if_wpi.c revision 1.84 
1/*	$NetBSD: if_wpi.c,v 1.84 2018/12/09 11:14:02 jdolecek Exp $	*/
2
3/*-
4 * Copyright (c) 2006, 2007
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__KERNEL_RCSID(0, "$NetBSD: if_wpi.c,v 1.84 2018/12/09 11:14:02 jdolecek Exp $");
22
23/*
24 * Driver for Intel PRO/Wireless 3945ABG 802.11 network adapters.
25 */
26
27
28#include <sys/param.h>
29#include <sys/sockio.h>
30#include <sys/sysctl.h>
31#include <sys/mbuf.h>
32#include <sys/kernel.h>
33#include <sys/socket.h>
34#include <sys/systm.h>
35#include <sys/malloc.h>
36#include <sys/mutex.h>
37#include <sys/once.h>
38#include <sys/conf.h>
39#include <sys/kauth.h>
40#include <sys/callout.h>
41#include <sys/proc.h>
42#include <sys/kthread.h>
43
44#include <sys/bus.h>
45#include <machine/endian.h>
46#include <sys/intr.h>
47
48#include <dev/pci/pcireg.h>
49#include <dev/pci/pcivar.h>
50#include <dev/pci/pcidevs.h>
51
52#include <dev/sysmon/sysmonvar.h>
53
54#include <net/bpf.h>
55#include <net/if.h>
56#include <net/if_arp.h>
57#include <net/if_dl.h>
58#include <net/if_ether.h>
59#include <net/if_media.h>
60#include <net/if_types.h>
61
62#include <netinet/in.h>
63#include <netinet/in_systm.h>
64#include <netinet/in_var.h>
65#include <netinet/ip.h>
66
67#include <net80211/ieee80211_var.h>
68#include <net80211/ieee80211_amrr.h>
69#include <net80211/ieee80211_radiotap.h>
70
71#include <dev/firmload.h>
72
73#include <dev/pci/if_wpireg.h>
74#include <dev/pci/if_wpivar.h>
75
76static const char wpi_firmware_name[] = "iwlwifi-3945.ucode";
77static once_t wpi_firmware_init;
78static kmutex_t wpi_firmware_mutex;
79static size_t wpi_firmware_users;
80static uint8_t *wpi_firmware_image;
81static size_t wpi_firmware_size;
82
83static int	wpi_match(device_t, cfdata_t, void *);
84static void	wpi_attach(device_t, device_t, void *);
85static int	wpi_detach(device_t , int);
86static int	wpi_dma_contig_alloc(bus_dma_tag_t, struct wpi_dma_info *,
87		    void **, bus_size_t, bus_size_t, int);
88static void	wpi_dma_contig_free(struct wpi_dma_info *);
89static int	wpi_alloc_shared(struct wpi_softc *);
90static void	wpi_free_shared(struct wpi_softc *);
91static int	wpi_alloc_fwmem(struct wpi_softc *);
92static void	wpi_free_fwmem(struct wpi_softc *);
93static struct	wpi_rbuf *wpi_alloc_rbuf(struct wpi_softc *);
94static void	wpi_free_rbuf(struct mbuf *, void *, size_t, void *);
95static int	wpi_alloc_rpool(struct wpi_softc *);
96static void	wpi_free_rpool(struct wpi_softc *);
97static int	wpi_alloc_rx_ring(struct wpi_softc *, struct wpi_rx_ring *);
98static void	wpi_reset_rx_ring(struct wpi_softc *, struct wpi_rx_ring *);
99static void	wpi_free_rx_ring(struct wpi_softc *, struct wpi_rx_ring *);
100static int	wpi_alloc_tx_ring(struct wpi_softc *, struct wpi_tx_ring *,
101		    int, int);
102static void	wpi_reset_tx_ring(struct wpi_softc *, struct wpi_tx_ring *);
103static void	wpi_free_tx_ring(struct wpi_softc *, struct wpi_tx_ring *);
104static struct	ieee80211_node * wpi_node_alloc(struct ieee80211_node_table *);
105static void	wpi_newassoc(struct ieee80211_node *, int);
106static int	wpi_media_change(struct ifnet *);
107static int	wpi_newstate(struct ieee80211com *, enum ieee80211_state, int);
108static void	wpi_mem_lock(struct wpi_softc *);
109static void	wpi_mem_unlock(struct wpi_softc *);
110static uint32_t	wpi_mem_read(struct wpi_softc *, uint16_t);
111static void	wpi_mem_write(struct wpi_softc *, uint16_t, uint32_t);
112static void	wpi_mem_write_region_4(struct wpi_softc *, uint16_t,
113		    const uint32_t *, int);
114static int	wpi_read_prom_data(struct wpi_softc *, uint32_t, void *, int);
115static int	wpi_load_microcode(struct wpi_softc *,  const uint8_t *, int);
116static int	wpi_cache_firmware(struct wpi_softc *);
117static void	wpi_release_firmware(void);
118static int	wpi_load_firmware(struct wpi_softc *);
119static void	wpi_calib_timeout(void *);
120static void	wpi_iter_func(void *, struct ieee80211_node *);
121static void	wpi_power_calibration(struct wpi_softc *, int);
122static void	wpi_rx_intr(struct wpi_softc *, struct wpi_rx_desc *,
123		    struct wpi_rx_data *);
124static void	wpi_tx_intr(struct wpi_softc *, struct wpi_rx_desc *);
125static void	wpi_cmd_intr(struct wpi_softc *, struct wpi_rx_desc *);
126static void	wpi_notif_intr(struct wpi_softc *);
127static int	wpi_intr(void *);
128static void	wpi_softintr(void *);
129static void	wpi_read_eeprom(struct wpi_softc *);
130static void	wpi_read_eeprom_channels(struct wpi_softc *, int);
131static void	wpi_read_eeprom_group(struct wpi_softc *, int);
132static uint8_t	wpi_plcp_signal(int);
133static int	wpi_tx_data(struct wpi_softc *, struct mbuf *,
134		    struct ieee80211_node *, int);
135static void	wpi_start(struct ifnet *);
136static void	wpi_watchdog(struct ifnet *);
137static int	wpi_ioctl(struct ifnet *, u_long, void *);
138static int	wpi_cmd(struct wpi_softc *, int, const void *, int, int);
139static int	wpi_wme_update(struct ieee80211com *);
140static int	wpi_mrr_setup(struct wpi_softc *);
141static void	wpi_set_led(struct wpi_softc *, uint8_t, uint8_t, uint8_t);
142static void	wpi_enable_tsf(struct wpi_softc *, struct ieee80211_node *);
143static int	wpi_set_txpower(struct wpi_softc *,
144		    struct ieee80211_channel *, int);
145static int	wpi_get_power_index(struct wpi_softc *,
146		    struct wpi_power_group *, struct ieee80211_channel *, int);
147static int	wpi_setup_beacon(struct wpi_softc *, struct ieee80211_node *);
148static int	wpi_auth(struct wpi_softc *);
149static int	wpi_scan(struct wpi_softc *);
150static int	wpi_config(struct wpi_softc *);
151static void	wpi_stop_master(struct wpi_softc *);
152static int	wpi_power_up(struct wpi_softc *);
153static int	wpi_reset(struct wpi_softc *);
154static void	wpi_hw_config(struct wpi_softc *);
155static int	wpi_init(struct ifnet *);
156static void	wpi_stop(struct ifnet *, int);
157static bool	wpi_resume(device_t, const pmf_qual_t *);
158static int	wpi_getrfkill(struct wpi_softc *);
159static void	wpi_sysctlattach(struct wpi_softc *);
160static void	wpi_rsw_thread(void *);
161
162#ifdef WPI_DEBUG
163#define DPRINTF(x)	do { if (wpi_debug > 0) printf x; } while (0)
164#define DPRINTFN(n, x)	do { if (wpi_debug >= (n)) printf x; } while (0)
165int wpi_debug = 1;
166#else
167#define DPRINTF(x)
168#define DPRINTFN(n, x)
169#endif
170
171CFATTACH_DECL_NEW(wpi, sizeof (struct wpi_softc), wpi_match, wpi_attach,
172	wpi_detach, NULL);
173
174static int
175wpi_match(device_t parent, cfdata_t match __unused, void *aux)
176{
177	struct pci_attach_args *pa = aux;
178
179	if (PCI_VENDOR(pa->pa_id) != PCI_VENDOR_INTEL)
180		return 0;
181
182	if (PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_3945ABG_1 ||
183	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_3945ABG_2)
184		return 1;
185
186	return 0;
187}
188
189/* Base Address Register */
190#define WPI_PCI_BAR0	0x10
191
192static int
193wpi_attach_once(void)
194{
195
196	mutex_init(&wpi_firmware_mutex, MUTEX_DEFAULT, IPL_NONE);
197	return 0;
198}
199
200static void
201wpi_attach(device_t parent __unused, device_t self, void *aux)
202{
203	struct wpi_softc *sc = device_private(self);
204	struct ieee80211com *ic = &sc->sc_ic;
205	struct ifnet *ifp = &sc->sc_ec.ec_if;
206	struct pci_attach_args *pa = aux;
207	const char *intrstr;
208	bus_space_tag_t memt;
209	bus_space_handle_t memh;
210	pcireg_t data;
211	int ac, error;
212	char intrbuf[PCI_INTRSTR_LEN];
213
214	RUN_ONCE(&wpi_firmware_init, wpi_attach_once);
215	sc->fw_used = false;
216
217	sc->sc_dev = self;
218	sc->sc_pct = pa->pa_pc;
219	sc->sc_pcitag = pa->pa_tag;
220
221	sc->sc_rsw_status = WPI_RSW_UNKNOWN;
222	sc->sc_rsw.smpsw_name = device_xname(self);
223	sc->sc_rsw.smpsw_type = PSWITCH_TYPE_RADIO;
224	error = sysmon_pswitch_register(&sc->sc_rsw);
225	if (error) {
226		aprint_error_dev(self,
227		    "unable to register radio switch with sysmon\n");
228		return;
229	}
230	mutex_init(&sc->sc_rsw_mtx, MUTEX_DEFAULT, IPL_NONE);
231	cv_init(&sc->sc_rsw_cv, "wpirsw");
232	sc->sc_rsw_suspend = false;
233	sc->sc_rsw_suspended = false;
234	if (kthread_create(PRI_NONE, 0, NULL,
235	    wpi_rsw_thread, sc, &sc->sc_rsw_lwp, "%s", device_xname(self))) {
236		aprint_error_dev(self, "couldn't create switch thread\n");
237	}
238
239	callout_init(&sc->calib_to, 0);
240	callout_setfunc(&sc->calib_to, wpi_calib_timeout, sc);
241
242	pci_aprint_devinfo(pa, NULL);
243
244	/* enable bus-mastering */
245	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG);
246	data |= PCI_COMMAND_MASTER_ENABLE;
247	pci_conf_write(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG, data);
248
249	/* map the register window */
250	error = pci_mapreg_map(pa, WPI_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
251	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, NULL, &sc->sc_sz);
252	if (error != 0) {
253		aprint_error_dev(self, "could not map memory space\n");
254		return;
255	}
256
257	sc->sc_st = memt;
258	sc->sc_sh = memh;
259	sc->sc_dmat = pa->pa_dmat;
260
261	sc->sc_soft_ih = softint_establish(SOFTINT_NET, wpi_softintr, sc);
262	if (sc->sc_soft_ih == NULL) {
263		aprint_error_dev(self, "could not establish softint\n");
264		goto unmap;
265	}
266
267	if (pci_intr_alloc(pa, &sc->sc_pihp, NULL, 0)) {
268		aprint_error_dev(self, "could not map interrupt\n");
269		goto failsi;
270	}
271
272	intrstr = pci_intr_string(sc->sc_pct, sc->sc_pihp[0], intrbuf,
273	    sizeof(intrbuf));
274	sc->sc_ih = pci_intr_establish_xname(sc->sc_pct, sc->sc_pihp[0],
275	    IPL_NET, wpi_intr, sc, device_xname(self));
276	if (sc->sc_ih == NULL) {
277		aprint_error_dev(self, "could not establish interrupt");
278		if (intrstr != NULL)
279			aprint_error(" at %s", intrstr);
280		aprint_error("\n");
281		goto failia;
282	}
283	aprint_normal_dev(self, "interrupting at %s\n", intrstr);
284
285	/*
286	 * Put adapter into a known state.
287	 */
288	if ((error = wpi_reset(sc)) != 0) {
289		aprint_error_dev(self, "could not reset adapter\n");
290		goto failih;
291	}
292
293	/*
294	 * Allocate DMA memory for firmware transfers.
295	 */
296	if ((error = wpi_alloc_fwmem(sc)) != 0) {
297		aprint_error_dev(self, "could not allocate firmware memory\n");
298		goto failih;
299	}
300
301	/*
302	 * Allocate shared page and Tx/Rx rings.
303	 */
304	if ((error = wpi_alloc_shared(sc)) != 0) {
305		aprint_error_dev(self, "could not allocate shared area\n");
306		goto fail1;
307	}
308
309	if ((error = wpi_alloc_rpool(sc)) != 0) {
310		aprint_error_dev(self, "could not allocate Rx buffers\n");
311		goto fail2;
312	}
313
314	for (ac = 0; ac < 4; ac++) {
315		error = wpi_alloc_tx_ring(sc, &sc->txq[ac], WPI_TX_RING_COUNT,
316		    ac);
317		if (error != 0) {
318			aprint_error_dev(self,
319			    "could not allocate Tx ring %d\n", ac);
320			goto fail3;
321		}
322	}
323
324	error = wpi_alloc_tx_ring(sc, &sc->cmdq, WPI_CMD_RING_COUNT, 4);
325	if (error != 0) {
326		aprint_error_dev(self, "could not allocate command ring\n");
327		goto fail3;
328	}
329
330	error = wpi_alloc_rx_ring(sc, &sc->rxq);
331	if (error != 0) {
332		aprint_error_dev(self, "could not allocate Rx ring\n");
333		goto fail4;
334	}
335
336	ic->ic_ifp = ifp;
337	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
338	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
339	ic->ic_state = IEEE80211_S_INIT;
340
341	/* set device capabilities */
342	ic->ic_caps =
343	    IEEE80211_C_WPA |		/* 802.11i */
344	    IEEE80211_C_MONITOR |	/* monitor mode supported */
345	    IEEE80211_C_TXPMGT |	/* tx power management */
346	    IEEE80211_C_SHSLOT |	/* short slot time supported */
347	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
348	    IEEE80211_C_WME;		/* 802.11e */
349
350	/* read supported channels and MAC address from EEPROM */
351	wpi_read_eeprom(sc);
352
353	/* set supported .11a, .11b and .11g rates */
354	ic->ic_sup_rates[IEEE80211_MODE_11A] = ieee80211_std_rateset_11a;
355	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
356	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
357
358	/* IBSS channel undefined for now */
359	ic->ic_ibss_chan = &ic->ic_channels[0];
360
361	ifp->if_softc = sc;
362	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
363	ifp->if_init = wpi_init;
364	ifp->if_stop = wpi_stop;
365	ifp->if_ioctl = wpi_ioctl;
366	ifp->if_start = wpi_start;
367	ifp->if_watchdog = wpi_watchdog;
368	IFQ_SET_READY(&ifp->if_snd);
369	memcpy(ifp->if_xname, device_xname(self), IFNAMSIZ);
370
371	error = if_initialize(ifp);
372	if (error != 0) {
373		aprint_error_dev(sc->sc_dev, "if_initialize failed(%d)\n",
374		    error);
375		goto fail5;
376	}
377	ieee80211_ifattach(ic);
378	/* Use common softint-based if_input */
379	ifp->if_percpuq = if_percpuq_create(ifp);
380	if_register(ifp);
381
382	/* override default methods */
383	ic->ic_node_alloc = wpi_node_alloc;
384	ic->ic_newassoc = wpi_newassoc;
385	ic->ic_wme.wme_update = wpi_wme_update;
386
387	/* override state transition machine */
388	sc->sc_newstate = ic->ic_newstate;
389	ic->ic_newstate = wpi_newstate;
390	ieee80211_media_init(ic, wpi_media_change, ieee80211_media_status);
391
392	sc->amrr.amrr_min_success_threshold =  1;
393	sc->amrr.amrr_max_success_threshold = 15;
394
395	wpi_sysctlattach(sc);
396
397	if (pmf_device_register(self, NULL, wpi_resume))
398		pmf_class_network_register(self, ifp);
399	else
400		aprint_error_dev(self, "couldn't establish power handler\n");
401
402	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
403	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
404	    &sc->sc_drvbpf);
405
406	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
407	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
408	sc->sc_rxtap.wr_ihdr.it_present = htole32(WPI_RX_RADIOTAP_PRESENT);
409
410	sc->sc_txtap_len = sizeof sc->sc_txtapu;
411	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
412	sc->sc_txtap.wt_ihdr.it_present = htole32(WPI_TX_RADIOTAP_PRESENT);
413
414	ieee80211_announce(ic);
415
416	return;
417
418	/* free allocated memory if something failed during attachment */
419fail5:	wpi_free_rx_ring(sc, &sc->rxq);
420fail4:	wpi_free_tx_ring(sc, &sc->cmdq);
421fail3:	while (--ac >= 0)
422		wpi_free_tx_ring(sc, &sc->txq[ac]);
423	wpi_free_rpool(sc);
424fail2:	wpi_free_shared(sc);
425fail1:	wpi_free_fwmem(sc);
426failih:	pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
427	sc->sc_ih = NULL;
428failia:	pci_intr_release(sc->sc_pct, sc->sc_pihp, 1);
429	sc->sc_pihp = NULL;
430failsi:	softint_disestablish(sc->sc_soft_ih);
431	sc->sc_soft_ih = NULL;
432unmap:	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
433}
434
435static int
436wpi_detach(device_t self, int flags __unused)
437{
438	struct wpi_softc *sc = device_private(self);
439	struct ifnet *ifp = sc->sc_ic.ic_ifp;
440	int ac;
441
442	wpi_stop(ifp, 1);
443
444	if (ifp != NULL)
445		bpf_detach(ifp);
446	ieee80211_ifdetach(&sc->sc_ic);
447	if (ifp != NULL)
448		if_detach(ifp);
449
450	for (ac = 0; ac < 4; ac++)
451		wpi_free_tx_ring(sc, &sc->txq[ac]);
452	wpi_free_tx_ring(sc, &sc->cmdq);
453	wpi_free_rx_ring(sc, &sc->rxq);
454	wpi_free_rpool(sc);
455	wpi_free_shared(sc);
456
457	if (sc->sc_ih != NULL) {
458		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
459		sc->sc_ih = NULL;
460	}
461	if (sc->sc_pihp != NULL) {
462		pci_intr_release(sc->sc_pct, sc->sc_pihp, 1);
463		sc->sc_pihp = NULL;
464	}
465	if (sc->sc_soft_ih != NULL) {
466		softint_disestablish(sc->sc_soft_ih);
467		sc->sc_soft_ih = NULL;
468	}
469
470	mutex_enter(&sc->sc_rsw_mtx);
471	sc->sc_dying = 1;
472	cv_signal(&sc->sc_rsw_cv);
473	while (sc->sc_rsw_lwp != NULL)
474		cv_wait(&sc->sc_rsw_cv, &sc->sc_rsw_mtx);
475	mutex_exit(&sc->sc_rsw_mtx);
476	sysmon_pswitch_unregister(&sc->sc_rsw);
477
478	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
479
480	if (sc->fw_used) {
481		sc->fw_used = false;
482		wpi_release_firmware();
483	}
484	cv_destroy(&sc->sc_rsw_cv);
485	mutex_destroy(&sc->sc_rsw_mtx);
486	return 0;
487}
488
489static int
490wpi_dma_contig_alloc(bus_dma_tag_t tag, struct wpi_dma_info *dma, void **kvap,
491    bus_size_t size, bus_size_t alignment, int flags)
492{
493	int nsegs, error;
494
495	dma->tag = tag;
496	dma->size = size;
497
498	error = bus_dmamap_create(tag, size, 1, size, 0, flags, &dma->map);
499	if (error != 0)
500		goto fail;
501
502	error = bus_dmamem_alloc(tag, size, alignment, 0, &dma->seg, 1, &nsegs,
503	    flags);
504	if (error != 0)
505		goto fail;
506
507	error = bus_dmamem_map(tag, &dma->seg, 1, size, &dma->vaddr, flags);
508	if (error != 0)
509		goto fail;
510
511	error = bus_dmamap_load(tag, dma->map, dma->vaddr, size, NULL, flags);
512	if (error != 0)
513		goto fail;
514
515	memset(dma->vaddr, 0, size);
516	bus_dmamap_sync(dma->tag, dma->map, 0, size, BUS_DMASYNC_PREWRITE);
517
518	dma->paddr = dma->map->dm_segs[0].ds_addr;
519	if (kvap != NULL)
520		*kvap = dma->vaddr;
521
522	return 0;
523
524fail:	wpi_dma_contig_free(dma);
525	return error;
526}
527
528static void
529wpi_dma_contig_free(struct wpi_dma_info *dma)
530{
531	if (dma->map != NULL) {
532		if (dma->vaddr != NULL) {
533			bus_dmamap_unload(dma->tag, dma->map);
534			bus_dmamem_unmap(dma->tag, dma->vaddr, dma->size);
535			bus_dmamem_free(dma->tag, &dma->seg, 1);
536			dma->vaddr = NULL;
537		}
538		bus_dmamap_destroy(dma->tag, dma->map);
539		dma->map = NULL;
540	}
541}
542
543/*
544 * Allocate a shared page between host and NIC.
