sys/dev/netif/acx/if_acx.c

   1 /*
   2  * Copyright (c) 2006 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Sepherosa Ziehau <sepherosa@gmail.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  * $DragonFly: src/sys/dev/netif/acx/if_acx.c,v 1.2 2006/05/18 13:51:45 sephe Exp $
  35  */
  36
  37 /*
  38  * Copyright (c) 2003-2004 wlan.kewl.org Project
  39  * All rights reserved.
  40  *
  41  * $Id: LICENSE,v 1.1.1.1 2004/07/01 12:20:39 darron Exp $
  42  *
  43  * Redistribution and use in source and binary forms, with or without
  44  * modification, are permitted provided that the following conditions
  45  * are met:
  46  *
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  *
  50  * 2. Redistributions in binary form must reproduce the above copyright
  51  *    notice, this list of conditions and the following disclaimer in the
  52  *    documentation and/or other materials provided with the distribution.
  53  *
  54  * 3. All advertising materials mentioning features or use of this software
  55  *    must display the following acknowledgement:
  56  *
  57  *    This product includes software developed by the wlan.kewl.org Project.
  58  *
  59  * 4. Neither the name of the wlan.kewl.org Project nor the names of its
  60  *    contributors may be used to endorse or promote products derived from
  61  *    this software without specific prior written permission.
  62  *
  63  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  64  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
  65  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
  66  * THE wlan.kewl.org Project BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  67  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  68  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  69  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  70  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  71  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  72  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  73  */
  74
  75 #include <sys/param.h>
  76 #include <sys/endian.h>
  77 #include <sys/kernel.h>
  78 #include <sys/bus.h>
  79 #include <sys/malloc.h>
  80 #include <sys/proc.h>
  81 #include <sys/rman.h>
  82 #include <sys/serialize.h>
  83 #include <sys/socket.h>
  84 #include <sys/sockio.h>
  85 #include <sys/sysctl.h>
  86
  87 #include <machine/bus.h>
  88 #include <machine/resource.h>
  89
  90 #include <net/ethernet.h>
  91 #include <net/if.h>
  92 #include <net/bpf.h>
  93 #include <net/if_arp.h>
  94 #include <net/if_dl.h>
  95 #include <net/if_media.h>
  96 #include <net/ifq_var.h>
  97
  98 #include <netproto/802_11/ieee80211_var.h>
  99
 100 #include <bus/pci/pcireg.h>
 101 #include <bus/pci/pcivar.h>
 102 #include <bus/pci/pcidevs.h>
 103
 104 #define ACX_DEBUG
 105
 106 #include "if_acxreg.h"
 107 #include "if_acxvar.h"
 108 #include "acxcmd.h"
 109
 110 #define ACX_ENABLE_TXCHAN(sc, chan)                                     \
 111 do {                                                                    \
 112         if (acx_enable_txchan((sc), (chan)) != 0) {                     \
 113                 if_printf(&(sc)->sc_ic.ic_if,                           \
 114                           "enable TX on channel %d failed\n", (chan));  \
 115         }                                                               \
 116 } while (0)
 117
 118 #define ACX_ENABLE_RXCHAN(sc, chan)                                     \
 119 do {                                                                    \
 120         if (acx_enable_rxchan((sc), (chan)) != 0) {                     \
 121                 if_printf(&(sc)->sc_ic.ic_if,                           \
 122                           "enable RX on channel %d failed\n", (chan));  \
 123         }                                                               \
 124 } while (0)
 125
 126 #define SIOCSLOADFW     _IOW('i', 137, struct ifreq)    /* load firmware */
 127 #define SIOCGRADIO      _IOW('i', 138, struct ifreq)    /* get radio type */
 128 #define SIOCGSTATS      _IOW('i', 139, struct ifreq)    /* get acx stats */
 129 #define SIOCSKILLFW     _IOW('i', 140, struct ifreq)    /* free firmware */
 130 #define SIOCGFWVER      _IOW('i', 141, struct ifreq)    /* get firmware ver */
 131 #define SIOCGHWID       _IOW('i', 142, struct ifreq)    /* get hardware id */
 132
 133 static int      acx_probe(device_t);
 134 static int      acx_attach(device_t);
 135 static int      acx_detach(device_t);
 136 static int      acx_shutdown(device_t);
 137
 138 static void     acx_init(void *);
 139 static int      acx_stop(struct acx_softc *);
 140 static void     acx_init_info_reg(struct acx_softc *);
 141 static int      acx_config(struct acx_softc *);
 142 static int      acx_read_config(struct acx_softc *, struct acx_config *);
 143 static int      acx_write_config(struct acx_softc *, struct acx_config *);
 144 static int      acx_set_wepkeys(struct acx_softc *);
 145 #ifdef foo
 146 static void     acx_begin_scan(struct acx_softc *);
 147 #endif
 148 static void     acx_next_scan(void *);
 149
 150 static void     acx_start(struct ifnet *);
 151 static void     acx_watchdog(struct ifnet *);
 152
 153 static int      acx_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 154
 155 static void     acx_intr(void *);
 156 static void     acx_disable_intr(struct acx_softc *);
 157 static void     acx_enable_intr(struct acx_softc *);
 158 static void     acx_txeof(struct acx_softc *);
 159 static void     acx_txerr(struct acx_softc *, uint8_t);
 160 static void     acx_rxeof(struct acx_softc *);
 161
 162 static int      acx_dma_alloc(struct acx_softc *);
 163 static void     acx_dma_free(struct acx_softc *);
 164 static int      acx_init_tx_ring(struct acx_softc *);
 165 static int      acx_init_rx_ring(struct acx_softc *);
 166 static int      acx_newbuf(struct acx_softc *, struct acx_rxbuf *, int);
 167 static int      acx_encap(struct acx_softc *, struct acx_txbuf *,
 168                           struct mbuf *, struct ieee80211_node *, int);
 169
 170 static int      acx_reset(struct acx_softc *);
 171
 172 static int      acx_set_null_tmplt(struct acx_softc *);
 173 static int      acx_set_probe_req_tmplt(struct acx_softc *, const char *, int);
 174 static int      acx_set_probe_resp_tmplt(struct acx_softc *, const char *, int,
 175                                          int);
 176 static int      acx_set_beacon_tmplt(struct acx_softc *, const char *, int,
 177                                      int);
 178
 179 static int      acx_read_eeprom(struct acx_softc *, uint32_t, uint8_t *);
 180 static int      acx_read_phyreg(struct acx_softc *, uint32_t, uint8_t *);
 181
 182 static int      acx_copyin_firmware(struct acx_softc *, struct ifreq *);
 183 static void     acx_free_firmware(struct acx_softc *);
 184 static int      acx_load_firmware(struct acx_softc *, uint32_t,
 185                                   const uint8_t *, int);
 186 static int      acx_load_radio_firmware(struct acx_softc *, const uint8_t *,
 187                                         uint32_t);
 188 static int      acx_load_base_firmware(struct acx_softc *, const uint8_t *,
 189                                        uint32_t);
 190
 191 static struct ieee80211_node *acx_node_alloc(struct ieee80211_node_table *);
 192 static void     acx_node_init(struct acx_softc *, struct acx_node *);
 193 static void     acx_node_update(struct acx_softc *, struct acx_node *,
 194                                 uint8_t, uint8_t);
 195 static int      acx_newstate(struct ieee80211com *, enum ieee80211_state, int);
 196
 197 static int      acx_sysctl_txrate_upd_intvl_min(SYSCTL_HANDLER_ARGS);
 198 static int      acx_sysctl_txrate_upd_intvl_max(SYSCTL_HANDLER_ARGS);
 199 static int      acx_sysctl_txrate_sample_thresh(SYSCTL_HANDLER_ARGS);
 200 static int      acx_sysctl_long_retry_limit(SYSCTL_HANDLER_ARGS);
 201 static int      acx_sysctl_short_retry_limit(SYSCTL_HANDLER_ARGS);
 202 static int      acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS);
 203
 204 const struct ieee80211_rateset  acx_rates_11b =
 205         { 4, { 2, 4, 11, 22 } };
 206 const struct ieee80211_rateset  acx_rates_11g =
 207         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
 208
 209 static int      acx_chanscan_rate = 5;  /* 5/second */
 210 int             acx_beacon_intvl = 100; /* 100 TU */
 211
 212 static const struct acx_device {
 213         uint16_t        vid;
 214         uint16_t        did;
 215         void            (*set_param)(device_t);
 216         const char      *desc;
 217 } acx_devices[] = {
 218         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100A, acx100_set_param,
 219           "Texas Instruments TNETW1100A Wireless Adapter" },
 220         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100B, acx100_set_param,
 221           "Texas Instruments TNETW1100B Wireless Adapter" },
 222         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX111, acx111_set_param,
 223           "Texas Instruments TNETW1130 Wireless Adapter" },
 224         { 0, 0, NULL, NULL }
 225 };
 226
 227 static device_method_t acx_methods[] = {
 228         DEVMETHOD(device_probe,         acx_probe),
 229         DEVMETHOD(device_attach,        acx_attach),
 230         DEVMETHOD(device_detach,        acx_detach),
 231         DEVMETHOD(device_shutdown,      acx_shutdown),
 232 #if 0
 233         DEVMETHOD(device_suspend,       acx_suspend),
 234         DEVMETHOD(device_resume,        acx_resume),
 235 #endif
 236         { 0, 0 }
 237 };
 238
 239 static driver_t acx_driver = {
 240         "acx",
 241         acx_methods,
 242         sizeof(struct acx_softc)
 243 };
 244
 245 static devclass_t acx_devclass;
 246
 247 DRIVER_MODULE(acx, pci, acx_driver, acx_devclass, 0, 0);
 248 DRIVER_MODULE(acx, cardbus, acx_driver, acx_devclass, 0, 0);
 249
 250 MODULE_DEPEND(acx, wlan, 1, 1, 1);
 251 MODULE_DEPEND(acx, pci, 1, 1, 1);
 252 MODULE_DEPEND(acx, cardbus, 1, 1, 1);
 253
 254 static int
 255 acx_probe(device_t dev)
 256 {
 257         const struct acx_device *a;
 258         uint16_t did, vid;
 259
 260         vid = pci_get_vendor(dev);
 261         did = pci_get_device(dev);
 262         for (a = acx_devices; a->desc != NULL; ++a) {
 263                 if (vid == a->vid && did == a->did) {
 264                         a->set_param(dev);
 265                         device_set_desc(dev, a->desc);
 266                         return 0;
 267                 }
 268         }
 269         return ENXIO;
 270 }
 271
 272 static int
 273 acx_attach(device_t dev)
 274 {
 275         struct acx_softc *sc;
 276         struct ifnet *ifp;
 277         struct ieee80211com *ic;
 278         int i, error;
 279
 280         sc = device_get_softc(dev);
 281         ic = &sc->sc_ic;
 282         ifp = &ic->ic_if;
 283
 284         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 285
 286 #ifndef BURN_BRIDGES
 287         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 288                 uint32_t mem1, mem2, irq;
 289
 290                 mem1 = pci_read_config(dev, sc->chip_mem1_rid, 4);
 291                 mem2 = pci_read_config(dev, sc->chip_mem2_rid, 4);
 292                 irq = pci_read_config(dev, PCIR_INTLINE, 4);
 293
 294                 device_printf(dev, "chip is in D%d power mode "
 295                     "-- setting to D0\n", pci_get_powerstate(dev));
 296
 297                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 298
 299                 pci_write_config(dev, sc->chip_mem1_rid, mem1, 4);
 300                 pci_write_config(dev, sc->chip_mem2_rid, mem2, 4);
 301                 pci_write_config(dev, PCIR_INTLINE, irq, 4);
 302         }
 303 #endif  /* !BURN_BRIDGE */
 304
 305         /* Enable bus mastering */
 306         pci_enable_busmaster(dev);
 307
 308         /* Allocate IO memory 1 */
 309         sc->sc_mem1_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 310                                                  &sc->chip_mem1_rid,
 311                                                  RF_ACTIVE);
 312         if (sc->sc_mem1_res == NULL) {
 313                 error = ENXIO;
 314                 device_printf(dev, "can't allocate IO mem1\n");
 315                 goto fail;
 316         }
 317         sc->sc_mem1_bt = rman_get_bustag(sc->sc_mem1_res);
 318         sc->sc_mem1_bh = rman_get_bushandle(sc->sc_mem1_res);
 319
 320         /* Allocate IO memory 2 */
 321         sc->sc_mem2_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 322                                                  &sc->chip_mem2_rid,
 323                                                  RF_ACTIVE);
 324         if (sc->sc_mem2_res == NULL) {
 325                 error = ENXIO;
 326                 device_printf(dev, "can't allocate IO mem2\n");
 327                 goto fail;
 328         }
 329         sc->sc_mem2_bt = rman_get_bustag(sc->sc_mem2_res);
 330         sc->sc_mem2_bh = rman_get_bushandle(sc->sc_mem2_res);
 331
 332         /* Allocate irq */
 333         sc->sc_irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 334                                                 &sc->sc_irq_rid,
 335                                                 RF_SHAREABLE | RF_ACTIVE);
 336         if (sc->sc_irq_res == NULL) {
 337                 error = ENXIO;
 338                 device_printf(dev, "can't allocate intr\n");
 339                 goto fail;
 340         }
 341
 342         /* Initilize channel scanning timer */
 343         callout_init(&sc->sc_chanscan_timer);
 344
 345         /* Allocate busdma stuffs */
 346         error = acx_dma_alloc(sc);
 347         if (error)
 348                 goto fail;
 349
 350         /* Reset Hardware */
 351         error = acx_reset(sc);
 352         if (error)
 353                 goto fail;
 354
 355         /* Disable interrupts before firmware is loaded */
 356         acx_disable_intr(sc);
 357
 358         /* Get radio type and form factor */
 359 #define EEINFO_RETRY_MAX        50
