sys/dev/netif/acx/if_acx.c

   1 /*
   2  * Copyright (c) 2006 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Sepherosa Ziehau <sepherosa@gmail.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  */
  35
  36 /*
  37  * Copyright (c) 2003-2004 wlan.kewl.org Project
  38  * All rights reserved.
  39  *
  40  * $Id: LICENSE,v 1.1.1.1 2004/07/01 12:20:39 darron Exp $
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  *
  46  * 1. Redistributions of source code must retain the above copyright
  47  *    notice, this list of conditions and the following disclaimer.
  48  *
  49  * 2. Redistributions in binary form must reproduce the above copyright
  50  *    notice, this list of conditions and the following disclaimer in the
  51  *    documentation and/or other materials provided with the distribution.
  52  *
  53  * 3. All advertising materials mentioning features or use of this software
  54  *    must display the following acknowledgement:
  55  *
  56  *    This product includes software developed by the wlan.kewl.org Project.
  57  *
  58  * 4. Neither the name of the wlan.kewl.org Project nor the names of its
  59  *    contributors may be used to endorse or promote products derived from
  60  *    this software without specific prior written permission.
  61  *
  62  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  63  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
  64  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
  65  * THE wlan.kewl.org Project BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  66  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  67  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  68  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  69  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  70  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  71  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  72  */
  73
  74 #include <sys/param.h>
  75 #include <sys/endian.h>
  76 #include <sys/kernel.h>
  77 #include <sys/bus.h>
  78 #include <sys/firmware.h>
  79 #include <sys/interrupt.h>
  80 #include <sys/malloc.h>
  81 #include <sys/proc.h>
  82 #include <sys/rman.h>
  83 #include <sys/serialize.h>
  84 #include <sys/socket.h>
  85 #include <sys/sockio.h>
  86 #include <sys/sysctl.h>
  87
  88 #include <net/ethernet.h>
  89 #include <net/if.h>
  90 #include <net/bpf.h>
  91 #include <net/if_arp.h>
  92 #include <net/if_dl.h>
  93 #include <net/if_media.h>
  94 #include <net/ifq_var.h>
  95
  96 #include <netproto/802_11/ieee80211_var.h>
  97 #include <netproto/802_11/ieee80211_radiotap.h>
  98 #include <netproto/802_11/wlan_ratectl/amrr/ieee80211_amrr_param.h>
  99 #include <netproto/802_11/wlan_ratectl/onoe/ieee80211_onoe_param.h>
 100
 101 #include <bus/pci/pcireg.h>
 102 #include <bus/pci/pcivar.h>
 103 #include "pcidevs.h"
 104
 105 #define ACX_DEBUG
 106
 107 #include <dev/netif/acx/if_acxreg.h>
 108 #include <dev/netif/acx/if_acxvar.h>
 109 #include <dev/netif/acx/acxcmd.h>
 110
 111 static int      acx_probe(device_t);
 112 static int      acx_attach(device_t);
 113 static int      acx_detach(device_t);
 114 static int      acx_shutdown(device_t);
 115
 116 static void     acx_init(void *);
 117 static void     acx_start(struct ifnet *, struct ifaltq_subque *);
 118 static int      acx_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 119 static void     acx_watchdog(struct ifnet *);
 120
 121 static void     acx_intr(void *);
 122 static void     acx_txeof(struct acx_softc *);
 123 static void     acx_txerr(struct acx_softc *, uint8_t);
 124 static void     acx_rxeof(struct acx_softc *);
 125 static void     acx_disable_intr(struct acx_softc *);
 126 static void     acx_enable_intr(struct acx_softc *);
 127
 128 static int      acx_reset(struct acx_softc *);
 129 static int      acx_stop(struct acx_softc *);
 130 static void     acx_init_info_reg(struct acx_softc *);
 131 static int      acx_config(struct acx_softc *);
 132 static int      acx_read_config(struct acx_softc *, struct acx_config *);
 133 static int      acx_write_config(struct acx_softc *, struct acx_config *);
 134 static int      acx_rx_config(struct acx_softc *, int);
 135 static int      acx_set_crypt_keys(struct acx_softc *);
 136 static void     acx_calibrate(void *);
 137
 138 static int      acx_dma_alloc(struct acx_softc *);
 139 static void     acx_dma_free(struct acx_softc *);
 140 static int      acx_init_tx_ring(struct acx_softc *);
 141 static int      acx_init_rx_ring(struct acx_softc *);
 142 static int      acx_newbuf(struct acx_softc *, struct acx_rxbuf *, int);
 143 static int      acx_encap(struct acx_softc *, struct acx_txbuf *,
 144                           struct mbuf *, struct ieee80211_node *);
 145
 146 static int      acx_set_null_tmplt(struct acx_softc *);
 147 static int      acx_set_probe_req_tmplt(struct acx_softc *, const char *, int);
 148 static int      acx_set_probe_resp_tmplt(struct acx_softc *,
 149                                          struct ieee80211_node *);
 150 static int      acx_set_beacon_tmplt(struct acx_softc *,
 151                                      struct ieee80211_node *);
 152
 153 static int      acx_read_eeprom(struct acx_softc *, uint32_t, uint8_t *);
 154 static int      acx_read_phyreg(struct acx_softc *, uint32_t, uint8_t *);
 155
 156 static int      acx_alloc_firmware(struct acx_softc *);
 157 static void     acx_free_firmware(struct acx_softc *);
 158 static int      acx_setup_firmware(struct acx_softc *, struct fw_image *,
 159                                    const uint8_t **, int *);
 160 static int      acx_load_firmware(struct acx_softc *, uint32_t,
 161                                   const uint8_t *, int);
 162 static int      acx_load_radio_firmware(struct acx_softc *, const uint8_t *,
 163                                         uint32_t);
 164 static int      acx_load_base_firmware(struct acx_softc *, const uint8_t *,
 165                                        uint32_t);
 166
 167 static void     acx_next_scan(void *);
 168 static int      acx_set_chan(struct acx_softc *, struct ieee80211_channel *);
 169
 170 static int      acx_media_change(struct ifnet *);
 171 static int      acx_newstate(struct ieee80211com *, enum ieee80211_state, int);
 172
 173 static int      acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS);
 174 static int      acx_sysctl_free_firmware(SYSCTL_HANDLER_ARGS);
 175
 176 const struct ieee80211_rateset  acx_rates_11b =
 177         { 4, { 2, 4, 11, 22 } };
 178 const struct ieee80211_rateset  acx_rates_11g =
 179         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
 180 const struct ieee80211_rateset  acx_rates_11b_pbcc =
 181         { 5, { 2, 4, 11, 22, 44 } };
 182 const struct ieee80211_rateset  acx_rates_11g_pbcc =
 183         { 13, { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 72, 96, 108 } };
 184
 185 int     acx_enable_pbcc = 1;
 186 TUNABLE_INT("hw.acx.enable_pbcc", &acx_enable_pbcc);
 187
 188 static const struct acx_device {
 189         uint16_t        vid;
 190         uint16_t        did;
 191         void            (*set_param)(device_t);
 192         const char      *desc;
 193 } acx_devices[] = {
 194         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100A, acx100_set_param,
 195           "Texas Instruments TNETW1100A Wireless Adapter" },
 196         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100B, acx100_set_param,
 197           "Texas Instruments TNETW1100B Wireless Adapter" },
 198         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX111, acx111_set_param,
 199           "Texas Instruments TNETW1130 Wireless Adapter" },
 200         { 0, 0, NULL, NULL }
 201 };
 202
 203 static device_method_t acx_methods[] = {
 204         DEVMETHOD(device_probe,         acx_probe),
 205         DEVMETHOD(device_attach,        acx_attach),
 206         DEVMETHOD(device_detach,        acx_detach),
 207         DEVMETHOD(device_shutdown,      acx_shutdown),
 208 #if 0
 209         DEVMETHOD(device_suspend,       acx_suspend),
 210         DEVMETHOD(device_resume,        acx_resume),
 211 #endif
 212         DEVMETHOD_END
 213 };
 214
 215 static driver_t acx_driver = {
 216         "acx",
 217         acx_methods,
 218         sizeof(struct acx_softc)
 219 };
 220
 221 static devclass_t acx_devclass;
 222
 223 DRIVER_MODULE(acx, pci, acx_driver, acx_devclass, NULL, NULL);
 224 DRIVER_MODULE(acx, cardbus, acx_driver, acx_devclass, NULL, NULL);
 225
 226 MODULE_DEPEND(acx, wlan, 1, 1, 1);
 227 MODULE_DEPEND(acx, wlan_ratectl_onoe, 1, 1, 1);
 228 MODULE_DEPEND(acx, wlan_ratectl_amrr, 1, 1, 1);
 229 MODULE_DEPEND(acx, pci, 1, 1, 1);
 230 MODULE_DEPEND(acx, cardbus, 1, 1, 1);
 231
 232 static __inline int
 233 acx_get_rssi(struct acx_softc *sc, uint8_t raw)
 234 {
 235         int rssi;
 236
 237         rssi = ((sc->chip_rssi_corr / 2) + (raw * 5)) / sc->chip_rssi_corr;
 238         return rssi > 100 ? 100 : rssi;
 239 }
 240
 241 static int
 242 acx_probe(device_t dev)
 243 {
 244         const struct acx_device *a;
 245         uint16_t did, vid;
 246
 247         vid = pci_get_vendor(dev);
 248         did = pci_get_device(dev);
 249         for (a = acx_devices; a->desc != NULL; ++a) {
 250                 if (vid == a->vid && did == a->did) {
 251                         a->set_param(dev);
 252                         device_set_desc(dev, a->desc);
 253                         return 0;
 254                 }
 255         }
 256         return ENXIO;
 257 }
 258
 259 static int
 260 acx_attach(device_t dev)
 261 {
 262         struct acx_softc *sc;
 263         struct ifnet *ifp;
 264         struct ieee80211com *ic;
 265         struct sysctl_ctx_list *sctx;
 266         struct sysctl_oid *soid;
 267         int i, error;
 268
 269         sc = device_get_softc(dev);
 270         ic = &sc->sc_ic;
 271         ifp = &ic->ic_if;
 272
 273         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 274
 275 #ifndef BURN_BRIDGES
 276         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 277                 uint32_t mem1, mem2, irq;
 278
 279                 mem1 = pci_read_config(dev, sc->chip_mem1_rid, 4);
 280                 mem2 = pci_read_config(dev, sc->chip_mem2_rid, 4);
 281                 irq = pci_read_config(dev, PCIR_INTLINE, 4);
 282
 283                 device_printf(dev, "chip is in D%d power mode "
 284                     "-- setting to D0\n", pci_get_powerstate(dev));
 285
 286                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 287
 288                 pci_write_config(dev, sc->chip_mem1_rid, mem1, 4);
 289                 pci_write_config(dev, sc->chip_mem2_rid, mem2, 4);
 290                 pci_write_config(dev, PCIR_INTLINE, irq, 4);
 291         }
 292 #endif  /* !BURN_BRIDGE */
 293
 294         /* Enable bus mastering */
 295         pci_enable_busmaster(dev);
 296
 297         /* Allocate IO memory 1 */
 298         sc->sc_mem1_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 299                                                  &sc->chip_mem1_rid,
 300                                                  RF_ACTIVE);
 301         if (sc->sc_mem1_res == NULL) {
 302                 error = ENXIO;
 303                 device_printf(dev, "can't allocate IO mem1\n");
 304                 goto fail;
 305         }
 306         sc->sc_mem1_bt = rman_get_bustag(sc->sc_mem1_res);
 307         sc->sc_mem1_bh = rman_get_bushandle(sc->sc_mem1_res);
 308
 309         /* Allocate IO memory 2 */
 310         sc->sc_mem2_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 311                                                  &sc->chip_mem2_rid,
 312                                                  RF_ACTIVE);
 313         if (sc->sc_mem2_res == NULL) {
 314                 error = ENXIO;
 315                 device_printf(dev, "can't allocate IO mem2\n");
 316                 goto fail;
 317         }
 318         sc->sc_mem2_bt = rman_get_bustag(sc->sc_mem2_res);
 319         sc->sc_mem2_bh = rman_get_bushandle(sc->sc_mem2_res);
 320
 321         /* Allocate irq */
 322         sc->sc_irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 323                                                 &sc->sc_irq_rid,
 324                                                 RF_SHAREABLE | RF_ACTIVE);
 325         if (sc->sc_irq_res == NULL) {
 326                 error = ENXIO;
 327                 device_printf(dev, "can't allocate intr\n");
 328                 goto fail;
 329         }
 330
 331         /* Initialize channel scanning timer */
 332         callout_init(&sc->sc_scan_timer);
 333
 334         /* Initialize calibration timer */
 335         callout_init(&sc->sc_calibrate_timer);
 336
 337         /* Allocate busdma stuffs */
 338         error = acx_dma_alloc(sc);
 339         if (error)
 340                 goto fail;
 341
 342         /* Reset Hardware */
 343         error = acx_reset(sc);
 344         if (error)
 345                 goto fail;
 346
 347         /* Disable interrupts before firmware is loaded */
 348         acx_disable_intr(sc);
 349
 350         /* Get radio type and form factor */
