sys/dev/wpi/if_wpi.c

   1 /*-
   2  * Copyright (c) 2006,2007
   3  *      Damien Bergamini <damien.bergamini@free.fr>
   4  *      Benjamin Close <Benjamin.Close@clearchain.com>
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #define VERSION "20071127"
  20
  21 #include <sys/cdefs.h>
  22 __FBSDID("$FreeBSD$");
  23
  24 /*
  25  * Driver for Intel PRO/Wireless 3945ABG 802.11 network adapters.
  26  *
  27  * The 3945ABG network adapter doesn't use traditional hardware as
  28  * many other adaptors do. Instead at run time the eeprom is set into a known
  29  * state and told to load boot firmware. The boot firmware loads an init and a
  30  * main  binary firmware image into SRAM on the card via DMA.
  31  * Once the firmware is loaded, the driver/hw then
  32  * communicate by way of circular dma rings via the SRAM to the firmware.
  33  *
  34  * There is 6 memory rings. 1 command ring, 1 rx data ring & 4 tx data rings.
  35  * The 4 tx data rings allow for prioritization QoS.
  36  *
  37  * The rx data ring consists of 32 dma buffers. Two registers are used to
  38  * indicate where in the ring the driver and the firmware are up to. The
  39  * driver sets the initial read index (reg1) and the initial write index (reg2),
  40  * the firmware updates the read index (reg1) on rx of a packet and fires an
  41  * interrupt. The driver then processes the buffers starting at reg1 indicating
  42  * to the firmware which buffers have been accessed by updating reg2. At the
  43  * same time allocating new memory for the processed buffer.
  44  *
  45  * A similar thing happens with the tx rings. The difference is the firmware
  46  * stop processing buffers once the queue is full and until confirmation
  47  * of a successful transmition (tx_intr) has occurred.
  48  *
  49  * The command ring operates in the same manner as the tx queues.
  50  *
  51  * All communication direct to the card (ie eeprom) is classed as Stage1
  52  * communication
  53  *
  54  * All communication via the firmware to the card is classed as State2.
  55  * The firmware consists of 2 parts. A bootstrap firmware and a runtime
  56  * firmware. The bootstrap firmware and runtime firmware are loaded
  57  * from host memory via dma to the card then told to execute. From this point
  58  * on the majority of communications between the driver and the card goes
  59  * via the firmware.
  60  */
  61
  62 #include "opt_wlan.h"
  63
  64 #include <sys/param.h>
  65 #include <sys/sysctl.h>
  66 #include <sys/sockio.h>
  67 #include <sys/mbuf.h>
  68 #include <sys/kernel.h>
  69 #include <sys/socket.h>
  70 #include <sys/systm.h>
  71 #include <sys/malloc.h>
  72 #include <sys/queue.h>
  73 #include <sys/taskqueue.h>
  74 #include <sys/module.h>
  75 #include <sys/bus.h>
  76 #include <sys/endian.h>
  77 #include <sys/linker.h>
  78 #include <sys/firmware.h>
  79
  80 #include <machine/bus.h>
  81 #include <machine/resource.h>
  82 #include <sys/rman.h>
  83
  84 #include <dev/pci/pcireg.h>
  85 #include <dev/pci/pcivar.h>
  86
  87 #include <net/bpf.h>
  88 #include <net/if.h>
  89 #include <net/if_arp.h>
  90 #include <net/ethernet.h>
  91 #include <net/if_dl.h>
  92 #include <net/if_media.h>
  93 #include <net/if_types.h>
  94
  95 #include <net80211/ieee80211_var.h>
  96 #include <net80211/ieee80211_radiotap.h>
  97 #include <net80211/ieee80211_regdomain.h>
  98 #include <net80211/ieee80211_ratectl.h>
  99
 100 #include <netinet/in.h>
 101 #include <netinet/in_systm.h>
 102 #include <netinet/in_var.h>
 103 #include <netinet/ip.h>
 104 #include <netinet/if_ether.h>
 105
 106 #include <dev/wpi/if_wpireg.h>
 107 #include <dev/wpi/if_wpivar.h>
 108
 109 #define WPI_DEBUG
 110
 111 #ifdef WPI_DEBUG
 112 #define DPRINTF(x)      do { if (wpi_debug != 0) printf x; } while (0)
 113 #define DPRINTFN(n, x)  do { if (wpi_debug & n) printf x; } while (0)
 114 #define WPI_DEBUG_SET   (wpi_debug != 0)
 115
 116 enum {
 117         WPI_DEBUG_UNUSED        = 0x00000001,   /* Unused */
 118         WPI_DEBUG_HW            = 0x00000002,   /* Stage 1 (eeprom) debugging */
 119         WPI_DEBUG_TX            = 0x00000004,   /* Stage 2 TX intrp debugging*/
 120         WPI_DEBUG_RX            = 0x00000008,   /* Stage 2 RX intrp debugging */
 121         WPI_DEBUG_CMD           = 0x00000010,   /* Stage 2 CMD intrp debugging*/
 122         WPI_DEBUG_FIRMWARE      = 0x00000020,   /* firmware(9) loading debug  */
 123         WPI_DEBUG_DMA           = 0x00000040,   /* DMA (de)allocations/syncs  */
 124         WPI_DEBUG_SCANNING      = 0x00000080,   /* Stage 2 Scanning debugging */
 125         WPI_DEBUG_NOTIFY        = 0x00000100,   /* State 2 Noftif intr debug */
 126         WPI_DEBUG_TEMP          = 0x00000200,   /* TXPower/Temp Calibration */
 127         WPI_DEBUG_OPS           = 0x00000400,   /* wpi_ops taskq debug */
 128         WPI_DEBUG_WATCHDOG      = 0x00000800,   /* Watch dog debug */
 129         WPI_DEBUG_ANY           = 0xffffffff
 130 };
 131
 132 static int wpi_debug = 0;
 133 SYSCTL_INT(_debug, OID_AUTO, wpi, CTLFLAG_RW, &wpi_debug, 0, "wpi debug level");
 134 TUNABLE_INT("debug.wpi", &wpi_debug);
 135
 136 #else
 137 #define DPRINTF(x)
 138 #define DPRINTFN(n, x)
 139 #define WPI_DEBUG_SET   0
 140 #endif
 141
 142 struct wpi_ident {
 143         uint16_t        vendor;
 144         uint16_t        device;
 145         uint16_t        subdevice;
 146         const char      *name;
 147 };
 148
 149 static const struct wpi_ident wpi_ident_table[] = {
 150         /* The below entries support ABG regardless of the subid */
 151         { 0x8086, 0x4222,    0x0, "Intel(R) PRO/Wireless 3945ABG" },
 152         { 0x8086, 0x4227,    0x0, "Intel(R) PRO/Wireless 3945ABG" },
 153         /* The below entries only support BG */
 154         { 0x8086, 0x4222, 0x1005, "Intel(R) PRO/Wireless 3945BG"  },
 155         { 0x8086, 0x4222, 0x1034, "Intel(R) PRO/Wireless 3945BG"  },
 156         { 0x8086, 0x4227, 0x1014, "Intel(R) PRO/Wireless 3945BG"  },
 157         { 0x8086, 0x4222, 0x1044, "Intel(R) PRO/Wireless 3945BG"  },
 158         { 0, 0, 0, NULL }
 159 };
 160
 161 static struct ieee80211vap *wpi_vap_create(struct ieee80211com *,
 162                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 163                     const uint8_t [IEEE80211_ADDR_LEN],
 164                     const uint8_t [IEEE80211_ADDR_LEN]);
 165 static void     wpi_vap_delete(struct ieee80211vap *);
 166 static int      wpi_dma_contig_alloc(struct wpi_softc *, struct wpi_dma_info *,
 167                     void **, bus_size_t, bus_size_t, int);
 168 static void     wpi_dma_contig_free(struct wpi_dma_info *);
 169 static void     wpi_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 170 static int      wpi_alloc_shared(struct wpi_softc *);
 171 static void     wpi_free_shared(struct wpi_softc *);
 172 static int      wpi_alloc_rx_ring(struct wpi_softc *, struct wpi_rx_ring *);
 173 static void     wpi_reset_rx_ring(struct wpi_softc *, struct wpi_rx_ring *);
 174 static void     wpi_free_rx_ring(struct wpi_softc *, struct wpi_rx_ring *);
 175 static int      wpi_alloc_tx_ring(struct wpi_softc *, struct wpi_tx_ring *,
 176                     int, int);
 177 static void     wpi_reset_tx_ring(struct wpi_softc *, struct wpi_tx_ring *);
 178 static void     wpi_free_tx_ring(struct wpi_softc *, struct wpi_tx_ring *);
 179 static int      wpi_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 180 static void     wpi_mem_lock(struct wpi_softc *);
 181 static void     wpi_mem_unlock(struct wpi_softc *);
 182 static uint32_t wpi_mem_read(struct wpi_softc *, uint16_t);
 183 static void     wpi_mem_write(struct wpi_softc *, uint16_t, uint32_t);
 184 static void     wpi_mem_write_region_4(struct wpi_softc *, uint16_t,
 185                     const uint32_t *, int);
 186 static uint16_t wpi_read_prom_data(struct wpi_softc *, uint32_t, void *, int);
 187 static int      wpi_alloc_fwmem(struct wpi_softc *);
 188 static void     wpi_free_fwmem(struct wpi_softc *);
 189 static int      wpi_load_firmware(struct wpi_softc *);
 190 static void     wpi_unload_firmware(struct wpi_softc *);
 191 static int      wpi_load_microcode(struct wpi_softc *, const uint8_t *, int);
 192 static void     wpi_rx_intr(struct wpi_softc *, struct wpi_rx_desc *,
 193                     struct wpi_rx_data *);
 194 static void     wpi_tx_intr(struct wpi_softc *, struct wpi_rx_desc *);
 195 static void     wpi_cmd_intr(struct wpi_softc *, struct wpi_rx_desc *);
 196 static void     wpi_notif_intr(struct wpi_softc *);
 197 static void     wpi_intr(void *);
 198 static uint8_t  wpi_plcp_signal(int);
 199 static void     wpi_watchdog(void *);
 200 static int      wpi_tx_data(struct wpi_softc *, struct mbuf *,
 201                     struct ieee80211_node *, int);
 202 static void     wpi_start(struct ifnet *);
 203 static void     wpi_start_locked(struct ifnet *);
 204 static int      wpi_raw_xmit(struct ieee80211_node *, struct mbuf *,
 205                     const struct ieee80211_bpf_params *);
 206 static void     wpi_scan_start(struct ieee80211com *);
 207 static void     wpi_scan_end(struct ieee80211com *);
 208 static void     wpi_set_channel(struct ieee80211com *);
 209 static void     wpi_scan_curchan(struct ieee80211_scan_state *, unsigned long);
 210 static void     wpi_scan_mindwell(struct ieee80211_scan_state *);
 211 static int      wpi_ioctl(struct ifnet *, u_long, caddr_t);
 212 static void     wpi_read_eeprom(struct wpi_softc *,
 213                     uint8_t macaddr[IEEE80211_ADDR_LEN]);
 214 static void     wpi_read_eeprom_channels(struct wpi_softc *, int);
 215 static void     wpi_read_eeprom_group(struct wpi_softc *, int);
 216 static int      wpi_cmd(struct wpi_softc *, int, const void *, int, int);
 217 static int      wpi_wme_update(struct ieee80211com *);
 218 static int      wpi_mrr_setup(struct wpi_softc *);
 219 static void     wpi_set_led(struct wpi_softc *, uint8_t, uint8_t, uint8_t);
 220 static void     wpi_enable_tsf(struct wpi_softc *, struct ieee80211_node *);
 221 #if 0
 222 static int      wpi_setup_beacon(struct wpi_softc *, struct ieee80211_node *);
 223 #endif
 224 static int      wpi_auth(struct wpi_softc *, struct ieee80211vap *);
 225 static int      wpi_run(struct wpi_softc *, struct ieee80211vap *);
 226 static int      wpi_scan(struct wpi_softc *);
 227 static int      wpi_config(struct wpi_softc *);
 228 static void     wpi_stop_master(struct wpi_softc *);
 229 static int      wpi_power_up(struct wpi_softc *);
 230 static int      wpi_reset(struct wpi_softc *);
 231 static void     wpi_hwreset(void *, int);
 232 static void     wpi_rfreset(void *, int);
 233 static void     wpi_hw_config(struct wpi_softc *);
 234 static void     wpi_init(void *);
 235 static void     wpi_init_locked(struct wpi_softc *, int);
 236 static void     wpi_stop(struct wpi_softc *);
 237 static void     wpi_stop_locked(struct wpi_softc *);
 238
 239 static int      wpi_set_txpower(struct wpi_softc *, struct ieee80211_channel *,
 240                     int);
 241 static void     wpi_calib_timeout(void *);
 242 static void     wpi_power_calibration(struct wpi_softc *, int);
 243 static int      wpi_get_power_index(struct wpi_softc *,
 244                     struct wpi_power_group *, struct ieee80211_channel *, int);
 245 #ifdef WPI_DEBUG
 246 static const char *wpi_cmd_str(int);
 247 #endif
 248 static int wpi_probe(device_t);
 249 static int wpi_attach(device_t);
 250 static int wpi_detach(device_t);
 251 static int wpi_shutdown(device_t);
 252 static int wpi_suspend(device_t);
 253 static int wpi_resume(device_t);
 254
 255 static device_method_t wpi_methods[] = {
 256         /* Device interface */
 257         DEVMETHOD(device_probe,         wpi_probe),
 258         DEVMETHOD(device_attach,        wpi_attach),
 259         DEVMETHOD(device_detach,        wpi_detach),
 260         DEVMETHOD(device_shutdown,      wpi_shutdown),
 261         DEVMETHOD(device_suspend,       wpi_suspend),
 262         DEVMETHOD(device_resume,        wpi_resume),
 263
 264         DEVMETHOD_END
 265 };
 266
 267 static driver_t wpi_driver = {
 268         "wpi",
 269         wpi_methods,
 270         sizeof (struct wpi_softc)
 271 };
 272
 273 static devclass_t wpi_devclass;
 274
 275 DRIVER_MODULE(wpi, pci, wpi_driver, wpi_devclass, NULL, NULL);
 276
 277 MODULE_VERSION(wpi, 1);
 278
 279 static const uint8_t wpi_ridx_to_plcp[] = {
 280         /* OFDM: IEEE Std 802.11a-1999, pp. 14 Table 80 */
 281         /* R1-R4 (ral/ural is R4-R1) */
 282         0xd, 0xf, 0x5, 0x7, 0x9, 0xb, 0x1, 0x3,
 283         /* CCK: device-dependent */
 284         10, 20, 55, 110
 285 };
 286
 287 static const uint8_t wpi_ridx_to_rate[] = {
 288         12, 18, 24, 36, 48, 72, 96, 108, /* OFDM */
 289         2, 4, 11, 22 /*CCK */
 290 };
 291
 292 static int
 293 wpi_probe(device_t dev)
 294 {
 295         const struct wpi_ident *ident;
 296
 297         for (ident = wpi_ident_table; ident->name != NULL; ident++) {
 298                 if (pci_get_vendor(dev) == ident->vendor &&
 299                     pci_get_device(dev) == ident->device) {
 300                         device_set_desc(dev, ident->name);
 301                         return (BUS_PROBE_DEFAULT);
 302                 }
 303         }
 304         return ENXIO;
 305 }
 306
 307 /**
 308  * Load the firmare image from disk to the allocated dma buffer.
