sys/dev/netif/acx/if_acx.c

   1 /*
   2  * Copyright (c) 2006 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Sepherosa Ziehau <sepherosa@gmail.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  * $DragonFly: src/sys/dev/netif/acx/if_acx.c,v 1.17 2007/02/15 09:05:11 sephe Exp $
  35  */
  36
  37 /*
  38  * Copyright (c) 2003-2004 wlan.kewl.org Project
  39  * All rights reserved.
  40  *
  41  * $Id: LICENSE,v 1.1.1.1 2004/07/01 12:20:39 darron Exp $
  42  *
  43  * Redistribution and use in source and binary forms, with or without
  44  * modification, are permitted provided that the following conditions
  45  * are met:
  46  *
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  *
  50  * 2. Redistributions in binary form must reproduce the above copyright
  51  *    notice, this list of conditions and the following disclaimer in the
  52  *    documentation and/or other materials provided with the distribution.
  53  *
  54  * 3. All advertising materials mentioning features or use of this software
  55  *    must display the following acknowledgement:
  56  *
  57  *    This product includes software developed by the wlan.kewl.org Project.
  58  *
  59  * 4. Neither the name of the wlan.kewl.org Project nor the names of its
  60  *    contributors may be used to endorse or promote products derived from
  61  *    this software without specific prior written permission.
  62  *
  63  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  64  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
  65  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
  66  * THE wlan.kewl.org Project BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  67  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  68  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  69  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  70  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  71  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  72  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  73  */
  74
  75 #include <sys/param.h>
  76 #include <sys/endian.h>
  77 #include <sys/kernel.h>
  78 #include <sys/bus.h>
  79 #include <sys/malloc.h>
  80 #include <sys/proc.h>
  81 #include <sys/rman.h>
  82 #include <sys/serialize.h>
  83 #include <sys/socket.h>
  84 #include <sys/sockio.h>
  85 #include <sys/sysctl.h>
  86
  87 #include <net/ethernet.h>
  88 #include <net/if.h>
  89 #include <net/bpf.h>
  90 #include <net/if_arp.h>
  91 #include <net/if_dl.h>
  92 #include <net/if_media.h>
  93 #include <net/ifq_var.h>
  94
  95 #include <netproto/802_11/ieee80211_var.h>
  96
  97 #include <bus/pci/pcireg.h>
  98 #include <bus/pci/pcivar.h>
  99 #include <bus/pci/pcidevs.h>
 100
 101 #define ACX_DEBUG
 102
 103 #include "if_acxreg.h"
 104 #include "if_acxvar.h"
 105 #include "acxcmd.h"
 106
 107 #define ACX_ENABLE_TXCHAN(sc, chan)                                     \
 108 do {                                                                    \
 109         if (acx_enable_txchan((sc), (chan)) != 0) {                     \
 110                 if_printf(&(sc)->sc_ic.ic_if,                           \
 111                           "enable TX on channel %d failed\n", (chan));  \
 112         }                                                               \
 113 } while (0)
 114
 115 #define ACX_ENABLE_RXCHAN(sc, chan)                                     \
 116 do {                                                                    \
 117         if (acx_enable_rxchan((sc), (chan)) != 0) {                     \
 118                 if_printf(&(sc)->sc_ic.ic_if,                           \
 119                           "enable RX on channel %d failed\n", (chan));  \
 120         }                                                               \
 121 } while (0)
 122
 123 #define SIOCSLOADFW     _IOW('i', 137, struct ifreq)    /* load firmware */
 124 #define SIOCGRADIO      _IOW('i', 138, struct ifreq)    /* get radio type */
 125 #define SIOCGSTATS      _IOW('i', 139, struct ifreq)    /* get acx stats */
 126 #define SIOCSKILLFW     _IOW('i', 140, struct ifreq)    /* free firmware */
 127 #define SIOCGFWVER      _IOW('i', 141, struct ifreq)    /* get firmware ver */
 128 #define SIOCGHWID       _IOW('i', 142, struct ifreq)    /* get hardware id */
 129
 130 static int      acx_probe(device_t);
 131 static int      acx_attach(device_t);
 132 static int      acx_detach(device_t);
 133 static int      acx_shutdown(device_t);
 134 static int      acx_media_change(struct ifnet *);
 135
 136 static void     acx_init(void *);
 137 static int      acx_stop(struct acx_softc *);
 138 static void     acx_init_info_reg(struct acx_softc *);
 139 static int      acx_config(struct acx_softc *);
 140 static int      acx_read_config(struct acx_softc *, struct acx_config *);
 141 static int      acx_write_config(struct acx_softc *, struct acx_config *);
 142 static int      acx_rx_config(struct acx_softc *, int);
 143 static int      acx_set_crypt_keys(struct acx_softc *);
 144 static void     acx_next_scan(void *);
 145
 146 static void     acx_start(struct ifnet *);
 147 static void     acx_watchdog(struct ifnet *);
 148
 149 static int      acx_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 150
 151 static void     acx_intr(void *);
 152 static void     acx_disable_intr(struct acx_softc *);
 153 static void     acx_enable_intr(struct acx_softc *);
 154 static void     acx_txeof(struct acx_softc *);
 155 static void     acx_txerr(struct acx_softc *, uint8_t);
 156 static void     acx_rxeof(struct acx_softc *);
 157
 158 static int      acx_dma_alloc(struct acx_softc *);
 159 static void     acx_dma_free(struct acx_softc *);
 160 static int      acx_init_tx_ring(struct acx_softc *);
 161 static int      acx_init_rx_ring(struct acx_softc *);
 162 static int      acx_newbuf(struct acx_softc *, struct acx_rxbuf *, int);
 163 static int      acx_encap(struct acx_softc *, struct acx_txbuf *,
 164                           struct mbuf *, struct ieee80211_node *);
 165
 166 static int      acx_reset(struct acx_softc *);
 167
 168 static int      acx_set_null_tmplt(struct acx_softc *);
 169 static int      acx_set_probe_req_tmplt(struct acx_softc *, const char *, int);
 170 static int      acx_set_probe_resp_tmplt(struct acx_softc *,
 171                                          struct ieee80211_node *);
 172 static int      acx_set_beacon_tmplt(struct acx_softc *,
 173                                      struct ieee80211_node *);
 174
 175 static int      acx_read_eeprom(struct acx_softc *, uint32_t, uint8_t *);
 176 static int      acx_read_phyreg(struct acx_softc *, uint32_t, uint8_t *);
 177
 178 static int      acx_copyin_firmware(struct acx_softc *, struct ifreq *);
 179 static void     acx_free_firmware(struct acx_softc *);
 180 static int      acx_load_firmware(struct acx_softc *, uint32_t,
 181                                   const uint8_t *, int);
 182 static int      acx_load_radio_firmware(struct acx_softc *, const uint8_t *,
 183                                         uint32_t);
 184 static int      acx_load_base_firmware(struct acx_softc *, const uint8_t *,
 185                                        uint32_t);
 186
 187 static int      acx_newstate(struct ieee80211com *, enum ieee80211_state, int);
 188
 189 static int      acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS);
 190
 191 const struct ieee80211_rateset  acx_rates_11b =
 192         { 5, { 2, 4, 11, 22, 44 } };
 193 const struct ieee80211_rateset  acx_rates_11g =
 194         { 13, { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 72, 96, 108 } };
 195
 196 static int      acx_chanscan_rate = 5;  /* 5/second */
 197
 198 static const struct acx_device {
 199         uint16_t        vid;
 200         uint16_t        did;
 201         void            (*set_param)(device_t);
 202         const char      *desc;
 203 } acx_devices[] = {
 204         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100A, acx100_set_param,
 205           "Texas Instruments TNETW1100A Wireless Adapter" },
 206         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX100B, acx100_set_param,
 207           "Texas Instruments TNETW1100B Wireless Adapter" },
 208         { PCI_VENDOR_TI, PCI_PRODUCT_TI_ACX111, acx111_set_param,
 209           "Texas Instruments TNETW1130 Wireless Adapter" },
 210         { 0, 0, NULL, NULL }
 211 };
 212
 213 static device_method_t acx_methods[] = {
 214         DEVMETHOD(device_probe,         acx_probe),
 215         DEVMETHOD(device_attach,        acx_attach),
 216         DEVMETHOD(device_detach,        acx_detach),
 217         DEVMETHOD(device_shutdown,      acx_shutdown),
 218 #if 0
 219         DEVMETHOD(device_suspend,       acx_suspend),
 220         DEVMETHOD(device_resume,        acx_resume),
 221 #endif
 222         { 0, 0 }
 223 };
 224
 225 static driver_t acx_driver = {
 226         "acx",
 227         acx_methods,
 228         sizeof(struct acx_softc)
 229 };
 230
 231 static devclass_t acx_devclass;
 232
 233 DRIVER_MODULE(acx, pci, acx_driver, acx_devclass, 0, 0);
 234 DRIVER_MODULE(acx, cardbus, acx_driver, acx_devclass, 0, 0);
 235
 236 MODULE_DEPEND(acx, wlan, 1, 1, 1);
 237 MODULE_DEPEND(acx, wlan_ratectl_onoe, 1, 1, 1);
 238 MODULE_DEPEND(acx, wlan_ratectl_amrr, 1, 1, 1);
 239 MODULE_DEPEND(acx, pci, 1, 1, 1);
 240 MODULE_DEPEND(acx, cardbus, 1, 1, 1);
 241
 242 static __inline int
 243 acx_get_rssi(struct acx_softc *sc, uint8_t raw)
 244 {
 245         int rssi;
 246
 247         rssi = ((sc->chip_rssi_corr / 2) + (raw * 5)) / sc->chip_rssi_corr;
 248         return rssi > 100 ? 100 : rssi;
 249 }
 250
 251 static int
 252 acx_probe(device_t dev)
 253 {
 254         const struct acx_device *a;
 255         uint16_t did, vid;
 256
 257         vid = pci_get_vendor(dev);
 258         did = pci_get_device(dev);
 259         for (a = acx_devices; a->desc != NULL; ++a) {
 260                 if (vid == a->vid && did == a->did) {
 261                         a->set_param(dev);
 262                         device_set_desc(dev, a->desc);
 263                         return 0;
 264                 }
 265         }
 266         return ENXIO;
 267 }
 268
 269 static int
 270 acx_attach(device_t dev)
 271 {
 272         struct acx_softc *sc;
 273         struct ifnet *ifp;
 274         struct ieee80211com *ic;
 275         int i, error;
 276
 277         sc = device_get_softc(dev);
 278         ic = &sc->sc_ic;
 279         ifp = &ic->ic_if;
 280
 281         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 282
 283 #ifndef BURN_BRIDGES
 284         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 285                 uint32_t mem1, mem2, irq;
 286
 287                 mem1 = pci_read_config(dev, sc->chip_mem1_rid, 4);
 288                 mem2 = pci_read_config(dev, sc->chip_mem2_rid, 4);
 289                 irq = pci_read_config(dev, PCIR_INTLINE, 4);
 290
 291                 device_printf(dev, "chip is in D%d power mode "
 292                     "-- setting to D0\n", pci_get_powerstate(dev));
 293
 294                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 295
 296                 pci_write_config(dev, sc->chip_mem1_rid, mem1, 4);
 297                 pci_write_config(dev, sc->chip_mem2_rid, mem2, 4);
 298                 pci_write_config(dev, PCIR_INTLINE, irq, 4);
 299         }
 300 #endif  /* !BURN_BRIDGE */
 301
 302         /* Enable bus mastering */
 303         pci_enable_busmaster(dev);
 304
 305         /* Allocate IO memory 1 */
 306         sc->sc_mem1_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 307                                                  &sc->chip_mem1_rid,
 308                                                  RF_ACTIVE);
 309         if (sc->sc_mem1_res == NULL) {
 310                 error = ENXIO;
 311                 device_printf(dev, "can't allocate IO mem1\n");
 312                 goto fail;
 313         }
 314         sc->sc_mem1_bt = rman_get_bustag(sc->sc_mem1_res);
 315         sc->sc_mem1_bh = rman_get_bushandle(sc->sc_mem1_res);
 316
 317         /* Allocate IO memory 2 */
 318         sc->sc_mem2_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 319                                                  &sc->chip_mem2_rid,
 320                                                  RF_ACTIVE);
 321         if (sc->sc_mem2_res == NULL) {
 322                 error = ENXIO;
 323                 device_printf(dev, "can't allocate IO mem2\n");
 324                 goto fail;
 325         }
 326         sc->sc_mem2_bt = rman_get_bustag(sc->sc_mem2_res);
 327         sc->sc_mem2_bh = rman_get_bushandle(sc->sc_mem2_res);
 328
 329         /* Allocate irq */
