sys/dev/netif/acx/if_acx.c

   1 /*
   2  * Copyright (c) 2006 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Sepherosa Ziehau <sepherosa@gmail.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  * $DragonFly: src/sys/dev/netif/acx/if_acx.c,v 1.8 2006/10/25 20:55:55 dillon Exp $
  35  */
  36
  37 /*
  38  * Copyright (c) 2003-2004 wlan.kewl.org Project
  39  * All rights reserved.
  40  *
  41  * $Id: LICENSE,v 1.1.1.1 2004/07/01 12:20:39 darron Exp $
  42  *
  43  * Redistribution and use in source and binary forms, with or without
  44  * modification, are permitted provided that the following conditions
  45  * are met:
  46  *
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  *
  50  * 2. Redistributions in binary form must reproduce the above copyright
  51  *    notice, this list of conditions and the following disclaimer in the
  52  *    documentation and/or other materials provided with the distribution.
  53  *
  54  * 3. All advertising materials mentioning features or use of this software
  55  *    must display the following acknowledgement:
  56  *
  57  *    This product includes software developed by the wlan.kewl.org Project.
  58  *
  59  * 4. Neither the name of the wlan.kewl.org Project nor the names of its
  60  *    contributors may be used to endorse or promote products derived from
  61  *    this software without specific prior written permission.
  62  *
  63  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  64  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
  65  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
  66  * THE wlan.kewl.org Project BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  67  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  68  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  69  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  70  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  71  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  72  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  73  */
  74
  75 #include <sys/param.h>
  76 #include <sys/endian.h>
  77 #include <sys/kernel.h>
  78 #include <sys/bus.h>
  79 #include <sys/malloc.h>
  80 #include <sys/proc.h>
  81 #include <sys/rman.h>
  82 #include <sys/serialize.h>
  83 #include <sys/socket.h>
  84 #include <sys/sockio.h>
  85 #include <sys/sysctl.h>
  86
  87 #include <net/ethernet.h>
  88 #include <net/if.h>
  89 #include <net/bpf.h>
  90 #include <net/if_arp.h>
  91 #include <net/if_dl.h>
  92 #include <net/if_media.h>
  93 #include <net/ifq_var.h>
  94
  95 #include <netproto/802_11/ieee80211_var.h>
  96
  97 #include <bus/pci/pcireg.h>
  98 #include <bus/pci/pcivar.h>
  99 #include <bus/pci/pcidevs.h>
 100
 101 #define ACX_DEBUG
 102
 103 #include "if_acxreg.h"
 104 #include "if_acxvar.h"
 105 #include "acxcmd.h"
 106
 107 #define ACX_ENABLE_TXCHAN(sc, chan)                                     \
 108 do {                                                                    \
 109         if (acx_enable_txchan((sc), (chan)) != 0) {                     \
 110                 if_printf(&(sc)->sc_ic.ic_if,                           \
 111                           "enable TX on channel %d failed\n", (chan));  \
 112         }                                                               \
 113 } while (0)
 114
 115 #define ACX_ENABLE_RXCHAN(sc, chan)                                     \
 116 do {                                                                    \
 117         if (acx_enable_rxchan((sc), (chan)) != 0) {                     \
 118                 if_printf(&(sc)->sc_ic.ic_if,                           \
 119                           "enable RX on channel %d failed\n", (chan));  \
 120         }                                                               \
 121 } while (0)
 122
 123 #define SIOCSLOADFW     _IOW('i', 137, struct ifreq)    /* load firmware */
 124 #define SIOCGRADIO      _IOW('i', 138, struct ifreq)    /* get radio type */
 125 #define SIOCGSTATS      _IOW('i', 139, struct ifreq)    /* get acx stats */
 126 #define SIOCSKILLFW     _IOW('i', 140, struct ifreq)    /* free firmware */
 127 #define SIOCGFWVER      _IOW('i', 141, struct ifreq)    /* get firmware ver */
 128 #define SIOCGHWID       _IOW('i', 142, struct ifreq)    /* get hardware id */
 129
 130 static int      acx_probe(device_t);
 131 static int      acx_attach(device_t);
 132 static int      acx_detach(device_t);
 133 static int      acx_shutdown(device_t);
 134
 135 static void     acx_init(void *);
 136 static int      acx_stop(struct acx_softc *);
 137 static void     acx_init_info_reg(struct acx_softc *);
 138 static int      acx_config(struct acx_softc *);
 139 static int      acx_read_config(struct acx_softc *, struct acx_config *);
 140 static int      acx_write_config(struct acx_softc *, struct acx_config *);
 141 static int      acx_set_crypt_keys(struct acx_softc *);
 142 #ifdef foo
 143 static void     acx_begin_scan(struct acx_softc *);
 144 #endif
 145 static void     acx_next_scan(void *);
 146
 147 static void     acx_start(struct ifnet *);
 148 static void     acx_watchdog(struct ifnet *);
 149
 150 static int      acx_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 151
 152 static void     acx_intr(void *);
 153 static void     acx_disable_intr(struct acx_softc *);
 154 static void     acx_enable_intr(struct acx_softc *);
 155 static void     acx_txeof(struct acx_softc *);
 156 static void     acx_txerr(struct acx_softc *, uint8_t);
 157 static void     acx_rxeof(struct acx_softc *);
 158
 159 static int      acx_dma_alloc(struct acx_softc *);
 160 static void     acx_dma_free(struct acx_softc *);
 161 static int      acx_init_tx_ring(struct acx_softc *);
 162 static int      acx_init_rx_ring(struct acx_softc *);
 163 static int      acx_newbuf(struct acx_softc *, struct acx_rxbuf *, int);
 164 static int      acx_encap(struct acx_softc *, struct acx_txbuf *,
 165                           struct mbuf *, struct ieee80211_node *);
 166
 167 static int      acx_reset(struct acx_softc *);
 168
 169 static int      acx_set_null_tmplt(struct acx_softc *);
 170 static int      acx_set_probe_req_tmplt(struct acx_softc *, const char *, int);
 171 static int      acx_set_probe_resp_tmplt(struct acx_softc *,
 172                                          struct ieee80211_node *);
 173 static int      acx_set_beacon_tmplt(struct acx_softc *,
 174                                      struct ieee80211_node *);
 175
 176 static int      acx_read_eeprom(struct acx_softc *, uint32_t, uint8_t *);
 177 static int      acx_read_phyreg(struct acx_softc *, uint32_t, uint8_t *);
 178
 179 static int      acx_copyin_firmware(struct acx_softc *, struct ifreq *);
 180 static void     acx_free_firmware(struct acx_softc *);
 181 static int      acx_load_firmware(struct acx_softc *, uint32_t,
 182                                   const uint8_t *, int);
 183 static int      acx_load_radio_firmware(struct acx_softc *, const uint8_t *,
 184                                         uint32_t);
 185 static int      acx_load_base_firmware(struct acx_softc *, const uint8_t *,
 186                                        uint32_t);
 187
 188 static int      acx_newstate(struct ieee80211com *, enum ieee80211_state, int);
 189
 190 static int      acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS);
 191
 192 const struct ieee80211_rateset  acx_rates_11b =
 193         { 4, { 2, 4, 11, 22 } };
 194 const struct ieee80211_rateset  acx_rates_11g =
 195         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
 196
 197 static int      acx_chanscan_rate = 5;  /* 5/second */
 198 int             acx_beacon_intvl = 100; /* 100 TU */
 199
 200 static const struct acx_device {
 201         uint16_t        vid;
 202         uint16_t        did;
 203         void            (*set_param)(device_t);
 204         const char      *desc;
 205 } acx_devices[] = {
 206         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100A, acx100_set_param,
 207           "Texas Instruments TNETW1100A Wireless Adapter" },
 208         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100B, acx100_set_param,
 209           "Texas Instruments TNETW1100B Wireless Adapter" },
 210         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX111, acx111_set_param,
 211           "Texas Instruments TNETW1130 Wireless Adapter" },
 212         { 0, 0, NULL, NULL }
 213 };
 214
 215 static device_method_t acx_methods[] = {
 216         DEVMETHOD(device_probe,         acx_probe),
 217         DEVMETHOD(device_attach,        acx_attach),
 218         DEVMETHOD(device_detach,        acx_detach),
 219         DEVMETHOD(device_shutdown,      acx_shutdown),
 220 #if 0
 221         DEVMETHOD(device_suspend,       acx_suspend),
 222         DEVMETHOD(device_resume,        acx_resume),
 223 #endif
 224         { 0, 0 }
 225 };
 226
 227 static driver_t acx_driver = {
 228         "acx",
 229         acx_methods,
 230         sizeof(struct acx_softc)
 231 };
 232
 233 static devclass_t acx_devclass;
 234
 235 DRIVER_MODULE(acx, pci, acx_driver, acx_devclass, 0, 0);
 236 DRIVER_MODULE(acx, cardbus, acx_driver, acx_devclass, 0, 0);
 237
 238 MODULE_DEPEND(acx, wlan, 1, 1, 1);
 239 MODULE_DEPEND(acx, wlan_ratectl_onoe, 1, 1, 1);
 240 MODULE_DEPEND(acx, wlan_ratectl_amrr, 1, 1, 1);
 241 MODULE_DEPEND(acx, pci, 1, 1, 1);
 242 MODULE_DEPEND(acx, cardbus, 1, 1, 1);
 243
 244 static int
 245 acx_probe(device_t dev)
 246 {
 247         const struct acx_device *a;
 248         uint16_t did, vid;
 249
 250         vid = pci_get_vendor(dev);
 251         did = pci_get_device(dev);
 252         for (a = acx_devices; a->desc != NULL; ++a) {
 253                 if (vid == a->vid && did == a->did) {
 254                         a->set_param(dev);
 255                         device_set_desc(dev, a->desc);
 256                         return 0;
 257                 }
 258         }
 259         return ENXIO;
 260 }
 261
 262 static int
 263 acx_attach(device_t dev)
 264 {
 265         struct acx_softc *sc;
 266         struct ifnet *ifp;
 267         struct ieee80211com *ic;
 268         int i, error;
 269
 270         sc = device_get_softc(dev);
 271         ic = &sc->sc_ic;
 272         ifp = &ic->ic_if;
 273
 274         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 275
 276 #ifndef BURN_BRIDGES
 277         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 278                 uint32_t mem1, mem2, irq;
 279
 280                 mem1 = pci_read_config(dev, sc->chip_mem1_rid, 4);
 281                 mem2 = pci_read_config(dev, sc->chip_mem2_rid, 4);
 282                 irq = pci_read_config(dev, PCIR_INTLINE, 4);
 283
 284                 device_printf(dev, "chip is in D%d power mode "
 285                     "-- setting to D0\n", pci_get_powerstate(dev));
 286