 351 #define EEINFO_RETRY_MAX        50
 352         for (i = 0; i < EEINFO_RETRY_MAX; ++i) {
 353                 uint16_t ee_info;
 354
 355                 ee_info = CSR_READ_2(sc, ACXREG_EEPROM_INFO);
 356                 if (ACX_EEINFO_HAS_RADIO_TYPE(ee_info)) {
 357                         sc->sc_form_factor = ACX_EEINFO_FORM_FACTOR(ee_info);
 358                         sc->sc_radio_type = ACX_EEINFO_RADIO_TYPE(ee_info);
 359                         break;
 360                 }
 361                 DELAY(10000);
 362         }
 363         if (i == EEINFO_RETRY_MAX) {
 364                 error = ENXIO;
 365                 goto fail;
 366         }
 367 #undef EEINFO_RETRY_MAX
 368
 369         DPRINTF((&sc->sc_ic.ic_if, "radio type %02x\n", sc->sc_radio_type));
 370
 371 #ifdef DUMP_EEPROM
 372         for (i = 0; i < 0x40; ++i) {
 373                 uint8_t val;
 374
 375                 error = acx_read_eeprom(sc, i, &val);
 376                 if (i % 10 == 0)
 377                         kprintf("\n");
 378                 kprintf("%02x ", val);
 379         }
 380         kprintf("\n");
 381 #endif  /* DUMP_EEPROM */
 382
 383         /* Get EEPROM version */
 384         error = acx_read_eeprom(sc, ACX_EE_VERSION_OFS, &sc->sc_eeprom_ver);
 385         if (error)
 386                 goto fail;
 387         DPRINTF((&sc->sc_ic.ic_if, "EEPROM version %u\n", sc->sc_eeprom_ver));
 388
 389         /*
 390          * Initialize device sysctl before ieee80211_ifattach()
 391          */
 392         sc->sc_long_retry_limit = 4;
 393         sc->sc_msdu_lifetime = 4096;
 394         sc->sc_scan_dwell = 200;        /* 200 milliseconds */
 395         sc->sc_calib_intvl = 3 * 60;    /* 3 minutes */
 396
 397         sctx = device_get_sysctl_ctx(dev);
 398         soid = device_get_sysctl_tree(dev);
 399         SYSCTL_ADD_PROC(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 400                         "msdu_lifetime", CTLTYPE_INT | CTLFLAG_RW,
 401                         sc, 0, acx_sysctl_msdu_lifetime, "I",
 402                         "MSDU life time");
 403         SYSCTL_ADD_INT(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 404                        "long_retry_limit", CTLFLAG_RW,
 405                        &sc->sc_long_retry_limit, 0, "Long retry limit");
 406         SYSCTL_ADD_INT(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 407                        "scan_dwell", CTLFLAG_RW,
 408                        &sc->sc_scan_dwell, 0, "Scan channel dwell time (ms)");
 409         SYSCTL_ADD_INT(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 410                        "calib_intvl", CTLFLAG_RW,
 411                        &sc->sc_calib_intvl, 0, "Calibration interval (second)");
 412
 413         /*
 414          * Nodes for firmware operation
 415          */
 416         SYSCTL_ADD_INT(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 417                        "combined_radio_fw", CTLFLAG_RW,
 418                        &sc->sc_firmware.combined_radio_fw, 0,
 419                        "Radio and base firmwares are combined");
 420         SYSCTL_ADD_PROC(sctx, SYSCTL_CHILDREN(soid), OID_AUTO, "free_fw",
 421                         CTLTYPE_INT | CTLFLAG_RW,
 422                         sc, 0, acx_sysctl_free_firmware, "I",
 423                         "Free firmware");
 424
 425         /*
 426          * Nodes for statistics
 427          */
 428         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 429                          "frag_error", CTLFLAG_RW, &sc->sc_stats.err_oth_frag,
 430                          0, "Fragment errors");
 431         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 432                          "tx_abort", CTLFLAG_RW, &sc->sc_stats.err_abort,
 433                          0, "TX abortions");
 434         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 435                          "tx_invalid", CTLFLAG_RW, &sc->sc_stats.err_param,
 436                          0, "Invalid TX param in TX descriptor");
 437         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 438                          "no_wepkey", CTLFLAG_RW, &sc->sc_stats.err_no_wepkey,
 439                          0, "No WEP key exists");
 440         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 441                          "msdu_timeout", CTLFLAG_RW,
 442                          &sc->sc_stats.err_msdu_timeout,
 443                          0, "MSDU timeouts");
 444         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 445                          "ex_txretry", CTLFLAG_RW, &sc->sc_stats.err_ex_retry,
 446                          0, "Excessive TX retries");
 447         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 448                          "buf_oflow", CTLFLAG_RW, &sc->sc_stats.err_buf_oflow,
 449                          0, "Buffer overflows");
 450         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 451                          "dma_error", CTLFLAG_RW, &sc->sc_stats.err_dma,
 452                          0, "DMA errors");
 453         SYSCTL_ADD_UQUAD(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
 454                          "unkn_error", CTLFLAG_RW, &sc->sc_stats.err_unkn,
 455                          0, "Unknown errors");
 456
 457         ifp->if_softc = sc;
 458         ifp->if_init = acx_init;
 459         ifp->if_ioctl = acx_ioctl;
 460         ifp->if_start = acx_start;
 461         ifp->if_watchdog = acx_watchdog;
 462         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
 463         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 464 #ifdef notyet
 465         ifq_set_ready(&ifp->if_snd);
 466 #endif
 467
 468         /* Set channels */
 469         for (i = 1; i <= 14; ++i) {
 470                 ic->ic_channels[i].ic_freq =
 471                         ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 472                 ic->ic_channels[i].ic_flags = sc->chip_chan_flags;
 473         }
 474
 475         ic->ic_opmode = IEEE80211_M_STA;
 476         ic->ic_state = IEEE80211_S_INIT;
 477
 478         /*
 479          * NOTE: Don't overwrite ic_caps set by chip specific code
 480          */
 481         ic->ic_caps |= IEEE80211_C_WEP |        /* WEP */
 482                        IEEE80211_C_HOSTAP |     /* HostAP mode */
 483                        IEEE80211_C_MONITOR |    /* Monitor mode */
 484                        IEEE80211_C_IBSS |       /* IBSS modes */
 485                        IEEE80211_C_SHPREAMBLE;  /* Short preamble */
 486         if (acx_enable_pbcc)
 487                 ic->ic_caps_ext = IEEE80211_CEXT_PBCC;  /* PBCC modulation */
 488
 489         /* Get station id */
 490         for (i = 0; i < IEEE80211_ADDR_LEN; ++i) {
 491                 error = acx_read_eeprom(sc, sc->chip_ee_eaddr_ofs - i,
 492                                         &ic->ic_myaddr[i]);
 493         }
 494
 495         ieee80211_ifattach(ic);
 496
 497         /* Enable software beacon missing */
 498         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 499
 500         /* Override newstate */
 501         sc->sc_newstate = ic->ic_newstate;
 502         ic->ic_newstate = acx_newstate;
 503
 504         ieee80211_media_init(ic, acx_media_change, ieee80211_media_status);
 505
 506         /*
 507          * Radio tap attaching
 508          */
 509         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 510                       sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
 511                       &sc->sc_drvbpf);
 512
 513         sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(uint32_t));
 514         sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
 515         sc->sc_tx_th.wt_ihdr.it_present = htole32(ACX_TX_RADIOTAP_PRESENT);
 516
 517         sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(uint32_t));
 518         sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
 519         sc->sc_rx_th.wr_ihdr.it_present = htole32(ACX_RX_RADIOTAP_PRESENT);
 520
 521         ifq_set_cpuid(&ifp->if_snd, rman_get_cpuid(sc->sc_irq_res));
 522
 523         error = bus_setup_intr(dev, sc->sc_irq_res, INTR_MPSAFE, acx_intr, sc,
 524                                &sc->sc_irq_handle, ifp->if_serializer);
 525         if (error) {
 526                 device_printf(dev, "can't set up interrupt\n");
 527                 bpfdetach(ifp);
 528                 ieee80211_ifdetach(ic);
 529                 goto fail;
 530         }
 531
 532         if (bootverbose)
 533                 ieee80211_announce(ic);
 534
 535         return 0;
 536 fail:
 537         acx_detach(dev);
 538         return error;
 539 }
 540
 541 static int
 542 acx_detach(device_t dev)
 543 {
 544         struct acx_softc *sc = device_get_softc(dev);
 545
 546         if (device_is_attached(dev)) {
 547                 struct ieee80211com *ic = &sc->sc_ic;
 548                 struct ifnet *ifp = &ic->ic_if;
 549
 550                 lwkt_serialize_enter(ifp->if_serializer);
 551
 552                 acx_stop(sc);
 553                 acx_free_firmware(sc);
 554                 bus_teardown_intr(dev, sc->sc_irq_res, sc->sc_irq_handle);
 555
 556                 lwkt_serialize_exit(ifp->if_serializer);
 557
 558                 bpfdetach(ifp);
 559                 ieee80211_ifdetach(ic);
 560         }
 561
 562         if (sc->sc_irq_res != NULL) {
 563                 bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
 564                                      sc->sc_irq_res);
 565         }
 566         if (sc->sc_mem1_res != NULL) {
 567                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem1_rid,
 568                                      sc->sc_mem1_res);
 569         }
 570         if (sc->sc_mem2_res != NULL) {
 571                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem2_rid,
 572                                      sc->sc_mem2_res);
 573         }
 574
 575         acx_dma_free(sc);
 576         return 0;
 577 }
 578
 579 static int
 580 acx_shutdown(device_t dev)
 581 {
 582         struct acx_softc *sc = device_get_softc(dev);
 583
 584         lwkt_serialize_enter(sc->sc_ic.ic_if.if_serializer);
 585         acx_stop(sc);
 586         lwkt_serialize_exit(sc->sc_ic.ic_if.if_serializer);
 587         return 0;
 588 }
 589
 590 static void
 591 acx_init(void *arg)
 592 {
 593         struct acx_softc *sc = arg;
 594         struct ieee80211com *ic = &sc->sc_ic;
 595         struct ifnet *ifp = &ic->ic_if;
 596         struct acx_firmware *fw = &sc->sc_firmware;
 597         int error;
 598
 599         error = acx_stop(sc);
 600         if (error)
 601                 return;
 602
 603         error = acx_alloc_firmware(sc);
 604         if (error)
 605                 return;
 606
 607         error = acx_init_tx_ring(sc);
 608         if (error) {
 609                 if_printf(ifp, "can't initialize TX ring\n");
 610                 goto back;
 611         }
 612
 613         error = acx_init_rx_ring(sc);
 614         if (error) {
 615                 if_printf(ifp, "can't initialize RX ring\n");
 616                 goto back;
 617         }
 618
 619         error = acx_load_base_firmware(sc, fw->base_fw, fw->base_fw_len);
 620         if (error)
 621                 goto back;
 622
 623         /*
 624          * Initialize command and information registers
 625          * NOTE: This should be done after base firmware is loaded
 626          */
 627         acx_init_cmd_reg(sc);
 628         acx_init_info_reg(sc);
 629
 630         sc->sc_flags |= ACX_FLAG_FW_LOADED;
 631
 632 #if 0
 633         if (sc->chip_post_basefw != NULL) {
 634                 error = sc->chip_post_basefw(sc);
 635                 if (error)
 636                         goto back;
 637         }
 638 #endif
 639
 640         if (fw->radio_fw != NULL) {
 641                 error = acx_load_radio_firmware(sc, fw->radio_fw,
 642                                                 fw->radio_fw_len);
 643                 if (error)
 644                         goto back;
 645         }
 646
 647         error = sc->chip_init(sc);
 648         if (error)
 649                 goto back;
 650
 651         /* Get and set device various configuration */
 652         error = acx_config(sc);
 653         if (error)
 654                 goto back;
 655
 656         /* Setup crypto stuffs */
 657         if (sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) {
 658                 error = acx_set_crypt_keys(sc);
 659                 if (error)
 660                         goto back;
 661                 sc->sc_ic.ic_flags &= ~IEEE80211_F_DROPUNENC;
 662         }
 663
 664         /* Turn on power led */
 665         CSR_CLRB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 666
 667         acx_enable_intr(sc);
 668
 669         ifp->if_flags |= IFF_RUNNING;
 670         ifq_clr_oactive(&ifp->if_snd);
 671
 672         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 673                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 674                         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_SCAN, -1);
 675         } else {