545 */
546static int
547wpi_alloc_shared(struct wpi_softc *sc)
548{
549	int error;
550
551	/* must be aligned on a 4K-page boundary */
552	error = wpi_dma_contig_alloc(sc->sc_dmat, &sc->shared_dma,
553	    (void **)&sc->shared, sizeof (struct wpi_shared), WPI_BUF_ALIGN,
554	    BUS_DMA_NOWAIT);
555	if (error != 0)
556		aprint_error_dev(sc->sc_dev,
557		    "could not allocate shared area DMA memory\n");
558
559	return error;
560}
561
562static void
563wpi_free_shared(struct wpi_softc *sc)
564{
565	wpi_dma_contig_free(&sc->shared_dma);
566}
567
568/*
569 * Allocate DMA-safe memory for firmware transfer.
570 */
571static int
572wpi_alloc_fwmem(struct wpi_softc *sc)
573{
574	int error;
575
576	/* allocate enough contiguous space to store text and data */
577	error = wpi_dma_contig_alloc(sc->sc_dmat, &sc->fw_dma, NULL,
578	    WPI_FW_MAIN_TEXT_MAXSZ + WPI_FW_MAIN_DATA_MAXSZ, 0,
579	    BUS_DMA_NOWAIT);
580
581	if (error != 0)
582		aprint_error_dev(sc->sc_dev,
583		    "could not allocate firmware transfer area DMA memory\n");
584	return error;
585}
586
587static void
588wpi_free_fwmem(struct wpi_softc *sc)
589{
590	wpi_dma_contig_free(&sc->fw_dma);
591}
592
593static struct wpi_rbuf *
594wpi_alloc_rbuf(struct wpi_softc *sc)
595{
596	struct wpi_rbuf *rbuf;
597
598	mutex_enter(&sc->rxq.freelist_mtx);
599	rbuf = SLIST_FIRST(&sc->rxq.freelist);
600	if (rbuf != NULL) {
601		SLIST_REMOVE_HEAD(&sc->rxq.freelist, next);
602	}
603	mutex_exit(&sc->rxq.freelist_mtx);
604
605	return rbuf;
606}
607
608/*
609 * This is called automatically by the network stack when the mbuf to which our
610 * Rx buffer is attached is freed.
611 */
612static void
613wpi_free_rbuf(struct mbuf* m, void *buf, size_t size, void *arg)
614{
615	struct wpi_rbuf *rbuf = arg;
616	struct wpi_softc *sc = rbuf->sc;
617
618	/* put the buffer back in the free list */
619
620	mutex_enter(&sc->rxq.freelist_mtx);
621	SLIST_INSERT_HEAD(&sc->rxq.freelist, rbuf, next);
622	mutex_exit(&sc->rxq.freelist_mtx);
623
624	if (__predict_true(m != NULL))
625		pool_cache_put(mb_cache, m);
626}
627
628static int
629wpi_alloc_rpool(struct wpi_softc *sc)
630{
631	struct wpi_rx_ring *ring = &sc->rxq;
632	int i, error;
633
634	/* allocate a big chunk of DMA'able memory.. */
635	error = wpi_dma_contig_alloc(sc->sc_dmat, &ring->buf_dma, NULL,
636	    WPI_RBUF_COUNT * WPI_RBUF_SIZE, WPI_BUF_ALIGN, BUS_DMA_NOWAIT);
637	if (error != 0) {
638		aprint_normal_dev(sc->sc_dev,
639		    "could not allocate Rx buffers DMA memory\n");
640		return error;
641	}
642
643	/* ..and split it into 3KB chunks */
644	mutex_init(&ring->freelist_mtx, MUTEX_DEFAULT, IPL_NET);
645	SLIST_INIT(&ring->freelist);
646	for (i = 0; i < WPI_RBUF_COUNT; i++) {
647		struct wpi_rbuf *rbuf = &ring->rbuf[i];
648
649		rbuf->sc = sc;	/* backpointer for callbacks */
650		rbuf->vaddr = (char *)ring->buf_dma.vaddr + i * WPI_RBUF_SIZE;
651		rbuf->paddr = ring->buf_dma.paddr + i * WPI_RBUF_SIZE;
652
653		SLIST_INSERT_HEAD(&ring->freelist, rbuf, next);
654	}
655
656	return 0;
657}
658
659static void
660wpi_free_rpool(struct wpi_softc *sc)
661{
662	mutex_destroy(&sc->rxq.freelist_mtx);
663	wpi_dma_contig_free(&sc->rxq.buf_dma);
664}
665
666static int
667wpi_alloc_rx_ring(struct wpi_softc *sc, struct wpi_rx_ring *ring)
668{
669	bus_size_t size;
670	int i, error;
671
672	ring->cur = 0;
673
674	size = WPI_RX_RING_COUNT * sizeof (uint32_t);
675	error = wpi_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma,
676	    (void **)&ring->desc, size,
677	    WPI_RING_DMA_ALIGN, BUS_DMA_NOWAIT);
678	if (error != 0) {
679		aprint_error_dev(sc->sc_dev,
680		    "could not allocate rx ring DMA memory\n");
681		goto fail;
682	}
683
684	/*
685	 * Setup Rx buffers.
686	 */
687	for (i = 0; i < WPI_RX_RING_COUNT; i++) {
688		struct wpi_rx_data *data = &ring->data[i];
689		struct wpi_rbuf *rbuf;
690
691		error = bus_dmamap_create(sc->sc_dmat, WPI_RBUF_SIZE, 1,
692		    WPI_RBUF_SIZE, 0, BUS_DMA_NOWAIT, &data->map);
693		if (error) {
694			aprint_error_dev(sc->sc_dev,
695			    "could not allocate rx dma map\n");
696			goto fail;
697		}
698
699		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
700		if (data->m == NULL) {
701			aprint_error_dev(sc->sc_dev,
702			    "could not allocate rx mbuf\n");
703			error = ENOMEM;
704			goto fail;
705		}
706		if ((rbuf = wpi_alloc_rbuf(sc)) == NULL) {
707			m_freem(data->m);
708			data->m = NULL;
709			aprint_error_dev(sc->sc_dev,
710			    "could not allocate rx cluster\n");
711			error = ENOMEM;
712			goto fail;
713		}
714		/* attach Rx buffer to mbuf */
715		MEXTADD(data->m, rbuf->vaddr, WPI_RBUF_SIZE, 0, wpi_free_rbuf,
716		    rbuf);
717		data->m->m_flags |= M_EXT_RW;
718
719		error = bus_dmamap_load(sc->sc_dmat, data->map,
720		    mtod(data->m, void *), WPI_RBUF_SIZE, NULL,
721		    BUS_DMA_NOWAIT | BUS_DMA_READ);
722		if (error) {
723			aprint_error_dev(sc->sc_dev,
724			    "could not load mbuf: %d\n", error);
725			goto fail;
726		}
727
728		ring->desc[i] = htole32(rbuf->paddr);
729	}
730
731	bus_dmamap_sync(sc->sc_dmat, ring->desc_dma.map, 0, size,
732	    BUS_DMASYNC_PREWRITE);
733
734	return 0;
735
736fail:	wpi_free_rx_ring(sc, ring);
737	return error;
738}
739
740static void
741wpi_reset_rx_ring(struct wpi_softc *sc, struct wpi_rx_ring *ring)
742{
743	int ntries;
744
745	wpi_mem_lock(sc);
746
747	WPI_WRITE(sc, WPI_RX_CONFIG, 0);
748	for (ntries = 0; ntries < 100; ntries++) {
749		if (WPI_READ(sc, WPI_RX_STATUS) & WPI_RX_IDLE)
750			break;
751		DELAY(10);
752	}
753#ifdef WPI_DEBUG
754	if (ntries == 100 && wpi_debug > 0)
755		aprint_error_dev(sc->sc_dev, "timeout resetting Rx ring\n");
756#endif
757	wpi_mem_unlock(sc);
758
759	ring->cur = 0;
760}
761
762static void
763wpi_free_rx_ring(struct wpi_softc *sc, struct wpi_rx_ring *ring)
764{
765	int i;
766
767	wpi_dma_contig_free(&ring->desc_dma);
768
769	for (i = 0; i < WPI_RX_RING_COUNT; i++) {
770		if (ring->data[i].m != NULL) {
771			bus_dmamap_unload(sc->sc_dmat, ring->data[i].map);
772			m_freem(ring->data[i].m);
773		}
774		if (ring->data[i].map != NULL) {
775			bus_dmamap_destroy(sc->sc_dmat, ring->data[i].map);
776		}
777	}
778}
779
780static int
781wpi_alloc_tx_ring(struct wpi_softc *sc, struct wpi_tx_ring *ring, int count,
782    int qid)
783{
784	int i, error;
785
786	ring->qid = qid;
787	ring->count = count;
788	ring->queued = 0;
789	ring->cur = 0;
790
791	error = wpi_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma,
792	    (void **)&ring->desc, count * sizeof (struct wpi_tx_desc),
793	    WPI_RING_DMA_ALIGN, BUS_DMA_NOWAIT);
794	if (error != 0) {
795		aprint_error_dev(sc->sc_dev,
796		    "could not allocate tx ring DMA memory\n");
797		goto fail;
798	}
799
800	/* update shared page with ring's base address */
801	sc->shared->txbase[qid] = htole32(ring->desc_dma.paddr);
802	bus_dmamap_sync(sc->sc_dmat, sc->shared_dma.map, 0,
803	    sizeof(struct wpi_shared), BUS_DMASYNC_PREWRITE);
804
805	error = wpi_dma_contig_alloc(sc->sc_dmat, &ring->cmd_dma,
806	    (void **)&ring->cmd, count * sizeof (struct wpi_tx_cmd), 4,
807	    BUS_DMA_NOWAIT);
808	if (error != 0) {
809		aprint_error_dev(sc->sc_dev,
810		    "could not allocate tx cmd DMA memory\n");
811		goto fail;
812	}
813
814	ring->data = malloc(count * sizeof (struct wpi_tx_data), M_DEVBUF,
815	    M_NOWAIT | M_ZERO);
816	if (ring->data == NULL) {
817		aprint_error_dev(sc->sc_dev,
818		    "could not allocate tx data slots\n");
819		goto fail;
820	}
821
822	for (i = 0; i < count; i++) {
823		struct wpi_tx_data *data = &ring->data[i];
824
825		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
826		    WPI_MAX_SCATTER - 1, MCLBYTES, 0, BUS_DMA_NOWAIT,
827		    &data->map);
828		if (error != 0) {
829			aprint_error_dev(sc->sc_dev,
830			    "could not create tx buf DMA map\n");
831			goto fail;
832		}
833	}
834
835	return 0;
836
837fail:	wpi_free_tx_ring(sc, ring);
838	return error;
839}
840
841static void
842wpi_reset_tx_ring(struct wpi_softc *sc, struct wpi_tx_ring *ring)
843{
844	int i, ntries;
845
846	wpi_mem_lock(sc);
847
848	WPI_WRITE(sc, WPI_TX_CONFIG(ring->qid), 0);
849	for (ntries = 0; ntries < 100; ntries++) {
850		if (WPI_READ(sc, WPI_TX_STATUS) & WPI_TX_IDLE(ring->qid))
851			break;
852		DELAY(10);
853	}
854#ifdef WPI_DEBUG
855	if (ntries == 100 && wpi_debug > 0) {
856		aprint_error_dev(sc->sc_dev, "timeout resetting Tx ring %d\n",
857		    ring->qid);
858	}
859#endif
860	wpi_mem_unlock(sc);
861
862	for (i = 0; i < ring->count; i++) {
863		struct wpi_tx_data *data = &ring->data[i];
864
865		if (data->m != NULL) {
866			bus_dmamap_unload(sc->sc_dmat, data->map);
867			m_freem(data->m);
868			data->m = NULL;
869		}
870	}
871
872	ring->queued = 0;
873	ring->cur = 0;
874}
875
876static void
877wpi_free_tx_ring(struct wpi_softc *sc, struct wpi_tx_ring *ring)
878{
879	int i;
880
881	wpi_dma_contig_free(&ring->desc_dma);
882	wpi_dma_contig_free(&ring->cmd_dma);
883
884	if (ring->data != NULL) {
885		for (i = 0; i < ring->count; i++) {
886			struct wpi_tx_data *data = &ring->data[i];
887
888			if (data->m != NULL) {
889				bus_dmamap_unload(sc->sc_dmat, data->map);
890				m_freem(data->m);
891			}
892		}
893		free(ring->data, M_DEVBUF);
894	}
895}
896
897/*ARGUSED*/
898static struct ieee80211_node *
899wpi_node_alloc(struct ieee80211_node_table *nt __unused)
900{
901	struct wpi_node *wn;
902
903	wn = malloc(sizeof (struct wpi_node), M_80211_NODE, M_NOWAIT | M_ZERO);
904
905	return (struct ieee80211_node *)wn;
906}
907
908static void
909wpi_newassoc(struct ieee80211_node *ni, int isnew)
910{
911	struct wpi_softc *sc = ni->ni_ic->ic_ifp->if_softc;
912	int i;
913
914	ieee80211_amrr_node_init(&sc->amrr, &((struct wpi_node *)ni)->amn);
915
916	/* set rate to some reasonable initial value */
917	for (i = ni->ni_rates.rs_nrates - 1;
918	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
919	     i--);
920	ni->ni_txrate = i;
921}
922
923static int
924wpi_media_change(struct ifnet *ifp)
925{
926	int error;
927
928	error = ieee80211_media_change(ifp);
929	if (error != ENETRESET)
930		return error;
931
932	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
933		wpi_init(ifp);
934
935	return 0;
936}
937
938static int
939wpi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
940{
941	struct ifnet *ifp = ic->ic_ifp;
942	struct wpi_softc *sc = ifp->if_softc;
943	struct ieee80211_node *ni;
944	enum ieee80211_state ostate = ic->ic_state;
945	int error;
946
947	callout_stop(&sc->calib_to);
948
949	switch (nstate) {
950	case IEEE80211_S_SCAN:
951
952		if (sc->is_scanning)
953			break;
954
955		sc->is_scanning = true;
956
957		if (ostate != IEEE80211_S_SCAN) {
958			/* make the link LED blink while we're scanning */
959			wpi_set_led(sc, WPI_LED_LINK, 20, 2);
960		}
961
962		if ((error = wpi_scan(sc)) != 0) {
963			aprint_error_dev(sc->sc_dev,
964			    "could not initiate scan\n");
965			return error;
966		}
967		break;
968
969	case IEEE80211_S_ASSOC:
970		if (ic->ic_state != IEEE80211_S_RUN)
971			break;
972		/* FALLTHROUGH */
973	case IEEE80211_S_AUTH:
974		/* reset state to handle reassociations correctly */
975		sc->config.associd = 0;
976		sc->config.filter &= ~htole32(WPI_FILTER_BSS);
977
978		if ((error = wpi_auth(sc)) != 0) {
979			aprint_error_dev(sc->sc_dev,
980			    "could not send authentication request\n");
981			return error;
982		}
983		break;
984
985	case IEEE80211_S_RUN:
986		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
987			/* link LED blinks while monitoring */
988			wpi_set_led(sc, WPI_LED_LINK, 5, 5);
989			break;
990		}
991		ni = ic->ic_bss;
992
993		if (ic->ic_opmode != IEEE80211_M_STA) {
994			(void) wpi_auth(sc);    /* XXX */
995			wpi_setup_beacon(sc, ni);
996		}
997
998		wpi_enable_tsf(sc, ni);
999
1000		/* update adapter's configuration */
1001		sc->config.associd = htole16(ni->ni_associd & ~0xc000);
1002		/* short preamble/slot time are negotiated when associating */
1003		sc->config.flags &= ~htole32(WPI_CONFIG_SHPREAMBLE |
1004		    WPI_CONFIG_SHSLOT);
1005		if (ic->ic_flags & IEEE80211_F_SHSLOT)
1006			sc->config.flags |= htole32(WPI_CONFIG_SHSLOT);
1007		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1008			sc->config.flags |= htole32(WPI_CONFIG_SHPREAMBLE);
1009		sc->config.filter |= htole32(WPI_FILTER_BSS);
1010		if (ic->ic_opmode != IEEE80211_M_STA)
1011			sc->config.filter |= htole32(WPI_FILTER_BEACON);
1012
1013/* XXX put somewhere HC_QOS_SUPPORT_ASSOC + HC_IBSS_START */
1014
1015		DPRINTF(("config chan %d flags %x\n", sc->config.chan,
1016		    sc->config.flags));
1017		error = wpi_cmd(sc, WPI_CMD_CONFIGURE, &sc->config,
1018		    sizeof (struct wpi_config), 1);
1019		if (error != 0) {
1020			aprint_error_dev(sc->sc_dev,
1021			    "could not update configuration\n");
1022			return error;
1023		}
1024
1025		/* configuration has changed, set Tx power accordingly */
1026		if ((error = wpi_set_txpower(sc, ic->ic_curchan, 1)) != 0) {
1027			aprint_error_dev(sc->sc_dev,
1028			    "could not set Tx power\n");
1029			return error;
1030		}
1031
1032		if (ic->ic_opmode == IEEE80211_M_STA) {
1033			/* fake a join to init the tx rate */
1034			wpi_newassoc(ni, 1);
1035		}
1036
1037		/* start periodic calibration timer */
1038		sc->calib_cnt = 0;
1039		callout_schedule(&sc->calib_to, hz/2);
1040
1041		/* link LED always on while associated */
1042		wpi_set_led(sc, WPI_LED_LINK, 0, 1);
1043		break;
1044
1045	case IEEE80211_S_INIT:
1046		sc->is_scanning = false;
1047		break;
1048	}
1049
1050	return sc->sc_newstate(ic, nstate, arg);
1051}
1052
1053/*
1054 * Grab exclusive access to NIC memory.