 287                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 288
 289                 pci_write_config(dev, sc->chip_mem1_rid, mem1, 4);
 290                 pci_write_config(dev, sc->chip_mem2_rid, mem2, 4);
 291                 pci_write_config(dev, PCIR_INTLINE, irq, 4);
 292         }
 293 #endif  /* !BURN_BRIDGE */
 294
 295         /* Enable bus mastering */
 296         pci_enable_busmaster(dev);
 297
 298         /* Allocate IO memory 1 */
 299         sc->sc_mem1_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 300                                                  &sc->chip_mem1_rid,
 301                                                  RF_ACTIVE);
 302         if (sc->sc_mem1_res == NULL) {
 303                 error = ENXIO;
 304                 device_printf(dev, "can't allocate IO mem1\n");
 305                 goto fail;
 306         }
 307         sc->sc_mem1_bt = rman_get_bustag(sc->sc_mem1_res);
 308         sc->sc_mem1_bh = rman_get_bushandle(sc->sc_mem1_res);
 309
 310         /* Allocate IO memory 2 */
 311         sc->sc_mem2_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 312                                                  &sc->chip_mem2_rid,
 313                                                  RF_ACTIVE);
 314         if (sc->sc_mem2_res == NULL) {
 315                 error = ENXIO;
 316                 device_printf(dev, "can't allocate IO mem2\n");
 317                 goto fail;
 318         }
 319         sc->sc_mem2_bt = rman_get_bustag(sc->sc_mem2_res);
 320         sc->sc_mem2_bh = rman_get_bushandle(sc->sc_mem2_res);
 321
 322         /* Allocate irq */
 323         sc->sc_irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 324                                                 &sc->sc_irq_rid,
 325                                                 RF_SHAREABLE | RF_ACTIVE);
 326         if (sc->sc_irq_res == NULL) {
 327                 error = ENXIO;
 328                 device_printf(dev, "can't allocate intr\n");
 329                 goto fail;
 330         }
 331
 332         /* Initilize channel scanning timer */
 333         callout_init(&sc->sc_chanscan_timer);
 334
 335         /* Allocate busdma stuffs */
 336         error = acx_dma_alloc(sc);
 337         if (error)
 338                 goto fail;
 339
 340         /* Reset Hardware */
 341         error = acx_reset(sc);
 342         if (error)
 343                 goto fail;
 344
 345         /* Disable interrupts before firmware is loaded */
 346         acx_disable_intr(sc);
 347
 348         /* Get radio type and form factor */
 349 #define EEINFO_RETRY_MAX        50
 350         for (i = 0; i < EEINFO_RETRY_MAX; ++i) {
 351                 uint16_t ee_info;
 352
 353                 ee_info = CSR_READ_2(sc, ACXREG_EEPROM_INFO);
 354                 if (ACX_EEINFO_HAS_RADIO_TYPE(ee_info)) {
 355                         sc->sc_form_factor = ACX_EEINFO_FORM_FACTOR(ee_info);
 356                         sc->sc_radio_type = ACX_EEINFO_RADIO_TYPE(ee_info);
 357                         break;
 358                 }
 359                 DELAY(10000);
 360         }
 361         if (i == EEINFO_RETRY_MAX) {
 362                 error = ENXIO;
 363                 goto fail;
 364         }
 365 #undef EEINFO_RETRY_MAX
 366
 367         DPRINTF((&sc->sc_ic.ic_if, "radio type %02x\n", sc->sc_radio_type));
 368
 369 #ifdef DUMP_EEPROM
 370         for (i = 0; i < 0x40; ++i) {
 371                 uint8_t val;
 372
 373                 error = acx_read_eeprom(sc, i, &val);
 374                 if (i % 10 == 0)
 375                         printf("\n");
 376                 printf("%02x ", val);
 377         }
 378         printf("\n");
 379 #endif  /* DUMP_EEPROM */
 380
 381         /* Get EEPROM version */
 382         error = acx_read_eeprom(sc, ACX_EE_VERSION_OFS, &sc->sc_eeprom_ver);
 383         if (error)
 384                 goto fail;
 385         DPRINTF((&sc->sc_ic.ic_if, "EEPROM version %u\n", sc->sc_eeprom_ver));
 386
 387         ifp->if_softc = sc;
 388         ifp->if_init = acx_init;
 389         ifp->if_ioctl = acx_ioctl;
 390         ifp->if_start = acx_start;
 391         ifp->if_watchdog = acx_watchdog;
 392         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
 393         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 394         ifq_set_ready(&ifp->if_snd);
 395
 396         /* Set channels */
 397         for (i = 1; i <= 14; ++i) {
 398                 ic->ic_channels[i].ic_freq =
 399                         ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 400                 ic->ic_channels[i].ic_flags = sc->chip_chan_flags;
 401         }
 402
 403         ic->ic_opmode = IEEE80211_M_STA;
 404         ic->ic_state = IEEE80211_S_INIT;
 405         ic->ic_bintval = acx_beacon_intvl;
 406
 407         /*
 408          * NOTE: Don't overwrite ic_caps set by chip specific code
 409          */
 410         ic->ic_caps |= IEEE80211_C_WEP |        /* WEP */
 411                        IEEE80211_C_HOSTAP |     /* Host AP modes */
 412                        IEEE80211_C_IBSS |       /* IBSS modes */
 413                        IEEE80211_C_SHPREAMBLE;  /* Short preamble */
 414
 415         /* Get station id */
 416         for (i = 0; i < IEEE80211_ADDR_LEN; ++i) {
 417                 error = acx_read_eeprom(sc, sc->chip_ee_eaddr_ofs - i,
 418                                         &ic->ic_myaddr[i]);
 419         }
 420
 421         ieee80211_ifattach(ic);
 422
 423         /* Override newstate */
 424         sc->sc_newstate = ic->ic_newstate;
 425         ic->ic_newstate = acx_newstate;
 426
 427         ieee80211_media_init(ic, ieee80211_media_change, ieee80211_media_status);
 428
 429         sc->sc_long_retry_limit = 4;
 430         sc->sc_msdu_lifetime = 4096;
 431
 432         sysctl_ctx_init(&sc->sc_sysctl_ctx);
 433         sc->sc_sysctl_tree = SYSCTL_ADD_NODE(&sc->sc_sysctl_ctx,
 434                                              SYSCTL_STATIC_CHILDREN(_hw),
 435                                              OID_AUTO,
 436                                              device_get_nameunit(dev),
 437                                              CTLFLAG_RD, 0, "");
 438         if (sc->sc_sysctl_tree == NULL) {
 439                 device_printf(dev, "can't add sysctl node\n");
 440                 error = ENXIO;
 441                 goto fail1;
 442         }
 443
 444         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 445                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 446                         OID_AUTO, "msdu_lifetime",
 447                         CTLTYPE_INT | CTLFLAG_RW,
 448                         sc, 0, acx_sysctl_msdu_lifetime, "I",
 449                         "MSDU life time");
 450
 451         error = bus_setup_intr(dev, sc->sc_irq_res, INTR_MPSAFE, acx_intr, sc,
 452                                &sc->sc_irq_handle, ifp->if_serializer);
 453         if (error) {
 454                 device_printf(dev, "can't set up interrupt\n");
 455                 goto fail1;
 456         }
 457
 458         if (bootverbose)
 459                 ieee80211_announce(ic);
 460
 461         return 0;
 462 fail1:
 463         ieee80211_ifdetach(ic);
 464 fail:
 465         acx_detach(dev);
 466         return error;
 467 }
 468
 469 static int
 470 acx_detach(device_t dev)
 471 {
 472         struct acx_softc *sc = device_get_softc(dev);
 473
 474         if (device_is_attached(dev)) {
 475                 struct ieee80211com *ic = &sc->sc_ic;
 476                 struct ifnet *ifp = &ic->ic_if;
 477
 478                 lwkt_serialize_enter(ifp->if_serializer);
 479
 480                 acx_stop(sc);
 481                 acx_free_firmware(sc);
 482                 bus_teardown_intr(dev, sc->sc_irq_res, sc->sc_irq_handle);
 483
 484                 lwkt_serialize_exit(ifp->if_serializer);
 485
 486                 ieee80211_ifdetach(ic);
 487         }
 488
 489         if (sc->sc_sysctl_tree != NULL)
 490                 sysctl_ctx_free(&sc->sc_sysctl_ctx);
 491
 492         if (sc->sc_irq_res != NULL) {
 493                 bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
 494                                      sc->sc_irq_res);
 495         }
 496         if (sc->sc_mem1_res != NULL) {
 497                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem1_rid,
 498                                      sc->sc_mem1_res);
 499         }
 500         if (sc->sc_mem2_res != NULL) {
 501                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem2_rid,
 502                                      sc->sc_mem2_res);
 503         }
 504
 505         acx_dma_free(sc);
 506         return 0;
 507 }
 508
 509 static int
 510 acx_shutdown(device_t dev)
 511 {
 512         struct acx_softc *sc = device_get_softc(dev);
 513
 514         lwkt_serialize_enter(sc->sc_ic.ic_if.if_serializer);
 515         acx_stop(sc);
 516         lwkt_serialize_exit(sc->sc_ic.ic_if.if_serializer);
 517         return 0;
 518 }
 519
 520 static void
 521 acx_init(void *arg)
 522 {
 523         struct acx_softc *sc = arg;
 524         struct ifnet *ifp = &sc->sc_ic.ic_if;
 525         struct acx_firmware *fw = &sc->sc_firmware;
 526         int error;
 527
 528         error = acx_stop(sc);
 529         if (error)
 530                 return;
 531
 532         if (fw->base_fw == NULL) {
 533                 error = EINVAL;
 534                 if_printf(ifp, "base firmware is not loaded yet\n");
 535                 return;
 536         }
 537
 538         error = acx_init_tx_ring(sc);
 539         if (error) {
 540                 if_printf(ifp, "can't initialize TX ring\n");
 541                 goto back;
 542         }
 543
 544         error = acx_init_rx_ring(sc);
 545         if (error) {
 546                 if_printf(ifp, "can't initialize RX ring\n");
 547                 goto back;
 548         }
 549
 550         error = acx_load_base_firmware(sc, fw->base_fw, fw->base_fw_len);
 551         if (error)
 552                 goto back;
 553
 554         /*
 555          * Initialize command and information registers
 556          * NOTE: This should be done after base firmware is loaded
 557          */
 558         acx_init_cmd_reg(sc);
 559         acx_init_info_reg(sc);
 560
 561         sc->sc_flags |= ACX_FLAG_FW_LOADED;
 562
 563 #if 0
 564         if (sc->chip_post_basefw != NULL) {
 565                 error = sc->chip_post_basefw(sc);
 566                 if (error)
 567                         goto back;
 568         }
 569 #endif
 570
 571         if (fw->radio_fw != NULL) {
 572                 error = acx_load_radio_firmware(sc, fw->radio_fw,
 573                                                 fw->radio_fw_len);
 574                 if (error)
 575                         goto back;
 576         }
 577
 578         error = sc->chip_init(sc);
