sys/dev/netif/acx/if_acx.c

   1 /*
   2  * Copyright (c) 2006 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Sepherosa Ziehau <sepherosa@gmail.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  * $DragonFly: src/sys/dev/netif/acx/if_acx.c,v 1.5 2006/09/01 15:13:15 sephe Exp $
  35  */
  36
  37 /*
  38  * Copyright (c) 2003-2004 wlan.kewl.org Project
  39  * All rights reserved.
  40  *
  41  * $Id: LICENSE,v 1.1.1.1 2004/07/01 12:20:39 darron Exp $
  42  *
  43  * Redistribution and use in source and binary forms, with or without
  44  * modification, are permitted provided that the following conditions
  45  * are met:
  46  *
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  *
  50  * 2. Redistributions in binary form must reproduce the above copyright
  51  *    notice, this list of conditions and the following disclaimer in the
  52  *    documentation and/or other materials provided with the distribution.
  53  *
  54  * 3. All advertising materials mentioning features or use of this software
  55  *    must display the following acknowledgement:
  56  *
  57  *    This product includes software developed by the wlan.kewl.org Project.
  58  *
  59  * 4. Neither the name of the wlan.kewl.org Project nor the names of its
  60  *    contributors may be used to endorse or promote products derived from
  61  *    this software without specific prior written permission.
  62  *
  63  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  64  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
  65  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
  66  * THE wlan.kewl.org Project BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  67  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  68  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  69  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  70  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  71  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  72  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  73  */
  74
  75 #include <sys/param.h>
  76 #include <sys/endian.h>
  77 #include <sys/kernel.h>
  78 #include <sys/bus.h>
  79 #include <sys/malloc.h>
  80 #include <sys/proc.h>
  81 #include <sys/rman.h>
  82 #include <sys/serialize.h>
  83 #include <sys/socket.h>
  84 #include <sys/sockio.h>
  85 #include <sys/sysctl.h>
  86
  87 #include <machine/bus.h>
  88 #include <machine/resource.h>
  89
  90 #include <net/ethernet.h>
  91 #include <net/if.h>
  92 #include <net/bpf.h>
  93 #include <net/if_arp.h>
  94 #include <net/if_dl.h>
  95 #include <net/if_media.h>
  96 #include <net/ifq_var.h>
  97
  98 #include <netproto/802_11/ieee80211_var.h>
  99
 100 #include <bus/pci/pcireg.h>
 101 #include <bus/pci/pcivar.h>
 102 #include <bus/pci/pcidevs.h>
 103
 104 #define ACX_DEBUG
 105
 106 #include "if_acxreg.h"
 107 #include "if_acxvar.h"
 108 #include "acxcmd.h"
 109
 110 #define ACX_ENABLE_TXCHAN(sc, chan)                                     \
 111 do {                                                                    \
 112         if (acx_enable_txchan((sc), (chan)) != 0) {                     \
 113                 if_printf(&(sc)->sc_ic.ic_if,                           \
 114                           "enable TX on channel %d failed\n", (chan));  \
 115         }                                                               \
 116 } while (0)
 117
 118 #define ACX_ENABLE_RXCHAN(sc, chan)                                     \
 119 do {                                                                    \
 120         if (acx_enable_rxchan((sc), (chan)) != 0) {                     \
 121                 if_printf(&(sc)->sc_ic.ic_if,                           \
 122                           "enable RX on channel %d failed\n", (chan));  \
 123         }                                                               \
 124 } while (0)
 125
 126 #define SIOCSLOADFW     _IOW('i', 137, struct ifreq)    /* load firmware */
 127 #define SIOCGRADIO      _IOW('i', 138, struct ifreq)    /* get radio type */
 128 #define SIOCGSTATS      _IOW('i', 139, struct ifreq)    /* get acx stats */
 129 #define SIOCSKILLFW     _IOW('i', 140, struct ifreq)    /* free firmware */
 130 #define SIOCGFWVER      _IOW('i', 141, struct ifreq)    /* get firmware ver */
 131 #define SIOCGHWID       _IOW('i', 142, struct ifreq)    /* get hardware id */
 132
 133 static int      acx_probe(device_t);
 134 static int      acx_attach(device_t);
 135 static int      acx_detach(device_t);
 136 static int      acx_shutdown(device_t);
 137
 138 static void     acx_init(void *);
 139 static int      acx_stop(struct acx_softc *);
 140 static void     acx_init_info_reg(struct acx_softc *);
 141 static int      acx_config(struct acx_softc *);
 142 static int      acx_read_config(struct acx_softc *, struct acx_config *);
 143 static int      acx_write_config(struct acx_softc *, struct acx_config *);
 144 static int      acx_set_crypt_keys(struct acx_softc *);
 145 #ifdef foo
 146 static void     acx_begin_scan(struct acx_softc *);
 147 #endif
 148 static void     acx_next_scan(void *);
 149
 150 static void     acx_start(struct ifnet *);
 151 static void     acx_watchdog(struct ifnet *);
 152
 153 static int      acx_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 154
 155 static void     acx_intr(void *);
 156 static void     acx_disable_intr(struct acx_softc *);
 157 static void     acx_enable_intr(struct acx_softc *);
 158 static void     acx_txeof(struct acx_softc *);
 159 static void     acx_txerr(struct acx_softc *, uint8_t);
 160 static void     acx_rxeof(struct acx_softc *);
 161
 162 static int      acx_dma_alloc(struct acx_softc *);
 163 static void     acx_dma_free(struct acx_softc *);
 164 static int      acx_init_tx_ring(struct acx_softc *);
 165 static int      acx_init_rx_ring(struct acx_softc *);
 166 static int      acx_newbuf(struct acx_softc *, struct acx_rxbuf *, int);
 167 static int      acx_encap(struct acx_softc *, struct acx_txbuf *,
 168                           struct mbuf *, struct ieee80211_node *);
 169
 170 static int      acx_reset(struct acx_softc *);
 171
 172 static int      acx_set_null_tmplt(struct acx_softc *);
 173 static int      acx_set_probe_req_tmplt(struct acx_softc *, const char *, int);
 174 static int      acx_set_probe_resp_tmplt(struct acx_softc *,
 175                                          struct ieee80211_node *);
 176 static int      acx_set_beacon_tmplt(struct acx_softc *,
 177                                      struct ieee80211_node *);
 178
 179 static int      acx_read_eeprom(struct acx_softc *, uint32_t, uint8_t *);
 180 static int      acx_read_phyreg(struct acx_softc *, uint32_t, uint8_t *);
 181
 182 static int      acx_copyin_firmware(struct acx_softc *, struct ifreq *);
 183 static void     acx_free_firmware(struct acx_softc *);
 184 static int      acx_load_firmware(struct acx_softc *, uint32_t,
 185                                   const uint8_t *, int);
 186 static int      acx_load_radio_firmware(struct acx_softc *, const uint8_t *,
 187                                         uint32_t);
 188 static int      acx_load_base_firmware(struct acx_softc *, const uint8_t *,
 189                                        uint32_t);
 190
 191 static int      acx_newstate(struct ieee80211com *, enum ieee80211_state, int);
 192
 193 static int      acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS);
 194
 195 const struct ieee80211_rateset  acx_rates_11b =
 196         { 4, { 2, 4, 11, 22 } };
 197 const struct ieee80211_rateset  acx_rates_11g =
 198         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
 199
 200 static int      acx_chanscan_rate = 5;  /* 5/second */
 201 int             acx_beacon_intvl = 100; /* 100 TU */
 202
 203 static const struct acx_device {
 204         uint16_t        vid;
 205         uint16_t        did;
 206         void            (*set_param)(device_t);
 207         const char      *desc;
 208 } acx_devices[] = {
 209         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100A, acx100_set_param,
 210           "Texas Instruments TNETW1100A Wireless Adapter" },
 211         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100B, acx100_set_param,
 212           "Texas Instruments TNETW1100B Wireless Adapter" },
 213         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX111, acx111_set_param,
 214           "Texas Instruments TNETW1130 Wireless Adapter" },
 215         { 0, 0, NULL, NULL }
 216 };
 217
 218 static device_method_t acx_methods[] = {
 219         DEVMETHOD(device_probe,         acx_probe),
 220         DEVMETHOD(device_attach,        acx_attach),
 221         DEVMETHOD(device_detach,        acx_detach),
 222         DEVMETHOD(device_shutdown,      acx_shutdown),
 223 #if 0
 224         DEVMETHOD(device_suspend,       acx_suspend),
 225         DEVMETHOD(device_resume,        acx_resume),
 226 #endif
 227         { 0, 0 }
 228 };
 229
 230 static driver_t acx_driver = {
 231         "acx",
 232         acx_methods,
 233         sizeof(struct acx_softc)
 234 };
 235
 236 static devclass_t acx_devclass;
 237
 238 DRIVER_MODULE(acx, pci, acx_driver, acx_devclass, 0, 0);
 239 DRIVER_MODULE(acx, cardbus, acx_driver, acx_devclass, 0, 0);
 240
 241 MODULE_DEPEND(acx, wlan, 1, 1, 1);
 242 MODULE_DEPEND(acx, pci, 1, 1, 1);
 243 MODULE_DEPEND(acx, cardbus, 1, 1, 1);
 244
 245 static int
 246 acx_probe(device_t dev)
 247 {
 248         const struct acx_device *a;
 249         uint16_t did, vid;
 250
 251         vid = pci_get_vendor(dev);
 252         did = pci_get_device(dev);
 253         for (a = acx_devices; a->desc != NULL; ++a) {
 254                 if (vid == a->vid && did == a->did) {
 255                         a->set_param(dev);
 256                         device_set_desc(dev, a->desc);
 257                         return 0;
 258                 }
 259         }
 260         return ENXIO;
 261 }
 262
 263 static int
 264 acx_attach(device_t dev)
 265 {
 266         struct acx_softc *sc;
 267         struct ifnet *ifp;
 268         struct ieee80211com *ic;
 269         int i, error;
 270
 271         sc = device_get_softc(dev);
 272         ic = &sc->sc_ic;
 273         ifp = &ic->ic_if;
 274
 275         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 276
 277 #ifndef BURN_BRIDGES
 278         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 279                 uint32_t mem1, mem2, irq;
 280
 281                 mem1 = pci_read_config(dev, sc->chip_mem1_rid, 4);
 282                 mem2 = pci_read_config(dev, sc->chip_mem2_rid, 4);
 283                 irq = pci_read_config(dev, PCIR_INTLINE, 4);
 284
 285                 device_printf(dev, "chip is in D%d power mode "
 286                     "-- setting to D0\n", pci_get_powerstate(dev));
 287
 288                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 289