1055 */
1056static void
1057wpi_mem_lock(struct wpi_softc *sc)
1058{
1059	uint32_t tmp;
1060	int ntries;
1061
1062	tmp = WPI_READ(sc, WPI_GPIO_CTL);
1063	WPI_WRITE(sc, WPI_GPIO_CTL, tmp | WPI_GPIO_MAC);
1064
1065	/* spin until we actually get the lock */
1066	for (ntries = 0; ntries < 1000; ntries++) {
1067		if ((WPI_READ(sc, WPI_GPIO_CTL) &
1068		    (WPI_GPIO_CLOCK | WPI_GPIO_SLEEP)) == WPI_GPIO_CLOCK)
1069			break;
1070		DELAY(10);
1071	}
1072	if (ntries == 1000)
1073		aprint_error_dev(sc->sc_dev, "could not lock memory\n");
1074}
1075
1076/*
1077 * Release lock on NIC memory.
1078 */
1079static void
1080wpi_mem_unlock(struct wpi_softc *sc)
1081{
1082	uint32_t tmp = WPI_READ(sc, WPI_GPIO_CTL);
1083	WPI_WRITE(sc, WPI_GPIO_CTL, tmp & ~WPI_GPIO_MAC);
1084}
1085
1086static uint32_t
1087wpi_mem_read(struct wpi_softc *sc, uint16_t addr)
1088{
1089	WPI_WRITE(sc, WPI_READ_MEM_ADDR, WPI_MEM_4 | addr);
1090	return WPI_READ(sc, WPI_READ_MEM_DATA);
1091}
1092
1093static void
1094wpi_mem_write(struct wpi_softc *sc, uint16_t addr, uint32_t data)
1095{
1096	WPI_WRITE(sc, WPI_WRITE_MEM_ADDR, WPI_MEM_4 | addr);
1097	WPI_WRITE(sc, WPI_WRITE_MEM_DATA, data);
1098}
1099
1100static void
1101wpi_mem_write_region_4(struct wpi_softc *sc, uint16_t addr,
1102    const uint32_t *data, int wlen)
1103{
1104	for (; wlen > 0; wlen--, data++, addr += 4)
1105		wpi_mem_write(sc, addr, *data);
1106}
1107
1108/*
1109 * Read `len' bytes from the EEPROM.  We access the EEPROM through the MAC
1110 * instead of using the traditional bit-bang method.
1111 */
1112static int
1113wpi_read_prom_data(struct wpi_softc *sc, uint32_t addr, void *data, int len)
1114{
1115	uint8_t *out = data;
1116	uint32_t val;
1117	int ntries;
1118
1119	wpi_mem_lock(sc);
1120	for (; len > 0; len -= 2, addr++) {
1121		WPI_WRITE(sc, WPI_EEPROM_CTL, addr << 2);
1122
1123		for (ntries = 0; ntries < 10; ntries++) {
1124			if ((val = WPI_READ(sc, WPI_EEPROM_CTL)) &
1125			    WPI_EEPROM_READY)
1126				break;
1127			DELAY(5);
1128		}
1129		if (ntries == 10) {
1130			aprint_error_dev(sc->sc_dev, "could not read EEPROM\n");
1131			return ETIMEDOUT;
1132		}
1133		*out++ = val >> 16;
1134		if (len > 1)
1135			*out++ = val >> 24;
1136	}
1137	wpi_mem_unlock(sc);
1138
1139	return 0;
1140}
1141
1142/*
1143 * The firmware boot code is small and is intended to be copied directly into
1144 * the NIC internal memory.
1145 */
1146int
1147wpi_load_microcode(struct wpi_softc *sc, const uint8_t *ucode, int size)
1148{
1149	int ntries;
1150
1151	size /= sizeof (uint32_t);
1152
1153	wpi_mem_lock(sc);
1154
1155	/* copy microcode image into NIC memory */
1156	wpi_mem_write_region_4(sc, WPI_MEM_UCODE_BASE,
1157	    (const uint32_t *)ucode, size);
1158
1159	wpi_mem_write(sc, WPI_MEM_UCODE_SRC, 0);
1160	wpi_mem_write(sc, WPI_MEM_UCODE_DST, WPI_FW_TEXT);
1161	wpi_mem_write(sc, WPI_MEM_UCODE_SIZE, size);
1162
1163	/* run microcode */
1164	wpi_mem_write(sc, WPI_MEM_UCODE_CTL, WPI_UC_RUN);
1165
1166	/* wait for transfer to complete */
1167	for (ntries = 0; ntries < 1000; ntries++) {
1168		if (!(wpi_mem_read(sc, WPI_MEM_UCODE_CTL) & WPI_UC_RUN))
1169			break;
1170		DELAY(10);
1171	}
1172	if (ntries == 1000) {
1173		wpi_mem_unlock(sc);
1174		aprint_error_dev(sc->sc_dev, "could not load boot firmware\n");
1175		return ETIMEDOUT;
1176	}
1177	wpi_mem_write(sc, WPI_MEM_UCODE_CTL, WPI_UC_ENABLE);
1178
1179	wpi_mem_unlock(sc);
1180
1181	return 0;
1182}
1183
1184static int
1185wpi_cache_firmware(struct wpi_softc *sc)
1186{
1187	const char *const fwname = wpi_firmware_name;
1188	firmware_handle_t fw;
1189	int error;
1190
1191	/* sc is used here only to report error messages.  */
1192
1193	mutex_enter(&wpi_firmware_mutex);
1194
1195	if (wpi_firmware_users == SIZE_MAX) {
1196		mutex_exit(&wpi_firmware_mutex);
1197		return ENFILE;	/* Too many of something in the system...  */
1198	}
1199	if (wpi_firmware_users++) {
1200		KASSERT(wpi_firmware_image != NULL);
1201		KASSERT(wpi_firmware_size > 0);
1202		mutex_exit(&wpi_firmware_mutex);
1203		return 0;	/* Already good to go.  */
1204	}
1205
1206	KASSERT(wpi_firmware_image == NULL);
1207	KASSERT(wpi_firmware_size == 0);
1208
1209	/* load firmware image from disk */
1210	if ((error = firmware_open("if_wpi", fwname, &fw)) != 0) {
1211		aprint_error_dev(sc->sc_dev,
1212		    "could not open firmware file %s: %d\n", fwname, error);
1213		goto fail0;
1214	}
1215
1216	wpi_firmware_size = firmware_get_size(fw);
1217
1218	if (wpi_firmware_size > sizeof (struct wpi_firmware_hdr) +
1219	    WPI_FW_MAIN_TEXT_MAXSZ + WPI_FW_MAIN_DATA_MAXSZ +
1220	    WPI_FW_INIT_TEXT_MAXSZ + WPI_FW_INIT_DATA_MAXSZ +
1221	    WPI_FW_BOOT_TEXT_MAXSZ) {
1222		aprint_error_dev(sc->sc_dev,
1223		    "firmware file %s too large: %zu bytes\n",
1224		    fwname, wpi_firmware_size);
1225		error = EFBIG;
1226		goto fail1;
1227	}
1228
1229	if (wpi_firmware_size < sizeof (struct wpi_firmware_hdr)) {
1230		aprint_error_dev(sc->sc_dev,
1231		    "firmware file %s too small: %zu bytes\n",
1232		    fwname, wpi_firmware_size);
1233		error = EINVAL;
1234		goto fail1;
1235	}
1236
1237	wpi_firmware_image = firmware_malloc(wpi_firmware_size);
1238	if (wpi_firmware_image == NULL) {
1239		aprint_error_dev(sc->sc_dev,
1240		    "not enough memory for firmware file %s\n", fwname);
1241		error = ENOMEM;
1242		goto fail1;
1243	}
1244
1245	error = firmware_read(fw, 0, wpi_firmware_image, wpi_firmware_size);
1246	if (error != 0) {
1247		aprint_error_dev(sc->sc_dev,
1248		    "error reading firmware file %s: %d\n", fwname, error);
1249		goto fail2;
1250	}
1251
1252	/* Success!  */
1253	firmware_close(fw);
1254	mutex_exit(&wpi_firmware_mutex);
1255	return 0;
1256
1257fail2:
1258	firmware_free(wpi_firmware_image, wpi_firmware_size);
1259	wpi_firmware_image = NULL;
1260fail1:
1261	wpi_firmware_size = 0;
1262	firmware_close(fw);
1263fail0:
1264	KASSERT(wpi_firmware_users == 1);
1265	wpi_firmware_users = 0;
1266	KASSERT(wpi_firmware_image == NULL);
1267	KASSERT(wpi_firmware_size == 0);
1268
1269	mutex_exit(&wpi_firmware_mutex);
1270	return error;
1271}
1272
1273static void
1274wpi_release_firmware(void)
1275{
1276
1277	mutex_enter(&wpi_firmware_mutex);
1278
1279	KASSERT(wpi_firmware_users > 0);
1280	KASSERT(wpi_firmware_image != NULL);
1281	KASSERT(wpi_firmware_size != 0);
1282
1283	if (--wpi_firmware_users == 0) {
1284		firmware_free(wpi_firmware_image, wpi_firmware_size);
1285		wpi_firmware_image = NULL;
1286		wpi_firmware_size = 0;
1287	}
1288
1289	mutex_exit(&wpi_firmware_mutex);
1290}
1291
1292static int
1293wpi_load_firmware(struct wpi_softc *sc)
1294{
1295	struct wpi_dma_info *dma = &sc->fw_dma;
1296	struct wpi_firmware_hdr hdr;
1297	const uint8_t *init_text, *init_data, *main_text, *main_data;
1298	const uint8_t *boot_text;
1299	uint32_t init_textsz, init_datasz, main_textsz, main_datasz;
1300	uint32_t boot_textsz;
1301	size_t size;
1302	int error;
1303
1304	if (!sc->fw_used) {
1305		if ((error = wpi_cache_firmware(sc)) != 0)
1306			return error;
1307		sc->fw_used = true;
1308	}
1309
1310	KASSERT(sc->fw_used);
1311	KASSERT(wpi_firmware_image != NULL);
1312	KASSERT(wpi_firmware_size > sizeof(hdr));
1313
1314	memcpy(&hdr, wpi_firmware_image, sizeof(hdr));
1315
1316	main_textsz = le32toh(hdr.main_textsz);
1317	main_datasz = le32toh(hdr.main_datasz);
1318	init_textsz = le32toh(hdr.init_textsz);
1319	init_datasz = le32toh(hdr.init_datasz);
1320	boot_textsz = le32toh(hdr.boot_textsz);
1321
1322	/* sanity-check firmware segments sizes */
1323	if (main_textsz > WPI_FW_MAIN_TEXT_MAXSZ ||
1324	    main_datasz > WPI_FW_MAIN_DATA_MAXSZ ||
1325	    init_textsz > WPI_FW_INIT_TEXT_MAXSZ ||
1326	    init_datasz > WPI_FW_INIT_DATA_MAXSZ ||
1327	    boot_textsz > WPI_FW_BOOT_TEXT_MAXSZ ||
1328	    (boot_textsz & 3) != 0) {
1329		aprint_error_dev(sc->sc_dev, "invalid firmware header\n");
1330		error = EINVAL;
1331		goto free_firmware;
1332	}
1333
1334	/* check that all firmware segments are present */
1335	size = sizeof (struct wpi_firmware_hdr) + main_textsz +
1336	    main_datasz + init_textsz + init_datasz + boot_textsz;
1337	if (wpi_firmware_size < size) {
1338		aprint_error_dev(sc->sc_dev,
1339		    "firmware file truncated: %zu bytes, expected %zu bytes\n",
1340		    wpi_firmware_size, size);
1341		error = EINVAL;
1342		goto free_firmware;
1343	}
1344
1345	/* get pointers to firmware segments */
1346	main_text = wpi_firmware_image + sizeof (struct wpi_firmware_hdr);
1347	main_data = main_text + main_textsz;
1348	init_text = main_data + main_datasz;
1349	init_data = init_text + init_textsz;
1350	boot_text = init_data + init_datasz;
1351
1352	/* copy initialization images into pre-allocated DMA-safe memory */
1353	memcpy(dma->vaddr, init_data, init_datasz);
1354	memcpy((char *)dma->vaddr + WPI_FW_INIT_DATA_MAXSZ, init_text,
1355	    init_textsz);
1356
1357	bus_dmamap_sync(dma->tag, dma->map, 0, dma->size, BUS_DMASYNC_PREWRITE);
1358
1359	/* tell adapter where to find initialization images */
1360	wpi_mem_lock(sc);
1361	wpi_mem_write(sc, WPI_MEM_DATA_BASE, dma->paddr);
1362	wpi_mem_write(sc, WPI_MEM_DATA_SIZE, init_datasz);
1363	wpi_mem_write(sc, WPI_MEM_TEXT_BASE,
1364	    dma->paddr + WPI_FW_INIT_DATA_MAXSZ);
1365	wpi_mem_write(sc, WPI_MEM_TEXT_SIZE, init_textsz);
1366	wpi_mem_unlock(sc);
1367
1368	/* load firmware boot code */
1369	if ((error = wpi_load_microcode(sc, boot_text, boot_textsz)) != 0) {
1370		aprint_error_dev(sc->sc_dev, "could not load boot firmware\n");
1371		return error;
1372	}
1373
1374	/* now press "execute" ;-) */
1375	WPI_WRITE(sc, WPI_RESET, 0);
1376
1377	/* wait at most one second for first alive notification */
1378	if ((error = tsleep(sc, PCATCH, "wpiinit", hz)) != 0) {
1379		/* this isn't what was supposed to happen.. */
1380		aprint_error_dev(sc->sc_dev,
1381		    "timeout waiting for adapter to initialize\n");
1382	}
1383
1384	/* copy runtime images into pre-allocated DMA-safe memory */
1385	memcpy(dma->vaddr, main_data, main_datasz);
1386	memcpy((char *)dma->vaddr + WPI_FW_MAIN_DATA_MAXSZ, main_text,
1387	    main_textsz);
1388
1389	bus_dmamap_sync(dma->tag, dma->map, 0, dma->size, BUS_DMASYNC_PREWRITE);
1390
1391	/* tell adapter where to find runtime images */
1392	wpi_mem_lock(sc);
1393	wpi_mem_write(sc, WPI_MEM_DATA_BASE, dma->paddr);
1394	wpi_mem_write(sc, WPI_MEM_DATA_SIZE, main_datasz);
1395	wpi_mem_write(sc, WPI_MEM_TEXT_BASE,
1396	    dma->paddr + WPI_FW_MAIN_DATA_MAXSZ);
1397	wpi_mem_write(sc, WPI_MEM_TEXT_SIZE, WPI_FW_UPDATED | main_textsz);
1398	wpi_mem_unlock(sc);
1399
1400	/* wait at most one second for second alive notification */
1401	if ((error = tsleep(sc, PCATCH, "wpiinit", hz)) != 0) {
1402		/* this isn't what was supposed to happen.. */
1403		aprint_error_dev(sc->sc_dev,
1404		    "timeout waiting for adapter to initialize\n");
1405	}
1406
1407	return error;
1408
1409free_firmware:
1410	sc->fw_used = false;
1411	wpi_release_firmware();
1412	return error;
1413}
1414
1415static void
1416wpi_calib_timeout(void *arg)
1417{
1418	struct wpi_softc *sc = arg;
1419	struct ieee80211com *ic = &sc->sc_ic;
1420	int temp, s;
1421
1422	/* automatic rate control triggered every 500ms */
1423	if (ic->ic_fixed_rate == -1) {
1424		s = splnet();
1425		if (ic->ic_opmode == IEEE80211_M_STA)
1426			wpi_iter_func(sc, ic->ic_bss);
1427		else
1428			ieee80211_iterate_nodes(&ic->ic_sta, wpi_iter_func, sc);
1429		splx(s);
1430	}
1431
1432	/* update sensor data */
1433	temp = (int)WPI_READ(sc, WPI_TEMPERATURE);
1434
1435	/* automatic power calibration every 60s */
1436	if (++sc->calib_cnt >= 120) {
1437		wpi_power_calibration(sc, temp);
1438		sc->calib_cnt = 0;
1439	}
1440
1441	callout_schedule(&sc->calib_to, hz/2);
1442}
1443
1444static void
1445wpi_iter_func(void *arg, struct ieee80211_node *ni)
1446{
1447	struct wpi_softc *sc = arg;
1448	struct wpi_node *wn = (struct wpi_node *)ni;
1449
1450	ieee80211_amrr_choose(&sc->amrr, ni, &wn->amn);
1451}
1452
1453/*
1454 * This function is called periodically (every 60 seconds) to adjust output
1455 * power to temperature changes.