 579         if (error)
 580                 goto back;
 581
 582         /* Get and set device various configuration */
 583         error = acx_config(sc);
 584         if (error)
 585                 goto back;
 586
 587         /* Setup crypto stuffs */
 588         if (sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) {
 589                 error = acx_set_crypt_keys(sc);
 590                 if (error)
 591                         goto back;
 592                 sc->sc_ic.ic_flags &= ~IEEE80211_F_DROPUNENC;
 593         }
 594
 595         /* Turn on power led */
 596         CSR_CLRB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 597
 598         acx_enable_intr(sc);
 599
 600         ifp->if_flags |= IFF_RUNNING;
 601         ifp->if_flags &= ~IFF_OACTIVE;
 602
 603         /* Begin background scanning */
 604 #ifdef foo
 605         acx_begin_scan(sc);
 606 #else
 607         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_SCAN, -1);
 608 #endif
 609
 610 back:
 611         if (error)
 612                 acx_stop(sc);
 613 }
 614
 615 static void
 616 acx_init_info_reg(struct acx_softc *sc)
 617 {
 618         sc->sc_info = CSR_READ_4(sc, ACXREG_INFO_REG_OFFSET);
 619         sc->sc_info_param = sc->sc_info + ACX_INFO_REG_SIZE;
 620 }
 621
 622 static int
 623 acx_set_crypt_keys(struct acx_softc *sc)
 624 {
 625         struct ieee80211com *ic = &sc->sc_ic;
 626         struct acx_conf_wep_txkey wep_txkey;
 627         int i, error, got_wk = 0;
 628
 629         for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
 630                 struct ieee80211_key *wk = &ic->ic_nw_keys[i];
 631
 632                 if (wk->wk_keylen == 0)
 633                         continue;
 634
 635                 if (sc->chip_hw_crypt) {
 636                         error = sc->chip_set_wepkey(sc, wk, i);
 637                         if (error)
 638                                 return error;
 639                         got_wk = 1;
 640                 } else if (wk->wk_flags & IEEE80211_KEY_XMIT) {
 641                         wk->wk_flags |= IEEE80211_KEY_SWCRYPT;
 642                 }
 643         }
 644
 645         if (!got_wk || sc->chip_hw_crypt ||
 646             ic->ic_def_txkey == IEEE80211_KEYIX_NONE)
 647                 return 0;
 648
 649         /* Set current WEP key index */
 650         wep_txkey.wep_txkey = ic->ic_def_txkey;
 651         if (acx_set_wep_txkey_conf(sc, &wep_txkey) != 0) {
 652                 if_printf(&ic->ic_if, "set WEP txkey failed\n");
 653                 return ENXIO;
 654         }
 655         return 0;
 656 }
 657
 658 #ifdef foo
 659 static void
 660 acx_begin_scan(struct acx_softc *sc)
 661 {
 662         struct ieee80211com *ic = &sc->sc_ic;
 663         uint8_t chan;
 664
 665         ieee80211_begin_scan(ic, 1);
 666
 667         chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 668
 669         ACX_ENABLE_TXCHAN(sc, chan);
 670         ACX_ENABLE_RXCHAN(sc, chan);
 671
 672         /* Start background scanning */
 673         callout_reset(&sc->sc_chanscan_timer, hz / acx_chanscan_rate,
 674                       acx_next_scan, sc);
 675 }
 676 #endif
 677
 678 static void
 679 acx_next_scan(void *arg)
 680 {
 681         struct acx_softc *sc = arg;
 682         struct ieee80211com *ic = &sc->sc_ic;
 683         struct ifnet *ifp = &ic->ic_if;
 684
 685         lwkt_serialize_enter(ifp->if_serializer);
 686
 687         if (ic->ic_state == IEEE80211_S_SCAN) {
 688 #if 0
 689                 uint8_t chan;
 690 #endif
 691
 692                 ieee80211_next_scan(ic);
 693
 694 #if 0
 695                 chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 696
 697                 ACX_ENABLE_TXCHAN(sc, chan);
 698                 ACX_ENABLE_RXCHAN(sc, chan);
 699
 700                 callout_reset(&sc->sc_chanscan_timer, hz / acx_chanscan_rate,
 701                               acx_next_scan, sc);
 702 #endif
 703         }
 704
 705         lwkt_serialize_exit(ifp->if_serializer);
 706 }
 707
 708 static int
 709 acx_stop(struct acx_softc *sc)
 710 {
 711         struct ieee80211com *ic = &sc->sc_ic;
 712         struct ifnet *ifp = &ic->ic_if;
 713         struct acx_buf_data *bd = &sc->sc_buf_data;
 714         struct acx_ring_data *rd = &sc->sc_ring_data;
 715         int i, error;
 716
 717         ASSERT_SERIALIZED(ifp->if_serializer);
 718
 719         sc->sc_firmware_ver = 0;
 720         sc->sc_hardware_id = 0;
 721
 722         /* Reset hardware */
 723         error = acx_reset(sc);
 724         if (error)
 725                 return error;
 726
 727         /* Firmware no longer functions after hardware reset */
 728         sc->sc_flags &= ~ACX_FLAG_FW_LOADED;
 729
 730         acx_disable_intr(sc);
 731
 732         /* Stop backgroud scanning */
 733         callout_stop(&sc->sc_chanscan_timer);
 734
 735         /* Turn off power led */
 736         CSR_SETB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 737
 738         /* Free TX mbuf */
 739         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
 740                 struct acx_txbuf *buf;
 741
 742                 buf = &bd->tx_buf[i];
 743
 744                 if (buf->tb_mbuf != NULL) {
 745                         bus_dmamap_unload(bd->mbuf_dma_tag,
 746                                           buf->tb_mbuf_dmamap);
 747                         m_freem(buf->tb_mbuf);
 748                         buf->tb_mbuf = NULL;
 749                 }
 750
 751                 if (buf->tb_node != NULL)
 752                         ieee80211_free_node(buf->tb_node);
 753                 buf->tb_node = NULL;
 754         }
 755
 756         /* Clear TX host descriptors */
 757         bzero(rd->tx_ring, ACX_TX_RING_SIZE);
 758
 759         /* Free RX mbuf */
 760         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
 761                 if (bd->rx_buf[i].rb_mbuf != NULL) {
 762                         bus_dmamap_unload(bd->mbuf_dma_tag,
 763                                           bd->rx_buf[i].rb_mbuf_dmamap);
 764                         m_freem(bd->rx_buf[i].rb_mbuf);
 765                         bd->rx_buf[i].rb_mbuf = NULL;
 766                 }
 767         }
 768
 769         /* Clear RX host descriptors */
 770         bzero(rd->rx_ring, ACX_RX_RING_SIZE);
 771
 772         ifp->if_timer = 0;
 773         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 774         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
 775
 776         return 0;
 777 }
 778
 779 static int
 780 acx_config(struct acx_softc *sc)
 781 {
 782         struct acx_config conf;
 783         int error;
 784
 785         error = acx_read_config(sc, &conf);
 786         if (error)
 787                 return error;
 788
 789         error = acx_write_config(sc, &conf);
 790         if (error)
 791                 return error;
 792
 793         if (acx_set_probe_req_tmplt(sc, "", 0) != 0) {
 794                 if_printf(&sc->sc_ic.ic_if, "can't set probe req template "
 795                           "(empty ssid)\n");
 796                 return ENXIO;
 797         }
 798
 799         /* XXX for PM?? */
 800         if (acx_set_null_tmplt(sc) != 0) {
 801                 if_printf(&sc->sc_ic.ic_if, "can't set null data template\n");
 802                 return ENXIO;
 803         }
 804         return 0;
 805 }
 806
 807 static int
 808 acx_read_config(struct acx_softc *sc, struct acx_config *conf)
 809 {
 810         struct acx_conf_eaddr addr;
 811         struct acx_conf_regdom reg_dom;
 812         struct acx_conf_antenna ant;
 813         struct acx_conf_fwrev fw_rev;
 814         uint32_t fw_rev_no;
 815         uint8_t sen;
 816         int i, error;
 817
 818         /* Get station id */
 819         if (acx_get_eaddr_conf(sc, &addr) != 0) {
 820                 if_printf(&sc->sc_ic.ic_if, "can't get station id\n");
 821                 return ENXIO;
 822         }
 823
 824         /*
 825          * Get and print station id in case that EEPROM station id's
 826          * offset is not correct
 827          */
 828         for (i = 0; i < IEEE80211_ADDR_LEN; ++i)
 829                 conf->eaddr[IEEE80211_ADDR_LEN - 1 - i] = addr.eaddr[i];
 830         if_printf(&sc->sc_ic.ic_if, "MAC address (from firmware): %6D\n",
 831                   conf->eaddr, ":");
 832
 833         /* Get region domain */
 834         if (acx_get_regdom_conf(sc, &reg_dom) != 0) {
 835                 if_printf(&sc->sc_ic.ic_if, "can't get region domain\n");
 836                 return ENXIO;
 837         }
 838         conf->regdom = reg_dom.regdom;
 839         DPRINTF((&sc->sc_ic.ic_if, "regdom %02x\n", reg_dom.regdom));
 840
 841         /* Get antenna */
 842         if (acx_get_antenna_conf(sc, &ant) != 0) {
 843                 if_printf(&sc->sc_ic.ic_if, "can't get antenna\n");
 844                 return ENXIO;
 845         }
 846         conf->antenna = ant.antenna;
 847         DPRINTF((&sc->sc_ic.ic_if, "antenna %02x\n", ant.antenna));
 848
 849         /* Get sensitivity XXX not used */
 850         if (sc->sc_radio_type == ACX_RADIO_TYPE_MAXIM ||
 851             sc->sc_radio_type == ACX_RADIO_TYPE_RFMD ||
 852             sc->sc_radio_type == ACX_RADIO_TYPE_RALINK) {
 853                 error = acx_read_phyreg(sc, ACXRV_PHYREG_SENSITIVITY, &sen);
 854                 if (error) {
 855                         if_printf(&sc->sc_ic.ic_if, "can't get sensitivity\n");
 856                         return error;
 857                 }
 858         } else {
 859                 sen = 0;
 860         }
 861         DPRINTF((&sc->sc_ic.ic_if, "sensitivity %02x\n", sen));
 862
 863         /* Get firmware revision */
 864         if (acx_get_fwrev_conf(sc, &fw_rev) != 0) {
 865                 if_printf(&sc->sc_ic.ic_if, "can't get firmware revision\n");
 866                 return ENXIO;
 867         }
 868
 869         if (strncmp(fw_rev.fw_rev, "Rev ", 4) != 0) {
 870                 if_printf(&sc->sc_ic.ic_if, "strange revision string -- %s\n",
 871                           fw_rev.fw_rev);
 872                 fw_rev_no = 0x01090407;
 873         } else {
 874                 char *s, *endp;
 875
 876                 /*
 877                  *  01234
 878                  * "Rev xx.xx.xx.xx"
 879                  *      ^ Start from here
 880                  */
 881                 s = &fw_rev.fw_rev[4];
 882                 fw_rev_no = 0;
 883                 for (i = 0; i < 4; ++i) {
 884                         uint8_t val;
 885
 886                         val = strtoul(s, &endp, 16);
 887                         fw_rev_no |= val << ((3 - i) * 8);
 888
 889                         if (*endp == '\0')
 890                                 break;
 891                         else
 892                                 s = ++endp;
 893                 }
 894         }