 290                 pci_write_config(dev, sc->chip_mem1_rid, mem1, 4);
 291                 pci_write_config(dev, sc->chip_mem2_rid, mem2, 4);
 292                 pci_write_config(dev, PCIR_INTLINE, irq, 4);
 293         }
 294 #endif  /* !BURN_BRIDGE */
 295
 296         /* Enable bus mastering */
 297         pci_enable_busmaster(dev);
 298
 299         /* Allocate IO memory 1 */
 300         sc->sc_mem1_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 301                                                  &sc->chip_mem1_rid,
 302                                                  RF_ACTIVE);
 303         if (sc->sc_mem1_res == NULL) {
 304                 error = ENXIO;
 305                 device_printf(dev, "can't allocate IO mem1\n");
 306                 goto fail;
 307         }
 308         sc->sc_mem1_bt = rman_get_bustag(sc->sc_mem1_res);
 309         sc->sc_mem1_bh = rman_get_bushandle(sc->sc_mem1_res);
 310
 311         /* Allocate IO memory 2 */
 312         sc->sc_mem2_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 313                                                  &sc->chip_mem2_rid,
 314                                                  RF_ACTIVE);
 315         if (sc->sc_mem2_res == NULL) {
 316                 error = ENXIO;
 317                 device_printf(dev, "can't allocate IO mem2\n");
 318                 goto fail;
 319         }
 320         sc->sc_mem2_bt = rman_get_bustag(sc->sc_mem2_res);
 321         sc->sc_mem2_bh = rman_get_bushandle(sc->sc_mem2_res);
 322
 323         /* Allocate irq */
 324         sc->sc_irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 325                                                 &sc->sc_irq_rid,
 326                                                 RF_SHAREABLE | RF_ACTIVE);
 327         if (sc->sc_irq_res == NULL) {
 328                 error = ENXIO;
 329                 device_printf(dev, "can't allocate intr\n");
 330                 goto fail;
 331         }
 332
 333         /* Initilize channel scanning timer */
 334         callout_init(&sc->sc_chanscan_timer);
 335
 336         /* Allocate busdma stuffs */
 337         error = acx_dma_alloc(sc);
 338         if (error)
 339                 goto fail;
 340
 341         /* Reset Hardware */
 342         error = acx_reset(sc);
 343         if (error)
 344                 goto fail;
 345
 346         /* Disable interrupts before firmware is loaded */
 347         acx_disable_intr(sc);
 348
 349         /* Get radio type and form factor */
 350 #define EEINFO_RETRY_MAX        50
 351         for (i = 0; i < EEINFO_RETRY_MAX; ++i) {
 352                 uint16_t ee_info;
 353
 354                 ee_info = CSR_READ_2(sc, ACXREG_EEPROM_INFO);
 355                 if (ACX_EEINFO_HAS_RADIO_TYPE(ee_info)) {
 356                         sc->sc_form_factor = ACX_EEINFO_FORM_FACTOR(ee_info);
 357                         sc->sc_radio_type = ACX_EEINFO_RADIO_TYPE(ee_info);
 358                         break;
 359                 }
 360                 DELAY(10000);
 361         }
 362         if (i == EEINFO_RETRY_MAX) {
 363                 error = ENXIO;
 364                 goto fail;
 365         }
 366 #undef EEINFO_RETRY_MAX
 367
 368         DPRINTF((&sc->sc_ic.ic_if, "radio type %02x\n", sc->sc_radio_type));
 369
 370 #ifdef DUMP_EEPROM
 371         for (i = 0; i < 0x40; ++i) {
 372                 uint8_t val;
 373
 374                 error = acx_read_eeprom(sc, i, &val);
 375                 if (i % 10 == 0)
 376                         printf("\n");
 377                 printf("%02x ", val);
 378         }
 379         printf("\n");
 380 #endif  /* DUMP_EEPROM */
 381
 382         /* Get EEPROM version */
 383         error = acx_read_eeprom(sc, ACX_EE_VERSION_OFS, &sc->sc_eeprom_ver);
 384         if (error)
 385                 goto fail;
 386         DPRINTF((&sc->sc_ic.ic_if, "EEPROM version %u\n", sc->sc_eeprom_ver));
 387
 388         ifp->if_softc = sc;
 389         ifp->if_init = acx_init;
 390         ifp->if_ioctl = acx_ioctl;
 391         ifp->if_start = acx_start;
 392         ifp->if_watchdog = acx_watchdog;
 393         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
 394         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 395         ifq_set_ready(&ifp->if_snd);
 396
 397         /* Set channels */
 398         for (i = 1; i <= 14; ++i) {
 399                 ic->ic_channels[i].ic_freq =
 400                         ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 401                 ic->ic_channels[i].ic_flags = sc->chip_chan_flags;
 402         }
 403
 404         ic->ic_opmode = IEEE80211_M_STA;
 405         ic->ic_state = IEEE80211_S_INIT;
 406         ic->ic_bintval = acx_beacon_intvl;
 407
 408         /*
 409          * NOTE: Don't overwrite ic_caps set by chip specific code
 410          */
 411         ic->ic_caps |= IEEE80211_C_WEP |        /* WEP */
 412                        IEEE80211_C_HOSTAP |     /* Host AP modes */
 413                        IEEE80211_C_IBSS |       /* IBSS modes */
 414                        IEEE80211_C_SHPREAMBLE;  /* Short preamble */
 415
 416         /* Get station id */
 417         for (i = 0; i < IEEE80211_ADDR_LEN; ++i) {
 418                 error = acx_read_eeprom(sc, sc->chip_ee_eaddr_ofs - i,
 419                                         &ic->ic_myaddr[i]);
 420         }
 421
 422         ieee80211_ifattach(ic);
 423
 424         /* Override newstate */
 425         sc->sc_newstate = ic->ic_newstate;
 426         ic->ic_newstate = acx_newstate;
 427
 428         ieee80211_media_init(ic, ieee80211_media_change, ieee80211_media_status);
 429
 430         sc->sc_long_retry_limit = 4;
 431         sc->sc_msdu_lifetime = 4096;
 432
 433         sysctl_ctx_init(&sc->sc_sysctl_ctx);
 434         sc->sc_sysctl_tree = SYSCTL_ADD_NODE(&sc->sc_sysctl_ctx,
 435                                              SYSCTL_STATIC_CHILDREN(_hw),
 436                                              OID_AUTO,
 437                                              device_get_nameunit(dev),
 438                                              CTLFLAG_RD, 0, "");
 439         if (sc->sc_sysctl_tree == NULL) {
 440                 device_printf(dev, "can't add sysctl node\n");
 441                 error = ENXIO;
 442                 goto fail1;
 443         }
 444
 445         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 446                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 447                         OID_AUTO, "msdu_lifetime",
 448                         CTLTYPE_INT | CTLFLAG_RW,
 449                         sc, 0, acx_sysctl_msdu_lifetime, "I",
 450                         "MSDU life time");
 451
 452         error = bus_setup_intr(dev, sc->sc_irq_res, INTR_MPSAFE, acx_intr, sc,
 453                                &sc->sc_irq_handle, ifp->if_serializer);
 454         if (error) {
 455                 device_printf(dev, "can't set up interrupt\n");
 456                 goto fail1;
 457         }
 458
 459         if (bootverbose)
 460                 ieee80211_announce(ic);
 461
 462         return 0;
 463 fail1:
 464         ieee80211_ifdetach(ic);
 465 fail:
 466         acx_detach(dev);
 467         return error;
 468 }
 469
 470 static int
 471 acx_detach(device_t dev)
 472 {
 473         struct acx_softc *sc = device_get_softc(dev);
 474
 475         if (device_is_attached(dev)) {
 476                 struct ieee80211com *ic = &sc->sc_ic;
 477                 struct ifnet *ifp = &ic->ic_if;
 478
 479                 lwkt_serialize_enter(ifp->if_serializer);
 480
 481                 acx_stop(sc);
 482                 acx_free_firmware(sc);
 483                 bus_teardown_intr(dev, sc->sc_irq_res, sc->sc_irq_handle);
 484
 485                 lwkt_serialize_exit(ifp->if_serializer);
 486
 487                 ieee80211_ifdetach(ic);
 488         }
 489
 490         if (sc->sc_sysctl_tree != NULL)
 491                 sysctl_ctx_free(&sc->sc_sysctl_ctx);
 492
 493         if (sc->sc_irq_res != NULL) {
 494                 bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
 495                                      sc->sc_irq_res);
 496         }
 497         if (sc->sc_mem1_res != NULL) {
 498                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem1_rid,
 499                                      sc->sc_mem1_res);
 500         }
 501         if (sc->sc_mem2_res != NULL) {
 502                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem2_rid,
 503                                      sc->sc_mem2_res);
 504         }
 505
 506         acx_dma_free(sc);
 507         return 0;
 508 }
 509
 510 static int
 511 acx_shutdown(device_t dev)
 512 {
 513         struct acx_softc *sc = device_get_softc(dev);
 514
 515         lwkt_serialize_enter(sc->sc_ic.ic_if.if_serializer);
 516         acx_stop(sc);
 517         lwkt_serialize_exit(sc->sc_ic.ic_if.if_serializer);
 518         return 0;
 519 }
 520
 521 static void
 522 acx_init(void *arg)
 523 {
 524         struct acx_softc *sc = arg;
 525         struct ifnet *ifp = &sc->sc_ic.ic_if;
 526         struct acx_firmware *fw = &sc->sc_firmware;
 527         int error;
 528
 529         error = acx_stop(sc);
 530         if (error)
 531                 return;
 532
 533         if (fw->base_fw == NULL) {
 534                 error = EINVAL;
 535                 if_printf(ifp, "base firmware is not loaded yet\n");
 536                 return;
 537         }
 538
 539         error = acx_init_tx_ring(sc);
 540         if (error) {
 541                 if_printf(ifp, "can't initialize TX ring\n");
 542                 goto back;
 543         }
 544
 545         error = acx_init_rx_ring(sc);
 546         if (error) {
 547                 if_printf(ifp, "can't initialize RX ring\n");
 548                 goto back;
 549         }
 550
 551         error = acx_load_base_firmware(sc, fw->base_fw, fw->base_fw_len);
 552         if (error)
 553                 goto back;
 554
 555         /*
 556          * Initialize command and information registers
 557          * NOTE: This should be done after base firmware is loaded
 558          */
 559         acx_init_cmd_reg(sc);
 560         acx_init_info_reg(sc);
 561
 562         sc->sc_flags |= ACX_FLAG_FW_LOADED;
 563
 564 #if 0
 565         if (sc->chip_post_basefw != NULL) {
 566                 error = sc->chip_post_basefw(sc);
 567                 if (error)
 568                         goto back;
 569         }
 570 #endif
 571
 572         if (fw->radio_fw != NULL) {
 573                 error = acx_load_radio_firmware(sc, fw->radio_fw,
 574                                                 fw->radio_fw_len);
 575                 if (error)
 576                         goto back;
 577         }
 578
 579         error = sc->chip_init(sc);
 580         if (error)