 360         for (i = 0; i < EEINFO_RETRY_MAX; ++i) {
 361                 uint16_t ee_info;
 362
 363                 ee_info = CSR_READ_2(sc, ACXREG_EEPROM_INFO);
 364                 if (ACX_EEINFO_HAS_RADIO_TYPE(ee_info)) {
 365                         sc->sc_form_factor = ACX_EEINFO_FORM_FACTOR(ee_info);
 366                         sc->sc_radio_type = ACX_EEINFO_RADIO_TYPE(ee_info);
 367                         break;
 368                 }
 369                 DELAY(10000);
 370         }
 371         if (i == EEINFO_RETRY_MAX) {
 372                 error = ENXIO;
 373                 goto fail;
 374         }
 375 #undef EEINFO_RETRY_MAX
 376
 377         DPRINTF((&sc->sc_ic.ic_if, "radio type %02x\n", sc->sc_radio_type));
 378
 379 #ifdef DUMP_EEPROM
 380         for (i = 0; i < 0x40; ++i) {
 381                 uint8_t val;
 382
 383                 error = acx_read_eeprom(sc, i, &val);
 384                 if (i % 10 == 0)
 385                         printf("\n");
 386                 printf("%02x ", val);
 387         }
 388         printf("\n");
 389 #endif  /* DUMP_EEPROM */
 390
 391         /* Get EEPROM version */
 392         error = acx_read_eeprom(sc, ACX_EE_VERSION_OFS, &sc->sc_eeprom_ver);
 393         if (error)
 394                 goto fail;
 395         DPRINTF((&sc->sc_ic.ic_if, "EEPROM version %u\n", sc->sc_eeprom_ver));
 396
 397         ifp->if_softc = sc;
 398         ifp->if_init = acx_init;
 399         ifp->if_ioctl = acx_ioctl;
 400         ifp->if_start = acx_start;
 401         ifp->if_watchdog = acx_watchdog;
 402         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
 403         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 404         ifq_set_ready(&ifp->if_snd);
 405
 406         /* Set channels */
 407         for (i = 1; i <= 14; ++i) {
 408                 ic->ic_channels[i].ic_freq =
 409                         ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 410                 ic->ic_channels[i].ic_flags = sc->chip_chan_flags;
 411         }
 412
 413         ic->ic_opmode = IEEE80211_M_STA;
 414         ic->ic_state = IEEE80211_S_INIT;
 415
 416         ic->ic_caps = IEEE80211_C_WEP |         /* WEP */
 417                       IEEE80211_C_IBSS |        /* IBSS modes */
 418                       IEEE80211_C_SHPREAMBLE;   /* Short preamble */
 419
 420         /* Get station id */
 421         for (i = 0; i < IEEE80211_ADDR_LEN; ++i) {
 422                 error = acx_read_eeprom(sc, sc->chip_ee_eaddr_ofs - i,
 423                                         &ic->ic_myaddr[i]);
 424         }
 425
 426         ieee80211_ifattach(ic);
 427
 428         /* Override node alloc */
 429         ic->ic_node_alloc = acx_node_alloc;
 430
 431         /* Override newstate */
 432         sc->sc_newstate = ic->ic_newstate;
 433         ic->ic_newstate = acx_newstate;
 434
 435         ieee80211_media_init(ic, ieee80211_media_change, ieee80211_media_status);
 436
 437         sc->sc_txrate_upd_intvl_min = 10;       /* 10 seconds */
 438         sc->sc_txrate_upd_intvl_max = 300;      /* 5 minutes */
 439         sc->sc_txrate_sample_thresh = 30;       /* 30 packets */
 440         sc->sc_long_retry_limit = 4;
 441         sc->sc_short_retry_limit = 7;
 442         sc->sc_msdu_lifetime = 4096;
 443
 444         sysctl_ctx_init(&sc->sc_sysctl_ctx);
 445         sc->sc_sysctl_tree = SYSCTL_ADD_NODE(&sc->sc_sysctl_ctx,
 446                                              SYSCTL_STATIC_CHILDREN(_hw),
 447                                              OID_AUTO,
 448                                              device_get_nameunit(dev),
 449                                              CTLFLAG_RD, 0, "");
 450         if (sc->sc_sysctl_tree == NULL) {
 451                 device_printf(dev, "can't add sysctl node\n");
 452                 error = ENXIO;
 453                 goto fail1;
 454         }
 455
 456         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 457                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 458                         OID_AUTO, "txrate_upd_intvl_min",
 459                         CTLTYPE_INT | CTLFLAG_RW,
 460                         sc, 0, acx_sysctl_txrate_upd_intvl_min, "I",
 461                         "min seconds to wait before raising TX rate");
 462         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 463                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 464                         OID_AUTO, "txrate_upd_intvl_max",
 465                         CTLTYPE_INT | CTLFLAG_RW,
 466                         sc, 0, acx_sysctl_txrate_upd_intvl_max, "I",
 467                         "max seconds to wait before raising TX rate");
 468         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 469                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 470                         OID_AUTO, "txrate_sample_threshold",
 471                         CTLTYPE_INT | CTLFLAG_RW,
 472                         sc, 0, acx_sysctl_txrate_sample_thresh, "I",
 473                         "number of packets to be sampled "
 474                         "before raising TX rate");
 475
 476         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 477                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 478                         OID_AUTO, "long_retry_limit",
 479                         CTLTYPE_INT | CTLFLAG_RW,
 480                         sc, 0, acx_sysctl_long_retry_limit, "I",
 481                         "max number of retries for RTS packets");
 482         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 483                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 484                         OID_AUTO, "short_retry_limit",
 485                         CTLTYPE_INT | CTLFLAG_RW,
 486                         sc, 0, acx_sysctl_short_retry_limit, "I",
 487                         "max number of retries for non-RTS packets");
 488
 489         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 490                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 491                         OID_AUTO, "msdu_lifetime",
 492                         CTLTYPE_INT | CTLFLAG_RW,
 493                         sc, 0, acx_sysctl_msdu_lifetime, "I",
 494                         "MSDU life time");
 495
 496         error = bus_setup_intr(dev, sc->sc_irq_res, INTR_MPSAFE, acx_intr, sc,
 497                                &sc->sc_irq_handle, ifp->if_serializer);
 498         if (error) {
 499                 device_printf(dev, "can't set up interrupt\n");
 500                 goto fail1;
 501         }
 502
 503         if (bootverbose)
 504                 ieee80211_announce(ic);
 505
 506         return 0;
 507 fail1:
 508         ieee80211_ifdetach(ic);
 509 fail:
 510         acx_detach(dev);
 511         return error;
 512 }
 513
 514 static int
 515 acx_detach(device_t dev)
 516 {
 517         struct acx_softc *sc = device_get_softc(dev);
 518
 519         if (device_is_attached(dev)) {
 520                 struct ieee80211com *ic = &sc->sc_ic;
 521                 struct ifnet *ifp = &ic->ic_if;
 522
 523                 lwkt_serialize_enter(ifp->if_serializer);
 524
 525                 acx_stop(sc);
 526                 acx_free_firmware(sc);
 527                 bus_teardown_intr(dev, sc->sc_irq_res, sc->sc_irq_handle);
 528
 529                 lwkt_serialize_exit(ifp->if_serializer);
 530
 531                 ieee80211_ifdetach(ic);
 532         }
 533
 534         if (sc->sc_sysctl_tree != NULL)
 535                 sysctl_ctx_free(&sc->sc_sysctl_ctx);
 536
 537         if (sc->sc_irq_res != NULL) {
 538                 bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
 539                                      sc->sc_irq_res);
 540         }
 541         if (sc->sc_mem1_res != NULL) {
 542                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem1_rid,
 543                                      sc->sc_mem1_res);
 544         }
 545         if (sc->sc_mem2_res != NULL) {
 546                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem2_rid,
 547                                      sc->sc_mem2_res);
 548         }
 549
 550         acx_dma_free(sc);
 551         return 0;
 552 }
 553
 554 static int
 555 acx_shutdown(device_t dev)
 556 {
 557         struct acx_softc *sc = device_get_softc(dev);
 558
 559         lwkt_serialize_enter(sc->sc_ic.ic_if.if_serializer);
 560         acx_stop(sc);
 561         lwkt_serialize_exit(sc->sc_ic.ic_if.if_serializer);
 562         return 0;
 563 }
 564
 565 static void
 566 acx_init(void *arg)
 567 {
 568         struct acx_softc *sc = arg;
 569         struct ifnet *ifp = &sc->sc_ic.ic_if;
 570         struct acx_firmware *fw = &sc->sc_firmware;
 571         int error;
 572
 573         error = acx_stop(sc);
 574         if (error)
 575                 return;
 576
 577         if (fw->base_fw == NULL) {
 578                 error = EINVAL;
 579                 if_printf(ifp, "base firmware is not loaded yet\n");
 580                 return;
 581         }
 582
 583         error = acx_init_tx_ring(sc);
 584         if (error) {
 585                 if_printf(ifp, "can't initialize TX ring\n");
 586                 goto back;
 587         }
 588
 589         error = acx_init_rx_ring(sc);
 590         if (error) {
 591                 if_printf(ifp, "can't initialize RX ring\n");
 592                 goto back;
 593         }
 594
 595         error = acx_load_base_firmware(sc, fw->base_fw, fw->base_fw_len);
 596         if (error)
 597                 goto back;
 598
 599         /*
 600          * Initialize command and information registers
 601          * NOTE: This should be done after base firmware is loaded
 602          */
 603         acx_init_cmd_reg(sc);
 604         acx_init_info_reg(sc);
 605
 606         sc->sc_flags |= ACX_FLAG_FW_LOADED;
 607
 608 #if 0
 609         if (sc->chip_post_basefw != NULL) {
 610                 error = sc->chip_post_basefw(sc);
 611                 if (error)
 612                         goto back;
 613         }
 614 #endif
 615
 616         if (fw->radio_fw != NULL) {
 617                 error = acx_load_radio_firmware(sc, fw->radio_fw,
 618                                                 fw->radio_fw_len);
 619                 if (error)
 620                         goto back;
 621         }
 622
 623         error = sc->chip_init(sc);
 624         if (error)
 625                 goto back;
 626
 627         /* Get and set device various configuration */
 628         error = acx_config(sc);
 629         if (error)
 630                 goto back;
 631
 632         /* Setup WEP */
 633         if (sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) {
 634                 error = acx_set_wepkeys(sc);
 635                 if (error)
 636                         goto back;
 637                 sc->sc_ic.ic_flags &= ~IEEE80211_F_DROPUNENC;
 638         }
 639
 640         /* Turn on power led */
 641         CSR_CLRB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 642
 643         acx_enable_intr(sc);
 644
 645         ifp->if_flags |= IFF_RUNNING;
 646         ifp->if_flags &= ~IFF_OACTIVE;
 647
 648         /* Begin background scanning */
 649 #ifdef foo
 650         acx_begin_scan(sc);
 651 #else
 652         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_SCAN, -1);
 653 #endif
 654
 655 back:
 656         if (error)
 657                 acx_stop(sc);
 658 }
 659
 660 static void
 661 acx_init_info_reg(struct acx_softc *sc)
 662 {
 663         sc->sc_info = CSR_READ_4(sc, ACXREG_INFO_REG_OFFSET);
 664         sc->sc_info_param = sc->sc_info + ACX_INFO_REG_SIZE;
 665 }
 666
 667 static int
 668 acx_set_wepkeys(struct acx_softc *sc)
 669 {
 670         struct ieee80211com *ic = &sc->sc_ic;
 671         struct acx_conf_wep_txkey wep_txkey;
 672         int i, error, got_wk = 0;
 673
 674         for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
 675                 struct ieee80211_key *wk = &ic->ic_nw_keys[i];
 676
 677                 if (wk->wk_keylen == 0)
 678                         continue;
 679
 680                 error = sc->chip_set_wepkey(sc, wk, i);
 681                 if (error)
 682                         return error;
 683
 684                 if (sc->sc_softwep && (wk->wk_flags & IEEE80211_KEY_XMIT))
 685                         wk->wk_flags |= IEEE80211_KEY_SWCRYPT;
 686                 got_wk = 1;
 687         }
 688
 689         if (!got_wk || ic->ic_def_txkey == IEEE80211_KEYIX_NONE)
 690                 return 0;
 691
 692         /* Set current WEP key index */
 693         wep_txkey.wep_txkey = ic->ic_def_txkey;
 694         if (acx_set_wep_txkey_conf(sc, &wep_txkey) != 0) {
 695                 if_printf(&ic->ic_if, "set WEP txkey failed\n");
 696                 return ENXIO;
 697         }
 698         return 0;
 699 }
 700
 701 #ifdef foo
 702 static void
 703 acx_begin_scan(struct acx_softc *sc)
 704 {
 705         struct ieee80211com *ic = &sc->sc_ic;
 706         uint8_t chan;
 707
 708         ieee80211_begin_scan(ic, 1);
 709
 710         chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 711
 712         ACX_ENABLE_TXCHAN(sc, chan);
 713         ACX_ENABLE_RXCHAN(sc, chan);
 714
 715         /* Start background scanning */
 716         callout_reset(&sc->sc_chanscan_timer, hz / acx_chanscan_rate,
 717                       acx_next_scan, sc);
 718 }
 719 #endif
 720
 721 static void
 722 acx_next_scan(void *arg)
 723 {
 724         struct acx_softc *sc = arg;
 725         struct ieee80211com *ic = &sc->sc_ic;
 726         struct ifnet *ifp = &ic->ic_if;
 727
 728         lwkt_serialize_enter(ifp->if_serializer);
 729
 730         if (ic->ic_state == IEEE80211_S_SCAN) {
 731 #if 0
 732                 uint8_t chan;
 733 #endif
 734
 735                 ieee80211_next_scan(ic);
 736
 737 #if 0
 738                 chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 739
 740                 ACX_ENABLE_TXCHAN(sc, chan);
 741                 ACX_ENABLE_RXCHAN(sc, chan);
