root/dev/ic/pgt.c

DEFINITIONS

1. pgt_write_memory_barrier
2. pgt_read_4
3. pgt_write_4
4. pgt_write_4_flush
5. pgt_debug_events
6. pgt_queue_frags_pending
7. pgt_reinit_rx_desc_frag
8. pgt_load_tx_desc_frag
9. pgt_unload_tx_desc_frag
10. pgt_load_firmware
11. pgt_cleanup_queue
12. pgt_reset
13. pgt_stop
14. pgt_attach
15. pgt_detach
16. pgt_reboot
17. pgt_init_intr
18. pgt_update_intr
19. pgt_ieee80211_encap
20. pgt_input_frames
21. pgt_wakeup_intr
22. pgt_sleep_intr
23. pgt_empty_traps
24. pgt_per_device_kthread
25. pgt_async_reset
26. pgt_async_update
27. pgt_intr
28. pgt_txdone
29. pgt_rxdone
30. pgt_trap_received
31. pgt_mgmtrx_completion
32. pgt_datarx_completion
33. pgt_oid_get
34. pgt_oid_retrieve
35. pgt_oid_set
36. pgt_state_dump
37. pgt_mgmt_request
38. pgt_desc_transmit
39. pgt_maybe_trigger
40. pgt_ieee80211_node_alloc
41. pgt_ieee80211_newassoc
42. pgt_ieee80211_node_free
43. pgt_ieee80211_node_copy
44. pgt_ieee80211_send_mgmt
45. pgt_net_attach
46. pgt_media_change
47. pgt_media_status
48. pgt_start
49. pgt_ioctl
50. pgt_obj_bss2scanres
51. node_mark_active_ap
52. node_mark_active_adhoc
53. pgt_watchdog
54. pgt_init
55. pgt_update_hw_from_sw
56. pgt_hostap_handle_mlme
57. pgt_update_sw_from_hw
58. pgt_newstate
59. pgt_drain_tx_queue
60. pgt_dma_alloc
61. pgt_dma_alloc_queue
62. pgt_dma_free
63. pgt_dma_free_queue
64. pgt_shutdown
65. pgt_power

    1 /*      $OpenBSD: pgt.c,v 1.43 2007/07/18 18:10:31 damien Exp $  */
    3 /*
    4  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
    5  * Copyright (c) 2006 Marcus Glocker <mglocker@openbsd.org>
    6  *
    7  * Permission to use, copy, modify, and distribute this software for any
    8  * purpose with or without fee is hereby granted, provided that the above
    9  * copyright notice and this permission notice appear in all copies.
   10  *
   11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   18  */
   20 /*
   21  * Copyright (c) 2004 Fujitsu Laboratories of America, Inc.
   22  * Copyright (c) 2004 Brian Fundakowski Feldman
   23  * All rights reserved.
   24  *
   25  * Redistribution and use in source and binary forms, with or without
   26  * modification, are permitted provided that the following conditions
   27  * are met:
   28  * 1. Redistributions of source code must retain the above copyright
   29  *    notice, this list of conditions and the following disclaimer.
   30  * 2. Redistributions in binary form must reproduce the above copyright
   31  *    notice, this list of conditions and the following disclaimer in the
   32  *    documentation and/or other materials provided with the distribution.
   33  *
   34  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   35  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   36  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   37  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   38  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   39  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   40  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   41  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   42  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   43  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   44  * SUCH DAMAGE.