 581                 goto back;
 582
 583         /* Get and set device various configuration */
 584         error = acx_config(sc);
 585         if (error)
 586                 goto back;
 587
 588         /* Setup crypto stuffs */
 589         if (sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) {
 590                 error = acx_set_crypt_keys(sc);
 591                 if (error)
 592                         goto back;
 593                 sc->sc_ic.ic_flags &= ~IEEE80211_F_DROPUNENC;
 594         }
 595
 596         /* Turn on power led */
 597         CSR_CLRB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 598
 599         acx_enable_intr(sc);
 600
 601         ifp->if_flags |= IFF_RUNNING;
 602         ifp->if_flags &= ~IFF_OACTIVE;
 603
 604         /* Begin background scanning */
 605 #ifdef foo
 606         acx_begin_scan(sc);
 607 #else
 608         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_SCAN, -1);
 609 #endif
 610
 611 back:
 612         if (error)
 613                 acx_stop(sc);
 614 }
 615
 616 static void
 617 acx_init_info_reg(struct acx_softc *sc)
 618 {
 619         sc->sc_info = CSR_READ_4(sc, ACXREG_INFO_REG_OFFSET);
 620         sc->sc_info_param = sc->sc_info + ACX_INFO_REG_SIZE;
 621 }
 622
 623 static int
 624 acx_set_crypt_keys(struct acx_softc *sc)
 625 {
 626         struct ieee80211com *ic = &sc->sc_ic;
 627         struct acx_conf_wep_txkey wep_txkey;
 628         int i, error, got_wk = 0;
 629
 630         for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
 631                 struct ieee80211_key *wk = &ic->ic_nw_keys[i];
 632
 633                 if (wk->wk_keylen == 0)
 634                         continue;
 635
 636                 if (sc->chip_hw_crypt) {
 637                         error = sc->chip_set_wepkey(sc, wk, i);
 638                         if (error)
 639                                 return error;
 640                         got_wk = 1;
 641                 } else if (wk->wk_flags & IEEE80211_KEY_XMIT) {
 642                         wk->wk_flags |= IEEE80211_KEY_SWCRYPT;
 643                 }
 644         }
 645
 646         if (!got_wk || sc->chip_hw_crypt ||
 647             ic->ic_def_txkey == IEEE80211_KEYIX_NONE)
 648                 return 0;
 649
 650         /* Set current WEP key index */
 651         wep_txkey.wep_txkey = ic->ic_def_txkey;
 652         if (acx_set_wep_txkey_conf(sc, &wep_txkey) != 0) {
 653                 if_printf(&ic->ic_if, "set WEP txkey failed\n");
 654                 return ENXIO;
 655         }
 656         return 0;
 657 }
 658
 659 #ifdef foo
 660 static void
 661 acx_begin_scan(struct acx_softc *sc)
 662 {
 663         struct ieee80211com *ic = &sc->sc_ic;
 664         uint8_t chan;
 665
 666         ieee80211_begin_scan(ic, 1);
 667
 668         chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 669
 670         ACX_ENABLE_TXCHAN(sc, chan);
 671         ACX_ENABLE_RXCHAN(sc, chan);
 672
 673         /* Start background scanning */
 674         callout_reset(&sc->sc_chanscan_timer, hz / acx_chanscan_rate,
 675                       acx_next_scan, sc);
 676 }
 677 #endif
 678
 679 static void
 680 acx_next_scan(void *arg)
 681 {
 682         struct acx_softc *sc = arg;
 683         struct ieee80211com *ic = &sc->sc_ic;
 684         struct ifnet *ifp = &ic->ic_if;
 685
 686         lwkt_serialize_enter(ifp->if_serializer);
 687
 688         if (ic->ic_state == IEEE80211_S_SCAN) {
 689 #if 0
 690                 uint8_t chan;
 691 #endif
 692
 693                 ieee80211_next_scan(ic);
 694
 695 #if 0
 696                 chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 697
 698                 ACX_ENABLE_TXCHAN(sc, chan);
 699                 ACX_ENABLE_RXCHAN(sc, chan);
 700
 701                 callout_reset(&sc->sc_chanscan_timer, hz / acx_chanscan_rate,
 702                               acx_next_scan, sc);
 703 #endif
 704         }
 705
 706         lwkt_serialize_exit(ifp->if_serializer);
 707 }
 708
 709 static int
 710 acx_stop(struct acx_softc *sc)
 711 {
 712         struct ieee80211com *ic = &sc->sc_ic;
 713         struct ifnet *ifp = &ic->ic_if;
 714         struct acx_buf_data *bd = &sc->sc_buf_data;
 715         struct acx_ring_data *rd = &sc->sc_ring_data;
 716         int i, error;
 717
 718         ASSERT_SERIALIZED(ifp->if_serializer);
 719
 720         sc->sc_firmware_ver = 0;
 721         sc->sc_hardware_id = 0;
 722
 723         /* Reset hardware */
 724         error = acx_reset(sc);
 725         if (error)
 726                 return error;
 727
 728         /* Firmware no longer functions after hardware reset */
 729         sc->sc_flags &= ~ACX_FLAG_FW_LOADED;
 730
 731         acx_disable_intr(sc);
 732
 733         /* Stop backgroud scanning */
 734         callout_stop(&sc->sc_chanscan_timer);
 735
 736         /* Turn off power led */
 737         CSR_SETB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 738
 739         /* Free TX mbuf */
 740         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
 741                 struct acx_txbuf *buf;
 742
 743                 buf = &bd->tx_buf[i];
 744
 745                 if (buf->tb_mbuf != NULL) {
 746                         bus_dmamap_unload(bd->mbuf_dma_tag,
 747                                           buf->tb_mbuf_dmamap);
 748                         m_freem(buf->tb_mbuf);
 749                         buf->tb_mbuf = NULL;
 750                 }
 751
 752                 if (buf->tb_node != NULL)
 753                         ieee80211_free_node(buf->tb_node);
 754                 buf->tb_node = NULL;
 755         }
 756
 757         /* Clear TX host descriptors */
 758         bzero(rd->tx_ring, ACX_TX_RING_SIZE);
 759
 760         /* Free RX mbuf */
 761         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
 762                 if (bd->rx_buf[i].rb_mbuf != NULL) {
 763                         bus_dmamap_unload(bd->mbuf_dma_tag,
 764                                           bd->rx_buf[i].rb_mbuf_dmamap);
 765                         m_freem(bd->rx_buf[i].rb_mbuf);
 766                         bd->rx_buf[i].rb_mbuf = NULL;
 767                 }
 768         }
 769
 770         /* Clear RX host descriptors */
 771         bzero(rd->rx_ring, ACX_RX_RING_SIZE);
 772
 773         ifp->if_timer = 0;
 774         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 775         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
 776
 777         return 0;
 778 }
 779
 780 static int
 781 acx_config(struct acx_softc *sc)
 782 {
 783         struct acx_config conf;
 784         int error;
 785
 786         error = acx_read_config(sc, &conf);
 787         if (error)
 788                 return error;
 789
 790         error = acx_write_config(sc, &conf);
 791         if (error)
 792                 return error;
 793
 794         if (acx_set_probe_req_tmplt(sc, "", 0) != 0) {
 795                 if_printf(&sc->sc_ic.ic_if, "can't set probe req template "
 796                           "(empty ssid)\n");
 797                 return ENXIO;
 798         }
 799
 800         /* XXX for PM?? */
 801         if (acx_set_null_tmplt(sc) != 0) {
 802                 if_printf(&sc->sc_ic.ic_if, "can't set null data template\n");
 803                 return ENXIO;
 804         }
 805         return 0;
 806 }
 807
 808 static int
 809 acx_read_config(struct acx_softc *sc, struct acx_config *conf)
 810 {
 811         struct acx_conf_eaddr addr;
 812         struct acx_conf_regdom reg_dom;
 813         struct acx_conf_antenna ant;
 814         struct acx_conf_fwrev fw_rev;
 815         uint32_t fw_rev_no;
 816         uint8_t sen;
 817         int i, error;
 818
 819         /* Get station id */
 820         if (acx_get_eaddr_conf(sc, &addr) != 0) {
 821                 if_printf(&sc->sc_ic.ic_if, "can't get station id\n");
 822                 return ENXIO;
 823         }
 824
 825         /*
 826          * Get and print station id in case that EEPROM station id's
 827          * offset is not correct
 828          */
 829         for (i = 0; i < IEEE80211_ADDR_LEN; ++i)
 830                 conf->eaddr[IEEE80211_ADDR_LEN - 1 - i] = addr.eaddr[i];
 831         if_printf(&sc->sc_ic.ic_if, "MAC address (from firmware): %6D\n",
 832                   conf->eaddr, ":");
 833
 834         /* Get region domain */
 835         if (acx_get_regdom_conf(sc, &reg_dom) != 0) {
 836                 if_printf(&sc->sc_ic.ic_if, "can't get region domain\n");
 837                 return ENXIO;
 838         }
 839         conf->regdom = reg_dom.regdom;
 840         DPRINTF((&sc->sc_ic.ic_if, "regdom %02x\n", reg_dom.regdom));
 841
 842         /* Get antenna */
 843         if (acx_get_antenna_conf(sc, &ant) != 0) {
 844                 if_printf(&sc->sc_ic.ic_if, "can't get antenna\n");
 845                 return ENXIO;
 846         }
 847         conf->antenna = ant.antenna;
 848         DPRINTF((&sc->sc_ic.ic_if, "antenna %02x\n", ant.antenna));
 849
 850         /* Get sensitivity XXX not used */
 851         if (sc->sc_radio_type == ACX_RADIO_TYPE_MAXIM ||
 852             sc->sc_radio_type == ACX_RADIO_TYPE_RFMD ||
 853             sc->sc_radio_type == ACX_RADIO_TYPE_RALINK) {
 854                 error = acx_read_phyreg(sc, ACXRV_PHYREG_SENSITIVITY, &sen);
 855                 if (error) {
 856                         if_printf(&sc->sc_ic.ic_if, "can't get sensitivity\n");
 857                         return error;
 858                 }
 859         } else {
 860                 sen = 0;
 861         }
 862         DPRINTF((&sc->sc_ic.ic_if, "sensitivity %02x\n", sen));
 863
 864         /* Get firmware revision */
 865         if (acx_get_fwrev_conf(sc, &fw_rev) != 0) {
 866                 if_printf(&sc->sc_ic.ic_if, "can't get firmware revision\n");
 867                 return ENXIO;
 868         }
 869
 870         if (strncmp(fw_rev.fw_rev, "Rev ", 4) != 0) {
 871                 if_printf(&sc->sc_ic.ic_if, "strange revision string -- %s\n",
 872                           fw_rev.fw_rev);
 873                 fw_rev_no = 0x01090407;
 874         } else {
 875                 char *s, *endp;
 876
 877                 /*
 878                  *  01234
 879                  * "Rev xx.xx.xx.xx"
 880                  *      ^ Start from here
 881                  */
 882                 s = &fw_rev.fw_rev[4];
 883                 fw_rev_no = 0;
 884                 for (i = 0; i < 4; ++i) {
 885                         uint8_t val;
 886
 887                         val = strtoul(s, &endp, 16);
 888                         fw_rev_no |= val << ((3 - i) * 8);
 889
 890                         if (*endp == '\0')
 891                                 break;
 892                         else
 893                                 s = ++endp;
 894                 }
 895         }
 896         sc->sc_firmware_ver = fw_rev_no;