 742
 743                 callout_reset(&sc->sc_chanscan_timer, hz / acx_chanscan_rate,
 744                               acx_next_scan, sc);
 745 #endif
 746         }
 747
 748         lwkt_serialize_exit(ifp->if_serializer);
 749 }
 750
 751 static int
 752 acx_stop(struct acx_softc *sc)
 753 {
 754         struct ieee80211com *ic = &sc->sc_ic;
 755         struct ifnet *ifp = &ic->ic_if;
 756         struct acx_buf_data *bd = &sc->sc_buf_data;
 757         struct acx_ring_data *rd = &sc->sc_ring_data;
 758         int i, error;
 759
 760         ASSERT_SERIALIZED(ifp->if_serializer);
 761
 762         sc->sc_firmware_ver = 0;
 763         sc->sc_hardware_id = 0;
 764
 765         /* Reset hardware */
 766         error = acx_reset(sc);
 767         if (error)
 768                 return error;
 769
 770         /* Firmware no longer functions after hardware reset */
 771         sc->sc_flags &= ~ACX_FLAG_FW_LOADED;
 772
 773         acx_disable_intr(sc);
 774
 775         /* Stop backgroud scanning */
 776         callout_stop(&sc->sc_chanscan_timer);
 777
 778         /* Turn off power led */
 779         CSR_SETB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 780
 781         /* Free TX mbuf */
 782         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
 783                 struct acx_txbuf *buf;
 784                 struct ieee80211_node *ni;
 785
 786                 buf = &bd->tx_buf[i];
 787
 788                 if (buf->tb_mbuf != NULL) {
 789                         bus_dmamap_unload(bd->mbuf_dma_tag,
 790                                           buf->tb_mbuf_dmamap);
 791                         m_freem(buf->tb_mbuf);
 792                         buf->tb_mbuf = NULL;
 793                 }
 794
 795                 ni = (struct ieee80211_node *)buf->tb_node;
 796                 if (ni != NULL)
 797                         ieee80211_free_node(ni);
 798                 buf->tb_node = NULL;
 799         }
 800
 801         /* Clear TX host descriptors */
 802         bzero(rd->tx_ring, ACX_TX_RING_SIZE);
 803
 804         /* Free RX mbuf */
 805         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
 806                 if (bd->rx_buf[i].rb_mbuf != NULL) {
 807                         bus_dmamap_unload(bd->mbuf_dma_tag,
 808                                           bd->rx_buf[i].rb_mbuf_dmamap);
 809                         m_freem(bd->rx_buf[i].rb_mbuf);
 810                         bd->rx_buf[i].rb_mbuf = NULL;
 811                 }
 812         }
 813
 814         /* Clear RX host descriptors */
 815         bzero(rd->rx_ring, ACX_RX_RING_SIZE);
 816
 817         ifp->if_timer = 0;
 818         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 819         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
 820
 821         return 0;
 822 }
 823
 824 static int
 825 acx_config(struct acx_softc *sc)
 826 {
 827         struct acx_config conf;
 828         int error;
 829
 830         error = acx_read_config(sc, &conf);
 831         if (error)
 832                 return error;
 833
 834         error = acx_write_config(sc, &conf);
 835         if (error)
 836                 return error;
 837
 838         if (acx_set_probe_req_tmplt(sc, "", 0) != 0) {
 839                 if_printf(&sc->sc_ic.ic_if, "can't set probe req template "
 840                           "(empty ssid)\n");
 841                 return ENXIO;
 842         }
 843
 844         /* XXX for PM?? */
 845         if (acx_set_null_tmplt(sc) != 0) {
 846                 if_printf(&sc->sc_ic.ic_if, "can't set null data template\n");
 847                 return ENXIO;
 848         }
 849         return 0;
 850 }
 851
 852 static int
 853 acx_read_config(struct acx_softc *sc, struct acx_config *conf)
 854 {
 855         struct acx_conf_eaddr addr;
 856         struct acx_conf_regdom reg_dom;
 857         struct acx_conf_antenna ant;
 858         struct acx_conf_fwrev fw_rev;
 859         uint32_t fw_rev_no;
 860         uint8_t sen;
 861         int i, error;
 862
 863         /* Get station id */
 864         if (acx_get_eaddr_conf(sc, &addr) != 0) {
 865                 if_printf(&sc->sc_ic.ic_if, "can't get station id\n");
 866                 return ENXIO;
 867         }
 868
 869         /*
 870          * Get and print station id in case that EEPROM station id's
 871          * offset is not correct
 872          */
 873         for (i = 0; i < IEEE80211_ADDR_LEN; ++i)
 874                 conf->eaddr[IEEE80211_ADDR_LEN - 1 - i] = addr.eaddr[i];
 875         if_printf(&sc->sc_ic.ic_if, "MAC address (from firmware): %6D\n",
 876                   conf->eaddr, ":");
 877
 878         /* Get region domain */
 879         if (acx_get_regdom_conf(sc, &reg_dom) != 0) {
 880                 if_printf(&sc->sc_ic.ic_if, "can't get region domain\n");
 881                 return ENXIO;
 882         }
 883         conf->regdom = reg_dom.regdom;
 884         DPRINTF((&sc->sc_ic.ic_if, "regdom %02x\n", reg_dom.regdom));
 885
 886         /* Get antenna */
 887         if (acx_get_antenna_conf(sc, &ant) != 0) {
 888                 if_printf(&sc->sc_ic.ic_if, "can't get antenna\n");
 889                 return ENXIO;
 890         }
 891         conf->antenna = ant.antenna;
 892         DPRINTF((&sc->sc_ic.ic_if, "antenna %02x\n", ant.antenna));
 893
 894         /* Get sensitivity XXX not used */
 895         if (sc->sc_radio_type == ACX_RADIO_TYPE_MAXIM ||
 896             sc->sc_radio_type == ACX_RADIO_TYPE_RFMD ||
 897             sc->sc_radio_type == ACX_RADIO_TYPE_RALINK) {
 898                 error = acx_read_phyreg(sc, ACXRV_PHYREG_SENSITIVITY, &sen);
 899                 if (error) {
 900                         if_printf(&sc->sc_ic.ic_if, "can't get sensitivity\n");
 901                         return error;
 902                 }
 903         } else {
 904                 sen = 0;
 905         }
 906         DPRINTF((&sc->sc_ic.ic_if, "sensitivity %02x\n", sen));
 907
 908         /* Get firmware revision */
 909         if (acx_get_fwrev_conf(sc, &fw_rev) != 0) {
 910                 if_printf(&sc->sc_ic.ic_if, "can't get firmware revision\n");
 911                 return ENXIO;
 912         }
 913
 914         if (strncmp(fw_rev.fw_rev, "Rev ", 4) != 0) {
 915                 if_printf(&sc->sc_ic.ic_if, "strange revision string -- %s\n",
 916                           fw_rev.fw_rev);
 917                 fw_rev_no = 0x01090407;
 918         } else {
 919                 char *s, *endp;
 920
 921                 /*
 922                  *  01234
 923                  * "Rev xx.xx.xx.xx"
 924                  *      ^ Start from here
 925                  */
 926                 s = &fw_rev.fw_rev[4];
 927                 fw_rev_no = 0;
 928                 for (i = 0; i < 4; ++i) {
 929                         uint8_t val;
 930
 931                         val = strtoul(s, &endp, 16);
 932                         fw_rev_no |= val << ((3 - i) * 8);
 933
 934                         if (*endp == '\0')
 935                                 break;
 936                         else
 937                                 s = ++endp;
 938                 }
 939         }
 940         sc->sc_firmware_ver = fw_rev_no;
 941         sc->sc_hardware_id = le32toh(fw_rev.hw_id);
 942         DPRINTF((&sc->sc_ic.ic_if, "fw rev %08x, hw id %08x\n",
 943                  sc->sc_firmware_ver, sc->sc_hardware_id));
 944
 945         if (sc->chip_read_config != NULL) {
 946                 error = sc->chip_read_config(sc, conf);
 947                 if (error)
 948                         return error;
 949         }
 950         return 0;
 951 }
 952
 953 static int
 954 acx_write_config(struct acx_softc *sc, struct acx_config *conf)
 955 {
 956         struct acx_conf_nretry_short sretry;
 957         struct acx_conf_nretry_long lretry;
 958         struct acx_conf_msdu_lifetime msdu_lifetime;
 959         struct acx_conf_rate_fallback rate_fb;
 960         struct acx_conf_antenna ant;
 961         struct acx_conf_regdom reg_dom;
 962         struct acx_conf_rxopt rx_opt;
 963         int error;
 964
 965         /* Set number of long/short retry */
 966         sretry.nretry = sc->sc_short_retry_limit;
 967         if (acx_set_nretry_short_conf(sc, &sretry) != 0) {
 968                 if_printf(&sc->sc_ic.ic_if, "can't set short retry limit\n");
 969                 return ENXIO;
 970         }
 971
 972         lretry.nretry = sc->sc_long_retry_limit;
 973         if (acx_set_nretry_long_conf(sc, &lretry) != 0) {
 974                 if_printf(&sc->sc_ic.ic_if, "can't set long retry limit\n");
 975                 return ENXIO;
 976         }
 977
 978         /* Set MSDU lifetime */
 979         msdu_lifetime.lifetime = htole32(sc->sc_msdu_lifetime);
 980         if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
 981                 if_printf(&sc->sc_ic.ic_if, "can't set MSDU lifetime\n");
 982                 return ENXIO;
 983         }
 984
 985         /* Enable rate fallback */
 986         rate_fb.ratefb_enable = 1;
 987         if (acx_set_rate_fallback_conf(sc, &rate_fb) != 0) {
 988                 if_printf(&sc->sc_ic.ic_if, "can't enable rate fallback\n");
 989                 return ENXIO;
 990         }
 991
 992         /* Set antenna */
 993         ant.antenna = conf->antenna;
 994         if (acx_set_antenna_conf(sc, &ant) != 0) {
 995                 if_printf(&sc->sc_ic.ic_if, "can't set antenna\n");
 996                 return ENXIO;
 997         }
 998
 999         /* Set region domain */
1000         reg_dom.regdom = conf->regdom;
1001         if (acx_set_regdom_conf(sc, &reg_dom) != 0) {
1002                 if_printf(&sc->sc_ic.ic_if, "can't set region domain\n");
1003                 return ENXIO;
1004         }
1005
1006         if (sc->chip_write_config != NULL) {
1007                 error = sc->chip_write_config(sc, conf);
1008                 if (error)
1009                         return error;
1010         }
1011
1012         /* What we want to receive and how to receive */
1013         /* XXX may not belong here, acx_init() */
1014         rx_opt.opt1 = RXOPT1_FILT_FDEST | RXOPT1_INCL_RXBUF_HDR;
1015         rx_opt.opt2 = RXOPT2_RECV_ASSOC_REQ |
1016                       RXOPT2_RECV_AUTH |
1017                       RXOPT2_RECV_BEACON |
1018                       RXOPT2_RECV_CF |
1019                       RXOPT2_RECV_CTRL |
1020                       RXOPT2_RECV_DATA |
1021                       RXOPT2_RECV_MGMT |
1022                       RXOPT2_RECV_PROBE_REQ |
1023                       RXOPT2_RECV_PROBE_RESP |
1024                       RXOPT2_RECV_OTHER;
1025         if (acx_set_rxopt_conf(sc, &rx_opt) != 0) {
1026                 if_printf(&sc->sc_ic.ic_if, "can't set RX option\n");
1027                 return ENXIO;
1028         }
1029         return 0;
1030 }
1031
1032 static int
1033 acx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1034 {
1035         struct acx_softc *sc = ifp->if_softc;
1036         struct ifreq *req;
1037         int error;
1038
1039         error = 0;
1040         req = (struct ifreq *)data;
1041
1042         switch (cmd) {
1043         case SIOCSLOADFW:
1044                 error = suser_cred(cr, NULL_CRED_OKAY);
1045                 if (error)
1046                         break;
1047
1048                 error = acx_copyin_firmware(sc, req);
1049                 break;
1050         case SIOCSKILLFW:
1051                 error = suser_cred(cr, NULL_CRED_OKAY);
1052                 if (error)
1053                         break;
1054                 acx_free_firmware(sc);
1055                 break;
1056         case SIOCGRADIO:
1057                 error = copyout(&sc->sc_radio_type, req->ifr_data,
1058                                 sizeof(sc->sc_radio_type));
1059                 break;
1060         case SIOCGFWVER:
1061                 error = copyout(&sc->sc_firmware_ver, req->ifr_data,
1062                                 sizeof(sc->sc_firmware_ver));
1063                 break;
1064         case SIOCGHWID:
1065                 error = copyout(&sc->sc_hardware_id, req->ifr_data,
1066                                 sizeof(sc->sc_hardware_id));
1067                 break;
1068         case SIOCGSTATS:
1069                 error = copyout(&sc->sc_stats, req->ifr_data,
1070                                 sizeof(sc->sc_stats));
1071                 break;
1072         case SIOCSIFFLAGS:
1073                 if (ifp->if_flags & IFF_UP) {
1074                         if ((ifp->if_flags & IFF_RUNNING) == 0)
1075                                 acx_init(sc);
1076                 } else {
1077                         if (ifp->if_flags & IFF_RUNNING)
1078                                 acx_stop(sc);
1079                 }
1080                 break;
1081         case SIOCADDMULTI:
1082         case SIOCDELMULTI:
1083                 /* TODO */
1084                 break;
1085         default:
1086                 error = ieee80211_ioctl(&sc->sc_ic, cmd, data, cr);
1087                 break;
1088         }
1089
1090         if (error == ENETRESET) {
1091                 if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
1092                     (IFF_RUNNING | IFF_UP))
1093                         acx_init(sc);
1094                 error = 0;
1095         }
1096         return error;
1097 }
1098
1099 static void
1100 acx_start(struct ifnet *ifp)
1101 {
1102         struct acx_softc *sc = ifp->if_softc;
1103         struct ieee80211com *ic = &sc->sc_ic;
1104         struct acx_buf_data *bd = &sc->sc_buf_data;
1105         struct acx_txbuf *buf;
1106         int trans, idx;
1107
1108         ASSERT_SERIALIZED(ifp->if_serializer);
1109
1110         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0 ||
1111             (ifp->if_flags & IFF_RUNNING) == 0 ||
1112             (ifp->if_flags & IFF_OACTIVE))
1113                 return;
1114
1115         /*
1116          * NOTE:
1117          * We can't start from a random position that TX descriptor
1118          * is free, since hardware will be confused by that.