 676                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 677         }
 678 back:
 679         if (error)
 680                 acx_stop(sc);
 681 }
 682
 683 static void
 684 acx_init_info_reg(struct acx_softc *sc)
 685 {
 686         sc->sc_info = CSR_READ_4(sc, ACXREG_INFO_REG_OFFSET);
 687         sc->sc_info_param = sc->sc_info + ACX_INFO_REG_SIZE;
 688 }
 689
 690 static int
 691 acx_set_crypt_keys(struct acx_softc *sc)
 692 {
 693         struct ieee80211com *ic = &sc->sc_ic;
 694         struct acx_conf_wep_txkey wep_txkey;
 695         int i, error, got_wk = 0;
 696
 697         for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
 698                 struct ieee80211_key *wk = &ic->ic_nw_keys[i];
 699
 700                 if (wk->wk_keylen == 0)
 701                         continue;
 702
 703                 if (sc->chip_hw_crypt) {
 704                         error = sc->chip_set_wepkey(sc, wk, i);
 705                         if (error)
 706                                 return error;
 707                         got_wk = 1;
 708                 } else if (wk->wk_flags & IEEE80211_KEY_XMIT) {
 709                         wk->wk_flags |= IEEE80211_KEY_SWCRYPT;
 710                 }
 711         }
 712
 713         if (!got_wk || sc->chip_hw_crypt ||
 714             ic->ic_def_txkey == IEEE80211_KEYIX_NONE)
 715                 return 0;
 716
 717         /* Set current WEP key index */
 718         wep_txkey.wep_txkey = ic->ic_def_txkey;
 719         if (acx_set_wep_txkey_conf(sc, &wep_txkey) != 0) {
 720                 if_printf(&ic->ic_if, "set WEP txkey failed\n");
 721                 return ENXIO;
 722         }
 723         return 0;
 724 }
 725
 726 static void
 727 acx_next_scan(void *arg)
 728 {
 729         struct acx_softc *sc = arg;
 730         struct ieee80211com *ic = &sc->sc_ic;
 731         struct ifnet *ifp = &ic->ic_if;
 732
 733         lwkt_serialize_enter(ifp->if_serializer);
 734
 735         if (ic->ic_state == IEEE80211_S_SCAN)
 736                 ieee80211_next_scan(ic);
 737
 738         lwkt_serialize_exit(ifp->if_serializer);
 739 }
 740
 741 static int
 742 acx_stop(struct acx_softc *sc)
 743 {
 744         struct ieee80211com *ic = &sc->sc_ic;
 745         struct ifnet *ifp = &ic->ic_if;
 746         struct acx_buf_data *bd = &sc->sc_buf_data;
 747         struct acx_ring_data *rd = &sc->sc_ring_data;
 748         int i, error;
 749
 750         ASSERT_SERIALIZED(ifp->if_serializer);
 751
 752         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
 753
 754         sc->sc_firmware_ver = 0;
 755         sc->sc_hardware_id = 0;
 756
 757         /* Reset hardware */
 758         error = acx_reset(sc);
 759         if (error)
 760                 return error;
 761
 762         /* Firmware no longer functions after hardware reset */
 763         sc->sc_flags &= ~ACX_FLAG_FW_LOADED;
 764
 765         acx_disable_intr(sc);
 766
 767         /* Stop backgroud scanning */
 768         callout_stop(&sc->sc_scan_timer);
 769
 770         /* Turn off power led */
 771         CSR_SETB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 772
 773         /* Free TX mbuf */
 774         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
 775                 struct acx_txbuf *buf;
 776
 777                 buf = &bd->tx_buf[i];
 778
 779                 if (buf->tb_mbuf != NULL) {
 780                         bus_dmamap_unload(bd->mbuf_dma_tag,
 781                                           buf->tb_mbuf_dmamap);
 782                         m_freem(buf->tb_mbuf);
 783                         buf->tb_mbuf = NULL;
 784                 }
 785
 786                 if (buf->tb_node != NULL)
 787                         ieee80211_free_node(buf->tb_node);
 788                 buf->tb_node = NULL;
 789         }
 790
 791         /* Clear TX host descriptors */
 792         bzero(rd->tx_ring, ACX_TX_RING_SIZE);
 793
 794         /* Free RX mbuf */
 795         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
 796                 if (bd->rx_buf[i].rb_mbuf != NULL) {
 797                         bus_dmamap_unload(bd->mbuf_dma_tag,
 798                                           bd->rx_buf[i].rb_mbuf_dmamap);
 799                         m_freem(bd->rx_buf[i].rb_mbuf);
 800                         bd->rx_buf[i].rb_mbuf = NULL;
 801                 }
 802         }
 803
 804         /* Clear RX host descriptors */
 805         bzero(rd->rx_ring, ACX_RX_RING_SIZE);
 806
 807         sc->sc_tx_timer = 0;
 808         ifp->if_timer = 0;
 809         ifp->if_flags &= ~IFF_RUNNING;
 810         ifq_clr_oactive(&ifp->if_snd);
 811
 812         return 0;
 813 }
 814
 815 static int
 816 acx_config(struct acx_softc *sc)
 817 {
 818         struct acx_config conf;
 819         int error;
 820
 821         error = acx_read_config(sc, &conf);
 822         if (error)
 823                 return error;
 824
 825         error = acx_write_config(sc, &conf);
 826         if (error)
 827                 return error;
 828
 829         error = acx_rx_config(sc, sc->sc_flags & ACX_FLAG_PROMISC);
 830         if (error)
 831                 return error;
 832
 833         if (acx_set_probe_req_tmplt(sc, "", 0) != 0) {
 834                 if_printf(&sc->sc_ic.ic_if, "can't set probe req template "
 835                           "(empty ssid)\n");
 836                 return ENXIO;
 837         }
 838
 839         /* XXX for PM?? */
 840         if (acx_set_null_tmplt(sc) != 0) {
 841                 if_printf(&sc->sc_ic.ic_if, "can't set null data template\n");
 842                 return ENXIO;
 843         }
 844         return 0;
 845 }
 846
 847 static int
 848 acx_read_config(struct acx_softc *sc, struct acx_config *conf)
 849 {
 850         struct acx_conf_eaddr addr;
 851         struct acx_conf_regdom reg_dom;
 852         struct acx_conf_antenna ant;
 853         struct acx_conf_fwrev fw_rev;
 854         char ethstr[ETHER_ADDRSTRLEN + 1];
 855         uint32_t fw_rev_no;
 856         uint8_t sen;
 857         int i, error;
 858
 859         /* Get station id */
 860         if (acx_get_eaddr_conf(sc, &addr) != 0) {
 861                 if_printf(&sc->sc_ic.ic_if, "can't get station id\n");
 862                 return ENXIO;
 863         }
 864
 865         /*
 866          * Get and print station id in case that EEPROM station id's
 867          * offset is not correct
 868          */
 869         for (i = 0; i < IEEE80211_ADDR_LEN; ++i)
 870                 conf->eaddr[IEEE80211_ADDR_LEN - 1 - i] = addr.eaddr[i];
 871         if_printf(&sc->sc_ic.ic_if, "MAC address (from firmware): %s\n",
 872             kether_ntoa(conf->eaddr, ethstr));
 873
 874         /* Get region domain */
 875         if (acx_get_regdom_conf(sc, &reg_dom) != 0) {
 876                 if_printf(&sc->sc_ic.ic_if, "can't get region domain\n");
 877                 return ENXIO;
 878         }
 879         conf->regdom = reg_dom.regdom;
 880         DPRINTF((&sc->sc_ic.ic_if, "regdom %02x\n", reg_dom.regdom));
 881
 882         /* Get antenna */
 883         if (acx_get_antenna_conf(sc, &ant) != 0) {
 884                 if_printf(&sc->sc_ic.ic_if, "can't get antenna\n");
 885                 return ENXIO;
 886         }
 887         conf->antenna = ant.antenna;
 888         DPRINTF((&sc->sc_ic.ic_if, "antenna %02x\n", ant.antenna));
 889
 890         /* Get sensitivity XXX not used */
 891         if (sc->sc_radio_type == ACX_RADIO_TYPE_MAXIM ||
 892             sc->sc_radio_type == ACX_RADIO_TYPE_RFMD ||
 893             sc->sc_radio_type == ACX_RADIO_TYPE_RALINK) {
 894                 error = acx_read_phyreg(sc, ACXRV_PHYREG_SENSITIVITY, &sen);
 895                 if (error) {
 896                         if_printf(&sc->sc_ic.ic_if, "can't get sensitivity\n");
 897                         return error;
 898                 }
 899         } else {
 900                 sen = 0;
 901         }
 902         DPRINTF((&sc->sc_ic.ic_if, "sensitivity %02x\n", sen));
 903
 904         /* Get firmware revision */
 905         if (acx_get_fwrev_conf(sc, &fw_rev) != 0) {
 906                 if_printf(&sc->sc_ic.ic_if, "can't get firmware revision\n");
 907                 return ENXIO;
 908         }
 909
 910         if (strncmp(fw_rev.fw_rev, "Rev ", 4) != 0) {
 911                 if_printf(&sc->sc_ic.ic_if, "strange revision string -- %s\n",
 912                           fw_rev.fw_rev);
 913                 fw_rev_no = 0x01090407;
 914         } else {
 915                 char *s, *endp;
 916
 917                 /*
 918                  *  01234
 919                  * "Rev xx.xx.xx.xx"
 920                  *      ^ Start from here
 921                  */
 922                 s = &fw_rev.fw_rev[4];
 923                 fw_rev_no = 0;
 924                 for (i = 0; i < 4; ++i) {
 925                         uint8_t val;
 926
 927                         val = strtoul(s, &endp, 16);
 928                         fw_rev_no |= val << ((3 - i) * 8);
 929
 930                         if (*endp == '\0')
 931                                 break;
 932                         else
 933                                 s = ++endp;
 934                 }
 935         }
 936         sc->sc_firmware_ver = fw_rev_no;
 937         sc->sc_hardware_id = le32toh(fw_rev.hw_id);
 938         DPRINTF((&sc->sc_ic.ic_if, "fw rev %08x, hw id %08x\n",
 939                  sc->sc_firmware_ver, sc->sc_hardware_id));
 940
 941         if (sc->chip_read_config != NULL) {
 942                 error = sc->chip_read_config(sc, conf);
 943                 if (error)
 944                         return error;
 945         }
 946         return 0;
 947 }
 948
 949 static int
 950 acx_write_config(struct acx_softc *sc, struct acx_config *conf)
 951 {
 952         struct acx_conf_nretry_short sretry;
 953         struct acx_conf_nretry_long lretry;
 954         struct acx_conf_msdu_lifetime msdu_lifetime;
 955         struct acx_conf_rate_fallback rate_fb;
 956         struct acx_conf_antenna ant;
 957         struct acx_conf_regdom reg_dom;
 958         int error;
 959
 960         /* Set number of long/short retry */
 961         KKASSERT(sc->chip_short_retry_limit > 0);
 962         sretry.nretry = sc->chip_short_retry_limit;
 963         if (acx_set_nretry_short_conf(sc, &sretry) != 0) {
 964                 if_printf(&sc->sc_ic.ic_if, "can't set short retry limit\n");
 965                 return ENXIO;
 966         }
 967
 968         lretry.nretry = sc->sc_long_retry_limit;
 969         if (acx_set_nretry_long_conf(sc, &lretry) != 0) {
 970                 if_printf(&sc->sc_ic.ic_if, "can't set long retry limit\n");
 971                 return ENXIO;
 972         }
 973
 974         /* Set MSDU lifetime */
 975         msdu_lifetime.lifetime = htole32(sc->sc_msdu_lifetime);
 976         if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
 977                 if_printf(&sc->sc_ic.ic_if, "can't set MSDU lifetime\n");
 978                 return ENXIO;
 979         }
 980
 981         /* Enable rate fallback */
 982         rate_fb.ratefb_enable = 1;
 983         if (acx_set_rate_fallback_conf(sc, &rate_fb) != 0) {
 984                 if_printf(&sc->sc_ic.ic_if, "can't enable rate fallback\n");
 985                 return ENXIO;
 986         }
 987
 988         /* Set antenna */
 989         ant.antenna = conf->antenna;
 990         if (acx_set_antenna_conf(sc, &ant) != 0) {
 991                 if_printf(&sc->sc_ic.ic_if, "can't set antenna\n");
 992                 return ENXIO;
 993         }
 994
 995         /* Set region domain */
 996         reg_dom.regdom = conf->regdom;
 997         if (acx_set_regdom_conf(sc, &reg_dom) != 0) {
 998                 if_printf(&sc->sc_ic.ic_if, "can't set region domain\n");
 999                 return ENXIO;
1000         }
1001
1002         if (sc->chip_write_config != NULL) {
1003                 error = sc->chip_write_config(sc, conf);
1004                 if (error)
1005                         return error;
1006         }
1007
1008         return 0;
1009 }
1010
1011 static int
1012 acx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1013 {
1014         struct acx_softc *sc = ifp->if_softc;
1015         struct ieee80211com *ic = &sc->sc_ic;
1016         int error;
1017
1018         error = 0;
1019
1020         switch (cmd) {
1021         case SIOCSIFFLAGS:
1022                 if (ifp->if_flags & IFF_UP) {
1023                         if ((ifp->if_flags & IFF_RUNNING)) {
1024                                 int promisc = -1;
1025
1026                                 if ((ifp->if_flags & IFF_PROMISC) &&
1027                                     (sc->sc_flags & ACX_FLAG_PROMISC) == 0)
1028                                         promisc = 1;
1029                                 else if ((ifp->if_flags & IFF_PROMISC) == 0 &&
1030                                          (sc->sc_flags & ACX_FLAG_PROMISC))
1031                                         promisc = 0;
1032
1033                                 /*
1034                                  * Promisc mode is always enabled when
1035                                  * operation mode is Monitor.