 897         sc->sc_hardware_id = le32toh(fw_rev.hw_id);
 898         DPRINTF((&sc->sc_ic.ic_if, "fw rev %08x, hw id %08x\n",
 899                  sc->sc_firmware_ver, sc->sc_hardware_id));
 900
 901         if (sc->chip_read_config != NULL) {
 902                 error = sc->chip_read_config(sc, conf);
 903                 if (error)
 904                         return error;
 905         }
 906         return 0;
 907 }
 908
 909 static int
 910 acx_write_config(struct acx_softc *sc, struct acx_config *conf)
 911 {
 912         struct acx_conf_nretry_short sretry;
 913         struct acx_conf_nretry_long lretry;
 914         struct acx_conf_msdu_lifetime msdu_lifetime;
 915         struct acx_conf_rate_fallback rate_fb;
 916         struct acx_conf_antenna ant;
 917         struct acx_conf_regdom reg_dom;
 918         struct acx_conf_rxopt rx_opt;
 919         int error;
 920
 921         /* Set number of long/short retry */
 922         KKASSERT(sc->chip_short_retry_limit > 0);
 923         sretry.nretry = sc->chip_short_retry_limit;
 924         if (acx_set_nretry_short_conf(sc, &sretry) != 0) {
 925                 if_printf(&sc->sc_ic.ic_if, "can't set short retry limit\n");
 926                 return ENXIO;
 927         }
 928
 929         lretry.nretry = sc->sc_long_retry_limit;
 930         if (acx_set_nretry_long_conf(sc, &lretry) != 0) {
 931                 if_printf(&sc->sc_ic.ic_if, "can't set long retry limit\n");
 932                 return ENXIO;
 933         }
 934
 935         /* Set MSDU lifetime */
 936         msdu_lifetime.lifetime = htole32(sc->sc_msdu_lifetime);
 937         if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
 938                 if_printf(&sc->sc_ic.ic_if, "can't set MSDU lifetime\n");
 939                 return ENXIO;
 940         }
 941
 942         /* Enable rate fallback */
 943         rate_fb.ratefb_enable = 1;
 944         if (acx_set_rate_fallback_conf(sc, &rate_fb) != 0) {
 945                 if_printf(&sc->sc_ic.ic_if, "can't enable rate fallback\n");
 946                 return ENXIO;
 947         }
 948
 949         /* Set antenna */
 950         ant.antenna = conf->antenna;
 951         if (acx_set_antenna_conf(sc, &ant) != 0) {
 952                 if_printf(&sc->sc_ic.ic_if, "can't set antenna\n");
 953                 return ENXIO;
 954         }
 955
 956         /* Set region domain */
 957         reg_dom.regdom = conf->regdom;
 958         if (acx_set_regdom_conf(sc, &reg_dom) != 0) {
 959                 if_printf(&sc->sc_ic.ic_if, "can't set region domain\n");
 960                 return ENXIO;
 961         }
 962
 963         if (sc->chip_write_config != NULL) {
 964                 error = sc->chip_write_config(sc, conf);
 965                 if (error)
 966                         return error;
 967         }
 968
 969         /* What we want to receive and how to receive */
 970         /* XXX may not belong here, acx_init() */
 971         rx_opt.opt1 = RXOPT1_FILT_FDEST | RXOPT1_INCL_RXBUF_HDR;
 972         rx_opt.opt2 = RXOPT2_RECV_ASSOC_REQ |
 973                       RXOPT2_RECV_AUTH |
 974                       RXOPT2_RECV_BEACON |
 975                       RXOPT2_RECV_CF |
 976                       RXOPT2_RECV_CTRL |
 977                       RXOPT2_RECV_DATA |
 978                       RXOPT2_RECV_MGMT |
 979                       RXOPT2_RECV_PROBE_REQ |
 980                       RXOPT2_RECV_PROBE_RESP |
 981                       RXOPT2_RECV_OTHER;
 982         if (acx_set_rxopt_conf(sc, &rx_opt) != 0) {
 983                 if_printf(&sc->sc_ic.ic_if, "can't set RX option\n");
 984                 return ENXIO;
 985         }
 986         return 0;
 987 }
 988
 989 static int
 990 acx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
 991 {
 992         struct acx_softc *sc = ifp->if_softc;
 993         struct ifreq *req;
 994         int error;
 995
 996         error = 0;
 997         req = (struct ifreq *)data;
 998
 999         switch (cmd) {
1000         case SIOCSLOADFW:
1001                 error = suser_cred(cr, NULL_CRED_OKAY);
1002                 if (error)
1003                         break;
1004
1005                 error = acx_copyin_firmware(sc, req);
1006                 break;
1007         case SIOCSKILLFW:
1008                 error = suser_cred(cr, NULL_CRED_OKAY);
1009                 if (error)
1010                         break;
1011                 acx_free_firmware(sc);
1012                 break;
1013         case SIOCGRADIO:
1014                 error = copyout(&sc->sc_radio_type, req->ifr_data,
1015                                 sizeof(sc->sc_radio_type));
1016                 break;
1017         case SIOCGFWVER:
1018                 error = copyout(&sc->sc_firmware_ver, req->ifr_data,
1019                                 sizeof(sc->sc_firmware_ver));
1020                 break;
1021         case SIOCGHWID:
1022                 error = copyout(&sc->sc_hardware_id, req->ifr_data,
1023                                 sizeof(sc->sc_hardware_id));
1024                 break;
1025         case SIOCGSTATS:
1026                 error = copyout(&sc->sc_stats, req->ifr_data,
1027                                 sizeof(sc->sc_stats));
1028                 break;
1029         case SIOCSIFFLAGS:
1030                 if (ifp->if_flags & IFF_UP) {
1031                         if ((ifp->if_flags & IFF_RUNNING) == 0)
1032                                 acx_init(sc);
1033                 } else {
1034                         if (ifp->if_flags & IFF_RUNNING)
1035                                 acx_stop(sc);
1036                 }
1037                 break;
1038         case SIOCADDMULTI:
1039         case SIOCDELMULTI:
1040                 /* TODO */
1041                 break;
1042         default:
1043                 error = ieee80211_ioctl(&sc->sc_ic, cmd, data, cr);
1044                 break;
1045         }
1046
1047         if (error == ENETRESET) {
1048                 if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
1049                     (IFF_RUNNING | IFF_UP))
1050                         acx_init(sc);
1051                 error = 0;
1052         }
1053         return error;
1054 }
1055
1056 static void
1057 acx_start(struct ifnet *ifp)
1058 {
1059         struct acx_softc *sc = ifp->if_softc;
1060         struct ieee80211com *ic = &sc->sc_ic;
1061         struct acx_buf_data *bd = &sc->sc_buf_data;
1062         struct acx_txbuf *buf;
1063         int trans, idx;
1064
1065         ASSERT_SERIALIZED(ifp->if_serializer);
1066
1067         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0 ||
1068             (ifp->if_flags & IFF_RUNNING) == 0 ||
1069             (ifp->if_flags & IFF_OACTIVE))
1070                 return;
1071
1072         /*
1073          * NOTE:
1074          * We can't start from a random position that TX descriptor
1075          * is free, since hardware will be confused by that.
1076          * We have to follow the order of the TX ring.
1077          */
1078         idx = bd->tx_free_start;
1079         trans = 0;
1080         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf == NULL;
1081              buf = &bd->tx_buf[idx]) {
1082                 struct ieee80211_frame *f;
1083                 struct ieee80211_node *ni = NULL;
1084                 struct mbuf *m;
1085                 int mgmt_pkt = 0;
1086
1087                 if (!IF_QEMPTY(&ic->ic_mgtq)) {
1088                         IF_DEQUEUE(&ic->ic_mgtq, m);
1089
1090                         ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1091                         m->m_pkthdr.rcvif = NULL;
1092
1093                         mgmt_pkt = 1;
1094                 } else if (!ifq_is_empty(&ifp->if_snd)) {
1095                         struct ether_header *eh;
1096
1097                         if (ic->ic_state != IEEE80211_S_RUN) {
1098                                 if_printf(ifp, "data packet dropped due to "
1099                                           "not RUN.  Current state %d\n",
1100                                           ic->ic_state);
1101                                 break;
1102                         }
1103
1104                         m = ifq_dequeue(&ifp->if_snd, NULL);
1105                         if (m == NULL)
1106                                 break;
1107
1108                         if (m->m_len < sizeof(struct ether_header)) {
1109                                 m = m_pullup(m, sizeof(struct ether_header));
1110                                 if (m == NULL) {
1111                                         ifp->if_oerrors++;
1112                                         continue;
1113                                 }
1114                         }
1115                         eh = mtod(m, struct ether_header *);
1116
1117                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1118                         if (ni == NULL) {
1119                                 m_freem(m);
1120                                 ifp->if_oerrors++;
1121                                 continue;
1122                         }
1123
1124                         /* TODO power save */
1125
1126                         m = ieee80211_encap(ic, m, ni);
1127                         if (m == NULL) {
1128                                 ieee80211_free_node(ni);
1129                                 ifp->if_oerrors++;
1130                                 continue;
1131                         }
1132
1133                         BPF_MTAP(ifp, m);
1134                 } else {
1135                         break;
1136                 }
1137
1138                 f = mtod(m, struct ieee80211_frame *);
1139                 if ((f->i_fc[1] & IEEE80211_FC1_WEP) && !sc->chip_hw_crypt) {
1140                         KASSERT(ni != NULL, ("TX node is NULL (WEP)\n"));
1141                         if (ieee80211_crypto_encap(ic, ni, m) == NULL) {
1142                                 ieee80211_free_node(ni);
1143                                 m_freem(m);
1144                                 ifp->if_oerrors++;
1145                                 continue;
1146                         }
1147                 }
1148
1149                 if (ic->ic_rawbpf != NULL)
1150                         bpf_mtap(ic->ic_rawbpf, m);
1151
1152                 /*
1153                  * Since mgmt data are transmitted at fixed rate
1154                  * they will not be used to do rate control.
1155                  */
1156                 if (mgmt_pkt && ni != NULL) {
1157                         ieee80211_free_node(ni);
1158                         ni = NULL;
1159                 }
1160
1161                 if (acx_encap(sc, buf, m, ni) != 0) {
1162                         /*
1163                          * NOTE: `m' will be freed in acx_encap()
1164                          * if we reach here.