1119          * We have to follow the order of the TX ring.
1120          */
1121         idx = bd->tx_free_start;
1122         trans = 0;
1123         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf == NULL;
1124              buf = &bd->tx_buf[idx]) {
1125                 struct ieee80211_frame *f;
1126                 struct ieee80211_node *ni = NULL;
1127                 struct mbuf *m;
1128                 int rate;
1129
1130                 if (!IF_QEMPTY(&ic->ic_mgtq)) {
1131                         IF_DEQUEUE(&ic->ic_mgtq, m);
1132
1133                         ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1134                         m->m_pkthdr.rcvif = NULL;
1135
1136 #if 0
1137                         /*
1138                          * Since mgmt data are transmitted at fixed rate
1139                          * they will not be used to do rate control.
1140                          */
1141                         if (ni != NULL)
1142                                 ieee80211_free_node(ni);
1143 #endif
1144                         rate = 4;       /* XXX 2Mb/s for mgmt packet */
1145                 } else if (!ifq_is_empty(&ifp->if_snd)) {
1146                         struct ether_header *eh;
1147                         struct acx_node *node;
1148
1149                         if (ic->ic_state != IEEE80211_S_RUN) {
1150                                 if_printf(ifp, "data packet dropped due to "
1151                                           "not RUN.  Current state %d\n",
1152                                           ic->ic_state);
1153                                 break;
1154                         }
1155
1156                         m = ifq_dequeue(&ifp->if_snd, NULL);
1157                         if (m == NULL)
1158                                 break;
1159
1160                         if (m->m_len < sizeof(struct ether_header)) {
1161                                 m = m_pullup(m, sizeof(struct ether_header));
1162                                 if (m == NULL) {
1163                                         ifp->if_oerrors++;
1164                                         continue;
1165                                 }
1166                         }
1167                         eh = mtod(m, struct ether_header *);
1168
1169                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1170                         if (ni == NULL) {
1171                                 m_freem(m);
1172                                 ifp->if_oerrors++;
1173                                 continue;
1174                         }
1175
1176                         /* TODO power save */
1177
1178                         m = ieee80211_encap(ic, m, ni);
1179                         if (m == NULL) {
1180                                 ieee80211_free_node(ni);
1181                                 ifp->if_oerrors++;
1182                                 continue;
1183                         }
1184
1185                         node = (struct acx_node *)ni;
1186                         if (node->nd_txrate < 0) {
1187                                 acx_node_init(sc, node);
1188 #if 0
1189                                 if (ic->ic_opmode == IEEE80211_M_IBSS) {
1190                                         /* XXX
1191                                          * Add extra reference here,
1192                                          * so that some node (bss_dup)
1193                                          * will not be freed just after
1194                                          * they are allocated, which
1195                                          * make TX rate control impossible
1196                                          */
1197                                         ieee80211_ref_node(ni);
1198                                 }
1199 #endif
1200                         }
1201
1202                         rate = node->nd_rates.rs_rates[node->nd_txrate];
1203
1204                         BPF_MTAP(ifp, m);
1205                 } else {
1206                         break;
1207                 }
1208
1209                 f = mtod(m, struct ieee80211_frame *);
1210                 if ((f->i_fc[1] & IEEE80211_FC1_WEP) && sc->sc_softwep) {
1211                         KASSERT(ni != NULL, ("TX node is NULL (WEP)\n"));
1212                         if (ieee80211_crypto_encap(ic, ni, m) == NULL) {
1213                                 ieee80211_free_node(ni);
1214                                 m_freem(m);
1215                                 ifp->if_oerrors++;
1216                                 continue;
1217                         }
1218                 }
1219
1220                 if (ic->ic_rawbpf != NULL)
1221                         bpf_mtap(ic->ic_rawbpf, m);
1222
1223                 if (acx_encap(sc, buf, m, ni, rate) != 0) {
1224                         /*
1225                          * NOTE: `m' will be freed in acx_encap()
1226                          * if we reach here.
1227                          */
1228                         if (ni != NULL)
1229                                 ieee80211_free_node(ni);
1230                         ifp->if_oerrors++;
1231                         continue;
1232                 }
1233
1234                 /*
1235                  * NOTE:
1236                  * 1) `m' should not be touched after acx_encap()
1237                  * 2) `node' will be used to do TX rate control during
1238                  *    acx_txeof(), so it is not freed here.  acx_txeof()
1239                  *    will free it for us
1240                  */
1241
1242                 trans = 1;
1243                 bd->tx_used_count++;
1244                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1245         }
1246         bd->tx_free_start = idx;
1247
1248         if (bd->tx_used_count == ACX_TX_DESC_CNT)
1249                 ifp->if_flags |= IFF_OACTIVE;
1250
1251         if (trans && ifp->if_timer == 0)
1252                 ifp->if_timer = 5;
1253 }
1254
1255 static void
1256 acx_watchdog(struct ifnet *ifp)
1257 {
1258         if_printf(ifp, "watchdog timeout\n");
1259         acx_txeof(ifp->if_softc);
1260         /* TODO */
1261 }
1262
1263 static void
1264 acx_intr(void *arg)
1265 {
1266         struct acx_softc *sc = arg;
1267         uint16_t intr_status;
1268
1269         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0)
1270                 return;
1271
1272         intr_status = CSR_READ_2(sc, ACXREG_INTR_STATUS_CLR);
1273         if (intr_status == ACXRV_INTR_ALL) {
1274                 /* not our interrupt */
1275                 return;
1276         }
1277
1278         intr_status &= sc->chip_intr_enable;
1279         if (intr_status == 0) {
1280                 /* not interrupts we care about */
1281                 return;
1282         }
1283
1284         /* Acknowledge all interrupts */
1285         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_ALL);
1286
1287         if (intr_status & ACXRV_INTR_TX_FINI)
1288                 acx_txeof(sc);
1289
1290         if (intr_status & ACXRV_INTR_RX_FINI)
1291                 acx_rxeof(sc);
1292 }
1293
1294 static void
1295 acx_disable_intr(struct acx_softc *sc)
1296 {
1297         CSR_WRITE_2(sc, ACXREG_INTR_MASK, sc->chip_intr_disable);
1298         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, 0);
1299 }
1300
1301 static void
1302 acx_enable_intr(struct acx_softc *sc)
1303 {
1304         /* Mask out interrupts that are not in the enable set */
1305         CSR_WRITE_2(sc, ACXREG_INTR_MASK, ~sc->chip_intr_enable);
1306         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, ACXRV_EVENT_DISABLE);
1307 }
1308
1309 static void
1310 acx_txeof(struct acx_softc *sc)
1311 {
1312         struct acx_buf_data *bd;
1313         struct acx_txbuf *buf;
1314         struct ifnet *ifp;
1315         int idx;
1316
1317         ifp = &sc->sc_ic.ic_if;
1318         ASSERT_SERIALIZED(ifp->if_serializer);
1319
1320         bd = &sc->sc_buf_data;
1321         idx = bd->tx_used_start;
1322         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf != NULL;
1323              buf = &bd->tx_buf[idx]) {
1324                 uint8_t ctrl, error;
1325
1326                 ctrl = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_ctrl);
1327                 if ((ctrl & (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE)) !=
1328                     (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE))
1329                         break;
1330
1331                 bus_dmamap_unload(bd->mbuf_dma_tag, buf->tb_mbuf_dmamap);
1332                 m_freem(buf->tb_mbuf);
1333                 buf->tb_mbuf = NULL;
1334
1335                 error = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_error);
1336                 if (error) {
1337                         acx_txerr(sc, error);
1338                         ifp->if_oerrors++;
1339                 } else {
1340                         ifp->if_opackets++;
1341                 }
1342
1343                 if (buf->tb_node != NULL) {
1344                         struct ieee80211com *ic;
1345                         struct ieee80211_node *ni;
1346
1347                         ic = &sc->sc_ic;
1348                         ni = (struct ieee80211_node *)buf->tb_node;
1349
1350                         acx_node_update(sc, buf->tb_node, buf->tb_rate, error);
1351                         ieee80211_free_node(ni);
1352                         buf->tb_node = NULL;
1353                 }
1354
1355                 FW_TXDESC_SETFIELD_1(sc, buf, f_tx_ctrl, DESC_CTRL_HOSTOWN);
1356
1357                 bd->tx_used_count--;
1358
1359                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1360         }
1361         bd->tx_used_start = idx;
1362
1363         ifp->if_timer = bd->tx_used_count == 0 ? 0 : 5;
1364
1365         if (bd->tx_used_count != ACX_TX_DESC_CNT) {
1366                 ifp->if_flags &= ~IFF_OACTIVE;
1367                 acx_start(ifp);
1368         }
1369 }
1370
1371 static void
1372 acx_txerr(struct acx_softc *sc, uint8_t err)
1373 {
1374         struct ifnet *ifp = &sc->sc_ic.ic_if;
1375         struct acx_stats *stats = &sc->sc_stats;
1376
1377         if (err == DESC_ERR_EXCESSIVE_RETRY) {
1378                 /*
1379                  * This a common error (see comment below),
1380                  * so print it using DPRINTF()
1381                  */
1382                 DPRINTF((ifp, "TX failed -- excessive retry\n"));
1383         } else {
1384                 if_printf(ifp, "TX failed -- ");
1385         }
1386
1387         /*
1388          * Although `err' looks like bitmask, it never
1389          * has multiple bits set.