 309  * we also maintain the reference to the firmware pointer as there
 310  * is times where we may need to reload the firmware but we are not
 311  * in a context that can access the filesystem (ie taskq cause by restart)
 312  *
 313  * @return 0 on success, an errno on failure
 314  */
 315 static int
 316 wpi_load_firmware(struct wpi_softc *sc)
 317 {
 318         const struct firmware *fp;
 319         struct wpi_dma_info *dma = &sc->fw_dma;
 320         const struct wpi_firmware_hdr *hdr;
 321         const uint8_t *itext, *idata, *rtext, *rdata, *btext;
 322         uint32_t itextsz, idatasz, rtextsz, rdatasz, btextsz;
 323         int error;
 324
 325         DPRINTFN(WPI_DEBUG_FIRMWARE,
 326             ("Attempting Loading Firmware from wpi_fw module\n"));
 327
 328         WPI_UNLOCK(sc);
 329
 330         if (sc->fw_fp == NULL && (sc->fw_fp = firmware_get("wpifw")) == NULL) {
 331                 device_printf(sc->sc_dev,
 332                     "could not load firmware image 'wpifw'\n");
 333                 error = ENOENT;
 334                 WPI_LOCK(sc);
 335                 goto fail;
 336         }
 337
 338         fp = sc->fw_fp;
 339
 340         WPI_LOCK(sc);
 341
 342         /* Validate the firmware is minimum a particular version */
 343         if (fp->version < WPI_FW_MINVERSION) {
 344             device_printf(sc->sc_dev,
 345                            "firmware version is too old. Need %d, got %d\n",
 346                            WPI_FW_MINVERSION,
 347                            fp->version);
 348             error = ENXIO;
 349             goto fail;
 350         }
 351
 352         if (fp->datasize < sizeof (struct wpi_firmware_hdr)) {
 353                 device_printf(sc->sc_dev,
 354                     "firmware file too short: %zu bytes\n", fp->datasize);
 355                 error = ENXIO;
 356                 goto fail;
 357         }
 358
 359         hdr = (const struct wpi_firmware_hdr *)fp->data;
 360
 361         /*     |  RUNTIME FIRMWARE   |    INIT FIRMWARE    | BOOT FW  |
 362            |HDR|<--TEXT-->|<--DATA-->|<--TEXT-->|<--DATA-->|<--TEXT-->| */
 363
 364         rtextsz = le32toh(hdr->rtextsz);
 365         rdatasz = le32toh(hdr->rdatasz);
 366         itextsz = le32toh(hdr->itextsz);
 367         idatasz = le32toh(hdr->idatasz);
 368         btextsz = le32toh(hdr->btextsz);
 369
 370         /* check that all firmware segments are present */
 371         if (fp->datasize < sizeof (struct wpi_firmware_hdr) +
 372                 rtextsz + rdatasz + itextsz + idatasz + btextsz) {
 373                 device_printf(sc->sc_dev,
 374                     "firmware file too short: %zu bytes\n", fp->datasize);
 375                 error = ENXIO; /* XXX appropriate error code? */
 376                 goto fail;
 377         }
 378
 379         /* get pointers to firmware segments */
 380         rtext = (const uint8_t *)(hdr + 1);
 381         rdata = rtext + rtextsz;
 382         itext = rdata + rdatasz;
 383         idata = itext + itextsz;
 384         btext = idata + idatasz;
 385
 386         DPRINTFN(WPI_DEBUG_FIRMWARE,
 387             ("Firmware Version: Major %d, Minor %d, Driver %d, \n"
 388              "runtime (text: %u, data: %u) init (text: %u, data %u) boot (text %u)\n",
 389              (le32toh(hdr->version) & 0xff000000) >> 24,
 390              (le32toh(hdr->version) & 0x00ff0000) >> 16,
 391              (le32toh(hdr->version) & 0x0000ffff),
 392              rtextsz, rdatasz,
 393              itextsz, idatasz, btextsz));
 394
 395         DPRINTFN(WPI_DEBUG_FIRMWARE,("rtext 0x%x\n", *(const uint32_t *)rtext));
 396         DPRINTFN(WPI_DEBUG_FIRMWARE,("rdata 0x%x\n", *(const uint32_t *)rdata));
 397         DPRINTFN(WPI_DEBUG_FIRMWARE,("itext 0x%x\n", *(const uint32_t *)itext));
 398         DPRINTFN(WPI_DEBUG_FIRMWARE,("idata 0x%x\n", *(const uint32_t *)idata));
 399         DPRINTFN(WPI_DEBUG_FIRMWARE,("btext 0x%x\n", *(const uint32_t *)btext));
 400
 401         /* sanity checks */
 402         if (rtextsz > WPI_FW_MAIN_TEXT_MAXSZ ||
 403             rdatasz > WPI_FW_MAIN_DATA_MAXSZ ||
 404             itextsz > WPI_FW_INIT_TEXT_MAXSZ ||
 405             idatasz > WPI_FW_INIT_DATA_MAXSZ ||
 406             btextsz > WPI_FW_BOOT_TEXT_MAXSZ ||
 407             (btextsz & 3) != 0) {
 408                 device_printf(sc->sc_dev, "firmware invalid\n");
 409                 error = EINVAL;
 410                 goto fail;
 411         }
 412
 413         /* copy initialization images into pre-allocated DMA-safe memory */
 414         memcpy(dma->vaddr, idata, idatasz);
 415         memcpy(dma->vaddr + WPI_FW_INIT_DATA_MAXSZ, itext, itextsz);
 416
 417         bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
 418
 419         /* tell adapter where to find initialization images */
 420         wpi_mem_lock(sc);
 421         wpi_mem_write(sc, WPI_MEM_DATA_BASE, dma->paddr);
 422         wpi_mem_write(sc, WPI_MEM_DATA_SIZE, idatasz);
 423         wpi_mem_write(sc, WPI_MEM_TEXT_BASE,
 424             dma->paddr + WPI_FW_INIT_DATA_MAXSZ);
 425         wpi_mem_write(sc, WPI_MEM_TEXT_SIZE, itextsz);
 426         wpi_mem_unlock(sc);
 427
 428         /* load firmware boot code */
 429         if ((error = wpi_load_microcode(sc, btext, btextsz)) != 0) {
 430             device_printf(sc->sc_dev, "Failed to load microcode\n");
 431             goto fail;
 432         }
 433
 434         /* now press "execute" */
 435         WPI_WRITE(sc, WPI_RESET, 0);
 436
 437         /* wait at most one second for the first alive notification */
 438         if ((error = msleep(sc, &sc->sc_mtx, PCATCH, "wpiinit", hz)) != 0) {
 439                 device_printf(sc->sc_dev,
 440                     "timeout waiting for adapter to initialize\n");
 441                 goto fail;
 442         }
 443
 444         /* copy runtime images into pre-allocated DMA-sage memory */
 445         memcpy(dma->vaddr, rdata, rdatasz);
 446         memcpy(dma->vaddr + WPI_FW_MAIN_DATA_MAXSZ, rtext, rtextsz);
 447         bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
 448
 449         /* tell adapter where to find runtime images */
 450         wpi_mem_lock(sc);
 451         wpi_mem_write(sc, WPI_MEM_DATA_BASE, dma->paddr);
 452         wpi_mem_write(sc, WPI_MEM_DATA_SIZE, rdatasz);
 453         wpi_mem_write(sc, WPI_MEM_TEXT_BASE,
 454             dma->paddr + WPI_FW_MAIN_DATA_MAXSZ);
 455         wpi_mem_write(sc, WPI_MEM_TEXT_SIZE, WPI_FW_UPDATED | rtextsz);
 456         wpi_mem_unlock(sc);
 457
 458         /* wait at most one second for the first alive notification */
 459         if ((error = msleep(sc, &sc->sc_mtx, PCATCH, "wpiinit", hz)) != 0) {
 460                 device_printf(sc->sc_dev,
 461                     "timeout waiting for adapter to initialize2\n");
 462                 goto fail;
 463         }
 464
 465         DPRINTFN(WPI_DEBUG_FIRMWARE,
 466             ("Firmware loaded to driver successfully\n"));
 467         return error;
 468 fail:
 469         wpi_unload_firmware(sc);
 470         return error;
 471 }
 472
 473 /**
 474  * Free the referenced firmware image
 475  */
 476 static void
 477 wpi_unload_firmware(struct wpi_softc *sc)
 478 {
 479
 480         if (sc->fw_fp) {
 481                 WPI_UNLOCK(sc);
 482                 firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
 483                 WPI_LOCK(sc);
 484                 sc->fw_fp = NULL;
 485         }
 486 }
 487
 488 static int
 489 wpi_attach(device_t dev)
 490 {
 491         struct wpi_softc *sc = device_get_softc(dev);
 492         struct ifnet *ifp;
 493         struct ieee80211com *ic;
 494         int ac, error, rid, supportsa = 1;
 495         uint32_t tmp;
 496         const struct wpi_ident *ident;
 497         uint8_t macaddr[IEEE80211_ADDR_LEN];
 498
 499         sc->sc_dev = dev;
 500
 501         if (bootverbose || WPI_DEBUG_SET)
 502             device_printf(sc->sc_dev,"Driver Revision %s\n", VERSION);
 503
 504         /*
 505          * Some card's only support 802.11b/g not a, check to see if
 506          * this is one such card. A 0x0 in the subdevice table indicates
 507          * the entire subdevice range is to be ignored.
 508          */
 509         for (ident = wpi_ident_table; ident->name != NULL; ident++) {
 510                 if (ident->subdevice &&
 511                     pci_get_subdevice(dev) == ident->subdevice) {
 512                     supportsa = 0;
 513                     break;
 514                 }
 515         }
 516
 517         /* Create the tasks that can be queued */
 518         TASK_INIT(&sc->sc_restarttask, 0, wpi_hwreset, sc);
 519         TASK_INIT(&sc->sc_radiotask, 0, wpi_rfreset, sc);
 520
 521         WPI_LOCK_INIT(sc);
 522
 523         callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
 524         callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
 525
 526         /* disable the retry timeout register */
 527         pci_write_config(dev, 0x41, 0, 1);
 528
 529         /* enable bus-mastering */
 530         pci_enable_busmaster(dev);
 531
 532         rid = PCIR_BAR(0);
 533         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
 534             RF_ACTIVE);
 535         if (sc->mem == NULL) {
 536                 device_printf(dev, "could not allocate memory resource\n");
 537                 error = ENOMEM;
 538                 goto fail;
 539         }
 540
 541         sc->sc_st = rman_get_bustag(sc->mem);
 542         sc->sc_sh = rman_get_bushandle(sc->mem);
 543
 544         rid = 0;
 545         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
 546             RF_ACTIVE | RF_SHAREABLE);
 547         if (sc->irq == NULL) {
 548                 device_printf(dev, "could not allocate interrupt resource\n");
 549                 error = ENOMEM;
 550                 goto fail;
 551         }
 552
 553         /*
 554          * Allocate DMA memory for firmware transfers.
 555          */
 556         if ((error = wpi_alloc_fwmem(sc)) != 0) {
 557                 printf(": could not allocate firmware memory\n");
 558                 error = ENOMEM;
 559                 goto fail;
 560         }
 561
 562         /*
 563          * Put adapter into a known state.
 564          */
 565         if ((error = wpi_reset(sc)) != 0) {
 566                 device_printf(dev, "could not reset adapter\n");
 567                 goto fail;
 568         }
 569
 570         wpi_mem_lock(sc);
 571         tmp = wpi_mem_read(sc, WPI_MEM_PCIDEV);
 572         if (bootverbose || WPI_DEBUG_SET)
 573             device_printf(sc->sc_dev, "Hardware Revision (0x%X)\n", tmp);
 574
 575         wpi_mem_unlock(sc);
 576
 577         /* Allocate shared page */
 578         if ((error = wpi_alloc_shared(sc)) != 0) {
 579                 device_printf(dev, "could not allocate shared page\n");
 580                 goto fail;
 581         }
 582
 583         /* tx data queues  - 4 for QoS purposes */
 584         for (ac = 0; ac < WME_NUM_AC; ac++) {
 585                 error = wpi_alloc_tx_ring(sc, &sc->txq[ac], WPI_TX_RING_COUNT, ac);
 586                 if (error != 0) {
 587                     device_printf(dev, "could not allocate Tx ring %d\n",ac);
 588                     goto fail;
 589                 }
 590         }
 591
 592         /* command queue to talk to the card's firmware */
 593         error = wpi_alloc_tx_ring(sc, &sc->cmdq, WPI_CMD_RING_COUNT, 4);
 594         if (error != 0) {
 595                 device_printf(dev, "could not allocate command ring\n");
 596                 goto fail;
 597         }
 598
 599         /* receive data queue */
 600         error = wpi_alloc_rx_ring(sc, &sc->rxq);
 601         if (error != 0) {
 602                 device_printf(dev, "could not allocate Rx ring\n");
 603                 goto fail;
 604         }
 605
 606         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 607         if (ifp == NULL) {
 608                 device_printf(dev, "can not if_alloc()\n");
 609                 error = ENOMEM;
 610                 goto fail;
 611         }
 612         ic = ifp->if_l2com;
 613
 614         ic->ic_ifp = ifp;
 615         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 616         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 617
 618         /* set device capabilities */
 619         ic->ic_caps =
 620                   IEEE80211_C_STA               /* station mode supported */
 621                 | IEEE80211_C_MONITOR           /* monitor mode supported */
 622                 | IEEE80211_C_TXPMGT            /* tx power management */
 623                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 624                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 625                 | IEEE80211_C_WPA               /* 802.11i */
 626 /* XXX looks like WME is partly supported? */
 627 #if 0
 628                 | IEEE80211_C_IBSS              /* IBSS mode support */
 629                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 630                 | IEEE80211_C_WME               /* 802.11e */
 631                 | IEEE80211_C_HOSTAP            /* Host access point mode */
 632 #endif
 633                 ;
 634
 635         /*
 636          * Read in the eeprom and also setup the channels for
 637          * net80211. We don't set the rates as net80211 does this for us
 638          */
 639         wpi_read_eeprom(sc, macaddr);
 640
 641         if (bootverbose || WPI_DEBUG_SET) {
 642             device_printf(sc->sc_dev, "Regulatory Domain: %.4s\n", sc->domain);
 643             device_printf(sc->sc_dev, "Hardware Type: %c\n",
 644                           sc->type > 1 ? 'B': '?');
 645             device_printf(sc->sc_dev, "Hardware Revision: %c\n",
 646                           ((le16toh(sc->rev) & 0xf0) == 0xd0) ? 'D': '?');
 647             device_printf(sc->sc_dev, "SKU %s support 802.11a\n",
 648                           supportsa ? "does" : "does not");
 649
 650             /* XXX hw_config uses the PCIDEV for the Hardware rev. Must check
 651                what sc->rev really represents - benjsc 20070615 */
 652         }
 653
 654         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 655         ifp->if_softc = sc;
 656         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 657         ifp->if_init = wpi_init;
 658         ifp->if_ioctl = wpi_ioctl;
 659         ifp->if_start = wpi_start;
 660         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 661         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 662         IFQ_SET_READY(&ifp->if_snd);
 663
 664         ieee80211_ifattach(ic, macaddr);
 665         /* override default methods */
 666         ic->ic_raw_xmit = wpi_raw_xmit;
 667         ic->ic_wme.wme_update = wpi_wme_update;
 668         ic->ic_scan_start = wpi_scan_start;
 669         ic->ic_scan_end = wpi_scan_end;
 670         ic->ic_set_channel = wpi_set_channel;
 671         ic->ic_scan_curchan = wpi_scan_curchan;
 672         ic->ic_scan_mindwell = wpi_scan_mindwell;
 673
 674         ic->ic_vap_create = wpi_vap_create;
 675         ic->ic_vap_delete = wpi_vap_delete;
 676
 677         ieee80211_radiotap_attach(ic,
 678             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 679                 WPI_TX_RADIOTAP_PRESENT,
 680             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 681                 WPI_RX_RADIOTAP_PRESENT);
 682
 683         /*
 684          * Hook our interrupt after all initialization is complete.
 685          */
 686         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET |INTR_MPSAFE,
 687             NULL, wpi_intr, sc, &sc->sc_ih);
 688         if (error != 0) {
 689                 device_printf(dev, "could not set up interrupt\n");
 690                 goto fail;
 691         }
 692
 693         if (bootverbose)
 694                 ieee80211_announce(ic);
 695 #ifdef XXX_DEBUG
 696         ieee80211_announce_channels(ic);
 697 #endif
 698         return 0;
 699
 700 fail:   wpi_detach(dev);
 701         return ENXIO;
 702 }
 703
 704 static int
 705 wpi_detach(device_t dev)
 706 {
 707         struct wpi_softc *sc = device_get_softc(dev);
 708         struct ifnet *ifp = sc->sc_ifp;
 709         struct ieee80211com *ic;
 710         int ac;
 711
 712         if (sc->irq != NULL)
 713                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
 714
 715         if (ifp != NULL) {
 716                 ic = ifp->if_l2com;
 717
 718                 ieee80211_draintask(ic, &sc->sc_restarttask);
 719                 ieee80211_draintask(ic, &sc->sc_radiotask);
 720                 wpi_stop(sc);
 721                 callout_drain(&sc->watchdog_to);
 722                 callout_drain(&sc->calib_to);
 723                 ieee80211_ifdetach(ic);
 724         }
 725
 726         WPI_LOCK(sc);
 727         if (sc->txq[0].data_dmat) {
 728                 for (ac = 0; ac < WME_NUM_AC; ac++)
 729                         wpi_free_tx_ring(sc, &sc->txq[ac]);
 730
 731                 wpi_free_tx_ring(sc, &sc->cmdq);
 732                 wpi_free_rx_ring(sc, &sc->rxq);
 733                 wpi_free_shared(sc);
 734         }
 735
 736         if (sc->fw_fp != NULL) {
 737                 wpi_unload_firmware(sc);
 738         }
 739
 740         if (sc->fw_dma.tag)
 741                 wpi_free_fwmem(sc);
 742         WPI_UNLOCK(sc);
 743
 744         if (sc->irq != NULL)
 745                 bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
 746                     sc->irq);
 747         if (sc->mem != NULL)
 748                 bus_release_resource(dev, SYS_RES_MEMORY,
 749                     rman_get_rid(sc->mem), sc->mem);
 750
 751         if (ifp != NULL)
 752                 if_free(ifp);
 753
 754         WPI_LOCK_DESTROY(sc);
 755
 756         return 0;
 757 }
 758
 759 static struct ieee80211vap *
 760 wpi_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 761     enum ieee80211_opmode opmode, int flags,
 762     const uint8_t bssid[IEEE80211_ADDR_LEN],
 763     const uint8_t mac[IEEE80211_ADDR_LEN])
 764 {
 765         struct wpi_vap *wvp;
 766         struct ieee80211vap *vap;
 767
 768         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
 769                 return NULL;
 770         wvp = (struct wpi_vap *) malloc(sizeof(struct wpi_vap),
 771             M_80211_VAP, M_NOWAIT | M_ZERO);
 772         if (wvp == NULL)
 773                 return NULL;
 774         vap = &wvp->vap;
 775         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
 776         /* override with driver methods */
 777         wvp->newstate = vap->iv_newstate;
 778         vap->iv_newstate = wpi_newstate;
 779
 780         ieee80211_ratectl_init(vap);
 781         /* complete setup */
 782         ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
 783         ic->ic_opmode = opmode;
 784         return vap;
 785 }
 786
 787 static void
 788 wpi_vap_delete(struct ieee80211vap *vap)
 789 {
 790         struct wpi_vap *wvp = WPI_VAP(vap);
 791
 792         ieee80211_ratectl_deinit(vap);
 793         ieee80211_vap_detach(vap);
 794         free(wvp, M_80211_VAP);
 795 }
 796
 797 static void
 798 wpi_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 799 {
 800         if (error != 0)
 801                 return;
 802
 803         KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
 804
 805         *(bus_addr_t *)arg = segs[0].ds_addr;
 806 }
 807
 808 /*
 809  * Allocates a contiguous block of dma memory of the requested size and
 810  * alignment. Due to limitations of the FreeBSD dma subsystem as of 20071217,
 811  * allocations greater than 4096 may fail. Hence if the requested alignment is
 812  * greater we allocate 'alignment' size extra memory and shift the vaddr and
 813  * paddr after the dma load. This bypasses the problem at the cost of a little
 814  * more memory.
 815  */
 816 static int
 817 wpi_dma_contig_alloc(struct wpi_softc *sc, struct wpi_dma_info *dma,
 818     void **kvap, bus_size_t size, bus_size_t alignment, int flags)
 819 {
 820         int error;
 821         bus_size_t align;
 822         bus_size_t reqsize;
 823
 824         DPRINTFN(WPI_DEBUG_DMA,
 825             ("Size: %zd - alignment %zd\n", size, alignment));
 826
 827         dma->size = size;
 828         dma->tag = NULL;
 829
 830         if (alignment > 4096) {
 831                 align = PAGE_SIZE;
 832                 reqsize = size + alignment;
 833         } else {
 834                 align = alignment;
 835                 reqsize = size;
 836         }
 837         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), align,
 838             0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
 839             NULL, NULL, reqsize,
 840             1, reqsize, flags,
 841             NULL, NULL, &dma->tag);
 842         if (error != 0) {
 843                 device_printf(sc->sc_dev,
 844                     "could not create shared page DMA tag\n");
 845                 goto fail;
 846         }
 847         error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr_start,
 848             flags | BUS_DMA_ZERO, &dma->map);
 849         if (error != 0) {
 850                 device_printf(sc->sc_dev,
 851                     "could not allocate shared page DMA memory\n");
 852                 goto fail;
 853         }
 854
 855         error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr_start,
 856             reqsize,  wpi_dma_map_addr, &dma->paddr_start, flags);
 857
 858         /* Save the original pointers so we can free all the memory */
 859         dma->paddr = dma->paddr_start;
 860         dma->vaddr = dma->vaddr_start;
 861
 862         /*
 863          * Check the alignment and increment by 4096 until we get the
 864          * requested alignment. Fail if can't obtain the alignment
 865          * we requested.