1165                          */
1166                         if (ni != NULL)
1167                                 ieee80211_free_node(ni);
1168                         ifp->if_oerrors++;
1169                         continue;
1170                 }
1171
1172                 /*
1173                  * NOTE:
1174                  * 1) `m' should not be touched after acx_encap()
1175                  * 2) `node' will be used to do TX rate control during
1176                  *    acx_txeof(), so it is not freed here.  acx_txeof()
1177                  *    will free it for us
1178                  */
1179
1180                 trans = 1;
1181                 bd->tx_used_count++;
1182                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1183         }
1184         bd->tx_free_start = idx;
1185
1186         if (bd->tx_used_count == ACX_TX_DESC_CNT)
1187                 ifp->if_flags |= IFF_OACTIVE;
1188
1189         if (trans && ifp->if_timer == 0)
1190                 ifp->if_timer = 5;
1191 }
1192
1193 static void
1194 acx_watchdog(struct ifnet *ifp)
1195 {
1196         if_printf(ifp, "watchdog timeout\n");
1197         acx_txeof(ifp->if_softc);
1198         /* TODO */
1199 }
1200
1201 static void
1202 acx_intr(void *arg)
1203 {
1204         struct acx_softc *sc = arg;
1205         uint16_t intr_status;
1206
1207         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0)
1208                 return;
1209
1210         intr_status = CSR_READ_2(sc, ACXREG_INTR_STATUS_CLR);
1211         if (intr_status == ACXRV_INTR_ALL) {
1212                 /* not our interrupt */
1213                 return;
1214         }
1215
1216         intr_status &= sc->chip_intr_enable;
1217         if (intr_status == 0) {
1218                 /* not interrupts we care about */
1219                 return;
1220         }
1221
1222         /* Acknowledge all interrupts */
1223         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_ALL);
1224
1225         if (intr_status & ACXRV_INTR_TX_FINI)
1226                 acx_txeof(sc);
1227
1228         if (intr_status & ACXRV_INTR_RX_FINI)
1229                 acx_rxeof(sc);
1230 }
1231
1232 static void
1233 acx_disable_intr(struct acx_softc *sc)
1234 {
1235         CSR_WRITE_2(sc, ACXREG_INTR_MASK, sc->chip_intr_disable);
1236         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, 0);
1237 }
1238
1239 static void
1240 acx_enable_intr(struct acx_softc *sc)
1241 {
1242         /* Mask out interrupts that are not in the enable set */
1243         CSR_WRITE_2(sc, ACXREG_INTR_MASK, ~sc->chip_intr_enable);
1244         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, ACXRV_EVENT_DISABLE);
1245 }
1246
1247 static void
1248 acx_txeof(struct acx_softc *sc)
1249 {
1250         struct acx_buf_data *bd;
1251         struct acx_txbuf *buf;
1252         struct ifnet *ifp;
1253         int idx;
1254
1255         ifp = &sc->sc_ic.ic_if;
1256         ASSERT_SERIALIZED(ifp->if_serializer);
1257
1258         bd = &sc->sc_buf_data;
1259         idx = bd->tx_used_start;
1260         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf != NULL;
1261              buf = &bd->tx_buf[idx]) {
1262                 uint8_t ctrl, error;
1263                 int frame_len;
1264
1265                 ctrl = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_ctrl);
1266                 if ((ctrl & (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE)) !=
1267                     (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE))
1268                         break;
1269
1270                 bus_dmamap_unload(bd->mbuf_dma_tag, buf->tb_mbuf_dmamap);
1271                 frame_len = buf->tb_mbuf->m_pkthdr.len;
1272                 m_freem(buf->tb_mbuf);
1273                 buf->tb_mbuf = NULL;
1274
1275                 error = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_error);
1276                 if (error) {
1277                         acx_txerr(sc, error);
1278                         ifp->if_oerrors++;
1279                 } else {
1280                         ifp->if_opackets++;
1281                 }
1282
1283                 if (buf->tb_node != NULL) {
1284                         sc->chip_tx_complete(sc, buf, frame_len, error);
1285                         ieee80211_free_node(buf->tb_node);
1286                         buf->tb_node = NULL;
1287                 }
1288
1289                 FW_TXDESC_SETFIELD_1(sc, buf, f_tx_ctrl, DESC_CTRL_HOSTOWN);
1290
1291                 bd->tx_used_count--;
1292
1293                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1294         }
1295         bd->tx_used_start = idx;
1296
1297         ifp->if_timer = bd->tx_used_count == 0 ? 0 : 5;
1298
1299         if (bd->tx_used_count != ACX_TX_DESC_CNT) {
1300                 ifp->if_flags &= ~IFF_OACTIVE;
1301                 acx_start(ifp);
1302         }
1303 }
1304
1305 static void
1306 acx_txerr(struct acx_softc *sc, uint8_t err)
1307 {
1308         struct ifnet *ifp = &sc->sc_ic.ic_if;
1309         struct acx_stats *stats = &sc->sc_stats;
1310
1311         if (err == DESC_ERR_EXCESSIVE_RETRY) {
1312                 /*
1313                  * This a common error (see comment below),
1314                  * so print it using DPRINTF()
1315                  */
1316                 DPRINTF((ifp, "TX failed -- excessive retry\n"));
1317         } else {
1318                 if_printf(ifp, "TX failed -- ");
1319         }
1320
1321         /*
1322          * Although `err' looks like bitmask, it never
1323          * has multiple bits set.
1324          */
1325         switch (err) {
1326 #if 0
1327         case DESC_ERR_OTHER_FRAG:
1328                 /* XXX what's this */
1329                 printf("error in other fragment\n");
1330                 stats->err_oth_frag++;
1331                 break;
1332 #endif
1333         case DESC_ERR_ABORT:
1334                 printf("aborted\n");
1335                 stats->err_abort++;
1336                 break;
1337         case DESC_ERR_PARAM:
1338                 printf("wrong paramters in descriptor\n");
1339                 stats->err_param++;
1340                 break;
1341         case DESC_ERR_NO_WEPKEY:
1342                 printf("WEP key missing\n");
1343                 stats->err_no_wepkey++;
1344                 break;
1345         case DESC_ERR_MSDU_TIMEOUT:
1346                 printf("MSDU life timeout\n");
1347                 stats->err_msdu_timeout++;
1348                 break;
1349         case DESC_ERR_EXCESSIVE_RETRY:
1350                 /*
1351                  * Possible causes:
1352                  * 1) Distance is too long
1353                  * 2) Transmit failed (e.g. no MAC level ACK)
1354                  * 3) Chip overheated (this should be rare)
1355                  */
1356                 stats->err_ex_retry++;
1357                 break;
1358         case DESC_ERR_BUF_OVERFLOW:
1359                 printf("buffer overflow\n");
1360                 stats->err_buf_oflow++;
1361                 break;
1362         case DESC_ERR_DMA:
1363                 printf("DMA error\n");
1364                 stats->err_dma++;
1365                 break;
1366         default:
1367                 printf("unknown error %d\n", err);
1368                 stats->err_unkn++;
1369                 break;
1370         }
1371 }
1372
1373 static void
1374 acx_rxeof(struct acx_softc *sc)
1375 {
1376         struct ieee80211com *ic = &sc->sc_ic;
1377         struct acx_ring_data *rd = &sc->sc_ring_data;
1378         struct acx_buf_data *bd = &sc->sc_buf_data;
1379         struct ifnet *ifp = &ic->ic_if;
1380         int idx, ready;
1381
1382         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1383
1384         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1385                         BUS_DMASYNC_POSTREAD);
1386
1387         /*
1388          * Locate first "ready" rx buffer,
1389          * start from last stopped position
1390          */
1391         idx = bd->rx_scan_start;
1392         ready = 0;
1393         do {
1394                 struct acx_rxbuf *buf;
1395
1396                 buf = &bd->rx_buf[idx];
1397                 if ((buf->rb_desc->h_ctrl & htole16(DESC_CTRL_HOSTOWN)) &&
1398                     (buf->rb_desc->h_status & htole32(DESC_STATUS_FULL))) {
1399                         ready = 1;
1400                         break;
1401                 }
1402                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1403         } while (idx != bd->rx_scan_start);
1404
1405         if (!ready)
1406                 return;
1407
1408         /*
1409          * NOTE: don't mess up `idx' here, it will
1410          * be used in the following code
1411          */
1412
1413         do {
1414                 struct acx_rxbuf_hdr *head;
1415                 struct acx_rxbuf *buf;
1416                 struct mbuf *m;
1417                 uint32_t desc_status;
1418                 uint16_t desc_ctrl;
1419                 int len, error;
1420
1421                 buf = &bd->rx_buf[idx];
1422
1423                 desc_ctrl = le16toh(buf->rb_desc->h_ctrl);
1424                 desc_status = le32toh(buf->rb_desc->h_status);
1425                 if (!(desc_ctrl & DESC_CTRL_HOSTOWN) ||
1426                     !(desc_status & DESC_STATUS_FULL))
1427                         break;
1428
1429                 bus_dmamap_sync(bd->mbuf_dma_tag, buf->rb_mbuf_dmamap,
1430                                 BUS_DMASYNC_POSTREAD);
1431
1432                 m = buf->rb_mbuf;
1433
1434                 error = acx_newbuf(sc, buf, 0);
1435                 if (error) {
1436                         ifp->if_ierrors++;
1437                         goto next;
1438                 }
1439
1440                 head = mtod(m, struct acx_rxbuf_hdr *);
1441
1442                 len = le16toh(head->rbh_len) & ACX_RXBUF_LEN_MASK;
1443                 if (len >= sizeof(struct ieee80211_frame_min) &&
1444                     len < MCLBYTES) {
1445                         struct ieee80211_frame *f;
1446                         struct ieee80211_node *ni;
1447
1448                         m_adj(m, sizeof(struct acx_rxbuf_hdr) +
1449                                  sc->chip_rxbuf_exhdr);
1450                         f = mtod(m, struct ieee80211_frame *);
1451
1452                         if ((f->i_fc[1] & IEEE80211_FC1_WEP) &&
1453                             sc->chip_hw_crypt) {
1454                                 /* Short circuit software WEP */
1455                                 f->i_fc[1] &= ~IEEE80211_FC1_WEP;
1456
1457                                 /* Do chip specific RX buffer processing */
1458                                 if (sc->chip_proc_wep_rxbuf != NULL) {
1459                                         sc->chip_proc_wep_rxbuf(sc, m, &len);
1460                                         f = mtod(m, struct ieee80211_frame *);
1461                                 }
1462                         }
1463
1464                         ni = ieee80211_find_rxnode(ic,
1465                                 (struct ieee80211_frame_min *)f);
1466
1467                         m->m_len = m->m_pkthdr.len = len;
1468                         m->m_pkthdr.rcvif = &ic->ic_if;
1469
1470                         ieee80211_input(ic, m, ni, head->rbh_level,
1471                                         le32toh(head->rbh_time));
1472
1473                         ieee80211_free_node(ni);
1474                         ifp->if_ipackets++;
1475                 } else {
1476                         m_freem(m);
1477                         ifp->if_ierrors++;
1478                 }
1479
1480 next:
1481                 buf->rb_desc->h_ctrl = htole16(desc_ctrl & ~DESC_CTRL_HOSTOWN);
1482                 buf->rb_desc->h_status = 0;
1483                 bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1484                                 BUS_DMASYNC_PREWRITE);
1485
1486                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1487         } while (idx != bd->rx_scan_start);
1488
1489         /*
1490          * Record the position so that next
1491          * time we can start from it
1492          */
1493         bd->rx_scan_start = idx;
1494 }
1495
1496 static int
1497 acx_reset(struct acx_softc *sc)
1498 {
1499         uint16_t reg;
1500
1501         /* Halt ECPU */
1502         CSR_SETB_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_HALT);
1503
1504         /* Software reset */
1505         reg = CSR_READ_2(sc, ACXREG_SOFT_RESET);
1506         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg | ACXRV_SOFT_RESET);
1507         DELAY(100);
1508         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg);
1509
1510         /* Initialize EEPROM */
1511         CSR_SETB_2(sc, ACXREG_EEPROM_INIT, ACXRV_EEPROM_INIT);
1512         DELAY(50000);
1513
1514         /* Test whether ECPU is stopped */
1515         reg = CSR_READ_2(sc, ACXREG_ECPU_CTRL);
1516         if (!(reg & ACXRV_ECPU_HALT)) {
1517                 if_printf(&sc->sc_ic.ic_if, "can't halt ECPU\n");
1518                 return ENXIO;
1519         }
1520         return 0;
1521 }
1522
1523 static int
1524 acx_read_eeprom(struct acx_softc *sc, uint32_t offset, uint8_t *val)
1525 {
1526         int i;
1527
1528         CSR_WRITE_4(sc, ACXREG_EEPROM_CONF, 0);
1529         CSR_WRITE_4(sc, ACXREG_EEPROM_ADDR, offset);
1530         CSR_WRITE_4(sc, ACXREG_EEPROM_CTRL, ACXRV_EEPROM_READ);
1531
1532 #define EE_READ_RETRY_MAX       100
1533         for (i = 0; i < EE_READ_RETRY_MAX; ++i) {
1534                 if (CSR_READ_2(sc, ACXREG_EEPROM_CTRL) == 0)
1535                         break;
1536                 DELAY(10000);
1537         }
1538         if (i == EE_READ_RETRY_MAX) {
1539                 if_printf(&sc->sc_ic.ic_if, "can't read EEPROM offset %x "
1540                           "(timeout)\n", offset);
1541                 return ETIMEDOUT;
1542         }
1543 #undef EE_READ_RETRY_MAX
1544
1545         *val = CSR_READ_1(sc, ACXREG_EEPROM_DATA);
1546         return 0;
1547 }
1548
1549 static int
1550 acx_read_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t *val)
1551 {
1552         int i;
1553
1554         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1555         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_READ);
1556
1557 #define PHY_READ_RETRY_MAX      100
1558         for (i = 0; i < PHY_READ_RETRY_MAX; ++i) {
1559                 if (CSR_READ_4(sc, ACXREG_PHY_CTRL) == 0)
1560                         break;
1561                 DELAY(10000);
1562         }
1563         if (i == PHY_READ_RETRY_MAX) {
1564                 if_printf(&sc->sc_ic.ic_if, "can't read phy reg %x (timeout)\n",
1565                           reg);
1566                 return ETIMEDOUT;
1567         }
1568 #undef PHY_READ_RETRY_MAX
1569
1570         *val = CSR_READ_1(sc, ACXREG_PHY_DATA);
1571         return 0;
1572 }
1573
1574 void
1575 acx_write_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t val)
1576 {
1577         CSR_WRITE_4(sc, ACXREG_PHY_DATA, val);
1578         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1579         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_WRITE);
1580 }
1581
1582 static int
1583 acx_copyin_firmware(struct acx_softc *sc, struct ifreq *req)
1584 {
1585         struct acx_firmware ufw, *kfw;
1586         uint8_t *base_fw, *radio_fw;
1587         int error;
1588
1589         kfw = &sc->sc_firmware;
1590         base_fw = NULL;
1591         radio_fw = NULL;
1592
1593         error = copyin(req->ifr_data, &ufw, sizeof(ufw));
1594         if (error)
1595                 return error;
1596
1597         /*
1598          * For combined base firmware, there is no radio firmware.