1390          */
1391         switch (err) {
1392 #if 0
1393         case DESC_ERR_OTHER_FRAG:
1394                 /* XXX what's this */
1395                 printf("error in other fragment\n");
1396                 stats->err_oth_frag++;
1397                 break;
1398 #endif
1399         case DESC_ERR_ABORT:
1400                 printf("aborted\n");
1401                 stats->err_abort++;
1402                 break;
1403         case DESC_ERR_PARAM:
1404                 printf("wrong paramters in descriptor\n");
1405                 stats->err_param++;
1406                 break;
1407         case DESC_ERR_NO_WEPKEY:
1408                 printf("WEP key missing\n");
1409                 stats->err_no_wepkey++;
1410                 break;
1411         case DESC_ERR_MSDU_TIMEOUT:
1412                 printf("MSDU life timeout\n");
1413                 stats->err_msdu_timeout++;
1414                 break;
1415         case DESC_ERR_EXCESSIVE_RETRY:
1416                 /*
1417                  * Possible causes:
1418                  * 1) Distance is too long
1419                  * 2) Transmit failed (e.g. no MAC level ACK)
1420                  * 3) Chip overheated (this should be rare)
1421                  */
1422                 stats->err_ex_retry++;
1423                 break;
1424         case DESC_ERR_BUF_OVERFLOW:
1425                 printf("buffer overflow\n");
1426                 stats->err_buf_oflow++;
1427                 break;
1428         case DESC_ERR_DMA:
1429                 printf("DMA error\n");
1430                 stats->err_dma++;
1431                 break;
1432         default:
1433                 printf("unknown error %d\n", err);
1434                 stats->err_unkn++;
1435                 break;
1436         }
1437 }
1438
1439 static void
1440 acx_rxeof(struct acx_softc *sc)
1441 {
1442         struct ieee80211com *ic = &sc->sc_ic;
1443         struct acx_ring_data *rd = &sc->sc_ring_data;
1444         struct acx_buf_data *bd = &sc->sc_buf_data;
1445         struct ifnet *ifp = &ic->ic_if;
1446         int idx, ready;
1447
1448         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1449
1450         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1451                         BUS_DMASYNC_POSTREAD);
1452
1453         /*
1454          * Locate first "ready" rx buffer,
1455          * start from last stopped position
1456          */
1457         idx = bd->rx_scan_start;
1458         ready = 0;
1459         do {
1460                 struct acx_rxbuf *buf;
1461
1462                 buf = &bd->rx_buf[idx];
1463                 if ((buf->rb_desc->h_ctrl & htole16(DESC_CTRL_HOSTOWN)) &&
1464                     (buf->rb_desc->h_status & htole32(DESC_STATUS_FULL))) {
1465                         ready = 1;
1466                         break;
1467                 }
1468                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1469         } while (idx != bd->rx_scan_start);
1470
1471         if (!ready)
1472                 return;
1473
1474         /*
1475          * NOTE: don't mess up `idx' here, it will
1476          * be used in the following code
1477          */
1478
1479         do {
1480                 struct acx_rxbuf_hdr *head;
1481                 struct acx_rxbuf *buf;
1482                 struct mbuf *m;
1483                 uint32_t desc_status;
1484                 uint16_t desc_ctrl;
1485                 int len, error;
1486
1487                 buf = &bd->rx_buf[idx];
1488
1489                 desc_ctrl = le16toh(buf->rb_desc->h_ctrl);
1490                 desc_status = le32toh(buf->rb_desc->h_status);
1491                 if (!(desc_ctrl & DESC_CTRL_HOSTOWN) ||
1492                     !(desc_status & DESC_STATUS_FULL))
1493                         break;
1494
1495                 bus_dmamap_sync(bd->mbuf_dma_tag, buf->rb_mbuf_dmamap,
1496                                 BUS_DMASYNC_POSTREAD);
1497
1498                 m = buf->rb_mbuf;
1499
1500                 error = acx_newbuf(sc, buf, 0);
1501                 if (error) {
1502                         ifp->if_ierrors++;
1503                         goto next;
1504                 }
1505
1506                 head = mtod(m, struct acx_rxbuf_hdr *);
1507
1508                 len = le16toh(head->rbh_len) & ACX_RXBUF_LEN_MASK;
1509                 if (len >= sizeof(struct ieee80211_frame_min) &&
1510                     len < MCLBYTES) {
1511                         struct ieee80211_frame *f;
1512                         struct ieee80211_node *ni;
1513
1514                         m_adj(m, sizeof(struct acx_rxbuf_hdr) +
1515                                  sc->chip_rxbuf_exhdr);
1516                         f = mtod(m, struct ieee80211_frame *);
1517
1518                         if (f->i_fc[1] & IEEE80211_FC1_WEP) {
1519                                 /* Short circuit software WEP */
1520                                 f->i_fc[1] &= ~IEEE80211_FC1_WEP;
1521
1522                                 /* Do chip specific RX buffer processing */
1523                                 if (sc->chip_proc_wep_rxbuf != NULL) {
1524                                         sc->chip_proc_wep_rxbuf(sc, m, &len);
1525                                         f = mtod(m, struct ieee80211_frame *);
1526                                 }
1527                         }
1528
1529                         ni = ieee80211_find_rxnode(ic,
1530                                 (struct ieee80211_frame_min *)f);
1531
1532                         m->m_len = m->m_pkthdr.len = len;
1533                         m->m_pkthdr.rcvif = &ic->ic_if;
1534
1535                         ieee80211_input(ic, m, ni, head->rbh_level,
1536                                         le32toh(head->rbh_time));
1537
1538                         ieee80211_free_node(ni);
1539                         ifp->if_ipackets++;
1540                 } else {
1541                         m_freem(m);
1542                         ifp->if_ierrors++;
1543                 }
1544
1545 next:
1546                 buf->rb_desc->h_ctrl = htole16(desc_ctrl & ~DESC_CTRL_HOSTOWN);
1547                 buf->rb_desc->h_status = 0;
1548                 bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1549                                 BUS_DMASYNC_PREWRITE);
1550
1551                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1552         } while (idx != bd->rx_scan_start);
1553
1554         /*
1555          * Record the position so that next
1556          * time we can start from it
1557          */
1558         bd->rx_scan_start = idx;
1559 }
1560
1561 static int
1562 acx_reset(struct acx_softc *sc)
1563 {
1564         uint16_t reg;
1565
1566         /* Halt ECPU */
1567         CSR_SETB_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_HALT);
1568
1569         /* Software reset */
1570         reg = CSR_READ_2(sc, ACXREG_SOFT_RESET);
1571         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg | ACXRV_SOFT_RESET);
1572         DELAY(100);
1573         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg);
1574
1575         /* Initialize EEPROM */
1576         CSR_SETB_2(sc, ACXREG_EEPROM_INIT, ACXRV_EEPROM_INIT);
1577         DELAY(50000);
1578
1579         /* Test whether ECPU is stopped */
1580         reg = CSR_READ_2(sc, ACXREG_ECPU_CTRL);
1581         if (!(reg & ACXRV_ECPU_HALT)) {
1582                 if_printf(&sc->sc_ic.ic_if, "can't halt ECPU\n");
1583                 return ENXIO;
1584         }
1585         return 0;
1586 }
1587
1588 static int
1589 acx_read_eeprom(struct acx_softc *sc, uint32_t offset, uint8_t *val)
1590 {
1591         int i;
1592
1593         CSR_WRITE_4(sc, ACXREG_EEPROM_CONF, 0);
1594         CSR_WRITE_4(sc, ACXREG_EEPROM_ADDR, offset);
1595         CSR_WRITE_4(sc, ACXREG_EEPROM_CTRL, ACXRV_EEPROM_READ);
1596
1597 #define EE_READ_RETRY_MAX       100
1598         for (i = 0; i < EE_READ_RETRY_MAX; ++i) {
1599                 if (CSR_READ_2(sc, ACXREG_EEPROM_CTRL) == 0)
1600                         break;
1601                 DELAY(10000);
1602         }
1603         if (i == EE_READ_RETRY_MAX) {
1604                 if_printf(&sc->sc_ic.ic_if, "can't read EEPROM offset %x "
1605                           "(timeout)\n", offset);
1606                 return ETIMEDOUT;
1607         }
1608 #undef EE_READ_RETRY_MAX
1609
1610         *val = CSR_READ_1(sc, ACXREG_EEPROM_DATA);
1611         return 0;
1612 }
1613
1614 static int
1615 acx_read_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t *val)
1616 {
1617         int i;
1618
1619         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1620         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_READ);
1621
1622 #define PHY_READ_RETRY_MAX      100
1623         for (i = 0; i < PHY_READ_RETRY_MAX; ++i) {
1624                 if (CSR_READ_4(sc, ACXREG_PHY_CTRL) == 0)
1625                         break;
1626                 DELAY(10000);
1627         }
1628         if (i == PHY_READ_RETRY_MAX) {
1629                 if_printf(&sc->sc_ic.ic_if, "can't read phy reg %x (timeout)\n",
1630                           reg);
1631                 return ETIMEDOUT;
1632         }
1633 #undef PHY_READ_RETRY_MAX
1634
1635         *val = CSR_READ_1(sc, ACXREG_PHY_DATA);
1636         return 0;
1637 }
1638
1639 void
1640 acx_write_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t val)
1641 {
1642         CSR_WRITE_4(sc, ACXREG_PHY_DATA, val);
1643         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1644         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_WRITE);
1645 }
1646
1647 static int
1648 acx_copyin_firmware(struct acx_softc *sc, struct ifreq *req)
1649 {
1650         struct acx_firmware ufw, *kfw;
1651         uint8_t *base_fw, *radio_fw;
1652         int error;
1653
1654         kfw = &sc->sc_firmware;
1655         base_fw = NULL;
1656         radio_fw = NULL;
1657
1658         error = copyin(req->ifr_data, &ufw, sizeof(ufw));
1659         if (error)
1660                 return error;
1661
1662         /*
1663          * For combined base firmware, there is no radio firmware.
1664          * But base firmware must exist.
1665          */
1666         if (ufw.base_fw_len <= 0 || ufw.radio_fw_len < 0)
1667                 return EINVAL;
1668
1669         base_fw = malloc(ufw.base_fw_len, M_DEVBUF, M_INTWAIT);
1670         error = copyin(ufw.base_fw, base_fw, ufw.base_fw_len);
1671         if (error)
1672                 goto fail;
1673
1674         if (ufw.radio_fw_len > 0) {
1675                 radio_fw = malloc(ufw.radio_fw_len, M_DEVBUF, M_INTWAIT);
1676                 error = copyin(ufw.radio_fw, radio_fw, ufw.radio_fw_len);
1677                 if (error)
1678                         goto fail;
1679         }
1680
1681         kfw->base_fw_len = ufw.base_fw_len;
1682         if (kfw->base_fw != NULL)
1683                 free(kfw->base_fw, M_DEVBUF);
1684         kfw->base_fw = base_fw;
1685
1686         kfw->radio_fw_len = ufw.radio_fw_len;
1687         if (kfw->radio_fw != NULL)
1688                 free(kfw->radio_fw, M_DEVBUF);
1689         kfw->radio_fw = radio_fw;
1690
1691         return 0;
1692 fail:
1693         if (base_fw != NULL)
1694                 free(base_fw, M_DEVBUF);
1695         if (radio_fw != NULL)
1696                 free(radio_fw, M_DEVBUF);
1697         return error;
1698 }
1699
1700 static void
1701 acx_free_firmware(struct acx_softc *sc)
1702 {
1703         struct acx_firmware *fw = &sc->sc_firmware;
1704
1705         if (fw->base_fw != NULL) {
1706                 free(fw->base_fw, M_DEVBUF);
1707                 fw->base_fw = NULL;
1708                 fw->base_fw_len = 0;
1709         }
1710         if (fw->radio_fw != NULL) {
1711                 free(fw->radio_fw, M_DEVBUF);
1712                 fw->radio_fw = NULL;
1713                 fw->radio_fw_len = 0;
1714         }
1715 }
1716
1717 static int
1718 acx_load_base_firmware(struct acx_softc *sc, const uint8_t *base_fw,
1719                        uint32_t base_fw_len)
1720 {
1721         int i, error;
1722
1723         /* Load base firmware */
1724         error = acx_load_firmware(sc, 0, base_fw, base_fw_len);
1725         if (error) {
1726                 if_printf(&sc->sc_ic.ic_if, "can't load base firmware\n");
1727                 return error;
1728         }
1729         DPRINTF((&sc->sc_ic.ic_if, "base firmware loaded\n"));
1730
1731         /* Start ECPU */
1732         CSR_WRITE_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_START);
1733
1734         /* Wait for ECPU to be up */
1735         for (i = 0; i < 500; ++i) {
1736                 uint16_t reg;
1737
1738                 reg = CSR_READ_2(sc, ACXREG_INTR_STATUS);
1739                 if (reg & ACXRV_INTR_FCS_THRESH) {
1740                         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_FCS_THRESH);
1741                         return 0;
1742                 }
1743                 DELAY(10000);
1744         }
1745
1746         if_printf(&sc->sc_ic.ic_if, "can't initialize ECPU (timeout)\n");
1747         return ENXIO;
1748 }
1749
1750 static int
1751 acx_load_radio_firmware(struct acx_softc *sc, const uint8_t *radio_fw,
1752                         uint32_t radio_fw_len)
1753 {
1754         struct acx_conf_mmap mem_map;
1755         uint32_t radio_fw_ofs;
1756         int error;
1757
1758         /*
1759          * Get the position, where base firmware is loaded, so that
1760          * radio firmware can be loaded after it.