 895         sc->sc_firmware_ver = fw_rev_no;
 896         sc->sc_hardware_id = le32toh(fw_rev.hw_id);
 897         DPRINTF((&sc->sc_ic.ic_if, "fw rev %08x, hw id %08x\n",
 898                  sc->sc_firmware_ver, sc->sc_hardware_id));
 899
 900         if (sc->chip_read_config != NULL) {
 901                 error = sc->chip_read_config(sc, conf);
 902                 if (error)
 903                         return error;
 904         }
 905         return 0;
 906 }
 907
 908 static int
 909 acx_write_config(struct acx_softc *sc, struct acx_config *conf)
 910 {
 911         struct acx_conf_nretry_short sretry;
 912         struct acx_conf_nretry_long lretry;
 913         struct acx_conf_msdu_lifetime msdu_lifetime;
 914         struct acx_conf_rate_fallback rate_fb;
 915         struct acx_conf_antenna ant;
 916         struct acx_conf_regdom reg_dom;
 917         struct acx_conf_rxopt rx_opt;
 918         int error;
 919
 920         /* Set number of long/short retry */
 921         KKASSERT(sc->chip_short_retry_limit > 0);
 922         sretry.nretry = sc->chip_short_retry_limit;
 923         if (acx_set_nretry_short_conf(sc, &sretry) != 0) {
 924                 if_printf(&sc->sc_ic.ic_if, "can't set short retry limit\n");
 925                 return ENXIO;
 926         }
 927
 928         lretry.nretry = sc->sc_long_retry_limit;
 929         if (acx_set_nretry_long_conf(sc, &lretry) != 0) {
 930                 if_printf(&sc->sc_ic.ic_if, "can't set long retry limit\n");
 931                 return ENXIO;
 932         }
 933
 934         /* Set MSDU lifetime */
 935         msdu_lifetime.lifetime = htole32(sc->sc_msdu_lifetime);
 936         if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
 937                 if_printf(&sc->sc_ic.ic_if, "can't set MSDU lifetime\n");
 938                 return ENXIO;
 939         }
 940
 941         /* Enable rate fallback */
 942         rate_fb.ratefb_enable = 1;
 943         if (acx_set_rate_fallback_conf(sc, &rate_fb) != 0) {
 944                 if_printf(&sc->sc_ic.ic_if, "can't enable rate fallback\n");
 945                 return ENXIO;
 946         }
 947
 948         /* Set antenna */
 949         ant.antenna = conf->antenna;
 950         if (acx_set_antenna_conf(sc, &ant) != 0) {
 951                 if_printf(&sc->sc_ic.ic_if, "can't set antenna\n");
 952                 return ENXIO;
 953         }
 954
 955         /* Set region domain */
 956         reg_dom.regdom = conf->regdom;
 957         if (acx_set_regdom_conf(sc, &reg_dom) != 0) {
 958                 if_printf(&sc->sc_ic.ic_if, "can't set region domain\n");
 959                 return ENXIO;
 960         }
 961
 962         if (sc->chip_write_config != NULL) {
 963                 error = sc->chip_write_config(sc, conf);
 964                 if (error)
 965                         return error;
 966         }
 967
 968         /* What we want to receive and how to receive */
 969         /* XXX may not belong here, acx_init() */
 970         rx_opt.opt1 = RXOPT1_FILT_FDEST | RXOPT1_INCL_RXBUF_HDR;
 971         rx_opt.opt2 = RXOPT2_RECV_ASSOC_REQ |
 972                       RXOPT2_RECV_AUTH |
 973                       RXOPT2_RECV_BEACON |
 974                       RXOPT2_RECV_CF |
 975                       RXOPT2_RECV_CTRL |
 976                       RXOPT2_RECV_DATA |
 977                       RXOPT2_RECV_MGMT |
 978                       RXOPT2_RECV_PROBE_REQ |
 979                       RXOPT2_RECV_PROBE_RESP |
 980                       RXOPT2_RECV_OTHER;
 981         if (acx_set_rxopt_conf(sc, &rx_opt) != 0) {
 982                 if_printf(&sc->sc_ic.ic_if, "can't set RX option\n");
 983                 return ENXIO;
 984         }
 985         return 0;
 986 }
 987
 988 static int
 989 acx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
 990 {
 991         struct acx_softc *sc = ifp->if_softc;
 992         struct ifreq *req;
 993         int error;
 994
 995         error = 0;
 996         req = (struct ifreq *)data;
 997
 998         switch (cmd) {
 999         case SIOCSLOADFW:
1000                 error = suser_cred(cr, NULL_CRED_OKAY);
1001                 if (error)
1002                         break;
1003
1004                 error = acx_copyin_firmware(sc, req);
1005                 break;
1006         case SIOCSKILLFW:
1007                 error = suser_cred(cr, NULL_CRED_OKAY);
1008                 if (error)
1009                         break;
1010                 acx_free_firmware(sc);
1011                 break;
1012         case SIOCGRADIO:
1013                 error = copyout(&sc->sc_radio_type, req->ifr_data,
1014                                 sizeof(sc->sc_radio_type));
1015                 break;
1016         case SIOCGFWVER:
1017                 error = copyout(&sc->sc_firmware_ver, req->ifr_data,
1018                                 sizeof(sc->sc_firmware_ver));
1019                 break;
1020         case SIOCGHWID:
1021                 error = copyout(&sc->sc_hardware_id, req->ifr_data,
1022                                 sizeof(sc->sc_hardware_id));
1023                 break;
1024         case SIOCGSTATS:
1025                 error = copyout(&sc->sc_stats, req->ifr_data,
1026                                 sizeof(sc->sc_stats));
1027                 break;
1028         case SIOCSIFFLAGS:
1029                 if (ifp->if_flags & IFF_UP) {
1030                         if ((ifp->if_flags & IFF_RUNNING) == 0)
1031                                 acx_init(sc);
1032                 } else {
1033                         if (ifp->if_flags & IFF_RUNNING)
1034                                 acx_stop(sc);
1035                 }
1036                 break;
1037         case SIOCADDMULTI:
1038         case SIOCDELMULTI:
1039                 /* TODO */
1040                 break;
1041         default:
1042                 error = ieee80211_ioctl(&sc->sc_ic, cmd, data, cr);
1043                 break;
1044         }
1045
1046         if (error == ENETRESET) {
1047                 if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
1048                     (IFF_RUNNING | IFF_UP))
1049                         acx_init(sc);
1050                 error = 0;
1051         }
1052         return error;
1053 }
1054
1055 static void
1056 acx_start(struct ifnet *ifp)
1057 {
1058         struct acx_softc *sc = ifp->if_softc;
1059         struct ieee80211com *ic = &sc->sc_ic;
1060         struct acx_buf_data *bd = &sc->sc_buf_data;
1061         struct acx_txbuf *buf;
1062         int trans, idx;
1063
1064         ASSERT_SERIALIZED(ifp->if_serializer);
1065
1066         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0 ||
1067             (ifp->if_flags & IFF_RUNNING) == 0 ||
1068             (ifp->if_flags & IFF_OACTIVE))
1069                 return;
1070
1071         /*
1072          * NOTE:
1073          * We can't start from a random position that TX descriptor
1074          * is free, since hardware will be confused by that.
1075          * We have to follow the order of the TX ring.
1076          */
1077         idx = bd->tx_free_start;
1078         trans = 0;
1079         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf == NULL;
1080              buf = &bd->tx_buf[idx]) {
1081                 struct ieee80211_frame *f;
1082                 struct ieee80211_node *ni = NULL;
1083                 struct mbuf *m;
1084                 int mgmt_pkt = 0;
1085
1086                 if (!IF_QEMPTY(&ic->ic_mgtq)) {
1087                         IF_DEQUEUE(&ic->ic_mgtq, m);
1088
1089                         ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1090                         m->m_pkthdr.rcvif = NULL;
1091
1092                         mgmt_pkt = 1;
1093                 } else if (!ifq_is_empty(&ifp->if_snd)) {
1094                         struct ether_header *eh;
1095
1096                         if (ic->ic_state != IEEE80211_S_RUN) {
1097                                 if_printf(ifp, "data packet dropped due to "
1098                                           "not RUN.  Current state %d\n",
1099                                           ic->ic_state);
1100                                 break;
1101                         }
1102
1103                         m = ifq_dequeue(&ifp->if_snd, NULL);
1104                         if (m == NULL)
1105                                 break;
1106
1107                         if (m->m_len < sizeof(struct ether_header)) {
1108                                 m = m_pullup(m, sizeof(struct ether_header));
1109                                 if (m == NULL) {
1110                                         ifp->if_oerrors++;
1111                                         continue;
1112                                 }
1113                         }
1114                         eh = mtod(m, struct ether_header *);
1115
1116                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1117                         if (ni == NULL) {
1118                                 m_freem(m);
1119                                 ifp->if_oerrors++;
1120                                 continue;
1121                         }
1122
1123                         /* TODO power save */
1124
1125                         m = ieee80211_encap(ic, m, ni);
1126                         if (m == NULL) {
1127                                 ieee80211_free_node(ni);
1128                                 ifp->if_oerrors++;
1129                                 continue;
1130                         }
1131
1132                         BPF_MTAP(ifp, m);
1133                 } else {
1134                         break;
1135                 }
1136
1137                 f = mtod(m, struct ieee80211_frame *);
1138                 if ((f->i_fc[1] & IEEE80211_FC1_WEP) && !sc->chip_hw_crypt) {
1139                         KASSERT(ni != NULL, ("TX node is NULL (WEP)\n"));
1140                         if (ieee80211_crypto_encap(ic, ni, m) == NULL) {
1141                                 ieee80211_free_node(ni);
1142                                 m_freem(m);
1143                                 ifp->if_oerrors++;
1144                                 continue;
1145                         }
1146                 }
1147
1148                 if (ic->ic_rawbpf != NULL)
1149                         bpf_mtap(ic->ic_rawbpf, m);
1150
1151                 /*
1152                  * Since mgmt data are transmitted at fixed rate
1153                  * they will not be used to do rate control.
1154                  */
1155                 if (mgmt_pkt && ni != NULL) {
1156                         ieee80211_free_node(ni);
1157                         ni = NULL;
1158                 }
1159
1160                 if (acx_encap(sc, buf, m, ni) != 0) {
1161                         /*
1162                          * NOTE: `m' will be freed in acx_encap()
1163                          * if we reach here.