   45  */
   47 #include <sys/cdefs.h>
   48 #include "bpfilter.h"
   50 #include <sys/param.h>
   51 #include <sys/systm.h>
   52 #include <sys/kernel.h>
   53 #include <sys/malloc.h>
   54 #include <sys/socket.h>
   55 #include <sys/mbuf.h>
   56 #include <sys/endian.h>
   57 #include <sys/sockio.h>
   58 #include <sys/sysctl.h>
   59 #include <sys/kthread.h>
   60 #include <sys/time.h>
   61 #include <sys/ioctl.h>
   62 #include <sys/device.h>
   64 #include <machine/bus.h>
   65 #include <machine/endian.h>
   66 #include <machine/intr.h>
   68 #include <net/if.h>
   69 #include <net/if_arp.h>
   70 #include <net/if_dl.h>
   71 #include <net/if_llc.h>
   72 #include <net/if_media.h>
   73 #include <net/if_types.h>
   75 #if NBPFILTER > 0
   76 #include <net/bpf.h>
   77 #endif
   79 #ifdef INET
   80 #include <netinet/in.h>
   81 #include <netinet/in_systm.h>
   82 #include <netinet/in_var.h>
   83 #include <netinet/if_ether.h>
   84 #include <netinet/ip.h>
   85 #endif
   87 #include <net80211/ieee80211_var.h>
   88 #include <net80211/ieee80211_radiotap.h>
   90 #include <dev/ic/pgtreg.h>
   91 #include <dev/ic/pgtvar.h>
   93 #include <dev/ic/if_wireg.h>
   94 #include <dev/ic/if_wi_ieee.h>
   95 #include <dev/ic/if_wivar.h>
   97 #ifdef PGT_DEBUG
   98 #define DPRINTF(x)      do { printf x; } while (0)
   99 #else
  100 #define DPRINTF(x)
  101 #endif
  103 #define SETOID(oid, var, size) {                                        \
  104         if (pgt_oid_set(sc, oid, var, size) != 0)                       \
  105                 break;                                                  \
  106 }
  108 /*
  109  * This is a driver for the Intersil Prism family of 802.11g network cards,
  110  * based upon version 1.2 of the Linux driver and firmware found at
  111  * http://www.prism54.org/.
  112  */
  114 #define SCAN_TIMEOUT                    5       /* 5 seconds */
  116 struct cfdriver pgt_cd = {
NULL, "pgt", DV_IFNET
  118 };
  120 void     pgt_media_status(struct ifnet *ifp, struct ifmediareq *imr);
  121 int      pgt_media_change(struct ifnet *ifp);
  122 void     pgt_write_memory_barrier(struct pgt_softc *);
uint32_t pgt_read_4(struct pgt_softc *, uint16_t);
  124 void     pgt_write_4(struct pgt_softc *, uint16_t, uint32_t);
  125 void     pgt_write_4_flush(struct pgt_softc *, uint16_t, uint32_t);
  126 void     pgt_debug_events(struct pgt_softc *, const char *);
uint32_t pgt_queue_frags_pending(struct pgt_softc *, enum pgt_queue);
  128 void     pgt_reinit_rx_desc_frag(struct pgt_softc *, struct pgt_desc *);
  129 int      pgt_load_tx_desc_frag(struct pgt_softc *, enum pgt_queue,
  130              struct pgt_desc *);
  131 void     pgt_unload_tx_desc_frag(struct pgt_softc *, struct pgt_desc *);
  132 int      pgt_load_firmware(struct pgt_softc *);
  133 void     pgt_cleanup_queue(struct pgt_softc *, enum pgt_queue,
  134              struct pgt_frag []);
  135 int      pgt_reset(struct pgt_softc *);
  136 void     pgt_stop(struct pgt_softc *, unsigned int);
  137 void     pgt_reboot(struct pgt_softc *);
  138 void     pgt_init_intr(struct pgt_softc *);
  139 void     pgt_update_intr(struct pgt_softc *, int);
  140 struct mbuf
  141         *pgt_ieee80211_encap(struct pgt_softc *, struct ether_header *,
  142              struct mbuf *, struct ieee80211_node **);
  143 void     pgt_input_frames(struct pgt_softc *, struct mbuf *);
  144 void     pgt_wakeup_intr(struct pgt_softc *);
  145 void     pgt_sleep_intr(struct pgt_softc *);
  146 void     pgt_empty_traps(struct pgt_softc_kthread *);