1036                                  */
1037                                 if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1038                                     promisc >= 0)
1039                                         error = acx_rx_config(sc, promisc);
1040                         } else {
1041                                 acx_init(sc);
1042                         }
1043                 } else {
1044                         if (ifp->if_flags & IFF_RUNNING)
1045                                 acx_stop(sc);
1046                 }
1047
1048                 if (ifp->if_flags & IFF_PROMISC)
1049                         sc->sc_flags |= ACX_FLAG_PROMISC;
1050                 else
1051                         sc->sc_flags &= ~ACX_FLAG_PROMISC;
1052                 break;
1053         case SIOCADDMULTI:
1054         case SIOCDELMULTI:
1055                 /* TODO */
1056                 break;
1057         default:
1058                 error = ieee80211_ioctl(ic, cmd, data, cr);
1059                 break;
1060         }
1061
1062         if (error == ENETRESET) {
1063                 if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
1064                     (IFF_RUNNING | IFF_UP))
1065                         acx_init(sc);
1066                 error = 0;
1067         }
1068         return error;
1069 }
1070
1071 static void
1072 acx_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
1073 {
1074         struct acx_softc *sc = ifp->if_softc;
1075         struct ieee80211com *ic = &sc->sc_ic;
1076         struct acx_buf_data *bd = &sc->sc_buf_data;
1077         struct acx_txbuf *buf;
1078         int trans, idx;
1079
1080         ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
1081         ASSERT_SERIALIZED(ifp->if_serializer);
1082
1083         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0) {
1084                 ifq_purge(&ifp->if_snd);
1085                 ieee80211_drain_mgtq(&ic->ic_mgtq);
1086                 return;
1087         }
1088
1089         if ((ifp->if_flags & IFF_RUNNING) == 0 || ifq_is_oactive(ifp->if_snd))
1090                 return;
1091
1092         /*
1093          * NOTE:
1094          * We can't start from a random position that TX descriptor
1095          * is free, since hardware will be confused by that.
1096          * We have to follow the order of the TX ring.
1097          */
1098         idx = bd->tx_free_start;
1099         trans = 0;
1100         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf == NULL;
1101              buf = &bd->tx_buf[idx]) {
1102                 struct ieee80211_frame *f;
1103                 struct ieee80211_node *ni = NULL;
1104                 struct mbuf *m;
1105                 int mgmt_pkt = 0;
1106
1107                 if (!IF_QEMPTY(&ic->ic_mgtq)) {
1108                         IF_DEQUEUE(&ic->ic_mgtq, m);
1109
1110                         ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1111                         m->m_pkthdr.rcvif = NULL;
1112
1113                         mgmt_pkt = 1;
1114
1115                         /*
1116                          * Don't transmit probe response firmware will
1117                          * do it for us.
1118                          */
1119                         f = mtod(m, struct ieee80211_frame *);
1120                         if ((f->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1121                             IEEE80211_FC0_TYPE_MGT &&
1122                             (f->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1123                             IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1124                                 if (ni != NULL)
1125                                         ieee80211_free_node(ni);
1126                                 m_freem(m);
1127                                 continue;
1128                         }
1129                 } else if (!ifq_is_empty(&ifp->if_snd)) {
1130                         struct ether_header *eh;
1131
1132                         if (ic->ic_state != IEEE80211_S_RUN) {
1133                                 ifq_purge(&ifp->if_snd);
1134                                 break;
1135                         }
1136
1137                         m = ifq_dequeue(&ifp->if_snd);
1138                         if (m == NULL)
1139                                 break;
1140
1141                         if (m->m_len < sizeof(struct ether_header)) {
1142                                 m = m_pullup(m, sizeof(struct ether_header));
1143                                 if (m == NULL) {
1144                                         IFNET_STAT_INC(ifp, oerrors, 1);
1145                                         continue;
1146                                 }
1147                         }
1148                         eh = mtod(m, struct ether_header *);
1149
1150                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1151                         if (ni == NULL) {
1152                                 m_freem(m);
1153                                 IFNET_STAT_INC(ifp, oerrors, 1);
1154                                 continue;
1155                         }
1156
1157                         /* TODO power save */
1158
1159                         BPF_MTAP(ifp, m);
1160
1161                         m = ieee80211_encap(ic, m, ni);
1162                         if (m == NULL) {
1163                                 ieee80211_free_node(ni);
1164                                 IFNET_STAT_INC(ifp, oerrors, 1);
1165                                 continue;
1166                         }
1167                 } else {
1168                         break;
1169                 }
1170
1171                 if (ic->ic_rawbpf != NULL)
1172                         bpf_mtap(ic->ic_rawbpf, m);
1173
1174                 f = mtod(m, struct ieee80211_frame *);
1175                 if ((f->i_fc[1] & IEEE80211_FC1_PROTECTED) && !sc->chip_hw_crypt) {
1176                         KASSERT(ni != NULL, ("TX node is NULL (WEP)"));
1177                         if (ieee80211_crypto_encap(ic, ni, m) == NULL) {
1178                                 ieee80211_free_node(ni);
1179                                 m_freem(m);
1180                                 IFNET_STAT_INC(ifp, oerrors, 1);
1181                                 continue;
1182                         }
1183                 }
1184
1185                 /*
1186                  * Since mgmt data are transmitted at fixed rate
1187                  * they will not be used to do rate control.
1188                  */
1189                 if (mgmt_pkt && ni != NULL) {
1190                         ieee80211_free_node(ni);
1191                         ni = NULL;
1192                 }
1193
1194                 if (acx_encap(sc, buf, m, ni) != 0) {
1195                         /*
1196                          * NOTE: `m' will be freed in acx_encap()
1197                          * if we reach here.
1198                          */
1199                         if (ni != NULL)
1200                                 ieee80211_free_node(ni);
1201                         IFNET_STAT_INC(ifp, oerrors, 1);
1202                         continue;
1203                 }
1204
1205                 /*
1206                  * NOTE:
1207                  * 1) `m' should not be touched after acx_encap()
1208                  * 2) `node' will be used to do TX rate control during
1209                  *    acx_txeof(), so it is not freed here.  acx_txeof()
1210                  *    will free it for us
1211                  */
1212
1213                 trans = 1;
1214                 bd->tx_used_count++;
1215                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1216         }
1217         bd->tx_free_start = idx;
1218
1219         if (bd->tx_used_count == ACX_TX_DESC_CNT)
1220                 ifq_set_oactive(&ifp->if_snd);
1221
1222         if (trans && sc->sc_tx_timer == 0)
1223                 sc->sc_tx_timer = 5;
1224         ifp->if_timer = 1;
1225 }
1226
1227 static void
1228 acx_watchdog(struct ifnet *ifp)
1229 {
1230         struct acx_softc *sc = ifp->if_softc;
1231
1232         ifp->if_timer = 0;
1233
1234         if ((ifp->if_flags & IFF_RUNNING) == 0)
1235                 return;
1236
1237         if (sc->sc_tx_timer) {
1238                 if (--sc->sc_tx_timer == 0) {
1239                         if_printf(ifp, "watchdog timeout\n");
1240                         IFNET_STAT_INC(ifp, oerrors, 1);
1241                         acx_txeof(ifp->if_softc);
1242                 } else {
1243                         ifp->if_timer = 1;
1244                 }
1245         }
1246         ieee80211_watchdog(&sc->sc_ic);
1247 }
1248
1249 static void
1250 acx_intr(void *arg)
1251 {
1252         struct acx_softc *sc = arg;
1253         uint16_t intr_status;
1254
1255         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0)
1256                 return;
1257
1258         intr_status = CSR_READ_2(sc, ACXREG_INTR_STATUS_CLR);
1259         if (intr_status == ACXRV_INTR_ALL) {
1260                 /* not our interrupt */
1261                 return;
1262         }
1263
1264         intr_status &= sc->chip_intr_enable;
1265         if (intr_status == 0) {
1266                 /* not interrupts we care about */
1267                 return;
1268         }
1269
1270         /* Acknowledge all interrupts */
1271         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_ALL);
1272
1273         if (intr_status & ACXRV_INTR_TX_FINI)
1274                 acx_txeof(sc);
1275
1276         if (intr_status & ACXRV_INTR_RX_FINI)
1277                 acx_rxeof(sc);
1278 }
1279
1280 static void
1281 acx_disable_intr(struct acx_softc *sc)
1282 {
1283         CSR_WRITE_2(sc, ACXREG_INTR_MASK, sc->chip_intr_disable);
1284         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, 0);
1285 }
1286
1287 static void
1288 acx_enable_intr(struct acx_softc *sc)
1289 {
1290         /* Mask out interrupts that are not in the enable set */
1291         CSR_WRITE_2(sc, ACXREG_INTR_MASK, ~sc->chip_intr_enable);
1292         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, ACXRV_EVENT_DISABLE);
1293 }
1294
1295 static void
1296 acx_txeof(struct acx_softc *sc)
1297 {
1298         struct acx_buf_data *bd;
1299         struct acx_txbuf *buf;
1300         struct ifnet *ifp;
1301         int idx;
1302
1303         ifp = &sc->sc_ic.ic_if;
1304         ASSERT_SERIALIZED(ifp->if_serializer);
1305
1306         bd = &sc->sc_buf_data;
1307         idx = bd->tx_used_start;
1308         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf != NULL;
1309              buf = &bd->tx_buf[idx]) {
1310                 uint8_t ctrl, error;
1311                 int frame_len;
1312
1313                 ctrl = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_ctrl);
1314                 if ((ctrl & (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE)) !=
1315                     (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE))
1316                         break;
1317
1318                 bus_dmamap_unload(bd->mbuf_dma_tag, buf->tb_mbuf_dmamap);
1319                 frame_len = buf->tb_mbuf->m_pkthdr.len;
1320                 m_freem(buf->tb_mbuf);
1321                 buf->tb_mbuf = NULL;
1322
1323                 error = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_error);
1324                 if (error) {
1325                         acx_txerr(sc, error);
1326                         IFNET_STAT_INC(ifp, oerrors, 1);
1327                 } else {
1328                         IFNET_STAT_INC(ifp, opackets, 1);
1329                 }
1330
1331                 if (buf->tb_node != NULL) {
1332                         sc->chip_tx_complete(sc, buf, frame_len, error);
1333                         ieee80211_free_node(buf->tb_node);
1334                         buf->tb_node = NULL;
1335                 }
1336
1337                 FW_TXDESC_SETFIELD_1(sc, buf, f_tx_ctrl, DESC_CTRL_HOSTOWN);
1338
1339                 bd->tx_used_count--;
1340
1341                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1342         }
1343         bd->tx_used_start = idx;
1344
1345         sc->sc_tx_timer = bd->tx_used_count == 0 ? 0 : 5;
1346
1347         if (bd->tx_used_count != ACX_TX_DESC_CNT) {
1348                 ifq_clr_oactive(&ifp->if_snd);
1349                 ifp->if_start(ifp);
1350         }
1351 }
1352
1353 static void
1354 acx_txerr(struct acx_softc *sc, uint8_t err)
1355 {
1356         struct ifnet *ifp = &sc->sc_ic.ic_if;
1357         struct acx_stats *stats = &sc->sc_stats;
1358
1359         if (err == DESC_ERR_EXCESSIVE_RETRY) {
1360                 /*
1361                  * This a common error (see comment below),
1362                  * so print it using DPRINTF()
1363                  */
1364                 DPRINTF((ifp, "TX failed -- excessive retry\n"));
1365         } else {
1366                 if_printf(ifp, "TX failed -- ");
1367         }
1368
1369         /*
1370          * Although `err' looks like bitmask, it never
1371          * has multiple bits set.