 330         sc->sc_irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 331                                                 &sc->sc_irq_rid,
 332                                                 RF_SHAREABLE | RF_ACTIVE);
 333         if (sc->sc_irq_res == NULL) {
 334                 error = ENXIO;
 335                 device_printf(dev, "can't allocate intr\n");
 336                 goto fail;
 337         }
 338
 339         /* Initilize channel scanning timer */
 340         callout_init(&sc->sc_chanscan_timer);
 341
 342         /* Allocate busdma stuffs */
 343         error = acx_dma_alloc(sc);
 344         if (error)
 345                 goto fail;
 346
 347         /* Reset Hardware */
 348         error = acx_reset(sc);
 349         if (error)
 350                 goto fail;
 351
 352         /* Disable interrupts before firmware is loaded */
 353         acx_disable_intr(sc);
 354
 355         /* Get radio type and form factor */
 356 #define EEINFO_RETRY_MAX        50
 357         for (i = 0; i < EEINFO_RETRY_MAX; ++i) {
 358                 uint16_t ee_info;
 359
 360                 ee_info = CSR_READ_2(sc, ACXREG_EEPROM_INFO);
 361                 if (ACX_EEINFO_HAS_RADIO_TYPE(ee_info)) {
 362                         sc->sc_form_factor = ACX_EEINFO_FORM_FACTOR(ee_info);
 363                         sc->sc_radio_type = ACX_EEINFO_RADIO_TYPE(ee_info);
 364                         break;
 365                 }
 366                 DELAY(10000);
 367         }
 368         if (i == EEINFO_RETRY_MAX) {
 369                 error = ENXIO;
 370                 goto fail;
 371         }
 372 #undef EEINFO_RETRY_MAX
 373
 374         DPRINTF((&sc->sc_ic.ic_if, "radio type %02x\n", sc->sc_radio_type));
 375
 376 #ifdef DUMP_EEPROM
 377         for (i = 0; i < 0x40; ++i) {
 378                 uint8_t val;
 379
 380                 error = acx_read_eeprom(sc, i, &val);
 381                 if (i % 10 == 0)
 382                         kprintf("\n");
 383                 kprintf("%02x ", val);
 384         }
 385         kprintf("\n");
 386 #endif  /* DUMP_EEPROM */
 387
 388         /* Get EEPROM version */
 389         error = acx_read_eeprom(sc, ACX_EE_VERSION_OFS, &sc->sc_eeprom_ver);
 390         if (error)
 391                 goto fail;
 392         DPRINTF((&sc->sc_ic.ic_if, "EEPROM version %u\n", sc->sc_eeprom_ver));
 393
 394         ifp->if_softc = sc;
 395         ifp->if_init = acx_init;
 396         ifp->if_ioctl = acx_ioctl;
 397         ifp->if_start = acx_start;
 398         ifp->if_watchdog = acx_watchdog;
 399         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
 400         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 401         ifq_set_ready(&ifp->if_snd);
 402
 403         /* Set channels */
 404         for (i = 1; i <= 14; ++i) {
 405                 ic->ic_channels[i].ic_freq =
 406                         ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 407                 ic->ic_channels[i].ic_flags = sc->chip_chan_flags;
 408         }
 409
 410         ic->ic_opmode = IEEE80211_M_STA;
 411         ic->ic_state = IEEE80211_S_INIT;
 412
 413         /*
 414          * NOTE: Don't overwrite ic_caps set by chip specific code
 415          */
 416         ic->ic_caps |= IEEE80211_C_WEP |        /* WEP */
 417                        IEEE80211_C_HOSTAP |     /* HostAP mode */
 418                        IEEE80211_C_MONITOR |    /* Monitor mode */
 419                        IEEE80211_C_IBSS |       /* IBSS modes */
 420                        IEEE80211_C_SHPREAMBLE;  /* Short preamble */
 421         ic->ic_caps_ext = IEEE80211_CEXT_PBCC;  /* PBCC modulation */
 422
 423         /* Get station id */
 424         for (i = 0; i < IEEE80211_ADDR_LEN; ++i) {
 425                 error = acx_read_eeprom(sc, sc->chip_ee_eaddr_ofs - i,
 426                                         &ic->ic_myaddr[i]);
 427         }
 428
 429         ieee80211_ifattach(ic);
 430
 431         /* Enable software beacon missing */
 432         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 433
 434         /* Override newstate */
 435         sc->sc_newstate = ic->ic_newstate;
 436         ic->ic_newstate = acx_newstate;
 437
 438         ieee80211_media_init(ic, acx_media_change, ieee80211_media_status);
 439
 440         sc->sc_long_retry_limit = 4;
 441         sc->sc_msdu_lifetime = 4096;
 442
 443         sysctl_ctx_init(&sc->sc_sysctl_ctx);
 444         sc->sc_sysctl_tree = SYSCTL_ADD_NODE(&sc->sc_sysctl_ctx,
 445                                              SYSCTL_STATIC_CHILDREN(_hw),
 446                                              OID_AUTO,
 447                                              device_get_nameunit(dev),
 448                                              CTLFLAG_RD, 0, "");
 449         if (sc->sc_sysctl_tree == NULL) {
 450                 device_printf(dev, "can't add sysctl node\n");
 451                 error = ENXIO;
 452                 goto fail1;
 453         }
 454
 455         SYSCTL_ADD_PROC(&sc->sc_sysctl_ctx,
 456                         SYSCTL_CHILDREN(sc->sc_sysctl_tree),
 457                         OID_AUTO, "msdu_lifetime",
 458                         CTLTYPE_INT | CTLFLAG_RW,
 459                         sc, 0, acx_sysctl_msdu_lifetime, "I",
 460                         "MSDU life time");
 461
 462         error = bus_setup_intr(dev, sc->sc_irq_res, INTR_MPSAFE, acx_intr, sc,
 463                                &sc->sc_irq_handle, ifp->if_serializer);
 464         if (error) {
 465                 device_printf(dev, "can't set up interrupt\n");
 466                 goto fail1;
 467         }
 468
 469         if (bootverbose)
 470                 ieee80211_announce(ic);
 471
 472         return 0;
 473 fail1:
 474         ieee80211_ifdetach(ic);
 475 fail:
 476         acx_detach(dev);
 477         return error;
 478 }
 479
 480 static int
 481 acx_detach(device_t dev)
 482 {
 483         struct acx_softc *sc = device_get_softc(dev);
 484
 485         if (device_is_attached(dev)) {
 486                 struct ieee80211com *ic = &sc->sc_ic;
 487                 struct ifnet *ifp = &ic->ic_if;
 488
 489                 lwkt_serialize_enter(ifp->if_serializer);
 490
 491                 acx_stop(sc);
 492                 acx_free_firmware(sc);
 493                 bus_teardown_intr(dev, sc->sc_irq_res, sc->sc_irq_handle);
 494
 495                 lwkt_serialize_exit(ifp->if_serializer);
 496
 497                 ieee80211_ifdetach(ic);
 498         }
 499
 500         if (sc->sc_sysctl_tree != NULL)
 501                 sysctl_ctx_free(&sc->sc_sysctl_ctx);
 502
 503         if (sc->sc_irq_res != NULL) {
 504                 bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
 505                                      sc->sc_irq_res);
 506         }
 507         if (sc->sc_mem1_res != NULL) {
 508                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem1_rid,
 509                                      sc->sc_mem1_res);
 510         }
 511         if (sc->sc_mem2_res != NULL) {
 512                 bus_release_resource(dev, SYS_RES_MEMORY, sc->chip_mem2_rid,
 513                                      sc->sc_mem2_res);
 514         }
 515
 516         acx_dma_free(sc);
 517         return 0;
 518 }
 519
 520 static int
 521 acx_shutdown(device_t dev)
 522 {
 523         struct acx_softc *sc = device_get_softc(dev);
 524
 525         lwkt_serialize_enter(sc->sc_ic.ic_if.if_serializer);
 526         acx_stop(sc);
 527         lwkt_serialize_exit(sc->sc_ic.ic_if.if_serializer);
 528         return 0;
 529 }
 530
 531 static void
 532 acx_init(void *arg)
 533 {
 534         struct acx_softc *sc = arg;
 535         struct ieee80211com *ic = &sc->sc_ic;
 536         struct ifnet *ifp = &ic->ic_if;
 537         struct acx_firmware *fw = &sc->sc_firmware;
 538         int error;
 539
 540         error = acx_stop(sc);
 541         if (error)
 542                 return;
 543
 544         if (fw->base_fw == NULL) {
 545                 error = EINVAL;
 546                 if_printf(ifp, "base firmware is not loaded yet\n");
 547                 return;
 548         }
 549
 550         error = acx_init_tx_ring(sc);
 551         if (error) {
 552                 if_printf(ifp, "can't initialize TX ring\n");
 553                 goto back;
 554         }
 555
 556         error = acx_init_rx_ring(sc);
 557         if (error) {
 558                 if_printf(ifp, "can't initialize RX ring\n");
 559                 goto back;
 560         }
 561
 562         error = acx_load_base_firmware(sc, fw->base_fw, fw->base_fw_len);
 563         if (error)
 564                 goto back;
 565
 566         /*
 567          * Initialize command and information registers
 568          * NOTE: This should be done after base firmware is loaded
 569          */
 570         acx_init_cmd_reg(sc);
 571         acx_init_info_reg(sc);
 572
 573         sc->sc_flags |= ACX_FLAG_FW_LOADED;
 574
 575 #if 0
 576         if (sc->chip_post_basefw != NULL) {
 577                 error = sc->chip_post_basefw(sc);
 578                 if (error)
 579                         goto back;
 580         }
 581 #endif
 582
 583         if (fw->radio_fw != NULL) {
 584                 error = acx_load_radio_firmware(sc, fw->radio_fw,
 585                                                 fw->radio_fw_len);
 586                 if (error)
 587                         goto back;
 588         }
 589
 590         error = sc->chip_init(sc);
 591         if (error)
 592                 goto back;
 593
 594         /* Get and set device various configuration */
 595         error = acx_config(sc);
 596         if (error)
 597                 goto back;
 598
 599         /* Setup crypto stuffs */
 600         if (sc->sc_ic.ic_flags & IEEE80211_F_PRIVACY) {
 601                 error = acx_set_crypt_keys(sc);
 602                 if (error)
 603                         goto back;
 604                 sc->sc_ic.ic_flags &= ~IEEE80211_F_DROPUNENC;
 605         }
 606
 607         /* Turn on power led */
 608         CSR_CLRB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 609
 610         acx_enable_intr(sc);
 611
 612         ifp->if_flags |= IFF_RUNNING;
 613         ifp->if_flags &= ~IFF_OACTIVE;
 614
 615         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 616                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 617                         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_SCAN, -1);
 618         } else {
 619                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 620         }
 621 back:
 622         if (error)
 623                 acx_stop(sc);
 624 }
 625
 626 static void
 627 acx_init_info_reg(struct acx_softc *sc)
 628 {
 629         sc->sc_info = CSR_READ_4(sc, ACXREG_INFO_REG_OFFSET);
 630         sc->sc_info_param = sc->sc_info + ACX_INFO_REG_SIZE;
 631 }
 632
 633 static int
 634 acx_set_crypt_keys(struct acx_softc *sc)
 635 {
 636         struct ieee80211com *ic = &sc->sc_ic;
 637         struct acx_conf_wep_txkey wep_txkey;
 638         int i, error, got_wk = 0;
 639
 640         for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
 641                 struct ieee80211_key *wk = &ic->ic_nw_keys[i];
 642
 643                 if (wk->wk_keylen == 0)
 644                         continue;
 645
 646                 if (sc->chip_hw_crypt) {
 647                         error = sc->chip_set_wepkey(sc, wk, i);
 648                         if (error)
 649                                 return error;
 650                         got_wk = 1;
 651                 } else if (wk->wk_flags & IEEE80211_KEY_XMIT) {
 652                         wk->wk_flags |= IEEE80211_KEY_SWCRYPT;
 653                 }
 654         }
 655
 656         if (!got_wk || sc->chip_hw_crypt ||
 657             ic->ic_def_txkey == IEEE80211_KEYIX_NONE)
 658                 return 0;
 659
 660         /* Set current WEP key index */
 661         wep_txkey.wep_txkey = ic->ic_def_txkey;
 662         if (acx_set_wep_txkey_conf(sc, &wep_txkey) != 0) {
 663                 if_printf(&ic->ic_if, "set WEP txkey failed\n");
 664                 return ENXIO;
 665         }
 666         return 0;
 667 }
 668
 669 static void
 670 acx_next_scan(void *arg)
 671 {
 672         struct acx_softc *sc = arg;
 673         struct ieee80211com *ic = &sc->sc_ic;
 674         struct ifnet *ifp = &ic->ic_if;
 675
 676         lwkt_serialize_enter(ifp->if_serializer);
 677
 678         if (ic->ic_state == IEEE80211_S_SCAN) {
 679 #if 0
 680                 uint8_t chan;
 681 #endif
 682
 683                 ieee80211_next_scan(ic);
 684
 685 #if 0
