so that the TBTT cannot pass before
   2528 	 * we've programmed it.  Ten is an arbitrary number.
   2529 	 */
   2530 	tbtt = past_even + ival * 10;
   2531 
   2532 	ATW_WRITE(sc, ATW_TOFS1,
   2533 	    LSHIFT(1, ATW_TOFS1_TSFTOFSR_MASK) |
   2534 	    LSHIFT(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
   2535 	    LSHIFT(MASK_AND_RSHIFT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
   2536 	        ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
   2537 #undef TBTTOFS
   2538 }
   2539 
   2540 static void
   2541 atw_next_scan(void *arg)
   2542 {
   2543 	struct atw_softc *sc = arg;
   2544 	struct ieee80211com *ic = &sc->sc_ic;
   2545 	struct ifnet *ifp = &ic->ic_if;
   2546 	int s;
   2547 
   2548 	/* don't call atw_start w/o network interrupts blocked */
   2549 	s = splnet();
   2550 	if (ic->ic_state == IEEE80211_S_SCAN)
   2551 		ieee80211_next_scan(ifp);
   2552 	splx(s);
   2553 }
   2554 
   2555 /* Synchronize the hardware state with the software state. */
   2556 static int
   2557 atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
   2558 {
   2559 	struct ifnet *ifp = &ic->ic_if;
   2560 	struct atw_softc *sc = ifp->if_softc;
   2561 	enum ieee80211_state ostate;
   2562 	int error;
   2563 
   2564 	ostate = ic->ic_state;
   2565 
   2566 	if (nstate == IEEE80211_S_INIT) {
   2567 		callout_stop(&sc->sc_scan_ch);
   2568 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
   2569 		atw_start_beacon(sc, 0);
   2570 		return (*sc->sc_newstate)(ic, nstate, arg);
   2571 	}
   2572 
   2573 	if ((error = atw_tune(sc)) != 0)
   2574 		return error;
   2575 
   2576 	switch (nstate) {
   2577 	case IEEE80211_S_ASSOC:
   2578 		break;
   2579 	case IEEE80211_S_INIT:
   2580 		panic("%s: unexpected state IEEE80211_S_INIT\n", __func__);
   2581 		break;
   2582 	case IEEE80211_S_SCAN:
   2583 		callout_reset(&sc->sc_scan_ch, atw_dwelltime * hz / 1000,
   2584 		    atw_next_scan, sc);
   2585 
   2586 		break;
   2587 	case IEEE80211_S_RUN:
   2588 		if (ic->ic_opmode == IEEE80211_M_STA)
   2589 			break;
   2590 		/*FALLTHROUGH*/
   2591 	case IEEE80211_S_AUTH:
   2592 		atw_write_bssid(sc);
   2593 		atw_write_ssid(sc);
   2594 		atw_write_sup_rates(sc);
   2595 
   2596 		if (ic->ic_opmode == IEEE80211_M_AHDEMO ||
   2597 		    ic->ic_opmode == IEEE80211_M_MONITOR)
   2598 			break;
   2599 
   2600 		/* set listen interval
   2601 		 * XXX do software units agree w/ hardware?
   2602 		 */
   2603 		ATW_WRITE(sc, ATW_BPLI,
   2604 		    LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
   2605 		    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval,
   2606 			   ATW_BPLI_LI_MASK));
   2607 
   2608 		DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n",
   2609 		    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_BPLI)));
   2610 
   2611 		atw_tsf(sc);
   2612 		break;
   2613 	}
   2614 
   2615 	if (nstate != IEEE80211_S_SCAN)
   2616 		callout_stop(&sc->sc_scan_ch);
   2617 
   2618 	if (nstate == IEEE80211_S_RUN &&
   2619 	    (ic->ic_opmode == IEEE80211_M_HOSTAP ||
   2620 	     ic->ic_opmode == IEEE80211_M_IBSS))
   2621 		atw_start_beacon(sc, 1);
   2622 	else
   2623 		atw_start_beacon(sc, 0);
   2624 
   2625 	error = (*sc->sc_newstate)(ic, nstate, arg);
   2626 
   2627 	if (ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_SCAN)
   2628 		atw_write_bssid(sc);
   2629 
   2630 	return error;
   2631 }
   2632 
   2633 /*
   2634  * atw_add_rxbuf:
   2635  *
   2636  *	Add a receive buffer to the indicated descriptor.
   2637  */
   2638 int
   2639 atw_add_rxbuf(struct atw_softc *sc, int idx)
   2640 {
   2641 	struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
   2642 	struct mbuf *m;
   2643 	int error;
   2644 
   2645 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   2646 	if (m == NULL)
   2647 		return (ENOBUFS);
   2648 
   2649 	MCLGET(m, M_DONTWAIT);
   2650 	if ((m->m_flags & M_EXT) == 0) {
   2651 		m_freem(m);
   2652 		return (ENOBUFS);
   2653 	}
   2654 
   2655 	if (rxs->rxs_mbuf != NULL)
   2656 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
   2657 
   2658 	rxs->rxs_mbuf = m;
   2659 
   2660 	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
   2661 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
   2662 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
   2663 	if (error) {
   2664 		printf("%s: can't load rx DMA map %d, error = %d\n",
   2665 		    sc->sc_dev.dv_xname, idx, error);
   2666 		panic("atw_add_rxbuf");	/* XXX */
   2667 	}
   2668 
   2669 	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
   2670 	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
   2671 
   2672 	ATW_INIT_RXDESC(sc, idx);
   2673 
   2674 	return (0);
   2675 }
   2676 
   2677 /*
   2678  * Release any queued transmit buffers.
   2679  */
   2680 void
   2681 atw_txdrain(struct atw_softc *sc)
   2682 {
   2683 	struct atw_txsoft *txs;
   2684 
   2685 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
   2686 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
   2687 		if (txs->txs_mbuf != NULL) {
   2688 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
   2689 			m_freem(txs->txs_mbuf);
   2690 			txs->txs_mbuf = NULL;
   2691 		}
   2692 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
   2693 	}
   2694 	sc->sc_tx_timer = 0;
   2695 }
   2696 
   2697 /*
   2698  * atw_stop:		[ ifnet interface function ]
   2699  *
   2700  *	Stop transmission on the interface.
   2701  */
   2702 void
   2703 atw_stop(struct ifnet *ifp, int disable)
   2704 {
   2705 	struct atw_softc *sc = ifp->if_softc;
   2706 	struct ieee80211com *ic = &sc->sc_ic;
   2707 
   2708 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   2709 
   2710 	/* Disable interrupts. */
   2711 	ATW_WRITE(sc, ATW_IER, 0);
   2712 
   2713 	/* Stop the transmit and receive processes. */
   2714 	sc->sc_opmode = 0;
   2715 	ATW_WRITE(sc, ATW_NAR, 0);
   2716 	DELAY(atw_nar_delay);
   2717 	ATW_WRITE(sc, ATW_TDBD, 0);
   2718 	ATW_WRITE(sc, ATW_TDBP, 0);
   2719 	ATW_WRITE(sc, ATW_RDB, 0);
   2720 
   2721 	atw_txdrain(sc);
   2722 
   2723 	if (disable) {
   2724 		atw_rxdrain(sc);
   2725 		atw_disable(sc);
   2726 	}
   2727 
   2728 	/*
   2729 	 * Mark the interface down and cancel the watchdog timer.
   2730 	 */
   2731 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
   2732 	ifp->if_timer = 0;
   2733 
   2734 	if (!disable)
   2735 		atw_reset(sc);
   2736 }
   2737 
   2738 /*
   2739  * atw_rxdrain:
   2740  *
   2741  *	Drain the receive queue.