  147 void     pgt_per_device_kthread(void *);
  148 void     pgt_async_reset(struct pgt_softc *);
  149 void     pgt_async_update(struct pgt_softc *);
  150 void     pgt_txdone(struct pgt_softc *, enum pgt_queue);
  151 void     pgt_rxdone(struct pgt_softc *, enum pgt_queue);
  152 void     pgt_trap_received(struct pgt_softc *, uint32_t, void *, size_t);
  153 void     pgt_mgmtrx_completion(struct pgt_softc *, struct pgt_mgmt_desc *);
  154 struct mbuf
  155         *pgt_datarx_completion(struct pgt_softc *, enum pgt_queue);
  156 int      pgt_oid_get(struct pgt_softc *, enum pgt_oid, void *, size_t);
  157 int      pgt_oid_retrieve(struct pgt_softc *, enum pgt_oid, void *, size_t);
  158 int      pgt_oid_set(struct pgt_softc *, enum pgt_oid, const void *, size_t);
  159 void     pgt_state_dump(struct pgt_softc *);
  160 int      pgt_mgmt_request(struct pgt_softc *, struct pgt_mgmt_desc *);
  161 void     pgt_desc_transmit(struct pgt_softc *, enum pgt_queue,
  162              struct pgt_desc *, uint16_t, int);
  163 void     pgt_maybe_trigger(struct pgt_softc *, enum pgt_queue);
  164 struct ieee80211_node
  165         *pgt_ieee80211_node_alloc(struct ieee80211com *);
  166 void     pgt_ieee80211_newassoc(struct ieee80211com *,
  167              struct ieee80211_node *, int);
  168 void     pgt_ieee80211_node_free(struct ieee80211com *,
  169             struct ieee80211_node *);
  170 void     pgt_ieee80211_node_copy(struct ieee80211com *,
  171              struct ieee80211_node *,
  172              const struct ieee80211_node *);
  173 int      pgt_ieee80211_send_mgmt(struct ieee80211com *,
  174              struct ieee80211_node *, int, int);
  175 int      pgt_net_attach(struct pgt_softc *);
  176 void     pgt_start(struct ifnet *);
  177 int      pgt_ioctl(struct ifnet *, u_long, caddr_t);
  178 void     pgt_obj_bss2scanres(struct pgt_softc *,
  179              struct pgt_obj_bss *, struct wi_scan_res *, uint32_t);
  180 void     node_mark_active_ap(void *, struct ieee80211_node *);
  181 void     node_mark_active_adhoc(void *, struct ieee80211_node *);
  182 void     pgt_watchdog(struct ifnet *);
  183 int      pgt_init(struct ifnet *);
  184 void     pgt_update_hw_from_sw(struct pgt_softc *, int, int);
  185 void     pgt_hostap_handle_mlme(struct pgt_softc *, uint32_t,
  186              struct pgt_obj_mlme *);
  187 void     pgt_update_sw_from_hw(struct pgt_softc *,
  188              struct pgt_async_trap *, struct mbuf *);
  189 int      pgt_newstate(struct ieee80211com *, enum ieee80211_state, int);
  190 int      pgt_drain_tx_queue(struct pgt_softc *, enum pgt_queue);
  191 int      pgt_dma_alloc(struct pgt_softc *);
  192 int      pgt_dma_alloc_queue(struct pgt_softc *sc, enum pgt_queue pq);
  193 void     pgt_dma_free(struct pgt_softc *);
  194 void     pgt_dma_free_queue(struct pgt_softc *sc, enum pgt_queue pq);
  195 void     pgt_shutdown(void *);
  196 void     pgt_power(int, void *);
  198 void
pgt_write_memory_barrier(struct pgt_softc *sc)
  200 {
bus_space_barrier(sc->sc_iotag, sc->sc_iohandle, 0, 0,
BUS_SPACE_BARRIER_WRITE);
  203 }
u_int32_t
pgt_read_4(struct pgt_softc *sc, uint16_t offset)
  207 {
  208         return (bus_space_read_4(sc->sc_iotag, sc->sc_iohandle, offset));
  209 }
  211 void
pgt_write_4(struct pgt_softc *sc, uint16_t offset, uint32_t value)
  213 {
bus_space_write_4(sc->sc_iotag, sc->sc_iohandle, offset, value);
  215 }
  217 /*
  218  * Write out 4 bytes and cause a PCI flush by reading back in on a
  219  * harmless register.