1456 */
1457void
1458wpi_power_calibration(struct wpi_softc *sc, int temp)
1459{
1460	/* sanity-check read value */
1461	if (temp < -260 || temp > 25) {
1462		/* this can't be correct, ignore */
1463		DPRINTF(("out-of-range temperature reported: %d\n", temp));
1464		return;
1465	}
1466
1467	DPRINTF(("temperature %d->%d\n", sc->temp, temp));
1468
1469	/* adjust Tx power if need be */
1470	if (abs(temp - sc->temp) <= 6)
1471		return;
1472
1473	sc->temp = temp;
1474
1475	if (wpi_set_txpower(sc, sc->sc_ic.ic_curchan, 1) != 0) {
1476		/* just warn, too bad for the automatic calibration... */
1477		aprint_error_dev(sc->sc_dev, "could not adjust Tx power\n");
1478	}
1479}
1480
1481static void
1482wpi_rx_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc,
1483    struct wpi_rx_data *data)
1484{
1485	struct ieee80211com *ic = &sc->sc_ic;
1486	struct ifnet *ifp = ic->ic_ifp;
1487	struct wpi_rx_ring *ring = &sc->rxq;
1488	struct wpi_rx_stat *stat;
1489	struct wpi_rx_head *head;
1490	struct wpi_rx_tail *tail;
1491	struct wpi_rbuf *rbuf;
1492	struct ieee80211_frame *wh;
1493	struct ieee80211_node *ni;
1494	struct mbuf *m, *mnew;
1495	int data_off, error, s;
1496
1497	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1498	    BUS_DMASYNC_POSTREAD);
1499	stat = (struct wpi_rx_stat *)(desc + 1);
1500
1501	if (stat->len > WPI_STAT_MAXLEN) {
1502		aprint_error_dev(sc->sc_dev, "invalid rx statistic header\n");
1503		ifp->if_ierrors++;
1504		return;
1505	}
1506
1507	head = (struct wpi_rx_head *)((char *)(stat + 1) + stat->len);
1508	tail = (struct wpi_rx_tail *)((char *)(head + 1) + le16toh(head->len));
1509
1510	DPRINTFN(4, ("rx intr: idx=%d len=%d stat len=%d rssi=%d rate=%x "
1511	    "chan=%d tstamp=%" PRIu64 "\n", ring->cur, le32toh(desc->len),
1512	    le16toh(head->len), (int8_t)stat->rssi, head->rate, head->chan,
1513	    le64toh(tail->tstamp)));
1514
1515	/*
1516	 * Discard Rx frames with bad CRC early (XXX we may want to pass them
1517	 * to radiotap in monitor mode).
1518	 */
1519	if ((le32toh(tail->flags) & WPI_RX_NOERROR) != WPI_RX_NOERROR) {
1520		DPRINTF(("rx tail flags error %x\n",
1521		    le32toh(tail->flags)));
1522		ifp->if_ierrors++;
1523		return;
1524	}
1525
1526	/* Compute where are the useful datas */
1527	data_off = (char*)(head + 1) - mtod(data->m, char*);
1528
1529	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1530	if (mnew == NULL) {
1531		ifp->if_ierrors++;
1532		return;
1533	}
1534
1535	rbuf = wpi_alloc_rbuf(sc);
1536	if (rbuf == NULL) {
1537		m_freem(mnew);
1538		ifp->if_ierrors++;
1539		return;
1540	}
1541
1542	/* attach Rx buffer to mbuf */
1543	MEXTADD(mnew, rbuf->vaddr, WPI_RBUF_SIZE, 0, wpi_free_rbuf,
1544		rbuf);
1545	mnew->m_flags |= M_EXT_RW;
1546
1547	bus_dmamap_unload(sc->sc_dmat, data->map);
1548
1549	error = bus_dmamap_load(sc->sc_dmat, data->map,
1550	    mtod(mnew, void *), WPI_RBUF_SIZE, NULL,
1551	    BUS_DMA_NOWAIT | BUS_DMA_READ);
1552	if (error) {
1553		device_printf(sc->sc_dev,
1554		    "couldn't load rx mbuf: %d\n", error);
1555		m_freem(mnew);
1556		ifp->if_ierrors++;
1557
1558		error = bus_dmamap_load(sc->sc_dmat, data->map,
1559		    mtod(data->m, void *), WPI_RBUF_SIZE, NULL,
1560		    BUS_DMA_NOWAIT | BUS_DMA_READ);
1561		if (error)
1562			panic("%s: bus_dmamap_load failed: %d\n",
1563			    device_xname(sc->sc_dev), error);
1564		return;
1565	}
1566
1567	/* new mbuf loaded successfully */
1568	m = data->m;
1569	data->m = mnew;
1570
1571	/* update Rx descriptor */
1572	ring->desc[ring->cur] = htole32(rbuf->paddr);
1573	bus_dmamap_sync(sc->sc_dmat, ring->desc_dma.map, 0,
1574	    ring->desc_dma.size,
1575	    BUS_DMASYNC_PREWRITE);
1576
1577	m->m_data = (char*)m->m_data + data_off;
1578	m->m_pkthdr.len = m->m_len = le16toh(head->len);
1579
1580	/* finalize mbuf */
1581	m_set_rcvif(m, ifp);
1582
1583	s = splnet();
1584
1585	if (sc->sc_drvbpf != NULL) {
1586		struct wpi_rx_radiotap_header *tap = &sc->sc_rxtap;
1587
1588		tap->wr_flags = 0;
1589		tap->wr_chan_freq =
1590		    htole16(ic->ic_channels[head->chan].ic_freq);
1591		tap->wr_chan_flags =
1592		    htole16(ic->ic_channels[head->chan].ic_flags);
1593		tap->wr_dbm_antsignal = (int8_t)(stat->rssi - WPI_RSSI_OFFSET);
1594		tap->wr_dbm_antnoise = (int8_t)le16toh(stat->noise);
1595		tap->wr_tsft = tail->tstamp;
1596		tap->wr_antenna = (le16toh(head->flags) >> 4) & 0xf;
1597		switch (head->rate) {
1598		/* CCK rates */
1599		case  10: tap->wr_rate =   2; break;
1600		case  20: tap->wr_rate =   4; break;
1601		case  55: tap->wr_rate =  11; break;
1602		case 110: tap->wr_rate =  22; break;
1603		/* OFDM rates */
1604		case 0xd: tap->wr_rate =  12; break;
1605		case 0xf: tap->wr_rate =  18; break;
1606		case 0x5: tap->wr_rate =  24; break;
1607		case 0x7: tap->wr_rate =  36; break;
1608		case 0x9: tap->wr_rate =  48; break;
1609		case 0xb: tap->wr_rate =  72; break;
1610		case 0x1: tap->wr_rate =  96; break;
1611		case 0x3: tap->wr_rate = 108; break;
1612		/* unknown rate: should not happen */
1613		default:  tap->wr_rate =   0;
1614		}
1615		if (le16toh(head->flags) & 0x4)
1616			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1617
1618		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
1619	}
1620
1621	/* grab a reference to the source node */
1622	wh = mtod(m, struct ieee80211_frame *);
1623	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
1624
1625	/* send the frame to the 802.11 layer */
1626	ieee80211_input(ic, m, ni, stat->rssi, 0);
1627
1628	/* release node reference */
1629	ieee80211_free_node(ni);
1630
1631	splx(s);
1632}
1633
1634static void
1635wpi_tx_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc)
1636{
1637	struct ifnet *ifp = sc->sc_ic.ic_ifp;
1638	struct wpi_tx_ring *ring = &sc->txq[desc->qid & 0x3];
1639	struct wpi_tx_data *data = &ring->data[desc->idx];
1640	struct wpi_tx_stat *stat = (struct wpi_tx_stat *)(desc + 1);
1641	struct wpi_node *wn = (struct wpi_node *)data->ni;
1642	int s;
1643
1644	DPRINTFN(4, ("tx done: qid=%d idx=%d retries=%d nkill=%d rate=%x "
1645	    "duration=%d status=%x\n", desc->qid, desc->idx, stat->ntries,
1646	    stat->nkill, stat->rate, le32toh(stat->duration),
1647	    le32toh(stat->status)));
1648
1649	s = splnet();
1650
1651	/*
1652	 * Update rate control statistics for the node.
1653	 * XXX we should not count mgmt frames since they're always sent at
1654	 * the lowest available bit-rate.