   2742  */
   2743 void
   2744 atw_rxdrain(struct atw_softc *sc)
   2745 {
   2746 	struct atw_rxsoft *rxs;
   2747 	int i;
   2748 
   2749 	for (i = 0; i < ATW_NRXDESC; i++) {
   2750 		rxs = &sc->sc_rxsoft[i];
   2751 		if (rxs->rxs_mbuf == NULL)
   2752 			continue;
   2753 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
   2754 		m_freem(rxs->rxs_mbuf);
   2755 		rxs->rxs_mbuf = NULL;
   2756 	}
   2757 }
   2758 
   2759 /*
   2760  * atw_detach:
   2761  *
   2762  *	Detach an ADM8211 interface.
   2763  */
   2764 int
   2765 atw_detach(struct atw_softc *sc)
   2766 {
   2767 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   2768 	struct atw_rxsoft *rxs;
   2769 	struct atw_txsoft *txs;
   2770 	int i;
   2771 
   2772 	/*
   2773 	 * Succeed now if there isn't any work to do.
   2774 	 */
   2775 	if ((sc->sc_flags & ATWF_ATTACHED) == 0)
   2776 		return (0);
   2777 
   2778 	ieee80211_ifdetach(ifp);
   2779 	if_detach(ifp);
   2780 
   2781 	for (i = 0; i < ATW_NRXDESC; i++) {
   2782 		rxs = &sc->sc_rxsoft[i];
   2783 		if (rxs->rxs_mbuf != NULL) {
   2784 			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
   2785 			m_freem(rxs->rxs_mbuf);
   2786 			rxs->rxs_mbuf = NULL;
   2787 		}
   2788 		bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
   2789 	}
   2790 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
   2791 		txs = &sc->sc_txsoft[i];
   2792 		if (txs->txs_mbuf != NULL) {
   2793 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
   2794 			m_freem(txs->txs_mbuf);
   2795 			txs->txs_mbuf = NULL;
   2796 		}
   2797 		bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
   2798 	}
   2799 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
   2800 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
   2801 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
   2802 	    sizeof(struct atw_control_data));
   2803 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
   2804 
   2805 	shutdownhook_disestablish(sc->sc_sdhook);
   2806 	powerhook_disestablish(sc->sc_powerhook);
   2807 
   2808 	if (sc->sc_srom)
   2809 		free(sc->sc_srom, M_DEVBUF);
   2810 
   2811 	return (0);
   2812 }
   2813 
   2814 /* atw_shutdown: make sure the interface is stopped at reboot time. */
   2815 void
   2816 atw_shutdown(void *arg)
   2817 {
   2818 	struct atw_softc *sc = arg;
   2819 
   2820 	atw_stop(&sc->sc_ic.ic_if, 1);
   2821 }
   2822 
   2823 int
   2824 atw_intr(void *arg)
   2825 {
   2826 	struct atw_softc *sc = arg;
   2827 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   2828 	u_int32_t status, rxstatus, txstatus, linkstatus;
   2829 	int handled = 0, txthresh;
   2830 
   2831 #ifdef DEBUG
   2832 	if (ATW_IS_ENABLED(sc) == 0)
   2833 		panic("%s: atw_intr: not enabled", sc->sc_dev.dv_xname);
   2834 #endif
   2835 
   2836 	/*
   2837 	 * If the interface isn't running, the interrupt couldn't
   2838 	 * possibly have come from us.
   2839 	 */
   2840 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
   2841 	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
   2842 		return (0);
   2843 
   2844 	for (;;) {
   2845 		status = ATW_READ(sc, ATW_STSR);
   2846 
   2847 		if (status)
   2848 			ATW_WRITE(sc, ATW_STSR, status);
   2849 
   2850 #ifdef ATW_DEBUG
   2851 #define PRINTINTR(flag) do { \
   2852 	if ((status & flag) != 0) { \
   2853 		printf("%s" #flag, delim); \
   2854 		delim = ","; \
   2855 	} \
   2856 } while (0)
   2857 
   2858 		if (atw_debug > 1 && status) {
   2859 			const char *delim = "<";
   2860 
   2861 			printf("%s: reg[STSR] = %x",
   2862 			    sc->sc_dev.dv_xname, status);
   2863 
   2864 			PRINTINTR(ATW_INTR_FBE);
   2865 			PRINTINTR(ATW_INTR_LINKOFF);
   2866 			PRINTINTR(ATW_INTR_LINKON);
   2867 			PRINTINTR(ATW_INTR_RCI);
   2868 			PRINTINTR(ATW_INTR_RDU);
   2869 			PRINTINTR(ATW_INTR_REIS);
   2870 			PRINTINTR(ATW_INTR_RPS);
   2871 			PRINTINTR(ATW_INTR_TCI);
   2872 			PRINTINTR(ATW_INTR_TDU);
   2873 			PRINTINTR(ATW_INTR_TLT);
   2874 			PRINTINTR(ATW_INTR_TPS);
   2875 			PRINTINTR(ATW_INTR_TRT);
   2876 			PRINTINTR(ATW_INTR_TUF);
   2877 			PRINTINTR(ATW_INTR_BCNTC);
   2878 			PRINTINTR(ATW_INTR_ATIME);
   2879 			PRINTINTR(ATW_INTR_TBTT);
   2880 			PRINTINTR(ATW_INTR_TSCZ);
   2881 			PRINTINTR(ATW_INTR_TSFTF);
   2882 			printf(">\n");
   2883 		}
   2884 #undef PRINTINTR
   2885 #endif /* ATW_DEBUG */
   2886 
   2887 		if ((status & sc->sc_inten) == 0)
   2888 			break;
   2889 
   2890 		handled = 1;
   2891 
   2892 		rxstatus = status & sc->sc_rxint_mask;
   2893 		txstatus = status & sc->sc_txint_mask;
   2894 		linkstatus = status & sc->sc_linkint_mask;
   2895 
   2896 		if (linkstatus) {
   2897 			atw_linkintr(sc, linkstatus);
   2898 		}
   2899 
   2900 		if (rxstatus) {
   2901 			/* Grab any new packets. */
   2902 			atw_rxintr(sc);
   2903 
   2904 			if (rxstatus & ATW_INTR_RDU) {
   2905 				printf("%s: receive ring overrun\n",
   2906 				    sc->sc_dev.dv_xname);
   2907 				/* Get the receive process going again. */
   2908 				ATW_WRITE(sc, ATW_RDR, 0x1);
   2909 				break;
   2910 			}
   2911 		}
   2912 
   2913 		if (txstatus) {
   2914 			/* Sweep up transmit descriptors. */
   2915 			atw_txintr(sc);
   2916 
   2917 			if (txstatus & ATW_INTR_TLT)
   2918 				DPRINTF(sc, ("%s: tx lifetime exceeded\n",
   2919 				    sc->sc_dev.dv_xname));
   2920 
   2921 			if (txstatus & ATW_INTR_TRT)
   2922 				DPRINTF(sc, ("%s: tx retry limit exceeded\n",
   2923 				    sc->sc_dev.dv_xname));
   2924 
   2925 			/* If Tx under-run, increase our transmit threshold
   2926 			 * if another is available.