 866          */
 867         if ((dma->paddr & (alignment -1 )) != 0) {
 868                 int i;
 869
 870                 for (i = 0; i < alignment / 4096; i++) {
 871                         if ((dma->paddr & (alignment - 1 )) == 0)
 872                                 break;
 873                         dma->paddr += 4096;
 874                         dma->vaddr += 4096;
 875                 }
 876                 if (i == alignment / 4096) {
 877                         device_printf(sc->sc_dev,
 878                             "alignment requirement was not satisfied\n");
 879                         goto fail;
 880                 }
 881         }
 882
 883         if (error != 0) {
 884                 device_printf(sc->sc_dev,
 885                     "could not load shared page DMA map\n");
 886                 goto fail;
 887         }
 888
 889         if (kvap != NULL)
 890                 *kvap = dma->vaddr;
 891
 892         return 0;
 893
 894 fail:
 895         wpi_dma_contig_free(dma);
 896         return error;
 897 }
 898
 899 static void
 900 wpi_dma_contig_free(struct wpi_dma_info *dma)
 901 {
 902         if (dma->tag) {
 903                 if (dma->map != NULL) {
 904                         if (dma->paddr_start != 0) {
 905                                 bus_dmamap_sync(dma->tag, dma->map,
 906                                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 907                                 bus_dmamap_unload(dma->tag, dma->map);
 908                         }
 909                         bus_dmamem_free(dma->tag, &dma->vaddr_start, dma->map);
 910                 }
 911                 bus_dma_tag_destroy(dma->tag);
 912         }
 913 }
 914
 915 /*
 916  * Allocate a shared page between host and NIC.
 917  */
 918 static int
 919 wpi_alloc_shared(struct wpi_softc *sc)
 920 {
 921         int error;
 922
 923         error = wpi_dma_contig_alloc(sc, &sc->shared_dma,
 924             (void **)&sc->shared, sizeof (struct wpi_shared),
 925             PAGE_SIZE,
 926             BUS_DMA_NOWAIT);
 927
 928         if (error != 0) {
 929                 device_printf(sc->sc_dev,
 930                     "could not allocate shared area DMA memory\n");
 931         }
 932
 933         return error;
 934 }
 935
 936 static void
 937 wpi_free_shared(struct wpi_softc *sc)
 938 {
 939         wpi_dma_contig_free(&sc->shared_dma);
 940 }
 941
 942 static int
 943 wpi_alloc_rx_ring(struct wpi_softc *sc, struct wpi_rx_ring *ring)
 944 {
 945
 946         int i, error;
 947
 948         ring->cur = 0;
 949
 950         error = wpi_dma_contig_alloc(sc, &ring->desc_dma,
 951             (void **)&ring->desc, WPI_RX_RING_COUNT * sizeof (uint32_t),
 952             WPI_RING_DMA_ALIGN, BUS_DMA_NOWAIT);
 953
 954         if (error != 0) {
 955                 device_printf(sc->sc_dev,
 956                     "%s: could not allocate rx ring DMA memory, error %d\n",
 957                     __func__, error);
 958                 goto fail;
 959         }
 960
 961         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
 962             BUS_SPACE_MAXADDR_32BIT,
 963             BUS_SPACE_MAXADDR, NULL, NULL, MJUMPAGESIZE, 1,
 964             MJUMPAGESIZE, BUS_DMA_NOWAIT, NULL, NULL, &ring->data_dmat);
 965         if (error != 0) {
 966                 device_printf(sc->sc_dev,
 967                     "%s: bus_dma_tag_create_failed, error %d\n",
 968                     __func__, error);
 969                 goto fail;
 970         }
 971
 972         /*
 973          * Setup Rx buffers.
 974          */
 975         for (i = 0; i < WPI_RX_RING_COUNT; i++) {
 976                 struct wpi_rx_data *data = &ring->data[i];
 977                 struct mbuf *m;
 978                 bus_addr_t paddr;
 979
 980                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
 981                 if (error != 0) {
 982                         device_printf(sc->sc_dev,
 983                             "%s: bus_dmamap_create failed, error %d\n",
 984                             __func__, error);
 985                         goto fail;
 986                 }
 987                 m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
 988                 if (m == NULL) {
 989                         device_printf(sc->sc_dev,
 990                            "%s: could not allocate rx mbuf\n", __func__);
 991                         error = ENOMEM;
 992                         goto fail;
 993                 }
 994                 /* map page */
 995                 error = bus_dmamap_load(ring->data_dmat, data->map,
 996                     mtod(m, caddr_t), MJUMPAGESIZE,
 997                     wpi_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
 998                 if (error != 0 && error != EFBIG) {
 999                         device_printf(sc->sc_dev,
1000                             "%s: bus_dmamap_load failed, error %d\n",
1001                             __func__, error);
1002                         m_freem(m);
1003                         error = ENOMEM; /* XXX unique code */
1004                         goto fail;
1005                 }
1006                 bus_dmamap_sync(ring->data_dmat, data->map,
1007                     BUS_DMASYNC_PREWRITE);
1008
1009                 data->m = m;
1010                 ring->desc[i] = htole32(paddr);
1011         }
1012         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
1013             BUS_DMASYNC_PREWRITE);
1014         return 0;
1015 fail:
1016         wpi_free_rx_ring(sc, ring);
1017         return error;
1018 }
1019
1020 static void
1021 wpi_reset_rx_ring(struct wpi_softc *sc, struct wpi_rx_ring *ring)
1022 {
1023         int ntries;
1024
1025         wpi_mem_lock(sc);
1026
1027         WPI_WRITE(sc, WPI_RX_CONFIG, 0);
1028
1029         for (ntries = 0; ntries < 100; ntries++) {
1030                 if (WPI_READ(sc, WPI_RX_STATUS) & WPI_RX_IDLE)
1031                         break;
1032                 DELAY(10);
1033         }
1034
1035         wpi_mem_unlock(sc);
1036
1037 #ifdef WPI_DEBUG
1038         if (ntries == 100 && wpi_debug > 0)
1039                 device_printf(sc->sc_dev, "timeout resetting Rx ring\n");
1040 #endif
1041
1042         ring->cur = 0;
1043 }
1044
1045 static void
1046 wpi_free_rx_ring(struct wpi_softc *sc, struct wpi_rx_ring *ring)
1047 {
1048         int i;
1049
1050         wpi_dma_contig_free(&ring->desc_dma);
1051
1052         for (i = 0; i < WPI_RX_RING_COUNT; i++) {
1053                 struct wpi_rx_data *data = &ring->data[i];
1054
1055                 if (data->m != NULL) {
1056                         bus_dmamap_sync(ring->data_dmat, data->map,
1057                             BUS_DMASYNC_POSTREAD);
1058                         bus_dmamap_unload(ring->data_dmat, data->map);
1059                         m_freem(data->m);
1060                 }
1061                 if (data->map != NULL)
1062                         bus_dmamap_destroy(ring->data_dmat, data->map);
1063         }
1064 }
1065
1066 static int
1067 wpi_alloc_tx_ring(struct wpi_softc *sc, struct wpi_tx_ring *ring, int count,
1068         int qid)
1069 {
1070         struct wpi_tx_data *data;
1071         int i, error;
1072
1073         ring->qid = qid;
1074         ring->count = count;
1075         ring->queued = 0;
1076         ring->cur = 0;
1077         ring->data = NULL;
1078
1079         error = wpi_dma_contig_alloc(sc, &ring->desc_dma,
1080                 (void **)&ring->desc, count * sizeof (struct wpi_tx_desc),
1081                 WPI_RING_DMA_ALIGN, BUS_DMA_NOWAIT);
1082
1083         if (error != 0) {
1084             device_printf(sc->sc_dev, "could not allocate tx dma memory\n");
1085             goto fail;
1086         }
1087
1088         /* update shared page with ring's base address */
1089         sc->shared->txbase[qid] = htole32(ring->desc_dma.paddr);
1090
1091         error = wpi_dma_contig_alloc(sc, &ring->cmd_dma, (void **)&ring->cmd,
1092                 count * sizeof (struct wpi_tx_cmd), WPI_RING_DMA_ALIGN,
1093                 BUS_DMA_NOWAIT);
1094
1095         if (error != 0) {
1096                 device_printf(sc->sc_dev,
1097                     "could not allocate tx command DMA memory\n");
1098                 goto fail;
1099         }
1100
1101         ring->data = malloc(count * sizeof (struct wpi_tx_data), M_DEVBUF,
1102             M_NOWAIT | M_ZERO);
1103         if (ring->data == NULL) {
1104                 device_printf(sc->sc_dev,
1105                     "could not allocate tx data slots\n");
1106                 goto fail;
1107         }
1108
1109         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
1110             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
1111             WPI_MAX_SCATTER - 1, MCLBYTES, BUS_DMA_NOWAIT, NULL, NULL,
1112             &ring->data_dmat);
1113         if (error != 0) {
1114                 device_printf(sc->sc_dev, "could not create data DMA tag\n");
1115                 goto fail;
1116         }
1117
1118         for (i = 0; i < count; i++) {
1119                 data = &ring->data[i];
1120
1121                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
1122                 if (error != 0) {
1123                         device_printf(sc->sc_dev,
1124                             "could not create tx buf DMA map\n");
1125                         goto fail;
1126                 }
1127                 bus_dmamap_sync(ring->data_dmat, data->map,
1128                     BUS_DMASYNC_PREWRITE);
1129         }
1130
1131         return 0;
1132
1133 fail:
1134         wpi_free_tx_ring(sc, ring);
1135         return error;
1136 }
1137
1138 static void
1139 wpi_reset_tx_ring(struct wpi_softc *sc, struct wpi_tx_ring *ring)
1140 {
1141         struct wpi_tx_data *data;
1142         int i, ntries;
1143
1144         wpi_mem_lock(sc);
1145
1146         WPI_WRITE(sc, WPI_TX_CONFIG(ring->qid), 0);
1147         for (ntries = 0; ntries < 100; ntries++) {
1148                 if (WPI_READ(sc, WPI_TX_STATUS) & WPI_TX_IDLE(ring->qid))
1149                         break;
1150                 DELAY(10);
1151         }
1152 #ifdef WPI_DEBUG
1153         if (ntries == 100 && wpi_debug > 0)
1154                 device_printf(sc->sc_dev, "timeout resetting Tx ring %d\n",
1155                     ring->qid);
1156 #endif
1157         wpi_mem_unlock(sc);
1158
1159         for (i = 0; i < ring->count; i++) {
1160                 data = &ring->data[i];
1161
1162                 if (data->m != NULL) {
1163                         bus_dmamap_unload(ring->data_dmat, data->map);
1164                         m_freem(data->m);
1165                         data->m = NULL;
1166                 }
1167         }
1168
1169         ring->queued = 0;
1170         ring->cur = 0;
1171 }
1172
1173 static void
1174 wpi_free_tx_ring(struct wpi_softc *sc, struct wpi_tx_ring *ring)
1175 {
1176         struct wpi_tx_data *data;
1177         int i;
1178
1179         wpi_dma_contig_free(&ring->desc_dma);
1180         wpi_dma_contig_free(&ring->cmd_dma);
1181
1182         if (ring->data != NULL) {
1183                 for (i = 0; i < ring->count; i++) {
1184                         data = &ring->data[i];
1185
1186                         if (data->m != NULL) {
1187                                 bus_dmamap_sync(ring->data_dmat, data->map,
1188                                     BUS_DMASYNC_POSTWRITE);
1189                                 bus_dmamap_unload(ring->data_dmat, data->map);
1190                                 m_freem(data->m);
1191                                 data->m = NULL;
1192                         }
1193                 }
1194                 free(ring->data, M_DEVBUF);
1195         }
1196
1197         if (ring->data_dmat != NULL)
1198                 bus_dma_tag_destroy(ring->data_dmat);
1199 }
1200
1201 static int
1202 wpi_shutdown(device_t dev)
1203 {
1204         struct wpi_softc *sc = device_get_softc(dev);
1205
1206         WPI_LOCK(sc);
1207         wpi_stop_locked(sc);
1208         wpi_unload_firmware(sc);
1209         WPI_UNLOCK(sc);
1210
1211         return 0;
1212 }
1213
1214 static int
1215 wpi_suspend(device_t dev)
1216 {
1217         struct wpi_softc *sc = device_get_softc(dev);
1218         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1219
1220         ieee80211_suspend_all(ic);
1221         return 0;
1222 }
1223
1224 static int
1225 wpi_resume(device_t dev)
1226 {
1227         struct wpi_softc *sc = device_get_softc(dev);
1228         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1229
1230         pci_write_config(dev, 0x41, 0, 1);
1231
1232         ieee80211_resume_all(ic);
1233         return 0;
1234 }
1235
1236 /**
1237  * Called by net80211 when ever there is a change to 80211 state machine
1238  */
1239 static int
1240 wpi_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1241 {
1242         struct wpi_vap *wvp = WPI_VAP(vap);
1243         struct ieee80211com *ic = vap->iv_ic;
1244         struct ifnet *ifp = ic->ic_ifp;
1245         struct wpi_softc *sc = ifp->if_softc;
1246         int error;
1247
1248         DPRINTF(("%s: %s -> %s flags 0x%x\n", __func__,
1249                 ieee80211_state_name[vap->iv_state],
1250                 ieee80211_state_name[nstate], sc->flags));
1251
1252         IEEE80211_UNLOCK(ic);
1253         WPI_LOCK(sc);
1254         if (nstate == IEEE80211_S_SCAN && vap->iv_state != IEEE80211_S_INIT) {
1255                 /*
1256                  * On !INIT -> SCAN transitions, we need to clear any possible
1257                  * knowledge about associations.
1258                  */
1259                 error = wpi_config(sc);
1260                 if (error != 0) {
1261                         device_printf(sc->sc_dev,
1262                             "%s: device config failed, error %d\n",
1263                             __func__, error);
1264                 }
1265         }
1266         if (nstate == IEEE80211_S_AUTH ||
1267             (nstate == IEEE80211_S_ASSOC && vap->iv_state == IEEE80211_S_RUN)) {
1268                 /*
1269                  * The node must be registered in the firmware before auth.
1270                  * Also the associd must be cleared on RUN -> ASSOC
1271                  * transitions.
1272                  */
1273                 error = wpi_auth(sc, vap);
1274                 if (error != 0) {
1275                         device_printf(sc->sc_dev,
1276                             "%s: could not move to auth state, error %d\n",
1277                             __func__, error);
1278                 }
1279         }
1280         if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
1281                 error = wpi_run(sc, vap);
1282                 if (error != 0) {
1283                         device_printf(sc->sc_dev,
1284                             "%s: could not move to run state, error %d\n",
1285                             __func__, error);
1286                 }
1287         }
1288         if (nstate == IEEE80211_S_RUN) {
1289                 /* RUN -> RUN transition; just restart the timers */
1290                 wpi_calib_timeout(sc);
1291                 /* XXX split out rate control timer */
1292         }
1293         WPI_UNLOCK(sc);
1294         IEEE80211_LOCK(ic);
1295         return wvp->newstate(vap, nstate, arg);
1296 }
1297
1298 /*
1299  * Grab exclusive access to NIC memory.
1300  */
1301 static void
1302 wpi_mem_lock(struct wpi_softc *sc)
1303 {
1304         int ntries;
1305         uint32_t tmp;
1306
1307         tmp = WPI_READ(sc, WPI_GPIO_CTL);
1308         WPI_WRITE(sc, WPI_GPIO_CTL, tmp | WPI_GPIO_MAC);
1309
1310         /* spin until we actually get the lock */
1311         for (ntries = 0; ntries < 100; ntries++) {
1312                 if ((WPI_READ(sc, WPI_GPIO_CTL) &
1313                         (WPI_GPIO_CLOCK | WPI_GPIO_SLEEP)) == WPI_GPIO_CLOCK)
1314                         break;
1315                 DELAY(10);
1316         }
1317         if (ntries == 100)
1318                 device_printf(sc->sc_dev, "could not lock memory\n");
1319 }
1320
1321 /*
1322  * Release lock on NIC memory.
1323  */
1324 static void
1325 wpi_mem_unlock(struct wpi_softc *sc)
1326 {
1327         uint32_t tmp = WPI_READ(sc, WPI_GPIO_CTL);
1328         WPI_WRITE(sc, WPI_GPIO_CTL, tmp & ~WPI_GPIO_MAC);
1329 }
1330
1331 static uint32_t
1332 wpi_mem_read(struct wpi_softc *sc, uint16_t addr)
1333 {
1334         WPI_WRITE(sc, WPI_READ_MEM_ADDR, WPI_MEM_4 | addr);
1335         return WPI_READ(sc, WPI_READ_MEM_DATA);
1336 }
1337
1338 static void
1339 wpi_mem_write(struct wpi_softc *sc, uint16_t addr, uint32_t data)
1340 {
1341         WPI_WRITE(sc, WPI_WRITE_MEM_ADDR, WPI_MEM_4 | addr);
1342         WPI_WRITE(sc, WPI_WRITE_MEM_DATA, data);
1343 }
1344
1345 static void
1346 wpi_mem_write_region_4(struct wpi_softc *sc, uint16_t addr,
1347     const uint32_t *data, int wlen)
1348 {
1349         for (; wlen > 0; wlen--, data++, addr+=4)
1350                 wpi_mem_write(sc, addr, *data);
1351 }
1352
1353 /*
1354  * Read data from the EEPROM.  We access EEPROM through the MAC instead of
1355  * using the traditional bit-bang method. Data is read up until len bytes have
1356  * been obtained.
1357  */
1358 static uint16_t
1359 wpi_read_prom_data(struct wpi_softc *sc, uint32_t addr, void *data, int len)
1360 {
1361         int ntries;
1362         uint32_t val;
1363         uint8_t *out = data;
1364
1365         wpi_mem_lock(sc);
1366
1367         for (; len > 0; len -= 2, addr++) {
1368                 WPI_WRITE(sc, WPI_EEPROM_CTL, addr << 2);
1369
1370                 for (ntries = 0; ntries < 10; ntries++) {
1371                         if ((val = WPI_READ(sc, WPI_EEPROM_CTL)) & WPI_EEPROM_READY)
1372                                 break;
1373                         DELAY(5);
1374                 }
1375
1376                 if (ntries == 10) {
1377                         device_printf(sc->sc_dev, "could not read EEPROM\n");
1378                         return ETIMEDOUT;
1379                 }
1380
1381                 *out++= val >> 16;
1382                 if (len > 1)
1383                         *out ++= val >> 24;
1384         }
1385
1386         wpi_mem_unlock(sc);
1387
1388         return 0;
1389 }
1390
1391 /*
1392  * The firmware text and data segments are transferred to the NIC using DMA.
1393  * The driver just copies the firmware into DMA-safe memory and tells the NIC
1394  * where to find it.  Once the NIC has copied the firmware into its internal
1395  * memory, we can free our local copy in the driver.