1655	 */
1656	wn->amn.amn_txcnt++;
1657	if (stat->ntries > 0) {
1658		DPRINTFN(3, ("tx intr ntries %d\n", stat->ntries));
1659		wn->amn.amn_retrycnt++;
1660	}
1661
1662	if ((le32toh(stat->status) & 0xff) != 1)
1663		ifp->if_oerrors++;
1664	else
1665		ifp->if_opackets++;
1666
1667	bus_dmamap_unload(sc->sc_dmat, data->map);
1668	m_freem(data->m);
1669	data->m = NULL;
1670	ieee80211_free_node(data->ni);
1671	data->ni = NULL;
1672
1673	ring->queued--;
1674
1675	sc->sc_tx_timer = 0;
1676	ifp->if_flags &= ~IFF_OACTIVE;
1677	wpi_start(ifp); /* in softint */
1678
1679	splx(s);
1680}
1681
1682static void
1683wpi_cmd_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc)
1684{
1685	struct wpi_tx_ring *ring = &sc->cmdq;
1686	struct wpi_tx_data *data;
1687
1688	if ((desc->qid & 7) != 4)
1689		return;	/* not a command ack */
1690
1691	data = &ring->data[desc->idx];
1692
1693	/* if the command was mapped in a mbuf, free it */
1694	if (data->m != NULL) {
1695		bus_dmamap_unload(sc->sc_dmat, data->map);
1696		m_freem(data->m);
1697		data->m = NULL;
1698	}
1699
1700	wakeup(&ring->cmd[desc->idx]);
1701}
1702
1703static void
1704wpi_notif_intr(struct wpi_softc *sc)
1705{
1706	struct ieee80211com *ic = &sc->sc_ic;
1707	struct ifnet *ifp =  ic->ic_ifp;
1708	uint32_t hw;
1709	int s;
1710
1711	bus_dmamap_sync(sc->sc_dmat, sc->shared_dma.map, 0,
1712	    sizeof(struct wpi_shared), BUS_DMASYNC_POSTREAD);
1713
1714	hw = le32toh(sc->shared->next);
1715	while (sc->rxq.cur != hw) {
1716		struct wpi_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1717		struct wpi_rx_desc *desc;
1718
1719		bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1720		    BUS_DMASYNC_POSTREAD);
1721		desc = mtod(data->m, struct wpi_rx_desc *);
1722
1723		DPRINTFN(4, ("rx notification qid=%x idx=%d flags=%x type=%d "
1724		    "len=%d\n", desc->qid, desc->idx, desc->flags,
1725		    desc->type, le32toh(desc->len)));
1726
1727		if (!(desc->qid & 0x80))	/* reply to a command */
1728			wpi_cmd_intr(sc, desc);
1729
1730		switch (desc->type) {
1731		case WPI_RX_DONE:
1732			/* a 802.11 frame was received */
1733			wpi_rx_intr(sc, desc, data);
1734			break;
1735
1736		case WPI_TX_DONE:
1737			/* a 802.11 frame has been transmitted */
1738			wpi_tx_intr(sc, desc);
1739			break;
1740
1741		case WPI_UC_READY:
1742		{
1743			struct wpi_ucode_info *uc =
1744			    (struct wpi_ucode_info *)(desc + 1);
1745
1746			/* the microcontroller is ready */
1747			DPRINTF(("microcode alive notification version %x "
1748			    "alive %x\n", le32toh(uc->version),
1749			    le32toh(uc->valid)));
1750
1751			if (le32toh(uc->valid) != 1) {
1752				aprint_error_dev(sc->sc_dev,
1753				    "microcontroller initialization failed\n");
1754			}
1755			break;
1756		}
1757		case WPI_STATE_CHANGED:
1758		{
1759			uint32_t *status = (uint32_t *)(desc + 1);
1760
1761			/* enabled/disabled notification */
1762			DPRINTF(("state changed to %x\n", le32toh(*status)));
1763
1764			if (le32toh(*status) & 1) {
1765				s = splnet();
1766				/* the radio button has to be pushed */
1767				/* wake up thread to signal powerd */
1768				cv_signal(&sc->sc_rsw_cv);
1769				aprint_error_dev(sc->sc_dev,
1770				    "Radio transmitter is off\n");
1771				/* turn the interface down */
1772				ifp->if_flags &= ~IFF_UP;
1773				wpi_stop(ifp, 1);
1774				splx(s);
1775				return;	/* no further processing */
1776			}
1777			break;
1778		}
1779		case WPI_START_SCAN:
1780		{
1781#if 0
1782			struct wpi_start_scan *scan =
1783			    (struct wpi_start_scan *)(desc + 1);
1784
1785			DPRINTFN(2, ("scanning channel %d status %x\n",
1786			    scan->chan, le32toh(scan->status)));
1787
1788			/* fix current channel */
1789			ic->ic_curchan = &ic->ic_channels[scan->chan];
1790#endif
1791			break;
1792		}
1793		case WPI_STOP_SCAN:
1794		{
1795#ifdef WPI_DEBUG
1796			struct wpi_stop_scan *scan =
1797			    (struct wpi_stop_scan *)(desc + 1);
1798#endif
1799
1800			DPRINTF(("scan finished nchan=%d status=%d chan=%d\n",
1801			    scan->nchan, scan->status, scan->chan));
1802
1803			s = splnet();
1804			sc->is_scanning = false;
1805			if (ic->ic_state == IEEE80211_S_SCAN)
1806				ieee80211_next_scan(ic);
1807			splx(s);
1808			break;
1809		}
1810		}
1811
1812		sc->rxq.cur = (sc->rxq.cur + 1) % WPI_RX_RING_COUNT;
1813	}
1814
1815	/* tell the firmware what we have processed */
1816	hw = (hw == 0) ? WPI_RX_RING_COUNT - 1 : hw - 1;
1817	WPI_WRITE(sc, WPI_RX_WIDX, hw & ~7);
1818}
1819
1820static int
1821wpi_intr(void *arg)
1822{
1823	struct wpi_softc *sc = arg;
1824	uint32_t r;
1825
1826	r = WPI_READ(sc, WPI_INTR);
1827	if (r == 0 || r == 0xffffffff)
1828		return 0;	/* not for us */
1829
1830	DPRINTFN(6, ("interrupt reg %x\n", r));
1831
1832	/* disable interrupts */
1833	WPI_WRITE(sc, WPI_MASK, 0);
1834
1835	softint_schedule(sc->sc_soft_ih);
1836	return 1;
1837}
1838
1839static void
1840wpi_softintr(void *arg)
1841{
1842	struct wpi_softc *sc = arg;
1843	struct ifnet *ifp = sc->sc_ic.ic_ifp;
1844	uint32_t r;
1845
1846	r = WPI_READ(sc, WPI_INTR);
1847	if (r == 0 || r == 0xffffffff)
1848		goto out;
1849
1850	/* ack interrupts */
1851	WPI_WRITE(sc, WPI_INTR, r);
1852
1853	if (r & (WPI_SW_ERROR | WPI_HW_ERROR)) {
1854		/* SYSTEM FAILURE, SYSTEM FAILURE */
1855		aprint_error_dev(sc->sc_dev, "fatal firmware error\n");
1856		ifp->if_flags &= ~IFF_UP;
1857		wpi_stop(ifp, 1);
1858		return;
1859	}
1860
1861	if (r & WPI_RX_INTR)
1862		wpi_notif_intr(sc);
1863
1864	if (r & WPI_ALIVE_INTR)	/* firmware initialized */
1865		wakeup(sc);
1866
1867 out:
1868	/* re-enable interrupts */
1869	if (ifp->if_flags & IFF_UP)
1870		WPI_WRITE(sc, WPI_MASK, WPI_INTR_MASK);
1871}
1872
1873static uint8_t
1874wpi_plcp_signal(int rate)
1875{
1876	switch (rate) {
1877	/* CCK rates (returned values are device-dependent) */
1878	case 2:		return 10;
1879	case 4:		return 20;
1880	case 11:	return 55;
1881	case 22:	return 110;
1882
1883	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1884	/* R1-R4, (u)ral is R4-R1 */
1885	case 12:	return 0xd;
1886	case 18:	return 0xf;
1887	case 24:	return 0x5;
1888	case 36:	return 0x7;
1889	case 48:	return 0x9;
1890	case 72:	return 0xb;
1891	case 96:	return 0x1;
1892	case 108:	return 0x3;
1893
1894	/* unsupported rates (should not get there) */
1895	default:	return 0;
1896	}
1897}
1898
1899/* quickly determine if a given rate is CCK or OFDM */
1900#define WPI_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1901
1902static int
1903wpi_tx_data(struct wpi_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1904    int ac)
1905{
1906	struct ieee80211com *ic = &sc->sc_ic;
1907	struct wpi_tx_ring *ring = &sc->txq[ac];
1908	struct wpi_tx_desc *desc;
1909	struct wpi_tx_data *data;
1910	struct wpi_tx_cmd *cmd;
1911	struct wpi_cmd_data *tx;
1912	struct ieee80211_frame *wh;
1913	struct ieee80211_key *k;
1914	const struct chanAccParams *cap;
1915	struct mbuf *mnew;
1916	int i, rate, error, hdrlen, noack = 0;
1917
1918	desc = &ring->desc[ring->cur];
1919	data = &ring->data[ring->cur];
1920
1921	wh = mtod(m0, struct ieee80211_frame *);
1922
1923	if (ieee80211_has_qos(wh)) {
1924		cap = &ic->ic_wme.wme_chanParams;
1925		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1926	}
1927
1928	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1929		k = ieee80211_crypto_encap(ic, ni, m0);
1930		if (k == NULL) {
1931			m_freem(m0);
1932			return ENOBUFS;
1933		}
1934
1935		/* packet header may have moved, reset our local pointer */
1936		wh = mtod(m0, struct ieee80211_frame *);
1937	}
1938
1939	hdrlen = ieee80211_anyhdrsize(wh);
1940
1941	/* pickup a rate */
1942	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1943	    IEEE80211_FC0_TYPE_MGT) {
1944		/* mgmt frames are sent at the lowest available bit-rate */
1945		rate = ni->ni_rates.rs_rates[0];
1946	} else {
1947		if (ic->ic_fixed_rate != -1) {
1948			rate = ic->ic_sup_rates[ic->ic_curmode].
1949			    rs_rates[ic->ic_fixed_rate];
1950		} else
1951			rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1952	}
1953	rate &= IEEE80211_RATE_VAL;
1954
1955	if (sc->sc_drvbpf != NULL) {
1956		struct wpi_tx_radiotap_header *tap = &sc->sc_txtap;
1957
1958		tap->wt_flags = 0;
1959		tap->wt_chan_freq = htole16(ni->ni_chan->ic_freq);
1960		tap->wt_chan_flags = htole16(ni->ni_chan->ic_flags);
1961		tap->wt_rate = rate;
1962		tap->wt_hwqueue = ac;
1963		if (wh->i_fc[1] & IEEE80211_FC1_WEP)
1964			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1965
1966		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
1967	}
1968
1969	cmd = &ring->cmd[ring->cur];
1970	cmd->code = WPI_CMD_TX_DATA;
1971	cmd->flags = 0;
1972	cmd->qid = ring->qid;
1973	cmd->idx = ring->cur;
1974
1975	tx = (struct wpi_cmd_data *)cmd->data;
1976	/* no need to zero tx, all fields are reinitialized here */
1977	tx->flags = 0;
1978
1979	if (!noack && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1980		tx->flags |= htole32(WPI_TX_NEED_ACK);
1981	} else if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold)
1982		tx->flags |= htole32(WPI_TX_NEED_RTS | WPI_TX_FULL_TXOP);
1983
1984	tx->flags |= htole32(WPI_TX_AUTO_SEQ);
1985
1986	/* retrieve destination node's id */
1987	tx->id = IEEE80211_IS_MULTICAST(wh->i_addr1) ? WPI_ID_BROADCAST :
1988		WPI_ID_BSS;
1989
1990	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1991	    IEEE80211_FC0_TYPE_MGT) {
1992		/* tell h/w to set timestamp in probe responses */
1993		if ((wh->i_fc[0] &
1994		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1995		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1996			tx->flags |= htole32(WPI_TX_INSERT_TSTAMP);
1997
1998		if (((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1999			 IEEE80211_FC0_SUBTYPE_ASSOC_REQ) ||
2000			((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
2001			 IEEE80211_FC0_SUBTYPE_REASSOC_REQ))
2002			tx->timeout = htole16(3);
2003		else
2004			tx->timeout = htole16(2);
2005	} else
2006		tx->timeout = htole16(0);
2007
2008	tx->rate = wpi_plcp_signal(rate);
2009
2010	/* be very persistant at sending frames out */
2011	tx->rts_ntries = 7;
2012	tx->data_ntries = 15;
2013
2014	tx->ofdm_mask = 0xff;
2015	tx->cck_mask = 0x0f;
2016	tx->lifetime = htole32(WPI_LIFETIME_INFINITE);
2017
2018	tx->len = htole16(m0->m_pkthdr.len);
2019
2020	/* save and trim IEEE802.11 header */
2021	memcpy((uint8_t *)(tx + 1), wh, hdrlen);
2022	m_adj(m0, hdrlen);
2023
2024	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
2025	    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
2026	if (error != 0 && error != EFBIG) {
2027		aprint_error_dev(sc->sc_dev, "could not map mbuf (error %d)\n",
2028		    error);
2029		m_freem(m0);
2030		return error;
2031	}
2032	if (error != 0) {
2033		/* too many fragments, linearize */
2034
2035		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
2036		if (mnew == NULL) {
2037			m_freem(m0);
2038			return ENOMEM;
2039		}
2040		M_COPY_PKTHDR(mnew, m0);
2041		if (m0->m_pkthdr.len > MHLEN) {
2042			MCLGET(mnew, M_DONTWAIT);
2043			if (!(mnew->m_flags & M_EXT)) {
2044				m_freem(m0);
2045				m_freem(mnew);
2046				return ENOMEM;
2047			}
2048		}
2049
2050		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(mnew, void *));
2051		m_freem(m0);
2052		mnew->m_len = mnew->m_pkthdr.len;
2053		m0 = mnew;
2054
2055		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
2056		    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
2057		if (error != 0) {
2058			aprint_error_dev(sc->sc_dev,
2059			    "could not map mbuf (error %d)\n", error);
2060			m_freem(m0);
2061			return error;
2062		}
2063	}
2064
2065	data->m = m0;
2066	data->ni = ni;
2067
2068	DPRINTFN(4, ("sending data: qid=%d idx=%d len=%d nsegs=%d\n",
2069	    ring->qid, ring->cur, m0->m_pkthdr.len, data->map->dm_nsegs));
2070
2071	/* first scatter/gather segment is used by the tx data command */
2072	desc->flags = htole32(WPI_PAD32(m0->m_pkthdr.len) << 28 |
2073	    (1 + data->map->dm_nsegs) << 24);
2074	desc->segs[0].addr = htole32(ring->cmd_dma.paddr +
2075	    ring->cur * sizeof (struct wpi_tx_cmd));
2076	desc->segs[0].len  = htole32(4 + sizeof (struct wpi_cmd_data) +
2077	    ((hdrlen + 3) & ~3));
2078	for (i = 1; i <= data->map->dm_nsegs; i++) {
2079		desc->segs[i].addr =
2080		    htole32(data->map->dm_segs[i - 1].ds_addr);
2081		desc->segs[i].len  =
2082		    htole32(data->map->dm_segs[i - 1].ds_len);
2083	}
2084
2085	ring->queued++;
2086
2087	bus_dmamap_sync(sc->sc_dmat, data->map, 0,
2088	    data->map->dm_mapsize,
2089	    BUS_DMASYNC_PREWRITE);
2090	bus_dmamap_sync(sc->sc_dmat, ring->cmd_dma.map, 0,
2091	    ring->cmd_dma.size,
2092	    BUS_DMASYNC_PREWRITE);
2093	bus_dmamap_sync(sc->sc_dmat, ring->desc_dma.map, 0,
2094	    ring->desc_dma.size,
2095	    BUS_DMASYNC_PREWRITE);
2096
2097	/* kick ring */
2098	ring->cur = (ring->cur + 1) % WPI_TX_RING_COUNT;
2099	WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2100
2101	return 0;
2102}
2103
2104static void
2105wpi_start(struct ifnet *ifp)
2106{
2107	struct wpi_softc *sc = ifp->if_softc;
2108	struct ieee80211com *ic = &sc->sc_ic;
2109	struct ieee80211_node *ni;
2110	struct ether_header *eh;
2111	struct mbuf *m0;
2112	int ac;
2113
2114	/*
2115	 * net80211 may still try to send management frames even if the
2116	 * IFF_RUNNING flag is not set...
2117	 */
2118	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2119		return;
2120
2121	for (;;) {
2122		IF_DEQUEUE(&ic->ic_mgtq, m0);
2123		if (m0 != NULL) {
2124
2125			ni = M_GETCTX(m0, struct ieee80211_node *);
2126			M_CLEARCTX(m0);
2127
2128			/* management frames go into ring 0 */
2129			if (sc->txq[0].queued > sc->txq[0].count - 8) {
2130				ifp->if_oerrors++;
2131				continue;
2132			}
2133			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2134			if (wpi_tx_data(sc, m0, ni, 0) != 0) {
2135				ifp->if_oerrors++;
2136				break;
2137			}
2138		} else {
2139			if (ic->ic_state != IEEE80211_S_RUN)
2140				break;
2141			IFQ_POLL(&ifp->if_snd, m0);
2142			if (m0 == NULL)
2143				break;
2144
2145			if (m0->m_len < sizeof (*eh) &&
2146			    (m0 = m_pullup(m0, sizeof (*eh))) == NULL) {
2147				ifp->if_oerrors++;
2148				continue;
2149			}
2150			eh = mtod(m0, struct ether_header *);
2151			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2152			if (ni == NULL) {
2153				m_freem(m0);
2154				ifp->if_oerrors++;
2155				continue;
2156			}
2157
2158			/* classify mbuf so we can find which tx ring to use */
2159			if (ieee80211_classify(ic, m0, ni) != 0) {
2160				m_freem(m0);
2161				ieee80211_free_node(ni);
2162				ifp->if_oerrors++;
2163				continue;
2164			}
2165
2166			/* no QoS encapsulation for EAPOL frames */
2167			ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
2168			    M_WME_GETAC(m0) : WME_AC_BE;
2169
2170			if (sc->txq[ac].queued > sc->txq[ac].count - 8) {
2171				/* there is no place left in this ring */
2172				ifp->if_flags |= IFF_OACTIVE;
2173				break;
2174			}
2175			IFQ_DEQUEUE(&ifp->if_snd, m0);
2176			bpf_mtap(ifp, m0, BPF_D_OUT);
2177			m0 = ieee80211_encap(ic, m0, ni);
2178			if (m0 == NULL) {
2179				ieee80211_free_node(ni);
2180				ifp->if_oerrors++;
2181				continue;
2182			}
2183			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2184			if (wpi_tx_data(sc, m0, ni, ac) != 0) {
2185				ieee80211_free_node(ni);
2186				ifp->if_oerrors++;
2187				break;
2188			}
2189		}
2190
2191		sc->sc_tx_timer = 5;
2192		ifp->if_timer = 1;
2193	}
2194}
2195
2196static void
2197wpi_watchdog(struct ifnet *ifp)
2198{
2199	struct wpi_softc *sc = ifp->if_softc;
2200
2201	ifp->if_timer = 0;
2202
2203	if (sc->sc_tx_timer > 0) {
2204		if (--sc->sc_tx_timer == 0) {
2205			aprint_error_dev(sc->sc_dev, "device timeout\n");
2206			ifp->if_flags &= ~IFF_UP;
2207			wpi_stop(ifp, 1);
2208			ifp->if_oerrors++;
2209			return;
2210		}
2211		ifp->if_timer = 1;
2212	}
2213
2214	ieee80211_watchdog(&sc->sc_ic);
2215}
2216
2217static int
2218wpi_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2219{
2220#define IS_RUNNING(ifp) \
2221	((ifp->if_flags & IFF_UP) && (ifp->if_flags & IFF_RUNNING))
2222
2223	struct wpi_softc *sc = ifp->if_softc;
2224	struct ieee80211com *ic = &sc->sc_ic;
2225	int s, error = 0;
2226
2227	s = splnet();
2228
2229	switch (cmd) {
2230	case SIOCSIFFLAGS:
2231		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2232			break;
2233		if (ifp->if_flags & IFF_UP) {
2234			if (!(ifp->if_flags & IFF_RUNNING))
2235				wpi_init(ifp);
2236		} else {
2237			if (ifp->if_flags & IFF_RUNNING)
2238				wpi_stop(ifp, 1);
2239		}
2240		break;
2241
2242	case SIOCADDMULTI:
2243	case SIOCDELMULTI:
2244		/* XXX no h/w multicast filter? --dyoung */
2245		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
2246			/* setup multicast filter, etc */
2247			error = 0;
2248		}
2249		break;
2250
2251	default:
2252		error = ieee80211_ioctl(ic, cmd, data);
2253	}
2254
2255	if (error == ENETRESET) {
2256		if (IS_RUNNING(ifp) &&
2257			(ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2258			wpi_init(ifp);
2259		error = 0;
2260	}
2261
2262	splx(s);
2263	return error;
2264
2265#undef IS_RUNNING
2266}
2267
2268/*
2269 * Extract various information from EEPROM.