   2927 			 */
   2928 			txthresh = sc->sc_txthresh + 1;
   2929 			if ((txstatus & ATW_INTR_TUF) &&
   2930 			    sc->sc_txth[txthresh].txth_name != NULL) {
   2931 				/* Idle the transmit process. */
   2932 				atw_idle(sc, ATW_NAR_ST);
   2933 
   2934 				sc->sc_txthresh = txthresh;
   2935 				sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
   2936 				sc->sc_opmode |=
   2937 				    sc->sc_txth[txthresh].txth_opmode;
   2938 				printf("%s: transmit underrun; new "
   2939 				    "threshold: %s\n", sc->sc_dev.dv_xname,
   2940 				    sc->sc_txth[txthresh].txth_name);
   2941 
   2942 				/* Set the new threshold and restart
   2943 				 * the transmit process.
   2944 				 */
   2945 				ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
   2946 				DELAY(atw_nar_delay);
   2947 				ATW_WRITE(sc, ATW_RDR, 0x1);
   2948 				/* XXX Log every Nth underrun from
   2949 				 * XXX now on?
   2950 				 */
   2951 			}
   2952 		}
   2953 
   2954 		if (status & (ATW_INTR_TPS|ATW_INTR_RPS)) {
   2955 			if (status & ATW_INTR_TPS)
   2956 				printf("%s: transmit process stopped\n",
   2957 				    sc->sc_dev.dv_xname);
   2958 			if (status & ATW_INTR_RPS)
   2959 				printf("%s: receive process stopped\n",
   2960 				    sc->sc_dev.dv_xname);
   2961 			(void)atw_init(ifp);
   2962 			break;
   2963 		}
   2964 
   2965 		if (status & ATW_INTR_FBE) {
   2966 			printf("%s: fatal bus error\n", sc->sc_dev.dv_xname);
   2967 			(void)atw_init(ifp);
   2968 			break;
   2969 		}
   2970 
   2971 		/*
   2972 		 * Not handled:
   2973 		 *
   2974 		 *	Transmit buffer unavailable -- normal
   2975 		 *	condition, nothing to do, really.
   2976 		 *
   2977 		 *	Early receive interrupt -- not available on
   2978 		 *	all chips, we just use RI.  We also only
   2979 		 *	use single-segment receive DMA, so this
   2980 		 *	is mostly useless.
   2981 		 *
   2982 		 *      TBD others
   2983 		 */
   2984 	}
   2985 
   2986 	/* Try to get more packets going. */
   2987 	atw_start(ifp);
   2988 
   2989 	return (handled);
   2990 }
   2991 
   2992 /*
   2993  * atw_idle:
   2994  *
   2995  *	Cause the transmit and/or receive processes to go idle.
   2996  *
   2997  *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
   2998  *	process in STSR if I clear SR or ST after the process has already
   2999  *	ceased. Fair enough. But the Rx process status bits in ATW_TEST0
   3000  *      do not seem to be too reliable. Perhaps I have the sense of the
   3001  *	Rx bits switched with the Tx bits?
   3002  */
   3003 void
   3004 atw_idle(struct atw_softc *sc, u_int32_t bits)
   3005 {
   3006 	u_int32_t ackmask = 0, opmode, stsr, test0;
   3007 	int i, s;
   3008 
   3009 	s = splnet();
   3010 
   3011 	opmode = sc->sc_opmode & ~bits;
   3012 
   3013 	if (bits & ATW_NAR_SR)
   3014 		ackmask |= ATW_INTR_RPS;
   3015 
   3016 	if (bits & ATW_NAR_ST) {
   3017 		ackmask |= ATW_INTR_TPS;
   3018 		/* set ATW_NAR_HF to flush TX FIFO. */
   3019 		opmode |= ATW_NAR_HF;
   3020 	}
   3021 
   3022 	ATW_WRITE(sc, ATW_NAR, opmode);
   3023 	DELAY(atw_nar_delay);
   3024 
   3025 	for (i = 0; i < 1000; i++) {
   3026 		stsr = ATW_READ(sc, ATW_STSR);
   3027 		if ((stsr & ackmask) == ackmask)
   3028 			break;
   3029 		DELAY(10);
   3030 	}
   3031 
   3032 	ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
   3033 
   3034 	if ((stsr & ackmask) == ackmask)
   3035 		goto out;
   3036 
   3037 	test0 = ATW_READ(sc, ATW_TEST0);
   3038 
   3039 	if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
   3040 	    (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
   3041 		printf("%s: transmit process not idle [%s]\n",
   3042 		    sc->sc_dev.dv_xname,
   3043 		    atw_tx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_TS_MASK)]);
   3044 		printf("%s: bits %08x test0 %08x stsr %08x\n",
   3045 		    sc->sc_dev.dv_xname, bits, test0, stsr);
   3046 	}
   3047 
   3048 	if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
   3049 	    (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
   3050 		DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
   3051 		    sc->sc_dev.dv_xname,
   3052 		    atw_rx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_RS_MASK)]));
   3053 		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
   3054 		    sc->sc_dev.dv_xname, bits, test0, stsr));
   3055 	}
   3056 out:
   3057 	if ((bits & ATW_NAR_ST) != 0)
   3058 		atw_txdrain(sc);
   3059 	splx(s);
   3060 	return;
   3061 }
   3062 
   3063 /*
   3064  * atw_linkintr:
   3065  *
   3066  *	Helper; handle link-status interrupts.
   3067  */
   3068 void
   3069 atw_linkintr(struct atw_softc *sc, u_int32_t linkstatus)
   3070 {
   3071 	struct ieee80211com *ic = &sc->sc_ic;
   3072 
   3073 	if (ic->ic_state != IEEE80211_S_RUN)
   3074 		return;
   3075 
   3076 	if (linkstatus & ATW_INTR_LINKON) {
   3077 		DPRINTF(sc, ("%s: link on\n", sc->sc_dev.dv_xname));
   3078 		sc->sc_rescan_timer = 0;
   3079 	} else if (linkstatus & ATW_INTR_LINKOFF) {
   3080 		DPRINTF(sc, ("%s: link off\n", sc->sc_dev.dv_xname));
   3081 		if (ic->ic_opmode != IEEE80211_M_STA)
   3082 			return;
   3083 		sc->sc_rescan_timer = 3;
   3084 		ic->ic_if.if_timer = 1;
   3085 	}
   3086 }
   3087 
   3088 static __inline int
   3089 atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame *wh)
   3090 {
   3091 	if ((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) == 0)
   3092 		return 0;
   3093 	if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
   3094 		return 0;
   3095 	return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
   3096 }
   3097 
   3098 /*
   3099  * atw_rxintr:
   3100  *
   3101  *	Helper; handle receive interrupts.
   3102  */
   3103 void
   3104 atw_rxintr(struct atw_softc *sc)
   3105 {
   3106 	static int rate_tbl[] = {2, 4, 11, 22, 44};
   3107 	struct ieee80211com *ic = &sc->sc_ic;
   3108 	struct ieee80211_node *ni;
   3109 	struct ieee80211_frame *wh;
   3110 	struct ifnet *ifp = &ic->ic_if;
   3111 	struct atw_rxsoft *rxs;
   3112 	struct mbuf *m;
   3113 	u_int32_t rxstat;
   3114 	int i, len, rate, rate0;
   3115 	u_int32_t rssi, rssi0;
   3116 
   3117 	for (i = sc->sc_rxptr;; i = ATW_NEXTRX(i)) {
   3118 		rxs = &sc->sc_rxsoft[i];
   3119 
   3120 		ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
   3121 
   3122 		rxstat = le32toh(sc->sc_rxdescs[i].ar_stat);
   3123 		rssi0 = le32toh(sc->sc_rxdescs[i].ar_rssi);
   3124 		rate0 = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_RXDR_MASK);
   3125 
   3126 		if (rxstat & ATW_RXSTAT_OWN)
   3127 			break; /* We have processed all receive buffers. */
   3128 
   3129 		DPRINTF3(sc,
   3130 		    ("%s: rx stat %08x rssi0 %08x buf1 %08x buf2 %08x\n",
   3131 		    sc->sc_dev.dv_xname,
   3132 		    rxstat, rssi0,
   3133 		    le32toh(sc->sc_rxdescs[i].ar_buf1),
   3134 		    le32toh(sc->sc_rxdescs[i].ar_buf2)));
   3135 
   3136 		/*
   3137 		 * Make sure the packet fits in one buffer.  This should
   3138 		 * always be the case.