1396  */
1397 static int
1398 wpi_load_microcode(struct wpi_softc *sc, const uint8_t *fw, int size)
1399 {
1400         int error, ntries;
1401
1402         DPRINTFN(WPI_DEBUG_HW,("Loading microcode  size 0x%x\n", size));
1403
1404         size /= sizeof(uint32_t);
1405
1406         wpi_mem_lock(sc);
1407
1408         wpi_mem_write_region_4(sc, WPI_MEM_UCODE_BASE,
1409             (const uint32_t *)fw, size);
1410
1411         wpi_mem_write(sc, WPI_MEM_UCODE_SRC, 0);
1412         wpi_mem_write(sc, WPI_MEM_UCODE_DST, WPI_FW_TEXT);
1413         wpi_mem_write(sc, WPI_MEM_UCODE_SIZE, size);
1414
1415         /* run microcode */
1416         wpi_mem_write(sc, WPI_MEM_UCODE_CTL, WPI_UC_RUN);
1417
1418         /* wait while the adapter is busy copying the firmware */
1419         for (error = 0, ntries = 0; ntries < 1000; ntries++) {
1420                 uint32_t status = WPI_READ(sc, WPI_TX_STATUS);
1421                 DPRINTFN(WPI_DEBUG_HW,
1422                     ("firmware status=0x%x, val=0x%x, result=0x%x\n", status,
1423                      WPI_TX_IDLE(6), status & WPI_TX_IDLE(6)));
1424                 if (status & WPI_TX_IDLE(6)) {
1425                         DPRINTFN(WPI_DEBUG_HW,
1426                             ("Status Match! - ntries = %d\n", ntries));
1427                         break;
1428                 }
1429                 DELAY(10);
1430         }
1431         if (ntries == 1000) {
1432                 device_printf(sc->sc_dev, "timeout transferring firmware\n");
1433                 error = ETIMEDOUT;
1434         }
1435
1436         /* start the microcode executing */
1437         wpi_mem_write(sc, WPI_MEM_UCODE_CTL, WPI_UC_ENABLE);
1438
1439         wpi_mem_unlock(sc);
1440
1441         return (error);
1442 }
1443
1444 static void
1445 wpi_rx_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc,
1446         struct wpi_rx_data *data)
1447 {
1448         struct ifnet *ifp = sc->sc_ifp;
1449         struct ieee80211com *ic = ifp->if_l2com;
1450         struct wpi_rx_ring *ring = &sc->rxq;
1451         struct wpi_rx_stat *stat;
1452         struct wpi_rx_head *head;
1453         struct wpi_rx_tail *tail;
1454         struct ieee80211_node *ni;
1455         struct mbuf *m, *mnew;
1456         bus_addr_t paddr;
1457         int error;
1458
1459         stat = (struct wpi_rx_stat *)(desc + 1);
1460
1461         if (stat->len > WPI_STAT_MAXLEN) {
1462                 device_printf(sc->sc_dev, "invalid rx statistic header\n");
1463                 ifp->if_ierrors++;
1464                 return;
1465         }
1466
1467         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
1468         head = (struct wpi_rx_head *)((caddr_t)(stat + 1) + stat->len);
1469         tail = (struct wpi_rx_tail *)((caddr_t)(head + 1) + le16toh(head->len));
1470
1471         DPRINTFN(WPI_DEBUG_RX, ("rx intr: idx=%d len=%d stat len=%d rssi=%d "
1472             "rate=%x chan=%d tstamp=%ju\n", ring->cur, le32toh(desc->len),
1473             le16toh(head->len), (int8_t)stat->rssi, head->rate, head->chan,
1474             (uintmax_t)le64toh(tail->tstamp)));
1475
1476         /* discard Rx frames with bad CRC early */
1477         if ((le32toh(tail->flags) & WPI_RX_NOERROR) != WPI_RX_NOERROR) {
1478                 DPRINTFN(WPI_DEBUG_RX, ("%s: rx flags error %x\n", __func__,
1479                     le32toh(tail->flags)));
1480                 ifp->if_ierrors++;
1481                 return;
1482         }
1483         if (le16toh(head->len) < sizeof (struct ieee80211_frame)) {
1484                 DPRINTFN(WPI_DEBUG_RX, ("%s: frame too short: %d\n", __func__,
1485                     le16toh(head->len)));
1486                 ifp->if_ierrors++;
1487                 return;
1488         }
1489
1490         /* XXX don't need mbuf, just dma buffer */
1491         mnew = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
1492         if (mnew == NULL) {
1493                 DPRINTFN(WPI_DEBUG_RX, ("%s: no mbuf to restock ring\n",
1494                     __func__));
1495                 ifp->if_ierrors++;
1496                 return;
1497         }
1498         bus_dmamap_unload(ring->data_dmat, data->map);
1499
1500         error = bus_dmamap_load(ring->data_dmat, data->map,
1501             mtod(mnew, caddr_t), MJUMPAGESIZE,
1502             wpi_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
1503         if (error != 0 && error != EFBIG) {
1504                 device_printf(sc->sc_dev,
1505                     "%s: bus_dmamap_load failed, error %d\n", __func__, error);
1506                 m_freem(mnew);
1507                 ifp->if_ierrors++;
1508                 return;
1509         }
1510         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1511
1512         /* finalize mbuf and swap in new one */
1513         m = data->m;
1514         m->m_pkthdr.rcvif = ifp;
1515         m->m_data = (caddr_t)(head + 1);
1516         m->m_pkthdr.len = m->m_len = le16toh(head->len);
1517
1518         data->m = mnew;
1519         /* update Rx descriptor */
1520         ring->desc[ring->cur] = htole32(paddr);
1521
1522         if (ieee80211_radiotap_active(ic)) {
1523                 struct wpi_rx_radiotap_header *tap = &sc->sc_rxtap;
1524
1525                 tap->wr_flags = 0;
1526                 tap->wr_chan_freq =
1527                         htole16(ic->ic_channels[head->chan].ic_freq);
1528                 tap->wr_chan_flags =
1529                         htole16(ic->ic_channels[head->chan].ic_flags);
1530                 tap->wr_dbm_antsignal = (int8_t)(stat->rssi - WPI_RSSI_OFFSET);
1531                 tap->wr_dbm_antnoise = (int8_t)le16toh(stat->noise);
1532                 tap->wr_tsft = tail->tstamp;
1533                 tap->wr_antenna = (le16toh(head->flags) >> 4) & 0xf;
1534                 switch (head->rate) {
1535                 /* CCK rates */
1536                 case  10: tap->wr_rate =   2; break;
1537                 case  20: tap->wr_rate =   4; break;
1538                 case  55: tap->wr_rate =  11; break;
1539                 case 110: tap->wr_rate =  22; break;
1540                 /* OFDM rates */
1541                 case 0xd: tap->wr_rate =  12; break;
1542                 case 0xf: tap->wr_rate =  18; break;
1543                 case 0x5: tap->wr_rate =  24; break;
1544                 case 0x7: tap->wr_rate =  36; break;
1545                 case 0x9: tap->wr_rate =  48; break;
1546                 case 0xb: tap->wr_rate =  72; break;
1547                 case 0x1: tap->wr_rate =  96; break;
1548                 case 0x3: tap->wr_rate = 108; break;
1549                 /* unknown rate: should not happen */
1550                 default:  tap->wr_rate =   0;
1551                 }
1552                 if (le16toh(head->flags) & 0x4)
1553                         tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1554         }
1555
1556         WPI_UNLOCK(sc);
1557
1558         ni = ieee80211_find_rxnode(ic, mtod(m, struct ieee80211_frame_min *));
1559         if (ni != NULL) {
1560                 (void) ieee80211_input(ni, m, stat->rssi, 0);
1561                 ieee80211_free_node(ni);
1562         } else
1563                 (void) ieee80211_input_all(ic, m, stat->rssi, 0);
1564
1565         WPI_LOCK(sc);
1566 }
1567
1568 static void
1569 wpi_tx_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc)
1570 {
1571         struct ifnet *ifp = sc->sc_ifp;
1572         struct wpi_tx_ring *ring = &sc->txq[desc->qid & 0x3];
1573         struct wpi_tx_data *txdata = &ring->data[desc->idx];
1574         struct wpi_tx_stat *stat = (struct wpi_tx_stat *)(desc + 1);
1575         struct ieee80211_node *ni = txdata->ni;
1576         struct ieee80211vap *vap = ni->ni_vap;
1577         int retrycnt = 0;
1578
1579         DPRINTFN(WPI_DEBUG_TX, ("tx done: qid=%d idx=%d retries=%d nkill=%d "
1580             "rate=%x duration=%d status=%x\n", desc->qid, desc->idx,
1581             stat->ntries, stat->nkill, stat->rate, le32toh(stat->duration),
1582             le32toh(stat->status)));
1583
1584         /*
1585          * Update rate control statistics for the node.
1586          * XXX we should not count mgmt frames since they're always sent at
1587          * the lowest available bit-rate.
1588          * XXX frames w/o ACK shouldn't be used either
1589          */
1590         if (stat->ntries > 0) {
1591                 DPRINTFN(WPI_DEBUG_TX, ("%d retries\n", stat->ntries));
1592                 retrycnt = 1;
1593         }
1594         ieee80211_ratectl_tx_complete(vap, ni, IEEE80211_RATECTL_TX_SUCCESS,
1595             &retrycnt, NULL);
1596
1597         /* XXX oerrors should only count errors !maxtries */
1598         if ((le32toh(stat->status) & 0xff) != 1)
1599                 ifp->if_oerrors++;
1600         else
1601                 ifp->if_opackets++;
1602
1603         bus_dmamap_sync(ring->data_dmat, txdata->map, BUS_DMASYNC_POSTWRITE);
1604         bus_dmamap_unload(ring->data_dmat, txdata->map);
1605         /* XXX handle M_TXCB? */
1606         m_freem(txdata->m);
1607         txdata->m = NULL;
1608         ieee80211_free_node(txdata->ni);
1609         txdata->ni = NULL;
1610
1611         ring->queued--;
1612
1613         sc->sc_tx_timer = 0;
1614         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1615         wpi_start_locked(ifp);
1616 }
1617
1618 static void
1619 wpi_cmd_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc)
1620 {
1621         struct wpi_tx_ring *ring = &sc->cmdq;
1622         struct wpi_tx_data *data;
1623
1624         DPRINTFN(WPI_DEBUG_CMD, ("cmd notification qid=%x idx=%d flags=%x "
1625                                  "type=%s len=%d\n", desc->qid, desc->idx,
1626                                  desc->flags, wpi_cmd_str(desc->type),
1627                                  le32toh(desc->len)));
1628
1629         if ((desc->qid & 7) != 4)
1630                 return; /* not a command ack */
1631
1632         data = &ring->data[desc->idx];
1633
1634         /* if the command was mapped in a mbuf, free it */
1635         if (data->m != NULL) {
1636                 bus_dmamap_unload(ring->data_dmat, data->map);
1637                 m_freem(data->m);
1638                 data->m = NULL;
1639         }
1640
1641         sc->flags &= ~WPI_FLAG_BUSY;
1642         wakeup(&ring->cmd[desc->idx]);
1643 }
1644
1645 static void
1646 wpi_notif_intr(struct wpi_softc *sc)
1647 {
1648         struct ifnet *ifp = sc->sc_ifp;
1649         struct ieee80211com *ic = ifp->if_l2com;
1650         struct wpi_rx_desc *desc;
1651         struct wpi_rx_data *data;
1652         uint32_t hw;
1653
1654         bus_dmamap_sync(sc->shared_dma.tag, sc->shared_dma.map,
1655             BUS_DMASYNC_POSTREAD);
1656
1657         hw = le32toh(sc->shared->next);
1658         while (sc->rxq.cur != hw) {
1659                 data = &sc->rxq.data[sc->rxq.cur];
1660
1661                 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1662                     BUS_DMASYNC_POSTREAD);
1663                 desc = (void *)data->m->m_ext.ext_buf;
1664
1665                 DPRINTFN(WPI_DEBUG_NOTIFY,
1666                          ("notify qid=%x idx=%d flags=%x type=%d len=%d\n",
1667                           desc->qid,
1668                           desc->idx,
1669                           desc->flags,
1670                           desc->type,
1671                           le32toh(desc->len)));
1672
1673                 if (!(desc->qid & 0x80))        /* reply to a command */
1674                         wpi_cmd_intr(sc, desc);
1675
1676                 switch (desc->type) {
1677                 case WPI_RX_DONE:
1678                         /* a 802.11 frame was received */
1679                         wpi_rx_intr(sc, desc, data);
1680                         break;
1681
1682                 case WPI_TX_DONE:
1683                         /* a 802.11 frame has been transmitted */
1684                         wpi_tx_intr(sc, desc);
1685                         break;
1686
1687                 case WPI_UC_READY:
1688                 {
1689                         struct wpi_ucode_info *uc =
1690                                 (struct wpi_ucode_info *)(desc + 1);
1691
1692                         /* the microcontroller is ready */
1693                         DPRINTF(("microcode alive notification version %x "
1694                                 "alive %x\n", le32toh(uc->version),
1695                                 le32toh(uc->valid)));
1696
1697                         if (le32toh(uc->valid) != 1) {
1698                                 device_printf(sc->sc_dev,
1699                                     "microcontroller initialization failed\n");
1700                                 wpi_stop_locked(sc);
1701                         }
1702                         break;
1703                 }
1704                 case WPI_STATE_CHANGED:
1705                 {
1706                         uint32_t *status = (uint32_t *)(desc + 1);
1707
1708                         /* enabled/disabled notification */
1709                         DPRINTF(("state changed to %x\n", le32toh(*status)));
1710
1711                         if (le32toh(*status) & 1) {
1712                                 device_printf(sc->sc_dev,
1713                                     "Radio transmitter is switched off\n");
1714                                 sc->flags |= WPI_FLAG_HW_RADIO_OFF;
1715                                 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1716                                 /* Disable firmware commands */
1717                                 WPI_WRITE(sc, WPI_UCODE_SET, WPI_DISABLE_CMD);
1718                         }
1719                         break;
1720                 }
1721                 case WPI_START_SCAN:
1722                 {
1723 #ifdef WPI_DEBUG
1724                         struct wpi_start_scan *scan =
1725                                 (struct wpi_start_scan *)(desc + 1);
1726 #endif
1727
1728                         DPRINTFN(WPI_DEBUG_SCANNING,
1729                                  ("scanning channel %d status %x\n",
1730                             scan->chan, le32toh(scan->status)));
1731                         break;
1732                 }
1733                 case WPI_STOP_SCAN:
1734                 {
1735 #ifdef WPI_DEBUG
1736                         struct wpi_stop_scan *scan =
1737                                 (struct wpi_stop_scan *)(desc + 1);
1738 #endif
1739                         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1740
1741                         DPRINTFN(WPI_DEBUG_SCANNING,
1742                             ("scan finished nchan=%d status=%d chan=%d\n",
1743                              scan->nchan, scan->status, scan->chan));
1744
1745                         sc->sc_scan_timer = 0;
1746                         ieee80211_scan_next(vap);
1747                         break;
1748                 }
1749                 case WPI_MISSED_BEACON:
1750                 {
1751                         struct wpi_missed_beacon *beacon =
1752                                 (struct wpi_missed_beacon *)(desc + 1);
1753                         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1754
1755                         if (le32toh(beacon->consecutive) >=
1756                             vap->iv_bmissthreshold) {
1757                                 DPRINTF(("Beacon miss: %u >= %u\n",
1758                                          le32toh(beacon->consecutive),
1759                                          vap->iv_bmissthreshold));
1760                                 ieee80211_beacon_miss(ic);
1761                         }
1762                         break;
1763                 }
1764                 }
1765
1766                 sc->rxq.cur = (sc->rxq.cur + 1) % WPI_RX_RING_COUNT;
1767         }
1768
1769         /* tell the firmware what we have processed */
1770         hw = (hw == 0) ? WPI_RX_RING_COUNT - 1 : hw - 1;
1771         WPI_WRITE(sc, WPI_RX_WIDX, hw & ~7);
1772 }
1773
1774 static void
1775 wpi_intr(void *arg)
1776 {
1777         struct wpi_softc *sc = arg;
1778         uint32_t r;
1779
1780         WPI_LOCK(sc);
1781
1782         r = WPI_READ(sc, WPI_INTR);
1783         if (r == 0 || r == 0xffffffff) {
1784                 WPI_UNLOCK(sc);
1785                 return;
1786         }
1787
1788         /* disable interrupts */
1789         WPI_WRITE(sc, WPI_MASK, 0);
1790         /* ack interrupts */
1791         WPI_WRITE(sc, WPI_INTR, r);
1792
1793         if (r & (WPI_SW_ERROR | WPI_HW_ERROR)) {
1794                 struct ifnet *ifp = sc->sc_ifp;
1795                 struct ieee80211com *ic = ifp->if_l2com;
1796                 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1797
1798                 device_printf(sc->sc_dev, "fatal firmware error\n");
1799                 DPRINTFN(6,("(%s)\n", (r & WPI_SW_ERROR) ? "(Software Error)" :
1800                                 "(Hardware Error)"));
1801                 if (vap != NULL)
1802                         ieee80211_cancel_scan(vap);
1803                 ieee80211_runtask(ic, &sc->sc_restarttask);
1804                 sc->flags &= ~WPI_FLAG_BUSY;
1805                 WPI_UNLOCK(sc);
1806                 return;
1807         }
1808
1809         if (r & WPI_RX_INTR)
1810                 wpi_notif_intr(sc);
1811
1812         if (r & WPI_ALIVE_INTR) /* firmware initialized */
1813                 wakeup(sc);
1814
1815         /* re-enable interrupts */
1816         if (sc->sc_ifp->if_flags & IFF_UP)
1817                 WPI_WRITE(sc, WPI_MASK, WPI_INTR_MASK);
1818
1819         WPI_UNLOCK(sc);
1820 }
1821
1822 static uint8_t
1823 wpi_plcp_signal(int rate)
1824 {
1825         switch (rate) {
1826         /* CCK rates (returned values are device-dependent) */
1827         case 2:         return 10;
1828         case 4:         return 20;
1829         case 11:        return 55;
1830         case 22:        return 110;
1831
1832         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1833         /* R1-R4 (ral/ural is R4-R1) */
1834         case 12:        return 0xd;
1835         case 18:        return 0xf;
1836         case 24:        return 0x5;
1837         case 36:        return 0x7;
1838         case 48:        return 0x9;
1839         case 72:        return 0xb;
1840         case 96:        return 0x1;
1841         case 108:       return 0x3;
1842
1843         /* unsupported rates (should not get there) */
1844         default:        return 0;
1845         }
1846 }
1847
1848 /* quickly determine if a given rate is CCK or OFDM */
1849 #define WPI_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1850
1851 /*
1852  * Construct the data packet for a transmit buffer and acutally put
1853  * the buffer onto the transmit ring, kicking the card to process the
1854  * the buffer.