1761          */
1762         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1763                 return ENXIO;
1764         radio_fw_ofs = le32toh(mem_map.code_end);
1765
1766         /* Put ECPU into sleeping state, before loading radio firmware */
1767         if (acx_sleep(sc) != 0)
1768                 return ENXIO;
1769
1770         /* Load radio firmware */
1771         error = acx_load_firmware(sc, radio_fw_ofs, radio_fw, radio_fw_len);
1772         if (error) {
1773                 if_printf(&sc->sc_ic.ic_if, "can't load radio firmware\n");
1774                 return ENXIO;
1775         }
1776         DPRINTF((&sc->sc_ic.ic_if, "radio firmware loaded\n"));
1777
1778         /* Wake up sleeping ECPU, after radio firmware is loaded */
1779         if (acx_wakeup(sc) != 0)
1780                 return ENXIO;
1781
1782         /* Initialize radio */
1783         if (acx_init_radio(sc, radio_fw_ofs, radio_fw_len) != 0)
1784                 return ENXIO;
1785
1786         /* Verify radio firmware's loading position */
1787         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1788                 return ENXIO;
1789         if (le32toh(mem_map.code_end) != radio_fw_ofs + radio_fw_len) {
1790                 if_printf(&sc->sc_ic.ic_if, "loaded radio firmware position "
1791                           "mismatch\n");
1792                 return ENXIO;
1793         }
1794
1795         DPRINTF((&sc->sc_ic.ic_if, "radio firmware initialized\n"));
1796         return 0;
1797 }
1798
1799 static int
1800 acx_load_firmware(struct acx_softc *sc, uint32_t offset, const uint8_t *data,
1801                   int data_len)
1802 {
1803         const uint32_t *fw;
1804         int i, fw_len;
1805
1806         fw = (const uint32_t *)data;
1807         fw_len = data_len / sizeof(uint32_t);
1808
1809         /*
1810          * LOADFW_AUTO_INC only works with some older firmware:
1811          * 1) acx100's firmware
1812          * 2) acx111's firmware whose rev is 0x00010011
1813          */
1814
1815         /* Load firmware */
1816         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1817 #ifndef LOADFW_AUTO_INC
1818         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1819 #else
1820         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1821         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1822 #endif
1823
1824         for (i = 0; i < fw_len; ++i) {
1825 #ifndef LOADFW_AUTO_INC
1826                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1827 #endif
1828                 CSR_WRITE_4(sc, ACXREG_FWMEM_DATA, be32toh(fw[i]));
1829         }
1830
1831         /* Verify firmware */
1832         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1833 #ifndef LOADFW_AUTO_INC
1834         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1835 #else
1836         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1837         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1838 #endif
1839
1840         for (i = 0; i < fw_len; ++i) {
1841                 uint32_t val;
1842
1843 #ifndef LOADFW_AUTO_INC
1844                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1845 #endif
1846                 val = CSR_READ_4(sc, ACXREG_FWMEM_DATA);
1847                 if (be32toh(fw[i]) != val) {
1848                         if_printf(&sc->sc_ic.ic_if, "fireware mismatch "
1849                                   "fw %08x  loaded %08x\n", fw[i], val);
1850                         return ENXIO;
1851                 }
1852         }
1853         return 0;
1854 }
1855
1856 static struct ieee80211_node *
1857 acx_node_alloc(struct ieee80211_node_table *nt __unused)
1858 {
1859         struct acx_node *node;
1860
1861         node = malloc(sizeof(struct acx_node), M_80211_NODE, M_NOWAIT | M_ZERO);
1862         node->nd_txrate = -1;
1863         return (struct ieee80211_node *)node;
1864 }
1865
1866 static void
1867 acx_node_init(struct acx_softc *sc, struct acx_node *node)
1868 {
1869         struct ieee80211_rateset *nd_rset, *ic_rset, *cp_rset;
1870         struct ieee80211com *ic;
1871         int i, j, c;
1872
1873         ic = &sc->sc_ic;
1874
1875         nd_rset = &node->nd_node.ni_rates;
1876         ic_rset = &ic->ic_sup_rates[sc->chip_phymode];
1877         cp_rset = &node->nd_rates;
1878         c = 0;
1879
1880 #define IEEERATE(rate)  ((rate) & IEEE80211_RATE_VAL)
1881         for (i = 0; i < nd_rset->rs_nrates; ++i) {
1882                 uint8_t nd_rate = IEEERATE(nd_rset->rs_rates[i]);
1883
1884                 for (j = 0; j < ic_rset->rs_nrates; ++j) {
1885                         if (nd_rate == IEEERATE(ic_rset->rs_rates[j])) {
1886                                 cp_rset->rs_rates[c++] = nd_rate;
1887                                 if (node->nd_txrate < 0) {
1888                                         /* XXX slow start?? */
1889                                         node->nd_txrate = 0;
1890                                         node->nd_node.ni_txrate = i;
1891                                 }
1892                                 break;
1893                         }
1894                 }
1895         }
1896         KASSERT(node->nd_node.ni_txrate >= 0, ("no compat rates"));
1897         DPRINTF((&ic->ic_if, "node rate %d\n",
1898                  IEEERATE(nd_rset->rs_rates[node->nd_node.ni_txrate])));
1899 #undef IEEERATE
1900
1901         cp_rset->rs_nrates = c;
1902
1903         node->nd_txrate_upd_intvl = sc->sc_txrate_upd_intvl_min;
1904         node->nd_txrate_upd_time = time_second;
1905         node->nd_txrate_sample = 0;
1906 }
1907
1908 static void
1909 acx_node_update(struct acx_softc *sc, struct acx_node *node, uint8_t rate,
1910                 uint8_t error)
1911 {
1912         struct ieee80211_rateset *nd_rset, *cp_rset;
1913         int i, time_diff;
1914
1915         nd_rset = &node->nd_node.ni_rates;
1916         cp_rset = &node->nd_rates;
1917
1918         time_diff = time_second - node->nd_txrate_upd_time;
1919
1920         if (error == DESC_ERR_MSDU_TIMEOUT ||
1921             error == DESC_ERR_EXCESSIVE_RETRY) {
1922                 uint8_t cur_rate;
1923
1924                 /* Reset packet sample counter */
1925                 node->nd_txrate_sample = 0;
1926
1927                 if (rate > cp_rset->rs_rates[node->nd_txrate]) {
1928                         /*
1929                          * This rate has already caused toubles,
1930                          * so don't count it in here
1931                          */
1932                         return;
1933                 }
1934
1935                 /* Double TX rate updating interval */
1936                 node->nd_txrate_upd_intvl *= 2;
1937                 if (node->nd_txrate_upd_intvl <=
1938                     sc->sc_txrate_upd_intvl_min) {
1939                         node->nd_txrate_upd_intvl =
1940                                 sc->sc_txrate_upd_intvl_min;
1941                 } else if (node->nd_txrate_upd_intvl >
1942                            sc->sc_txrate_upd_intvl_max) {
1943                         node->nd_txrate_upd_intvl =
1944                                 sc->sc_txrate_upd_intvl_max;
1945                 }
1946
1947                 if (node->nd_txrate == 0)
1948                         return;
1949
1950                 node->nd_txrate_upd_time += time_diff;
1951
1952                 /* TX rate down */
1953                 node->nd_txrate--;
1954                 cur_rate = cp_rset->rs_rates[node->nd_txrate + 1];
1955                 while (cp_rset->rs_rates[node->nd_txrate] > cur_rate) {
1956                         if (node->nd_txrate - 1 > 0)
1957                                 node->nd_txrate--;
1958                         else
1959                                 break;
1960                 }
1961                 DPRINTF((&sc->sc_ic.ic_if, "rate down %6D %d -> %d\n",
1962                          node->nd_node.ni_macaddr, ":",
1963                          cp_rset->rs_rates[node->nd_txrate + 1],
1964                          cp_rset->rs_rates[node->nd_txrate]));
1965         } else if (node->nd_txrate + 1 < node->nd_rates.rs_nrates) {
1966                 uint8_t cur_rate;
1967
1968                 node->nd_txrate_sample++;
1969
1970                 if (node->nd_txrate_sample <= sc->sc_txrate_sample_thresh ||
1971                     time_diff <= node->nd_txrate_upd_intvl)
1972                         return;
1973
1974                 /* Reset packet sample counter */
1975                 node->nd_txrate_sample = 0;
1976
1977                 /* Half TX rate updating interval */
1978                 node->nd_txrate_upd_intvl /= 2;
1979                 if (node->nd_txrate_upd_intvl <
1980                     sc->sc_txrate_upd_intvl_min) {
1981                         node->nd_txrate_upd_intvl =
1982                                 sc->sc_txrate_upd_intvl_min;
1983                 } else if (node->nd_txrate_upd_intvl >
1984                            sc->sc_txrate_upd_intvl_max) {
1985                         node->nd_txrate_upd_intvl =
1986                                 sc->sc_txrate_upd_intvl_max;
1987                 }
1988
1989                 node->nd_txrate_upd_time += time_diff;
1990
1991                 /* TX Rate up */
1992                 node->nd_txrate++;
1993                 cur_rate = cp_rset->rs_rates[node->nd_txrate - 1];
1994                 while (cp_rset->rs_rates[node->nd_txrate] < cur_rate) {
1995                         if (node->nd_txrate + 1 < cp_rset->rs_nrates)
1996                                 node->nd_txrate++;
1997                         else
1998                                 break;
1999                 }
2000                 DPRINTF((&sc->sc_ic.ic_if, "rate up %6D %d -> %d\n",
2001                          node->nd_node.ni_macaddr, ":",
2002                          cur_rate, cp_rset->rs_rates[node->nd_txrate]));
2003         } else {
2004                 return;
2005         }
2006
2007 #define IEEERATE(rate)  ((rate) & IEEE80211_RATE_VAL)
2008         /* XXX Update ieee80211_node's TX rate index */
2009         for (i = 0; i < nd_rset->rs_nrates; ++i) {
2010                 if (IEEERATE(nd_rset->rs_rates[i]) ==
2011                     cp_rset->rs_rates[node->nd_txrate]) {
2012                         node->nd_node.ni_txrate = i;
2013                         break;
2014                 }
2015         }
2016 #undef IEEERATE
2017 }
2018
2019 static int
2020 acx_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2021 {
2022         struct acx_softc *sc = ic->ic_if.if_softc;
2023         int error = 0;
2024
2025         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
2026
2027         switch (nstate) {
2028         case IEEE80211_S_SCAN:
2029                 if (ic->ic_state != IEEE80211_S_INIT) {
2030                         uint8_t chan;
2031
2032                         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2033                         ACX_ENABLE_TXCHAN(sc, chan);
2034                         ACX_ENABLE_RXCHAN(sc, chan);
2035
2036                         callout_reset(&sc->sc_chanscan_timer,
2037                                       hz / acx_chanscan_rate,
2038                                       acx_next_scan, sc);
2039                 }
2040                 break;
2041         case IEEE80211_S_AUTH:
2042                 if (ic->ic_opmode == IEEE80211_M_STA) {
2043                         struct ieee80211_node *ni;
2044 #ifdef ACX_DEBUG
2045                         int i;
2046 #endif
2047
2048                         ni = ic->ic_bss;
2049
2050                         if (acx_join_bss(sc, ACX_MODE_STA, ni) != 0) {
2051                                 if_printf(&ic->ic_if, "join BSS failed\n");
2052                                 error = 1;
2053                                 goto back;
2054                         }
2055
2056                         DPRINTF((&ic->ic_if, "join BSS\n"));
2057                         if (ic->ic_state == IEEE80211_S_ASSOC) {
2058                                 DPRINTF((&ic->ic_if,
2059                                          "change from assoc to run\n"));
2060                                 ic->ic_state = IEEE80211_S_RUN;
2061                         }
2062
2063 #ifdef ACX_DEBUG
2064                         if_printf(&ic->ic_if, "AP rates: ");
2065                         for (i = 0; i < ni->ni_rates.rs_nrates; ++i)
2066                                 printf("%d ", ni->ni_rates.rs_rates[i]);
2067                         ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2068                         printf(" %6D\n", ni->ni_bssid, ":");
2069 #endif
2070                 }
2071                 break;
2072         case IEEE80211_S_RUN:
2073                 if (ic->ic_opmode == IEEE80211_M_IBSS) {
2074                         struct ieee80211_node *ni;
2075                         uint8_t chan;
2076
2077                         ni = ic->ic_bss;
2078                         chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2079
2080                         error = 1;
2081
2082                         if (acx_enable_txchan(sc, chan) != 0) {
2083                                 if_printf(&ic->ic_if,
2084                                           "enable TX on channel %d failed\n",
2085                                           chan);
2086                                 goto back;
2087                         }
2088
2089                         if (acx_enable_rxchan(sc, chan) != 0) {
2090                                 if_printf(&ic->ic_if,
2091                                           "enable RX on channel %d failed\n",
2092                                           chan);
2093                                 goto back;
2094                         }
2095
2096                         if (acx_set_beacon_tmplt(sc, ni->ni_essid,
2097                                                  ni->ni_esslen, chan) != 0) {
2098                                 if_printf(&ic->ic_if,
2099                                           "set bescon template failed\n");
2100                                 goto back;
2101                         }
2102
2103                         if (acx_set_probe_resp_tmplt(sc, ni->ni_essid,
2104                                                      ni->ni_esslen,
2105                                                      chan) != 0) {
2106                                 if_printf(&ic->ic_if, "set probe response "
2107                                           "template failed\n");
2108                                 goto back;
2109                         }
2110
2111                         if (acx_join_bss(sc, ACX_MODE_ADHOC, ni) != 0) {
2112                                 if_printf(&ic->ic_if, "join IBSS failed\n");
2113                                 goto back;
2114                         }
2115
2116                         DPRINTF((&ic->ic_if, "join IBSS\n"));
2117                         error = 0;
2118                 }
2119                 break;
2120         default:
2121                 break;
2122         }
2123
2124 back:
2125         if (error) {
2126                 /* XXX */
2127                 nstate = IEEE80211_S_INIT;
2128                 arg = -1;
2129         }
2130         return sc->sc_newstate(ic, nstate, arg);
2131 }
2132
2133 int
2134 acx_init_tmplt_ordered(struct acx_softc *sc)
2135 {
2136 #define INIT_TMPLT(name)                        \
2137 do {                                            \
2138         if (acx_init_##name##_tmplt(sc) != 0)   \
2139                 return 1;                       \
2140 } while (0)
2141
2142         /*
2143          * NOTE:
2144          * Order of templates initialization:
2145          * 1) Probe request
2146          * 2) NULL data
2147          * 3) Beacon
2148          * 4) TIM
2149          * 5) Probe response
2150          * Above order is critical to get a correct memory map.