  220  */
  221 void
pgt_write_4_flush(struct pgt_softc *sc, uint16_t offset, uint32_t value)
  223 {
bus_space_write_4(sc->sc_iotag, sc->sc_iohandle, offset, value);
  225         (void)bus_space_read_4(sc->sc_iotag, sc->sc_iohandle, PGT_REG_INT_EN);
  226 }
  228 /*
  229  * Print the state of events in the queues from an interrupt or a trigger.
  230  */
  231 void
pgt_debug_events(struct pgt_softc *sc, const char *when)
  233 {
  234 #define COUNT(i)                                                        \
letoh32(sc->sc_cb->pcb_driver_curfrag[i]) -                     \
letoh32(sc->sc_cb->pcb_device_curfrag[i])
  237         if (sc->sc_debug & SC_DEBUG_EVENTS)
DPRINTF(("%s: ev%s: %u %u %u %u %u %u\n",
sc->sc_dev.dv_xname, when, COUNT(0), COUNT(1), COUNT(2),
COUNT(3), COUNT(4), COUNT(5)));
  241 #undef COUNT
  242 }
uint32_t
pgt_queue_frags_pending(struct pgt_softc *sc, enum pgt_queue pq)
  246 {
  247         return (letoh32(sc->sc_cb->pcb_driver_curfrag[pq]) -
letoh32(sc->sc_cb->pcb_device_curfrag[pq]));
  249 }
  251 void
pgt_reinit_rx_desc_frag(struct pgt_softc *sc, struct pgt_desc *pd)
  253 {
pd->pd_fragp->pf_addr = htole32((uint32_t)pd->pd_dmaaddr);
pd->pd_fragp->pf_size = htole16(PGT_FRAG_SIZE);
pd->pd_fragp->pf_flags = 0;
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0, pd->pd_dmam->dm_mapsize,
BUS_DMASYNC_POSTWRITE);
  260 }
  262 int
pgt_load_tx_desc_frag(struct pgt_softc *sc, enum pgt_queue pq,
  264     struct pgt_desc *pd)
  265 {
  266         int error;
error = bus_dmamap_load(sc->sc_dmat, pd->pd_dmam, pd->pd_mem,
PGT_FRAG_SIZE, NULL, BUS_DMA_NOWAIT);
  270         if (error) {
DPRINTF(("%s: unable to load %s tx DMA: %d\n",
sc->sc_dev.dv_xname,
pgt_queue_is_data(pq) ? "data" : "mgmt", error));
  274                 return (error);
  275         }
pd->pd_dmaaddr = pd->pd_dmam->dm_segs[0].ds_addr;
pd->pd_fragp->pf_addr = htole32((uint32_t)pd->pd_dmaaddr);
pd->pd_fragp->pf_size = htole16(PGT_FRAG_SIZE);
pd->pd_fragp->pf_flags = htole16(0);
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0, pd->pd_dmam->dm_mapsize,
BUS_DMASYNC_POSTWRITE);
  284         return (0);
  285 }
  287 void
pgt_unload_tx_desc_frag(struct pgt_softc *sc, struct pgt_desc *pd)
  289 {
bus_dmamap_unload(sc->sc_dmat, pd->pd_dmam);
pd->pd_dmaaddr = 0;
  292 }
  294 int
pgt_load_firmware(struct pgt_softc *sc)
  296 {
  297         int error, reg, dirreg, fwoff, ucodeoff, fwlen;
uint8_t *ucode;
uint32_t *uc;
size_t size;
  301         char *name;
  303         if (sc->sc_flags & SC_ISL3877)
name = "pgt-isl3877";
  305         else
name = "pgt-isl3890";   /* includes isl3880 */
error = loadfirmware(name, &ucode, &size);
  310         if (error != 0) {
DPRINTF(("%s: error %d, could not read microcode %s!\n",
sc->sc_dev.dv_xname, error, name));
  313                 return (EIO);