 686                 chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 687
 688                 ACX_ENABLE_TXCHAN(sc, chan);
 689                 ACX_ENABLE_RXCHAN(sc, chan);
 690
 691                 callout_reset(&sc->sc_chanscan_timer, hz / acx_chanscan_rate,
 692                               acx_next_scan, sc);
 693 #endif
 694         }
 695
 696         lwkt_serialize_exit(ifp->if_serializer);
 697 }
 698
 699 static int
 700 acx_stop(struct acx_softc *sc)
 701 {
 702         struct ieee80211com *ic = &sc->sc_ic;
 703         struct ifnet *ifp = &ic->ic_if;
 704         struct acx_buf_data *bd = &sc->sc_buf_data;
 705         struct acx_ring_data *rd = &sc->sc_ring_data;
 706         int i, error;
 707
 708         ASSERT_SERIALIZED(ifp->if_serializer);
 709
 710         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
 711
 712         sc->sc_firmware_ver = 0;
 713         sc->sc_hardware_id = 0;
 714
 715         /* Reset hardware */
 716         error = acx_reset(sc);
 717         if (error)
 718                 return error;
 719
 720         /* Firmware no longer functions after hardware reset */
 721         sc->sc_flags &= ~ACX_FLAG_FW_LOADED;
 722
 723         acx_disable_intr(sc);
 724
 725         /* Stop backgroud scanning */
 726         callout_stop(&sc->sc_chanscan_timer);
 727
 728         /* Turn off power led */
 729         CSR_SETB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);
 730
 731         /* Free TX mbuf */
 732         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
 733                 struct acx_txbuf *buf;
 734
 735                 buf = &bd->tx_buf[i];
 736
 737                 if (buf->tb_mbuf != NULL) {
 738                         bus_dmamap_unload(bd->mbuf_dma_tag,
 739                                           buf->tb_mbuf_dmamap);
 740                         m_freem(buf->tb_mbuf);
 741                         buf->tb_mbuf = NULL;
 742                 }
 743
 744                 if (buf->tb_node != NULL)
 745                         ieee80211_free_node(buf->tb_node);
 746                 buf->tb_node = NULL;
 747         }
 748
 749         /* Clear TX host descriptors */
 750         bzero(rd->tx_ring, ACX_TX_RING_SIZE);
 751
 752         /* Free RX mbuf */
 753         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
 754                 if (bd->rx_buf[i].rb_mbuf != NULL) {
 755                         bus_dmamap_unload(bd->mbuf_dma_tag,
 756                                           bd->rx_buf[i].rb_mbuf_dmamap);
 757                         m_freem(bd->rx_buf[i].rb_mbuf);
 758                         bd->rx_buf[i].rb_mbuf = NULL;
 759                 }
 760         }
 761
 762         /* Clear RX host descriptors */
 763         bzero(rd->rx_ring, ACX_RX_RING_SIZE);
 764
 765         sc->sc_tx_timer = 0;
 766         ifp->if_timer = 0;
 767         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 768
 769         return 0;
 770 }
 771
 772 static int
 773 acx_config(struct acx_softc *sc)
 774 {
 775         struct acx_config conf;
 776         int error;
 777
 778         error = acx_read_config(sc, &conf);
 779         if (error)
 780                 return error;
 781
 782         error = acx_write_config(sc, &conf);
 783         if (error)
 784                 return error;
 785
 786         error = acx_rx_config(sc, sc->sc_flags & ACX_FLAG_PROMISC);
 787         if (error)
 788                 return error;
 789
 790         if (acx_set_probe_req_tmplt(sc, "", 0) != 0) {
 791                 if_printf(&sc->sc_ic.ic_if, "can't set probe req template "
 792                           "(empty ssid)\n");
 793                 return ENXIO;
 794         }
 795
 796         /* XXX for PM?? */
 797         if (acx_set_null_tmplt(sc) != 0) {
 798                 if_printf(&sc->sc_ic.ic_if, "can't set null data template\n");
 799                 return ENXIO;
 800         }
 801         return 0;
 802 }
 803
 804 static int
 805 acx_read_config(struct acx_softc *sc, struct acx_config *conf)
 806 {
 807         struct acx_conf_eaddr addr;
 808         struct acx_conf_regdom reg_dom;
 809         struct acx_conf_antenna ant;
 810         struct acx_conf_fwrev fw_rev;
 811         uint32_t fw_rev_no;
 812         uint8_t sen;
 813         int i, error;
 814
 815         /* Get station id */
 816         if (acx_get_eaddr_conf(sc, &addr) != 0) {
 817                 if_printf(&sc->sc_ic.ic_if, "can't get station id\n");
 818                 return ENXIO;
 819         }
 820
 821         /*
 822          * Get and print station id in case that EEPROM station id's
 823          * offset is not correct
 824          */
 825         for (i = 0; i < IEEE80211_ADDR_LEN; ++i)
 826                 conf->eaddr[IEEE80211_ADDR_LEN - 1 - i] = addr.eaddr[i];
 827         if_printf(&sc->sc_ic.ic_if, "MAC address (from firmware): %6D\n",
 828                   conf->eaddr, ":");
 829
 830         /* Get region domain */
 831         if (acx_get_regdom_conf(sc, &reg_dom) != 0) {
 832                 if_printf(&sc->sc_ic.ic_if, "can't get region domain\n");
 833                 return ENXIO;
 834         }
 835         conf->regdom = reg_dom.regdom;
 836         DPRINTF((&sc->sc_ic.ic_if, "regdom %02x\n", reg_dom.regdom));
 837
 838         /* Get antenna */
 839         if (acx_get_antenna_conf(sc, &ant) != 0) {
 840                 if_printf(&sc->sc_ic.ic_if, "can't get antenna\n");
 841                 return ENXIO;
 842         }
 843         conf->antenna = ant.antenna;
 844         DPRINTF((&sc->sc_ic.ic_if, "antenna %02x\n", ant.antenna));
 845
 846         /* Get sensitivity XXX not used */
 847         if (sc->sc_radio_type == ACX_RADIO_TYPE_MAXIM ||
 848             sc->sc_radio_type == ACX_RADIO_TYPE_RFMD ||
 849             sc->sc_radio_type == ACX_RADIO_TYPE_RALINK) {
 850                 error = acx_read_phyreg(sc, ACXRV_PHYREG_SENSITIVITY, &sen);
 851                 if (error) {
 852                         if_printf(&sc->sc_ic.ic_if, "can't get sensitivity\n");
 853                         return error;
 854                 }
 855         } else {
 856                 sen = 0;
 857         }
 858         DPRINTF((&sc->sc_ic.ic_if, "sensitivity %02x\n", sen));
 859
 860         /* Get firmware revision */
 861         if (acx_get_fwrev_conf(sc, &fw_rev) != 0) {
 862                 if_printf(&sc->sc_ic.ic_if, "can't get firmware revision\n");
 863                 return ENXIO;
 864         }
 865
 866         if (strncmp(fw_rev.fw_rev, "Rev ", 4) != 0) {
 867                 if_printf(&sc->sc_ic.ic_if, "strange revision string -- %s\n",
 868                           fw_rev.fw_rev);
 869                 fw_rev_no = 0x01090407;
 870         } else {
 871                 char *s, *endp;
 872
 873                 /*
 874                  *  01234
 875                  * "Rev xx.xx.xx.xx"
 876                  *      ^ Start from here
 877                  */
 878                 s = &fw_rev.fw_rev[4];
 879                 fw_rev_no = 0;
 880                 for (i = 0; i < 4; ++i) {
 881                         uint8_t val;
 882
 883                         val = strtoul(s, &endp, 16);
 884                         fw_rev_no |= val << ((3 - i) * 8);
 885
 886                         if (*endp == '\0')
 887                                 break;
 888                         else
 889                                 s = ++endp;
 890                 }
 891         }
 892         sc->sc_firmware_ver = fw_rev_no;
 893         sc->sc_hardware_id = le32toh(fw_rev.hw_id);
 894         DPRINTF((&sc->sc_ic.ic_if, "fw rev %08x, hw id %08x\n",
 895                  sc->sc_firmware_ver, sc->sc_hardware_id));
 896
 897         if (sc->chip_read_config != NULL) {
 898                 error = sc->chip_read_config(sc, conf);
 899                 if (error)
 900                         return error;
 901         }
 902         return 0;
 903 }
 904
 905 static int
 906 acx_write_config(struct acx_softc *sc, struct acx_config *conf)
 907 {
 908         struct acx_conf_nretry_short sretry;
 909         struct acx_conf_nretry_long lretry;
 910         struct acx_conf_msdu_lifetime msdu_lifetime;
 911         struct acx_conf_rate_fallback rate_fb;
 912         struct acx_conf_antenna ant;
 913         struct acx_conf_regdom reg_dom;
 914         int error;
 915
 916         /* Set number of long/short retry */
 917         KKASSERT(sc->chip_short_retry_limit > 0);
 918         sretry.nretry = sc->chip_short_retry_limit;
 919         if (acx_set_nretry_short_conf(sc, &sretry) != 0) {
 920                 if_printf(&sc->sc_ic.ic_if, "can't set short retry limit\n");
 921                 return ENXIO;
 922         }
 923
 924         lretry.nretry = sc->sc_long_retry_limit;
 925         if (acx_set_nretry_long_conf(sc, &lretry) != 0) {
 926                 if_printf(&sc->sc_ic.ic_if, "can't set long retry limit\n");
 927                 return ENXIO;
 928         }
 929
 930         /* Set MSDU lifetime */
 931         msdu_lifetime.lifetime = htole32(sc->sc_msdu_lifetime);
 932         if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
 933                 if_printf(&sc->sc_ic.ic_if, "can't set MSDU lifetime\n");
 934                 return ENXIO;
 935         }
 936
 937         /* Enable rate fallback */
 938         rate_fb.ratefb_enable = 1;
 939         if (acx_set_rate_fallback_conf(sc, &rate_fb) != 0) {
 940                 if_printf(&sc->sc_ic.ic_if, "can't enable rate fallback\n");
 941                 return ENXIO;
 942         }
 943
 944         /* Set antenna */
 945         ant.antenna = conf->antenna;
 946         if (acx_set_antenna_conf(sc, &ant) != 0) {
 947                 if_printf(&sc->sc_ic.ic_if, "can't set antenna\n");
 948                 return ENXIO;
 949         }
 950
 951         /* Set region domain */
 952         reg_dom.regdom = conf->regdom;
 953         if (acx_set_regdom_conf(sc, &reg_dom) != 0) {
 954                 if_printf(&sc->sc_ic.ic_if, "can't set region domain\n");
 955                 return ENXIO;
 956         }
 957
 958         if (sc->chip_write_config != NULL) {
 959                 error = sc->chip_write_config(sc, conf);
 960                 if (error)
 961                         return error;
 962         }
 963
 964         return 0;
 965 }
 966
 967 static int
 968 acx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
 969 {
 970         struct acx_softc *sc = ifp->if_softc;
 971         struct ieee80211com *ic = &sc->sc_ic;
 972         struct ifreq *req;
 973         int error;
 974
 975         error = 0;
 976         req = (struct ifreq *)data;
 977
 978         switch (cmd) {
 979         case SIOCSLOADFW:
 980                 error = suser_cred(cr, NULL_CRED_OKAY);
 981                 if (error)
 982                         break;
 983
 984                 error = acx_copyin_firmware(sc, req);
 985                 break;
 986         case SIOCSKILLFW:
 987                 error = suser_cred(cr, NULL_CRED_OKAY);
 988                 if (error)
 989                         break;
 990                 acx_free_firmware(sc);
 991                 break;
 992         case SIOCGRADIO:
 993                 error = copyout(&sc->sc_radio_type, req->ifr_data,
 994                                 sizeof(sc->sc_radio_type));
 995                 break;
 996         case SIOCGFWVER:
 997                 error = copyout(&sc->sc_firmware_ver, req->ifr_data,
 998                                 sizeof(sc->sc_firmware_ver));
 999                 break;
1000         case SIOCGHWID:
1001                 error = copyout(&sc->sc_hardware_id, req->ifr_data,
1002                                 sizeof(sc->sc_hardware_id));
1003                 break;
1004         case SIOCGSTATS:
1005                 error = copyout(&sc->sc_stats, req->ifr_data,
1006                                 sizeof(sc->sc_stats));
1007                 break;
1008         case SIOCSIFFLAGS:
1009                 if (ifp->if_flags & IFF_UP) {
1010                         if ((ifp->if_flags & IFF_RUNNING)) {
1011                                 int promisc = -1;
1012
1013                                 if ((ifp->if_flags & IFF_PROMISC) &&
1014                                     (sc->sc_flags & ACX_FLAG_PROMISC) == 0)
1015                                         promisc = 1;
1016                                 else if ((ifp->if_flags & IFF_PROMISC) == 0 &&
1017                                          (sc->sc_flags & ACX_FLAG_PROMISC))
1018                                         promisc = 0;
1019
1020                                 /*
1021                                  * Promisc mode is always enabled when
1022                                  * operation mode is Monitor.