2270 */
2271static void
2272wpi_read_eeprom(struct wpi_softc *sc)
2273{
2274	struct ieee80211com *ic = &sc->sc_ic;
2275	char domain[4];
2276	int i;
2277
2278	wpi_read_prom_data(sc, WPI_EEPROM_CAPABILITIES, &sc->cap, 1);
2279	wpi_read_prom_data(sc, WPI_EEPROM_REVISION, &sc->rev, 2);
2280	wpi_read_prom_data(sc, WPI_EEPROM_TYPE, &sc->type, 1);
2281
2282	DPRINTF(("cap=%x rev=%x type=%x\n", sc->cap, le16toh(sc->rev),
2283	    sc->type));
2284
2285	/* read and print regulatory domain */
2286	wpi_read_prom_data(sc, WPI_EEPROM_DOMAIN, domain, 4);
2287	aprint_normal_dev(sc->sc_dev, "%.4s", domain);
2288
2289	/* read and print MAC address */
2290	wpi_read_prom_data(sc, WPI_EEPROM_MAC, ic->ic_myaddr, 6);
2291	aprint_normal(", address %s\n", ether_sprintf(ic->ic_myaddr));
2292
2293	/* read the list of authorized channels */
2294	for (i = 0; i < WPI_CHAN_BANDS_COUNT; i++)
2295		wpi_read_eeprom_channels(sc, i);
2296
2297	/* read the list of power groups */
2298	for (i = 0; i < WPI_POWER_GROUPS_COUNT; i++)
2299		wpi_read_eeprom_group(sc, i);
2300}
2301
2302static void
2303wpi_read_eeprom_channels(struct wpi_softc *sc, int n)
2304{
2305	struct ieee80211com *ic = &sc->sc_ic;
2306	const struct wpi_chan_band *band = &wpi_bands[n];
2307	struct wpi_eeprom_chan channels[WPI_MAX_CHAN_PER_BAND];
2308	int chan, i;
2309
2310	wpi_read_prom_data(sc, band->addr, channels,
2311	    band->nchan * sizeof (struct wpi_eeprom_chan));
2312
2313	for (i = 0; i < band->nchan; i++) {
2314		if (!(channels[i].flags & WPI_EEPROM_CHAN_VALID))
2315			continue;
2316
2317		chan = band->chan[i];
2318
2319		if (n == 0) {	/* 2GHz band */
2320			ic->ic_channels[chan].ic_freq =
2321			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
2322			ic->ic_channels[chan].ic_flags =
2323			    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2324			    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2325
2326		} else {	/* 5GHz band */
2327			/*
2328			 * Some 3945ABG adapters support channels 7, 8, 11
2329			 * and 12 in the 2GHz *and* 5GHz bands.
2330			 * Because of limitations in our net80211(9) stack,
2331			 * we can't support these channels in 5GHz band.
2332			 */
2333			if (chan <= 14)
2334				continue;
2335
2336			ic->ic_channels[chan].ic_freq =
2337			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
2338			ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
2339		}
2340
2341		/* is active scan allowed on this channel? */
2342		if (!(channels[i].flags & WPI_EEPROM_CHAN_ACTIVE)) {
2343			ic->ic_channels[chan].ic_flags |=
2344			    IEEE80211_CHAN_PASSIVE;
2345		}
2346
2347		/* save maximum allowed power for this channel */
2348		sc->maxpwr[chan] = channels[i].maxpwr;
2349
2350		DPRINTF(("adding chan %d flags=0x%x maxpwr=%d\n",
2351		    chan, channels[i].flags, sc->maxpwr[chan]));
2352	}
2353}
2354
2355static void
2356wpi_read_eeprom_group(struct wpi_softc *sc, int n)
2357{
2358	struct wpi_power_group *group = &sc->groups[n];
2359	struct wpi_eeprom_group rgroup;
2360	int i;
2361
2362	wpi_read_prom_data(sc, WPI_EEPROM_POWER_GRP + n * 32, &rgroup,
2363	    sizeof rgroup);
2364
2365	/* save power group information */
2366	group->chan   = rgroup.chan;
2367	group->maxpwr = rgroup.maxpwr;
2368	/* temperature at which the samples were taken */
2369	group->temp   = (int16_t)le16toh(rgroup.temp);
2370
2371	DPRINTF(("power group %d: chan=%d maxpwr=%d temp=%d\n", n,
2372	    group->chan, group->maxpwr, group->temp));
2373
2374	for (i = 0; i < WPI_SAMPLES_COUNT; i++) {
2375		group->samples[i].index = rgroup.samples[i].index;
2376		group->samples[i].power = rgroup.samples[i].power;
2377
2378		DPRINTF(("\tsample %d: index=%d power=%d\n", i,
2379		    group->samples[i].index, group->samples[i].power));
2380	}
2381}
2382
2383/*
2384 * Send a command to the firmware.
2385 */
2386static int
2387wpi_cmd(struct wpi_softc *sc, int code, const void *buf, int size, int async)
2388{
2389	struct wpi_tx_ring *ring = &sc->cmdq;
2390	struct wpi_tx_desc *desc;
2391	struct wpi_tx_cmd *cmd;
2392	struct wpi_dma_info *dma;
2393
2394	KASSERT(size <= sizeof cmd->data);
2395
2396	desc = &ring->desc[ring->cur];
2397	cmd = &ring->cmd[ring->cur];
2398
2399	cmd->code = code;
2400	cmd->flags = 0;
2401	cmd->qid = ring->qid;
2402	cmd->idx = ring->cur;
2403	memcpy(cmd->data, buf, size);
2404
2405	dma = &ring->cmd_dma;
2406	bus_dmamap_sync(dma->tag, dma->map, 0, dma->size, BUS_DMASYNC_PREWRITE);
2407
2408	desc->flags = htole32(WPI_PAD32(size) << 28 | 1 << 24);
2409	desc->segs[0].addr = htole32(ring->cmd_dma.paddr +
2410	    ring->cur * sizeof (struct wpi_tx_cmd));
2411	desc->segs[0].len  = htole32(4 + size);
2412
2413	dma = &ring->desc_dma;
2414	bus_dmamap_sync(dma->tag, dma->map, 0, dma->size, BUS_DMASYNC_PREWRITE);
2415
2416	/* kick cmd ring */
2417	ring->cur = (ring->cur + 1) % WPI_CMD_RING_COUNT;
2418	WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2419
2420	return async ? 0 : tsleep(cmd, PCATCH, "wpicmd", hz);
2421}
2422
2423static int
2424wpi_wme_update(struct ieee80211com *ic)
2425{
2426#define WPI_EXP2(v)	htole16((1 << (v)) - 1)
2427#define WPI_USEC(v)	htole16(IEEE80211_TXOP_TO_US(v))
2428	struct wpi_softc *sc = ic->ic_ifp->if_softc;
2429	const struct wmeParams *wmep;
2430	struct wpi_wme_setup wme;
2431	int ac;
2432
2433	/* don't override default WME values if WME is not actually enabled */
2434	if (!(ic->ic_flags & IEEE80211_F_WME))
2435		return 0;
2436
2437	wme.flags = 0;
2438	for (ac = 0; ac < WME_NUM_AC; ac++) {
2439		wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
2440		wme.ac[ac].aifsn = wmep->wmep_aifsn;
2441		wme.ac[ac].cwmin = WPI_EXP2(wmep->wmep_logcwmin);
2442		wme.ac[ac].cwmax = WPI_EXP2(wmep->wmep_logcwmax);
2443		wme.ac[ac].txop  = WPI_USEC(wmep->wmep_txopLimit);
2444
2445		DPRINTF(("setting WME for queue %d aifsn=%d cwmin=%d cwmax=%d "
2446		    "txop=%d\n", ac, wme.ac[ac].aifsn, wme.ac[ac].cwmin,
2447		    wme.ac[ac].cwmax, wme.ac[ac].txop));
2448	}
2449
2450	return wpi_cmd(sc, WPI_CMD_SET_WME, &wme, sizeof wme, 1);
2451#undef WPI_USEC
2452#undef WPI_EXP2
2453}
2454
2455/*
2456 * Configure h/w multi-rate retries.
2457 */
2458static int
2459wpi_mrr_setup(struct wpi_softc *sc)
2460{
2461	struct ieee80211com *ic = &sc->sc_ic;
2462	struct wpi_mrr_setup mrr;
2463	int i, error;
2464
2465	/* CCK rates (not used with 802.11a) */
2466	for (i = WPI_CCK1; i <= WPI_CCK11; i++) {
2467		mrr.rates[i].flags = 0;
2468		mrr.rates[i].plcp = wpi_ridx_to_plcp[i];
2469		/* fallback to the immediate lower CCK rate (if any) */
2470		mrr.rates[i].next = (i == WPI_CCK1) ? WPI_CCK1 : i - 1;
2471		/* try one time at this rate before falling back to "next" */
2472		mrr.rates[i].ntries = 1;
2473	}
2474
2475	/* OFDM rates (not used with 802.11b) */
2476	for (i = WPI_OFDM6; i <= WPI_OFDM54; i++) {
2477		mrr.rates[i].flags = 0;
2478		mrr.rates[i].plcp = wpi_ridx_to_plcp[i];
2479		/* fallback to the immediate lower rate (if any) */
2480		/* we allow fallback from OFDM/6 to CCK/2 in 11b/g mode */
2481		mrr.rates[i].next = (i == WPI_OFDM6) ?
2482		    ((ic->ic_curmode == IEEE80211_MODE_11A) ?
2483			WPI_OFDM6 : WPI_CCK2) :
2484		    i - 1;
2485		/* try one time at this rate before falling back to "next" */
2486		mrr.rates[i].ntries = 1;
2487	}
2488
2489	/* setup MRR for control frames */
2490	mrr.which = htole32(WPI_MRR_CTL);
2491	error = wpi_cmd(sc, WPI_CMD_MRR_SETUP, &mrr, sizeof mrr, 0);
2492	if (error != 0) {
2493		aprint_error_dev(sc->sc_dev,
2494		    "could not setup MRR for control frames\n");
2495		return error;
2496	}
2497
2498	/* setup MRR for data frames */
2499	mrr.which = htole32(WPI_MRR_DATA);
2500	error = wpi_cmd(sc, WPI_CMD_MRR_SETUP, &mrr, sizeof mrr, 0);
2501	if (error != 0) {
2502		aprint_error_dev(sc->sc_dev,
2503		    "could not setup MRR for data frames\n");
2504		return error;
2505	}
2506
2507	return 0;
2508}
2509
2510static void
2511wpi_set_led(struct wpi_softc *sc, uint8_t which, uint8_t off, uint8_t on)
2512{
2513	struct wpi_cmd_led led;
2514
2515	led.which = which;
2516	led.unit = htole32(100000);	/* on/off in unit of 100ms */
2517	led.off = off;
2518	led.on = on;
2519
2520	(void)wpi_cmd(sc, WPI_CMD_SET_LED, &led, sizeof led, 1);
2521}
2522
2523static void
2524wpi_enable_tsf(struct wpi_softc *sc, struct ieee80211_node *ni)
2525{
2526	struct wpi_cmd_tsf tsf;
2527	uint64_t val, mod;
2528
2529	memset(&tsf, 0, sizeof tsf);
2530	memcpy(&tsf.tstamp, ni->ni_tstamp.data, sizeof (uint64_t));
2531	tsf.bintval = htole16(ni->ni_intval);
2532	tsf.lintval = htole16(10);
2533
2534	/* compute remaining time until next beacon */
2535	val = (uint64_t)ni->ni_intval * 1024;	/* msecs -> usecs */
2536	mod = le64toh(tsf.tstamp) % val;
2537	tsf.binitval = htole32((uint32_t)(val - mod));
2538
2539	DPRINTF(("TSF bintval=%u tstamp=%" PRIu64 ", init=%u\n",
2540	    ni->ni_intval, le64toh(tsf.tstamp), (uint32_t)(val - mod)));
2541
2542	if (wpi_cmd(sc, WPI_CMD_TSF, &tsf, sizeof tsf, 1) != 0)
2543		aprint_error_dev(sc->sc_dev, "could not enable TSF\n");
2544}
2545
2546/*
2547 * Update Tx power to match what is defined for channel `c'.
2548 */
2549static int
2550wpi_set_txpower(struct wpi_softc *sc, struct ieee80211_channel *c, int async)
2551{
2552	struct ieee80211com *ic = &sc->sc_ic;
2553	struct wpi_power_group *group;
2554	struct wpi_cmd_txpower txpower;
2555	u_int chan;
2556	int i;
2557
2558	/* get channel number */
2559	chan = ieee80211_chan2ieee(ic, c);
2560
2561	/* find the power group to which this channel belongs */
2562	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2563		for (group = &sc->groups[1]; group < &sc->groups[4]; group++)
2564			if (chan <= group->chan)
2565				break;
2566	} else
2567		group = &sc->groups[0];
2568
2569	memset(&txpower, 0, sizeof txpower);
2570	txpower.band = IEEE80211_IS_CHAN_5GHZ(c) ? 0 : 1;
2571	txpower.chan = htole16(chan);
2572
2573	/* set Tx power for all OFDM and CCK rates */
2574	for (i = 0; i <= 11 ; i++) {
2575		/* retrieve Tx power for this channel/rate combination */
2576		int idx = wpi_get_power_index(sc, group, c,
2577		    wpi_ridx_to_rate[i]);
2578
2579		txpower.rates[i].plcp = wpi_ridx_to_plcp[i];
2580
2581		if (IEEE80211_IS_CHAN_5GHZ(c)) {
2582			txpower.rates[i].rf_gain = wpi_rf_gain_5ghz[idx];
2583			txpower.rates[i].dsp_gain = wpi_dsp_gain_5ghz[idx];
2584		} else {
2585			txpower.rates[i].rf_gain = wpi_rf_gain_2ghz[idx];
2586			txpower.rates[i].dsp_gain = wpi_dsp_gain_2ghz[idx];
2587		}
2588		DPRINTF(("chan %d/rate %d: power index %d\n", chan,
2589		    wpi_ridx_to_rate[i], idx));
2590	}
2591
2592	return wpi_cmd(sc, WPI_CMD_TXPOWER, &txpower, sizeof txpower, async);
2593}
2594
2595/*
2596 * Determine Tx power index for a given channel/rate combination.
2597 * This takes into account the regulatory information from EEPROM and the
2598 * current temperature.
2599 */
2600static int
2601wpi_get_power_index(struct wpi_softc *sc, struct wpi_power_group *group,
2602    struct ieee80211_channel *c, int rate)
2603{
2604/* fixed-point arithmetic division using a n-bit fractional part */
2605#define fdivround(a, b, n)	\
2606	((((1 << n) * (a)) / (b) + (1 << n) / 2) / (1 << n))
2607
2608/* linear interpolation */
2609#define interpolate(x, x1, y1, x2, y2, n)	\
2610	((y1) + fdivround(((x) - (x1)) * ((y2) - (y1)), (x2) - (x1), n))
2611
2612	struct ieee80211com *ic = &sc->sc_ic;
2613	struct wpi_power_sample *sample;
2614	int pwr, idx;
2615	u_int chan;
2616
2617	/* get channel number */
2618	chan = ieee80211_chan2ieee(ic, c);
2619
2620	/* default power is group's maximum power - 3dB */
2621	pwr = group->maxpwr / 2;
2622
2623	/* decrease power for highest OFDM rates to reduce distortion */
2624	switch (rate) {
2625	case 72:	/* 36Mb/s */
2626		pwr -= IEEE80211_IS_CHAN_2GHZ(c) ? 0 :  5;
2627		break;
2628	case 96:	/* 48Mb/s */
2629		pwr -= IEEE80211_IS_CHAN_2GHZ(c) ? 7 : 10;
2630		break;
2631	case 108:	/* 54Mb/s */
2632		pwr -= IEEE80211_IS_CHAN_2GHZ(c) ? 9 : 12;
2633		break;
2634	}
2635
2636	/* never exceed channel's maximum allowed Tx power */
2637	pwr = uimin(pwr, sc->maxpwr[chan]);
2638
2639	/* retrieve power index into gain tables from samples */
2640	for (sample = group->samples; sample < &group->samples[3]; sample++)
2641		if (pwr > sample[1].power)
2642			break;
2643	/* fixed-point linear interpolation using a 19-bit fractional part */
2644	idx = interpolate(pwr, sample[0].power, sample[0].index,
2645	    sample[1].power, sample[1].index, 19);
2646
2647	/*-
2648	 * Adjust power index based on current temperature:
2649	 * - if cooler than factory-calibrated: decrease output power
2650	 * - if warmer than factory-calibrated: increase output power
2651	 */
2652	idx -= (sc->temp - group->temp) * 11 / 100;
2653
2654	/* decrease power for CCK rates (-5dB) */
2655	if (!WPI_RATE_IS_OFDM(rate))
2656		idx += 10;
2657
2658	/* keep power index in a valid range */
2659	if (idx < 0)
2660		return 0;
2661	if (idx > WPI_MAX_PWR_INDEX)
2662		return WPI_MAX_PWR_INDEX;
2663	return idx;
2664
2665#undef interpolate
2666#undef fdivround
2667}
2668
2669/*
2670 * Build a beacon frame that the firmware will broadcast periodically in
2671 * IBSS or HostAP modes.