2151          */
2152         INIT_TMPLT(probe_req);
2153         INIT_TMPLT(null_data);
2154         INIT_TMPLT(beacon);
2155         INIT_TMPLT(tim);
2156         INIT_TMPLT(probe_resp);
2157
2158 #undef CALL_SET_TMPLT
2159         return 0;
2160 }
2161
2162 static void
2163 acx_ring_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
2164 {
2165         *((uint32_t *)arg) = seg->ds_addr;
2166 }
2167
2168 static int
2169 acx_dma_alloc(struct acx_softc *sc)
2170 {
2171         struct acx_ring_data *rd = &sc->sc_ring_data;
2172         struct acx_buf_data *bd = &sc->sc_buf_data;
2173         int i, error;
2174
2175         /* Allocate DMA stuffs for RX descriptors  */
2176         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
2177                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2178                                    NULL, NULL,
2179                                    ACX_RX_RING_SIZE, 1, ACX_RX_RING_SIZE,
2180                                    0, &rd->rx_ring_dma_tag);
2181         if (error) {
2182                 if_printf(&sc->sc_ic.ic_if, "can't create rx ring dma tag\n");
2183                 return error;
2184         }
2185
2186         error = bus_dmamem_alloc(rd->rx_ring_dma_tag, (void **)&rd->rx_ring,
2187                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
2188                                  &rd->rx_ring_dmamap);
2189         if (error) {
2190                 if_printf(&sc->sc_ic.ic_if,
2191                           "can't allocate rx ring dma memory\n");
2192                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2193                 rd->rx_ring_dma_tag = NULL;
2194                 return error;
2195         }
2196
2197         error = bus_dmamap_load(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2198                                 rd->rx_ring, ACX_RX_RING_SIZE,
2199                                 acx_ring_dma_addr, &rd->rx_ring_paddr,
2200                                 BUS_DMA_WAITOK);
2201         if (error) {
2202                 if_printf(&sc->sc_ic.ic_if, "can't get rx ring dma address\n");
2203                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2204                                 rd->rx_ring_dmamap);
2205                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2206                 rd->rx_ring_dma_tag = NULL;
2207                 return error;
2208         }
2209
2210         /* Allocate DMA stuffs for TX descriptors */
2211         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
2212                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2213                                    NULL, NULL,
2214                                    ACX_TX_RING_SIZE, 1, ACX_TX_RING_SIZE,
2215                                    0, &rd->tx_ring_dma_tag);
2216         if (error) {
2217                 if_printf(&sc->sc_ic.ic_if, "can't create tx ring dma tag\n");
2218                 return error;
2219         }
2220
2221         error = bus_dmamem_alloc(rd->tx_ring_dma_tag, (void **)&rd->tx_ring,
2222                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
2223                                  &rd->tx_ring_dmamap);
2224         if (error) {
2225                 if_printf(&sc->sc_ic.ic_if,
2226                           "can't allocate tx ring dma memory\n");
2227                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2228                 rd->tx_ring_dma_tag = NULL;
2229                 return error;
2230         }
2231
2232         error = bus_dmamap_load(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2233                                 rd->tx_ring, ACX_TX_RING_SIZE,
2234                                 acx_ring_dma_addr, &rd->tx_ring_paddr,
2235                                 BUS_DMA_WAITOK);
2236         if (error) {
2237                 if_printf(&sc->sc_ic.ic_if, "can't get tx ring dma address\n");
2238                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2239                                 rd->tx_ring_dmamap);
2240                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2241                 rd->tx_ring_dma_tag = NULL;
2242                 return error;
2243         }
2244
2245         /* Create DMA tag for RX/TX mbuf map */
2246         error = bus_dma_tag_create(NULL, 1, 0,
2247                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2248                                    NULL, NULL,
2249                                    MCLBYTES, 1, MCLBYTES,
2250                                    0, &bd->mbuf_dma_tag);
2251         if (error) {
2252                 if_printf(&sc->sc_ic.ic_if, "can't create mbuf dma tag\n");
2253                 return error;
2254         }
2255
2256         /* Create a spare RX DMA map */
2257         error = bus_dmamap_create(bd->mbuf_dma_tag, 0, &bd->mbuf_tmp_dmamap);
2258         if (error) {
2259                 if_printf(&sc->sc_ic.ic_if, "can't create tmp mbuf dma map\n");
2260                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2261                 bd->mbuf_dma_tag = NULL;
2262                 return error;
2263         }
2264
2265         /* Create DMA map for RX mbufs */
2266         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2267                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2268                                           &bd->rx_buf[i].rb_mbuf_dmamap);
2269                 if (error) {
2270                         if_printf(&sc->sc_ic.ic_if, "can't create rx mbuf "
2271                                   "dma map (%d)\n", i);
2272                         return error;
2273                 }
2274                 bd->rx_buf[i].rb_desc = &rd->rx_ring[i];
2275         }
2276
2277         /* Create DMA map for TX mbufs */
2278         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2279                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2280                                           &bd->tx_buf[i].tb_mbuf_dmamap);
2281                 if (error) {
2282                         if_printf(&sc->sc_ic.ic_if, "can't create tx mbuf "
2283                                   "dma map (%d)\n", i);
2284                         return error;
2285                 }
2286                 bd->tx_buf[i].tb_desc1 = &rd->tx_ring[i * 2];
2287                 bd->tx_buf[i].tb_desc2 = &rd->tx_ring[(i * 2) + 1];
2288         }
2289
2290         return 0;
2291 }
2292
2293 static void
2294 acx_dma_free(struct acx_softc *sc)
2295 {
2296         struct acx_ring_data *rd = &sc->sc_ring_data;
2297         struct acx_buf_data *bd = &sc->sc_buf_data;
2298         int i;
2299
2300         if (rd->rx_ring_dma_tag != NULL) {
2301                 bus_dmamap_unload(rd->rx_ring_dma_tag, rd->rx_ring_dmamap);
2302                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2303                                 rd->rx_ring_dmamap);
2304                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2305         }
2306
2307         if (rd->tx_ring_dma_tag != NULL) {
2308                 bus_dmamap_unload(rd->tx_ring_dma_tag, rd->tx_ring_dmamap);
2309                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2310                                 rd->tx_ring_dmamap);
2311                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2312         }
2313
2314         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2315                 if (bd->rx_buf[i].rb_desc != NULL) {
2316                         if (bd->rx_buf[i].rb_mbuf != NULL) {
2317                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2318                                                   bd->rx_buf[i].rb_mbuf_dmamap);
2319                                 m_freem(bd->rx_buf[i].rb_mbuf);
2320                         }
2321                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2322                                            bd->rx_buf[i].rb_mbuf_dmamap);
2323                 }
2324         }
2325
2326         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2327                 if (bd->tx_buf[i].tb_desc1 != NULL) {
2328                         if (bd->tx_buf[i].tb_mbuf != NULL) {
2329                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2330                                                   bd->tx_buf[i].tb_mbuf_dmamap);
2331                                 m_freem(bd->tx_buf[i].tb_mbuf);
2332                         }
2333                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2334                                            bd->tx_buf[i].tb_mbuf_dmamap);
2335                 }
2336         }
2337
2338         if (bd->mbuf_dma_tag != NULL) {
2339                 bus_dmamap_destroy(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap);
2340                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2341         }
2342 }
2343
2344 static int
2345 acx_init_tx_ring(struct acx_softc *sc)
2346 {
2347         struct acx_ring_data *rd;
2348         struct acx_buf_data *bd;
2349         uint32_t paddr;
2350         int i;
2351
2352         rd = &sc->sc_ring_data;
2353         paddr = rd->tx_ring_paddr;
2354         for (i = 0; i < (ACX_TX_DESC_CNT * 2) - 1; ++i) {
2355                 paddr += sizeof(struct acx_host_desc);
2356
2357                 rd->tx_ring[i].h_ctrl = htole16(DESC_CTRL_HOSTOWN);
2358
2359                 if (i == (ACX_TX_DESC_CNT * 2) - 1)
2360                         rd->tx_ring[i].h_next_desc = htole32(rd->tx_ring_paddr);
2361                 else
2362                         rd->tx_ring[i].h_next_desc = htole32(paddr);
2363         }
2364
2365         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2366                         BUS_DMASYNC_PREWRITE);
2367
2368         bd = &sc->sc_buf_data;
2369         bd->tx_free_start = 0;
2370         bd->tx_used_start = 0;
2371         bd->tx_used_count = 0;
2372
2373         return 0;
2374 }
2375
2376 static int
2377 acx_init_rx_ring(struct acx_softc *sc)
2378 {
2379         struct acx_ring_data *rd;
2380         struct acx_buf_data *bd;
2381         uint32_t paddr;
2382         int i;
2383
2384         bd = &sc->sc_buf_data;
2385         rd = &sc->sc_ring_data;
2386         paddr = rd->rx_ring_paddr;
2387
2388         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2389                 int error;
2390
2391                 paddr += sizeof(struct acx_host_desc);
2392
2393                 error = acx_newbuf(sc, &bd->rx_buf[i], 1);
2394                 if (error)
2395                         return error;
2396
2397                 if (i == ACX_RX_DESC_CNT - 1)
2398                         rd->rx_ring[i].h_next_desc = htole32(rd->rx_ring_paddr);
2399                 else
2400                         rd->rx_ring[i].h_next_desc = htole32(paddr);
2401         }
2402
2403         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2404                         BUS_DMASYNC_PREWRITE);
2405
2406         bd->rx_scan_start = 0;
2407         return 0;
2408 }
2409
2410 static void
2411 acx_buf_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg,
2412                  bus_size_t mapsz, int error)
2413 {
2414         if (error)
2415                 return;
2416
2417         /* XXX */
2418         KASSERT(nseg == 1, ("too many RX dma segments\n"));
2419         *((uint32_t *)arg) = seg->ds_addr;
2420 }
2421
2422 static int
2423 acx_newbuf(struct acx_softc *sc, struct acx_rxbuf *rb, int wait)
2424 {
2425         struct acx_buf_data *bd;
2426         struct mbuf *m;
2427         bus_dmamap_t map;
2428         uint32_t paddr;
2429         int error;
2430
2431         bd = &sc->sc_buf_data;
2432
2433         m = m_getcl(wait ? MB_WAIT : MB_DONTWAIT, MT_DATA, M_PKTHDR);
2434         if (m == NULL)
2435                 return ENOBUFS;
2436
2437         m->m_len = m->m_pkthdr.len = MCLBYTES;
2438
2439         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap,
2440                                      m, acx_buf_dma_addr, &paddr,
2441                                      wait ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
2442         if (error) {
2443                 m_freem(m);
2444                 if_printf(&sc->sc_ic.ic_if, "can't map rx mbuf %d\n", error);
2445                 return error;
2446         }
2447
2448         /* Unload originally mapped mbuf */
2449         bus_dmamap_unload(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap);
2450
2451         /* Swap this dmamap with tmp dmamap */
2452         map = rb->rb_mbuf_dmamap;
2453         rb->rb_mbuf_dmamap = bd->mbuf_tmp_dmamap;
2454         bd->mbuf_tmp_dmamap = map;
2455
2456         rb->rb_mbuf = m;
2457         rb->rb_desc->h_data_paddr = htole32(paddr);
2458         rb->rb_desc->h_data_len = htole16(m->m_len);
2459
2460         bus_dmamap_sync(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap,
2461                         BUS_DMASYNC_PREREAD);
2462         return 0;
2463 }
2464
2465 static int
2466 acx_encap(struct acx_softc *sc, struct acx_txbuf *txbuf, struct mbuf *m,
2467           struct ieee80211_node *ni, int rate)
2468 {
2469         struct acx_buf_data *bd = &sc->sc_buf_data;
2470         struct acx_ring_data *rd = &sc->sc_ring_data;
2471         struct acx_node *node = (struct acx_node *)ni;
2472         uint32_t paddr;
2473         uint8_t ctrl;
2474         int error;
2475
2476         KASSERT(txbuf->tb_mbuf == NULL, ("free TX buf has mbuf installed\n"));
2477         error = 0;
2478
2479         if (m->m_pkthdr.len > MCLBYTES) {
2480                 if_printf(&sc->sc_ic.ic_if, "mbuf too big\n");
2481                 error = E2BIG;
2482                 goto back;
2483         } else if (m->m_pkthdr.len < ACX_FRAME_HDRLEN) {
2484                 if_printf(&sc->sc_ic.ic_if, "mbuf too small\n");
2485                 error = EINVAL;
2486                 goto back;
2487         }
2488
2489         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2490                                      m, acx_buf_dma_addr, &paddr,
2491                                      BUS_DMA_NOWAIT);
2492         if (error && error != EFBIG) {
2493                 if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf1 %d\n", error);
2494                 goto back;
2495         }
2496
2497         if (error) {    /* error == EFBIG */
2498                 struct mbuf *m_new;
2499
2500                 m_new = m_defrag(m, MB_DONTWAIT);
2501                 if (m_new == NULL) {
2502                         if_printf(&sc->sc_ic.ic_if, "can't defrag tx mbuf\n");