1855  */
1856 static int
1857 wpi_tx_data(struct wpi_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1858         int ac)
1859 {
1860         struct ieee80211vap *vap = ni->ni_vap;
1861         struct ifnet *ifp = sc->sc_ifp;
1862         struct ieee80211com *ic = ifp->if_l2com;
1863         const struct chanAccParams *cap = &ic->ic_wme.wme_chanParams;
1864         struct wpi_tx_ring *ring = &sc->txq[ac];
1865         struct wpi_tx_desc *desc;
1866         struct wpi_tx_data *data;
1867         struct wpi_tx_cmd *cmd;
1868         struct wpi_cmd_data *tx;
1869         struct ieee80211_frame *wh;
1870         const struct ieee80211_txparam *tp;
1871         struct ieee80211_key *k;
1872         struct mbuf *mnew;
1873         int i, error, nsegs, rate, hdrlen, ismcast;
1874         bus_dma_segment_t segs[WPI_MAX_SCATTER];
1875
1876         desc = &ring->desc[ring->cur];
1877         data = &ring->data[ring->cur];
1878
1879         wh = mtod(m0, struct ieee80211_frame *);
1880
1881         hdrlen = ieee80211_hdrsize(wh);
1882         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
1883
1884         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1885                 k = ieee80211_crypto_encap(ni, m0);
1886                 if (k == NULL) {
1887                         m_freem(m0);
1888                         return ENOBUFS;
1889                 }
1890                 /* packet header may have moved, reset our local pointer */
1891                 wh = mtod(m0, struct ieee80211_frame *);
1892         }
1893
1894         cmd = &ring->cmd[ring->cur];
1895         cmd->code = WPI_CMD_TX_DATA;
1896         cmd->flags = 0;
1897         cmd->qid = ring->qid;
1898         cmd->idx = ring->cur;
1899
1900         tx = (struct wpi_cmd_data *)cmd->data;
1901         tx->flags = htole32(WPI_TX_AUTO_SEQ);
1902         tx->timeout = htole16(0);
1903         tx->ofdm_mask = 0xff;
1904         tx->cck_mask = 0x0f;
1905         tx->lifetime = htole32(WPI_LIFETIME_INFINITE);
1906         tx->id = ismcast ? WPI_ID_BROADCAST : WPI_ID_BSS;
1907         tx->len = htole16(m0->m_pkthdr.len);
1908
1909         if (!ismcast) {
1910                 if ((ni->ni_flags & IEEE80211_NODE_QOS) == 0 ||
1911                     !cap->cap_wmeParams[ac].wmep_noackPolicy)
1912                         tx->flags |= htole32(WPI_TX_NEED_ACK);
1913                 if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold) {
1914                         tx->flags |= htole32(WPI_TX_NEED_RTS|WPI_TX_FULL_TXOP);
1915                         tx->rts_ntries = 7;
1916                 }
1917         }
1918         /* pick a rate */
1919         tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1920         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_MGT) {
1921                 uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1922                 /* tell h/w to set timestamp in probe responses */
1923                 if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1924                         tx->flags |= htole32(WPI_TX_INSERT_TSTAMP);
1925                 if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
1926                     subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
1927                         tx->timeout = htole16(3);
1928                 else
1929                         tx->timeout = htole16(2);
1930                 rate = tp->mgmtrate;
1931         } else if (ismcast) {
1932                 rate = tp->mcastrate;
1933         } else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
1934                 rate = tp->ucastrate;
1935         } else {
1936                 (void) ieee80211_ratectl_rate(ni, NULL, 0);
1937                 rate = ni->ni_txrate;
1938         }
1939         tx->rate = wpi_plcp_signal(rate);
1940
1941         /* be very persistant at sending frames out */
1942 #if 0
1943         tx->data_ntries = tp->maxretry;
1944 #else
1945         tx->data_ntries = 15;           /* XXX way too high */
1946 #endif
1947
1948         if (ieee80211_radiotap_active_vap(vap)) {
1949                 struct wpi_tx_radiotap_header *tap = &sc->sc_txtap;
1950                 tap->wt_flags = 0;
1951                 tap->wt_rate = rate;
1952                 tap->wt_hwqueue = ac;
1953                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
1954                         tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1955
1956                 ieee80211_radiotap_tx(vap, m0);
1957         }
1958
1959         /* save and trim IEEE802.11 header */
1960         m_copydata(m0, 0, hdrlen, (caddr_t)&tx->wh);
1961         m_adj(m0, hdrlen);
1962
1963         error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m0, segs,
1964             &nsegs, BUS_DMA_NOWAIT);
1965         if (error != 0 && error != EFBIG) {
1966                 device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1967                     error);
1968                 m_freem(m0);
1969                 return error;
1970         }
1971         if (error != 0) {
1972                 /* XXX use m_collapse */
1973                 mnew = m_defrag(m0, M_NOWAIT);
1974                 if (mnew == NULL) {
1975                         device_printf(sc->sc_dev,
1976                             "could not defragment mbuf\n");
1977                         m_freem(m0);
1978                         return ENOBUFS;
1979                 }
1980                 m0 = mnew;
1981
1982                 error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map,
1983                     m0, segs, &nsegs, BUS_DMA_NOWAIT);
1984                 if (error != 0) {
1985                         device_printf(sc->sc_dev,
1986                             "could not map mbuf (error %d)\n", error);
1987                         m_freem(m0);
1988                         return error;
1989                 }
1990         }
1991
1992         data->m = m0;
1993         data->ni = ni;
1994
1995         DPRINTFN(WPI_DEBUG_TX, ("sending data: qid=%d idx=%d len=%d nsegs=%d\n",
1996             ring->qid, ring->cur, m0->m_pkthdr.len, nsegs));
1997
1998         /* first scatter/gather segment is used by the tx data command */
1999         desc->flags = htole32(WPI_PAD32(m0->m_pkthdr.len) << 28 |
2000             (1 + nsegs) << 24);
2001         desc->segs[0].addr = htole32(ring->cmd_dma.paddr +
2002             ring->cur * sizeof (struct wpi_tx_cmd));
2003         desc->segs[0].len  = htole32(4 + sizeof (struct wpi_cmd_data));
2004         for (i = 1; i <= nsegs; i++) {
2005                 desc->segs[i].addr = htole32(segs[i - 1].ds_addr);
2006                 desc->segs[i].len  = htole32(segs[i - 1].ds_len);
2007         }
2008
2009         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
2010         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2011             BUS_DMASYNC_PREWRITE);
2012
2013         ring->queued++;
2014
2015         /* kick ring */
2016         ring->cur = (ring->cur + 1) % WPI_TX_RING_COUNT;
2017         WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2018
2019         return 0;
2020 }
2021
2022 /**
2023  * Process data waiting to be sent on the IFNET output queue
2024  */
2025 static void
2026 wpi_start(struct ifnet *ifp)
2027 {
2028         struct wpi_softc *sc = ifp->if_softc;
2029
2030         WPI_LOCK(sc);
2031         wpi_start_locked(ifp);
2032         WPI_UNLOCK(sc);
2033 }
2034
2035 static void
2036 wpi_start_locked(struct ifnet *ifp)
2037 {
2038         struct wpi_softc *sc = ifp->if_softc;
2039         struct ieee80211_node *ni;
2040         struct mbuf *m;
2041         int ac;
2042
2043         WPI_LOCK_ASSERT(sc);
2044
2045         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2046                 return;
2047
2048         for (;;) {
2049                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2050                 if (m == NULL)
2051                         break;
2052                 ac = M_WME_GETAC(m);
2053                 if (sc->txq[ac].queued > sc->txq[ac].count - 8) {
2054                         /* there is no place left in this ring */
2055                         IFQ_DRV_PREPEND(&ifp->if_snd, m);
2056                         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2057                         break;
2058                 }
2059                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
2060                 if (wpi_tx_data(sc, m, ni, ac) != 0) {
2061                         ieee80211_free_node(ni);
2062                         ifp->if_oerrors++;
2063                         break;
2064                 }
2065                 sc->sc_tx_timer = 5;
2066         }
2067 }
2068
2069 static int
2070 wpi_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2071         const struct ieee80211_bpf_params *params)
2072 {
2073         struct ieee80211com *ic = ni->ni_ic;
2074         struct ifnet *ifp = ic->ic_ifp;
2075         struct wpi_softc *sc = ifp->if_softc;
2076
2077         /* prevent management frames from being sent if we're not ready */
2078         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2079                 m_freem(m);
2080                 ieee80211_free_node(ni);
2081                 return ENETDOWN;
2082         }
2083         WPI_LOCK(sc);
2084
2085         /* management frames go into ring 0 */
2086         if (sc->txq[0].queued > sc->txq[0].count - 8) {
2087                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2088                 m_freem(m);
2089                 WPI_UNLOCK(sc);
2090                 ieee80211_free_node(ni);
2091                 return ENOBUFS;         /* XXX */
2092         }
2093
2094         ifp->if_opackets++;
2095         if (wpi_tx_data(sc, m, ni, 0) != 0)
2096                 goto bad;
2097         sc->sc_tx_timer = 5;
2098         callout_reset(&sc->watchdog_to, hz, wpi_watchdog, sc);
2099
2100         WPI_UNLOCK(sc);
2101         return 0;
2102 bad:
2103         ifp->if_oerrors++;
2104         WPI_UNLOCK(sc);
2105         ieee80211_free_node(ni);
2106         return EIO;             /* XXX */
2107 }
2108
2109 static int
2110 wpi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2111 {
2112         struct wpi_softc *sc = ifp->if_softc;
2113         struct ieee80211com *ic = ifp->if_l2com;
2114         struct ifreq *ifr = (struct ifreq *) data;
2115         int error = 0, startall = 0;
2116
2117         switch (cmd) {
2118         case SIOCSIFFLAGS:
2119                 WPI_LOCK(sc);
2120                 if ((ifp->if_flags & IFF_UP)) {
2121                         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2122                                 wpi_init_locked(sc, 0);
2123                                 startall = 1;
2124                         }
2125                 } else if ((ifp->if_drv_flags & IFF_DRV_RUNNING) ||
2126                            (sc->flags & WPI_FLAG_HW_RADIO_OFF))
2127                         wpi_stop_locked(sc);
2128                 WPI_UNLOCK(sc);
2129                 if (startall)
2130                         ieee80211_start_all(ic);
2131                 break;
2132         case SIOCGIFMEDIA:
2133                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2134                 break;
2135         case SIOCGIFADDR:
2136                 error = ether_ioctl(ifp, cmd, data);
2137                 break;
2138         default:
2139                 error = EINVAL;
2140                 break;
2141         }
2142         return error;
2143 }
2144
2145 /*
2146  * Extract various information from EEPROM.
2147  */
2148 static void
2149 wpi_read_eeprom(struct wpi_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
2150 {
2151         int i;
2152
2153         /* read the hardware capabilities, revision and SKU type */
2154         wpi_read_prom_data(sc, WPI_EEPROM_CAPABILITIES, &sc->cap,1);
2155         wpi_read_prom_data(sc, WPI_EEPROM_REVISION, &sc->rev,2);
2156         wpi_read_prom_data(sc, WPI_EEPROM_TYPE, &sc->type, 1);
2157
2158         /* read the regulatory domain */
2159         wpi_read_prom_data(sc, WPI_EEPROM_DOMAIN, sc->domain, 4);
2160
2161         /* read in the hw MAC address */
2162         wpi_read_prom_data(sc, WPI_EEPROM_MAC, macaddr, 6);
2163
2164         /* read the list of authorized channels */
2165         for (i = 0; i < WPI_CHAN_BANDS_COUNT; i++)
2166                 wpi_read_eeprom_channels(sc,i);
2167
2168         /* read the power level calibration info for each group */
2169         for (i = 0; i < WPI_POWER_GROUPS_COUNT; i++)
2170                 wpi_read_eeprom_group(sc,i);
2171 }
2172
2173 /*
2174  * Send a command to the firmware.
2175  */
2176 static int
2177 wpi_cmd(struct wpi_softc *sc, int code, const void *buf, int size, int async)
2178 {
2179         struct wpi_tx_ring *ring = &sc->cmdq;
2180         struct wpi_tx_desc *desc;
2181         struct wpi_tx_cmd *cmd;
2182
2183 #ifdef WPI_DEBUG
2184         if (!async) {
2185                 WPI_LOCK_ASSERT(sc);
2186         }
2187 #endif
2188
2189         DPRINTFN(WPI_DEBUG_CMD,("wpi_cmd %d size %d async %d\n", code, size,
2190                     async));
2191
2192         if (sc->flags & WPI_FLAG_BUSY) {
2193                 device_printf(sc->sc_dev, "%s: cmd %d not sent, busy\n",
2194                     __func__, code);
2195                 return EAGAIN;
2196         }
2197         sc->flags|= WPI_FLAG_BUSY;
2198
2199         KASSERT(size <= sizeof cmd->data, ("command %d too large: %d bytes",
2200             code, size));
2201
2202         desc = &ring->desc[ring->cur];
2203         cmd = &ring->cmd[ring->cur];
2204
2205         cmd->code = code;
2206         cmd->flags = 0;
2207         cmd->qid = ring->qid;
2208         cmd->idx = ring->cur;
2209         memcpy(cmd->data, buf, size);
2210
2211         desc->flags = htole32(WPI_PAD32(size) << 28 | 1 << 24);
2212         desc->segs[0].addr = htole32(ring->cmd_dma.paddr +
2213                 ring->cur * sizeof (struct wpi_tx_cmd));
2214         desc->segs[0].len  = htole32(4 + size);
2215
2216         /* kick cmd ring */
2217         ring->cur = (ring->cur + 1) % WPI_CMD_RING_COUNT;
2218         WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2219
2220         if (async) {
2221                 sc->flags &= ~ WPI_FLAG_BUSY;
2222                 return 0;
2223         }
2224
2225         return msleep(cmd, &sc->sc_mtx, PCATCH, "wpicmd", hz);
2226 }
2227
2228 static int
2229 wpi_wme_update(struct ieee80211com *ic)
2230 {
2231 #define WPI_EXP2(v)     htole16((1 << (v)) - 1)
2232 #define WPI_USEC(v)     htole16(IEEE80211_TXOP_TO_US(v))
2233         struct wpi_softc *sc = ic->ic_ifp->if_softc;
2234         const struct wmeParams *wmep;
2235         struct wpi_wme_setup wme;
2236         int ac;
2237
2238         /* don't override default WME values if WME is not actually enabled */
2239         if (!(ic->ic_flags & IEEE80211_F_WME))
2240                 return 0;
2241
2242         wme.flags = 0;
2243         for (ac = 0; ac < WME_NUM_AC; ac++) {
2244                 wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
2245                 wme.ac[ac].aifsn = wmep->wmep_aifsn;
2246                 wme.ac[ac].cwmin = WPI_EXP2(wmep->wmep_logcwmin);
2247                 wme.ac[ac].cwmax = WPI_EXP2(wmep->wmep_logcwmax);
2248                 wme.ac[ac].txop  = WPI_USEC(wmep->wmep_txopLimit);
2249
2250                 DPRINTF(("setting WME for queue %d aifsn=%d cwmin=%d cwmax=%d "
2251                     "txop=%d\n", ac, wme.ac[ac].aifsn, wme.ac[ac].cwmin,
2252                     wme.ac[ac].cwmax, wme.ac[ac].txop));
2253         }
2254         return wpi_cmd(sc, WPI_CMD_SET_WME, &wme, sizeof wme, 1);
2255 #undef WPI_USEC
2256 #undef WPI_EXP2
2257 }
2258
2259 /*
2260  * Configure h/w multi-rate retries.
2261  */
2262 static int
2263 wpi_mrr_setup(struct wpi_softc *sc)
2264 {
2265         struct ifnet *ifp = sc->sc_ifp;
2266         struct ieee80211com *ic = ifp->if_l2com;
2267         struct wpi_mrr_setup mrr;
2268         int i, error;
2269
2270         memset(&mrr, 0, sizeof (struct wpi_mrr_setup));
2271
2272         /* CCK rates (not used with 802.11a) */
2273         for (i = WPI_CCK1; i <= WPI_CCK11; i++) {
2274                 mrr.rates[i].flags = 0;
2275                 mrr.rates[i].signal = wpi_ridx_to_plcp[i];
2276                 /* fallback to the immediate lower CCK rate (if any) */
2277                 mrr.rates[i].next = (i == WPI_CCK1) ? WPI_CCK1 : i - 1;
2278                 /* try one time at this rate before falling back to "next" */
2279                 mrr.rates[i].ntries = 1;
2280         }
2281
2282         /* OFDM rates (not used with 802.11b) */
2283         for (i = WPI_OFDM6; i <= WPI_OFDM54; i++) {
2284                 mrr.rates[i].flags = 0;
2285                 mrr.rates[i].signal = wpi_ridx_to_plcp[i];
2286                 /* fallback to the immediate lower OFDM rate (if any) */
2287                 /* we allow fallback from OFDM/6 to CCK/2 in 11b/g mode */
2288                 mrr.rates[i].next = (i == WPI_OFDM6) ?
2289                     ((ic->ic_curmode == IEEE80211_MODE_11A) ?
2290                         WPI_OFDM6 : WPI_CCK2) :
2291                     i - 1;
2292                 /* try one time at this rate before falling back to "next" */
2293                 mrr.rates[i].ntries = 1;
2294         }
2295
2296         /* setup MRR for control frames */
2297         mrr.which = WPI_MRR_CTL;
2298         error = wpi_cmd(sc, WPI_CMD_MRR_SETUP, &mrr, sizeof mrr, 0);
2299         if (error != 0) {
2300                 device_printf(sc->sc_dev,
2301                     "could not setup MRR for control frames\n");
2302                 return error;
2303         }
2304
2305         /* setup MRR for data frames */
2306         mrr.which = WPI_MRR_DATA;
2307         error = wpi_cmd(sc, WPI_CMD_MRR_SETUP, &mrr, sizeof mrr, 0);
2308         if (error != 0) {
2309                 device_printf(sc->sc_dev,
2310                     "could not setup MRR for data frames\n");
2311                 return error;
2312         }
2313
2314         return 0;
2315 }
2316
2317 static void
2318 wpi_set_led(struct wpi_softc *sc, uint8_t which, uint8_t off, uint8_t on)
2319 {
2320         struct wpi_cmd_led led;
2321
2322         led.which = which;
2323         led.unit = htole32(100000);     /* on/off in unit of 100ms */
2324         led.off = off;
2325         led.on = on;
2326
2327         (void)wpi_cmd(sc, WPI_CMD_SET_LED, &led, sizeof led, 1);
2328 }
2329
2330 static void
2331 wpi_enable_tsf(struct wpi_softc *sc, struct ieee80211_node *ni)
2332 {
2333         struct wpi_cmd_tsf tsf;
2334         uint64_t val, mod;
2335
2336         memset(&tsf, 0, sizeof tsf);
2337         memcpy(&tsf.tstamp, ni->ni_tstamp.data, 8);
2338         tsf.bintval = htole16(ni->ni_intval);
2339         tsf.lintval = htole16(10);
2340
2341         /* compute remaining time until next beacon */
2342         val = (uint64_t)ni->ni_intval  * 1024;  /* msec -> usec */
2343         mod = le64toh(tsf.tstamp) % val;
2344         tsf.binitval = htole32((uint32_t)(val - mod));
2345
2346         if (wpi_cmd(sc, WPI_CMD_TSF, &tsf, sizeof tsf, 1) != 0)
2347                 device_printf(sc->sc_dev, "could not enable TSF\n");
2348 }
2349
2350 #if 0
2351 /*
2352  * Build a beacon frame that the firmware will broadcast periodically in
2353  * IBSS or HostAP modes.
2354  */
2355 static int
2356 wpi_setup_beacon(struct wpi_softc *sc, struct ieee80211_node *ni)
2357 {
2358         struct ifnet *ifp = sc->sc_ifp;
2359         struct ieee80211com *ic = ifp->if_l2com;
2360         struct wpi_tx_ring *ring = &sc->cmdq;
2361         struct wpi_tx_desc *desc;
2362         struct wpi_tx_data *data;
2363         struct wpi_tx_cmd *cmd;
2364         struct wpi_cmd_beacon *bcn;
2365         struct ieee80211_beacon_offsets bo;
2366         struct mbuf *m0;
2367         bus_addr_t physaddr;
2368         int error;
2369
2370         desc = &ring->desc[ring->cur];
2371         data = &ring->data[ring->cur];
2372
2373         m0 = ieee80211_beacon_alloc(ic, ni, &bo);
2374         if (m0 == NULL) {
2375                 device_printf(sc->sc_dev, "could not allocate beacon frame\n");
2376                 return ENOMEM;
2377         }
2378
2379         cmd = &ring->cmd[ring->cur];
2380         cmd->code = WPI_CMD_SET_BEACON;
2381         cmd->flags = 0;
2382         cmd->qid = ring->qid;
2383         cmd->idx = ring->cur;
2384
2385         bcn = (struct wpi_cmd_beacon *)cmd->data;
2386         memset(bcn, 0, sizeof (struct wpi_cmd_beacon));
2387         bcn->id = WPI_ID_BROADCAST;
2388         bcn->ofdm_mask = 0xff;
2389         bcn->cck_mask = 0x0f;
2390         bcn->lifetime = htole32(WPI_LIFETIME_INFINITE);
2391         bcn->len = htole16(m0->m_pkthdr.len);
2392         bcn->rate = (ic->ic_curmode == IEEE80211_MODE_11A) ?