1164                          */
1165                         if (ni != NULL)
1166                                 ieee80211_free_node(ni);
1167                         ifp->if_oerrors++;
1168                         continue;
1169                 }
1170
1171                 /*
1172                  * NOTE:
1173                  * 1) `m' should not be touched after acx_encap()
1174                  * 2) `node' will be used to do TX rate control during
1175                  *    acx_txeof(), so it is not freed here.  acx_txeof()
1176                  *    will free it for us
1177                  */
1178
1179                 trans = 1;
1180                 bd->tx_used_count++;
1181                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1182         }
1183         bd->tx_free_start = idx;
1184
1185         if (bd->tx_used_count == ACX_TX_DESC_CNT)
1186                 ifp->if_flags |= IFF_OACTIVE;
1187
1188         if (trans && ifp->if_timer == 0)
1189                 ifp->if_timer = 5;
1190 }
1191
1192 static void
1193 acx_watchdog(struct ifnet *ifp)
1194 {
1195         if_printf(ifp, "watchdog timeout\n");
1196         acx_txeof(ifp->if_softc);
1197         /* TODO */
1198 }
1199
1200 static void
1201 acx_intr(void *arg)
1202 {
1203         struct acx_softc *sc = arg;
1204         uint16_t intr_status;
1205
1206         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0)
1207                 return;
1208
1209         intr_status = CSR_READ_2(sc, ACXREG_INTR_STATUS_CLR);
1210         if (intr_status == ACXRV_INTR_ALL) {
1211                 /* not our interrupt */
1212                 return;
1213         }
1214
1215         intr_status &= sc->chip_intr_enable;
1216         if (intr_status == 0) {
1217                 /* not interrupts we care about */
1218                 return;
1219         }
1220
1221         /* Acknowledge all interrupts */
1222         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_ALL);
1223
1224         if (intr_status & ACXRV_INTR_TX_FINI)
1225                 acx_txeof(sc);
1226
1227         if (intr_status & ACXRV_INTR_RX_FINI)
1228                 acx_rxeof(sc);
1229 }
1230
1231 static void
1232 acx_disable_intr(struct acx_softc *sc)
1233 {
1234         CSR_WRITE_2(sc, ACXREG_INTR_MASK, sc->chip_intr_disable);
1235         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, 0);
1236 }
1237
1238 static void
1239 acx_enable_intr(struct acx_softc *sc)
1240 {
1241         /* Mask out interrupts that are not in the enable set */
1242         CSR_WRITE_2(sc, ACXREG_INTR_MASK, ~sc->chip_intr_enable);
1243         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, ACXRV_EVENT_DISABLE);
1244 }
1245
1246 static void
1247 acx_txeof(struct acx_softc *sc)
1248 {
1249         struct acx_buf_data *bd;
1250         struct acx_txbuf *buf;
1251         struct ifnet *ifp;
1252         int idx;
1253
1254         ifp = &sc->sc_ic.ic_if;
1255         ASSERT_SERIALIZED(ifp->if_serializer);
1256
1257         bd = &sc->sc_buf_data;
1258         idx = bd->tx_used_start;
1259         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf != NULL;
1260              buf = &bd->tx_buf[idx]) {
1261                 uint8_t ctrl, error;
1262                 int frame_len;
1263
1264                 ctrl = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_ctrl);
1265                 if ((ctrl & (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE)) !=
1266                     (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE))
1267                         break;
1268
1269                 bus_dmamap_unload(bd->mbuf_dma_tag, buf->tb_mbuf_dmamap);
1270                 frame_len = buf->tb_mbuf->m_pkthdr.len;
1271                 m_freem(buf->tb_mbuf);
1272                 buf->tb_mbuf = NULL;
1273
1274                 error = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_error);
1275                 if (error) {
1276                         acx_txerr(sc, error);
1277                         ifp->if_oerrors++;
1278                 } else {
1279                         ifp->if_opackets++;
1280                 }
1281
1282                 if (buf->tb_node != NULL) {
1283                         sc->chip_tx_complete(sc, buf, frame_len, error);
1284                         ieee80211_free_node(buf->tb_node);
1285                         buf->tb_node = NULL;
1286                 }
1287
1288                 FW_TXDESC_SETFIELD_1(sc, buf, f_tx_ctrl, DESC_CTRL_HOSTOWN);
1289
1290                 bd->tx_used_count--;
1291
1292                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1293         }
1294         bd->tx_used_start = idx;
1295
1296         ifp->if_timer = bd->tx_used_count == 0 ? 0 : 5;
1297
1298         if (bd->tx_used_count != ACX_TX_DESC_CNT) {
1299                 ifp->if_flags &= ~IFF_OACTIVE;
1300                 acx_start(ifp);
1301         }
1302 }
1303
1304 static void
1305 acx_txerr(struct acx_softc *sc, uint8_t err)
1306 {
1307         struct ifnet *ifp = &sc->sc_ic.ic_if;
1308         struct acx_stats *stats = &sc->sc_stats;
1309
1310         if (err == DESC_ERR_EXCESSIVE_RETRY) {
1311                 /*
1312                  * This a common error (see comment below),
1313                  * so print it using DPRINTF()
1314                  */
1315                 DPRINTF((ifp, "TX failed -- excessive retry\n"));
1316         } else {
1317                 if_printf(ifp, "TX failed -- ");
1318         }
1319
1320         /*
1321          * Although `err' looks like bitmask, it never
1322          * has multiple bits set.
1323          */
1324         switch (err) {
1325 #if 0
1326         case DESC_ERR_OTHER_FRAG:
1327                 /* XXX what's this */
1328                 printf("error in other fragment\n");
1329                 stats->err_oth_frag++;
1330                 break;
1331 #endif
1332         case DESC_ERR_ABORT:
1333                 printf("aborted\n");
1334                 stats->err_abort++;
1335                 break;
1336         case DESC_ERR_PARAM:
1337                 printf("wrong paramters in descriptor\n");
1338                 stats->err_param++;
1339                 break;
1340         case DESC_ERR_NO_WEPKEY:
1341                 printf("WEP key missing\n");
1342                 stats->err_no_wepkey++;
1343                 break;
1344         case DESC_ERR_MSDU_TIMEOUT:
1345                 printf("MSDU life timeout\n");
1346                 stats->err_msdu_timeout++;
1347                 break;
1348         case DESC_ERR_EXCESSIVE_RETRY:
1349                 /*
1350                  * Possible causes:
1351                  * 1) Distance is too long
1352                  * 2) Transmit failed (e.g. no MAC level ACK)
1353                  * 3) Chip overheated (this should be rare)
1354                  */
1355                 stats->err_ex_retry++;
1356                 break;
1357         case DESC_ERR_BUF_OVERFLOW:
1358                 printf("buffer overflow\n");
1359                 stats->err_buf_oflow++;
1360                 break;
1361         case DESC_ERR_DMA:
1362                 printf("DMA error\n");
1363                 stats->err_dma++;
1364                 break;
1365         default:
1366                 printf("unknown error %d\n", err);
1367                 stats->err_unkn++;
1368                 break;
1369         }
1370 }
1371
1372 static void
1373 acx_rxeof(struct acx_softc *sc)
1374 {
1375         struct ieee80211com *ic = &sc->sc_ic;
1376         struct acx_ring_data *rd = &sc->sc_ring_data;
1377         struct acx_buf_data *bd = &sc->sc_buf_data;
1378         struct ifnet *ifp = &ic->ic_if;
1379         int idx, ready;
1380
1381         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1382
1383         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1384                         BUS_DMASYNC_POSTREAD);
1385
1386         /*
1387          * Locate first "ready" rx buffer,
1388          * start from last stopped position
1389          */
1390         idx = bd->rx_scan_start;
1391         ready = 0;
1392         do {
1393                 struct acx_rxbuf *buf;
1394
1395                 buf = &bd->rx_buf[idx];
1396                 if ((buf->rb_desc->h_ctrl & htole16(DESC_CTRL_HOSTOWN)) &&
1397                     (buf->rb_desc->h_status & htole32(DESC_STATUS_FULL))) {
1398                         ready = 1;
1399                         break;
1400                 }
1401                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1402         } while (idx != bd->rx_scan_start);
1403
1404         if (!ready)
1405                 return;
1406
1407         /*
1408          * NOTE: don't mess up `idx' here, it will
1409          * be used in the following code
1410          */
1411
1412         do {
1413                 struct acx_rxbuf_hdr *head;
1414                 struct acx_rxbuf *buf;
1415                 struct mbuf *m;
1416                 uint32_t desc_status;
1417                 uint16_t desc_ctrl;
1418                 int len, error;
1419
1420                 buf = &bd->rx_buf[idx];
1421
1422                 desc_ctrl = le16toh(buf->rb_desc->h_ctrl);
1423                 desc_status = le32toh(buf->rb_desc->h_status);
1424                 if (!(desc_ctrl & DESC_CTRL_HOSTOWN) ||
1425                     !(desc_status & DESC_STATUS_FULL))
1426                         break;
1427
1428                 bus_dmamap_sync(bd->mbuf_dma_tag, buf->rb_mbuf_dmamap,
1429                                 BUS_DMASYNC_POSTREAD);
1430
1431                 m = buf->rb_mbuf;
1432
1433                 error = acx_newbuf(sc, buf, 0);
1434                 if (error) {
1435                         ifp->if_ierrors++;
1436                         goto next;
1437                 }
1438
1439                 head = mtod(m, struct acx_rxbuf_hdr *);
1440
1441                 len = le16toh(head->rbh_len) & ACX_RXBUF_LEN_MASK;
1442                 if (len >= sizeof(struct ieee80211_frame_min) &&
1443                     len < MCLBYTES) {
1444                         struct ieee80211_frame *f;
1445                         struct ieee80211_node *ni;
1446
1447                         m_adj(m, sizeof(struct acx_rxbuf_hdr) +
1448                                  sc->chip_rxbuf_exhdr);
1449                         f = mtod(m, struct ieee80211_frame *);
1450
1451                         if ((f->i_fc[1] & IEEE80211_FC1_WEP) &&
1452                             sc->chip_hw_crypt) {
1453                                 /* Short circuit software WEP */
1454                                 f->i_fc[1] &= ~IEEE80211_FC1_WEP;
1455
1456                                 /* Do chip specific RX buffer processing */
1457                                 if (sc->chip_proc_wep_rxbuf != NULL) {
1458                                         sc->chip_proc_wep_rxbuf(sc, m, &len);
1459                                         f = mtod(m, struct ieee80211_frame *);
1460                                 }
1461                         }
1462
1463                         ni = ieee80211_find_rxnode(ic,
1464                                 (struct ieee80211_frame_min *)f);
1465
1466                         m->m_len = m->m_pkthdr.len = len;
1467                         m->m_pkthdr.rcvif = &ic->ic_if;
1468
1469                         ieee80211_input(ic, m, ni, head->rbh_level,
1470                                         le32toh(head->rbh_time));
1471
1472                         ieee80211_free_node(ni);
1473                         ifp->if_ipackets++;
1474                 } else {
1475                         m_freem(m);
1476                         ifp->if_ierrors++;
1477                 }
1478
1479 next:
1480                 buf->rb_desc->h_ctrl = htole16(desc_ctrl & ~DESC_CTRL_HOSTOWN);
1481                 buf->rb_desc->h_status = 0;
1482                 bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1483                                 BUS_DMASYNC_PREWRITE);
1484
1485                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1486         } while (idx != bd->rx_scan_start);
1487
1488         /*
1489          * Record the position so that next
1490          * time we can start from it
1491          */
1492         bd->rx_scan_start = idx;
1493 }
1494
1495 static int
1496 acx_reset(struct acx_softc *sc)
1497 {
1498         uint16_t reg;
1499
1500         /* Halt ECPU */
1501         CSR_SETB_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_HALT);
1502
1503         /* Software reset */
1504         reg = CSR_READ_2(sc, ACXREG_SOFT_RESET);
1505         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg | ACXRV_SOFT_RESET);
1506         DELAY(100);
1507         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg);
1508
1509         /* Initialize EEPROM */
1510         CSR_SETB_2(sc, ACXREG_EEPROM_INIT, ACXRV_EEPROM_INIT);
1511         DELAY(50000);
1512
1513         /* Test whether ECPU is stopped */
1514         reg = CSR_READ_2(sc, ACXREG_ECPU_CTRL);
1515         if (!(reg & ACXRV_ECPU_HALT)) {
1516                 if_printf(&sc->sc_ic.ic_if, "can't halt ECPU\n");
1517                 return ENXIO;
1518         }
1519         return 0;
1520 }
1521
1522 static int
1523 acx_read_eeprom(struct acx_softc *sc, uint32_t offset, uint8_t *val)
1524 {
1525         int i;
1526
1527         CSR_WRITE_4(sc, ACXREG_EEPROM_CONF, 0);
1528         CSR_WRITE_4(sc, ACXREG_EEPROM_ADDR, offset);
1529         CSR_WRITE_4(sc, ACXREG_EEPROM_CTRL, ACXRV_EEPROM_READ);
1530
1531 #define EE_READ_RETRY_MAX       100
1532         for (i = 0; i < EE_READ_RETRY_MAX; ++i) {
1533                 if (CSR_READ_2(sc, ACXREG_EEPROM_CTRL) == 0)
1534                         break;
1535                 DELAY(10000);
1536         }
1537         if (i == EE_READ_RETRY_MAX) {
1538                 if_printf(&sc->sc_ic.ic_if, "can't read EEPROM offset %x "
1539                           "(timeout)\n", offset);
1540                 return ETIMEDOUT;
1541         }
1542 #undef EE_READ_RETRY_MAX
1543
1544         *val = CSR_READ_1(sc, ACXREG_EEPROM_DATA);
1545         return 0;
1546 }
1547
1548 static int
1549 acx_read_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t *val)
1550 {
1551         int i;
1552
1553         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1554         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_READ);
1555
1556 #define PHY_READ_RETRY_MAX      100
1557         for (i = 0; i < PHY_READ_RETRY_MAX; ++i) {
1558                 if (CSR_READ_4(sc, ACXREG_PHY_CTRL) == 0)
1559                         break;
1560                 DELAY(10000);
1561         }
1562         if (i == PHY_READ_RETRY_MAX) {
1563                 if_printf(&sc->sc_ic.ic_if, "can't read phy reg %x (timeout)\n",
1564                           reg);
1565                 return ETIMEDOUT;
1566         }
1567 #undef PHY_READ_RETRY_MAX
1568
1569         *val = CSR_READ_1(sc, ACXREG_PHY_DATA);
1570         return 0;
1571 }
1572
1573 void
1574 acx_write_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t val)
1575 {
1576         CSR_WRITE_4(sc, ACXREG_PHY_DATA, val);
1577         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1578         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_WRITE);
1579 }
1580
1581 static int
1582 acx_copyin_firmware(struct acx_softc *sc, struct ifreq *req)
1583 {
1584         struct acx_firmware ufw, *kfw;
1585         uint8_t *base_fw, *radio_fw;
1586         int error;
1587
1588         kfw = &sc->sc_firmware;
1589         base_fw = NULL;
1590         radio_fw = NULL;
1591
1592         error = copyin(req->ifr_data, &ufw, sizeof(ufw));
1593         if (error)
1594                 return error;
1595
1596         /*
1597          * For combined base firmware, there is no radio firmware.