1372          */
1373         switch (err) {
1374 #if 0
1375         case DESC_ERR_OTHER_FRAG:
1376                 /* XXX what's this */
1377                 kprintf("error in other fragment\n");
1378                 stats->err_oth_frag++;
1379                 break;
1380 #endif
1381         case DESC_ERR_ABORT:
1382                 kprintf("aborted\n");
1383                 stats->err_abort++;
1384                 break;
1385         case DESC_ERR_PARAM:
1386                 kprintf("wrong parameters in descriptor\n");
1387                 stats->err_param++;
1388                 break;
1389         case DESC_ERR_NO_WEPKEY:
1390                 kprintf("WEP key missing\n");
1391                 stats->err_no_wepkey++;
1392                 break;
1393         case DESC_ERR_MSDU_TIMEOUT:
1394                 kprintf("MSDU life timeout\n");
1395                 stats->err_msdu_timeout++;
1396                 break;
1397         case DESC_ERR_EXCESSIVE_RETRY:
1398                 /*
1399                  * Possible causes:
1400                  * 1) Distance is too long
1401                  * 2) Transmit failed (e.g. no MAC level ACK)
1402                  * 3) Chip overheated (this should be rare)
1403                  */
1404                 stats->err_ex_retry++;
1405                 break;
1406         case DESC_ERR_BUF_OVERFLOW:
1407                 kprintf("buffer overflow\n");
1408                 stats->err_buf_oflow++;
1409                 break;
1410         case DESC_ERR_DMA:
1411                 kprintf("DMA error\n");
1412                 stats->err_dma++;
1413                 break;
1414         default:
1415                 kprintf("unknown error %d\n", err);
1416                 stats->err_unkn++;
1417                 break;
1418         }
1419 }
1420
1421 static void
1422 acx_rxeof(struct acx_softc *sc)
1423 {
1424         struct ieee80211com *ic = &sc->sc_ic;
1425         struct acx_ring_data *rd = &sc->sc_ring_data;
1426         struct acx_buf_data *bd = &sc->sc_buf_data;
1427         struct ifnet *ifp = &ic->ic_if;
1428         int idx, ready;
1429
1430         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1431
1432         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1433                         BUS_DMASYNC_POSTREAD);
1434
1435         /*
1436          * Locate first "ready" rx buffer,
1437          * start from last stopped position
1438          */
1439         idx = bd->rx_scan_start;
1440         ready = 0;
1441         do {
1442                 struct acx_rxbuf *buf;
1443
1444                 buf = &bd->rx_buf[idx];
1445                 if ((buf->rb_desc->h_ctrl & htole16(DESC_CTRL_HOSTOWN)) &&
1446                     (buf->rb_desc->h_status & htole32(DESC_STATUS_FULL))) {
1447                         ready = 1;
1448                         break;
1449                 }
1450                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1451         } while (idx != bd->rx_scan_start);
1452
1453         if (!ready)
1454                 return;
1455
1456         /*
1457          * NOTE: don't mess up `idx' here, it will
1458          * be used in the following code
1459          */
1460
1461         do {
1462                 struct acx_rxbuf_hdr *head;
1463                 struct acx_rxbuf *buf;
1464                 struct ieee80211_frame_min *wh;
1465                 struct mbuf *m;
1466                 uint32_t desc_status;
1467                 uint16_t desc_ctrl;
1468                 int len, error, rssi, is_priv;
1469
1470                 buf = &bd->rx_buf[idx];
1471
1472                 desc_ctrl = le16toh(buf->rb_desc->h_ctrl);
1473                 desc_status = le32toh(buf->rb_desc->h_status);
1474                 if (!(desc_ctrl & DESC_CTRL_HOSTOWN) ||
1475                     !(desc_status & DESC_STATUS_FULL))
1476                         break;
1477
1478                 bus_dmamap_sync(bd->mbuf_dma_tag, buf->rb_mbuf_dmamap,
1479                                 BUS_DMASYNC_POSTREAD);
1480
1481                 m = buf->rb_mbuf;
1482
1483                 error = acx_newbuf(sc, buf, 0);
1484                 if (error) {
1485                         IFNET_STAT_INC(ifp, ierrors, 1);
1486                         goto next;
1487                 }
1488
1489                 head = mtod(m, struct acx_rxbuf_hdr *);
1490                 len = le16toh(head->rbh_len) & ACX_RXBUF_LEN_MASK;
1491                 rssi = acx_get_rssi(sc, head->rbh_level);
1492
1493                 m_adj(m, sizeof(struct acx_rxbuf_hdr) + sc->chip_rxbuf_exhdr);
1494                 m->m_len = m->m_pkthdr.len = len;
1495                 m->m_pkthdr.rcvif = &ic->ic_if;
1496
1497                 wh = mtod(m, struct ieee80211_frame_min *);
1498                 is_priv = (wh->i_fc[1] & IEEE80211_FC1_PROTECTED);
1499
1500                 if (sc->sc_drvbpf != NULL) {
1501                         sc->sc_rx_th.wr_tsf = htole32(head->rbh_time);
1502
1503                         sc->sc_rx_th.wr_flags = 0;
1504                         if (is_priv) {
1505                                 sc->sc_rx_th.wr_flags |=
1506                                         IEEE80211_RADIOTAP_F_WEP;
1507                         }
1508                         if (head->rbh_bbp_stat & ACX_RXBUF_STAT_SHPRE) {
1509                                 sc->sc_rx_th.wr_flags |=
1510                                         IEEE80211_RADIOTAP_F_SHORTPRE;
1511                         }
1512
1513                         if (sc->chip_phymode == IEEE80211_MODE_11G) {
1514                                 sc->sc_rx_th.wr_rate =
1515                                     ieee80211_plcp2rate(head->rbh_plcp,
1516                                     head->rbh_bbp_stat & ACX_RXBUF_STAT_OFDM);
1517                         } else {
1518                                 sc->sc_rx_th.wr_rate =
1519                                     ieee80211_plcp2rate(head->rbh_plcp, 0);
1520                         }
1521
1522                         sc->sc_rx_th.wr_antsignal = rssi;
1523
1524                         if (head->rbh_bbp_stat & ACX_RXBUF_STAT_ANT1)
1525                                 sc->sc_rx_th.wr_antenna = 1;
1526                         else
1527                                 sc->sc_rx_th.wr_antenna = 0;
1528
1529                         bpf_ptap(sc->sc_drvbpf, m, &sc->sc_rx_th,
1530                                  sc->sc_rx_th_len);
1531                 }
1532
1533                 if (len >= sizeof(struct ieee80211_frame_min) &&
1534                     len < MCLBYTES) {
1535                         struct ieee80211_node *ni;
1536
1537                         if (is_priv && sc->chip_hw_crypt) {
1538                                 /* Short circuit software WEP */
1539                                 wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
1540
1541                                 /* Do chip specific RX buffer processing */
1542                                 if (sc->chip_proc_wep_rxbuf != NULL) {
1543                                         sc->chip_proc_wep_rxbuf(sc, m, &len);
1544                                         wh = mtod(m,
1545                                              struct ieee80211_frame_min *);
1546                                 }
1547                         }
1548                         m->m_len = m->m_pkthdr.len = len;
1549
1550                         ni = ieee80211_find_rxnode(ic, wh);
1551                         ieee80211_input(ic, m, ni, rssi,
1552                                         le32toh(head->rbh_time));
1553                         ieee80211_free_node(ni);
1554
1555                         IFNET_STAT_INC(ifp, ipackets, 1);
1556                 } else {
1557                         if (len < sizeof(struct ieee80211_frame_min)) {
1558                                 if (ic->ic_rawbpf != NULL &&
1559                                     len >= sizeof(struct ieee80211_frame_ack))
1560                                         bpf_mtap(ic->ic_rawbpf, m);
1561
1562                                 if (ic->ic_opmode != IEEE80211_M_MONITOR)
1563                                         ic->ic_stats.is_rx_tooshort++;
1564                         }
1565                         m_freem(m);
1566                 }
1567 next:
1568                 buf->rb_desc->h_ctrl = htole16(desc_ctrl & ~DESC_CTRL_HOSTOWN);
1569                 buf->rb_desc->h_status = 0;
1570                 bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1571                                 BUS_DMASYNC_PREWRITE);
1572
1573                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1574         } while (idx != bd->rx_scan_start);
1575
1576         /*
1577          * Record the position so that next
1578          * time we can start from it
1579          */
1580         bd->rx_scan_start = idx;
1581 }
1582
1583 static int
1584 acx_reset(struct acx_softc *sc)
1585 {
1586         uint16_t reg;
1587
1588         /* Halt ECPU */
1589         CSR_SETB_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_HALT);
1590
1591         /* Software reset */
1592         reg = CSR_READ_2(sc, ACXREG_SOFT_RESET);
1593         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg | ACXRV_SOFT_RESET);
1594         DELAY(100);
1595         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg);
1596
1597         /* Initialize EEPROM */
1598         CSR_SETB_2(sc, ACXREG_EEPROM_INIT, ACXRV_EEPROM_INIT);
1599         DELAY(50000);
1600
1601         /* Test whether ECPU is stopped */
1602         reg = CSR_READ_2(sc, ACXREG_ECPU_CTRL);
1603         if (!(reg & ACXRV_ECPU_HALT)) {
1604                 if_printf(&sc->sc_ic.ic_if, "can't halt ECPU\n");
1605                 return ENXIO;
1606         }
1607         return 0;
1608 }
1609
1610 static int
1611 acx_read_eeprom(struct acx_softc *sc, uint32_t offset, uint8_t *val)
1612 {
1613         int i;
1614
1615         CSR_WRITE_4(sc, ACXREG_EEPROM_CONF, 0);
1616         CSR_WRITE_4(sc, ACXREG_EEPROM_ADDR, offset);
1617         CSR_WRITE_4(sc, ACXREG_EEPROM_CTRL, ACXRV_EEPROM_READ);
1618
1619 #define EE_READ_RETRY_MAX       100
1620         for (i = 0; i < EE_READ_RETRY_MAX; ++i) {
1621                 if (CSR_READ_2(sc, ACXREG_EEPROM_CTRL) == 0)
1622                         break;
1623                 DELAY(10000);
1624         }
1625         if (i == EE_READ_RETRY_MAX) {
1626                 if_printf(&sc->sc_ic.ic_if, "can't read EEPROM offset %x "
1627                           "(timeout)\n", offset);
1628                 return ETIMEDOUT;
1629         }
1630 #undef EE_READ_RETRY_MAX
1631
1632         *val = CSR_READ_1(sc, ACXREG_EEPROM_DATA);
1633         return 0;
1634 }
1635
1636 static int
1637 acx_read_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t *val)
1638 {
1639         int i;
1640
1641         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1642         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_READ);
1643
1644 #define PHY_READ_RETRY_MAX      100
1645         for (i = 0; i < PHY_READ_RETRY_MAX; ++i) {
1646                 if (CSR_READ_4(sc, ACXREG_PHY_CTRL) == 0)
1647                         break;
1648                 DELAY(10000);
1649         }
1650         if (i == PHY_READ_RETRY_MAX) {
1651                 if_printf(&sc->sc_ic.ic_if, "can't read phy reg %x (timeout)\n",
1652                           reg);
1653                 return ETIMEDOUT;
1654         }
1655 #undef PHY_READ_RETRY_MAX
1656
1657         *val = CSR_READ_1(sc, ACXREG_PHY_DATA);
1658         return 0;
1659 }
1660
1661 void
1662 acx_write_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t val)
1663 {
1664         CSR_WRITE_4(sc, ACXREG_PHY_DATA, val);
1665         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1666         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_WRITE);
1667 }
1668
1669 static int
1670 acx_alloc_firmware(struct acx_softc *sc)
1671 {
1672         struct acx_firmware *fw = &sc->sc_firmware;
1673         struct ifnet *ifp = &sc->sc_ic.ic_if;
1674         struct fw_image *img;
1675         char filename[64];
1676         int error = 0;
1677
1678         /*
1679          * NB: serializer need to be released before loading firmware
1680          *     image to avoid possible dead lock
1681          */
1682         ASSERT_SERIALIZED(ifp->if_serializer);
1683
1684         if (fw->base_fw_image == NULL) {
1685                 if (fw->combined_radio_fw) {
1686                         ksnprintf(filename, sizeof(filename),
1687                                   ACX_BASE_RADIO_FW_PATH,
1688                                   fw->fwdir, sc->sc_radio_type);
1689                 } else {
1690                         ksnprintf(filename, sizeof(filename),
1691                                   ACX_BASE_FW_PATH, fw->fwdir);
1692                 }
1693
1694                 lwkt_serialize_exit(ifp->if_serializer);
1695                 img = firmware_image_load(filename, NULL);
1696                 lwkt_serialize_enter(ifp->if_serializer);
1697
1698                 fw->base_fw_image = img;
1699                 if (fw->base_fw_image == NULL) {
1700                         if_printf(ifp, "load %s base fw failed\n", filename);
1701                         error = EIO;
1702                         goto back;
1703                 }
1704
1705                 error = acx_setup_firmware(sc, fw->base_fw_image,