1599          * But base firmware must exist.
1600          */
1601         if (ufw.base_fw_len <= 0 || ufw.radio_fw_len < 0)
1602                 return EINVAL;
1603
1604         base_fw = malloc(ufw.base_fw_len, M_DEVBUF, M_INTWAIT);
1605         error = copyin(ufw.base_fw, base_fw, ufw.base_fw_len);
1606         if (error)
1607                 goto fail;
1608
1609         if (ufw.radio_fw_len > 0) {
1610                 radio_fw = malloc(ufw.radio_fw_len, M_DEVBUF, M_INTWAIT);
1611                 error = copyin(ufw.radio_fw, radio_fw, ufw.radio_fw_len);
1612                 if (error)
1613                         goto fail;
1614         }
1615
1616         kfw->base_fw_len = ufw.base_fw_len;
1617         if (kfw->base_fw != NULL)
1618                 free(kfw->base_fw, M_DEVBUF);
1619         kfw->base_fw = base_fw;
1620
1621         kfw->radio_fw_len = ufw.radio_fw_len;
1622         if (kfw->radio_fw != NULL)
1623                 free(kfw->radio_fw, M_DEVBUF);
1624         kfw->radio_fw = radio_fw;
1625
1626         return 0;
1627 fail:
1628         if (base_fw != NULL)
1629                 free(base_fw, M_DEVBUF);
1630         if (radio_fw != NULL)
1631                 free(radio_fw, M_DEVBUF);
1632         return error;
1633 }
1634
1635 static void
1636 acx_free_firmware(struct acx_softc *sc)
1637 {
1638         struct acx_firmware *fw = &sc->sc_firmware;
1639
1640         if (fw->base_fw != NULL) {
1641                 free(fw->base_fw, M_DEVBUF);
1642                 fw->base_fw = NULL;
1643                 fw->base_fw_len = 0;
1644         }
1645         if (fw->radio_fw != NULL) {
1646                 free(fw->radio_fw, M_DEVBUF);
1647                 fw->radio_fw = NULL;
1648                 fw->radio_fw_len = 0;
1649         }
1650 }
1651
1652 static int
1653 acx_load_base_firmware(struct acx_softc *sc, const uint8_t *base_fw,
1654                        uint32_t base_fw_len)
1655 {
1656         int i, error;
1657
1658         /* Load base firmware */
1659         error = acx_load_firmware(sc, 0, base_fw, base_fw_len);
1660         if (error) {
1661                 if_printf(&sc->sc_ic.ic_if, "can't load base firmware\n");
1662                 return error;
1663         }
1664         DPRINTF((&sc->sc_ic.ic_if, "base firmware loaded\n"));
1665
1666         /* Start ECPU */
1667         CSR_WRITE_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_START);
1668
1669         /* Wait for ECPU to be up */
1670         for (i = 0; i < 500; ++i) {
1671                 uint16_t reg;
1672
1673                 reg = CSR_READ_2(sc, ACXREG_INTR_STATUS);
1674                 if (reg & ACXRV_INTR_FCS_THRESH) {
1675                         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_FCS_THRESH);
1676                         return 0;
1677                 }
1678                 DELAY(10000);
1679         }
1680
1681         if_printf(&sc->sc_ic.ic_if, "can't initialize ECPU (timeout)\n");
1682         return ENXIO;
1683 }
1684
1685 static int
1686 acx_load_radio_firmware(struct acx_softc *sc, const uint8_t *radio_fw,
1687                         uint32_t radio_fw_len)
1688 {
1689         struct acx_conf_mmap mem_map;
1690         uint32_t radio_fw_ofs;
1691         int error;
1692
1693         /*
1694          * Get the position, where base firmware is loaded, so that
1695          * radio firmware can be loaded after it.
1696          */
1697         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1698                 return ENXIO;
1699         radio_fw_ofs = le32toh(mem_map.code_end);
1700
1701         /* Put ECPU into sleeping state, before loading radio firmware */
1702         if (acx_sleep(sc) != 0)
1703                 return ENXIO;
1704
1705         /* Load radio firmware */
1706         error = acx_load_firmware(sc, radio_fw_ofs, radio_fw, radio_fw_len);
1707         if (error) {
1708                 if_printf(&sc->sc_ic.ic_if, "can't load radio firmware\n");
1709                 return ENXIO;
1710         }
1711         DPRINTF((&sc->sc_ic.ic_if, "radio firmware loaded\n"));
1712
1713         /* Wake up sleeping ECPU, after radio firmware is loaded */
1714         if (acx_wakeup(sc) != 0)
1715                 return ENXIO;
1716
1717         /* Initialize radio */
1718         if (acx_init_radio(sc, radio_fw_ofs, radio_fw_len) != 0)
1719                 return ENXIO;
1720
1721         /* Verify radio firmware's loading position */
1722         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1723                 return ENXIO;
1724         if (le32toh(mem_map.code_end) != radio_fw_ofs + radio_fw_len) {
1725                 if_printf(&sc->sc_ic.ic_if, "loaded radio firmware position "
1726                           "mismatch\n");
1727                 return ENXIO;
1728         }
1729
1730         DPRINTF((&sc->sc_ic.ic_if, "radio firmware initialized\n"));
1731         return 0;
1732 }
1733
1734 static int
1735 acx_load_firmware(struct acx_softc *sc, uint32_t offset, const uint8_t *data,
1736                   int data_len)
1737 {
1738         const uint32_t *fw;
1739         int i, fw_len;
1740
1741         fw = (const uint32_t *)data;
1742         fw_len = data_len / sizeof(uint32_t);
1743
1744         /*
1745          * LOADFW_AUTO_INC only works with some older firmware:
1746          * 1) acx100's firmware
1747          * 2) acx111's firmware whose rev is 0x00010011
1748          */
1749
1750         /* Load firmware */
1751         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1752 #ifndef LOADFW_AUTO_INC
1753         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1754 #else
1755         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1756         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1757 #endif
1758
1759         for (i = 0; i < fw_len; ++i) {
1760 #ifndef LOADFW_AUTO_INC
1761                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1762 #endif
1763                 CSR_WRITE_4(sc, ACXREG_FWMEM_DATA, be32toh(fw[i]));
1764         }
1765
1766         /* Verify firmware */
1767         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1768 #ifndef LOADFW_AUTO_INC
1769         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1770 #else
1771         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1772         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1773 #endif
1774
1775         for (i = 0; i < fw_len; ++i) {
1776                 uint32_t val;
1777
1778 #ifndef LOADFW_AUTO_INC
1779                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1780 #endif
1781                 val = CSR_READ_4(sc, ACXREG_FWMEM_DATA);
1782                 if (be32toh(fw[i]) != val) {
1783                         if_printf(&sc->sc_ic.ic_if, "fireware mismatch "
1784                                   "fw %08x  loaded %08x\n", fw[i], val);
1785                         return ENXIO;
1786                 }
1787         }
1788         return 0;
1789 }
1790
1791 static int
1792 acx_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1793 {
1794         struct acx_softc *sc = ic->ic_if.if_softc;
1795         int error = 0, mode = 0;
1796
1797         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1798
1799         ieee80211_ratectl_newstate(ic, nstate);
1800
1801         switch (nstate) {
1802         case IEEE80211_S_SCAN:
1803                 if (ic->ic_state != IEEE80211_S_INIT) {
1804                         uint8_t chan;
1805
1806                         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1807                         ACX_ENABLE_TXCHAN(sc, chan);
1808                         ACX_ENABLE_RXCHAN(sc, chan);
1809
1810                         callout_reset(&sc->sc_chanscan_timer,
1811                                       hz / acx_chanscan_rate,
1812                                       acx_next_scan, sc);
1813                 }
1814                 break;
1815         case IEEE80211_S_AUTH:
1816                 if (ic->ic_opmode == IEEE80211_M_STA) {
1817                         struct ieee80211_node *ni;
1818 #ifdef ACX_DEBUG
1819                         int i;
1820 #endif
1821
1822                         ni = ic->ic_bss;
1823
1824                         if (acx_join_bss(sc, ACX_MODE_STA, ni) != 0) {
1825                                 if_printf(&ic->ic_if, "join BSS failed\n");
1826                                 error = 1;
1827                                 goto back;
1828                         }
1829
1830                         DPRINTF((&ic->ic_if, "join BSS\n"));
1831                         if (ic->ic_state == IEEE80211_S_ASSOC) {
1832                                 DPRINTF((&ic->ic_if,
1833                                          "change from assoc to run\n"));
1834                                 ic->ic_state = IEEE80211_S_RUN;
1835                         }
1836
1837 #ifdef ACX_DEBUG
1838                         if_printf(&ic->ic_if, "AP rates: ");
1839                         for (i = 0; i < ni->ni_rates.rs_nrates; ++i)
1840                                 printf("%d ", ni->ni_rates.rs_rates[i]);
1841                         ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
1842                         printf(" %6D\n", ni->ni_bssid, ":");
1843 #endif
1844                 }
1845                 break;
1846         case IEEE80211_S_RUN:
1847                 if (ic->ic_opmode == IEEE80211_M_IBSS ||
1848                     ic->ic_opmode == IEEE80211_M_HOSTAP) {
1849                         struct ieee80211_node *ni;
1850                         uint8_t chan;
1851
1852                         ni = ic->ic_bss;
1853                         chan = ieee80211_chan2ieee(ic, ni->ni_chan);
1854
1855                         error = 1;
1856
1857                         if (acx_enable_txchan(sc, chan) != 0) {
1858                                 if_printf(&ic->ic_if,
1859                                           "enable TX on channel %d failed\n",
1860                                           chan);
1861                                 goto back;
1862                         }
1863
1864                         if (acx_enable_rxchan(sc, chan) != 0) {
1865                                 if_printf(&ic->ic_if,
1866                                           "enable RX on channel %d failed\n",
1867                                           chan);
1868                                 goto back;
1869                         }
1870
1871                         if (acx_set_beacon_tmplt(sc, ni) != 0) {
1872                                 if_printf(&ic->ic_if,
1873                                           "set bescon template failed\n");
1874                                 goto back;
1875                         }
1876
1877                         if (acx_set_probe_resp_tmplt(sc, ni) != 0) {
1878                                 if_printf(&ic->ic_if, "set probe response "
1879                                           "template failed\n");
1880                                 goto back;
1881                         }
1882
1883                         if (ic->ic_opmode == IEEE80211_M_IBSS)
1884                                 mode = ACX_MODE_ADHOC;
1885                         else
1886                                 mode = ACX_MODE_AP;
1887
1888                         if (acx_join_bss(sc, mode, ni) != 0) {
1889                                 if_printf(&ic->ic_if, "acx_join_ibss failed\n");
1890                                 goto back;
1891                         }
1892
1893                         DPRINTF((&ic->ic_if, "join IBSS\n"));
1894                         error = 0;
1895                 }
1896                 break;
1897         default:
1898                 break;
1899         }
1900
1901 back:
1902         if (error) {
1903                 /* XXX */
1904                 nstate = IEEE80211_S_INIT;
1905                 arg = -1;
1906         }
1907         return sc->sc_newstate(ic, nstate, arg);
1908 }
1909
1910 int
1911 acx_init_tmplt_ordered(struct acx_softc *sc)
1912 {
1913 #define INIT_TMPLT(name)                        \
1914 do {                                            \
1915         if (acx_init_##name##_tmplt(sc) != 0)   \
1916                 return 1;                       \
1917 } while (0)
1918
1919         /*
1920          * NOTE:
1921          * Order of templates initialization:
1922          * 1) Probe request
1923          * 2) NULL data
1924          * 3) Beacon
1925          * 4) TIM
1926          * 5) Probe response
1927          * Above order is critical to get a correct memory map.