2672 */
2673static int
2674wpi_setup_beacon(struct wpi_softc *sc, struct ieee80211_node *ni)
2675{
2676	struct ieee80211com *ic = &sc->sc_ic;
2677	struct wpi_tx_ring *ring = &sc->cmdq;
2678	struct wpi_tx_desc *desc;
2679	struct wpi_tx_data *data;
2680	struct wpi_tx_cmd *cmd;
2681	struct wpi_cmd_beacon *bcn;
2682	struct ieee80211_beacon_offsets bo;
2683	struct mbuf *m0;
2684	int error;
2685
2686	desc = &ring->desc[ring->cur];
2687	data = &ring->data[ring->cur];
2688
2689	m0 = ieee80211_beacon_alloc(ic, ni, &bo);
2690	if (m0 == NULL) {
2691		aprint_error_dev(sc->sc_dev,
2692		    "could not allocate beacon frame\n");
2693		return ENOMEM;
2694	}
2695
2696	cmd = &ring->cmd[ring->cur];
2697	cmd->code = WPI_CMD_SET_BEACON;
2698	cmd->flags = 0;
2699	cmd->qid = ring->qid;
2700	cmd->idx = ring->cur;
2701
2702	bcn = (struct wpi_cmd_beacon *)cmd->data;
2703	memset(bcn, 0, sizeof (struct wpi_cmd_beacon));
2704	bcn->id = WPI_ID_BROADCAST;
2705	bcn->ofdm_mask = 0xff;
2706	bcn->cck_mask = 0x0f;
2707	bcn->lifetime = htole32(WPI_LIFETIME_INFINITE);
2708	bcn->len = htole16(m0->m_pkthdr.len);
2709	bcn->rate = (ic->ic_curmode == IEEE80211_MODE_11A) ?
2710	    wpi_plcp_signal(12) : wpi_plcp_signal(2);
2711	bcn->flags = htole32(WPI_TX_AUTO_SEQ | WPI_TX_INSERT_TSTAMP);
2712
2713	/* save and trim IEEE802.11 header */
2714	m_copydata(m0, 0, sizeof (struct ieee80211_frame), (void *)&bcn->wh);
2715	m_adj(m0, sizeof (struct ieee80211_frame));
2716
2717	/* assume beacon frame is contiguous */
2718	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
2719	    BUS_DMA_READ | BUS_DMA_NOWAIT);
2720	if (error != 0) {
2721		aprint_error_dev(sc->sc_dev, "could not map beacon\n");
2722		m_freem(m0);
2723		return error;
2724	}
2725
2726	data->m = m0;
2727
2728	/* first scatter/gather segment is used by the beacon command */
2729	desc->flags = htole32(WPI_PAD32(m0->m_pkthdr.len) << 28 | 2 << 24);
2730	desc->segs[0].addr = htole32(ring->cmd_dma.paddr +
2731	    ring->cur * sizeof (struct wpi_tx_cmd));
2732	desc->segs[0].len  = htole32(4 + sizeof (struct wpi_cmd_beacon));
2733	desc->segs[1].addr = htole32(data->map->dm_segs[0].ds_addr);
2734	desc->segs[1].len  = htole32(data->map->dm_segs[0].ds_len);
2735
2736	bus_dmamap_sync(sc->sc_dmat, ring->desc_dma.map, 0,
2737	    ring->desc_dma.map->dm_mapsize, BUS_DMASYNC_PREWRITE);
2738	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
2739	    BUS_DMASYNC_PREWRITE);
2740
2741	/* kick cmd ring */
2742	ring->cur = (ring->cur + 1) % WPI_CMD_RING_COUNT;
2743	WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2744
2745	return 0;
2746}
2747
2748static int
2749wpi_auth(struct wpi_softc *sc)
2750{
2751	struct ieee80211com *ic = &sc->sc_ic;
2752	struct ieee80211_node *ni = ic->ic_bss;
2753	struct wpi_node_info node;
2754	int error;
2755
2756	/* update adapter's configuration */
2757	IEEE80211_ADDR_COPY(sc->config.bssid, ni->ni_bssid);
2758	sc->config.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2759	sc->config.flags = htole32(WPI_CONFIG_TSF);
2760	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
2761		sc->config.flags |= htole32(WPI_CONFIG_AUTO |
2762		    WPI_CONFIG_24GHZ);
2763	}
2764	switch (ic->ic_curmode) {
2765	case IEEE80211_MODE_11A:
2766		sc->config.cck_mask  = 0;
2767		sc->config.ofdm_mask = 0x15;
2768		break;
2769	case IEEE80211_MODE_11B:
2770		sc->config.cck_mask  = 0x03;
2771		sc->config.ofdm_mask = 0;
2772		break;
2773	default:	/* assume 802.11b/g */
2774		sc->config.cck_mask  = 0x0f;
2775		sc->config.ofdm_mask = 0x15;
2776	}
2777	DPRINTF(("config chan %d flags %x cck %x ofdm %x\n", sc->config.chan,
2778	    sc->config.flags, sc->config.cck_mask, sc->config.ofdm_mask));
2779	error = wpi_cmd(sc, WPI_CMD_CONFIGURE, &sc->config,
2780	    sizeof (struct wpi_config), 1);
2781	if (error != 0) {
2782		aprint_error_dev(sc->sc_dev, "could not configure\n");
2783		return error;
2784	}
2785
2786	/* configuration has changed, set Tx power accordingly */
2787	if ((error = wpi_set_txpower(sc, ni->ni_chan, 1)) != 0) {
2788		aprint_error_dev(sc->sc_dev, "could not set Tx power\n");
2789		return error;
2790	}
2791
2792	/* add default node */
2793	memset(&node, 0, sizeof node);
2794	IEEE80211_ADDR_COPY(node.bssid, ni->ni_bssid);
2795	node.id = WPI_ID_BSS;
2796	node.rate = (ic->ic_curmode == IEEE80211_MODE_11A) ?
2797	    wpi_plcp_signal(12) : wpi_plcp_signal(2);
2798	node.action = htole32(WPI_ACTION_SET_RATE);
2799	node.antenna = WPI_ANTENNA_BOTH;
2800	error = wpi_cmd(sc, WPI_CMD_ADD_NODE, &node, sizeof node, 1);
2801	if (error != 0) {
2802		aprint_error_dev(sc->sc_dev, "could not add BSS node\n");
2803		return error;
2804	}
2805
2806	return 0;
2807}
2808
2809/*
2810 * Send a scan request to the firmware.  Since this command is huge, we map it
2811 * into a mbuf instead of using the pre-allocated set of commands.
2812 */
2813static int
2814wpi_scan(struct wpi_softc *sc)
2815{
2816	struct ieee80211com *ic = &sc->sc_ic;
2817	struct wpi_tx_ring *ring = &sc->cmdq;
2818	struct wpi_tx_desc *desc;
2819	struct wpi_tx_data *data;
2820	struct wpi_tx_cmd *cmd;
2821	struct wpi_scan_hdr *hdr;
2822	struct wpi_scan_chan *chan;
2823	struct ieee80211_frame *wh;
2824	struct ieee80211_rateset *rs;
2825	struct ieee80211_channel *c;
2826	uint8_t *frm;
2827	int pktlen, error, nrates;
2828
2829	if (ic->ic_curchan == NULL)
2830		return EIO;
2831
2832	desc = &ring->desc[ring->cur];
2833	data = &ring->data[ring->cur];
2834
2835	MGETHDR(data->m, M_DONTWAIT, MT_DATA);
2836	if (data->m == NULL) {
2837		aprint_error_dev(sc->sc_dev,
2838		    "could not allocate mbuf for scan command\n");
2839		return ENOMEM;
2840	}
2841	MCLGET(data->m, M_DONTWAIT);
2842	if (!(data->m->m_flags & M_EXT)) {
2843		m_freem(data->m);
2844		data->m = NULL;
2845		aprint_error_dev(sc->sc_dev,
2846		    "could not allocate mbuf for scan command\n");
2847		return ENOMEM;
2848	}
2849
2850	cmd = mtod(data->m, struct wpi_tx_cmd *);
2851	cmd->code = WPI_CMD_SCAN;
2852	cmd->flags = 0;
2853	cmd->qid = ring->qid;
2854	cmd->idx = ring->cur;
2855
2856	hdr = (struct wpi_scan_hdr *)cmd->data;
2857	memset(hdr, 0, sizeof (struct wpi_scan_hdr));
2858	hdr->cmd.flags = htole32(WPI_TX_AUTO_SEQ);
2859	hdr->cmd.id = WPI_ID_BROADCAST;
2860	hdr->cmd.lifetime = htole32(WPI_LIFETIME_INFINITE);
2861	/*
2862	 * Move to the next channel if no packets are received within 5 msecs
2863	 * after sending the probe request (this helps to reduce the duration
2864	 * of active scans).
2865	 */
2866	hdr->quiet = htole16(5);	/* timeout in milliseconds */
2867	hdr->plcp_threshold = htole16(1);	/* min # of packets */
2868
2869	if (ic->ic_curchan->ic_flags & IEEE80211_CHAN_5GHZ) {
2870		hdr->crc_threshold = htole16(1);
2871		/* send probe requests at 6Mbps */
2872		hdr->cmd.rate = wpi_plcp_signal(12);
2873		rs = &ic->ic_sup_rates[IEEE80211_MODE_11A];
2874	} else {
2875		hdr->flags = htole32(WPI_CONFIG_24GHZ | WPI_CONFIG_AUTO);
2876		/* send probe requests at 1Mbps */
2877		hdr->cmd.rate = wpi_plcp_signal(2);
2878		rs = &ic->ic_sup_rates[IEEE80211_MODE_11G];
2879	}
2880
2881	/* for directed scans, firmware inserts the essid IE itself */
2882	if (ic->ic_des_esslen != 0) {
2883		hdr->essid[0].id  = IEEE80211_ELEMID_SSID;
2884		hdr->essid[0].len = ic->ic_des_esslen;
2885		memcpy(hdr->essid[0].data, ic->ic_des_essid, ic->ic_des_esslen);
2886	}
2887
2888	/*
2889	 * Build a probe request frame.  Most of the following code is a
2890	 * copy & paste of what is done in net80211.
2891	 */
2892	wh = (struct ieee80211_frame *)(hdr + 1);
2893	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2894	    IEEE80211_FC0_SUBTYPE_PROBE_REQ;
2895	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2896	IEEE80211_ADDR_COPY(wh->i_addr1, etherbroadcastaddr);
2897	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
2898	IEEE80211_ADDR_COPY(wh->i_addr3, etherbroadcastaddr);
2899	*(u_int16_t *)&wh->i_dur[0] = 0;	/* filled by h/w */
2900	*(u_int16_t *)&wh->i_seq[0] = 0;	/* filled by h/w */
2901
2902	frm = (uint8_t *)(wh + 1);
2903
2904	/* add empty essid IE (firmware generates it for directed scans) */
2905	*frm++ = IEEE80211_ELEMID_SSID;
2906	*frm++ = 0;
2907
2908	/* add supported rates IE */
2909	*frm++ = IEEE80211_ELEMID_RATES;
2910	nrates = rs->rs_nrates;
2911	if (nrates > IEEE80211_RATE_SIZE)
2912		nrates = IEEE80211_RATE_SIZE;
2913	*frm++ = nrates;
2914	memcpy(frm, rs->rs_rates, nrates);
2915	frm += nrates;
2916
2917	/* add supported xrates IE */
2918	if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
2919		nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
2920		*frm++ = IEEE80211_ELEMID_XRATES;
2921		*frm++ = nrates;
2922		memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
2923		frm += nrates;
2924	}
2925
2926	/* setup length of probe request */
2927	hdr->cmd.len = htole16(frm - (uint8_t *)wh);
2928
2929	chan = (struct wpi_scan_chan *)frm;
2930	c = ic->ic_curchan;
2931
2932	chan->chan = ieee80211_chan2ieee(ic, c);
2933	chan->flags = 0;
2934	if (!(c->ic_flags & IEEE80211_CHAN_PASSIVE)) {
2935		chan->flags |= WPI_CHAN_ACTIVE;
2936		if (ic->ic_des_esslen != 0)
2937			chan->flags |= WPI_CHAN_DIRECT;
2938	}
2939	chan->dsp_gain = 0x6e;
2940	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2941		chan->rf_gain = 0x3b;
2942		chan->active  = htole16(10);
2943		chan->passive = htole16(110);
2944	} else {
2945		chan->rf_gain = 0x28;
2946		chan->active  = htole16(20);
2947		chan->passive = htole16(120);
2948	}
2949	hdr->nchan++;
2950	chan++;
2951
2952	frm += sizeof (struct wpi_scan_chan);
2953
2954	hdr->len = htole16(frm - (uint8_t *)hdr);
2955	pktlen = frm - (uint8_t *)cmd;
2956
2957	error = bus_dmamap_load(sc->sc_dmat, data->map, cmd, pktlen, NULL,
2958	    BUS_DMA_NOWAIT);
2959	if (error != 0) {
2960		aprint_error_dev(sc->sc_dev, "could not map scan command\n");
2961		m_freem(data->m);
2962		data->m = NULL;
2963		return error;
2964	}
2965
2966	desc->flags = htole32(WPI_PAD32(pktlen) << 28 | 1 << 24);
2967	desc->segs[0].addr = htole32(data->map->dm_segs[0].ds_addr);
2968	desc->segs[0].len  = htole32(data->map->dm_segs[0].ds_len);
2969
2970	bus_dmamap_sync(sc->sc_dmat, ring->desc_dma.map, 0,
2971	    ring->desc_dma.map->dm_mapsize, BUS_DMASYNC_PREWRITE);
2972	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
2973	    BUS_DMASYNC_PREWRITE);
2974
2975	/* kick cmd ring */
2976	ring->cur = (ring->cur + 1) % WPI_CMD_RING_COUNT;
2977	WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2978
2979	return 0;	/* will be notified async. of failure/success */
2980}
2981
2982static int
2983wpi_config(struct wpi_softc *sc)
2984{
2985	struct ieee80211com *ic = &sc->sc_ic;
2986	struct ifnet *ifp = ic->ic_ifp;
2987	struct wpi_power power;
2988	struct wpi_bluetooth bluetooth;
2989	struct wpi_node_info node;
2990	int error;
2991
2992	memset(&power, 0, sizeof power);
2993	power.flags = htole32(WPI_POWER_CAM | 0x8);
2994	error = wpi_cmd(sc, WPI_CMD_SET_POWER_MODE, &power, sizeof power, 0);
2995	if (error != 0) {
2996		aprint_error_dev(sc->sc_dev, "could not set power mode\n");
2997		return error;
2998	}
2999
3000	/* configure bluetooth coexistence */
3001	memset(&bluetooth, 0, sizeof bluetooth);
3002	bluetooth.flags = 3;
3003	bluetooth.lead = 0xaa;
3004	bluetooth.kill = 1;
3005	error = wpi_cmd(sc, WPI_CMD_BLUETOOTH, &bluetooth, sizeof bluetooth,
3006	    0);
3007	if (error != 0) {
3008		aprint_error_dev(sc->sc_dev,
3009			"could not configure bluetooth coexistence\n");
3010		return error;
3011	}
3012
3013	/* configure adapter */
3014	memset(&sc->config, 0, sizeof (struct wpi_config));
3015	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3016	IEEE80211_ADDR_COPY(sc->config.myaddr, ic->ic_myaddr);
3017	/* set default channel */
3018	sc->config.chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
3019	sc->config.flags = htole32(WPI_CONFIG_TSF);
3020	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
3021		sc->config.flags |= htole32(WPI_CONFIG_AUTO |
3022		    WPI_CONFIG_24GHZ);
3023	}
3024	sc->config.filter = 0;
3025	switch (ic->ic_opmode) {
3026	case IEEE80211_M_STA:
3027		sc->config.mode = WPI_MODE_STA;
3028		sc->config.filter |= htole32(WPI_FILTER_MULTICAST);
3029		break;
3030	case IEEE80211_M_IBSS:
3031	case IEEE80211_M_AHDEMO:
3032		sc->config.mode = WPI_MODE_IBSS;
3033		break;
3034	case IEEE80211_M_HOSTAP:
3035		sc->config.mode = WPI_MODE_HOSTAP;
3036		break;
3037	case IEEE80211_M_MONITOR:
3038		sc->config.mode = WPI_MODE_MONITOR;
3039		sc->config.filter |= htole32(WPI_FILTER_MULTICAST |
3040		    WPI_FILTER_CTL | WPI_FILTER_PROMISC);
3041		break;
3042	}
3043	sc->config.cck_mask  = 0x0f;	/* not yet negotiated */
3044	sc->config.ofdm_mask = 0xff;	/* not yet negotiated */