2503                         error = ENOBUFS;
2504                         goto back;
2505                 } else {
2506                         m = m_new;
2507                 }
2508
2509                 error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag,
2510                                              txbuf->tb_mbuf_dmamap, m,
2511                                              acx_buf_dma_addr, &paddr,
2512                                              BUS_DMA_NOWAIT);
2513                 if (error) {
2514                         if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf2 %d\n",
2515                                   error);
2516                         goto back;
2517                 }
2518         }
2519
2520         error = 0;
2521
2522         bus_dmamap_sync(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2523                         BUS_DMASYNC_PREWRITE);
2524
2525         txbuf->tb_mbuf = m;
2526         txbuf->tb_node = node;
2527         txbuf->tb_rate = rate;
2528
2529         /*
2530          * TX buffers are accessed in following way:
2531          * acx_fw_txdesc -> acx_host_desc -> buffer
2532          *
2533          * It is quite strange that acx also querys acx_host_desc next to
2534          * the one we have assigned to acx_fw_txdesc even if first one's
2535          * acx_host_desc.h_data_len == acx_fw_txdesc.f_tx_len
2536          *
2537          * So we allocate two acx_host_desc for one acx_fw_txdesc and
2538          * assign the first acx_host_desc to acx_fw_txdesc
2539          *
2540          * For acx111
2541          * host_desc1.h_data_len = buffer_len
2542          * host_desc2.h_data_len = buffer_len - mac_header_len
2543          *
2544          * For acx100
2545          * host_desc1.h_data_len = mac_header_len
2546          * host_desc2.h_data_len = buffer_len - mac_header_len
2547          */
2548
2549         txbuf->tb_desc1->h_data_paddr = htole32(paddr);
2550         txbuf->tb_desc2->h_data_paddr = htole32(paddr + ACX_FRAME_HDRLEN);
2551
2552         txbuf->tb_desc1->h_data_len =
2553                 htole16(sc->chip_txdesc1_len ? sc->chip_txdesc1_len
2554                                              : m->m_pkthdr.len);
2555         txbuf->tb_desc2->h_data_len =
2556                 htole16(m->m_pkthdr.len - ACX_FRAME_HDRLEN);
2557
2558         /*
2559          * NOTE:
2560          * We can't simply assign f_tx_ctrl, we will first read it back
2561          * and change it bit by bit
2562          */
2563         ctrl = FW_TXDESC_GETFIELD_1(sc, txbuf, f_tx_ctrl);
2564         ctrl |= sc->chip_fw_txdesc_ctrl; /* extra chip specific flags */
2565         ctrl &= ~(DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE);
2566
2567         FW_TXDESC_SETFIELD_4(sc, txbuf, f_tx_len, m->m_pkthdr.len);
2568         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_error, 0);
2569         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ack_fail, 0);
2570         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_fail, 0);
2571         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_ok, 0);
2572         sc->chip_set_fw_txdesc_rate(sc, txbuf, rate);
2573
2574         txbuf->tb_desc1->h_ctrl = 0;
2575         txbuf->tb_desc2->h_ctrl = 0;
2576         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2577                         BUS_DMASYNC_PREWRITE);
2578
2579         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl2, 0);
2580         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl, ctrl);
2581
2582         /* Tell chip to inform us about TX completion */
2583         CSR_WRITE_2(sc, ACXREG_INTR_TRIG, ACXRV_TRIG_TX_FINI);
2584 back:
2585         if (error)
2586                 m_freem(m);
2587         return error;
2588 }
2589
2590 static int
2591 acx_set_null_tmplt(struct acx_softc *sc)
2592 {
2593         struct acx_tmplt_null_data n;
2594         struct ieee80211_frame *f;
2595
2596         bzero(&n, sizeof(n));
2597
2598         f = &n.data;
2599         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
2600         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2601         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2602         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2603
2604         return _acx_set_null_data_tmplt(sc, &n, sizeof(n));
2605 }
2606
2607 static int
2608 acx_set_probe_req_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len)
2609 {
2610         struct acx_tmplt_probe_req req;
2611         struct ieee80211_frame *f;
2612         uint8_t *v;
2613         int vlen;
2614
2615         bzero(&req, sizeof(req));
2616
2617         f = &req.data.u_data.f;
2618         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
2619         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2620         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2621         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2622
2623         v = req.data.u_data.var;
2624         v = ieee80211_add_ssid(v, ssid, ssid_len);
2625         v = ieee80211_add_rates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2626         v = ieee80211_add_xrates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2627         vlen = v - req.data.u_data.var;
2628
2629         return _acx_set_probe_req_tmplt(sc, &req,
2630                                         ACX_TMPLT_PROBE_REQ_SIZ(vlen));
2631 }
2632
2633 static int
2634 acx_set_probe_resp_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len,
2635                          int chan)
2636 {
2637         struct acx_tmplt_probe_resp resp;
2638         struct ieee80211_frame *f;
2639         struct ieee80211com *ic;
2640         uint8_t *v;
2641         int vlen;
2642
2643         ic = &sc->sc_ic;
2644
2645         bzero(&resp, sizeof(resp));
2646
2647         f = &resp.data.u_data.f;
2648         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_PROBE_RESP | IEEE80211_FC0_TYPE_MGT;
2649         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2650         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&ic->ic_if));
2651         IEEE80211_ADDR_COPY(f->i_addr3, IF_LLADDR(&ic->ic_if));
2652
2653         resp.data.u_data.beacon_intvl = htole16(acx_beacon_intvl);
2654         resp.data.u_data.cap = htole16(IEEE80211_CAPINFO_IBSS);
2655
2656         v = resp.data.u_data.var;
2657         v = ieee80211_add_ssid(v, ssid, ssid_len);
2658         v = ieee80211_add_rates(v, &ic->ic_sup_rates[sc->chip_phymode]);
2659
2660         *v++ = IEEE80211_ELEMID_DSPARMS;
2661         *v++ = 1;
2662         *v++ = chan;
2663
2664         /* This should after IBSS or TIM, but acx always keeps them last */
2665         v = ieee80211_add_xrates(v, &ic->ic_sup_rates[sc->chip_phymode]);
2666
2667         if (ic->ic_opmode == IEEE80211_M_IBSS) {
2668                 *v++ = IEEE80211_ELEMID_IBSSPARMS;
2669                 *v++ = 2;
2670         }
2671
2672         vlen = v - resp.data.u_data.var;
2673
2674         return _acx_set_probe_resp_tmplt(sc, &resp,
2675                                          ACX_TMPLT_PROBE_RESP_SIZ(vlen));
2676 }
2677
2678 /* XXX C&P of acx_set_probe_resp_tmplt() */
2679 static int
2680 acx_set_beacon_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len,
2681                      int chan)
2682 {
2683         struct acx_tmplt_beacon beacon;
2684         struct ieee80211_frame *f;
2685         struct ieee80211com *ic;
2686         uint8_t *v;
2687         int vlen;
2688
2689         ic = &sc->sc_ic;
2690
2691         bzero(&beacon, sizeof(beacon));
2692
2693         f = &beacon.data.u_data.f;
2694         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_BEACON | IEEE80211_FC0_TYPE_MGT;
2695         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2696         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&ic->ic_if));
2697         IEEE80211_ADDR_COPY(f->i_addr3, IF_LLADDR(&ic->ic_if));
2698
2699         beacon.data.u_data.beacon_intvl = htole16(acx_beacon_intvl);
2700         beacon.data.u_data.cap = htole16(IEEE80211_CAPINFO_IBSS);
2701
2702         v = beacon.data.u_data.var;
2703         v = ieee80211_add_ssid(v, ssid, ssid_len);
2704         v = ieee80211_add_rates(v, &ic->ic_sup_rates[sc->chip_phymode]);
2705
2706         *v++ = IEEE80211_ELEMID_DSPARMS;
2707         *v++ = 1;
2708         *v++ = chan;
2709
2710         /* This should after IBSS or TIM, but acx always keeps them last */
2711         v = ieee80211_add_xrates(v, &ic->ic_sup_rates[sc->chip_phymode]);
2712
2713         if (ic->ic_opmode == IEEE80211_M_IBSS) {
2714                 *v++ = IEEE80211_ELEMID_IBSSPARMS;
2715                 *v++ = 2;
2716         }
2717
2718         vlen = v - beacon.data.u_data.var;
2719
2720         return _acx_set_beacon_tmplt(sc, &beacon, ACX_TMPLT_BEACON_SIZ(vlen));
2721 }
2722
2723 static int
2724 acx_sysctl_txrate_upd_intvl_min(SYSCTL_HANDLER_ARGS)
2725 {
2726         struct acx_softc *sc = arg1;
2727         struct ifnet *ifp = &sc->sc_ic.ic_if;
2728         int error = 0, v;
2729
2730         lwkt_serialize_enter(ifp->if_serializer);
2731
2732         v = sc->sc_txrate_upd_intvl_min;
2733         error = sysctl_handle_int(oidp, &v, 0, req);
2734         if (error || req->newptr == NULL)
2735                 goto back;
2736         if (v <= 0 || v > sc->sc_txrate_upd_intvl_max) {
2737                 error = EINVAL;
2738                 goto back;
2739         }
2740
2741         sc->sc_txrate_upd_intvl_min = v;
2742 back:
2743         lwkt_serialize_exit(ifp->if_serializer);
2744         return error;
2745 }
2746
2747 static int
2748 acx_sysctl_txrate_upd_intvl_max(SYSCTL_HANDLER_ARGS)
2749 {
2750         struct acx_softc *sc = arg1;
2751         struct ifnet *ifp = &sc->sc_ic.ic_if;
2752         int error = 0, v;
2753
2754         lwkt_serialize_enter(ifp->if_serializer);
2755
2756         v = sc->sc_txrate_upd_intvl_max;
2757         error = sysctl_handle_int(oidp, &v, 0, req);
2758         if (error || req->newptr == NULL)
2759                 goto back;
2760         if (v <= 0 || v < sc->sc_txrate_upd_intvl_min) {
2761                 error = EINVAL;
2762                 goto back;
2763         }
2764
2765         sc->sc_txrate_upd_intvl_max = v;
2766 back:
2767         lwkt_serialize_exit(ifp->if_serializer);
2768         return error;
2769 }
2770
2771 static int
2772 acx_sysctl_txrate_sample_thresh(SYSCTL_HANDLER_ARGS)
2773 {
2774         struct acx_softc *sc = arg1;
2775         struct ifnet *ifp = &sc->sc_ic.ic_if;
2776         int error = 0, v;
2777
2778         lwkt_serialize_enter(ifp->if_serializer);
2779
2780         v = sc->sc_txrate_sample_thresh;
2781         error = sysctl_handle_int(oidp, &v, 0, req);
2782         if (error || req->newptr == NULL)
2783                 goto back;
2784         if (v <= 0) {
2785                 error = EINVAL;
2786                 goto back;
2787         }
2788
2789         sc->sc_txrate_sample_thresh = v;
2790 back:
2791         lwkt_serialize_exit(ifp->if_serializer);
2792         return error;
2793 }
2794
2795 static int
2796 acx_sysctl_long_retry_limit(SYSCTL_HANDLER_ARGS)
2797 {
2798         struct acx_softc *sc = arg1;
2799         struct ifnet *ifp = &sc->sc_ic.ic_if;
2800         int error = 0, v;
2801
2802         lwkt_serialize_enter(ifp->if_serializer);
2803
2804         v = sc->sc_long_retry_limit;
2805         error = sysctl_handle_int(oidp, &v, 0, req);
2806         if (error || req->newptr == NULL)
2807                 goto back;
2808         if (v <= 0) {
2809                 error = EINVAL;
2810                 goto back;
2811         }
2812
2813         if (sc->sc_flags & ACX_FLAG_FW_LOADED) {
2814                 struct acx_conf_nretry_long lretry;
2815
2816                 lretry.nretry = v;
2817                 if (acx_set_nretry_long_conf(sc, &lretry) != 0) {
2818                         if_printf(ifp, "can't set long retry limit\n");
2819                         error = ENXIO;
2820                         goto back;
2821                 }
2822         }
2823         sc->sc_long_retry_limit = v;
2824 back:
2825         lwkt_serialize_exit(ifp->if_serializer);
2826         return error;
2827 }
2828
2829 static int
2830 acx_sysctl_short_retry_limit(SYSCTL_HANDLER_ARGS)
2831 {
2832         struct acx_softc *sc = arg1;
2833         struct ifnet *ifp = &sc->sc_ic.ic_if;
2834         int error = 0, v;
2835
2836         lwkt_serialize_enter(ifp->if_serializer);
2837
2838         v = sc->sc_short_retry_limit;
2839         error = sysctl_handle_int(oidp, &v, 0, req);
2840         if (error || req->newptr == NULL)
2841                 goto back;
2842         if (v <= 0) {
2843                 error = EINVAL;
2844                 goto back;
2845         }
2846
2847         if (sc->sc_flags & ACX_FLAG_FW_LOADED) {
2848                 struct acx_conf_nretry_short sretry;
2849
2850                 sretry.nretry = v;
2851                 if (acx_set_nretry_short_conf(sc, &sretry) != 0) {
2852                         if_printf(ifp, "can't set short retry limit\n");
2853                         error = ENXIO;
2854                         goto back;
2855                 }
2856         }
2857         sc->sc_short_retry_limit = v;
2858 back:
2859         lwkt_serialize_exit(ifp->if_serializer);
2860         return error;
2861 }
2862
2863 static int
2864 acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS)
2865 {
2866         struct acx_softc *sc = arg1;
2867         struct ifnet *ifp = &sc->sc_ic.ic_if;
2868         int error = 0, v;
2869
2870         lwkt_serialize_enter(ifp->if_serializer);
2871
2872         v = sc->sc_msdu_lifetime;
2873         error = sysctl_handle_int(oidp, &v, 0, req);
2874         if (error || req->newptr == NULL)
2875                 goto back;
2876         if (v <= 0) {
2877                 error = EINVAL;
2878                 goto back;
2879         }
2880
2881         if (sc->sc_flags & ACX_FLAG_FW_LOADED) {
2882                 struct acx_conf_msdu_lifetime msdu_lifetime;
2883
2884                 msdu_lifetime.lifetime = htole32(v);
2885                 if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
2886                         if_printf(&sc->sc_ic.ic_if,
2887                                   "can't set MSDU lifetime\n");
2888                         error = ENXIO;
2889                         goto back;
2890                 }
2891         }
2892         sc->sc_msdu_lifetime = v;
2893 back:
2894         lwkt_serialize_exit(ifp->if_serializer);
2895         return error;
2896 }