1706                                            &fw->base_fw, &fw->base_fw_len);
1707                 if (error)
1708                         goto back;
1709         }
1710
1711         if (!fw->combined_radio_fw && fw->radio_fw_image == NULL) {
1712                 ksnprintf(filename, sizeof(filename), ACX_RADIO_FW_PATH,
1713                           fw->fwdir, sc->sc_radio_type);
1714
1715                 lwkt_serialize_exit(ifp->if_serializer);
1716                 img = firmware_image_load(filename, NULL);
1717                 lwkt_serialize_enter(ifp->if_serializer);
1718
1719                 fw->radio_fw_image = img;
1720                 if (fw->radio_fw_image == NULL) {
1721                         if_printf(ifp, "load %s radio fw failed\n", filename);
1722                         error = EIO;
1723                         goto back;
1724                 }
1725
1726                 error = acx_setup_firmware(sc, fw->radio_fw_image,
1727                                            &fw->radio_fw, &fw->radio_fw_len);
1728         }
1729 back:
1730         if (error)
1731                 acx_free_firmware(sc);
1732         return error;
1733 }
1734
1735 static int
1736 acx_setup_firmware(struct acx_softc *sc, struct fw_image *img,
1737                    const uint8_t **ptr, int *len)
1738 {
1739         const struct acx_firmware_hdr *hdr;
1740         const uint8_t *p;
1741         uint32_t cksum;
1742         int i;
1743
1744         *ptr = NULL;
1745         *len = 0;
1746
1747         /*
1748          * Make sure that the firmware image contains more than just a header
1749          */
1750         if (img->fw_imglen <= sizeof(*hdr)) {
1751                 if_printf(&sc->sc_ic.ic_if, "%s is invalid image, "
1752                           "size %zu (too small)\n",
1753                           img->fw_name, img->fw_imglen);
1754                 return EINVAL;
1755         }
1756         hdr = (const struct acx_firmware_hdr *)img->fw_image;
1757
1758         /*
1759          * Verify length
1760          */
1761         if (hdr->fwh_len != img->fw_imglen - sizeof(*hdr)) {
1762                 if_printf(&sc->sc_ic.ic_if, "%s is invalid image, "
1763                           "size in hdr %u and image size %zu mismatches\n",
1764                           img->fw_name, hdr->fwh_len, img->fw_imglen);
1765                 return EINVAL;
1766         }
1767
1768         /*
1769          * Verify cksum
1770          */
1771         cksum = 0;
1772         for (i = 0, p = (const uint8_t *)&hdr->fwh_len;
1773              i < img->fw_imglen - sizeof(hdr->fwh_cksum); ++i, ++p)
1774                 cksum += *p;
1775         if (cksum != hdr->fwh_cksum) {
1776                 if_printf(&sc->sc_ic.ic_if, "%s is invalid image, "
1777                           "checksum mismatch\n", img->fw_name);
1778                 return EINVAL;
1779         }
1780
1781         *ptr = ((const uint8_t *)img->fw_image + sizeof(*hdr));
1782         *len = img->fw_imglen - sizeof(*hdr);
1783         return 0;
1784 }
1785
1786 static void
1787 acx_free_firmware(struct acx_softc *sc)
1788 {
1789         struct acx_firmware *fw = &sc->sc_firmware;
1790
1791         if (fw->base_fw_image != NULL) {
1792                 firmware_image_unload(fw->base_fw_image);
1793                 fw->base_fw_image = NULL;
1794                 fw->base_fw = NULL;
1795                 fw->base_fw_len = 0;
1796         }
1797         if (fw->radio_fw_image != NULL) {
1798                 firmware_image_unload(fw->radio_fw_image);
1799                 fw->radio_fw_image = NULL;
1800                 fw->radio_fw = NULL;
1801                 fw->radio_fw_len = 0;
1802         }
1803 }
1804
1805 static int
1806 acx_load_base_firmware(struct acx_softc *sc, const uint8_t *base_fw,
1807                        uint32_t base_fw_len)
1808 {
1809         int i, error;
1810
1811         /* Load base firmware */
1812         error = acx_load_firmware(sc, 0, base_fw, base_fw_len);
1813         if (error) {
1814                 if_printf(&sc->sc_ic.ic_if, "can't load base firmware\n");
1815                 return error;
1816         }
1817         DPRINTF((&sc->sc_ic.ic_if, "base firmware loaded\n"));
1818
1819         /* Start ECPU */
1820         CSR_WRITE_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_START);
1821
1822         /* Wait for ECPU to be up */
1823         for (i = 0; i < 500; ++i) {
1824                 uint16_t reg;
1825
1826                 reg = CSR_READ_2(sc, ACXREG_INTR_STATUS);
1827                 if (reg & ACXRV_INTR_FCS_THRESH) {
1828                         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_FCS_THRESH);
1829                         return 0;
1830                 }
1831                 DELAY(10000);
1832         }
1833
1834         if_printf(&sc->sc_ic.ic_if, "can't initialize ECPU (timeout)\n");
1835         return ENXIO;
1836 }
1837
1838 static int
1839 acx_load_radio_firmware(struct acx_softc *sc, const uint8_t *radio_fw,
1840                         uint32_t radio_fw_len)
1841 {
1842         struct acx_conf_mmap mem_map;
1843         uint32_t radio_fw_ofs;
1844         int error;
1845
1846         /*
1847          * Get the position, where base firmware is loaded, so that
1848          * radio firmware can be loaded after it.
1849          */
1850         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1851                 return ENXIO;
1852         radio_fw_ofs = le32toh(mem_map.code_end);
1853
1854         /* Put ECPU into sleeping state, before loading radio firmware */
1855         if (acx_sleep(sc) != 0)
1856                 return ENXIO;
1857
1858         /* Load radio firmware */
1859         error = acx_load_firmware(sc, radio_fw_ofs, radio_fw, radio_fw_len);
1860         if (error) {
1861                 if_printf(&sc->sc_ic.ic_if, "can't load radio firmware\n");
1862                 return ENXIO;
1863         }
1864         DPRINTF((&sc->sc_ic.ic_if, "radio firmware loaded\n"));
1865
1866         /* Wake up sleeping ECPU, after radio firmware is loaded */
1867         if (acx_wakeup(sc) != 0)
1868                 return ENXIO;
1869
1870         /* Initialize radio */
1871         if (acx_init_radio(sc, radio_fw_ofs, radio_fw_len) != 0)
1872                 return ENXIO;
1873
1874         /* Verify radio firmware's loading position */
1875         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1876                 return ENXIO;
1877         if (le32toh(mem_map.code_end) != radio_fw_ofs + radio_fw_len) {
1878                 if_printf(&sc->sc_ic.ic_if, "loaded radio firmware position "
1879                           "mismatch\n");
1880                 return ENXIO;
1881         }
1882
1883         DPRINTF((&sc->sc_ic.ic_if, "radio firmware initialized\n"));
1884         return 0;
1885 }
1886
1887 static int
1888 acx_load_firmware(struct acx_softc *sc, uint32_t offset, const uint8_t *data,
1889                   int data_len)
1890 {
1891         const uint32_t *fw;
1892         int i, fw_len;
1893
1894         fw = (const uint32_t *)data;
1895         fw_len = data_len / sizeof(uint32_t);
1896
1897         /*
1898          * LOADFW_AUTO_INC only works with some older firmware:
1899          * 1) acx100's firmware
1900          * 2) acx111's firmware whose rev is 0x00010011
1901          */
1902
1903         /* Load firmware */
1904         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1905 #ifndef LOADFW_AUTO_INC
1906         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1907 #else
1908         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1909         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1910 #endif
1911
1912         for (i = 0; i < fw_len; ++i) {
1913 #ifndef LOADFW_AUTO_INC
1914                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1915 #endif
1916                 CSR_WRITE_4(sc, ACXREG_FWMEM_DATA, be32toh(fw[i]));
1917         }
1918
1919         /* Verify firmware */
1920         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1921 #ifndef LOADFW_AUTO_INC
1922         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1923 #else
1924         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1925         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1926 #endif
1927
1928         for (i = 0; i < fw_len; ++i) {
1929                 uint32_t val;
1930
1931 #ifndef LOADFW_AUTO_INC
1932                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1933 #endif
1934                 val = CSR_READ_4(sc, ACXREG_FWMEM_DATA);
1935                 if (be32toh(fw[i]) != val) {
1936                         if_printf(&sc->sc_ic.ic_if, "fireware mismatch "
1937                                   "fw %08x  loaded %08x\n", fw[i], val);
1938                         return ENXIO;
1939                 }
1940         }
1941         return 0;
1942 }
1943
1944 static int
1945 acx_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1946 {
1947         struct ifnet *ifp = &ic->ic_if;
1948         struct acx_softc *sc = ifp->if_softc;
1949         struct ieee80211_node *ni = NULL;
1950         struct ieee80211_channel *c = NULL;
1951         int error = 1, mode = 0;
1952
1953         ASSERT_SERIALIZED(ifp->if_serializer);
1954
1955         ieee80211_ratectl_newstate(ic, nstate);
1956         callout_stop(&sc->sc_scan_timer);
1957         callout_stop(&sc->sc_calibrate_timer);
1958
1959         switch (nstate) {
1960         case IEEE80211_S_SCAN:
1961                 acx_set_chan(sc, ic->ic_curchan);
1962                 callout_reset(&sc->sc_scan_timer,
1963                               (hz * sc->sc_scan_dwell) / 1000,
1964                               acx_next_scan, sc);
1965                 break;
1966         case IEEE80211_S_AUTH:
1967                 if (ic->ic_opmode == IEEE80211_M_STA) {
1968                         ni = ic->ic_bss;
1969                         c = ni->ni_chan;
1970                         mode = ACX_MODE_STA;
1971                 }
1972                 break;
1973         case IEEE80211_S_RUN:
1974                 if (ic->ic_opmode == IEEE80211_M_IBSS ||
1975                     ic->ic_opmode == IEEE80211_M_HOSTAP) {
1976                         ni = ic->ic_bss;
1977                         c = ni->ni_chan;
1978                         if (ic->ic_opmode == IEEE80211_M_IBSS)
1979                                 mode = ACX_MODE_ADHOC;
1980                         else
1981                                 mode = ACX_MODE_AP;
1982
1983                         if (acx_set_beacon_tmplt(sc, ni) != 0) {
1984                                 if_printf(ifp, "set bescon template failed\n");
1985                                 goto back;
1986                         }
1987                         if (acx_set_probe_resp_tmplt(sc, ni) != 0) {
1988                                 if_printf(ifp, "set probe response template"
1989                                           " failed\n");
1990                                 goto back;
1991                         }
1992                 } else if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1993                         ni = ic->ic_bss;
1994                         c = ic->ic_curchan;
1995                         mode = ACX_MODE_STA;
1996                 }
1997                 break;
1998         default:
1999                 break;
2000         }
2001
2002         if (ni != NULL) {
2003                 KKASSERT(c != NULL);
2004
2005                 if (acx_set_chan(sc, c) != 0)
2006                         goto back;
2007
2008                 if (acx_join_bss(sc, mode, ni, c) != 0) {
2009                         if_printf(ifp, "join BSS failed\n");
2010                         goto back;
2011                 }
2012         }
2013
2014         if (nstate == IEEE80211_S_RUN) {
2015                 int interval = sc->sc_calib_intvl;
2016
2017                 if (sc->chip_calibrate != NULL) {
2018                         error = sc->chip_calibrate(sc);
2019                         if (error) {
2020                                 /*
2021                                  * Restart calibration some time later
2022                                  */
2023                                 interval = 10;
2024                         }
2025                         callout_reset(&sc->sc_calibrate_timer,
2026                                       hz * interval, acx_calibrate, sc);
2027                 }
2028         }
2029         error = 0;
2030 back:
2031         if (error) {
2032                 /* XXX */
2033                 nstate = IEEE80211_S_INIT;
2034                 arg = -1;
2035         }
2036         return sc->sc_newstate(ic, nstate, arg);
2037 }
2038
2039 int
2040 acx_init_tmplt_ordered(struct acx_softc *sc)
2041 {
2042 #define INIT_TMPLT(name)                        \
2043 do {                                            \
2044         if (acx_init_##name##_tmplt(sc) != 0)   \
2045                 return 1;                       \
2046 } while (0)
2047
2048         /*
2049          * NOTE:
2050          * Order of templates initialization:
2051          * 1) Probe request
2052          * 2) NULL data
2053          * 3) Beacon
2054          * 4) TIM
2055          * 5) Probe response
2056          * Above order is critical to get a correct memory map.