3045	error = wpi_cmd(sc, WPI_CMD_CONFIGURE, &sc->config,
3046	    sizeof (struct wpi_config), 0);
3047	if (error != 0) {
3048		aprint_error_dev(sc->sc_dev, "configure command failed\n");
3049		return error;
3050	}
3051
3052	/* configuration has changed, set Tx power accordingly */
3053	if ((error = wpi_set_txpower(sc, ic->ic_curchan, 0)) != 0) {
3054		aprint_error_dev(sc->sc_dev, "could not set Tx power\n");
3055		return error;
3056	}
3057
3058	/* add broadcast node */
3059	memset(&node, 0, sizeof node);
3060	IEEE80211_ADDR_COPY(node.bssid, etherbroadcastaddr);
3061	node.id = WPI_ID_BROADCAST;
3062	node.rate = wpi_plcp_signal(2);
3063	node.action = htole32(WPI_ACTION_SET_RATE);
3064	node.antenna = WPI_ANTENNA_BOTH;
3065	error = wpi_cmd(sc, WPI_CMD_ADD_NODE, &node, sizeof node, 0);
3066	if (error != 0) {
3067		aprint_error_dev(sc->sc_dev, "could not add broadcast node\n");
3068		return error;
3069	}
3070
3071	if ((error = wpi_mrr_setup(sc)) != 0) {
3072		aprint_error_dev(sc->sc_dev, "could not setup MRR\n");
3073		return error;
3074	}
3075
3076	return 0;
3077}
3078
3079static void
3080wpi_stop_master(struct wpi_softc *sc)
3081{
3082	uint32_t tmp;
3083	int ntries;
3084
3085	tmp = WPI_READ(sc, WPI_RESET);
3086	WPI_WRITE(sc, WPI_RESET, tmp | WPI_STOP_MASTER);
3087
3088	tmp = WPI_READ(sc, WPI_GPIO_CTL);
3089	if ((tmp & WPI_GPIO_PWR_STATUS) == WPI_GPIO_PWR_SLEEP)
3090		return;	/* already asleep */
3091
3092	for (ntries = 0; ntries < 100; ntries++) {
3093		if (WPI_READ(sc, WPI_RESET) & WPI_MASTER_DISABLED)
3094			break;
3095		DELAY(10);
3096	}
3097	if (ntries == 100) {
3098		aprint_error_dev(sc->sc_dev, "timeout waiting for master\n");
3099	}
3100}
3101
3102static int
3103wpi_power_up(struct wpi_softc *sc)
3104{
3105	uint32_t tmp;
3106	int ntries;
3107
3108	wpi_mem_lock(sc);
3109	tmp = wpi_mem_read(sc, WPI_MEM_POWER);
3110	wpi_mem_write(sc, WPI_MEM_POWER, tmp & ~0x03000000);
3111	wpi_mem_unlock(sc);
3112
3113	for (ntries = 0; ntries < 5000; ntries++) {
3114		if (WPI_READ(sc, WPI_GPIO_STATUS) & WPI_POWERED)
3115			break;
3116		DELAY(10);
3117	}
3118	if (ntries == 5000) {
3119		aprint_error_dev(sc->sc_dev,
3120		    "timeout waiting for NIC to power up\n");
3121		return ETIMEDOUT;
3122	}
3123	return 0;
3124}
3125
3126static int
3127wpi_reset(struct wpi_softc *sc)
3128{
3129	uint32_t tmp;
3130	int ntries;
3131
3132	/* clear any pending interrupts */
3133	WPI_WRITE(sc, WPI_INTR, 0xffffffff);
3134
3135	tmp = WPI_READ(sc, WPI_PLL_CTL);
3136	WPI_WRITE(sc, WPI_PLL_CTL, tmp | WPI_PLL_INIT);
3137
3138	tmp = WPI_READ(sc, WPI_CHICKEN);
3139	WPI_WRITE(sc, WPI_CHICKEN, tmp | WPI_CHICKEN_RXNOLOS);
3140
3141	tmp = WPI_READ(sc, WPI_GPIO_CTL);
3142	WPI_WRITE(sc, WPI_GPIO_CTL, tmp | WPI_GPIO_INIT);
3143
3144	/* wait for clock stabilization */
3145	for (ntries = 0; ntries < 1000; ntries++) {
3146		if (WPI_READ(sc, WPI_GPIO_CTL) & WPI_GPIO_CLOCK)
3147			break;
3148		DELAY(10);
3149	}
3150	if (ntries == 1000) {
3151		aprint_error_dev(sc->sc_dev,
3152		    "timeout waiting for clock stabilization\n");
3153		return ETIMEDOUT;
3154	}
3155
3156	/* initialize EEPROM */
3157	tmp = WPI_READ(sc, WPI_EEPROM_STATUS);
3158	if ((tmp & WPI_EEPROM_VERSION) == 0) {
3159		aprint_error_dev(sc->sc_dev, "EEPROM not found\n");
3160		return EIO;
3161	}
3162	WPI_WRITE(sc, WPI_EEPROM_STATUS, tmp & ~WPI_EEPROM_LOCKED);
3163
3164	return 0;
3165}
3166
3167static void
3168wpi_hw_config(struct wpi_softc *sc)
3169{
3170	uint32_t rev, hw;
3171
3172	/* voodoo from the reference driver */
3173	hw = WPI_READ(sc, WPI_HWCONFIG);
3174
3175	rev = pci_conf_read(sc->sc_pct, sc->sc_pcitag, PCI_CLASS_REG);
3176	rev = PCI_REVISION(rev);
3177	if ((rev & 0xc0) == 0x40)
3178		hw |= WPI_HW_ALM_MB;
3179	else if (!(rev & 0x80))
3180		hw |= WPI_HW_ALM_MM;
3181
3182	if (sc->cap == 0x80)
3183		hw |= WPI_HW_SKU_MRC;
3184
3185	hw &= ~WPI_HW_REV_D;
3186	if ((le16toh(sc->rev) & 0xf0) == 0xd0)
3187		hw |= WPI_HW_REV_D;
3188
3189	if (sc->type > 1)
3190		hw |= WPI_HW_TYPE_B;
3191
3192	DPRINTF(("setting h/w config %x\n", hw));
3193	WPI_WRITE(sc, WPI_HWCONFIG, hw);
3194}
3195
3196static int
3197wpi_init(struct ifnet *ifp)
3198{
3199	struct wpi_softc *sc = ifp->if_softc;
3200	struct ieee80211com *ic = &sc->sc_ic;
3201	uint32_t tmp;
3202	int qid, ntries, error;
3203
3204	wpi_stop(ifp,1);
3205	(void)wpi_reset(sc);
3206
3207	wpi_mem_lock(sc);
3208	wpi_mem_write(sc, WPI_MEM_CLOCK1, 0xa00);
3209	DELAY(20);
3210	tmp = wpi_mem_read(sc, WPI_MEM_PCIDEV);
3211	wpi_mem_write(sc, WPI_MEM_PCIDEV, tmp | 0x800);
3212	wpi_mem_unlock(sc);
3213
3214	(void)wpi_power_up(sc);
3215	wpi_hw_config(sc);
3216
3217	/* init Rx ring */
3218	wpi_mem_lock(sc);
3219	WPI_WRITE(sc, WPI_RX_BASE, sc->rxq.desc_dma.paddr);
3220	WPI_WRITE(sc, WPI_RX_RIDX_PTR, sc->shared_dma.paddr +
3221	    offsetof(struct wpi_shared, next));
3222	WPI_WRITE(sc, WPI_RX_WIDX, (WPI_RX_RING_COUNT - 1) & ~7);
3223	WPI_WRITE(sc, WPI_RX_CONFIG, 0xa9601010);
3224	wpi_mem_unlock(sc);
3225
3226	/* init Tx rings */
3227	wpi_mem_lock(sc);
3228	wpi_mem_write(sc, WPI_MEM_MODE, 2);	/* bypass mode */
3229	wpi_mem_write(sc, WPI_MEM_RA, 1);	/* enable RA0 */
3230	wpi_mem_write(sc, WPI_MEM_TXCFG, 0x3f);	/* enable all 6 Tx rings */
3231	wpi_mem_write(sc, WPI_MEM_BYPASS1, 0x10000);
3232	wpi_mem_write(sc, WPI_MEM_BYPASS2, 0x30002);
3233	wpi_mem_write(sc, WPI_MEM_MAGIC4, 4);
3234	wpi_mem_write(sc, WPI_MEM_MAGIC5, 5);
3235
3236	WPI_WRITE(sc, WPI_TX_BASE_PTR, sc->shared_dma.paddr);
3237	WPI_WRITE(sc, WPI_MSG_CONFIG, 0xffff05a5);
3238
3239	for (qid = 0; qid < 6; qid++) {
3240		WPI_WRITE(sc, WPI_TX_CTL(qid), 0);
3241		WPI_WRITE(sc, WPI_TX_BASE(qid), 0);
3242		WPI_WRITE(sc, WPI_TX_CONFIG(qid), 0x80200008);
3243	}
3244	wpi_mem_unlock(sc);
3245
3246	/* clear "radio off" and "disable command" bits (reversed logic) */
3247	WPI_WRITE(sc, WPI_UCODE_CLR, WPI_RADIO_OFF);
3248	WPI_WRITE(sc, WPI_UCODE_CLR, WPI_DISABLE_CMD);
3249
3250	/* clear any pending interrupts */
3251	WPI_WRITE(sc, WPI_INTR, 0xffffffff);
3252	/* enable interrupts */
3253	WPI_WRITE(sc, WPI_MASK, WPI_INTR_MASK);
3254
3255	/* not sure why/if this is necessary... */
3256	WPI_WRITE(sc, WPI_UCODE_CLR, WPI_RADIO_OFF);
3257	WPI_WRITE(sc, WPI_UCODE_CLR, WPI_RADIO_OFF);
3258
3259	if ((error = wpi_load_firmware(sc)) != 0)
3260		/* wpi_load_firmware prints error messages for us.  */
3261		goto fail1;
3262
3263	/* Check the status of the radio switch */
3264	mutex_enter(&sc->sc_rsw_mtx);
3265	if (wpi_getrfkill(sc)) {
3266		mutex_exit(&sc->sc_rsw_mtx);
3267		aprint_error_dev(sc->sc_dev,
3268		    "radio is disabled by hardware switch\n");
3269		ifp->if_flags &= ~IFF_UP;
3270		error = EBUSY;
3271		goto fail1;
3272	}
3273	sc->sc_rsw_suspend = false;
3274	cv_broadcast(&sc->sc_rsw_cv);
3275	while (sc->sc_rsw_suspend)
3276		cv_wait(&sc->sc_rsw_cv, &sc->sc_rsw_mtx);
3277	mutex_exit(&sc->sc_rsw_mtx);
3278
3279	/* wait for thermal sensors to calibrate */
3280	for (ntries = 0; ntries < 1000; ntries++) {
3281		if ((sc->temp = (int)WPI_READ(sc, WPI_TEMPERATURE)) != 0)
3282			break;
3283		DELAY(10);
3284	}
3285	if (ntries == 1000) {
3286		aprint_error_dev(sc->sc_dev,
3287		    "timeout waiting for thermal sensors calibration\n");
3288		error = ETIMEDOUT;
3289		goto fail1;
3290	}
3291	DPRINTF(("temperature %d\n", sc->temp));
3292
3293	if ((error = wpi_config(sc)) != 0) {
3294		aprint_error_dev(sc->sc_dev, "could not configure device\n");
3295		goto fail1;
3296	}
3297
3298	ifp->if_flags &= ~IFF_OACTIVE;
3299	ifp->if_flags |= IFF_RUNNING;
3300
3301	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
3302		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
3303			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3304	}
3305	else
3306		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3307
3308	return 0;
3309
3310fail1:	wpi_stop(ifp, 1);
3311	return error;
3312}
3313
3314static void
3315wpi_stop(struct ifnet *ifp, int disable)
3316{
3317	struct wpi_softc *sc = ifp->if_softc;
3318	struct ieee80211com *ic = &sc->sc_ic;
3319	uint32_t tmp;
3320	int ac;
3321
3322	ifp->if_timer = sc->sc_tx_timer = 0;
3323	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3324
3325	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3326
3327	/* suspend rfkill test thread */
3328	mutex_enter(&sc->sc_rsw_mtx);
3329	sc->sc_rsw_suspend = true;
3330	cv_broadcast(&sc->sc_rsw_cv);
3331	while (!sc->sc_rsw_suspended)
3332		cv_wait(&sc->sc_rsw_cv, &sc->sc_rsw_mtx);
3333	mutex_exit(&sc->sc_rsw_mtx);
3334
3335	/* disable interrupts */
3336	WPI_WRITE(sc, WPI_MASK, 0);
3337	WPI_WRITE(sc, WPI_INTR, WPI_INTR_MASK);
3338	WPI_WRITE(sc, WPI_INTR_STATUS, 0xff);
3339	WPI_WRITE(sc, WPI_INTR_STATUS, 0x00070000);
3340
3341	wpi_mem_lock(sc);
3342	wpi_mem_write(sc, WPI_MEM_MODE, 0);
3343	wpi_mem_unlock(sc);
3344
3345	/* reset all Tx rings */
3346	for (ac = 0; ac < 4; ac++)
3347		wpi_reset_tx_ring(sc, &sc->txq[ac]);
3348	wpi_reset_tx_ring(sc, &sc->cmdq);
3349
3350	/* reset Rx ring */
3351	wpi_reset_rx_ring(sc, &sc->rxq);
3352
3353	wpi_mem_lock(sc);
3354	wpi_mem_write(sc, WPI_MEM_CLOCK2, 0x200);
3355	wpi_mem_unlock(sc);
3356
3357	DELAY(5);
3358
3359	wpi_stop_master(sc);
3360
3361	tmp = WPI_READ(sc, WPI_RESET);
3362	WPI_WRITE(sc, WPI_RESET, tmp | WPI_SW_RESET);
3363}
3364
3365static bool
3366wpi_resume(device_t dv, const pmf_qual_t *qual)
3367{
3368	struct wpi_softc *sc = device_private(dv);
3369
3370	(void)wpi_reset(sc);
3371
3372	return true;
3373}
3374
3375/*
3376 * Return whether or not the radio is enabled in hardware
3377 * (i.e. the rfkill switch is "off").
3378 */
3379static int
3380wpi_getrfkill(struct wpi_softc *sc)
3381{
3382	uint32_t tmp;
3383
3384	wpi_mem_lock(sc);
3385	tmp = wpi_mem_read(sc, WPI_MEM_RFKILL);
3386	wpi_mem_unlock(sc);
3387
3388	KASSERT(mutex_owned(&sc->sc_rsw_mtx));
3389	if (tmp & 0x01) {
3390		/* switch is on */
3391		if (sc->sc_rsw_status != WPI_RSW_ON) {
3392			sc->sc_rsw_status = WPI_RSW_ON;
3393			sysmon_pswitch_event(&sc->sc_rsw,
3394			    PSWITCH_EVENT_PRESSED);
3395		}
3396	} else {
3397		/* switch is off */
3398		if (sc->sc_rsw_status != WPI_RSW_OFF) {
3399			sc->sc_rsw_status = WPI_RSW_OFF;
3400			sysmon_pswitch_event(&sc->sc_rsw,
3401			    PSWITCH_EVENT_RELEASED);
3402		}
3403	}
3404
3405	return !(tmp & 0x01);
3406}
3407
3408static int
3409wpi_sysctl_radio(SYSCTLFN_ARGS)
3410{
3411	struct sysctlnode node;
3412	struct wpi_softc *sc;
3413	int val, error;
3414
3415	node = *rnode;
3416	sc = (struct wpi_softc *)node.sysctl_data;
3417
3418	mutex_enter(&sc->sc_rsw_mtx);
3419	val = !wpi_getrfkill(sc);
3420	mutex_exit(&sc->sc_rsw_mtx);
3421
3422	node.sysctl_data = &val;
3423	error = sysctl_lookup(SYSCTLFN_CALL(&node));
3424
3425	if (error || newp == NULL)
3426		return error;
3427
3428	return 0;
3429}
3430
3431static void
3432wpi_sysctlattach(struct wpi_softc *sc)
3433{
3434	int rc;
3435	const struct sysctlnode *rnode;
3436	const struct sysctlnode *cnode;
3437
3438	struct sysctllog **clog = &sc->sc_sysctllog;
3439
3440	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
3441	    CTLFLAG_PERMANENT, CTLTYPE_NODE, device_xname(sc->sc_dev),
3442	    SYSCTL_DESCR("wpi controls and statistics"),
3443	    NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL)) != 0)
3444		goto err;
3445
3446	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
3447	    CTLFLAG_PERMANENT, CTLTYPE_INT, "radio",
3448	    SYSCTL_DESCR("radio transmitter switch state (0=off, 1=on)"),
3449	    wpi_sysctl_radio, 0, (void *)sc, 0, CTL_CREATE, CTL_EOL)) != 0)
3450		goto err;
3451
3452#ifdef WPI_DEBUG
3453	/* control debugging printfs */
3454	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
3455	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
3456	    "debug", SYSCTL_DESCR("Enable debugging output"),
3457	    NULL, 0, &wpi_debug, 0, CTL_CREATE, CTL_EOL)) != 0)
3458		goto err;
3459#endif
3460
3461	return;
3462err:
3463	aprint_error("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
3464}
3465
3466static void
3467wpi_rsw_thread(void *arg)
3468{
3469	struct wpi_softc *sc = (struct wpi_softc *)arg;
3470
3471	mutex_enter(&sc->sc_rsw_mtx);
3472	for (;;) {
3473		cv_timedwait(&sc->sc_rsw_cv, &sc->sc_rsw_mtx, hz);
3474		if (sc->sc_dying) {
3475			sc->sc_rsw_lwp = NULL;
3476			cv_broadcast(&sc->sc_rsw_cv);
3477			mutex_exit(&sc->sc_rsw_mtx);
3478			kthread_exit(0);
3479		}
3480		if (sc->sc_rsw_suspend) {
3481			sc->sc_rsw_suspended = true;
3482			cv_broadcast(&sc->sc_rsw_cv);
3483			while (sc->sc_rsw_suspend || sc->sc_dying)
3484				cv_wait(&sc->sc_rsw_cv, &sc->sc_rsw_mtx);
3485			sc->sc_rsw_suspended = false;
3486			cv_broadcast(&sc->sc_rsw_cv);
3487		}
3488		wpi_getrfkill(sc);
3489	}
3490}
3491