1598          * But base firmware must exist.
1599          */
1600         if (ufw.base_fw_len <= 0 || ufw.radio_fw_len < 0)
1601                 return EINVAL;
1602
1603         base_fw = kmalloc(ufw.base_fw_len, M_DEVBUF, M_INTWAIT);
1604         error = copyin(ufw.base_fw, base_fw, ufw.base_fw_len);
1605         if (error)
1606                 goto fail;
1607
1608         if (ufw.radio_fw_len > 0) {
1609                 radio_fw = kmalloc(ufw.radio_fw_len, M_DEVBUF, M_INTWAIT);
1610                 error = copyin(ufw.radio_fw, radio_fw, ufw.radio_fw_len);
1611                 if (error)
1612                         goto fail;
1613         }
1614
1615         kfw->base_fw_len = ufw.base_fw_len;
1616         if (kfw->base_fw != NULL)
1617                 kfree(kfw->base_fw, M_DEVBUF);
1618         kfw->base_fw = base_fw;
1619
1620         kfw->radio_fw_len = ufw.radio_fw_len;
1621         if (kfw->radio_fw != NULL)
1622                 kfree(kfw->radio_fw, M_DEVBUF);
1623         kfw->radio_fw = radio_fw;
1624
1625         return 0;
1626 fail:
1627         if (base_fw != NULL)
1628                 kfree(base_fw, M_DEVBUF);
1629         if (radio_fw != NULL)
1630                 kfree(radio_fw, M_DEVBUF);
1631         return error;
1632 }
1633
1634 static void
1635 acx_free_firmware(struct acx_softc *sc)
1636 {
1637         struct acx_firmware *fw = &sc->sc_firmware;
1638
1639         if (fw->base_fw != NULL) {
1640                 kfree(fw->base_fw, M_DEVBUF);
1641                 fw->base_fw = NULL;
1642                 fw->base_fw_len = 0;
1643         }
1644         if (fw->radio_fw != NULL) {
1645                 kfree(fw->radio_fw, M_DEVBUF);
1646                 fw->radio_fw = NULL;
1647                 fw->radio_fw_len = 0;
1648         }
1649 }
1650
1651 static int
1652 acx_load_base_firmware(struct acx_softc *sc, const uint8_t *base_fw,
1653                        uint32_t base_fw_len)
1654 {
1655         int i, error;
1656
1657         /* Load base firmware */
1658         error = acx_load_firmware(sc, 0, base_fw, base_fw_len);
1659         if (error) {
1660                 if_printf(&sc->sc_ic.ic_if, "can't load base firmware\n");
1661                 return error;
1662         }
1663         DPRINTF((&sc->sc_ic.ic_if, "base firmware loaded\n"));
1664
1665         /* Start ECPU */
1666         CSR_WRITE_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_START);
1667
1668         /* Wait for ECPU to be up */
1669         for (i = 0; i < 500; ++i) {
1670                 uint16_t reg;
1671
1672                 reg = CSR_READ_2(sc, ACXREG_INTR_STATUS);
1673                 if (reg & ACXRV_INTR_FCS_THRESH) {
1674                         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_FCS_THRESH);
1675                         return 0;
1676                 }
1677                 DELAY(10000);
1678         }
1679
1680         if_printf(&sc->sc_ic.ic_if, "can't initialize ECPU (timeout)\n");
1681         return ENXIO;
1682 }
1683
1684 static int
1685 acx_load_radio_firmware(struct acx_softc *sc, const uint8_t *radio_fw,
1686                         uint32_t radio_fw_len)
1687 {
1688         struct acx_conf_mmap mem_map;
1689         uint32_t radio_fw_ofs;
1690         int error;
1691
1692         /*
1693          * Get the position, where base firmware is loaded, so that
1694          * radio firmware can be loaded after it.
1695          */
1696         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1697                 return ENXIO;
1698         radio_fw_ofs = le32toh(mem_map.code_end);
1699
1700         /* Put ECPU into sleeping state, before loading radio firmware */
1701         if (acx_sleep(sc) != 0)
1702                 return ENXIO;
1703
1704         /* Load radio firmware */
1705         error = acx_load_firmware(sc, radio_fw_ofs, radio_fw, radio_fw_len);
1706         if (error) {
1707                 if_printf(&sc->sc_ic.ic_if, "can't load radio firmware\n");
1708                 return ENXIO;
1709         }
1710         DPRINTF((&sc->sc_ic.ic_if, "radio firmware loaded\n"));
1711
1712         /* Wake up sleeping ECPU, after radio firmware is loaded */
1713         if (acx_wakeup(sc) != 0)
1714                 return ENXIO;
1715
1716         /* Initialize radio */
1717         if (acx_init_radio(sc, radio_fw_ofs, radio_fw_len) != 0)
1718                 return ENXIO;
1719
1720         /* Verify radio firmware's loading position */
1721         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1722                 return ENXIO;
1723         if (le32toh(mem_map.code_end) != radio_fw_ofs + radio_fw_len) {
1724                 if_printf(&sc->sc_ic.ic_if, "loaded radio firmware position "
1725                           "mismatch\n");
1726                 return ENXIO;
1727         }
1728
1729         DPRINTF((&sc->sc_ic.ic_if, "radio firmware initialized\n"));
1730         return 0;
1731 }
1732
1733 static int
1734 acx_load_firmware(struct acx_softc *sc, uint32_t offset, const uint8_t *data,
1735                   int data_len)
1736 {
1737         const uint32_t *fw;
1738         int i, fw_len;
1739
1740         fw = (const uint32_t *)data;
1741         fw_len = data_len / sizeof(uint32_t);
1742
1743         /*
1744          * LOADFW_AUTO_INC only works with some older firmware:
1745          * 1) acx100's firmware
1746          * 2) acx111's firmware whose rev is 0x00010011
1747          */
1748
1749         /* Load firmware */
1750         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1751 #ifndef LOADFW_AUTO_INC
1752         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1753 #else
1754         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1755         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1756 #endif
1757
1758         for (i = 0; i < fw_len; ++i) {
1759 #ifndef LOADFW_AUTO_INC
1760                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1761 #endif
1762                 CSR_WRITE_4(sc, ACXREG_FWMEM_DATA, be32toh(fw[i]));
1763         }
1764
1765         /* Verify firmware */
1766         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1767 #ifndef LOADFW_AUTO_INC
1768         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1769 #else
1770         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1771         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1772 #endif
1773
1774         for (i = 0; i < fw_len; ++i) {
1775                 uint32_t val;
1776
1777 #ifndef LOADFW_AUTO_INC
1778                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1779 #endif
1780                 val = CSR_READ_4(sc, ACXREG_FWMEM_DATA);
1781                 if (be32toh(fw[i]) != val) {
1782                         if_printf(&sc->sc_ic.ic_if, "fireware mismatch "
1783                                   "fw %08x  loaded %08x\n", fw[i], val);
1784                         return ENXIO;
1785                 }
1786         }
1787         return 0;
1788 }
1789
1790 static int
1791 acx_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1792 {
1793         struct acx_softc *sc = ic->ic_if.if_softc;
1794         int error = 0, mode = 0;
1795
1796         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1797
1798         ieee80211_ratectl_newstate(ic, nstate);
1799
1800         switch (nstate) {
1801         case IEEE80211_S_SCAN:
1802                 if (ic->ic_state != IEEE80211_S_INIT) {
1803                         uint8_t chan;
1804
1805                         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1806                         ACX_ENABLE_TXCHAN(sc, chan);
1807                         ACX_ENABLE_RXCHAN(sc, chan);
1808
1809                         callout_reset(&sc->sc_chanscan_timer,
1810                                       hz / acx_chanscan_rate,
1811                                       acx_next_scan, sc);
1812                 }
1813                 break;
1814         case IEEE80211_S_AUTH:
1815                 if (ic->ic_opmode == IEEE80211_M_STA) {
1816                         struct ieee80211_node *ni;
1817 #ifdef ACX_DEBUG
1818                         int i;
1819 #endif
1820
1821                         ni = ic->ic_bss;
1822
1823                         if (acx_join_bss(sc, ACX_MODE_STA, ni) != 0) {
1824                                 if_printf(&ic->ic_if, "join BSS failed\n");
1825                                 error = 1;
1826                                 goto back;
1827                         }
1828
1829                         DPRINTF((&ic->ic_if, "join BSS\n"));
1830                         if (ic->ic_state == IEEE80211_S_ASSOC) {
1831                                 DPRINTF((&ic->ic_if,
1832                                          "change from assoc to run\n"));
1833                                 ic->ic_state = IEEE80211_S_RUN;
1834                         }
1835
1836 #ifdef ACX_DEBUG
1837                         if_printf(&ic->ic_if, "AP rates: ");
1838                         for (i = 0; i < ni->ni_rates.rs_nrates; ++i)
1839                                 printf("%d ", ni->ni_rates.rs_rates[i]);
1840                         ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
1841                         printf(" %6D\n", ni->ni_bssid, ":");
1842 #endif
1843                 }
1844                 break;
1845         case IEEE80211_S_RUN:
1846                 if (ic->ic_opmode == IEEE80211_M_IBSS ||
1847                     ic->ic_opmode == IEEE80211_M_HOSTAP) {
1848                         struct ieee80211_node *ni;
1849                         uint8_t chan;
1850
1851                         ni = ic->ic_bss;
1852                         chan = ieee80211_chan2ieee(ic, ni->ni_chan);
1853
1854                         error = 1;
1855
1856                         if (acx_enable_txchan(sc, chan) != 0) {
1857                                 if_printf(&ic->ic_if,
1858                                           "enable TX on channel %d failed\n",
1859                                           chan);
1860                                 goto back;
1861                         }
1862
1863                         if (acx_enable_rxchan(sc, chan) != 0) {
1864                                 if_printf(&ic->ic_if,
1865                                           "enable RX on channel %d failed\n",
1866                                           chan);
1867                                 goto back;
1868                         }
1869
1870                         if (acx_set_beacon_tmplt(sc, ni) != 0) {
1871                                 if_printf(&ic->ic_if,
1872                                           "set bescon template failed\n");
1873                                 goto back;
1874                         }
1875
1876                         if (acx_set_probe_resp_tmplt(sc, ni) != 0) {
1877                                 if_printf(&ic->ic_if, "set probe response "
1878                                           "template failed\n");
1879                                 goto back;
1880                         }
1881
1882                         if (ic->ic_opmode == IEEE80211_M_IBSS)
1883                                 mode = ACX_MODE_ADHOC;
1884                         else
1885                                 mode = ACX_MODE_AP;
1886
1887                         if (acx_join_bss(sc, mode, ni) != 0) {
1888                                 if_printf(&ic->ic_if, "acx_join_ibss failed\n");
1889                                 goto back;
1890                         }
1891
1892                         DPRINTF((&ic->ic_if, "join IBSS\n"));
1893                         error = 0;
1894                 }
1895                 break;
1896         default:
1897                 break;
1898         }
1899
1900 back:
1901         if (error) {
1902                 /* XXX */
1903                 nstate = IEEE80211_S_INIT;
1904                 arg = -1;
1905         }
1906         return sc->sc_newstate(ic, nstate, arg);
1907 }
1908
1909 int
1910 acx_init_tmplt_ordered(struct acx_softc *sc)
1911 {
1912 #define INIT_TMPLT(name)                        \
1913 do {                                            \
1914         if (acx_init_##name##_tmplt(sc) != 0)   \
1915                 return 1;                       \
1916 } while (0)
1917
1918         /*
1919          * NOTE:
1920          * Order of templates initialization:
1921          * 1) Probe request
1922          * 2) NULL data
1923          * 3) Beacon
1924          * 4) TIM
1925          * 5) Probe response
1926          * Above order is critical to get a correct memory map.