2057          */
2058         INIT_TMPLT(probe_req);
2059         INIT_TMPLT(null_data);
2060         INIT_TMPLT(beacon);
2061         INIT_TMPLT(tim);
2062         INIT_TMPLT(probe_resp);
2063
2064 #undef INIT_TMPLT
2065         return 0;
2066 }
2067
2068 static void
2069 acx_ring_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
2070 {
2071         *((uint32_t *)arg) = seg->ds_addr;
2072 }
2073
2074 static int
2075 acx_dma_alloc(struct acx_softc *sc)
2076 {
2077         struct acx_ring_data *rd = &sc->sc_ring_data;
2078         struct acx_buf_data *bd = &sc->sc_buf_data;
2079         int i, error;
2080
2081         /* Allocate DMA stuffs for RX descriptors  */
2082         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
2083                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2084                                    NULL, NULL,
2085                                    ACX_RX_RING_SIZE, 1, ACX_RX_RING_SIZE,
2086                                    0, &rd->rx_ring_dma_tag);
2087         if (error) {
2088                 if_printf(&sc->sc_ic.ic_if, "can't create rx ring dma tag\n");
2089                 return error;
2090         }
2091
2092         error = bus_dmamem_alloc(rd->rx_ring_dma_tag, (void **)&rd->rx_ring,
2093                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
2094                                  &rd->rx_ring_dmamap);
2095         if (error) {
2096                 if_printf(&sc->sc_ic.ic_if,
2097                           "can't allocate rx ring dma memory\n");
2098                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2099                 rd->rx_ring_dma_tag = NULL;
2100                 return error;
2101         }
2102
2103         error = bus_dmamap_load(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2104                                 rd->rx_ring, ACX_RX_RING_SIZE,
2105                                 acx_ring_dma_addr, &rd->rx_ring_paddr,
2106                                 BUS_DMA_WAITOK);
2107         if (error) {
2108                 if_printf(&sc->sc_ic.ic_if, "can't get rx ring dma address\n");
2109                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2110                                 rd->rx_ring_dmamap);
2111                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2112                 rd->rx_ring_dma_tag = NULL;
2113                 return error;
2114         }
2115
2116         /* Allocate DMA stuffs for TX descriptors */
2117         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
2118                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2119                                    NULL, NULL,
2120                                    ACX_TX_RING_SIZE, 1, ACX_TX_RING_SIZE,
2121                                    0, &rd->tx_ring_dma_tag);
2122         if (error) {
2123                 if_printf(&sc->sc_ic.ic_if, "can't create tx ring dma tag\n");
2124                 return error;
2125         }
2126
2127         error = bus_dmamem_alloc(rd->tx_ring_dma_tag, (void **)&rd->tx_ring,
2128                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
2129                                  &rd->tx_ring_dmamap);
2130         if (error) {
2131                 if_printf(&sc->sc_ic.ic_if,
2132                           "can't allocate tx ring dma memory\n");
2133                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2134                 rd->tx_ring_dma_tag = NULL;
2135                 return error;
2136         }
2137
2138         error = bus_dmamap_load(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2139                                 rd->tx_ring, ACX_TX_RING_SIZE,
2140                                 acx_ring_dma_addr, &rd->tx_ring_paddr,
2141                                 BUS_DMA_WAITOK);
2142         if (error) {
2143                 if_printf(&sc->sc_ic.ic_if, "can't get tx ring dma address\n");
2144                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2145                                 rd->tx_ring_dmamap);
2146                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2147                 rd->tx_ring_dma_tag = NULL;
2148                 return error;
2149         }
2150
2151         /* Create DMA tag for RX/TX mbuf map */
2152         error = bus_dma_tag_create(NULL, 1, 0,
2153                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2154                                    NULL, NULL,
2155                                    MCLBYTES, 1, MCLBYTES,
2156                                    0, &bd->mbuf_dma_tag);
2157         if (error) {
2158                 if_printf(&sc->sc_ic.ic_if, "can't create mbuf dma tag\n");
2159                 return error;
2160         }
2161
2162         /* Create a spare RX DMA map */
2163         error = bus_dmamap_create(bd->mbuf_dma_tag, 0, &bd->mbuf_tmp_dmamap);
2164         if (error) {
2165                 if_printf(&sc->sc_ic.ic_if, "can't create tmp mbuf dma map\n");
2166                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2167                 bd->mbuf_dma_tag = NULL;
2168                 return error;
2169         }
2170
2171         /* Create DMA map for RX mbufs */
2172         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2173                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2174                                           &bd->rx_buf[i].rb_mbuf_dmamap);
2175                 if (error) {
2176                         if_printf(&sc->sc_ic.ic_if, "can't create rx mbuf "
2177                                   "dma map (%d)\n", i);
2178                         return error;
2179                 }
2180                 bd->rx_buf[i].rb_desc = &rd->rx_ring[i];
2181         }
2182
2183         /* Create DMA map for TX mbufs */
2184         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2185                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2186                                           &bd->tx_buf[i].tb_mbuf_dmamap);
2187                 if (error) {
2188                         if_printf(&sc->sc_ic.ic_if, "can't create tx mbuf "
2189                                   "dma map (%d)\n", i);
2190                         return error;
2191                 }
2192                 bd->tx_buf[i].tb_desc1 = &rd->tx_ring[i * 2];
2193                 bd->tx_buf[i].tb_desc2 = &rd->tx_ring[(i * 2) + 1];
2194         }
2195
2196         return 0;
2197 }
2198
2199 static void
2200 acx_dma_free(struct acx_softc *sc)
2201 {
2202         struct acx_ring_data *rd = &sc->sc_ring_data;
2203         struct acx_buf_data *bd = &sc->sc_buf_data;
2204         int i;
2205
2206         if (rd->rx_ring_dma_tag != NULL) {
2207                 bus_dmamap_unload(rd->rx_ring_dma_tag, rd->rx_ring_dmamap);
2208                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2209                                 rd->rx_ring_dmamap);
2210                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2211         }
2212
2213         if (rd->tx_ring_dma_tag != NULL) {
2214                 bus_dmamap_unload(rd->tx_ring_dma_tag, rd->tx_ring_dmamap);
2215                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2216                                 rd->tx_ring_dmamap);
2217                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2218         }
2219
2220         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2221                 if (bd->rx_buf[i].rb_desc != NULL) {
2222                         if (bd->rx_buf[i].rb_mbuf != NULL) {
2223                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2224                                                   bd->rx_buf[i].rb_mbuf_dmamap);
2225                                 m_freem(bd->rx_buf[i].rb_mbuf);
2226                         }
2227                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2228                                            bd->rx_buf[i].rb_mbuf_dmamap);
2229                 }
2230         }
2231
2232         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2233                 if (bd->tx_buf[i].tb_desc1 != NULL) {
2234                         if (bd->tx_buf[i].tb_mbuf != NULL) {
2235                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2236                                                   bd->tx_buf[i].tb_mbuf_dmamap);
2237                                 m_freem(bd->tx_buf[i].tb_mbuf);
2238                         }
2239                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2240                                            bd->tx_buf[i].tb_mbuf_dmamap);
2241                 }
2242         }
2243
2244         if (bd->mbuf_dma_tag != NULL) {
2245                 bus_dmamap_destroy(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap);
2246                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2247         }
2248 }
2249
2250 static int
2251 acx_init_tx_ring(struct acx_softc *sc)
2252 {
2253         struct acx_ring_data *rd;
2254         struct acx_buf_data *bd;
2255         uint32_t paddr;
2256         int i;
2257
2258         rd = &sc->sc_ring_data;
2259         paddr = rd->tx_ring_paddr;
2260         for (i = 0; i < (ACX_TX_DESC_CNT * 2) - 1; ++i) {
2261                 paddr += sizeof(struct acx_host_desc);
2262
2263                 rd->tx_ring[i].h_ctrl = htole16(DESC_CTRL_HOSTOWN);
2264
2265                 if (i == (ACX_TX_DESC_CNT * 2) - 1)
2266                         rd->tx_ring[i].h_next_desc = htole32(rd->tx_ring_paddr);
2267                 else
2268                         rd->tx_ring[i].h_next_desc = htole32(paddr);
2269         }
2270
2271         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2272                         BUS_DMASYNC_PREWRITE);
2273
2274         bd = &sc->sc_buf_data;
2275         bd->tx_free_start = 0;
2276         bd->tx_used_start = 0;
2277         bd->tx_used_count = 0;
2278
2279         return 0;
2280 }
2281
2282 static int
2283 acx_init_rx_ring(struct acx_softc *sc)
2284 {
2285         struct acx_ring_data *rd;
2286         struct acx_buf_data *bd;
2287         uint32_t paddr;
2288         int i;
2289
2290         bd = &sc->sc_buf_data;
2291         rd = &sc->sc_ring_data;
2292         paddr = rd->rx_ring_paddr;
2293
2294         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2295                 int error;
2296
2297                 paddr += sizeof(struct acx_host_desc);
2298
2299                 error = acx_newbuf(sc, &bd->rx_buf[i], 1);
2300                 if (error)
2301                         return error;
2302
2303                 if (i == ACX_RX_DESC_CNT - 1)
2304                         rd->rx_ring[i].h_next_desc = htole32(rd->rx_ring_paddr);
2305                 else
2306                         rd->rx_ring[i].h_next_desc = htole32(paddr);
2307         }
2308
2309         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2310                         BUS_DMASYNC_PREWRITE);
2311
2312         bd->rx_scan_start = 0;
2313         return 0;
2314 }
2315
2316 static void
2317 acx_buf_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg,
2318                  bus_size_t mapsz, int error)
2319 {
2320         if (error)
2321                 return;
2322
2323         /* XXX */
2324         KASSERT(nseg == 1, ("too many RX dma segments"));
2325         *((uint32_t *)arg) = seg->ds_addr;
2326 }
2327
2328 static int
2329 acx_newbuf(struct acx_softc *sc, struct acx_rxbuf *rb, int wait)
2330 {
2331         struct acx_buf_data *bd;
2332         struct mbuf *m;
2333         bus_dmamap_t map;
2334         uint32_t paddr;
2335         int error;
2336
2337         bd = &sc->sc_buf_data;
2338
2339         m = m_getcl(wait ? M_WAITOK : M_NOWAIT, MT_DATA, M_PKTHDR);
2340         if (m == NULL)
2341                 return ENOBUFS;
2342
2343         m->m_len = m->m_pkthdr.len = MCLBYTES;
2344
2345         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap,
2346                                      m, acx_buf_dma_addr, &paddr,
2347                                      wait ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
2348         if (error) {
2349                 m_freem(m);
2350                 if_printf(&sc->sc_ic.ic_if, "can't map rx mbuf %d\n", error);
2351                 return error;
2352         }
2353
2354         /* Unload originally mapped mbuf */
2355         bus_dmamap_unload(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap);
2356
2357         /* Swap this dmamap with tmp dmamap */
2358         map = rb->rb_mbuf_dmamap;
2359         rb->rb_mbuf_dmamap = bd->mbuf_tmp_dmamap;
2360         bd->mbuf_tmp_dmamap = map;
2361
2362         rb->rb_mbuf = m;
2363         rb->rb_desc->h_data_paddr = htole32(paddr);
2364         rb->rb_desc->h_data_len = htole16(m->m_len);
2365
2366         bus_dmamap_sync(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap,
2367                         BUS_DMASYNC_PREREAD);
2368         return 0;
2369 }
2370
2371 static int
2372 acx_encap(struct acx_softc *sc, struct acx_txbuf *txbuf, struct mbuf *m,
2373           struct ieee80211_node *ni)
2374 {
2375         struct acx_buf_data *bd = &sc->sc_buf_data;
2376         struct acx_ring_data *rd = &sc->sc_ring_data;
2377         uint32_t paddr;
2378         uint8_t ctrl, rate;
2379         int error;
2380
2381         KASSERT(txbuf->tb_mbuf == NULL, ("free TX buf has mbuf installed"));
2382
2383         if (m->m_pkthdr.len > MCLBYTES) {
2384                 if_printf(&sc->sc_ic.ic_if, "mbuf too big\n");
2385                 error = E2BIG;
2386                 goto back;
2387         } else if (m->m_pkthdr.len < ACX_FRAME_HDRLEN) {
2388                 if_printf(&sc->sc_ic.ic_if, "mbuf too small\n");
2389                 error = EINVAL;
2390                 goto back;
2391         }
2392
2393         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2394                                      m, acx_buf_dma_addr, &paddr,
2395                                      BUS_DMA_NOWAIT);
2396         if (error && error != EFBIG) {
2397                 if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf1 %d\n", error);
2398                 goto back;
2399         }
2400