   3139 		 */
   3140 		if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=
   3141 		    (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {
   3142 			printf("%s: incoming packet spilled, resetting\n",
   3143 			    sc->sc_dev.dv_xname);
   3144 			(void)atw_init(ifp);
   3145 			return;
   3146 		}
   3147 
   3148 		/*
   3149 		 * If an error occurred, update stats, clear the status
   3150 		 * word, and leave the packet buffer in place.  It will
   3151 		 * simply be reused the next time the ring comes around.
   3152 	 	 * If 802.1Q VLAN MTU is enabled, ignore the Frame Too Long
   3153 		 * error.
   3154 		 */
   3155 
   3156 		if ((rxstat & ATW_RXSTAT_ES) != 0 &&
   3157 		    ((sc->sc_ic.ic_ec.ec_capenable & ETHERCAP_VLAN_MTU) == 0 ||
   3158 		     (rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_SFDE |
   3159 		                ATW_RXSTAT_SIGE | ATW_RXSTAT_CRC16E |
   3160 				ATW_RXSTAT_RXTOE | ATW_RXSTAT_CRC32E |
   3161 				ATW_RXSTAT_ICVE)) != 0)) {
   3162 #define	PRINTERR(bit, str)						\
   3163 			if (rxstat & (bit))				\
   3164 				printf("%s: receive error: %s\n",	\
   3165 				    sc->sc_dev.dv_xname, str)
   3166 			ifp->if_ierrors++;
   3167 			PRINTERR(ATW_RXSTAT_DE, "descriptor error");
   3168 			PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
   3169 			PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
   3170 			PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
   3171 			PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
   3172 			PRINTERR(ATW_RXSTAT_CRC32E, "FCS error");
   3173 			PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
   3174 #undef PRINTERR
   3175 			ATW_INIT_RXDESC(sc, i);
   3176 			continue;
   3177 		}
   3178 
   3179 		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
   3180 		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
   3181 
   3182 		/*
   3183 		 * No errors; receive the packet.  Note the ADM8211
   3184 		 * includes the CRC in promiscuous mode.
   3185 		 */
   3186 		len = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_FL_MASK);
   3187 
   3188 		/*
   3189 		 * Allocate a new mbuf cluster.  If that fails, we are
   3190 		 * out of memory, and must drop the packet and recycle
   3191 		 * the buffer that's already attached to this descriptor.
   3192 		 */
   3193 		m = rxs->rxs_mbuf;
   3194 		if (atw_add_rxbuf(sc, i) != 0) {
   3195 			ifp->if_ierrors++;
   3196 			ATW_INIT_RXDESC(sc, i);
   3197 			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
   3198 			    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
   3199 			continue;
   3200 		}
   3201 
   3202 		ifp->if_ipackets++;
   3203 		if (sc->sc_opmode & ATW_NAR_PR)
   3204 			m->m_flags |= M_HASFCS;
   3205 		m->m_pkthdr.rcvif = ifp;
   3206 		m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
   3207 
   3208 		if (rate0 >= sizeof(rate_tbl) / sizeof(rate_tbl[0]))
   3209 			rate = 0;
   3210 		else
   3211 			rate = rate_tbl[rate0];
   3212 
   3213 		/* The RSSI comes straight from a register in the
   3214 		 * baseband processor.  I know that for the RF3000,
   3215 		 * the RSSI register also contains the antenna-selection
   3216 		 * bits.  Mask those off.
   3217 		 *
   3218 		 * TBD Treat other basebands.
   3219 		 */
   3220 		if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
   3221 			rssi = rssi0 & RF3000_RSSI_MASK;
   3222 		else
   3223 			rssi = rssi0;
   3224 
   3225  #if NBPFILTER > 0
   3226 		/* Pass this up to any BPF listeners. */
   3227 		if (sc->sc_radiobpf != NULL) {
   3228 			struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
   3229 
   3230 			tap->ar_rate = rate;
   3231 			tap->ar_chan_freq = ic->ic_bss->ni_chan->ic_freq;
   3232 			tap->ar_chan_flags = ic->ic_bss->ni_chan->ic_flags;
   3233 
   3234 			/* TBD verify units are dB */
   3235 			tap->ar_antsignal = (int)rssi;
   3236 			/* TBD tap->ar_flags */
   3237 
   3238 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)tap,
   3239 			    tap->ar_ihdr.it_len, m);
   3240  		}
   3241  #endif /* NPBFILTER > 0 */
   3242 
   3243 		wh = mtod(m, struct ieee80211_frame *);
   3244 		ni = ieee80211_find_rxnode(ic, wh);
   3245 		if (atw_hw_decrypted(sc, wh))
   3246 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
   3247 		ieee80211_input(ifp, m, ni, (int)rssi, 0);
   3248 		/*
   3249 		 * The frame may have caused the node to be marked for
   3250 		 * reclamation (e.g. in response to a DEAUTH message)
   3251 		 * so use free_node here instead of unref_node.
   3252 		 */
   3253 		if (ni == ic->ic_bss)
   3254 			ieee80211_unref_node(&ni);
   3255 		else
   3256 			ieee80211_free_node(ic, ni);
   3257 	}
   3258 
   3259 	/* Update the receive pointer. */
   3260 	sc->sc_rxptr = i;
   3261 }
   3262 
   3263 /*
   3264  * atw_txintr:
   3265  *
   3266  *	Helper; handle transmit interrupts.
   3267  */
   3268 void
   3269 atw_txintr(struct atw_softc *sc)
   3270 {
   3271 #define TXSTAT_ERRMASK (ATW_TXSTAT_TUF | ATW_TXSTAT_TLT | ATW_TXSTAT_TRT | \
   3272     ATW_TXSTAT_TRO | ATW_TXSTAT_SOFBR)
   3273 #define TXSTAT_FMT "\20\31ATW_TXSTAT_SOFBR\32ATW_TXSTAT_TRO\33ATW_TXSTAT_TUF" \
   3274     "\34ATW_TXSTAT_TRT\35ATW_TXSTAT_TLT"
   3275 
   3276 	static char txstat_buf[sizeof("ffffffff<>" TXSTAT_FMT)];
   3277 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   3278 	struct atw_txsoft *txs;
   3279 	u_int32_t txstat;
   3280 
   3281 	DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
   3282 	    sc->sc_dev.dv_xname, sc->sc_flags));
   3283 
   3284 	ifp->if_flags &= ~IFF_OACTIVE;
   3285 
   3286 	/*
   3287 	 * Go through our Tx list and free mbufs for those
   3288 	 * frames that have been transmitted.