1023                                  */
1024                                 if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1025                                     promisc >= 0)
1026                                         error = acx_rx_config(sc, promisc);
1027                         } else {
1028                                 acx_init(sc);
1029                         }
1030                 } else {
1031                         if (ifp->if_flags & IFF_RUNNING)
1032                                 acx_stop(sc);
1033                 }
1034
1035                 if (ifp->if_flags & IFF_PROMISC)
1036                         sc->sc_flags |= ACX_FLAG_PROMISC;
1037                 else
1038                         sc->sc_flags &= ~ACX_FLAG_PROMISC;
1039                 break;
1040         case SIOCADDMULTI:
1041         case SIOCDELMULTI:
1042                 /* TODO */
1043                 break;
1044         default:
1045                 error = ieee80211_ioctl(ic, cmd, data, cr);
1046                 break;
1047         }
1048
1049         if (error == ENETRESET) {
1050                 if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
1051                     (IFF_RUNNING | IFF_UP))
1052                         acx_init(sc);
1053                 error = 0;
1054         }
1055         return error;
1056 }
1057
1058 static void
1059 acx_start(struct ifnet *ifp)
1060 {
1061         struct acx_softc *sc = ifp->if_softc;
1062         struct ieee80211com *ic = &sc->sc_ic;
1063         struct acx_buf_data *bd = &sc->sc_buf_data;
1064         struct acx_txbuf *buf;
1065         int trans, idx;
1066
1067         ASSERT_SERIALIZED(ifp->if_serializer);
1068
1069         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0 ||
1070             (ifp->if_flags & IFF_RUNNING) == 0 ||
1071             (ifp->if_flags & IFF_OACTIVE))
1072                 return;
1073
1074         /*
1075          * NOTE:
1076          * We can't start from a random position that TX descriptor
1077          * is free, since hardware will be confused by that.
1078          * We have to follow the order of the TX ring.
1079          */
1080         idx = bd->tx_free_start;
1081         trans = 0;
1082         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf == NULL;
1083              buf = &bd->tx_buf[idx]) {
1084                 struct ieee80211_frame *f;
1085                 struct ieee80211_node *ni = NULL;
1086                 struct mbuf *m;
1087                 int mgmt_pkt = 0;
1088
1089                 if (!IF_QEMPTY(&ic->ic_mgtq)) {
1090                         IF_DEQUEUE(&ic->ic_mgtq, m);
1091
1092                         ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1093                         m->m_pkthdr.rcvif = NULL;
1094
1095                         mgmt_pkt = 1;
1096
1097                         /*
1098                          * Don't transmit probe response firmware will
1099                          * do it for us.
1100                          */
1101                         f = mtod(m, struct ieee80211_frame *);
1102                         if ((f->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1103                             IEEE80211_FC0_TYPE_MGT &&
1104                             (f->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1105                             IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1106                                 if (ni != NULL)
1107                                         ieee80211_free_node(ni);
1108                                 m_freem(m);
1109                                 continue;
1110                         }
1111                 } else if (!ifq_is_empty(&ifp->if_snd)) {
1112                         struct ether_header *eh;
1113
1114                         if (ic->ic_state != IEEE80211_S_RUN) {
1115                                 if_printf(ifp, "data packet dropped due to "
1116                                           "not RUN.  Current state %d\n",
1117                                           ic->ic_state);
1118                                 break;
1119                         }
1120
1121                         m = ifq_dequeue(&ifp->if_snd, NULL);
1122                         if (m == NULL)
1123                                 break;
1124
1125                         if (m->m_len < sizeof(struct ether_header)) {
1126                                 m = m_pullup(m, sizeof(struct ether_header));
1127                                 if (m == NULL) {
1128                                         ifp->if_oerrors++;
1129                                         continue;
1130                                 }
1131                         }
1132                         eh = mtod(m, struct ether_header *);
1133
1134                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1135                         if (ni == NULL) {
1136                                 m_freem(m);
1137                                 ifp->if_oerrors++;
1138                                 continue;
1139                         }
1140
1141                         /* TODO power save */
1142
1143                         BPF_MTAP(ifp, m);
1144
1145                         m = ieee80211_encap(ic, m, ni);
1146                         if (m == NULL) {
1147                                 ieee80211_free_node(ni);
1148                                 ifp->if_oerrors++;
1149                                 continue;
1150                         }
1151                 } else {
1152                         break;
1153                 }
1154
1155                 if (ic->ic_rawbpf != NULL)
1156                         bpf_mtap(ic->ic_rawbpf, m);
1157
1158                 f = mtod(m, struct ieee80211_frame *);
1159                 if ((f->i_fc[1] & IEEE80211_FC1_WEP) && !sc->chip_hw_crypt) {
1160                         KASSERT(ni != NULL, ("TX node is NULL (WEP)\n"));
1161                         if (ieee80211_crypto_encap(ic, ni, m) == NULL) {
1162                                 ieee80211_free_node(ni);
1163                                 m_freem(m);
1164                                 ifp->if_oerrors++;
1165                                 continue;
1166                         }
1167                 }
1168
1169                 /*
1170                  * Since mgmt data are transmitted at fixed rate
1171                  * they will not be used to do rate control.
1172                  */
1173                 if (mgmt_pkt && ni != NULL) {
1174                         ieee80211_free_node(ni);
1175                         ni = NULL;
1176                 }
1177
1178                 if (acx_encap(sc, buf, m, ni) != 0) {
1179                         /*
1180                          * NOTE: `m' will be freed in acx_encap()
1181                          * if we reach here.
1182                          */
1183                         if (ni != NULL)
1184                                 ieee80211_free_node(ni);
1185                         ifp->if_oerrors++;
1186                         continue;
1187                 }
1188
1189                 /*
1190                  * NOTE:
1191                  * 1) `m' should not be touched after acx_encap()
1192                  * 2) `node' will be used to do TX rate control during
1193                  *    acx_txeof(), so it is not freed here.  acx_txeof()
1194                  *    will free it for us
1195                  */
1196
1197                 trans = 1;
1198                 bd->tx_used_count++;
1199                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1200         }
1201         bd->tx_free_start = idx;
1202
1203         if (bd->tx_used_count == ACX_TX_DESC_CNT)
1204                 ifp->if_flags |= IFF_OACTIVE;
1205
1206         if (trans && sc->sc_tx_timer == 0)
1207                 sc->sc_tx_timer = 5;
1208         ifp->if_timer = 1;
1209 }
1210
1211 static void
1212 acx_watchdog(struct ifnet *ifp)
1213 {
1214         struct acx_softc *sc = ifp->if_softc;
1215
1216         ifp->if_timer = 0;
1217
1218         if ((ifp->if_flags & IFF_RUNNING) == 0)
1219                 return;
1220
1221         if (sc->sc_tx_timer) {
1222                 if (--sc->sc_tx_timer == 0) {
1223                         if_printf(ifp, "watchdog timeout\n");
1224                         ifp->if_oerrors++;
1225                         acx_txeof(ifp->if_softc);
1226                 } else {
1227                         ifp->if_timer = 1;
1228                 }
1229         }
1230         ieee80211_watchdog(&sc->sc_ic);
1231 }
1232
1233 static void
1234 acx_intr(void *arg)
1235 {
1236         struct acx_softc *sc = arg;
1237         uint16_t intr_status;
1238
1239         if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0)
1240                 return;
1241
1242         intr_status = CSR_READ_2(sc, ACXREG_INTR_STATUS_CLR);
1243         if (intr_status == ACXRV_INTR_ALL) {
1244                 /* not our interrupt */
1245                 return;
1246         }
1247
1248         intr_status &= sc->chip_intr_enable;
1249         if (intr_status == 0) {
1250                 /* not interrupts we care about */
1251                 return;
1252         }
1253
1254         /* Acknowledge all interrupts */
1255         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_ALL);
1256
1257         if (intr_status & ACXRV_INTR_TX_FINI)
1258                 acx_txeof(sc);
1259
1260         if (intr_status & ACXRV_INTR_RX_FINI)
1261                 acx_rxeof(sc);
1262 }
1263
1264 static void
1265 acx_disable_intr(struct acx_softc *sc)
1266 {
1267         CSR_WRITE_2(sc, ACXREG_INTR_MASK, sc->chip_intr_disable);
1268         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, 0);
1269 }
1270
1271 static void
1272 acx_enable_intr(struct acx_softc *sc)
1273 {
1274         /* Mask out interrupts that are not in the enable set */
1275         CSR_WRITE_2(sc, ACXREG_INTR_MASK, ~sc->chip_intr_enable);
1276         CSR_WRITE_2(sc, ACXREG_EVENT_MASK, ACXRV_EVENT_DISABLE);
1277 }
1278
1279 static void
1280 acx_txeof(struct acx_softc *sc)
1281 {
1282         struct acx_buf_data *bd;
1283         struct acx_txbuf *buf;
1284         struct ifnet *ifp;
1285         int idx;
1286
1287         ifp = &sc->sc_ic.ic_if;
1288         ASSERT_SERIALIZED(ifp->if_serializer);
1289
1290         bd = &sc->sc_buf_data;
1291         idx = bd->tx_used_start;
1292         for (buf = &bd->tx_buf[idx]; buf->tb_mbuf != NULL;
1293              buf = &bd->tx_buf[idx]) {
1294                 uint8_t ctrl, error;
1295                 int frame_len;
1296
1297                 ctrl = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_ctrl);
1298                 if ((ctrl & (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE)) !=
1299                     (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE))
1300                         break;
1301
1302                 bus_dmamap_unload(bd->mbuf_dma_tag, buf->tb_mbuf_dmamap);
1303                 frame_len = buf->tb_mbuf->m_pkthdr.len;
1304                 m_freem(buf->tb_mbuf);
1305                 buf->tb_mbuf = NULL;
1306
1307                 error = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_error);
1308                 if (error) {
1309                         acx_txerr(sc, error);
1310                         ifp->if_oerrors++;
1311                 } else {
1312                         ifp->if_opackets++;
1313                 }
1314
1315                 if (buf->tb_node != NULL) {
1316                         sc->chip_tx_complete(sc, buf, frame_len, error);
1317                         ieee80211_free_node(buf->tb_node);
1318                         buf->tb_node = NULL;
1319                 }
1320
1321                 FW_TXDESC_SETFIELD_1(sc, buf, f_tx_ctrl, DESC_CTRL_HOSTOWN);
1322
1323                 bd->tx_used_count--;
1324
1325                 idx = (idx + 1) % ACX_TX_DESC_CNT;
1326         }
1327         bd->tx_used_start = idx;
1328
1329         sc->sc_tx_timer = bd->tx_used_count == 0 ? 0 : 5;
1330
1331         if (bd->tx_used_count != ACX_TX_DESC_CNT) {
1332                 ifp->if_flags &= ~IFF_OACTIVE;
1333                 acx_start(ifp);
1334         }
1335 }
1336
1337 static void
1338 acx_txerr(struct acx_softc *sc, uint8_t err)
1339 {
1340         struct ifnet *ifp = &sc->sc_ic.ic_if;
1341         struct acx_stats *stats = &sc->sc_stats;
1342
1343         if (err == DESC_ERR_EXCESSIVE_RETRY) {
1344                 /*
1345                  * This a common error (see comment below),
1346                  * so print it using DPRINTF()
1347                  */
1348                 DPRINTF((ifp, "TX failed -- excessive retry\n"));
1349         } else {
1350                 if_printf(ifp, "TX failed -- ");
1351         }
1352
1353         /*
1354          * Although `err' looks like bitmask, it never
1355          * has multiple bits set.