2393                 wpi_plcp_signal(12) : wpi_plcp_signal(2);
2394         bcn->flags = htole32(WPI_TX_AUTO_SEQ | WPI_TX_INSERT_TSTAMP);
2395
2396         /* save and trim IEEE802.11 header */
2397         m_copydata(m0, 0, sizeof (struct ieee80211_frame), (caddr_t)&bcn->wh);
2398         m_adj(m0, sizeof (struct ieee80211_frame));
2399
2400         /* assume beacon frame is contiguous */
2401         error = bus_dmamap_load(ring->data_dmat, data->map, mtod(m0, void *),
2402             m0->m_pkthdr.len, wpi_dma_map_addr, &physaddr, 0);
2403         if (error != 0) {
2404                 device_printf(sc->sc_dev, "could not map beacon\n");
2405                 m_freem(m0);
2406                 return error;
2407         }
2408
2409         data->m = m0;
2410
2411         /* first scatter/gather segment is used by the beacon command */
2412         desc->flags = htole32(WPI_PAD32(m0->m_pkthdr.len) << 28 | 2 << 24);
2413         desc->segs[0].addr = htole32(ring->cmd_dma.paddr +
2414                 ring->cur * sizeof (struct wpi_tx_cmd));
2415         desc->segs[0].len  = htole32(4 + sizeof (struct wpi_cmd_beacon));
2416         desc->segs[1].addr = htole32(physaddr);
2417         desc->segs[1].len  = htole32(m0->m_pkthdr.len);
2418
2419         /* kick cmd ring */
2420         ring->cur = (ring->cur + 1) % WPI_CMD_RING_COUNT;
2421         WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2422
2423         return 0;
2424 }
2425 #endif
2426
2427 static int
2428 wpi_auth(struct wpi_softc *sc, struct ieee80211vap *vap)
2429 {
2430         struct ieee80211com *ic = vap->iv_ic;
2431         struct ieee80211_node *ni = vap->iv_bss;
2432         struct wpi_node_info node;
2433         int error;
2434
2435
2436         /* update adapter's configuration */
2437         sc->config.associd = 0;
2438         sc->config.filter &= ~htole32(WPI_FILTER_BSS);
2439         IEEE80211_ADDR_COPY(sc->config.bssid, ni->ni_bssid);
2440         sc->config.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2441         if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
2442                 sc->config.flags |= htole32(WPI_CONFIG_AUTO |
2443                     WPI_CONFIG_24GHZ);
2444         } else {
2445                 sc->config.flags &= ~htole32(WPI_CONFIG_AUTO |
2446                     WPI_CONFIG_24GHZ);
2447         }
2448         if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
2449                 sc->config.cck_mask  = 0;
2450                 sc->config.ofdm_mask = 0x15;
2451         } else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
2452                 sc->config.cck_mask  = 0x03;
2453                 sc->config.ofdm_mask = 0;
2454         } else {
2455                 /* XXX assume 802.11b/g */
2456                 sc->config.cck_mask  = 0x0f;
2457                 sc->config.ofdm_mask = 0x15;
2458         }
2459
2460         DPRINTF(("config chan %d flags %x cck %x ofdm %x\n", sc->config.chan,
2461                 sc->config.flags, sc->config.cck_mask, sc->config.ofdm_mask));
2462         error = wpi_cmd(sc, WPI_CMD_CONFIGURE, &sc->config,
2463                 sizeof (struct wpi_config), 1);
2464         if (error != 0) {
2465                 device_printf(sc->sc_dev, "could not configure\n");
2466                 return error;
2467         }
2468
2469         /* configuration has changed, set Tx power accordingly */
2470         if ((error = wpi_set_txpower(sc, ni->ni_chan, 1)) != 0) {
2471                 device_printf(sc->sc_dev, "could not set Tx power\n");
2472                 return error;
2473         }
2474
2475         /* add default node */
2476         memset(&node, 0, sizeof node);
2477         IEEE80211_ADDR_COPY(node.bssid, ni->ni_bssid);
2478         node.id = WPI_ID_BSS;
2479         node.rate = (ic->ic_curmode == IEEE80211_MODE_11A) ?
2480             wpi_plcp_signal(12) : wpi_plcp_signal(2);
2481         node.action = htole32(WPI_ACTION_SET_RATE);
2482         node.antenna = WPI_ANTENNA_BOTH;
2483         error = wpi_cmd(sc, WPI_CMD_ADD_NODE, &node, sizeof node, 1);
2484         if (error != 0)
2485                 device_printf(sc->sc_dev, "could not add BSS node\n");
2486
2487         return (error);
2488 }
2489
2490 static int
2491 wpi_run(struct wpi_softc *sc, struct ieee80211vap *vap)
2492 {
2493         struct ieee80211com *ic = vap->iv_ic;
2494         struct ieee80211_node *ni = vap->iv_bss;
2495         int error;
2496
2497         if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2498                 /* link LED blinks while monitoring */
2499                 wpi_set_led(sc, WPI_LED_LINK, 5, 5);
2500                 return 0;
2501         }
2502
2503         wpi_enable_tsf(sc, ni);
2504
2505         /* update adapter's configuration */
2506         sc->config.associd = htole16(ni->ni_associd & ~0xc000);
2507         /* short preamble/slot time are negotiated when associating */
2508         sc->config.flags &= ~htole32(WPI_CONFIG_SHPREAMBLE |
2509             WPI_CONFIG_SHSLOT);
2510         if (ic->ic_flags & IEEE80211_F_SHSLOT)
2511                 sc->config.flags |= htole32(WPI_CONFIG_SHSLOT);
2512         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
2513                 sc->config.flags |= htole32(WPI_CONFIG_SHPREAMBLE);
2514         sc->config.filter |= htole32(WPI_FILTER_BSS);
2515
2516         /* XXX put somewhere HC_QOS_SUPPORT_ASSOC + HC_IBSS_START */
2517
2518         DPRINTF(("config chan %d flags %x\n", sc->config.chan,
2519                     sc->config.flags));
2520         error = wpi_cmd(sc, WPI_CMD_CONFIGURE, &sc->config, sizeof (struct
2521                     wpi_config), 1);
2522         if (error != 0) {
2523                 device_printf(sc->sc_dev, "could not update configuration\n");
2524                 return error;
2525         }
2526
2527         error = wpi_set_txpower(sc, ni->ni_chan, 1);
2528         if (error != 0) {
2529                 device_printf(sc->sc_dev, "could set txpower\n");
2530                 return error;
2531         }
2532
2533         /* link LED always on while associated */
2534         wpi_set_led(sc, WPI_LED_LINK, 0, 1);
2535
2536         /* start automatic rate control timer */
2537         callout_reset(&sc->calib_to, 60*hz, wpi_calib_timeout, sc);
2538
2539         return (error);
2540 }
2541
2542 /*
2543  * Send a scan request to the firmware.  Since this command is huge, we map it
2544  * into a mbufcluster instead of using the pre-allocated set of commands. Note,
2545  * much of this code is similar to that in wpi_cmd but because we must manually
2546  * construct the probe & channels, we duplicate what's needed here. XXX In the
2547  * future, this function should be modified to use wpi_cmd to help cleanup the
2548  * code base.
2549  */
2550 static int
2551 wpi_scan(struct wpi_softc *sc)
2552 {
2553         struct ifnet *ifp = sc->sc_ifp;
2554         struct ieee80211com *ic = ifp->if_l2com;
2555         struct ieee80211_scan_state *ss = ic->ic_scan;
2556         struct wpi_tx_ring *ring = &sc->cmdq;
2557         struct wpi_tx_desc *desc;
2558         struct wpi_tx_data *data;
2559         struct wpi_tx_cmd *cmd;
2560         struct wpi_scan_hdr *hdr;
2561         struct wpi_scan_chan *chan;
2562         struct ieee80211_frame *wh;
2563         struct ieee80211_rateset *rs;
2564         struct ieee80211_channel *c;
2565         enum ieee80211_phymode mode;
2566         uint8_t *frm;
2567         int nrates, pktlen, error, i, nssid;
2568         bus_addr_t physaddr;
2569
2570         desc = &ring->desc[ring->cur];
2571         data = &ring->data[ring->cur];
2572
2573         data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
2574         if (data->m == NULL) {
2575                 device_printf(sc->sc_dev,
2576                     "could not allocate mbuf for scan command\n");
2577                 return ENOMEM;
2578         }
2579
2580         cmd = mtod(data->m, struct wpi_tx_cmd *);
2581         cmd->code = WPI_CMD_SCAN;
2582         cmd->flags = 0;
2583         cmd->qid = ring->qid;
2584         cmd->idx = ring->cur;
2585
2586         hdr = (struct wpi_scan_hdr *)cmd->data;
2587         memset(hdr, 0, sizeof(struct wpi_scan_hdr));
2588
2589         /*
2590          * Move to the next channel if no packets are received within 5 msecs
2591          * after sending the probe request (this helps to reduce the duration
2592          * of active scans).
2593          */
2594         hdr->quiet = htole16(5);
2595         hdr->threshold = htole16(1);
2596
2597         if (IEEE80211_IS_CHAN_A(ic->ic_curchan)) {
2598                 /* send probe requests at 6Mbps */
2599                 hdr->tx.rate = wpi_ridx_to_plcp[WPI_OFDM6];
2600
2601                 /* Enable crc checking */
2602                 hdr->promotion = htole16(1);
2603         } else {
2604                 hdr->flags = htole32(WPI_CONFIG_24GHZ | WPI_CONFIG_AUTO);
2605                 /* send probe requests at 1Mbps */
2606                 hdr->tx.rate = wpi_ridx_to_plcp[WPI_CCK1];
2607         }
2608         hdr->tx.id = WPI_ID_BROADCAST;
2609         hdr->tx.lifetime = htole32(WPI_LIFETIME_INFINITE);
2610         hdr->tx.flags = htole32(WPI_TX_AUTO_SEQ);
2611
2612         memset(hdr->scan_essids, 0, sizeof(hdr->scan_essids));
2613         nssid = MIN(ss->ss_nssid, WPI_SCAN_MAX_ESSIDS);
2614         for (i = 0; i < nssid; i++) {
2615                 hdr->scan_essids[i].id = IEEE80211_ELEMID_SSID;
2616                 hdr->scan_essids[i].esslen = MIN(ss->ss_ssid[i].len, 32);
2617                 memcpy(hdr->scan_essids[i].essid, ss->ss_ssid[i].ssid,
2618                     hdr->scan_essids[i].esslen);
2619 #ifdef WPI_DEBUG
2620                 if (wpi_debug & WPI_DEBUG_SCANNING) {
2621                         printf("Scanning Essid: ");
2622                         ieee80211_print_essid(hdr->scan_essids[i].essid,
2623                             hdr->scan_essids[i].esslen);
2624                         printf("\n");
2625                 }
2626 #endif
2627         }
2628
2629         /*
2630          * Build a probe request frame.  Most of the following code is a
2631          * copy & paste of what is done in net80211.
2632          */
2633         wh = (struct ieee80211_frame *)&hdr->scan_essids[4];
2634         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2635                 IEEE80211_FC0_SUBTYPE_PROBE_REQ;
2636         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2637         IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
2638         IEEE80211_ADDR_COPY(wh->i_addr2, IF_LLADDR(ifp));
2639         IEEE80211_ADDR_COPY(wh->i_addr3, ifp->if_broadcastaddr);
2640         *(u_int16_t *)&wh->i_dur[0] = 0;        /* filled by h/w */
2641         *(u_int16_t *)&wh->i_seq[0] = 0;        /* filled by h/w */
2642
2643         frm = (uint8_t *)(wh + 1);
2644
2645         /* add essid IE, the hardware will fill this in for us */
2646         *frm++ = IEEE80211_ELEMID_SSID;
2647         *frm++ = 0;
2648
2649         mode = ieee80211_chan2mode(ic->ic_curchan);
2650         rs = &ic->ic_sup_rates[mode];
2651
2652         /* add supported rates IE */
2653         *frm++ = IEEE80211_ELEMID_RATES;
2654         nrates = rs->rs_nrates;
2655         if (nrates > IEEE80211_RATE_SIZE)
2656                 nrates = IEEE80211_RATE_SIZE;
2657         *frm++ = nrates;
2658         memcpy(frm, rs->rs_rates, nrates);
2659         frm += nrates;
2660
2661         /* add supported xrates IE */
2662         if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
2663                 nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
2664                 *frm++ = IEEE80211_ELEMID_XRATES;
2665                 *frm++ = nrates;
2666                 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
2667                 frm += nrates;
2668         }
2669
2670         /* setup length of probe request */
2671         hdr->tx.len = htole16(frm - (uint8_t *)wh);
2672
2673         /*
2674          * Construct information about the channel that we
2675          * want to scan. The firmware expects this to be directly
2676          * after the scan probe request
2677          */
2678         c = ic->ic_curchan;
2679         chan = (struct wpi_scan_chan *)frm;
2680         chan->chan = ieee80211_chan2ieee(ic, c);
2681         chan->flags = 0;
2682         if (!(c->ic_flags & IEEE80211_CHAN_PASSIVE)) {
2683                 chan->flags |= WPI_CHAN_ACTIVE;
2684                 if (nssid != 0)
2685                         chan->flags |= WPI_CHAN_DIRECT;
2686         }
2687         chan->gain_dsp = 0x6e; /* Default level */
2688         if (IEEE80211_IS_CHAN_5GHZ(c)) {
2689                 chan->active = htole16(10);
2690                 chan->passive = htole16(ss->ss_maxdwell);
2691                 chan->gain_radio = 0x3b;
2692         } else {
2693                 chan->active = htole16(20);
2694                 chan->passive = htole16(ss->ss_maxdwell);
2695                 chan->gain_radio = 0x28;
2696         }
2697
2698         DPRINTFN(WPI_DEBUG_SCANNING,
2699             ("Scanning %u Passive: %d\n",
2700              chan->chan,
2701              c->ic_flags & IEEE80211_CHAN_PASSIVE));
2702
2703         hdr->nchan++;
2704         chan++;
2705
2706         frm += sizeof (struct wpi_scan_chan);
2707 #if 0
2708         // XXX All Channels....
2709         for (c  = &ic->ic_channels[1];
2710              c <= &ic->ic_channels[IEEE80211_CHAN_MAX]; c++) {
2711                 if ((c->ic_flags & ic->ic_curchan->ic_flags) != ic->ic_curchan->ic_flags)
2712                         continue;
2713
2714                 chan->chan = ieee80211_chan2ieee(ic, c);
2715                 chan->flags = 0;
2716                 if (!(c->ic_flags & IEEE80211_CHAN_PASSIVE)) {
2717                     chan->flags |= WPI_CHAN_ACTIVE;
2718                     if (ic->ic_des_ssid[0].len != 0)
2719                         chan->flags |= WPI_CHAN_DIRECT;
2720                 }
2721                 chan->gain_dsp = 0x6e; /* Default level */
2722                 if (IEEE80211_IS_CHAN_5GHZ(c)) {
2723                         chan->active = htole16(10);
2724                         chan->passive = htole16(110);
2725                         chan->gain_radio = 0x3b;
2726                 } else {
2727                         chan->active = htole16(20);
2728                         chan->passive = htole16(120);
2729                         chan->gain_radio = 0x28;
2730                 }
2731
2732                 DPRINTFN(WPI_DEBUG_SCANNING,
2733                          ("Scanning %u Passive: %d\n",
2734                           chan->chan,
2735                           c->ic_flags & IEEE80211_CHAN_PASSIVE));
2736
2737                 hdr->nchan++;
2738                 chan++;
2739
2740                 frm += sizeof (struct wpi_scan_chan);
2741         }
2742 #endif
2743
2744         hdr->len = htole16(frm - (uint8_t *)hdr);
2745         pktlen = frm - (uint8_t *)cmd;
2746
2747         error = bus_dmamap_load(ring->data_dmat, data->map, cmd, pktlen,
2748             wpi_dma_map_addr, &physaddr, BUS_DMA_NOWAIT);
2749         if (error != 0) {
2750                 device_printf(sc->sc_dev, "could not map scan command\n");
2751                 m_freem(data->m);
2752                 data->m = NULL;
2753                 return error;
2754         }
2755
2756         desc->flags = htole32(WPI_PAD32(pktlen) << 28 | 1 << 24);
2757         desc->segs[0].addr = htole32(physaddr);
2758         desc->segs[0].len  = htole32(pktlen);
2759
2760         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2761             BUS_DMASYNC_PREWRITE);
2762         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
2763
2764         /* kick cmd ring */
2765         ring->cur = (ring->cur + 1) % WPI_CMD_RING_COUNT;
2766         WPI_WRITE(sc, WPI_TX_WIDX, ring->qid << 8 | ring->cur);
2767
2768         sc->sc_scan_timer = 5;
2769         return 0;       /* will be notified async. of failure/success */
2770 }
2771
2772 /**
2773  * Configure the card to listen to a particular channel, this transisions the
2774  * card in to being able to receive frames from remote devices.