2401         if (error) {    /* error == EFBIG */
2402                 struct mbuf *m_new;
2403
2404                 m_new = m_defrag(m, M_NOWAIT);
2405                 if (m_new == NULL) {
2406                         if_printf(&sc->sc_ic.ic_if, "can't defrag tx mbuf\n");
2407                         error = ENOBUFS;
2408                         goto back;
2409                 } else {
2410                         m = m_new;
2411                 }
2412
2413                 error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag,
2414                                              txbuf->tb_mbuf_dmamap, m,
2415                                              acx_buf_dma_addr, &paddr,
2416                                              BUS_DMA_NOWAIT);
2417                 if (error) {
2418                         if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf2 %d\n",
2419                                   error);
2420                         goto back;
2421                 }
2422         }
2423
2424         error = 0;
2425
2426         bus_dmamap_sync(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2427                         BUS_DMASYNC_PREWRITE);
2428
2429         txbuf->tb_mbuf = m;
2430         txbuf->tb_node = ni;
2431
2432         /*
2433          * TX buffers are accessed in following way:
2434          * acx_fw_txdesc -> acx_host_desc -> buffer
2435          *
2436          * It is quite strange that acx also querys acx_host_desc next to
2437          * the one we have assigned to acx_fw_txdesc even if first one's
2438          * acx_host_desc.h_data_len == acx_fw_txdesc.f_tx_len
2439          *
2440          * So we allocate two acx_host_desc for one acx_fw_txdesc and
2441          * assign the first acx_host_desc to acx_fw_txdesc
2442          *
2443          * For acx111
2444          * host_desc1.h_data_len = buffer_len
2445          * host_desc2.h_data_len = buffer_len - mac_header_len
2446          *
2447          * For acx100
2448          * host_desc1.h_data_len = mac_header_len
2449          * host_desc2.h_data_len = buffer_len - mac_header_len
2450          */
2451
2452         txbuf->tb_desc1->h_data_paddr = htole32(paddr);
2453         txbuf->tb_desc2->h_data_paddr = htole32(paddr + ACX_FRAME_HDRLEN);
2454
2455         txbuf->tb_desc1->h_data_len =
2456                 htole16(sc->chip_txdesc1_len ? sc->chip_txdesc1_len
2457                                              : m->m_pkthdr.len);
2458         txbuf->tb_desc2->h_data_len =
2459                 htole16(m->m_pkthdr.len - ACX_FRAME_HDRLEN);
2460
2461         /*
2462          * NOTE:
2463          * We can't simply assign f_tx_ctrl, we will first read it back
2464          * and change it bit by bit
2465          */
2466         ctrl = FW_TXDESC_GETFIELD_1(sc, txbuf, f_tx_ctrl);
2467         ctrl |= sc->chip_fw_txdesc_ctrl; /* extra chip specific flags */
2468         ctrl &= ~(DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE);
2469
2470         FW_TXDESC_SETFIELD_2(sc, txbuf, f_tx_len, m->m_pkthdr.len);
2471         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_error, 0);
2472         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_data_nretry, 0);
2473         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_nretry, 0);
2474         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_ok, 0);
2475         rate = sc->chip_set_fw_txdesc_rate(sc, txbuf, ni, m->m_pkthdr.len);
2476
2477         if (sc->sc_drvbpf != NULL) {
2478                 struct ieee80211_frame_min *wh;
2479
2480                 wh = mtod(m, struct ieee80211_frame_min *);
2481                 sc->sc_tx_th.wt_flags = 0;
2482                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
2483                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2484                 sc->sc_tx_th.wt_rate = rate;
2485
2486                 bpf_ptap(sc->sc_drvbpf, m, &sc->sc_tx_th, sc->sc_tx_th_len);
2487         }
2488
2489         txbuf->tb_desc1->h_ctrl = 0;
2490         txbuf->tb_desc2->h_ctrl = 0;
2491         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2492                         BUS_DMASYNC_PREWRITE);
2493
2494         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl2, 0);
2495         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl, ctrl);
2496
2497         /* Tell chip to inform us about TX completion */
2498         CSR_WRITE_2(sc, ACXREG_INTR_TRIG, ACXRV_TRIG_TX_FINI);
2499 back:
2500         if (error)
2501                 m_freem(m);
2502         return error;
2503 }
2504
2505 static int
2506 acx_set_null_tmplt(struct acx_softc *sc)
2507 {
2508         struct acx_tmplt_null_data n;
2509         struct ieee80211_frame *f;
2510
2511         bzero(&n, sizeof(n));
2512
2513         f = &n.data;
2514         f->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA |
2515                      IEEE80211_FC0_SUBTYPE_NODATA;
2516         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2517         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2518         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2519
2520         return _acx_set_null_data_tmplt(sc, &n, sizeof(n));
2521 }
2522
2523 static int
2524 acx_set_probe_req_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len)
2525 {
2526         struct acx_tmplt_probe_req req;
2527         struct ieee80211_frame *f;
2528         uint8_t *v;
2529         int vlen;
2530
2531         bzero(&req, sizeof(req));
2532
2533         f = &req.data.u_data.f;
2534         f->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2535                      IEEE80211_FC0_SUBTYPE_PROBE_REQ;
2536         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2537         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2538         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2539
2540         v = req.data.u_data.var;
2541         v = ieee80211_add_ssid(v, ssid, ssid_len);
2542         v = ieee80211_add_rates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2543         v = ieee80211_add_xrates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2544         vlen = v - req.data.u_data.var;
2545
2546         return _acx_set_probe_req_tmplt(sc, &req,
2547                                         ACX_TMPLT_PROBE_REQ_SIZ(vlen));
2548 }
2549
2550 static int
2551 acx_set_probe_resp_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2552 {
2553         struct ieee80211com *ic = &sc->sc_ic;
2554         struct acx_tmplt_probe_resp resp;
2555         struct ieee80211_frame *f;
2556         struct mbuf *m;
2557         int len;
2558
2559         m = ieee80211_probe_resp_alloc(ic, ni);
2560         if (m == NULL)
2561                 return 1;
2562         DPRINTF((&ic->ic_if, "%s alloc probe resp size %d\n", __func__,
2563                  m->m_pkthdr.len));
2564
2565         f = mtod(m, struct ieee80211_frame *);
2566         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2567
2568         bzero(&resp, sizeof(resp));
2569         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&resp.data);
2570         len = m->m_pkthdr.len + sizeof(resp.size);
2571         m_freem(m);
2572
2573         return _acx_set_probe_resp_tmplt(sc, &resp, len);
2574 }
2575
2576 static int
2577 acx_set_beacon_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2578 {
2579         struct ieee80211com *ic = &sc->sc_ic;
2580         struct acx_tmplt_beacon beacon;
2581         struct acx_tmplt_tim tim;
2582         struct ieee80211_beacon_offsets bo;
2583         struct mbuf *m;
2584         int beacon_tmplt_len = 0, tim_tmplt_len = 0;
2585
2586         bzero(&bo, sizeof(bo));
2587         m = ieee80211_beacon_alloc(ic, ni, &bo);
2588         if (m == NULL)
2589                 return 1;
2590         DPRINTF((&ic->ic_if, "%s alloc beacon size %d\n", __func__,
2591                  m->m_pkthdr.len));
2592
2593         if (bo.bo_tim_len == 0) {
2594                 beacon_tmplt_len = m->m_pkthdr.len;
2595         } else {
2596                 beacon_tmplt_len = bo.bo_tim - mtod(m, uint8_t *);
2597                 tim_tmplt_len = m->m_pkthdr.len - beacon_tmplt_len;
2598         }
2599
2600         bzero(&beacon, sizeof(beacon));
2601         bzero(&tim, sizeof(tim));
2602
2603         m_copydata(m, 0, beacon_tmplt_len, (caddr_t)&beacon.data);
2604         if (tim_tmplt_len != 0) {
2605                 m_copydata(m, beacon_tmplt_len, tim_tmplt_len,
2606                            (caddr_t)&tim.data);
2607         }
2608         m_freem(m);
2609
2610         beacon_tmplt_len += sizeof(beacon.size);
2611         if (_acx_set_beacon_tmplt(sc, &beacon, beacon_tmplt_len) != 0)
2612                 return 1;
2613
2614         if (tim_tmplt_len != 0) {
2615                 tim_tmplt_len += sizeof(tim.size);
2616                 if (_acx_set_tim_tmplt(sc, &tim, tim_tmplt_len) != 0)
2617                         return 1;
2618         }
2619         return 0;
2620 }
2621
2622 static int
2623 acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS)
2624 {
2625         struct acx_softc *sc = arg1;
2626         struct ifnet *ifp = &sc->sc_ic.ic_if;
2627         int error = 0, v;
2628
2629         lwkt_serialize_enter(ifp->if_serializer);
2630
2631         v = sc->sc_msdu_lifetime;
2632         error = sysctl_handle_int(oidp, &v, 0, req);
2633         if (error || req->newptr == NULL)
2634                 goto back;
2635         if (v <= 0) {
2636                 error = EINVAL;
2637                 goto back;
2638         }
2639
2640         if (sc->sc_flags & ACX_FLAG_FW_LOADED) {
2641                 struct acx_conf_msdu_lifetime msdu_lifetime;
2642
2643                 msdu_lifetime.lifetime = htole32(v);
2644                 if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
2645                         if_printf(&sc->sc_ic.ic_if,
2646                                   "can't set MSDU lifetime\n");
2647                         error = ENXIO;
2648                         goto back;
2649                 }
2650         }
2651         sc->sc_msdu_lifetime = v;
2652 back:
2653         lwkt_serialize_exit(ifp->if_serializer);
2654         return error;
2655 }
2656
2657 static int
2658 acx_sysctl_free_firmware(SYSCTL_HANDLER_ARGS)
2659 {
2660         struct acx_softc *sc = arg1;
2661         struct ifnet *ifp = &sc->sc_ic.ic_if;
2662         int error = 0, v;
2663
2664         lwkt_serialize_enter(ifp->if_serializer);
2665
2666         v = 0;
2667         error = sysctl_handle_int(oidp, &v, 0, req);
2668         if (error || req->newptr == NULL)
2669                 goto back;
2670         if (v == 0)     /* Do nothing */
2671                 goto back;
2672
2673         acx_free_firmware(sc);
2674 back:
2675         lwkt_serialize_exit(ifp->if_serializer);
2676         return error;
2677 }
2678
2679 static int
2680 acx_media_change(struct ifnet *ifp)
2681 {
2682         int error;
2683
2684         error = ieee80211_media_change(ifp);
2685         if (error != ENETRESET)
2686                 return error;
2687
2688         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
2689                 acx_init(ifp->if_softc);
2690         return 0;
2691 }
2692
2693 static int
2694 acx_rx_config(struct acx_softc *sc, int promisc)
2695 {
2696         struct acx_conf_rxopt rx_opt;
2697         struct ieee80211com *ic = &sc->sc_ic;
2698
2699         /*
2700          * What we want to receive and how to receive
2701          */
2702
2703         /* Common for all operational modes */
2704         rx_opt.opt1 = RXOPT1_INCL_RXBUF_HDR;
2705         rx_opt.opt2 = RXOPT2_RECV_ASSOC_REQ |
2706                       RXOPT2_RECV_AUTH |
2707                       RXOPT2_RECV_BEACON |
2708                       RXOPT2_RECV_CF |
2709                       RXOPT2_RECV_CTRL |
2710                       RXOPT2_RECV_DATA |
2711                       RXOPT2_RECV_MGMT |
2712                       RXOPT2_RECV_PROBE_REQ |
2713                       RXOPT2_RECV_PROBE_RESP |
2714                       RXOPT2_RECV_OTHER;
2715
2716         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2717                 rx_opt.opt1 |= RXOPT1_PROMISC;
2718                 rx_opt.opt2 |= RXOPT2_RECV_BROKEN | RXOPT2_RECV_ACK;
2719         } else {
2720                 rx_opt.opt1 |= promisc ? RXOPT1_PROMISC : RXOPT1_FILT_FDEST;
2721         }
2722
2723         if (acx_set_rxopt_conf(sc, &rx_opt) != 0) {
2724                 if_printf(&sc->sc_ic.ic_if, "can't config RX\n");
2725                 return ENXIO;
2726         }
2727         return 0;
2728 }
2729
2730 static int
2731 acx_set_chan(struct acx_softc *sc, struct ieee80211_channel *c)
2732 {
2733         struct ieee80211com *ic = &sc->sc_ic;
2734         uint16_t flags;
2735         uint8_t chan;
2736
2737         chan = ieee80211_chan2ieee(ic, c);
2738         if (acx_enable_txchan(sc, chan) != 0) {
2739                 if_printf(&ic->ic_if, "enable TX on channel %d failed\n", chan);
2740                 return EIO;
2741         }
2742         if (acx_enable_rxchan(sc, chan) != 0) {
2743                 if_printf(&ic->ic_if, "enable RX on channel %d failed\n", chan);
2744                 return EIO;
2745         }
2746
2747         if (IEEE80211_IS_CHAN_G(c))
2748                 flags = IEEE80211_CHAN_G;
2749         else
2750                 flags = IEEE80211_CHAN_B;
2751
2752         sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
2753                 htole16(c->ic_freq);
2754         sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
2755                 htole16(flags);
2756         return 0;
2757 }
2758
2759 static void
2760 acx_calibrate(void *xsc)
2761 {
2762         struct acx_softc *sc = xsc;
2763         struct ifnet *ifp = &sc->sc_ic.ic_if;
2764
2765         lwkt_serialize_enter(ifp->if_serializer);
2766         if (sc->chip_calibrate != NULL &&
2767             sc->sc_ic.ic_state == IEEE80211_S_RUN) {
2768                 sc->chip_calibrate(sc);
2769                 callout_reset(&sc->sc_calibrate_timer, hz * sc->sc_calib_intvl,
2770                               acx_calibrate, sc);
2771         }
2772         lwkt_serialize_exit(ifp->if_serializer);
2773 }