   3289 	 */
   3290 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
   3291 		ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
   3292 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
   3293 
   3294 #ifdef ATW_DEBUG
   3295 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
   3296 			int i;
   3297 			printf("    txsoft %p transmit chain:\n", txs);
   3298 			ATW_CDTXSYNC(sc, txs->txs_firstdesc,
   3299 			    txs->txs_ndescs - 1,
   3300 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
   3301 			for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
   3302 				printf("     descriptor %d:\n", i);
   3303 				printf("       at_status:   0x%08x\n",
   3304 				    le32toh(sc->sc_txdescs[i].at_stat));
   3305 				printf("       at_flags:      0x%08x\n",
   3306 				    le32toh(sc->sc_txdescs[i].at_flags));
   3307 				printf("       at_buf1: 0x%08x\n",
   3308 				    le32toh(sc->sc_txdescs[i].at_buf1));
   3309 				printf("       at_buf2: 0x%08x\n",
   3310 				    le32toh(sc->sc_txdescs[i].at_buf2));
   3311 				if (i == txs->txs_lastdesc)
   3312 					break;
   3313 			}
   3314 		}
   3315 #endif
   3316 
   3317 		txstat = le32toh(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
   3318 		if (txstat & ATW_TXSTAT_OWN)
   3319 			break;
   3320 
   3321 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
   3322 
   3323 		sc->sc_txfree += txs->txs_ndescs;
   3324 
   3325 		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
   3326 		    0, txs->txs_dmamap->dm_mapsize,
   3327 		    BUS_DMASYNC_POSTWRITE);
   3328 		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
   3329 		m_freem(txs->txs_mbuf);
   3330 		txs->txs_mbuf = NULL;
   3331 
   3332 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
   3333 
   3334 		if ((ifp->if_flags & IFF_DEBUG) != 0 &&
   3335 		    (txstat & TXSTAT_ERRMASK) != 0) {
   3336 			bitmask_snprintf(txstat & TXSTAT_ERRMASK, TXSTAT_FMT,
   3337 			    txstat_buf, sizeof(txstat_buf));
   3338 			printf("%s: txstat %s %d\n", sc->sc_dev.dv_xname,
   3339 			    txstat_buf,
   3340 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK));
   3341 		}
   3342 
   3343 		/*
   3344 		 * Check for errors and collisions.
   3345 		 */
   3346 		if (txstat & ATW_TXSTAT_TUF)
   3347 			sc->sc_stats.ts_tx_tuf++;
   3348 		if (txstat & ATW_TXSTAT_TLT)
   3349 			sc->sc_stats.ts_tx_tlt++;
   3350 		if (txstat & ATW_TXSTAT_TRT)
   3351 			sc->sc_stats.ts_tx_trt++;
   3352 		if (txstat & ATW_TXSTAT_TRO)
   3353 			sc->sc_stats.ts_tx_tro++;
   3354 		if (txstat & ATW_TXSTAT_SOFBR) {
   3355 			sc->sc_stats.ts_tx_sofbr++;
   3356 		}
   3357 
   3358 		if ((txstat & ATW_TXSTAT_ES) == 0)
   3359 			ifp->if_collisions +=
   3360 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK);
   3361 		else
   3362 			ifp->if_oerrors++;
   3363 
   3364 		ifp->if_opackets++;
   3365 	}
   3366 
   3367 	/*
   3368 	 * If there are no more pending transmissions, cancel the watchdog
   3369 	 * timer.
   3370 	 */
   3371 	if (txs == NULL)
   3372 		sc->sc_tx_timer = 0;
   3373 #undef TXSTAT_ERRMASK
   3374 #undef TXSTAT_FMT
   3375 }
   3376 
   3377 /*
   3378  * atw_watchdog:	[ifnet interface function]
   3379  *
   3380  *	Watchdog timer handler.
   3381  */
   3382 void
   3383 atw_watchdog(struct ifnet *ifp)
   3384 {
   3385 	struct atw_softc *sc = ifp->if_softc;
   3386 	struct ieee80211com *ic = &sc->sc_ic;
   3387 
   3388 	ifp->if_timer = 0;
   3389 	if (ATW_IS_ENABLED(sc) == 0)
   3390 		return;
   3391 
   3392 	if (sc->sc_rescan_timer) {
   3393 		if (--sc->sc_rescan_timer == 0)
   3394 			(void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
   3395 	}
   3396 	if (sc->sc_tx_timer) {
   3397 		if (--sc->sc_tx_timer == 0 &&
   3398 		    !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
   3399 			printf("%s: transmit timeout\n", ifp->if_xname);
   3400 			ifp->if_oerrors++;
   3401 			(void)atw_init(ifp);
   3402 			atw_start(ifp);
   3403 		}
   3404 	}
   3405 	if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
   3406 		ifp->if_timer = 1;
   3407 	ieee80211_watchdog(ifp);
   3408 }
   3409 
   3410 /* Compute the 802.11 Duration field and the PLCP Length fields for
   3411  * a len-byte frame (HEADER + PAYLOAD + FCS) sent at rate * 500Kbps.
   3412  * Write the fields to the ADM8211 Tx header, frm.
   3413  *
   3414  * TBD use the fragmentation threshold to find the right duration for
   3415  * the first & last fragments.
   3416  *
   3417  * TBD make certain of the duration fields applied by the ADM8211 to each
   3418  * fragment. I think that the ADM8211 knows how to subtract the CTS
   3419  * duration when ATW_HDRCTL_RTSCTS is clear; that is why I add it regardless.
   3420  * I also think that the ADM8211 does *some* arithmetic for us, because
   3421  * otherwise I think we would have to set a first duration for CTS/first
   3422  * fragment, a second duration for fragments between the first and the
   3423  * last, and a third duration for the last fragment.
   3424  *
   3425  * TBD make certain that duration fields reflect addition of FCS/WEP
   3426  * and correct duration arithmetic as necessary.
   3427  */
   3428 static void
   3429 atw_frame_setdurs(struct atw_softc *sc, struct atw_frame *frm, int rate,
   3430     int len)
   3431 {
   3432 	int remainder;
   3433 
   3434 	/* deal also with encrypted fragments */
   3435 	if (frm->atw_hdrctl & htole16(ATW_HDRCTL_WEP)) {
   3436 		DPRINTF2(sc, ("%s: atw_frame_setdurs len += 8\n",
   3437 		    sc->sc_dev.dv_xname));
   3438 		len += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
   3439 		       IEEE80211_WEP_CRCLEN;
   3440 	}
   3441 
   3442 	/* 802.11 Duration Field for CTS/Data/ACK sequence minus FCS & WEP
   3443 	 * duration (XXX added by MAC?).