1928          */
1929         INIT_TMPLT(probe_req);
1930         INIT_TMPLT(null_data);
1931         INIT_TMPLT(beacon);
1932         INIT_TMPLT(tim);
1933         INIT_TMPLT(probe_resp);
1934
1935 #undef CALL_SET_TMPLT
1936         return 0;
1937 }
1938
1939 static void
1940 acx_ring_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
1941 {
1942         *((uint32_t *)arg) = seg->ds_addr;
1943 }
1944
1945 static int
1946 acx_dma_alloc(struct acx_softc *sc)
1947 {
1948         struct acx_ring_data *rd = &sc->sc_ring_data;
1949         struct acx_buf_data *bd = &sc->sc_buf_data;
1950         int i, error;
1951
1952         /* Allocate DMA stuffs for RX descriptors  */
1953         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
1954                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
1955                                    NULL, NULL,
1956                                    ACX_RX_RING_SIZE, 1, ACX_RX_RING_SIZE,
1957                                    0, &rd->rx_ring_dma_tag);
1958         if (error) {
1959                 if_printf(&sc->sc_ic.ic_if, "can't create rx ring dma tag\n");
1960                 return error;
1961         }
1962
1963         error = bus_dmamem_alloc(rd->rx_ring_dma_tag, (void **)&rd->rx_ring,
1964                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
1965                                  &rd->rx_ring_dmamap);
1966         if (error) {
1967                 if_printf(&sc->sc_ic.ic_if,
1968                           "can't allocate rx ring dma memory\n");
1969                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
1970                 rd->rx_ring_dma_tag = NULL;
1971                 return error;
1972         }
1973
1974         error = bus_dmamap_load(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1975                                 rd->rx_ring, ACX_RX_RING_SIZE,
1976                                 acx_ring_dma_addr, &rd->rx_ring_paddr,
1977                                 BUS_DMA_WAITOK);
1978         if (error) {
1979                 if_printf(&sc->sc_ic.ic_if, "can't get rx ring dma address\n");
1980                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
1981                                 rd->rx_ring_dmamap);
1982                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
1983                 rd->rx_ring_dma_tag = NULL;
1984                 return error;
1985         }
1986
1987         /* Allocate DMA stuffs for TX descriptors */
1988         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
1989                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
1990                                    NULL, NULL,
1991                                    ACX_TX_RING_SIZE, 1, ACX_TX_RING_SIZE,
1992                                    0, &rd->tx_ring_dma_tag);
1993         if (error) {
1994                 if_printf(&sc->sc_ic.ic_if, "can't create tx ring dma tag\n");
1995                 return error;
1996         }
1997
1998         error = bus_dmamem_alloc(rd->tx_ring_dma_tag, (void **)&rd->tx_ring,
1999                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
2000                                  &rd->tx_ring_dmamap);
2001         if (error) {
2002                 if_printf(&sc->sc_ic.ic_if,
2003                           "can't allocate tx ring dma memory\n");
2004                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2005                 rd->tx_ring_dma_tag = NULL;
2006                 return error;
2007         }
2008
2009         error = bus_dmamap_load(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2010                                 rd->tx_ring, ACX_TX_RING_SIZE,
2011                                 acx_ring_dma_addr, &rd->tx_ring_paddr,
2012                                 BUS_DMA_WAITOK);
2013         if (error) {
2014                 if_printf(&sc->sc_ic.ic_if, "can't get tx ring dma address\n");
2015                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2016                                 rd->tx_ring_dmamap);
2017                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2018                 rd->tx_ring_dma_tag = NULL;
2019                 return error;
2020         }
2021
2022         /* Create DMA tag for RX/TX mbuf map */
2023         error = bus_dma_tag_create(NULL, 1, 0,
2024                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2025                                    NULL, NULL,
2026                                    MCLBYTES, 1, MCLBYTES,
2027                                    0, &bd->mbuf_dma_tag);
2028         if (error) {
2029                 if_printf(&sc->sc_ic.ic_if, "can't create mbuf dma tag\n");
2030                 return error;
2031         }
2032
2033         /* Create a spare RX DMA map */
2034         error = bus_dmamap_create(bd->mbuf_dma_tag, 0, &bd->mbuf_tmp_dmamap);
2035         if (error) {
2036                 if_printf(&sc->sc_ic.ic_if, "can't create tmp mbuf dma map\n");
2037                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2038                 bd->mbuf_dma_tag = NULL;
2039                 return error;
2040         }
2041
2042         /* Create DMA map for RX mbufs */
2043         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2044                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2045                                           &bd->rx_buf[i].rb_mbuf_dmamap);
2046                 if (error) {
2047                         if_printf(&sc->sc_ic.ic_if, "can't create rx mbuf "
2048                                   "dma map (%d)\n", i);
2049                         return error;
2050                 }
2051                 bd->rx_buf[i].rb_desc = &rd->rx_ring[i];
2052         }
2053
2054         /* Create DMA map for TX mbufs */
2055         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2056                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2057                                           &bd->tx_buf[i].tb_mbuf_dmamap);
2058                 if (error) {
2059                         if_printf(&sc->sc_ic.ic_if, "can't create tx mbuf "
2060                                   "dma map (%d)\n", i);
2061                         return error;
2062                 }
2063                 bd->tx_buf[i].tb_desc1 = &rd->tx_ring[i * 2];
2064                 bd->tx_buf[i].tb_desc2 = &rd->tx_ring[(i * 2) + 1];
2065         }
2066
2067         return 0;
2068 }
2069
2070 static void
2071 acx_dma_free(struct acx_softc *sc)
2072 {
2073         struct acx_ring_data *rd = &sc->sc_ring_data;
2074         struct acx_buf_data *bd = &sc->sc_buf_data;
2075         int i;
2076
2077         if (rd->rx_ring_dma_tag != NULL) {
2078                 bus_dmamap_unload(rd->rx_ring_dma_tag, rd->rx_ring_dmamap);
2079                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2080                                 rd->rx_ring_dmamap);
2081                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2082         }
2083
2084         if (rd->tx_ring_dma_tag != NULL) {
2085                 bus_dmamap_unload(rd->tx_ring_dma_tag, rd->tx_ring_dmamap);
2086                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2087                                 rd->tx_ring_dmamap);
2088                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2089         }
2090
2091         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2092                 if (bd->rx_buf[i].rb_desc != NULL) {
2093                         if (bd->rx_buf[i].rb_mbuf != NULL) {
2094                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2095                                                   bd->rx_buf[i].rb_mbuf_dmamap);
2096                                 m_freem(bd->rx_buf[i].rb_mbuf);
2097                         }
2098                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2099                                            bd->rx_buf[i].rb_mbuf_dmamap);
2100                 }
2101         }
2102
2103         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2104                 if (bd->tx_buf[i].tb_desc1 != NULL) {
2105                         if (bd->tx_buf[i].tb_mbuf != NULL) {
2106                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2107                                                   bd->tx_buf[i].tb_mbuf_dmamap);
2108                                 m_freem(bd->tx_buf[i].tb_mbuf);
2109                         }
2110                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2111                                            bd->tx_buf[i].tb_mbuf_dmamap);
2112                 }
2113         }
2114
2115         if (bd->mbuf_dma_tag != NULL) {
2116                 bus_dmamap_destroy(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap);
2117                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2118         }
2119 }
2120
2121 static int
2122 acx_init_tx_ring(struct acx_softc *sc)
2123 {
2124         struct acx_ring_data *rd;
2125         struct acx_buf_data *bd;
2126         uint32_t paddr;
2127         int i;
2128
2129         rd = &sc->sc_ring_data;
2130         paddr = rd->tx_ring_paddr;
2131         for (i = 0; i < (ACX_TX_DESC_CNT * 2) - 1; ++i) {
2132                 paddr += sizeof(struct acx_host_desc);
2133
2134                 rd->tx_ring[i].h_ctrl = htole16(DESC_CTRL_HOSTOWN);
2135
2136                 if (i == (ACX_TX_DESC_CNT * 2) - 1)
2137                         rd->tx_ring[i].h_next_desc = htole32(rd->tx_ring_paddr);
2138                 else
2139                         rd->tx_ring[i].h_next_desc = htole32(paddr);
2140         }
2141
2142         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2143                         BUS_DMASYNC_PREWRITE);
2144
2145         bd = &sc->sc_buf_data;
2146         bd->tx_free_start = 0;
2147         bd->tx_used_start = 0;
2148         bd->tx_used_count = 0;
2149
2150         return 0;
2151 }
2152
2153 static int
2154 acx_init_rx_ring(struct acx_softc *sc)
2155 {
2156         struct acx_ring_data *rd;
2157         struct acx_buf_data *bd;
2158         uint32_t paddr;
2159         int i;
2160
2161         bd = &sc->sc_buf_data;
2162         rd = &sc->sc_ring_data;
2163         paddr = rd->rx_ring_paddr;
2164
2165         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2166                 int error;
2167
2168                 paddr += sizeof(struct acx_host_desc);
2169
2170                 error = acx_newbuf(sc, &bd->rx_buf[i], 1);
2171                 if (error)
2172                         return error;
2173
2174                 if (i == ACX_RX_DESC_CNT - 1)
2175                         rd->rx_ring[i].h_next_desc = htole32(rd->rx_ring_paddr);
2176                 else
2177                         rd->rx_ring[i].h_next_desc = htole32(paddr);
2178         }
2179
2180         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2181                         BUS_DMASYNC_PREWRITE);
2182
2183         bd->rx_scan_start = 0;
2184         return 0;
2185 }
2186
2187 static void
2188 acx_buf_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg,
2189                  bus_size_t mapsz, int error)
2190 {
2191         if (error)
2192                 return;
2193
2194         /* XXX */
2195         KASSERT(nseg == 1, ("too many RX dma segments\n"));
2196         *((uint32_t *)arg) = seg->ds_addr;