2775  */
2776 static int
2777 wpi_config(struct wpi_softc *sc)
2778 {
2779         struct ifnet *ifp = sc->sc_ifp;
2780         struct ieee80211com *ic = ifp->if_l2com;
2781         struct wpi_power power;
2782         struct wpi_bluetooth bluetooth;
2783         struct wpi_node_info node;
2784         int error;
2785
2786         /* set power mode */
2787         memset(&power, 0, sizeof power);
2788         power.flags = htole32(WPI_POWER_CAM|0x8);
2789         error = wpi_cmd(sc, WPI_CMD_SET_POWER_MODE, &power, sizeof power, 0);
2790         if (error != 0) {
2791                 device_printf(sc->sc_dev, "could not set power mode\n");
2792                 return error;
2793         }
2794
2795         /* configure bluetooth coexistence */
2796         memset(&bluetooth, 0, sizeof bluetooth);
2797         bluetooth.flags = 3;
2798         bluetooth.lead = 0xaa;
2799         bluetooth.kill = 1;
2800         error = wpi_cmd(sc, WPI_CMD_BLUETOOTH, &bluetooth, sizeof bluetooth,
2801             0);
2802         if (error != 0) {
2803                 device_printf(sc->sc_dev,
2804                     "could not configure bluetooth coexistence\n");
2805                 return error;
2806         }
2807
2808         /* configure adapter */
2809         memset(&sc->config, 0, sizeof (struct wpi_config));
2810         IEEE80211_ADDR_COPY(sc->config.myaddr, IF_LLADDR(ifp));
2811         /*set default channel*/
2812         sc->config.chan = htole16(ieee80211_chan2ieee(ic, ic->ic_curchan));
2813         sc->config.flags = htole32(WPI_CONFIG_TSF);
2814         if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
2815                 sc->config.flags |= htole32(WPI_CONFIG_AUTO |
2816                     WPI_CONFIG_24GHZ);
2817         }
2818         sc->config.filter = 0;
2819         switch (ic->ic_opmode) {
2820         case IEEE80211_M_STA:
2821         case IEEE80211_M_WDS:   /* No know setup, use STA for now */
2822                 sc->config.mode = WPI_MODE_STA;
2823                 sc->config.filter |= htole32(WPI_FILTER_MULTICAST);
2824                 break;
2825         case IEEE80211_M_IBSS:
2826         case IEEE80211_M_AHDEMO:
2827                 sc->config.mode = WPI_MODE_IBSS;
2828                 sc->config.filter |= htole32(WPI_FILTER_BEACON |
2829                                              WPI_FILTER_MULTICAST);
2830                 break;
2831         case IEEE80211_M_HOSTAP:
2832                 sc->config.mode = WPI_MODE_HOSTAP;
2833                 break;
2834         case IEEE80211_M_MONITOR:
2835                 sc->config.mode = WPI_MODE_MONITOR;
2836                 sc->config.filter |= htole32(WPI_FILTER_MULTICAST |
2837                         WPI_FILTER_CTL | WPI_FILTER_PROMISC);
2838                 break;
2839         default:
2840                 device_printf(sc->sc_dev, "unknown opmode %d\n", ic->ic_opmode);
2841                 return EINVAL;
2842         }
2843         sc->config.cck_mask  = 0x0f;    /* not yet negotiated */
2844         sc->config.ofdm_mask = 0xff;    /* not yet negotiated */
2845         error = wpi_cmd(sc, WPI_CMD_CONFIGURE, &sc->config,
2846                 sizeof (struct wpi_config), 0);
2847         if (error != 0) {
2848                 device_printf(sc->sc_dev, "configure command failed\n");
2849                 return error;
2850         }
2851
2852         /* configuration has changed, set Tx power accordingly */
2853         if ((error = wpi_set_txpower(sc, ic->ic_curchan, 0)) != 0) {
2854             device_printf(sc->sc_dev, "could not set Tx power\n");
2855             return error;
2856         }
2857
2858         /* add broadcast node */
2859         memset(&node, 0, sizeof node);
2860         IEEE80211_ADDR_COPY(node.bssid, ifp->if_broadcastaddr);
2861         node.id = WPI_ID_BROADCAST;
2862         node.rate = wpi_plcp_signal(2);
2863         error = wpi_cmd(sc, WPI_CMD_ADD_NODE, &node, sizeof node, 0);
2864         if (error != 0) {
2865                 device_printf(sc->sc_dev, "could not add broadcast node\n");
2866                 return error;
2867         }
2868
2869         /* Setup rate scalling */
2870         error = wpi_mrr_setup(sc);
2871         if (error != 0) {
2872                 device_printf(sc->sc_dev, "could not setup MRR\n");
2873                 return error;
2874         }
2875
2876         return 0;
2877 }
2878
2879 static void
2880 wpi_stop_master(struct wpi_softc *sc)
2881 {
2882         uint32_t tmp;
2883         int ntries;
2884
2885         DPRINTFN(WPI_DEBUG_HW,("Disabling Firmware execution\n"));
2886
2887         tmp = WPI_READ(sc, WPI_RESET);
2888         WPI_WRITE(sc, WPI_RESET, tmp | WPI_STOP_MASTER | WPI_NEVO_RESET);
2889
2890         tmp = WPI_READ(sc, WPI_GPIO_CTL);
2891         if ((tmp & WPI_GPIO_PWR_STATUS) == WPI_GPIO_PWR_SLEEP)
2892                 return; /* already asleep */
2893
2894         for (ntries = 0; ntries < 100; ntries++) {
2895                 if (WPI_READ(sc, WPI_RESET) & WPI_MASTER_DISABLED)
2896                         break;
2897                 DELAY(10);
2898         }
2899         if (ntries == 100) {
2900                 device_printf(sc->sc_dev, "timeout waiting for master\n");
2901         }
2902 }
2903
2904 static int
2905 wpi_power_up(struct wpi_softc *sc)
2906 {
2907         uint32_t tmp;
2908         int ntries;
2909
2910         wpi_mem_lock(sc);
2911         tmp = wpi_mem_read(sc, WPI_MEM_POWER);
2912         wpi_mem_write(sc, WPI_MEM_POWER, tmp & ~0x03000000);
2913         wpi_mem_unlock(sc);
2914
2915         for (ntries = 0; ntries < 5000; ntries++) {
2916                 if (WPI_READ(sc, WPI_GPIO_STATUS) & WPI_POWERED)
2917                         break;
2918                 DELAY(10);
2919         }
2920         if (ntries == 5000) {
2921                 device_printf(sc->sc_dev,
2922                     "timeout waiting for NIC to power up\n");
2923                 return ETIMEDOUT;
2924         }
2925         return 0;
2926 }
2927
2928 static int
2929 wpi_reset(struct wpi_softc *sc)
2930 {
2931         uint32_t tmp;
2932         int ntries;
2933
2934         DPRINTFN(WPI_DEBUG_HW,
2935             ("Resetting the card - clearing any uploaded firmware\n"));
2936
2937         /* clear any pending interrupts */
2938         WPI_WRITE(sc, WPI_INTR, 0xffffffff);
2939
2940         tmp = WPI_READ(sc, WPI_PLL_CTL);
2941         WPI_WRITE(sc, WPI_PLL_CTL, tmp | WPI_PLL_INIT);
2942
2943         tmp = WPI_READ(sc, WPI_CHICKEN);
2944         WPI_WRITE(sc, WPI_CHICKEN, tmp | WPI_CHICKEN_RXNOLOS);
2945
2946         tmp = WPI_READ(sc, WPI_GPIO_CTL);
2947         WPI_WRITE(sc, WPI_GPIO_CTL, tmp | WPI_GPIO_INIT);
2948
2949         /* wait for clock stabilization */
2950         for (ntries = 0; ntries < 25000; ntries++) {
2951                 if (WPI_READ(sc, WPI_GPIO_CTL) & WPI_GPIO_CLOCK)
2952                         break;
2953                 DELAY(10);
2954         }
2955         if (ntries == 25000) {
2956                 device_printf(sc->sc_dev,
2957                     "timeout waiting for clock stabilization\n");
2958                 return ETIMEDOUT;
2959         }
2960
2961         /* initialize EEPROM */
2962         tmp = WPI_READ(sc, WPI_EEPROM_STATUS);
2963
2964         if ((tmp & WPI_EEPROM_VERSION) == 0) {
2965                 device_printf(sc->sc_dev, "EEPROM not found\n");
2966                 return EIO;
2967         }
2968         WPI_WRITE(sc, WPI_EEPROM_STATUS, tmp & ~WPI_EEPROM_LOCKED);
2969
2970         return 0;
2971 }
2972
2973 static void
2974 wpi_hw_config(struct wpi_softc *sc)
2975 {
2976         uint32_t rev, hw;
2977
2978         /* voodoo from the Linux "driver".. */
2979         hw = WPI_READ(sc, WPI_HWCONFIG);
2980
2981         rev = pci_read_config(sc->sc_dev, PCIR_REVID, 1);
2982         if ((rev & 0xc0) == 0x40)
2983                 hw |= WPI_HW_ALM_MB;
2984         else if (!(rev & 0x80))
2985                 hw |= WPI_HW_ALM_MM;
2986
2987         if (sc->cap == 0x80)
2988                 hw |= WPI_HW_SKU_MRC;
2989
2990         hw &= ~WPI_HW_REV_D;
2991         if ((le16toh(sc->rev) & 0xf0) == 0xd0)
2992                 hw |= WPI_HW_REV_D;
2993
2994         if (sc->type > 1)
2995                 hw |= WPI_HW_TYPE_B;
2996
2997         WPI_WRITE(sc, WPI_HWCONFIG, hw);
2998 }
2999
3000 static void
3001 wpi_rfkill_resume(struct wpi_softc *sc)
3002 {
3003         struct ifnet *ifp = sc->sc_ifp;
3004         struct ieee80211com *ic = ifp->if_l2com;
3005         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3006         int ntries;
3007
3008         /* enable firmware again */
3009         WPI_WRITE(sc, WPI_UCODE_CLR, WPI_RADIO_OFF);
3010         WPI_WRITE(sc, WPI_UCODE_CLR, WPI_DISABLE_CMD);
3011
3012         /* wait for thermal sensors to calibrate */
3013         for (ntries = 0; ntries < 1000; ntries++) {
3014                 if ((sc->temp = (int)WPI_READ(sc, WPI_TEMPERATURE)) != 0)
3015                         break;
3016                 DELAY(10);
3017         }
3018
3019         if (ntries == 1000) {
3020                 device_printf(sc->sc_dev,
3021                     "timeout waiting for thermal calibration\n");
3022                 return;
3023         }
3024         DPRINTFN(WPI_DEBUG_TEMP,("temperature %d\n", sc->temp));
3025
3026         if (wpi_config(sc) != 0) {
3027                 device_printf(sc->sc_dev, "device config failed\n");
3028                 return;
3029         }
3030
3031         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
3032         ifp->if_drv_flags |= IFF_DRV_RUNNING;
3033         sc->flags &= ~WPI_FLAG_HW_RADIO_OFF;
3034
3035         if (vap != NULL) {
3036                 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
3037                         if (vap->iv_opmode != IEEE80211_M_MONITOR) {
3038                                 ieee80211_beacon_miss(ic);
3039                                 wpi_set_led(sc, WPI_LED_LINK, 0, 1);
3040                         } else
3041                                 wpi_set_led(sc, WPI_LED_LINK, 5, 5);
3042                 } else {
3043                         ieee80211_scan_next(vap);
3044                         wpi_set_led(sc, WPI_LED_LINK, 20, 2);
3045                 }
3046         }
3047
3048         callout_reset(&sc->watchdog_to, hz, wpi_watchdog, sc);
3049 }
3050
3051 static void
3052 wpi_init_locked(struct wpi_softc *sc, int force)
3053 {
3054         struct ifnet *ifp = sc->sc_ifp;
3055         uint32_t tmp;
3056         int ntries, qid;
3057
3058         wpi_stop_locked(sc);
3059         (void)wpi_reset(sc);
3060
3061         wpi_mem_lock(sc);
3062         wpi_mem_write(sc, WPI_MEM_CLOCK1, 0xa00);
3063         DELAY(20);
3064         tmp = wpi_mem_read(sc, WPI_MEM_PCIDEV);
3065         wpi_mem_write(sc, WPI_MEM_PCIDEV, tmp | 0x800);
3066         wpi_mem_unlock(sc);
3067
3068         (void)wpi_power_up(sc);
3069         wpi_hw_config(sc);
3070
3071         /* init Rx ring */
3072         wpi_mem_lock(sc);
3073         WPI_WRITE(sc, WPI_RX_BASE, sc->rxq.desc_dma.paddr);
3074         WPI_WRITE(sc, WPI_RX_RIDX_PTR, sc->shared_dma.paddr +
3075             offsetof(struct wpi_shared, next));
3076         WPI_WRITE(sc, WPI_RX_WIDX, (WPI_RX_RING_COUNT - 1) & ~7);
3077         WPI_WRITE(sc, WPI_RX_CONFIG, 0xa9601010);
3078         wpi_mem_unlock(sc);
3079
3080         /* init Tx rings */
3081         wpi_mem_lock(sc);
3082         wpi_mem_write(sc, WPI_MEM_MODE, 2); /* bypass mode */
3083         wpi_mem_write(sc, WPI_MEM_RA, 1);   /* enable RA0 */
3084         wpi_mem_write(sc, WPI_MEM_TXCFG, 0x3f); /* enable all 6 Tx rings */
3085         wpi_mem_write(sc, WPI_MEM_BYPASS1, 0x10000);
3086         wpi_mem_write(sc, WPI_MEM_BYPASS2, 0x30002);
3087         wpi_mem_write(sc, WPI_MEM_MAGIC4, 4);
3088         wpi_mem_write(sc, WPI_MEM_MAGIC5, 5);
3089
3090         WPI_WRITE(sc, WPI_TX_BASE_PTR, sc->shared_dma.paddr);
3091         WPI_WRITE(sc, WPI_MSG_CONFIG, 0xffff05a5);
3092
3093         for (qid = 0; qid < 6; qid++) {
3094                 WPI_WRITE(sc, WPI_TX_CTL(qid), 0);
3095                 WPI_WRITE(sc, WPI_TX_BASE(qid), 0);
3096                 WPI_WRITE(sc, WPI_TX_CONFIG(qid), 0x80200008);
3097         }
3098         wpi_mem_unlock(sc);
3099
3100         /* clear "radio off" and "disable command" bits (reversed logic) */
3101         WPI_WRITE(sc, WPI_UCODE_CLR, WPI_RADIO_OFF);
3102         WPI_WRITE(sc, WPI_UCODE_CLR, WPI_DISABLE_CMD);
3103         sc->flags &= ~WPI_FLAG_HW_RADIO_OFF;
3104
3105         /* clear any pending interrupts */
3106         WPI_WRITE(sc, WPI_INTR, 0xffffffff);
3107
3108         /* enable interrupts */
3109         WPI_WRITE(sc, WPI_MASK, WPI_INTR_MASK);
3110
3111         WPI_WRITE(sc, WPI_UCODE_CLR, WPI_RADIO_OFF);
3112         WPI_WRITE(sc, WPI_UCODE_CLR, WPI_RADIO_OFF);
3113
3114         if ((wpi_load_firmware(sc)) != 0) {
3115             device_printf(sc->sc_dev,
3116                 "A problem occurred loading the firmware to the driver\n");
3117             return;
3118         }
3119
3120         /* At this point the firmware is up and running. If the hardware
3121          * RF switch is turned off thermal calibration will fail, though
3122          * the card is still happy to continue to accept commands, catch
3123          * this case and schedule a task to watch for it to be turned on.
3124          */
3125         wpi_mem_lock(sc);
3126         tmp = wpi_mem_read(sc, WPI_MEM_HW_RADIO_OFF);
3127         wpi_mem_unlock(sc);
3128
3129         if (!(tmp & 0x1)) {
3130                 sc->flags |= WPI_FLAG_HW_RADIO_OFF;
3131                 device_printf(sc->sc_dev,"Radio Transmitter is switched off\n");
3132                 goto out;
3133         }
3134
3135         /* wait for thermal sensors to calibrate */
3136         for (ntries = 0; ntries < 1000; ntries++) {
3137                 if ((sc->temp = (int)WPI_READ(sc, WPI_TEMPERATURE)) != 0)
3138                         break;
3139                 DELAY(10);
3140         }
3141
3142         if (ntries == 1000) {
3143                 device_printf(sc->sc_dev,
3144                     "timeout waiting for thermal sensors calibration\n");
3145                 return;
3146         }
3147         DPRINTFN(WPI_DEBUG_TEMP,("temperature %d\n", sc->temp));
3148
3149         if (wpi_config(sc) != 0) {
3150                 device_printf(sc->sc_dev, "device config failed\n");
3151                 return;
3152         }
3153
3154         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
3155         ifp->if_drv_flags |= IFF_DRV_RUNNING;
3156 out:
3157         callout_reset(&sc->watchdog_to, hz, wpi_watchdog, sc);
3158 }
3159
3160 static void
3161 wpi_init(void *arg)
3162 {
3163         struct wpi_softc *sc = arg;
3164         struct ifnet *ifp = sc->sc_ifp;
3165         struct ieee80211com *ic = ifp->if_l2com;
3166
3167         WPI_LOCK(sc);
3168         wpi_init_locked(sc, 0);
3169         WPI_UNLOCK(sc);
3170
3171         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3172                 ieee80211_start_all(ic);                /* start all vaps */
3173 }
3174
3175 static void
3176 wpi_stop_locked(struct wpi_softc *sc)
3177 {
3178         struct ifnet *ifp = sc->sc_ifp;
3179         uint32_t tmp;
3180         int ac;
3181
3182         sc->sc_tx_timer = 0;
3183         sc->sc_scan_timer = 0;
3184         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
3185         sc->flags &= ~WPI_FLAG_HW_RADIO_OFF;
3186         callout_stop(&sc->watchdog_to);
3187         callout_stop(&sc->calib_to);
3188
3189         /* disable interrupts */
3190         WPI_WRITE(sc, WPI_MASK, 0);
3191         WPI_WRITE(sc, WPI_INTR, WPI_INTR_MASK);
3192         WPI_WRITE(sc, WPI_INTR_STATUS, 0xff);
3193         WPI_WRITE(sc, WPI_INTR_STATUS, 0x00070000);
3194
3195         wpi_mem_lock(sc);
3196         wpi_mem_write(sc, WPI_MEM_MODE, 0);
3197         wpi_mem_unlock(sc);
3198
3199         /* reset all Tx rings */
3200         for (ac = 0; ac < 4; ac++)
3201                 wpi_reset_tx_ring(sc, &sc->txq[ac]);
3202         wpi_reset_tx_ring(sc, &sc->cmdq);
3203
3204         /* reset Rx ring */
3205         wpi_reset_rx_ring(sc, &sc->rxq);
3206
3207         wpi_mem_lock(sc);
3208         wpi_mem_write(sc, WPI_MEM_CLOCK2, 0x200);
3209         wpi_mem_unlock(sc);
3210
3211         DELAY(5);
3212
3213         wpi_stop_master(sc);
3214
3215         tmp = WPI_READ(sc, WPI_RESET);
3216         WPI_WRITE(sc, WPI_RESET, tmp | WPI_SW_RESET);
3217         sc->flags &= ~WPI_FLAG_BUSY;
3218 }
3219
3220 static void
3221 wpi_stop(struct wpi_softc *sc)
3222 {
3223         WPI_LOCK(sc);
3224         wpi_stop_locked(sc);
3225         WPI_UNLOCK(sc);
3226 }
3227
3228 static void
3229 wpi_calib_timeout(void *arg)
3230 {
3231         struct wpi_softc *sc = arg;
3232         struct ifnet *ifp = sc->sc_ifp;
3233         struct ieee80211com *ic = ifp->if_l2com;
3234         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3235         int temp;
3236
3237         if (vap->iv_state != IEEE80211_S_RUN)
3238                 return;
3239
3240         /* update sensor data */
3241         temp = (int)WPI_READ(sc, WPI_TEMPERATURE);
3242         DPRINTFN(WPI_DEBUG_TEMP,("Temp in calibration is: %d\n", temp));
3243
3244         wpi_power_calibration(sc, temp);
3245
3246         callout_reset(&sc->calib_to, 60*hz, wpi_calib_timeout, sc);
3247 }
3248
3249 /*
3250  * This function is called periodically (every 60 seconds) to adjust output
3251  * power to temperature changes.