   3444 	 */
   3445 	frm->atw_head_dur = (16 * (len - IEEE80211_CRC_LEN)) / rate;
   3446 	remainder = (16 * (len - IEEE80211_CRC_LEN)) % rate;
   3447 
   3448 	if (rate <= 4)
   3449 		/* 1-2Mbps WLAN: send ACK/CTS at 1Mbps */
   3450 		frm->atw_head_dur += 3 * (IEEE80211_DUR_DS_SIFS +
   3451 		    IEEE80211_DUR_DS_SHORT_PREAMBLE +
   3452 		    IEEE80211_DUR_DS_FAST_PLCPHDR) +
   3453 		    IEEE80211_DUR_DS_SLOW_CTS + IEEE80211_DUR_DS_SLOW_ACK;
   3454 	else
   3455 		/* 5-11Mbps WLAN: send ACK/CTS at 2Mbps */
   3456 		frm->atw_head_dur += 3 * (IEEE80211_DUR_DS_SIFS +
   3457 		    IEEE80211_DUR_DS_SHORT_PREAMBLE +
   3458 		    IEEE80211_DUR_DS_FAST_PLCPHDR) +
   3459 		    IEEE80211_DUR_DS_FAST_CTS + IEEE80211_DUR_DS_FAST_ACK;
   3460 
   3461 	/* lengthen duration if long preamble */
   3462 	if ((sc->sc_flags & ATWF_SHORT_PREAMBLE) == 0)
   3463 		frm->atw_head_dur +=
   3464 		    3 * (IEEE80211_DUR_DS_LONG_PREAMBLE -
   3465 		         IEEE80211_DUR_DS_SHORT_PREAMBLE) +
   3466 		    3 * (IEEE80211_DUR_DS_SLOW_PLCPHDR -
   3467 		         IEEE80211_DUR_DS_FAST_PLCPHDR);
   3468 
   3469 	if (remainder != 0)
   3470 		frm->atw_head_dur++;
   3471 
   3472 	if ((atw_voodoo & VOODOO_DUR_2_4_SPECIALCASE) &&
   3473 	    (rate == 2 || rate == 4)) {
   3474 		/* derived from Linux: how could this be right? */
   3475 		frm->atw_head_plcplen = frm->atw_head_dur;
   3476 	} else {
   3477 		frm->atw_head_plcplen = (16 * len) / rate;
   3478 		remainder = (80 * len) % (rate * 5);
   3479 
   3480 		if (remainder != 0) {
   3481 			frm->atw_head_plcplen++;
   3482 
   3483 			/* XXX magic */
   3484 			if ((atw_voodoo & VOODOO_DUR_11_ROUNDING) &&
   3485 			    rate == 22 && remainder <= 30)
   3486 				frm->atw_head_plcplen |= 0x8000;
   3487 		}
   3488 	}
   3489 	frm->atw_tail_plcplen = frm->atw_head_plcplen =
   3490 	    htole16(frm->atw_head_plcplen);
   3491 	frm->atw_tail_dur = frm->atw_head_dur = htole16(frm->atw_head_dur);
   3492 }
   3493 
   3494 #ifdef ATW_DEBUG
   3495 static void
   3496 atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
   3497 {
   3498 	struct atw_softc *sc = ifp->if_softc;
   3499 	struct mbuf *m;
   3500 	int i, noctets = 0;
   3501 
   3502 	printf("%s: %d-byte packet\n", sc->sc_dev.dv_xname,
   3503 	    m0->m_pkthdr.len);
   3504 
   3505 	for (m = m0; m; m = m->m_next) {
   3506 		if (m->m_len == 0)
   3507 			continue;
   3508 		for (i = 0; i < m->m_len; i++) {
   3509 			printf(" %02x", ((u_int8_t*)m->m_data)[i]);
   3510 			if (++noctets % 24 == 0)
   3511 				printf("\n");
   3512 		}
   3513 	}
   3514 	printf("%s%s: %d bytes emitted\n",
   3515 	    (noctets % 24 != 0) ? "\n" : "", sc->sc_dev.dv_xname, noctets);
   3516 }
   3517 #endif /* ATW_DEBUG */
   3518 
   3519 /*
   3520  * atw_start:		[ifnet interface function]
   3521  *
   3522  *	Start packet transmission on the interface.
   3523  */
   3524 void
   3525 atw_start(struct ifnet *ifp)
   3526 {
   3527 	struct atw_softc *sc = ifp->if_softc;
   3528 	struct ieee80211com *ic = &sc->sc_ic;
   3529 	struct ieee80211_node *ni;
   3530 	struct ieee80211_frame *wh;
   3531 	struct atw_frame *hh;
   3532 	struct mbuf *m0, *m;
   3533 	struct atw_txsoft *txs, *last_txs;
   3534 	struct atw_txdesc *txd;
   3535 	int do_encrypt, rate;
   3536 	bus_dmamap_t dmamap;
   3537 	int ctl, error, firsttx, nexttx, lasttx = -1, first, ofree, seg;
   3538 
   3539 	DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
   3540 	    sc->sc_dev.dv_xname, sc->sc_flags, ifp->if_flags));
   3541 
   3542 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
   3543 		return;
   3544 
   3545 	/*
   3546 	 * Remember the previous number of free descriptors and
   3547 	 * the first descriptor we'll use.
   3548 	 */
   3549 	ofree = sc->sc_txfree;
   3550 	firsttx = sc->sc_txnext;
   3551 
   3552 	DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
   3553 	    sc->sc_dev.dv_xname, ofree, firsttx));
   3554 
   3555 	/*
   3556 	 * Loop through the send queue, setting up transmit descriptors
   3557 	 * until we drain the queue, or use up all available transmit
   3558 	 * descriptors.
   3559 	 */
   3560 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
   3561 	       sc->sc_txfree != 0) {
   3562 
   3563 		/*
   3564 		 * Grab a packet off the management queue, if it
   3565 		 * is not empty. Otherwise, from the data queue.
   3566 		 */
   3567 		IF_DEQUEUE(&ic->ic_mgtq, m0);
   3568 		if (m0 != NULL) {
   3569 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
   3570 			m0->m_pkthdr.rcvif = NULL;
   3571 		} else {
   3572 			/* send no data packets until we are associated */
   3573 			if (ic->ic_state != IEEE80211_S_RUN)
   3574 				break;
   3575 			IFQ_DEQUEUE(&ifp->if_snd, m0);
   3576 			if (m0 == NULL)
   3577 				break;
   3578 #if NBPFILTER > 0
   3579 			if (ifp->if_bpf != NULL)
   3580 				bpf_mtap(ifp->if_bpf, m0);
   3581 #endif /* NBPFILTER > 0 */
   3582 			if ((m0 = ieee80211_encap(ifp, m0, &ni)) == NULL) {
   3583 				ifp->if_oerrors++;
   3584 				break;
   3585 			}
   3586 		}
   3587 
   3588 		rate = MAX(ieee80211_get_rate(ic), 2);
   3589 
   3590 #if NBPFILTER > 0
   3591 		/*
   3592 		 * Pass the packet to any BPF listeners.
   3593 		 */
   3594 		if (ic->ic_rawbpf != NULL)
   3595 			bpf_mtap((caddr_t)ic->ic_rawbpf, m0);
   3596 
   3597 		if (sc->sc_radiobpf != NULL) {
   3598 			struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
   3599 
   3600 			tap->at_rate = rate;
   3601 			tap->at_chan_freq = ic->ic_bss->ni_chan->ic_freq;
   3602 			tap->at_chan_flags = ic->ic_bss->ni_chan->ic_flags;
   3603 
   3604 			/* TBD tap->at_flags */
   3605 
   3606 			bpf_mtap2(sc->sc_radiobpf, (caddr_t)tap,
   3607 			    tap->at_ihdr.it_len, m0);
   3608 		}
   3609 #endif /* NBPFILTER > 0 */
   3610 
   3611 		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
   3612 
   3613 		if (ni != NULL && ni != ic->ic_bss)
   3614 			ieee80211_free_node(ic, ni);
   3615 
   3616 		if (m0 == NULL) {
   3617 			ifp->if_oerrors++;
   3618 			break;
   3619 		}
   3620 
   3621 		/* just to make sure. */
   3622 		m0 = m_pullup(m0, sizeof(struct atw_frame));
   3623 
   3624 		if (m0 == NULL) {
   3625 			ifp->if_oerrors++;
   3626 			break;
   3627 		}
   3628 
   3629 		hh = mtod(m0, struct atw_frame *);
   3630 		wh = &hh->atw_ihdr;
   3631 
   3632 		do_encrypt = ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0) ? 1 : 0;
   3633 
   3634 		/* Copy everything we need from the 802.11 header:
   3635 		 * Frame Control; address 1, address 3, or addresses
   3636 		 * 3 and 4. NIC fills in BSSID, SA.