  314         }
  316         if (size & 3) {
DPRINTF(("%s: bad firmware size %u\n",
sc->sc_dev.dv_xname, size));
free(ucode, M_DEVBUF);
  320                 return (EINVAL);
  321         }
pgt_reboot(sc);
fwoff = 0;
ucodeoff = 0;
uc = (uint32_t *)ucode;
reg = PGT_FIRMWARE_INTERNAL_OFFSET;
  329         while (fwoff < size) {
pgt_write_4_flush(sc, PGT_REG_DIR_MEM_BASE, reg);
  332                 if ((size - fwoff) >= PGT_DIRECT_MEMORY_SIZE)
fwlen = PGT_DIRECT_MEMORY_SIZE;
  334                 else
fwlen = size - fwoff;
dirreg = PGT_DIRECT_MEMORY_OFFSET;
  338                 while (fwlen > 4) {
pgt_write_4(sc, dirreg, uc[ucodeoff]);
fwoff += 4;
dirreg += 4;
reg += 4;
fwlen -= 4;
ucodeoff++;
  345                 }
pgt_write_4_flush(sc, dirreg, uc[ucodeoff]);
fwoff += 4;
dirreg += 4;
reg += 4;
fwlen -= 4;
ucodeoff++;
  352         }
DPRINTF(("%s: %d bytes microcode loaded from %s\n",
sc->sc_dev.dv_xname, fwoff, name));
reg = pgt_read_4(sc, PGT_REG_CTRL_STAT);
reg &= ~(PGT_CTRL_STAT_RESET | PGT_CTRL_STAT_CLOCKRUN);
reg |= PGT_CTRL_STAT_RAMBOOT;
pgt_write_4_flush(sc, PGT_REG_CTRL_STAT, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY);
reg |= PGT_CTRL_STAT_RESET;
pgt_write_4(sc, PGT_REG_CTRL_STAT, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY);
reg &= ~PGT_CTRL_STAT_RESET;
pgt_write_4(sc, PGT_REG_CTRL_STAT, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY);
free(ucode, M_DEVBUF);
  375         return (0);
  376 }
  378 void
pgt_cleanup_queue(struct pgt_softc *sc, enum pgt_queue pq,
  380     struct pgt_frag pqfrags[])
  381 {
  382         struct pgt_desc *pd;
  383         unsigned int i;
sc->sc_cb->pcb_device_curfrag[pq] = 0;
i = 0;
  387         /* XXX why only freeq ??? */
TAILQ_FOREACH(pd, &sc->sc_freeq[pq], pd_link) {
pd->pd_fragnum = i;
pd->pd_fragp = &pqfrags[i];
  391                 if (pgt_queue_is_rx(pq))
pgt_reinit_rx_desc_frag(sc, pd);
i++;
  394         }
sc->sc_freeq_count[pq] = i;
  396         /*
  397          * The ring buffer describes how many free buffers are available from
  398          * the host (for receive queues) or how many are pending (for
  399          * transmit queues).
  400          */
  401         if (pgt_queue_is_rx(pq))
sc->sc_cb->pcb_driver_curfrag[pq] = htole32(i);
  403         else
sc->sc_cb->pcb_driver_curfrag[pq] = 0;
  405 }
  407 /*
  408  * Turn off interrupts, reset the device (possibly loading firmware),
  409  * and put everything in a known state.
  410  */
  411 int
pgt_reset(struct pgt_softc *sc)
  413 {
  414         int error;
  416         /* disable all interrupts */
pgt_write_4_flush(sc, PGT_REG_INT_EN, 0);
DELAY(PGT_WRITEIO_DELAY);
  420         /*
  421          * Set up the management receive queue, assuming there are no
  422          * requests in progress.