1356          */
1357         switch (err) {
1358 #if 0
1359         case DESC_ERR_OTHER_FRAG:
1360                 /* XXX what's this */
1361                 kprintf("error in other fragment\n");
1362                 stats->err_oth_frag++;
1363                 break;
1364 #endif
1365         case DESC_ERR_ABORT:
1366                 kprintf("aborted\n");
1367                 stats->err_abort++;
1368                 break;
1369         case DESC_ERR_PARAM:
1370                 kprintf("wrong paramters in descriptor\n");
1371                 stats->err_param++;
1372                 break;
1373         case DESC_ERR_NO_WEPKEY:
1374                 kprintf("WEP key missing\n");
1375                 stats->err_no_wepkey++;
1376                 break;
1377         case DESC_ERR_MSDU_TIMEOUT:
1378                 kprintf("MSDU life timeout\n");
1379                 stats->err_msdu_timeout++;
1380                 break;
1381         case DESC_ERR_EXCESSIVE_RETRY:
1382                 /*
1383                  * Possible causes:
1384                  * 1) Distance is too long
1385                  * 2) Transmit failed (e.g. no MAC level ACK)
1386                  * 3) Chip overheated (this should be rare)
1387                  */
1388                 stats->err_ex_retry++;
1389                 break;
1390         case DESC_ERR_BUF_OVERFLOW:
1391                 kprintf("buffer overflow\n");
1392                 stats->err_buf_oflow++;
1393                 break;
1394         case DESC_ERR_DMA:
1395                 kprintf("DMA error\n");
1396                 stats->err_dma++;
1397                 break;
1398         default:
1399                 kprintf("unknown error %d\n", err);
1400                 stats->err_unkn++;
1401                 break;
1402         }
1403 }
1404
1405 static void
1406 acx_rxeof(struct acx_softc *sc)
1407 {
1408         struct ieee80211com *ic = &sc->sc_ic;
1409         struct acx_ring_data *rd = &sc->sc_ring_data;
1410         struct acx_buf_data *bd = &sc->sc_buf_data;
1411         struct ifnet *ifp = &ic->ic_if;
1412         int idx, ready;
1413
1414         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1415
1416         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1417                         BUS_DMASYNC_POSTREAD);
1418
1419         /*
1420          * Locate first "ready" rx buffer,
1421          * start from last stopped position
1422          */
1423         idx = bd->rx_scan_start;
1424         ready = 0;
1425         do {
1426                 struct acx_rxbuf *buf;
1427
1428                 buf = &bd->rx_buf[idx];
1429                 if ((buf->rb_desc->h_ctrl & htole16(DESC_CTRL_HOSTOWN)) &&
1430                     (buf->rb_desc->h_status & htole32(DESC_STATUS_FULL))) {
1431                         ready = 1;
1432                         break;
1433                 }
1434                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1435         } while (idx != bd->rx_scan_start);
1436
1437         if (!ready)
1438                 return;
1439
1440         /*
1441          * NOTE: don't mess up `idx' here, it will
1442          * be used in the following code
1443          */
1444
1445         do {
1446                 struct acx_rxbuf_hdr *head;
1447                 struct acx_rxbuf *buf;
1448                 struct mbuf *m;
1449                 uint32_t desc_status;
1450                 uint16_t desc_ctrl;
1451                 int len, error;
1452
1453                 buf = &bd->rx_buf[idx];
1454
1455                 desc_ctrl = le16toh(buf->rb_desc->h_ctrl);
1456                 desc_status = le32toh(buf->rb_desc->h_status);
1457                 if (!(desc_ctrl & DESC_CTRL_HOSTOWN) ||
1458                     !(desc_status & DESC_STATUS_FULL))
1459                         break;
1460
1461                 bus_dmamap_sync(bd->mbuf_dma_tag, buf->rb_mbuf_dmamap,
1462                                 BUS_DMASYNC_POSTREAD);
1463
1464                 m = buf->rb_mbuf;
1465
1466                 error = acx_newbuf(sc, buf, 0);
1467                 if (error) {
1468                         ifp->if_ierrors++;
1469                         goto next;
1470                 }
1471
1472                 head = mtod(m, struct acx_rxbuf_hdr *);
1473
1474                 len = le16toh(head->rbh_len) & ACX_RXBUF_LEN_MASK;
1475                 if (len >= sizeof(struct ieee80211_frame_min) &&
1476                     len < MCLBYTES) {
1477                         struct ieee80211_frame_min *f;
1478                         struct ieee80211_node *ni;
1479                         int rssi;
1480
1481                         m_adj(m, sizeof(struct acx_rxbuf_hdr) +
1482                                  sc->chip_rxbuf_exhdr);
1483                         f = mtod(m, struct ieee80211_frame_min *);
1484
1485                         if ((f->i_fc[1] & IEEE80211_FC1_WEP) &&
1486                             sc->chip_hw_crypt) {
1487                                 /* Short circuit software WEP */
1488                                 f->i_fc[1] &= ~IEEE80211_FC1_WEP;
1489
1490                                 /* Do chip specific RX buffer processing */
1491                                 if (sc->chip_proc_wep_rxbuf != NULL) {
1492                                         sc->chip_proc_wep_rxbuf(sc, m, &len);
1493                                         f = mtod(m,
1494                                             struct ieee80211_frame_min *);
1495                                 }
1496                         }
1497
1498                         rssi = acx_get_rssi(sc, head->rbh_level);
1499
1500                         ni = ieee80211_find_rxnode(ic, f);
1501
1502                         m->m_len = m->m_pkthdr.len = len;
1503                         m->m_pkthdr.rcvif = &ic->ic_if;
1504
1505                         ieee80211_input(ic, m, ni, rssi,
1506                                         le32toh(head->rbh_time));
1507
1508                         ieee80211_free_node(ni);
1509                         ifp->if_ipackets++;
1510                 } else {
1511                         if (len < sizeof(struct ieee80211_frame_min)) {
1512                                 if (ic->ic_rawbpf != NULL &&
1513                                     len >= sizeof(struct ieee80211_frame_ack)) {
1514                                         m_adj(m, sizeof(struct acx_rxbuf_hdr) +
1515                                                  sc->chip_rxbuf_exhdr);
1516                                         m->m_len = m->m_pkthdr.len = len;
1517                                         m->m_pkthdr.rcvif = &ic->ic_if;
1518                                         bpf_mtap(ic->ic_rawbpf, m);
1519                                 }
1520
1521                                 if (ic->ic_opmode != IEEE80211_M_MONITOR)
1522                                         ic->ic_stats.is_rx_tooshort++;
1523                         }
1524                         m_freem(m);
1525                 }
1526
1527 next:
1528                 buf->rb_desc->h_ctrl = htole16(desc_ctrl & ~DESC_CTRL_HOSTOWN);
1529                 buf->rb_desc->h_status = 0;
1530                 bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
1531                                 BUS_DMASYNC_PREWRITE);
1532
1533                 idx = (idx + 1) % ACX_RX_DESC_CNT;
1534         } while (idx != bd->rx_scan_start);
1535
1536         /*
1537          * Record the position so that next
1538          * time we can start from it
1539          */
1540         bd->rx_scan_start = idx;
1541 }
1542
1543 static int
1544 acx_reset(struct acx_softc *sc)
1545 {
1546         uint16_t reg;
1547
1548         /* Halt ECPU */
1549         CSR_SETB_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_HALT);
1550
1551         /* Software reset */
1552         reg = CSR_READ_2(sc, ACXREG_SOFT_RESET);
1553         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg | ACXRV_SOFT_RESET);
1554         DELAY(100);
1555         CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg);
1556
1557         /* Initialize EEPROM */
1558         CSR_SETB_2(sc, ACXREG_EEPROM_INIT, ACXRV_EEPROM_INIT);
1559         DELAY(50000);
1560
1561         /* Test whether ECPU is stopped */
1562         reg = CSR_READ_2(sc, ACXREG_ECPU_CTRL);
1563         if (!(reg & ACXRV_ECPU_HALT)) {
1564                 if_printf(&sc->sc_ic.ic_if, "can't halt ECPU\n");
1565                 return ENXIO;
1566         }
1567         return 0;
1568 }
1569
1570 static int
1571 acx_read_eeprom(struct acx_softc *sc, uint32_t offset, uint8_t *val)
1572 {
1573         int i;
1574
1575         CSR_WRITE_4(sc, ACXREG_EEPROM_CONF, 0);
1576         CSR_WRITE_4(sc, ACXREG_EEPROM_ADDR, offset);
1577         CSR_WRITE_4(sc, ACXREG_EEPROM_CTRL, ACXRV_EEPROM_READ);
1578
1579 #define EE_READ_RETRY_MAX       100
1580         for (i = 0; i < EE_READ_RETRY_MAX; ++i) {
1581                 if (CSR_READ_2(sc, ACXREG_EEPROM_CTRL) == 0)
1582                         break;
1583                 DELAY(10000);
1584         }
1585         if (i == EE_READ_RETRY_MAX) {
1586                 if_printf(&sc->sc_ic.ic_if, "can't read EEPROM offset %x "
1587                           "(timeout)\n", offset);
1588                 return ETIMEDOUT;
1589         }
1590 #undef EE_READ_RETRY_MAX
1591
1592         *val = CSR_READ_1(sc, ACXREG_EEPROM_DATA);
1593         return 0;
1594 }
1595
1596 static int
1597 acx_read_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t *val)
1598 {
1599         int i;
1600
1601         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1602         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_READ);
1603
1604 #define PHY_READ_RETRY_MAX      100
1605         for (i = 0; i < PHY_READ_RETRY_MAX; ++i) {
1606                 if (CSR_READ_4(sc, ACXREG_PHY_CTRL) == 0)
1607                         break;
1608                 DELAY(10000);
1609         }
1610         if (i == PHY_READ_RETRY_MAX) {
1611                 if_printf(&sc->sc_ic.ic_if, "can't read phy reg %x (timeout)\n",
1612                           reg);
1613                 return ETIMEDOUT;
1614         }
1615 #undef PHY_READ_RETRY_MAX
1616
1617         *val = CSR_READ_1(sc, ACXREG_PHY_DATA);
1618         return 0;
1619 }
1620
1621 void
1622 acx_write_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t val)
1623 {
1624         CSR_WRITE_4(sc, ACXREG_PHY_DATA, val);
1625         CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
1626         CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_WRITE);
1627 }
1628
1629 static int
1630 acx_copyin_firmware(struct acx_softc *sc, struct ifreq *req)
1631 {
1632         struct acx_firmware ufw, *kfw;
1633         uint8_t *base_fw, *radio_fw;
1634         int error;
1635
1636         kfw = &sc->sc_firmware;
1637         base_fw = NULL;
1638         radio_fw = NULL;
1639
1640         error = copyin(req->ifr_data, &ufw, sizeof(ufw));
1641         if (error)
1642                 return error;
1643
1644         /*
1645          * For combined base firmware, there is no radio firmware.
1646          * But base firmware must exist.