   3637 		 */
   3638 		if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
   3639 			if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
   3640 				panic("%s: illegal WDS frame",
   3641 				    sc->sc_dev.dv_xname);
   3642 			memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
   3643 		} else
   3644 			memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
   3645 
   3646 		*(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;
   3647 
   3648 		/* initialize remaining Tx parameters */
   3649 		memset(&hh->u, 0, sizeof(hh->u));
   3650 
   3651 		hh->atw_rate = rate * 5;
   3652 		/* XXX this could be incorrect if M_FCS. _encap should
   3653 		 * probably strip FCS just in case it sticks around in
   3654 		 * bridged packets.
   3655 		 */
   3656 		hh->atw_service = IEEE80211_PLCP_SERVICE; /* XXX guess */
   3657 		hh->atw_paylen = htole16(m0->m_pkthdr.len -
   3658 		    sizeof(struct atw_frame));
   3659 
   3660 		hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
   3661 		hh->atw_rtylmt = 3;
   3662 		hh->atw_hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
   3663 		if (do_encrypt) {
   3664 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_WEP);
   3665 			hh->atw_keyid = ic->ic_wep_txkey;
   3666 		}
   3667 
   3668 		/* TBD 4-addr frames */
   3669 		atw_frame_setdurs(sc, hh, rate,
   3670 		    m0->m_pkthdr.len - sizeof(struct atw_frame) +
   3671 		    sizeof(struct ieee80211_frame) + IEEE80211_CRC_LEN);
   3672 
   3673 		/* never fragment multicast frames */
   3674 		if (IEEE80211_IS_MULTICAST(hh->atw_dst)) {
   3675 			hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
   3676 		} else if (sc->sc_flags & ATWF_RTSCTS) {
   3677 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
   3678 		}
   3679 
   3680 #ifdef ATW_DEBUG
   3681 		hh->atw_fragnum = 0;
   3682 
   3683 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
   3684 			printf("%s: dst = %s, rate = 0x%02x, "
   3685 			    "service = 0x%02x, paylen = 0x%04x\n",
   3686 			    sc->sc_dev.dv_xname, ether_sprintf(hh->atw_dst),
   3687 			    hh->atw_rate, hh->atw_service, hh->atw_paylen);
   3688 
   3689 			printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
   3690 			    "dur1 = 0x%04x, dur2 = 0x%04x, "
   3691 			    "dur3 = 0x%04x, rts_dur = 0x%04x\n",
   3692 			    sc->sc_dev.dv_xname, hh->atw_fc[0], hh->atw_fc[1],
   3693 			    hh->atw_tail_plcplen, hh->atw_head_plcplen,
   3694 			    hh->atw_tail_dur, hh->atw_head_dur);
   3695 
   3696 			printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
   3697 			    "fragnum = 0x%02x, rtylmt = 0x%04x\n",
   3698 			    sc->sc_dev.dv_xname, hh->atw_hdrctl,
   3699 			    hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
   3700 
   3701 			printf("%s: keyid = %d\n",
   3702 			    sc->sc_dev.dv_xname, hh->atw_keyid);
   3703 
   3704 			atw_dump_pkt(ifp, m0);
   3705 		}
   3706 #endif /* ATW_DEBUG */
   3707 
   3708 		dmamap = txs->txs_dmamap;
   3709 
   3710 		/*
   3711 		 * Load the DMA map.  Copy and try (once) again if the packet
   3712 		 * didn't fit in the alloted number of segments.
   3713 		 */
   3714 		for (first = 1;
   3715 		     (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
   3716 		                  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;
   3717 		     first = 0) {
   3718 			MGETHDR(m, M_DONTWAIT, MT_DATA);
   3719 			if (m == NULL) {
   3720 				printf("%s: unable to allocate Tx mbuf\n",
   3721 				    sc->sc_dev.dv_xname);
   3722 				break;
   3723 			}
   3724 			if (m0->m_pkthdr.len > MHLEN) {
   3725 				MCLGET(m, M_DONTWAIT);
   3726 				if ((m->m_flags & M_EXT) == 0) {
   3727 					printf("%s: unable to allocate Tx "
   3728 					    "cluster\n", sc->sc_dev.dv_xname);
   3729 					m_freem(m);
   3730 					break;
   3731 				}
   3732 			}
   3733 			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
   3734 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
   3735 			m_freem(m0);
   3736 			m0 = m;
   3737 			m = NULL;
   3738 		}
   3739 		if (error != 0) {
   3740 			printf("%s: unable to load Tx buffer, "
   3741 			    "error = %d\n", sc->sc_dev.dv_xname, error);
   3742 			m_freem(m0);
   3743 			break;
   3744 		}
   3745 
   3746 		/*
   3747 		 * Ensure we have enough descriptors free to describe
   3748 		 * the packet.
   3749 		 */
   3750 		if (dmamap->dm_nsegs > sc->sc_txfree) {
   3751 			/*
   3752 			 * Not enough free descriptors to transmit
   3753 			 * this packet.  Unload the DMA map and
   3754 			 * drop the packet.  Notify the upper layer
   3755 			 * that there are no more slots left.
   3756 			 *
   3757 			 * XXX We could allocate an mbuf and copy, but
   3758 			 * XXX it is worth it?
   3759 			 */
   3760 			ifp->if_flags |= IFF_OACTIVE;
   3761 			bus_dmamap_unload(sc->sc_dmat, dmamap);
   3762 			m_freem(m0);
   3763 			break;
   3764 		}
   3765 
   3766 		/*
   3767 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
   3768 		 */
   3769 
   3770 		/* Sync the DMA map. */
   3771 		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
   3772 		    BUS_DMASYNC_PREWRITE);
   3773 
   3774 		/* XXX arbitrary retry limit; 8 because I have seen it in
   3775 		 * use already and maybe 0 means "no tries" !
   3776 		 */
   3777 		ctl = htole32(LSHIFT(8, ATW_TXCTL_TL_MASK));
   3778 
   3779 		DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
   3780 		    sc->sc_dev.dv_xname, rate * 5));
   3781 		ctl |= htole32(LSHIFT(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
   3782 
   3783 		/*
   3784 		 * Initialize the transmit descriptors.
   3785 		 */
   3786 		for (nexttx = sc->sc_txnext, seg = 0;
   3787 		     seg < dmamap->dm_nsegs;
   3788 		     seg++, nexttx = ATW_NEXTTX(nexttx)) {
   3789 			/*
   3790 			 * If this is the first descriptor we're
   3791 			 * enqueueing, don't set the OWN bit just
   3792 			 * yet.  That could cause a race condition.
   3793 			 * We'll do it below.