2197 }
2198
2199 static int
2200 acx_newbuf(struct acx_softc *sc, struct acx_rxbuf *rb, int wait)
2201 {
2202         struct acx_buf_data *bd;
2203         struct mbuf *m;
2204         bus_dmamap_t map;
2205         uint32_t paddr;
2206         int error;
2207
2208         bd = &sc->sc_buf_data;
2209
2210         m = m_getcl(wait ? MB_WAIT : MB_DONTWAIT, MT_DATA, M_PKTHDR);
2211         if (m == NULL)
2212                 return ENOBUFS;
2213
2214         m->m_len = m->m_pkthdr.len = MCLBYTES;
2215
2216         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap,
2217                                      m, acx_buf_dma_addr, &paddr,
2218                                      wait ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
2219         if (error) {
2220                 m_freem(m);
2221                 if_printf(&sc->sc_ic.ic_if, "can't map rx mbuf %d\n", error);
2222                 return error;
2223         }
2224
2225         /* Unload originally mapped mbuf */
2226         bus_dmamap_unload(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap);
2227
2228         /* Swap this dmamap with tmp dmamap */
2229         map = rb->rb_mbuf_dmamap;
2230         rb->rb_mbuf_dmamap = bd->mbuf_tmp_dmamap;
2231         bd->mbuf_tmp_dmamap = map;
2232
2233         rb->rb_mbuf = m;
2234         rb->rb_desc->h_data_paddr = htole32(paddr);
2235         rb->rb_desc->h_data_len = htole16(m->m_len);
2236
2237         bus_dmamap_sync(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap,
2238                         BUS_DMASYNC_PREREAD);
2239         return 0;
2240 }
2241
2242 static int
2243 acx_encap(struct acx_softc *sc, struct acx_txbuf *txbuf, struct mbuf *m,
2244           struct ieee80211_node *ni)
2245 {
2246         struct acx_buf_data *bd = &sc->sc_buf_data;
2247         struct acx_ring_data *rd = &sc->sc_ring_data;
2248         uint32_t paddr;
2249         uint8_t ctrl;
2250         int error;
2251
2252         KASSERT(txbuf->tb_mbuf == NULL, ("free TX buf has mbuf installed\n"));
2253         error = 0;
2254
2255         if (m->m_pkthdr.len > MCLBYTES) {
2256                 if_printf(&sc->sc_ic.ic_if, "mbuf too big\n");
2257                 error = E2BIG;
2258                 goto back;
2259         } else if (m->m_pkthdr.len < ACX_FRAME_HDRLEN) {
2260                 if_printf(&sc->sc_ic.ic_if, "mbuf too small\n");
2261                 error = EINVAL;
2262                 goto back;
2263         }
2264
2265         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2266                                      m, acx_buf_dma_addr, &paddr,
2267                                      BUS_DMA_NOWAIT);
2268         if (error && error != EFBIG) {
2269                 if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf1 %d\n", error);
2270                 goto back;
2271         }
2272
2273         if (error) {    /* error == EFBIG */
2274                 struct mbuf *m_new;
2275
2276                 m_new = m_defrag(m, MB_DONTWAIT);
2277                 if (m_new == NULL) {
2278                         if_printf(&sc->sc_ic.ic_if, "can't defrag tx mbuf\n");
2279                         error = ENOBUFS;
2280                         goto back;
2281                 } else {
2282                         m = m_new;
2283                 }
2284
2285                 error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag,
2286                                              txbuf->tb_mbuf_dmamap, m,
2287                                              acx_buf_dma_addr, &paddr,
2288                                              BUS_DMA_NOWAIT);
2289                 if (error) {
2290                         if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf2 %d\n",
2291                                   error);
2292                         goto back;
2293                 }
2294         }
2295
2296         error = 0;
2297
2298         bus_dmamap_sync(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2299                         BUS_DMASYNC_PREWRITE);
2300
2301         txbuf->tb_mbuf = m;
2302         txbuf->tb_node = ni;
2303
2304         /*
2305          * TX buffers are accessed in following way:
2306          * acx_fw_txdesc -> acx_host_desc -> buffer
2307          *
2308          * It is quite strange that acx also querys acx_host_desc next to
2309          * the one we have assigned to acx_fw_txdesc even if first one's
2310          * acx_host_desc.h_data_len == acx_fw_txdesc.f_tx_len
2311          *
2312          * So we allocate two acx_host_desc for one acx_fw_txdesc and
2313          * assign the first acx_host_desc to acx_fw_txdesc
2314          *
2315          * For acx111
2316          * host_desc1.h_data_len = buffer_len
2317          * host_desc2.h_data_len = buffer_len - mac_header_len
2318          *
2319          * For acx100
2320          * host_desc1.h_data_len = mac_header_len
2321          * host_desc2.h_data_len = buffer_len - mac_header_len
2322          */
2323
2324         txbuf->tb_desc1->h_data_paddr = htole32(paddr);
2325         txbuf->tb_desc2->h_data_paddr = htole32(paddr + ACX_FRAME_HDRLEN);
2326
2327         txbuf->tb_desc1->h_data_len =
2328                 htole16(sc->chip_txdesc1_len ? sc->chip_txdesc1_len
2329                                              : m->m_pkthdr.len);
2330         txbuf->tb_desc2->h_data_len =
2331                 htole16(m->m_pkthdr.len - ACX_FRAME_HDRLEN);
2332
2333         /*
2334          * NOTE:
2335          * We can't simply assign f_tx_ctrl, we will first read it back
2336          * and change it bit by bit
2337          */
2338         ctrl = FW_TXDESC_GETFIELD_1(sc, txbuf, f_tx_ctrl);
2339         ctrl |= sc->chip_fw_txdesc_ctrl; /* extra chip specific flags */
2340         ctrl &= ~(DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE);
2341
2342         FW_TXDESC_SETFIELD_4(sc, txbuf, f_tx_len, m->m_pkthdr.len);
2343         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_error, 0);
2344         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_data_nretry, 0);
2345         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_nretry, 0);
2346         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_ok, 0);
2347         sc->chip_set_fw_txdesc_rate(sc, txbuf, ni, m->m_pkthdr.len);
2348
2349         txbuf->tb_desc1->h_ctrl = 0;
2350         txbuf->tb_desc2->h_ctrl = 0;
2351         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2352                         BUS_DMASYNC_PREWRITE);
2353
2354         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl2, 0);
2355         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl, ctrl);
2356
2357         /* Tell chip to inform us about TX completion */
2358         CSR_WRITE_2(sc, ACXREG_INTR_TRIG, ACXRV_TRIG_TX_FINI);
2359 back:
2360         if (error)
2361                 m_freem(m);
2362         return error;
2363 }
2364
2365 static int
2366 acx_set_null_tmplt(struct acx_softc *sc)
2367 {
2368         struct acx_tmplt_null_data n;
2369         struct ieee80211_frame *f;
2370
2371         bzero(&n, sizeof(n));
2372
2373         f = &n.data;
2374         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
2375         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2376         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2377         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2378
2379         return _acx_set_null_data_tmplt(sc, &n, sizeof(n));
2380 }
2381
2382 static int
2383 acx_set_probe_req_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len)
2384 {
2385         struct acx_tmplt_probe_req req;
2386         struct ieee80211_frame *f;
2387         uint8_t *v;
2388         int vlen;
2389
2390         bzero(&req, sizeof(req));
2391
2392         f = &req.data.u_data.f;
2393         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
2394         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2395         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2396         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2397
2398         v = req.data.u_data.var;
2399         v = ieee80211_add_ssid(v, ssid, ssid_len);
2400         v = ieee80211_add_rates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2401         v = ieee80211_add_xrates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2402         vlen = v - req.data.u_data.var;
2403
2404         return _acx_set_probe_req_tmplt(sc, &req,
2405                                         ACX_TMPLT_PROBE_REQ_SIZ(vlen));
2406 }
2407
2408 static int
2409 acx_set_probe_resp_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2410 {
2411         struct ieee80211com *ic = &sc->sc_ic;
2412         struct acx_tmplt_probe_resp resp;
2413         struct ieee80211_beacon_offsets bo;
2414         struct mbuf *m;
2415         int len;
2416
2417         bzero(&resp, sizeof(resp));
2418
2419         bzero(&bo, sizeof(bo));
2420         m = ieee80211_beacon_alloc(ic, ni, &bo);
2421         DPRINTF((&ic->ic_if, "%s alloc beacon size %d\n", __func__,
2422                  m->m_pkthdr.len));
2423
2424         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&resp.data);
2425         len = m->m_pkthdr.len + sizeof(resp.size);
2426         m_freem(m);
2427
2428         return _acx_set_probe_resp_tmplt(sc, &resp, len);
2429 }
2430
2431 static int
2432 acx_set_beacon_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2433 {
2434         struct ieee80211com *ic = &sc->sc_ic;
2435         struct acx_tmplt_beacon beacon;
2436         struct ieee80211_beacon_offsets bo;
2437         struct mbuf *m;
2438         int len;
2439
2440         bzero(&beacon, sizeof(beacon));
2441
2442         bzero(&bo, sizeof(bo));
2443         m = ieee80211_beacon_alloc(ic, ni, &bo);
2444         DPRINTF((&ic->ic_if, "%s alloc beacon size %d\n", __func__,
2445                  m->m_pkthdr.len));
2446
2447         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&beacon.data);
2448         len = m->m_pkthdr.len + sizeof(beacon.size);
2449         m_freem(m);
2450
2451         return _acx_set_beacon_tmplt(sc, &beacon, len);
2452 }
2453
2454 static int
2455 acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS)
2456 {
2457         struct acx_softc *sc = arg1;
2458         struct ifnet *ifp = &sc->sc_ic.ic_if;
2459         int error = 0, v;
2460
2461         lwkt_serialize_enter(ifp->if_serializer);
2462
2463         v = sc->sc_msdu_lifetime;
2464         error = sysctl_handle_int(oidp, &v, 0, req);
2465         if (error || req->newptr == NULL)
2466                 goto back;
2467         if (v <= 0) {
2468                 error = EINVAL;
2469                 goto back;
2470         }
2471
2472         if (sc->sc_flags & ACX_FLAG_FW_LOADED) {
2473                 struct acx_conf_msdu_lifetime msdu_lifetime;
2474
2475                 msdu_lifetime.lifetime = htole32(v);
2476                 if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
2477                         if_printf(&sc->sc_ic.ic_if,
2478                                   "can't set MSDU lifetime\n");
2479                         error = ENXIO;
2480                         goto back;
2481                 }
2482         }
2483         sc->sc_msdu_lifetime = v;
2484 back:
2485         lwkt_serialize_exit(ifp->if_serializer);
2486         return error;
2487 }