1647          */
1648         if (ufw.base_fw_len <= 0 || ufw.radio_fw_len < 0)
1649                 return EINVAL;
1650
1651         base_fw = kmalloc(ufw.base_fw_len, M_DEVBUF, M_INTWAIT);
1652         error = copyin(ufw.base_fw, base_fw, ufw.base_fw_len);
1653         if (error)
1654                 goto fail;
1655
1656         if (ufw.radio_fw_len > 0) {
1657                 radio_fw = kmalloc(ufw.radio_fw_len, M_DEVBUF, M_INTWAIT);
1658                 error = copyin(ufw.radio_fw, radio_fw, ufw.radio_fw_len);
1659                 if (error)
1660                         goto fail;
1661         }
1662
1663         kfw->base_fw_len = ufw.base_fw_len;
1664         if (kfw->base_fw != NULL)
1665                 kfree(kfw->base_fw, M_DEVBUF);
1666         kfw->base_fw = base_fw;
1667
1668         kfw->radio_fw_len = ufw.radio_fw_len;
1669         if (kfw->radio_fw != NULL)
1670                 kfree(kfw->radio_fw, M_DEVBUF);
1671         kfw->radio_fw = radio_fw;
1672
1673         return 0;
1674 fail:
1675         if (base_fw != NULL)
1676                 kfree(base_fw, M_DEVBUF);
1677         if (radio_fw != NULL)
1678                 kfree(radio_fw, M_DEVBUF);
1679         return error;
1680 }
1681
1682 static void
1683 acx_free_firmware(struct acx_softc *sc)
1684 {
1685         struct acx_firmware *fw = &sc->sc_firmware;
1686
1687         if (fw->base_fw != NULL) {
1688                 kfree(fw->base_fw, M_DEVBUF);
1689                 fw->base_fw = NULL;
1690                 fw->base_fw_len = 0;
1691         }
1692         if (fw->radio_fw != NULL) {
1693                 kfree(fw->radio_fw, M_DEVBUF);
1694                 fw->radio_fw = NULL;
1695                 fw->radio_fw_len = 0;
1696         }
1697 }
1698
1699 static int
1700 acx_load_base_firmware(struct acx_softc *sc, const uint8_t *base_fw,
1701                        uint32_t base_fw_len)
1702 {
1703         int i, error;
1704
1705         /* Load base firmware */
1706         error = acx_load_firmware(sc, 0, base_fw, base_fw_len);
1707         if (error) {
1708                 if_printf(&sc->sc_ic.ic_if, "can't load base firmware\n");
1709                 return error;
1710         }
1711         DPRINTF((&sc->sc_ic.ic_if, "base firmware loaded\n"));
1712
1713         /* Start ECPU */
1714         CSR_WRITE_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_START);
1715
1716         /* Wait for ECPU to be up */
1717         for (i = 0; i < 500; ++i) {
1718                 uint16_t reg;
1719
1720                 reg = CSR_READ_2(sc, ACXREG_INTR_STATUS);
1721                 if (reg & ACXRV_INTR_FCS_THRESH) {
1722                         CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_FCS_THRESH);
1723                         return 0;
1724                 }
1725                 DELAY(10000);
1726         }
1727
1728         if_printf(&sc->sc_ic.ic_if, "can't initialize ECPU (timeout)\n");
1729         return ENXIO;
1730 }
1731
1732 static int
1733 acx_load_radio_firmware(struct acx_softc *sc, const uint8_t *radio_fw,
1734                         uint32_t radio_fw_len)
1735 {
1736         struct acx_conf_mmap mem_map;
1737         uint32_t radio_fw_ofs;
1738         int error;
1739
1740         /*
1741          * Get the position, where base firmware is loaded, so that
1742          * radio firmware can be loaded after it.
1743          */
1744         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1745                 return ENXIO;
1746         radio_fw_ofs = le32toh(mem_map.code_end);
1747
1748         /* Put ECPU into sleeping state, before loading radio firmware */
1749         if (acx_sleep(sc) != 0)
1750                 return ENXIO;
1751
1752         /* Load radio firmware */
1753         error = acx_load_firmware(sc, radio_fw_ofs, radio_fw, radio_fw_len);
1754         if (error) {
1755                 if_printf(&sc->sc_ic.ic_if, "can't load radio firmware\n");
1756                 return ENXIO;
1757         }
1758         DPRINTF((&sc->sc_ic.ic_if, "radio firmware loaded\n"));
1759
1760         /* Wake up sleeping ECPU, after radio firmware is loaded */
1761         if (acx_wakeup(sc) != 0)
1762                 return ENXIO;
1763
1764         /* Initialize radio */
1765         if (acx_init_radio(sc, radio_fw_ofs, radio_fw_len) != 0)
1766                 return ENXIO;
1767
1768         /* Verify radio firmware's loading position */
1769         if (acx_get_mmap_conf(sc, &mem_map) != 0)
1770                 return ENXIO;
1771         if (le32toh(mem_map.code_end) != radio_fw_ofs + radio_fw_len) {
1772                 if_printf(&sc->sc_ic.ic_if, "loaded radio firmware position "
1773                           "mismatch\n");
1774                 return ENXIO;
1775         }
1776
1777         DPRINTF((&sc->sc_ic.ic_if, "radio firmware initialized\n"));
1778         return 0;
1779 }
1780
1781 static int
1782 acx_load_firmware(struct acx_softc *sc, uint32_t offset, const uint8_t *data,
1783                   int data_len)
1784 {
1785         const uint32_t *fw;
1786         int i, fw_len;
1787
1788         fw = (const uint32_t *)data;
1789         fw_len = data_len / sizeof(uint32_t);
1790
1791         /*
1792          * LOADFW_AUTO_INC only works with some older firmware:
1793          * 1) acx100's firmware
1794          * 2) acx111's firmware whose rev is 0x00010011
1795          */
1796
1797         /* Load firmware */
1798         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1799 #ifndef LOADFW_AUTO_INC
1800         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1801 #else
1802         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1803         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1804 #endif
1805
1806         for (i = 0; i < fw_len; ++i) {
1807 #ifndef LOADFW_AUTO_INC
1808                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1809 #endif
1810                 CSR_WRITE_4(sc, ACXREG_FWMEM_DATA, be32toh(fw[i]));
1811         }
1812
1813         /* Verify firmware */
1814         CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
1815 #ifndef LOADFW_AUTO_INC
1816         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
1817 #else
1818         CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
1819         CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
1820 #endif
1821
1822         for (i = 0; i < fw_len; ++i) {
1823                 uint32_t val;
1824
1825 #ifndef LOADFW_AUTO_INC
1826                 CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
1827 #endif
1828                 val = CSR_READ_4(sc, ACXREG_FWMEM_DATA);
1829                 if (be32toh(fw[i]) != val) {
1830                         if_printf(&sc->sc_ic.ic_if, "fireware mismatch "
1831                                   "fw %08x  loaded %08x\n", fw[i], val);
1832                         return ENXIO;
1833                 }
1834         }
1835         return 0;
1836 }
1837
1838 static int
1839 acx_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1840 {
1841         struct acx_softc *sc = ic->ic_if.if_softc;
1842         struct ieee80211_node *ni;
1843         int error = 0, mode = 0;
1844         uint8_t chan;
1845
1846         ASSERT_SERIALIZED(ic->ic_if.if_serializer);
1847
1848         ieee80211_ratectl_newstate(ic, nstate);
1849
1850         switch (nstate) {
1851         case IEEE80211_S_SCAN:
1852                 if (ic->ic_state != IEEE80211_S_INIT) {
1853                         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1854                         ACX_ENABLE_TXCHAN(sc, chan);
1855                         ACX_ENABLE_RXCHAN(sc, chan);
1856
1857                         callout_reset(&sc->sc_chanscan_timer,
1858                                       hz / acx_chanscan_rate,
1859                                       acx_next_scan, sc);
1860                 }
1861                 break;
1862         case IEEE80211_S_AUTH:
1863                 if (ic->ic_opmode == IEEE80211_M_STA) {
1864                         ni = ic->ic_bss;
1865                         chan = ieee80211_chan2ieee(ic, ni->ni_chan);
1866                         if (acx_join_bss(sc, ACX_MODE_STA, ni, chan) != 0) {
1867                                 if_printf(&ic->ic_if, "join BSS failed\n");
1868                                 error = 1;
1869                                 goto back;
1870                         }
1871
1872                         DPRINTF((&ic->ic_if, "join BSS\n"));
1873                         if (ic->ic_state == IEEE80211_S_ASSOC) {
1874                                 DPRINTF((&ic->ic_if,
1875                                          "change from assoc to run\n"));
1876                                 ic->ic_state = IEEE80211_S_RUN;
1877                         }
1878                 }
1879                 break;
1880         case IEEE80211_S_RUN:
1881                 if (ic->ic_opmode == IEEE80211_M_IBSS ||
1882                     ic->ic_opmode == IEEE80211_M_HOSTAP) {
1883                         ni = ic->ic_bss;
1884                         chan = ieee80211_chan2ieee(ic, ni->ni_chan);
1885
1886                         error = 1;
1887
1888                         if (acx_enable_txchan(sc, chan) != 0) {
1889                                 if_printf(&ic->ic_if,
1890                                           "enable TX on channel %d failed\n",
1891                                           chan);
1892                                 goto back;
1893                         }
1894
1895                         if (acx_enable_rxchan(sc, chan) != 0) {
1896                                 if_printf(&ic->ic_if,
1897                                           "enable RX on channel %d failed\n",
1898                                           chan);
1899                                 goto back;
1900                         }
1901
1902                         if (acx_set_beacon_tmplt(sc, ni) != 0) {
1903                                 if_printf(&ic->ic_if,
1904                                           "set bescon template failed\n");
1905                                 goto back;
1906                         }
1907
1908                         if (acx_set_probe_resp_tmplt(sc, ni) != 0) {
1909                                 if_printf(&ic->ic_if, "set probe response "
1910                                           "template failed\n");
1911                                 goto back;
1912                         }
1913
1914                         if (ic->ic_opmode == IEEE80211_M_IBSS)
1915                                 mode = ACX_MODE_ADHOC;
1916                         else
1917                                 mode = ACX_MODE_AP;
1918
1919                         if (acx_join_bss(sc, mode, ni, chan) != 0) {
1920                                 if_printf(&ic->ic_if, "acx_join_ibss failed\n");
1921                                 goto back;
1922                         }
1923
1924                         DPRINTF((&ic->ic_if, "join IBSS\n"));
1925                         error = 0;
1926                 } else if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1927                         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1928                         error = 1;
1929
1930                         if (acx_enable_txchan(sc, chan) != 0) {
1931                                 if_printf(&ic->ic_if,
1932                                           "enable TX on channel %d failed\n",
1933                                           chan);
1934                                 goto back;
1935                         }
1936                         if (acx_enable_rxchan(sc, chan) != 0) {
1937                                 if_printf(&ic->ic_if,
1938                                           "enable RX on channel %d failed\n",
1939                                           chan);
1940                                 goto back;
1941                         }
1942
1943                         if (acx_join_bss(sc, ACX_MODE_STA,
1944                                          ic->ic_bss, chan) != 0) {
1945                                 if_printf(&ic->ic_if, "join BSS failed\n");
1946                                 goto back;
1947                         }
1948                         error = 0;
1949                 }
1950                 break;
1951         default:
1952                 break;
1953         }
1954
1955 back:
1956         if (error) {
1957                 /* XXX */
1958                 nstate = IEEE80211_S_INIT;
1959                 arg = -1;
1960         }
1961         return sc->sc_newstate(ic, nstate, arg);
1962 }
1963
1964 int
1965 acx_init_tmplt_ordered(struct acx_softc *sc)
1966 {
1967         struct acx_tmplt_tim tim;
1968
1969 #define INIT_TMPLT(name)                        \
1970 do {                                            \
1971         if (acx_init_##name##_tmplt(sc) != 0)   \
1972                 return 1;                       \
1973 } while (0)
1974
1975         /*
1976          * NOTE:
1977          * Order of templates initialization:
1978          * 1) Probe request
1979          * 2) NULL data
1980          * 3) Beacon
1981          * 4) TIM
1982          * 5) Probe response
1983          * Above order is critical to get a correct memory map.