   3794 			 */
   3795 			txd = &sc->sc_txdescs[nexttx];
   3796 			txd->at_ctl = ctl |
   3797 			    ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
   3798 
   3799 			txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
   3800 			txd->at_flags =
   3801 			    htole32(LSHIFT(dmamap->dm_segs[seg].ds_len,
   3802 			                   ATW_TXFLAG_TBS1_MASK)) |
   3803 			    ((nexttx == (ATW_NTXDESC - 1))
   3804 			        ? htole32(ATW_TXFLAG_TER) : 0);
   3805 			lasttx = nexttx;
   3806 		}
   3807 
   3808 		IASSERT(lasttx != -1, ("bad lastx"));
   3809 		/* Set `first segment' and `last segment' appropriately. */
   3810 		sc->sc_txdescs[sc->sc_txnext].at_flags |=
   3811 		    htole32(ATW_TXFLAG_FS);
   3812 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
   3813 
   3814 #ifdef ATW_DEBUG
   3815 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
   3816 			printf("     txsoft %p transmit chain:\n", txs);
   3817 			for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
   3818 				printf("     descriptor %d:\n", seg);
   3819 				printf("       at_ctl:   0x%08x\n",
   3820 				    le32toh(sc->sc_txdescs[seg].at_ctl));
   3821 				printf("       at_flags:      0x%08x\n",
   3822 				    le32toh(sc->sc_txdescs[seg].at_flags));
   3823 				printf("       at_buf1: 0x%08x\n",
   3824 				    le32toh(sc->sc_txdescs[seg].at_buf1));
   3825 				printf("       at_buf2: 0x%08x\n",
   3826 				    le32toh(sc->sc_txdescs[seg].at_buf2));
   3827 				if (seg == lasttx)
   3828 					break;
   3829 			}
   3830 		}
   3831 #endif
   3832 
   3833 		/* Sync the descriptors we're using. */
   3834 		ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
   3835 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
   3836 
   3837 		/*
   3838 		 * Store a pointer to the packet so we can free it later,
   3839 		 * and remember what txdirty will be once the packet is
   3840 		 * done.
   3841 		 */
   3842 		txs->txs_mbuf = m0;
   3843 		txs->txs_firstdesc = sc->sc_txnext;
   3844 		txs->txs_lastdesc = lasttx;
   3845 		txs->txs_ndescs = dmamap->dm_nsegs;
   3846 
   3847 		/* Advance the tx pointer. */
   3848 		sc->sc_txfree -= dmamap->dm_nsegs;
   3849 		sc->sc_txnext = nexttx;
   3850 
   3851 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
   3852 		SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
   3853 
   3854 		last_txs = txs;
   3855 	}
   3856 
   3857 	if (txs == NULL || sc->sc_txfree == 0) {
   3858 		/* No more slots left; notify upper layer. */
   3859 		ifp->if_flags |= IFF_OACTIVE;
   3860 	}
   3861 
   3862 	if (sc->sc_txfree != ofree) {
   3863 		DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
   3864 		    sc->sc_dev.dv_xname, lasttx, firsttx));
   3865 		/*
   3866 		 * Cause a transmit interrupt to happen on the
   3867 		 * last packet we enqueued.
   3868 		 */
   3869 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
   3870 		ATW_CDTXSYNC(sc, lasttx, 1,
   3871 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
   3872 
   3873 		/*
   3874 		 * The entire packet chain is set up.  Give the
   3875 		 * first descriptor to the chip now.
   3876 		 */
   3877 		sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
   3878 		ATW_CDTXSYNC(sc, firsttx, 1,
   3879 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
   3880 
   3881 		/* Wake up the transmitter. */
   3882 		ATW_WRITE(sc, ATW_TDR, 0x1);
   3883 
   3884 		/* Set a watchdog timer in case the chip flakes out. */
   3885 		sc->sc_tx_timer = 5;
   3886 		ifp->if_timer = 1;
   3887 	}
   3888 }
   3889 
   3890 /*
   3891  * atw_power:
   3892  *
   3893  *	Power management (suspend/resume) hook.
   3894  */
   3895 void
   3896 atw_power(int why, void *arg)
   3897 {
   3898 	struct atw_softc *sc = arg;
   3899 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   3900 	int s;
   3901 
   3902 	DPRINTF(sc, ("%s: atw_power(%d,)\n", sc->sc_dev.dv_xname, why));
   3903 
   3904 	s = splnet();
   3905 	switch (why) {
   3906 	case PWR_STANDBY:
   3907 		/* XXX do nothing. */
   3908 		break;
   3909 	case PWR_SUSPEND:
   3910 		atw_stop(ifp, 0);
   3911 		if (sc->sc_power != NULL)
   3912 			(*sc->sc_power)(sc, why);
   3913 		break;
   3914 	case PWR_RESUME:
   3915 		if (ifp->if_flags & IFF_UP) {
   3916 			if (sc->sc_power != NULL)
   3917 				(*sc->sc_power)(sc, why);
   3918 			atw_init(ifp);
   3919 		}
   3920 		break;
   3921 	case PWR_SOFTSUSPEND:
   3922 	case PWR_SOFTSTANDBY:
   3923 	case PWR_SOFTRESUME:
   3924 		break;
   3925 	}
   3926 	splx(s);
   3927 }
   3928 
   3929 /*
   3930  * atw_ioctl:		[ifnet interface function]
   3931  *
   3932  *	Handle control requests from the operator.
   3933  */
   3934 int
   3935 atw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
   3936 {
   3937 	struct atw_softc *sc = ifp->if_softc;
   3938 	struct ifreq *ifr = (struct ifreq *)data;
   3939 	int s, error = 0;
   3940 
   3941 	/* XXX monkey see, monkey do. comes from wi_ioctl. */
   3942 	if ((sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
   3943 		return ENXIO;
   3944 
   3945 	s = splnet();
   3946 
   3947 	switch (cmd) {
   3948 	case SIOCSIFFLAGS:
   3949 		if (ifp->if_flags & IFF_UP) {
   3950 			if (ATW_IS_ENABLED(sc)) {
   3951 				/*
   3952 				 * To avoid rescanning another access point,
   3953 				 * do not call atw_init() here.  Instead,
   3954 				 * only reflect media settings.
   3955 				 */
   3956 				atw_filter_setup(sc);
   3957 			} else
   3958 				error = atw_init(ifp);
   3959 		} else if (ATW_IS_ENABLED(sc))
   3960 			atw_stop(ifp, 1);
   3961 		break;
   3962 	case SIOCADDMULTI:
   3963 	case SIOCDELMULTI:
   3964 		error = (cmd == SIOCADDMULTI) ?
   3965 		    ether_addmulti(ifr, &sc->sc_ic.ic_ec) :
   3966 		    ether_delmulti(ifr, &sc->sc_ic.ic_ec);
   3967 		if (error == ENETRESET) {
   3968 			if (ATW_IS_ENABLED(sc))
   3969 				atw_filter_setup(sc); /* do not rescan */
   3970 			error = 0;
   3971 		}
   3972 		break;
   3973 	default:
   3974 		error = ieee80211_ioctl(ifp, cmd, data);
   3975 		if (error == ENETRESET) {
   3976 			if (ATW_IS_ENABLED(sc))
   3977 				error = atw_init(ifp);
   3978 			else
   3979 				error = 0;
   3980 		}
   3981 		break;
   3982 	}
   3983 
   3984 	/* Try to get more packets going. */
   3985 	if (ATW_IS_ENABLED(sc))
   3986 		atw_start(ifp);
   3987 
   3988 	splx(s);
   3989 	return (error);
   3990 }
   3991 
   3992 static int
   3993 atw_media_change(struct ifnet *ifp)
   3994 {
   3995 	int error;
   3996 
   3997 	error = ieee80211_media_change(ifp);
   3998 	if (error == ENETRESET) {
   3999 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
   4000 		    (IFF_RUNNING|IFF_UP))
   4001 			atw_init(ifp);		/* XXX lose error */
   4002 		error = 0;
   4003 	}
   4004 	return error;
   4005 }
   4006 
   4007 static void
   4008 atw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
   4009 {
   4010 	struct atw_softc *sc = ifp->if_softc;
   4011 
   4012 	if (ATW_IS_ENABLED(sc) == 0) {
   4013 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
   4014 		imr->ifm_status = 0;
   4015 		return;
   4016 	}
   4017 	ieee80211_media_status(ifp, imr);
   4018 }
   4019