1927          */
1928         INIT_TMPLT(probe_req);
1929         INIT_TMPLT(null_data);
1930         INIT_TMPLT(beacon);
1931         INIT_TMPLT(tim);
1932         INIT_TMPLT(probe_resp);
1933
1934 #undef CALL_SET_TMPLT
1935         return 0;
1936 }
1937
1938 static void
1939 acx_ring_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
1940 {
1941         *((uint32_t *)arg) = seg->ds_addr;
1942 }
1943
1944 static int
1945 acx_dma_alloc(struct acx_softc *sc)
1946 {
1947         struct acx_ring_data *rd = &sc->sc_ring_data;
1948         struct acx_buf_data *bd = &sc->sc_buf_data;
1949         int i, error;
1950
1951         /* Allocate DMA stuffs for RX descriptors  */
1952         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
1953                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
1954                                    NULL, NULL,
1955                                    ACX_RX_RING_SIZE, 1, ACX_RX_RING_SIZE,
1956                                    0, &rd->rx_ring_dma_tag);
1957         if (error) {
1958                 if_printf(&sc->sc_ic.ic_if, "can't create rx ring dma tag\n");
1959                 return error;
1960         }
1961
1962         error = bus_dmamem_alloc(rd->rx_ring_dma_tag, (void **)&rd->rx_ring,
1963                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
1964                                  &rd->rx_ring_dmamap);
1965         if (error) {
1966                 if_printf(&sc->sc_ic.ic_if,
1967                           "can't allocate rx ring dma memory\n");
1968                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
1969                 rd->rx_ring_dma_tag = NULL;
1970                 return error;
1971         }
1972
1973         error = bus_dmamap_load(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1974                                 rd->rx_ring, ACX_RX_RING_SIZE,
1975                                 acx_ring_dma_addr, &rd->rx_ring_paddr,
1976                                 BUS_DMA_WAITOK);
1977         if (error) {
1978                 if_printf(&sc->sc_ic.ic_if, "can't get rx ring dma address\n");
1979                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
1980                                 rd->rx_ring_dmamap);
1981                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
1982                 rd->rx_ring_dma_tag = NULL;
1983                 return error;
1984         }
1985
1986         /* Allocate DMA stuffs for TX descriptors */
1987         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
1988                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
1989                                    NULL, NULL,
1990                                    ACX_TX_RING_SIZE, 1, ACX_TX_RING_SIZE,
1991                                    0, &rd->tx_ring_dma_tag);
1992         if (error) {
1993                 if_printf(&sc->sc_ic.ic_if, "can't create tx ring dma tag\n");
1994                 return error;
1995         }
1996
1997         error = bus_dmamem_alloc(rd->tx_ring_dma_tag, (void **)&rd->tx_ring,
1998                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
1999                                  &rd->tx_ring_dmamap);
2000         if (error) {
2001                 if_printf(&sc->sc_ic.ic_if,
2002                           "can't allocate tx ring dma memory\n");
2003                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2004                 rd->tx_ring_dma_tag = NULL;
2005                 return error;
2006         }
2007
2008         error = bus_dmamap_load(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2009                                 rd->tx_ring, ACX_TX_RING_SIZE,
2010                                 acx_ring_dma_addr, &rd->tx_ring_paddr,
2011                                 BUS_DMA_WAITOK);
2012         if (error) {
2013                 if_printf(&sc->sc_ic.ic_if, "can't get tx ring dma address\n");
2014                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2015                                 rd->tx_ring_dmamap);
2016                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2017                 rd->tx_ring_dma_tag = NULL;
2018                 return error;
2019         }
2020
2021         /* Create DMA tag for RX/TX mbuf map */
2022         error = bus_dma_tag_create(NULL, 1, 0,
2023                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2024                                    NULL, NULL,
2025                                    MCLBYTES, 1, MCLBYTES,
2026                                    0, &bd->mbuf_dma_tag);
2027         if (error) {
2028                 if_printf(&sc->sc_ic.ic_if, "can't create mbuf dma tag\n");
2029                 return error;
2030         }
2031
2032         /* Create a spare RX DMA map */
2033         error = bus_dmamap_create(bd->mbuf_dma_tag, 0, &bd->mbuf_tmp_dmamap);
2034         if (error) {
2035                 if_printf(&sc->sc_ic.ic_if, "can't create tmp mbuf dma map\n");
2036                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2037                 bd->mbuf_dma_tag = NULL;
2038                 return error;
2039         }
2040
2041         /* Create DMA map for RX mbufs */
2042         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2043                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2044                                           &bd->rx_buf[i].rb_mbuf_dmamap);
2045                 if (error) {
2046                         if_printf(&sc->sc_ic.ic_if, "can't create rx mbuf "
2047                                   "dma map (%d)\n", i);
2048                         return error;
2049                 }
2050                 bd->rx_buf[i].rb_desc = &rd->rx_ring[i];
2051         }
2052
2053         /* Create DMA map for TX mbufs */
2054         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2055                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2056                                           &bd->tx_buf[i].tb_mbuf_dmamap);
2057                 if (error) {
2058                         if_printf(&sc->sc_ic.ic_if, "can't create tx mbuf "
2059                                   "dma map (%d)\n", i);
2060                         return error;
2061                 }
2062                 bd->tx_buf[i].tb_desc1 = &rd->tx_ring[i * 2];
2063                 bd->tx_buf[i].tb_desc2 = &rd->tx_ring[(i * 2) + 1];
2064         }
2065
2066         return 0;
2067 }
2068
2069 static void
2070 acx_dma_free(struct acx_softc *sc)
2071 {
2072         struct acx_ring_data *rd = &sc->sc_ring_data;
2073         struct acx_buf_data *bd = &sc->sc_buf_data;
2074         int i;
2075
2076         if (rd->rx_ring_dma_tag != NULL) {
2077                 bus_dmamap_unload(rd->rx_ring_dma_tag, rd->rx_ring_dmamap);
2078                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2079                                 rd->rx_ring_dmamap);
2080                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2081         }
2082
2083         if (rd->tx_ring_dma_tag != NULL) {
2084                 bus_dmamap_unload(rd->tx_ring_dma_tag, rd->tx_ring_dmamap);
2085                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2086                                 rd->tx_ring_dmamap);
2087                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2088         }
2089
2090         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2091                 if (bd->rx_buf[i].rb_desc != NULL) {
2092                         if (bd->rx_buf[i].rb_mbuf != NULL) {
2093                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2094                                                   bd->rx_buf[i].rb_mbuf_dmamap);
2095                                 m_freem(bd->rx_buf[i].rb_mbuf);
2096                         }
2097                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2098                                            bd->rx_buf[i].rb_mbuf_dmamap);
2099                 }
2100         }
2101
2102         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2103                 if (bd->tx_buf[i].tb_desc1 != NULL) {
2104                         if (bd->tx_buf[i].tb_mbuf != NULL) {
2105                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2106                                                   bd->tx_buf[i].tb_mbuf_dmamap);
2107                                 m_freem(bd->tx_buf[i].tb_mbuf);
2108                         }
2109                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2110                                            bd->tx_buf[i].tb_mbuf_dmamap);
2111                 }
2112         }
2113
2114         if (bd->mbuf_dma_tag != NULL) {
2115                 bus_dmamap_destroy(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap);
2116                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2117         }
2118 }
2119
2120 static int
2121 acx_init_tx_ring(struct acx_softc *sc)
2122 {
2123         struct acx_ring_data *rd;
2124         struct acx_buf_data *bd;
2125         uint32_t paddr;
2126         int i;
2127
2128         rd = &sc->sc_ring_data;
2129         paddr = rd->tx_ring_paddr;
2130         for (i = 0; i < (ACX_TX_DESC_CNT * 2) - 1; ++i) {
2131                 paddr += sizeof(struct acx_host_desc);
2132
2133                 rd->tx_ring[i].h_ctrl = htole16(DESC_CTRL_HOSTOWN);
2134
2135                 if (i == (ACX_TX_DESC_CNT * 2) - 1)
2136                         rd->tx_ring[i].h_next_desc = htole32(rd->tx_ring_paddr);
2137                 else
2138                         rd->tx_ring[i].h_next_desc = htole32(paddr);
2139         }
2140
2141         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2142                         BUS_DMASYNC_PREWRITE);
2143
2144         bd = &sc->sc_buf_data;
2145         bd->tx_free_start = 0;
2146         bd->tx_used_start = 0;
2147         bd->tx_used_count = 0;
2148
2149         return 0;
2150 }
2151
2152 static int
2153 acx_init_rx_ring(struct acx_softc *sc)
2154 {
2155         struct acx_ring_data *rd;
2156         struct acx_buf_data *bd;
2157         uint32_t paddr;
2158         int i;
2159
2160         bd = &sc->sc_buf_data;
2161         rd = &sc->sc_ring_data;
2162         paddr = rd->rx_ring_paddr;
2163
2164         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2165                 int error;
2166
2167                 paddr += sizeof(struct acx_host_desc);
2168
2169                 error = acx_newbuf(sc, &bd->rx_buf[i], 1);
2170                 if (error)
2171                         return error;
2172
2173                 if (i == ACX_RX_DESC_CNT - 1)
2174                         rd->rx_ring[i].h_next_desc = htole32(rd->rx_ring_paddr);
2175                 else
2176                         rd->rx_ring[i].h_next_desc = htole32(paddr);
2177         }
2178
2179         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2180                         BUS_DMASYNC_PREWRITE);
2181
2182         bd->rx_scan_start = 0;
2183         return 0;
2184 }
2185
2186 static void
2187 acx_buf_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg,
2188                  bus_size_t mapsz, int error)
2189 {
2190         if (error)
2191                 return;
2192
2193         /* XXX */
2194         KASSERT(nseg == 1, ("too many RX dma segments\n"));
2195         *((uint32_t *)arg) = seg->ds_addr;