1984          */
1985         INIT_TMPLT(probe_req);
1986         INIT_TMPLT(null_data);
1987         INIT_TMPLT(beacon);
1988         INIT_TMPLT(tim);
1989         INIT_TMPLT(probe_resp);
1990
1991         /* Setup TIM template */
1992         bzero(&tim, sizeof(tim));
1993         tim.tim_eid = IEEE80211_ELEMID_TIM;
1994         tim.tim_len = ACX_TIM_LEN(ACX_TIM_BITMAP_LEN);
1995         if (_acx_set_tim_tmplt(sc, &tim,
1996                                ACX_TMPLT_TIM_SIZ(ACX_TIM_BITMAP_LEN)) != 0) {
1997                 if_printf(&sc->sc_ic.ic_if, "%s can't set tim tmplt\n",
1998                           __func__);
1999                 return 1;
2000         }
2001
2002 #undef INIT_TMPLT
2003         return 0;
2004 }
2005
2006 static void
2007 acx_ring_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
2008 {
2009         *((uint32_t *)arg) = seg->ds_addr;
2010 }
2011
2012 static int
2013 acx_dma_alloc(struct acx_softc *sc)
2014 {
2015         struct acx_ring_data *rd = &sc->sc_ring_data;
2016         struct acx_buf_data *bd = &sc->sc_buf_data;
2017         int i, error;
2018
2019         /* Allocate DMA stuffs for RX descriptors  */
2020         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
2021                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2022                                    NULL, NULL,
2023                                    ACX_RX_RING_SIZE, 1, ACX_RX_RING_SIZE,
2024                                    0, &rd->rx_ring_dma_tag);
2025         if (error) {
2026                 if_printf(&sc->sc_ic.ic_if, "can't create rx ring dma tag\n");
2027                 return error;
2028         }
2029
2030         error = bus_dmamem_alloc(rd->rx_ring_dma_tag, (void **)&rd->rx_ring,
2031                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
2032                                  &rd->rx_ring_dmamap);
2033         if (error) {
2034                 if_printf(&sc->sc_ic.ic_if,
2035                           "can't allocate rx ring dma memory\n");
2036                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2037                 rd->rx_ring_dma_tag = NULL;
2038                 return error;
2039         }
2040
2041         error = bus_dmamap_load(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2042                                 rd->rx_ring, ACX_RX_RING_SIZE,
2043                                 acx_ring_dma_addr, &rd->rx_ring_paddr,
2044                                 BUS_DMA_WAITOK);
2045         if (error) {
2046                 if_printf(&sc->sc_ic.ic_if, "can't get rx ring dma address\n");
2047                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2048                                 rd->rx_ring_dmamap);
2049                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2050                 rd->rx_ring_dma_tag = NULL;
2051                 return error;
2052         }
2053
2054         /* Allocate DMA stuffs for TX descriptors */
2055         error = bus_dma_tag_create(NULL, PAGE_SIZE, 0,
2056                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2057                                    NULL, NULL,
2058                                    ACX_TX_RING_SIZE, 1, ACX_TX_RING_SIZE,
2059                                    0, &rd->tx_ring_dma_tag);
2060         if (error) {
2061                 if_printf(&sc->sc_ic.ic_if, "can't create tx ring dma tag\n");
2062                 return error;
2063         }
2064
2065         error = bus_dmamem_alloc(rd->tx_ring_dma_tag, (void **)&rd->tx_ring,
2066                                  BUS_DMA_WAITOK | BUS_DMA_ZERO,
2067                                  &rd->tx_ring_dmamap);
2068         if (error) {
2069                 if_printf(&sc->sc_ic.ic_if,
2070                           "can't allocate tx ring dma memory\n");
2071                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2072                 rd->tx_ring_dma_tag = NULL;
2073                 return error;
2074         }
2075
2076         error = bus_dmamap_load(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2077                                 rd->tx_ring, ACX_TX_RING_SIZE,
2078                                 acx_ring_dma_addr, &rd->tx_ring_paddr,
2079                                 BUS_DMA_WAITOK);
2080         if (error) {
2081                 if_printf(&sc->sc_ic.ic_if, "can't get tx ring dma address\n");
2082                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2083                                 rd->tx_ring_dmamap);
2084                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2085                 rd->tx_ring_dma_tag = NULL;
2086                 return error;
2087         }
2088
2089         /* Create DMA tag for RX/TX mbuf map */
2090         error = bus_dma_tag_create(NULL, 1, 0,
2091                                    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
2092                                    NULL, NULL,
2093                                    MCLBYTES, 1, MCLBYTES,
2094                                    0, &bd->mbuf_dma_tag);
2095         if (error) {
2096                 if_printf(&sc->sc_ic.ic_if, "can't create mbuf dma tag\n");
2097                 return error;
2098         }
2099
2100         /* Create a spare RX DMA map */
2101         error = bus_dmamap_create(bd->mbuf_dma_tag, 0, &bd->mbuf_tmp_dmamap);
2102         if (error) {
2103                 if_printf(&sc->sc_ic.ic_if, "can't create tmp mbuf dma map\n");
2104                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2105                 bd->mbuf_dma_tag = NULL;
2106                 return error;
2107         }
2108
2109         /* Create DMA map for RX mbufs */
2110         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2111                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2112                                           &bd->rx_buf[i].rb_mbuf_dmamap);
2113                 if (error) {
2114                         if_printf(&sc->sc_ic.ic_if, "can't create rx mbuf "
2115                                   "dma map (%d)\n", i);
2116                         return error;
2117                 }
2118                 bd->rx_buf[i].rb_desc = &rd->rx_ring[i];
2119         }
2120
2121         /* Create DMA map for TX mbufs */
2122         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2123                 error = bus_dmamap_create(bd->mbuf_dma_tag, 0,
2124                                           &bd->tx_buf[i].tb_mbuf_dmamap);
2125                 if (error) {
2126                         if_printf(&sc->sc_ic.ic_if, "can't create tx mbuf "
2127                                   "dma map (%d)\n", i);
2128                         return error;
2129                 }
2130                 bd->tx_buf[i].tb_desc1 = &rd->tx_ring[i * 2];
2131                 bd->tx_buf[i].tb_desc2 = &rd->tx_ring[(i * 2) + 1];
2132         }
2133
2134         return 0;
2135 }
2136
2137 static void
2138 acx_dma_free(struct acx_softc *sc)
2139 {
2140         struct acx_ring_data *rd = &sc->sc_ring_data;
2141         struct acx_buf_data *bd = &sc->sc_buf_data;
2142         int i;
2143
2144         if (rd->rx_ring_dma_tag != NULL) {
2145                 bus_dmamap_unload(rd->rx_ring_dma_tag, rd->rx_ring_dmamap);
2146                 bus_dmamem_free(rd->rx_ring_dma_tag, rd->rx_ring,
2147                                 rd->rx_ring_dmamap);
2148                 bus_dma_tag_destroy(rd->rx_ring_dma_tag);
2149         }
2150
2151         if (rd->tx_ring_dma_tag != NULL) {
2152                 bus_dmamap_unload(rd->tx_ring_dma_tag, rd->tx_ring_dmamap);
2153                 bus_dmamem_free(rd->tx_ring_dma_tag, rd->tx_ring,
2154                                 rd->tx_ring_dmamap);
2155                 bus_dma_tag_destroy(rd->tx_ring_dma_tag);
2156         }
2157
2158         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2159                 if (bd->rx_buf[i].rb_desc != NULL) {
2160                         if (bd->rx_buf[i].rb_mbuf != NULL) {
2161                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2162                                                   bd->rx_buf[i].rb_mbuf_dmamap);
2163                                 m_freem(bd->rx_buf[i].rb_mbuf);
2164                         }
2165                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2166                                            bd->rx_buf[i].rb_mbuf_dmamap);
2167                 }
2168         }
2169
2170         for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
2171                 if (bd->tx_buf[i].tb_desc1 != NULL) {
2172                         if (bd->tx_buf[i].tb_mbuf != NULL) {
2173                                 bus_dmamap_unload(bd->mbuf_dma_tag,
2174                                                   bd->tx_buf[i].tb_mbuf_dmamap);
2175                                 m_freem(bd->tx_buf[i].tb_mbuf);
2176                         }
2177                         bus_dmamap_destroy(bd->mbuf_dma_tag,
2178                                            bd->tx_buf[i].tb_mbuf_dmamap);
2179                 }
2180         }
2181
2182         if (bd->mbuf_dma_tag != NULL) {
2183                 bus_dmamap_destroy(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap);
2184                 bus_dma_tag_destroy(bd->mbuf_dma_tag);
2185         }
2186 }
2187
2188 static int
2189 acx_init_tx_ring(struct acx_softc *sc)
2190 {
2191         struct acx_ring_data *rd;
2192         struct acx_buf_data *bd;
2193         uint32_t paddr;
2194         int i;
2195
2196         rd = &sc->sc_ring_data;
2197         paddr = rd->tx_ring_paddr;
2198         for (i = 0; i < (ACX_TX_DESC_CNT * 2) - 1; ++i) {
2199                 paddr += sizeof(struct acx_host_desc);
2200
2201                 rd->tx_ring[i].h_ctrl = htole16(DESC_CTRL_HOSTOWN);
2202
2203                 if (i == (ACX_TX_DESC_CNT * 2) - 1)
2204                         rd->tx_ring[i].h_next_desc = htole32(rd->tx_ring_paddr);
2205                 else
2206                         rd->tx_ring[i].h_next_desc = htole32(paddr);
2207         }
2208
2209         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2210                         BUS_DMASYNC_PREWRITE);
2211
2212         bd = &sc->sc_buf_data;
2213         bd->tx_free_start = 0;
2214         bd->tx_used_start = 0;
2215         bd->tx_used_count = 0;
2216
2217         return 0;
2218 }
2219
2220 static int
2221 acx_init_rx_ring(struct acx_softc *sc)
2222 {
2223         struct acx_ring_data *rd;
2224         struct acx_buf_data *bd;
2225         uint32_t paddr;
2226         int i;
2227
2228         bd = &sc->sc_buf_data;
2229         rd = &sc->sc_ring_data;
2230         paddr = rd->rx_ring_paddr;
2231
2232         for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
2233                 int error;
2234
2235                 paddr += sizeof(struct acx_host_desc);
2236
2237                 error = acx_newbuf(sc, &bd->rx_buf[i], 1);
2238                 if (error)
2239                         return error;
2240
2241                 if (i == ACX_RX_DESC_CNT - 1)
2242                         rd->rx_ring[i].h_next_desc = htole32(rd->rx_ring_paddr);
2243                 else
2244                         rd->rx_ring[i].h_next_desc = htole32(paddr);
2245         }
2246
2247         bus_dmamap_sync(rd->rx_ring_dma_tag, rd->rx_ring_dmamap,
2248                         BUS_DMASYNC_PREWRITE);
2249
2250         bd->rx_scan_start = 0;
2251         return 0;
2252 }
2253
2254 static void
2255 acx_buf_dma_addr(void *arg, bus_dma_segment_t *seg, int nseg,
2256                  bus_size_t mapsz, int error)
2257 {
2258         if (error)
2259                 return;
2260
2261         /* XXX */
2262         KASSERT(nseg == 1, ("too many RX dma segments\n"));
2263         *((uint32_t *)arg) = seg->ds_addr;
2264 }
2265
2266 static int
2267 acx_newbuf(struct acx_softc *sc, struct acx_rxbuf *rb, int wait)
2268 {
2269         struct acx_buf_data *bd;
2270         struct mbuf *m;
2271         bus_dmamap_t map;
2272         uint32_t paddr;
2273         int error;
2274
2275         bd = &sc->sc_buf_data;
2276
2277         m = m_getcl(wait ? MB_WAIT : MB_DONTWAIT, MT_DATA, M_PKTHDR);
2278         if (m == NULL)
2279                 return ENOBUFS;
2280
2281         m->m_len = m->m_pkthdr.len = MCLBYTES;
2282
2283         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, bd->mbuf_tmp_dmamap,
2284                                      m, acx_buf_dma_addr, &paddr,
2285                                      wait ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