3252  */
3253 static void
3254 wpi_power_calibration(struct wpi_softc *sc, int temp)
3255 {
3256         struct ifnet *ifp = sc->sc_ifp;
3257         struct ieee80211com *ic = ifp->if_l2com;
3258         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3259
3260         /* sanity-check read value */
3261         if (temp < -260 || temp > 25) {
3262                 /* this can't be correct, ignore */
3263                 DPRINTFN(WPI_DEBUG_TEMP,
3264                     ("out-of-range temperature reported: %d\n", temp));
3265                 return;
3266         }
3267
3268         DPRINTFN(WPI_DEBUG_TEMP,("temperature %d->%d\n", sc->temp, temp));
3269
3270         /* adjust Tx power if need be */
3271         if (abs(temp - sc->temp) <= 6)
3272                 return;
3273
3274         sc->temp = temp;
3275
3276         if (wpi_set_txpower(sc, vap->iv_bss->ni_chan, 1) != 0) {
3277                 /* just warn, too bad for the automatic calibration... */
3278                 device_printf(sc->sc_dev,"could not adjust Tx power\n");
3279         }
3280 }
3281
3282 /**
3283  * Read the eeprom to find out what channels are valid for the given
3284  * band and update net80211 with what we find.
3285  */
3286 static void
3287 wpi_read_eeprom_channels(struct wpi_softc *sc, int n)
3288 {
3289         struct ifnet *ifp = sc->sc_ifp;
3290         struct ieee80211com *ic = ifp->if_l2com;
3291         const struct wpi_chan_band *band = &wpi_bands[n];
3292         struct wpi_eeprom_chan channels[WPI_MAX_CHAN_PER_BAND];
3293         struct ieee80211_channel *c;
3294         int chan, i, passive;
3295
3296         wpi_read_prom_data(sc, band->addr, channels,
3297             band->nchan * sizeof (struct wpi_eeprom_chan));
3298
3299         for (i = 0; i < band->nchan; i++) {
3300                 if (!(channels[i].flags & WPI_EEPROM_CHAN_VALID)) {
3301                         DPRINTFN(WPI_DEBUG_HW,
3302                             ("Channel Not Valid: %d, band %d\n",
3303                              band->chan[i],n));
3304                         continue;
3305                 }
3306
3307                 passive = 0;
3308                 chan = band->chan[i];
3309                 c = &ic->ic_channels[ic->ic_nchans++];
3310
3311                 /* is active scan allowed on this channel? */
3312                 if (!(channels[i].flags & WPI_EEPROM_CHAN_ACTIVE)) {
3313                         passive = IEEE80211_CHAN_PASSIVE;
3314                 }
3315
3316                 if (n == 0) {   /* 2GHz band */
3317                         c->ic_ieee = chan;
3318                         c->ic_freq = ieee80211_ieee2mhz(chan,
3319                             IEEE80211_CHAN_2GHZ);
3320                         c->ic_flags = IEEE80211_CHAN_B | passive;
3321
3322                         c = &ic->ic_channels[ic->ic_nchans++];
3323                         c->ic_ieee = chan;
3324                         c->ic_freq = ieee80211_ieee2mhz(chan,
3325                             IEEE80211_CHAN_2GHZ);
3326                         c->ic_flags = IEEE80211_CHAN_G | passive;
3327
3328                 } else {        /* 5GHz band */
3329                         /*
3330                          * Some 3945ABG adapters support channels 7, 8, 11
3331                          * and 12 in the 2GHz *and* 5GHz bands.
3332                          * Because of limitations in our net80211(9) stack,
3333                          * we can't support these channels in 5GHz band.
3334                          * XXX not true; just need to map to proper frequency
3335                          */
3336                         if (chan <= 14)
3337                                 continue;
3338
3339                         c->ic_ieee = chan;
3340                         c->ic_freq = ieee80211_ieee2mhz(chan,
3341                             IEEE80211_CHAN_5GHZ);
3342                         c->ic_flags = IEEE80211_CHAN_A | passive;
3343                 }
3344
3345                 /* save maximum allowed power for this channel */
3346                 sc->maxpwr[chan] = channels[i].maxpwr;
3347
3348 #if 0
3349                 // XXX We can probably use this an get rid of maxpwr - ben 20070617
3350                 ic->ic_channels[chan].ic_maxpower = channels[i].maxpwr;
3351                 //ic->ic_channels[chan].ic_minpower...
3352                 //ic->ic_channels[chan].ic_maxregtxpower...
3353 #endif
3354
3355                 DPRINTF(("adding chan %d (%dMHz) flags=0x%x maxpwr=%d"
3356                     " passive=%d, offset %d\n", chan, c->ic_freq,
3357                     channels[i].flags, sc->maxpwr[chan],
3358                     (c->ic_flags & IEEE80211_CHAN_PASSIVE) != 0,
3359                     ic->ic_nchans));
3360         }
3361 }
3362
3363 static void
3364 wpi_read_eeprom_group(struct wpi_softc *sc, int n)
3365 {
3366         struct wpi_power_group *group = &sc->groups[n];
3367         struct wpi_eeprom_group rgroup;
3368         int i;
3369
3370         wpi_read_prom_data(sc, WPI_EEPROM_POWER_GRP + n * 32, &rgroup,
3371             sizeof rgroup);
3372
3373         /* save power group information */
3374         group->chan   = rgroup.chan;
3375         group->maxpwr = rgroup.maxpwr;
3376         /* temperature at which the samples were taken */
3377         group->temp   = (int16_t)le16toh(rgroup.temp);
3378
3379         DPRINTF(("power group %d: chan=%d maxpwr=%d temp=%d\n", n,
3380                     group->chan, group->maxpwr, group->temp));
3381
3382         for (i = 0; i < WPI_SAMPLES_COUNT; i++) {
3383                 group->samples[i].index = rgroup.samples[i].index;
3384                 group->samples[i].power = rgroup.samples[i].power;
3385
3386                 DPRINTF(("\tsample %d: index=%d power=%d\n", i,
3387                             group->samples[i].index, group->samples[i].power));
3388         }
3389 }
3390
3391 /*
3392  * Update Tx power to match what is defined for channel `c'.
3393  */
3394 static int
3395 wpi_set_txpower(struct wpi_softc *sc, struct ieee80211_channel *c, int async)
3396 {
3397         struct ifnet *ifp = sc->sc_ifp;
3398         struct ieee80211com *ic = ifp->if_l2com;
3399         struct wpi_power_group *group;
3400         struct wpi_cmd_txpower txpower;
3401         u_int chan;
3402         int i;
3403
3404         /* get channel number */
3405         chan = ieee80211_chan2ieee(ic, c);
3406
3407         /* find the power group to which this channel belongs */
3408         if (IEEE80211_IS_CHAN_5GHZ(c)) {
3409                 for (group = &sc->groups[1]; group < &sc->groups[4]; group++)
3410                         if (chan <= group->chan)
3411                                 break;
3412         } else
3413                 group = &sc->groups[0];
3414
3415         memset(&txpower, 0, sizeof txpower);
3416         txpower.band = IEEE80211_IS_CHAN_5GHZ(c) ? 0 : 1;
3417         txpower.channel = htole16(chan);
3418
3419         /* set Tx power for all OFDM and CCK rates */
3420         for (i = 0; i <= 11 ; i++) {
3421                 /* retrieve Tx power for this channel/rate combination */
3422                 int idx = wpi_get_power_index(sc, group, c,
3423                     wpi_ridx_to_rate[i]);
3424
3425                 txpower.rates[i].rate = wpi_ridx_to_plcp[i];
3426
3427                 if (IEEE80211_IS_CHAN_5GHZ(c)) {
3428                         txpower.rates[i].gain_radio = wpi_rf_gain_5ghz[idx];
3429                         txpower.rates[i].gain_dsp = wpi_dsp_gain_5ghz[idx];
3430                 } else {
3431                         txpower.rates[i].gain_radio = wpi_rf_gain_2ghz[idx];
3432                         txpower.rates[i].gain_dsp = wpi_dsp_gain_2ghz[idx];
3433                 }
3434                 DPRINTFN(WPI_DEBUG_TEMP,("chan %d/rate %d: power index %d\n",
3435                             chan, wpi_ridx_to_rate[i], idx));
3436         }
3437
3438         return wpi_cmd(sc, WPI_CMD_TXPOWER, &txpower, sizeof txpower, async);
3439 }
3440
3441 /*
3442  * Determine Tx power index for a given channel/rate combination.
3443  * This takes into account the regulatory information from EEPROM and the
3444  * current temperature.
3445  */
3446 static int
3447 wpi_get_power_index(struct wpi_softc *sc, struct wpi_power_group *group,
3448     struct ieee80211_channel *c, int rate)
3449 {
3450 /* fixed-point arithmetic division using a n-bit fractional part */
3451 #define fdivround(a, b, n)      \
3452         ((((1 << n) * (a)) / (b) + (1 << n) / 2) / (1 << n))
3453
3454 /* linear interpolation */
3455 #define interpolate(x, x1, y1, x2, y2, n)       \
3456         ((y1) + fdivround(((x) - (x1)) * ((y2) - (y1)), (x2) - (x1), n))
3457
3458         struct ifnet *ifp = sc->sc_ifp;
3459         struct ieee80211com *ic = ifp->if_l2com;
3460         struct wpi_power_sample *sample;
3461         int pwr, idx;
3462         u_int chan;
3463
3464         /* get channel number */
3465         chan = ieee80211_chan2ieee(ic, c);
3466
3467         /* default power is group's maximum power - 3dB */
3468         pwr = group->maxpwr / 2;
3469
3470         /* decrease power for highest OFDM rates to reduce distortion */
3471         switch (rate) {
3472                 case 72:        /* 36Mb/s */
3473                         pwr -= IEEE80211_IS_CHAN_2GHZ(c) ? 0 :  5;
3474                         break;
3475                 case 96:        /* 48Mb/s */
3476                         pwr -= IEEE80211_IS_CHAN_2GHZ(c) ? 7 : 10;
3477                         break;
3478                 case 108:       /* 54Mb/s */
3479                         pwr -= IEEE80211_IS_CHAN_2GHZ(c) ? 9 : 12;
3480                         break;
3481         }
3482
3483         /* never exceed channel's maximum allowed Tx power */
3484         pwr = min(pwr, sc->maxpwr[chan]);
3485
3486         /* retrieve power index into gain tables from samples */
3487         for (sample = group->samples; sample < &group->samples[3]; sample++)
3488                 if (pwr > sample[1].power)
3489                         break;
3490         /* fixed-point linear interpolation using a 19-bit fractional part */
3491         idx = interpolate(pwr, sample[0].power, sample[0].index,
3492             sample[1].power, sample[1].index, 19);
3493
3494         /*
3495          *  Adjust power index based on current temperature
3496          *      - if colder than factory-calibrated: decreate output power
3497          *      - if warmer than factory-calibrated: increase output power
3498          */
3499         idx -= (sc->temp - group->temp) * 11 / 100;
3500
3501         /* decrease power for CCK rates (-5dB) */
3502         if (!WPI_RATE_IS_OFDM(rate))
3503                 idx += 10;
3504
3505         /* keep power index in a valid range */
3506         if (idx < 0)
3507                 return 0;
3508         if (idx > WPI_MAX_PWR_INDEX)
3509                 return WPI_MAX_PWR_INDEX;
3510         return idx;
3511
3512 #undef interpolate
3513 #undef fdivround
3514 }
3515
3516 /**
3517  * Called by net80211 framework to indicate that a scan
3518  * is starting. This function doesn't actually do the scan,
3519  * wpi_scan_curchan starts things off. This function is more
3520  * of an early warning from the framework we should get ready
3521  * for the scan.
3522  */
3523 static void
3524 wpi_scan_start(struct ieee80211com *ic)
3525 {
3526         struct ifnet *ifp = ic->ic_ifp;
3527         struct wpi_softc *sc = ifp->if_softc;
3528
3529         WPI_LOCK(sc);
3530         wpi_set_led(sc, WPI_LED_LINK, 20, 2);
3531         WPI_UNLOCK(sc);
3532 }
3533
3534 /**
3535  * Called by the net80211 framework, indicates that the
3536  * scan has ended. If there is a scan in progress on the card
3537  * then it should be aborted.
3538  */
3539 static void
3540 wpi_scan_end(struct ieee80211com *ic)
3541 {
3542         /* XXX ignore */
3543 }
3544
3545 /**
3546  * Called by the net80211 framework to indicate to the driver
3547  * that the channel should be changed
3548  */
3549 static void
3550 wpi_set_channel(struct ieee80211com *ic)
3551 {
3552         struct ifnet *ifp = ic->ic_ifp;
3553         struct wpi_softc *sc = ifp->if_softc;
3554         int error;
3555
3556         /*
3557          * Only need to set the channel in Monitor mode. AP scanning and auth
3558          * are already taken care of by their respective firmware commands.
3559          */
3560         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
3561                 WPI_LOCK(sc);
3562                 error = wpi_config(sc);
3563                 WPI_UNLOCK(sc);
3564                 if (error != 0)
3565                         device_printf(sc->sc_dev,
3566                             "error %d settting channel\n", error);
3567         }
3568 }
3569
3570 /**
3571  * Called by net80211 to indicate that we need to scan the current
3572  * channel. The channel is previously be set via the wpi_set_channel
3573  * callback.
3574  */
3575 static void
3576 wpi_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
3577 {
3578         struct ieee80211vap *vap = ss->ss_vap;
3579         struct ifnet *ifp = vap->iv_ic->ic_ifp;
3580         struct wpi_softc *sc = ifp->if_softc;
3581
3582         WPI_LOCK(sc);
3583         if (wpi_scan(sc))
3584                 ieee80211_cancel_scan(vap);
3585         WPI_UNLOCK(sc);
3586 }
3587
3588 /**
3589  * Called by the net80211 framework to indicate
3590  * the minimum dwell time has been met, terminate the scan.
3591  * We don't actually terminate the scan as the firmware will notify
3592  * us when it's finished and we have no way to interrupt it.
3593  */
3594 static void
3595 wpi_scan_mindwell(struct ieee80211_scan_state *ss)
3596 {
3597         /* NB: don't try to abort scan; wait for firmware to finish */
3598 }
3599
3600 static void
3601 wpi_hwreset(void *arg, int pending)
3602 {
3603         struct wpi_softc *sc = arg;
3604
3605         WPI_LOCK(sc);
3606         wpi_init_locked(sc, 0);
3607         WPI_UNLOCK(sc);
3608 }
3609
3610 static void
3611 wpi_rfreset(void *arg, int pending)
3612 {
3613         struct wpi_softc *sc = arg;
3614
3615         WPI_LOCK(sc);
3616         wpi_rfkill_resume(sc);
3617         WPI_UNLOCK(sc);
3618 }
3619
3620 /*
3621  * Allocate DMA-safe memory for firmware transfer.
3622  */
3623 static int
3624 wpi_alloc_fwmem(struct wpi_softc *sc)
3625 {
3626         /* allocate enough contiguous space to store text and data */
3627         return wpi_dma_contig_alloc(sc, &sc->fw_dma, NULL,
3628             WPI_FW_MAIN_TEXT_MAXSZ + WPI_FW_MAIN_DATA_MAXSZ, 1,
3629             BUS_DMA_NOWAIT);
3630 }
3631
3632 static void
3633 wpi_free_fwmem(struct wpi_softc *sc)
3634 {
3635         wpi_dma_contig_free(&sc->fw_dma);
3636 }
3637
3638 /**
3639  * Called every second, wpi_watchdog used by the watch dog timer
3640  * to check that the card is still alive
3641  */
3642 static void
3643 wpi_watchdog(void *arg)
3644 {
3645         struct wpi_softc *sc = arg;
3646         struct ifnet *ifp = sc->sc_ifp;
3647         struct ieee80211com *ic = ifp->if_l2com;
3648         uint32_t tmp;
3649
3650         DPRINTFN(WPI_DEBUG_WATCHDOG,("Watchdog: tick\n"));
3651
3652         if (sc->flags & WPI_FLAG_HW_RADIO_OFF) {
3653                 /* No need to lock firmware memory */
3654                 tmp = wpi_mem_read(sc, WPI_MEM_HW_RADIO_OFF);
3655
3656                 if ((tmp & 0x1) == 0) {
3657                         /* Radio kill switch is still off */
3658                         callout_reset(&sc->watchdog_to, hz, wpi_watchdog, sc);
3659                         return;
3660                 }
3661
3662                 device_printf(sc->sc_dev, "Hardware Switch Enabled\n");
3663                 ieee80211_runtask(ic, &sc->sc_radiotask);
3664                 return;
3665         }
3666
3667         if (sc->sc_tx_timer > 0) {
3668                 if (--sc->sc_tx_timer == 0) {
3669                         device_printf(sc->sc_dev,"device timeout\n");
3670                         ifp->if_oerrors++;
3671                         ieee80211_runtask(ic, &sc->sc_restarttask);
3672                 }
3673         }
3674         if (sc->sc_scan_timer > 0) {
3675                 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3676                 if (--sc->sc_scan_timer == 0 && vap != NULL) {
3677                         device_printf(sc->sc_dev,"scan timeout\n");
3678                         ieee80211_cancel_scan(vap);
3679                         ieee80211_runtask(ic, &sc->sc_restarttask);
3680                 }
3681         }
3682
3683         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3684                 callout_reset(&sc->watchdog_to, hz, wpi_watchdog, sc);
3685 }
3686
3687 #ifdef WPI_DEBUG
3688 static const char *wpi_cmd_str(int cmd)
3689 {
3690         switch (cmd) {
3691         case WPI_DISABLE_CMD:   return "WPI_DISABLE_CMD";
3692         case WPI_CMD_CONFIGURE: return "WPI_CMD_CONFIGURE";
3693         case WPI_CMD_ASSOCIATE: return "WPI_CMD_ASSOCIATE";
3694         case WPI_CMD_SET_WME:   return "WPI_CMD_SET_WME";
3695         case WPI_CMD_TSF:       return "WPI_CMD_TSF";
3696         case WPI_CMD_ADD_NODE:  return "WPI_CMD_ADD_NODE";
3697         case WPI_CMD_TX_DATA:   return "WPI_CMD_TX_DATA";
3698         case WPI_CMD_MRR_SETUP: return "WPI_CMD_MRR_SETUP";
3699         case WPI_CMD_SET_LED:   return "WPI_CMD_SET_LED";
3700         case WPI_CMD_SET_POWER_MODE: return "WPI_CMD_SET_POWER_MODE";
3701         case WPI_CMD_SCAN:      return "WPI_CMD_SCAN";
3702         case WPI_CMD_SET_BEACON:return "WPI_CMD_SET_BEACON";
3703         case WPI_CMD_TXPOWER:   return "WPI_CMD_TXPOWER";
3704         case WPI_CMD_BLUETOOTH: return "WPI_CMD_BLUETOOTH";
3705
3706         default:
3707                 KASSERT(1, ("Unknown Command: %d\n", cmd));
3708                 return "UNKNOWN CMD";   /* Make the compiler happy */
3709         }
3710 }
3711 #endif
3712
3713 MODULE_DEPEND(wpi, pci,  1, 1, 1);
3714 MODULE_DEPEND(wpi, wlan, 1, 1, 1);
3715 MODULE_DEPEND(wpi, firmware, 1, 1, 1);