2196 }
2197
2198 static int
2199 acx_newbuf(struct acx_softc *sc, struct acx_rxbuf *rb, int wait)
2200 {
2201         struct acx_buf_data *bd;
2202         struct mbuf *m;
2203         bus_dmamap_t map;
2204         uint32_t paddr;
2205         int error;
2206
2207         bd = &sc->sc_buf_data;
2208
2209         m = m_getcl(wait ? MB_WAIT : MB_DONTWAIT, MT_DATA, M_PKTHDR);
2210         if (m == NULL)
2211                 return ENOBUFS;
2212
2213         m->m_len = m->m_pkthdr.len = MCLBYTES;
2214
2215         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap,
2216                                      m, acx_buf_dma_addr, &paddr,
2217                                      wait ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
2218         if (error) {
2219                 m_freem(m);
2220                 if_printf(&sc->sc_ic.ic_if, "can't map rx mbuf %d\n", error);
2221                 return error;
2222         }
2223
2224         /* Unload originally mapped mbuf */
2225         bus_dmamap_unload(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap);
2226
2227         /* Swap this dmamap with tmp dmamap */
2228         map = rb->rb_mbuf_dmamap;
2229         rb->rb_mbuf_dmamap = bd->mbuf_tmp_dmamap;
2230         bd->mbuf_tmp_dmamap = map;
2231
2232         rb->rb_mbuf = m;
2233         rb->rb_desc->h_data_paddr = htole32(paddr);
2234         rb->rb_desc->h_data_len = htole16(m->m_len);
2235
2236         bus_dmamap_sync(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap,
2237                         BUS_DMASYNC_PREREAD);
2238         return 0;
2239 }
2240
2241 static int
2242 acx_encap(struct acx_softc *sc, struct acx_txbuf *txbuf, struct mbuf *m,
2243           struct ieee80211_node *ni)
2244 {
2245         struct acx_buf_data *bd = &sc->sc_buf_data;
2246         struct acx_ring_data *rd = &sc->sc_ring_data;
2247         uint32_t paddr;
2248         uint8_t ctrl;
2249         int error;
2250
2251         KASSERT(txbuf->tb_mbuf == NULL, ("free TX buf has mbuf installed\n"));
2252         error = 0;
2253
2254         if (m->m_pkthdr.len > MCLBYTES) {
2255                 if_printf(&sc->sc_ic.ic_if, "mbuf too big\n");
2256                 error = E2BIG;
2257                 goto back;
2258         } else if (m->m_pkthdr.len < ACX_FRAME_HDRLEN) {
2259                 if_printf(&sc->sc_ic.ic_if, "mbuf too small\n");
2260                 error = EINVAL;
2261                 goto back;
2262         }
2263
2264         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2265                                      m, acx_buf_dma_addr, &paddr,
2266                                      BUS_DMA_NOWAIT);
2267         if (error && error != EFBIG) {
2268                 if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf1 %d\n", error);
2269                 goto back;
2270         }
2271
2272         if (error) {    /* error == EFBIG */
2273                 struct mbuf *m_new;
2274
2275                 m_new = m_defrag(m, MB_DONTWAIT);
2276                 if (m_new == NULL) {
2277                         if_printf(&sc->sc_ic.ic_if, "can't defrag tx mbuf\n");
2278                         error = ENOBUFS;
2279                         goto back;
2280                 } else {
2281                         m = m_new;
2282                 }
2283
2284                 error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag,
2285                                              txbuf->tb_mbuf_dmamap, m,
2286                                              acx_buf_dma_addr, &paddr,
2287                                              BUS_DMA_NOWAIT);
2288                 if (error) {
2289                         if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf2 %d\n",
2290                                   error);
2291                         goto back;
2292                 }
2293         }
2294
2295         error = 0;
2296
2297         bus_dmamap_sync(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2298                         BUS_DMASYNC_PREWRITE);
2299
2300         txbuf->tb_mbuf = m;
2301         txbuf->tb_node = ni;
2302
2303         /*
2304          * TX buffers are accessed in following way:
2305          * acx_fw_txdesc -> acx_host_desc -> buffer
2306          *
2307          * It is quite strange that acx also querys acx_host_desc next to
2308          * the one we have assigned to acx_fw_txdesc even if first one's
2309          * acx_host_desc.h_data_len == acx_fw_txdesc.f_tx_len
2310          *
2311          * So we allocate two acx_host_desc for one acx_fw_txdesc and
2312          * assign the first acx_host_desc to acx_fw_txdesc
2313          *
2314          * For acx111
2315          * host_desc1.h_data_len = buffer_len
2316          * host_desc2.h_data_len = buffer_len - mac_header_len
2317          *
2318          * For acx100
2319          * host_desc1.h_data_len = mac_header_len
2320          * host_desc2.h_data_len = buffer_len - mac_header_len
2321          */
2322
2323         txbuf->tb_desc1->h_data_paddr = htole32(paddr);
2324         txbuf->tb_desc2->h_data_paddr = htole32(paddr + ACX_FRAME_HDRLEN);
2325
2326         txbuf->tb_desc1->h_data_len =
2327                 htole16(sc->chip_txdesc1_len ? sc->chip_txdesc1_len
2328                                              : m->m_pkthdr.len);
2329         txbuf->tb_desc2->h_data_len =
2330                 htole16(m->m_pkthdr.len - ACX_FRAME_HDRLEN);
2331
2332         /*
2333          * NOTE:
2334          * We can't simply assign f_tx_ctrl, we will first read it back
2335          * and change it bit by bit
2336          */
2337         ctrl = FW_TXDESC_GETFIELD_1(sc, txbuf, f_tx_ctrl);
2338         ctrl |= sc->chip_fw_txdesc_ctrl; /* extra chip specific flags */
2339         ctrl &= ~(DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE);
2340
2341         FW_TXDESC_SETFIELD_4(sc, txbuf, f_tx_len, m->m_pkthdr.len);
2342         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_error, 0);
2343         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_data_nretry, 0);
2344         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_nretry, 0);
2345         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_ok, 0);
2346         sc->chip_set_fw_txdesc_rate(sc, txbuf, ni, m->m_pkthdr.len);
2347
2348         txbuf->tb_desc1->h_ctrl = 0;
2349         txbuf->tb_desc2->h_ctrl = 0;
2350         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2351                         BUS_DMASYNC_PREWRITE);
2352
2353         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl2, 0);
2354         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl, ctrl);
2355
2356         /* Tell chip to inform us about TX completion */
2357         CSR_WRITE_2(sc, ACXREG_INTR_TRIG, ACXRV_TRIG_TX_FINI);
2358 back:
2359         if (error)
2360                 m_freem(m);
2361         return error;
2362 }
2363
2364 static int
2365 acx_set_null_tmplt(struct acx_softc *sc)
2366 {
2367         struct acx_tmplt_null_data n;
2368         struct ieee80211_frame *f;
2369
2370         bzero(&n, sizeof(n));
2371
2372         f = &n.data;
2373         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
2374         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2375         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2376         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2377
2378         return _acx_set_null_data_tmplt(sc, &n, sizeof(n));
2379 }
2380
2381 static int
2382 acx_set_probe_req_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len)
2383 {
2384         struct acx_tmplt_probe_req req;
2385         struct ieee80211_frame *f;
2386         uint8_t *v;
2387         int vlen;
2388
2389         bzero(&req, sizeof(req));
2390
2391         f = &req.data.u_data.f;
2392         f->i_fc[0] = IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
2393         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2394         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2395         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2396
2397         v = req.data.u_data.var;
2398         v = ieee80211_add_ssid(v, ssid, ssid_len);
2399         v = ieee80211_add_rates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2400         v = ieee80211_add_xrates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2401         vlen = v - req.data.u_data.var;
2402
2403         return _acx_set_probe_req_tmplt(sc, &req,
2404                                         ACX_TMPLT_PROBE_REQ_SIZ(vlen));
2405 }
2406
2407 static int
2408 acx_set_probe_resp_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2409 {
2410         struct ieee80211com *ic = &sc->sc_ic;
2411         struct acx_tmplt_probe_resp resp;
2412         struct ieee80211_beacon_offsets bo;
2413         struct mbuf *m;
2414         int len;
2415
2416         bzero(&resp, sizeof(resp));
2417
2418         bzero(&bo, sizeof(bo));
2419         m = ieee80211_beacon_alloc(ic, ni, &bo);
2420         DPRINTF((&ic->ic_if, "%s alloc beacon size %d\n", __func__,
2421                  m->m_pkthdr.len));
2422
2423         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&resp.data);
2424         len = m->m_pkthdr.len + sizeof(resp.size);
2425         m_freem(m);
2426
2427         return _acx_set_probe_resp_tmplt(sc, &resp, len);
2428 }
2429
2430 static int
2431 acx_set_beacon_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2432 {
2433         struct ieee80211com *ic = &sc->sc_ic;
2434         struct acx_tmplt_beacon beacon;
2435         struct ieee80211_beacon_offsets bo;
2436         struct mbuf *m;
2437         int len;
2438
2439         bzero(&beacon, sizeof(beacon));
2440
2441         bzero(&bo, sizeof(bo));
2442         m = ieee80211_beacon_alloc(ic, ni, &bo);
2443         DPRINTF((&ic->ic_if, "%s alloc beacon size %d\n", __func__,
2444                  m->m_pkthdr.len));
2445
2446         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&beacon.data);
2447         len = m->m_pkthdr.len + sizeof(beacon.size);
2448         m_freem(m);
2449
2450         return _acx_set_beacon_tmplt(sc, &beacon, len);
2451 }
2452
2453 static int
2454 acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS)
2455 {
2456         struct acx_softc *sc = arg1;
2457         struct ifnet *ifp = &sc->sc_ic.ic_if;
2458         int error = 0, v;
2459
2460         lwkt_serialize_enter(ifp->if_serializer);
2461
2462         v = sc->sc_msdu_lifetime;
2463         error = sysctl_handle_int(oidp, &v, 0, req);
2464         if (error || req->newptr == NULL)
2465                 goto back;
2466         if (v <= 0) {
2467                 error = EINVAL;
2468                 goto back;
2469         }
2470
2471         if (sc->sc_flags & ACX_FLAG_FW_LOADED) {
2472                 struct acx_conf_msdu_lifetime msdu_lifetime;
2473
2474                 msdu_lifetime.lifetime = htole32(v);
2475                 if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
2476                         if_printf(&sc->sc_ic.ic_if,
2477                                   "can't set MSDU lifetime\n");
2478                         error = ENXIO;
2479                         goto back;
2480                 }
2481         }
2482         sc->sc_msdu_lifetime = v;
2483 back:
2484         lwkt_serialize_exit(ifp->if_serializer);
2485         return error;
2486 }