2286         if (error) {
2287                 m_freem(m);
2288                 if_printf(&sc->sc_ic.ic_if, "can't map rx mbuf %d\n", error);
2289                 return error;
2290         }
2291
2292         /* Unload originally mapped mbuf */
2293         bus_dmamap_unload(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap);
2294
2295         /* Swap this dmamap with tmp dmamap */
2296         map = rb->rb_mbuf_dmamap;
2297         rb->rb_mbuf_dmamap = bd->mbuf_tmp_dmamap;
2298         bd->mbuf_tmp_dmamap = map;
2299
2300         rb->rb_mbuf = m;
2301         rb->rb_desc->h_data_paddr = htole32(paddr);
2302         rb->rb_desc->h_data_len = htole16(m->m_len);
2303
2304         bus_dmamap_sync(bd->mbuf_dma_tag, rb->rb_mbuf_dmamap,
2305                         BUS_DMASYNC_PREREAD);
2306         return 0;
2307 }
2308
2309 static int
2310 acx_encap(struct acx_softc *sc, struct acx_txbuf *txbuf, struct mbuf *m,
2311           struct ieee80211_node *ni)
2312 {
2313         struct acx_buf_data *bd = &sc->sc_buf_data;
2314         struct acx_ring_data *rd = &sc->sc_ring_data;
2315         uint32_t paddr;
2316         uint8_t ctrl;
2317         int error;
2318
2319         KASSERT(txbuf->tb_mbuf == NULL, ("free TX buf has mbuf installed\n"));
2320         error = 0;
2321
2322         if (m->m_pkthdr.len > MCLBYTES) {
2323                 if_printf(&sc->sc_ic.ic_if, "mbuf too big\n");
2324                 error = E2BIG;
2325                 goto back;
2326         } else if (m->m_pkthdr.len < ACX_FRAME_HDRLEN) {
2327                 if_printf(&sc->sc_ic.ic_if, "mbuf too small\n");
2328                 error = EINVAL;
2329                 goto back;
2330         }
2331
2332         error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2333                                      m, acx_buf_dma_addr, &paddr,
2334                                      BUS_DMA_NOWAIT);
2335         if (error && error != EFBIG) {
2336                 if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf1 %d\n", error);
2337                 goto back;
2338         }
2339
2340         if (error) {    /* error == EFBIG */
2341                 struct mbuf *m_new;
2342
2343                 m_new = m_defrag(m, MB_DONTWAIT);
2344                 if (m_new == NULL) {
2345                         if_printf(&sc->sc_ic.ic_if, "can't defrag tx mbuf\n");
2346                         error = ENOBUFS;
2347                         goto back;
2348                 } else {
2349                         m = m_new;
2350                 }
2351
2352                 error = bus_dmamap_load_mbuf(bd->mbuf_dma_tag,
2353                                              txbuf->tb_mbuf_dmamap, m,
2354                                              acx_buf_dma_addr, &paddr,
2355                                              BUS_DMA_NOWAIT);
2356                 if (error) {
2357                         if_printf(&sc->sc_ic.ic_if, "can't map tx mbuf2 %d\n",
2358                                   error);
2359                         goto back;
2360                 }
2361         }
2362
2363         error = 0;
2364
2365         bus_dmamap_sync(bd->mbuf_dma_tag, txbuf->tb_mbuf_dmamap,
2366                         BUS_DMASYNC_PREWRITE);
2367
2368         txbuf->tb_mbuf = m;
2369         txbuf->tb_node = ni;
2370
2371         /*
2372          * TX buffers are accessed in following way:
2373          * acx_fw_txdesc -> acx_host_desc -> buffer
2374          *
2375          * It is quite strange that acx also querys acx_host_desc next to
2376          * the one we have assigned to acx_fw_txdesc even if first one's
2377          * acx_host_desc.h_data_len == acx_fw_txdesc.f_tx_len
2378          *
2379          * So we allocate two acx_host_desc for one acx_fw_txdesc and
2380          * assign the first acx_host_desc to acx_fw_txdesc
2381          *
2382          * For acx111
2383          * host_desc1.h_data_len = buffer_len
2384          * host_desc2.h_data_len = buffer_len - mac_header_len
2385          *
2386          * For acx100
2387          * host_desc1.h_data_len = mac_header_len
2388          * host_desc2.h_data_len = buffer_len - mac_header_len
2389          */
2390
2391         txbuf->tb_desc1->h_data_paddr = htole32(paddr);
2392         txbuf->tb_desc2->h_data_paddr = htole32(paddr + ACX_FRAME_HDRLEN);
2393
2394         txbuf->tb_desc1->h_data_len =
2395                 htole16(sc->chip_txdesc1_len ? sc->chip_txdesc1_len
2396                                              : m->m_pkthdr.len);
2397         txbuf->tb_desc2->h_data_len =
2398                 htole16(m->m_pkthdr.len - ACX_FRAME_HDRLEN);
2399
2400         /*
2401          * NOTE:
2402          * We can't simply assign f_tx_ctrl, we will first read it back
2403          * and change it bit by bit
2404          */
2405         ctrl = FW_TXDESC_GETFIELD_1(sc, txbuf, f_tx_ctrl);
2406         ctrl |= sc->chip_fw_txdesc_ctrl; /* extra chip specific flags */
2407         ctrl &= ~(DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE);
2408
2409         FW_TXDESC_SETFIELD_4(sc, txbuf, f_tx_len, m->m_pkthdr.len);
2410         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_error, 0);
2411         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_data_nretry, 0);
2412         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_nretry, 0);
2413         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_ok, 0);
2414         sc->chip_set_fw_txdesc_rate(sc, txbuf, ni, m->m_pkthdr.len);
2415
2416         txbuf->tb_desc1->h_ctrl = 0;
2417         txbuf->tb_desc2->h_ctrl = 0;
2418         bus_dmamap_sync(rd->tx_ring_dma_tag, rd->tx_ring_dmamap,
2419                         BUS_DMASYNC_PREWRITE);
2420
2421         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl2, 0);
2422         FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl, ctrl);
2423
2424         /* Tell chip to inform us about TX completion */
2425         CSR_WRITE_2(sc, ACXREG_INTR_TRIG, ACXRV_TRIG_TX_FINI);
2426 back:
2427         if (error)
2428                 m_freem(m);
2429         return error;
2430 }
2431
2432 static int
2433 acx_set_null_tmplt(struct acx_softc *sc)
2434 {
2435         struct acx_tmplt_null_data n;
2436         struct ieee80211_frame *f;
2437
2438         bzero(&n, sizeof(n));
2439
2440         f = &n.data;
2441         f->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA |
2442                      IEEE80211_FC0_SUBTYPE_NODATA;
2443         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2444         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2445         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2446
2447         return _acx_set_null_data_tmplt(sc, &n, sizeof(n));
2448 }
2449
2450 static int
2451 acx_set_probe_req_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len)
2452 {
2453         struct acx_tmplt_probe_req req;
2454         struct ieee80211_frame *f;
2455         uint8_t *v;
2456         int vlen;
2457
2458         bzero(&req, sizeof(req));
2459
2460         f = &req.data.u_data.f;
2461         f->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2462                      IEEE80211_FC0_SUBTYPE_PROBE_REQ;
2463         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2464         IEEE80211_ADDR_COPY(f->i_addr2, IF_LLADDR(&sc->sc_ic.ic_if));
2465         IEEE80211_ADDR_COPY(f->i_addr3, etherbroadcastaddr);
2466
2467         v = req.data.u_data.var;
2468         v = ieee80211_add_ssid(v, ssid, ssid_len);
2469         v = ieee80211_add_rates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2470         v = ieee80211_add_xrates(v, &sc->sc_ic.ic_sup_rates[sc->chip_phymode]);
2471         vlen = v - req.data.u_data.var;
2472
2473         return _acx_set_probe_req_tmplt(sc, &req,
2474                                         ACX_TMPLT_PROBE_REQ_SIZ(vlen));
2475 }
2476
2477 static int
2478 acx_set_probe_resp_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2479 {
2480         struct ieee80211com *ic = &sc->sc_ic;
2481         struct acx_tmplt_probe_resp resp;
2482         struct ieee80211_frame *f;
2483         struct mbuf *m;
2484         int len;
2485
2486         m = ieee80211_probe_resp_alloc(ic, ni);
2487         if (m == NULL)
2488                 return 1;
2489         DPRINTF((&ic->ic_if, "%s alloc probe resp size %d\n", __func__,
2490                  m->m_pkthdr.len));
2491
2492         f = mtod(m, struct ieee80211_frame *);
2493         IEEE80211_ADDR_COPY(f->i_addr1, etherbroadcastaddr);
2494
2495         bzero(&resp, sizeof(resp));
2496         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&resp.data);
2497         len = m->m_pkthdr.len + sizeof(resp.size);
2498         m_freem(m);
2499
2500         return _acx_set_probe_resp_tmplt(sc, &resp, len);
2501 }
2502
2503 static int
2504 acx_set_beacon_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
2505 {
2506         struct ieee80211com *ic = &sc->sc_ic;
2507         struct acx_tmplt_beacon beacon;
2508         struct ieee80211_beacon_offsets bo;
2509         struct mbuf *m;
2510         int len;
2511
2512         bzero(&bo, sizeof(bo));
2513         m = ieee80211_beacon_alloc(ic, ni, &bo);
2514         if (m == NULL)
2515                 return 1;
2516         DPRINTF((&ic->ic_if, "%s alloc beacon size %d\n", __func__,
2517                  m->m_pkthdr.len));
2518
2519         bzero(&beacon, sizeof(beacon));
2520         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&beacon.data);
2521         len = m->m_pkthdr.len + sizeof(beacon.size);
2522         m_freem(m);
2523
2524         return _acx_set_beacon_tmplt(sc, &beacon, len);
2525 }
2526
2527 static int
2528 acx_sysctl_msdu_lifetime(SYSCTL_HANDLER_ARGS)
2529 {
2530         struct acx_softc *sc = arg1;
2531         struct ifnet *ifp = &sc->sc_ic.ic_if;
2532         int error = 0, v;
2533
2534         lwkt_serialize_enter(ifp->if_serializer);
2535
2536         v = sc->sc_msdu_lifetime;
2537         error = sysctl_handle_int(oidp, &v, 0, req);
2538         if (error || req->newptr == NULL)
2539                 goto back;
2540         if (v <= 0) {
2541                 error = EINVAL;
2542                 goto back;
2543         }
2544
2545         if (sc->sc_flags & ACX_FLAG_FW_LOADED) {
2546                 struct acx_conf_msdu_lifetime msdu_lifetime;
2547
2548                 msdu_lifetime.lifetime = htole32(v);
2549                 if (acx_set_msdu_lifetime_conf(sc, &msdu_lifetime) != 0) {
2550                         if_printf(&sc->sc_ic.ic_if,
2551                                   "can't set MSDU lifetime\n");
2552                         error = ENXIO;
2553                         goto back;
2554                 }
2555         }
2556         sc->sc_msdu_lifetime = v;
2557 back:
2558         lwkt_serialize_exit(ifp->if_serializer);
2559         return error;
2560 }
2561
2562 static int
2563 acx_media_change(struct ifnet *ifp)
2564 {
2565         int error;
2566
2567         error = ieee80211_media_change(ifp);
2568         if (error != ENETRESET)
2569                 return error;
2570
2571         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
2572                 acx_init(ifp->if_softc);
2573         return 0;
2574 }
2575
2576 static int
2577 acx_rx_config(struct acx_softc *sc, int promisc)
2578 {
2579         struct acx_conf_rxopt rx_opt;
2580         struct ieee80211com *ic = &sc->sc_ic;
2581
2582         /*
2583          * What we want to receive and how to receive
2584          */
2585
2586         /* Common for all operational modes */
2587         rx_opt.opt1 = RXOPT1_INCL_RXBUF_HDR;
2588         rx_opt.opt2 = RXOPT2_RECV_ASSOC_REQ |
2589                       RXOPT2_RECV_AUTH |
2590                       RXOPT2_RECV_BEACON |
2591                       RXOPT2_RECV_CF |
2592                       RXOPT2_RECV_CTRL |
2593                       RXOPT2_RECV_DATA |
2594                       RXOPT2_RECV_MGMT |
2595                       RXOPT2_RECV_PROBE_REQ |
2596                       RXOPT2_RECV_PROBE_RESP |
2597                       RXOPT2_RECV_OTHER;
2598
2599         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2600                 rx_opt.opt1 |= RXOPT1_PROMISC;
2601                 rx_opt.opt2 |= RXOPT2_RECV_BROKEN | RXOPT2_RECV_ACK;
2602         } else {
2603                 rx_opt.opt1 |= promisc ? RXOPT1_PROMISC : RXOPT1_FILT_FDEST;
2604         }
2605
2606         if (acx_set_rxopt_conf(sc, &rx_opt) != 0) {
2607                 if_printf(&sc->sc_ic.ic_if, "can't config RX\n");
2608                 return ENXIO;
2609         }
2610         return 0;
2611 }