  423          */
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE);
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_LOW_RX,
  428             &sc->sc_cb->pcb_data_low_rx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_LOW_TX,
  430             &sc->sc_cb->pcb_data_low_tx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_HIGH_RX,
  432             &sc->sc_cb->pcb_data_high_rx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_HIGH_TX,
  434             &sc->sc_cb->pcb_data_high_tx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_MGMT_RX,
  436             &sc->sc_cb->pcb_mgmt_rx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_MGMT_TX,
  438             &sc->sc_cb->pcb_mgmt_tx[0]);
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD);
  443         /* load firmware */
  444         if (sc->sc_flags & SC_NEEDS_FIRMWARE) {
error = pgt_load_firmware(sc);
  446                 if (error) {
printf("%s: firmware load failed\n",
sc->sc_dev.dv_xname);
  449                         return (error);
  450                 }
sc->sc_flags &= ~SC_NEEDS_FIRMWARE;
DPRINTF(("%s: firmware loaded\n", sc->sc_dev.dv_xname));
  453         }
  455         /* upload the control block's DMA address */
pgt_write_4_flush(sc, PGT_REG_CTRL_BLK_BASE,
htole32((uint32_t)sc->sc_cbdmam->dm_segs[0].ds_addr));
DELAY(PGT_WRITEIO_DELAY);
  460         /* send a reset event */
pgt_write_4_flush(sc, PGT_REG_DEV_INT, PGT_DEV_INT_RESET);
DELAY(PGT_WRITEIO_DELAY);
  464         /* await only the initialization interrupt */
pgt_write_4_flush(sc, PGT_REG_INT_EN, PGT_INT_STAT_INIT);       
DELAY(PGT_WRITEIO_DELAY);
  468         return (0);
  469 }
  471 /*
  472  * If we're trying to reset and the device has seemingly not been detached,
  473  * we'll spend a minute seeing if we can't do the reset.
  474  */
  475 void
pgt_stop(struct pgt_softc *sc, unsigned int flag)
  477 {
  478         struct ieee80211com *ic;
  479         unsigned int wokeup;
  480         int tryagain = 0;
ic = &sc->sc_ic;
ic->ic_if.if_flags &= ~IFF_RUNNING;
sc->sc_flags |= SC_UNINITIALIZED;
sc->sc_flags |= flag;
pgt_drain_tx_queue(sc, PGT_QUEUE_DATA_LOW_TX);
pgt_drain_tx_queue(sc, PGT_QUEUE_DATA_HIGH_TX);
pgt_drain_tx_queue(sc, PGT_QUEUE_MGMT_TX);
trying_again:
  493         /* disable all interrupts */
pgt_write_4_flush(sc, PGT_REG_INT_EN, 0);
DELAY(PGT_WRITEIO_DELAY);
  497         /* reboot card */
pgt_reboot(sc);
  500         do {
wokeup = 0;
  502                 /*
  503                  * We don't expect to be woken up, just to drop the lock
  504                  * and time out.  Only tx queues can have anything valid
  505                  * on them outside of an interrupt.
  506                  */
  507                 while (!TAILQ_EMPTY(&sc->sc_mgmtinprog)) {
  508                         struct pgt_mgmt_desc *pmd;
pmd = TAILQ_FIRST(&sc->sc_mgmtinprog);
TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link);
pmd->pmd_error = ENETRESET;
wakeup_one(pmd);
  514                         if (sc->sc_debug & SC_DEBUG_MGMT)
DPRINTF(("%s: queue: mgmt %p <- %#x "
  516                                     "(drained)\n", sc->sc_dev.dv_xname,
pmd, pmd->pmd_oid));
wokeup++;
  519                 }
  520                 if (wokeup > 0) {
  521                         if (flag == SC_NEEDS_RESET && sc->sc_flags & SC_DYING) {
sc->sc_flags &= ~flag;
  523                                 return;
  524                         }
  525                 }
  526         } while (wokeup > 0);
  528         if (flag == SC_NEEDS_RESET) {
  529                 int error;
DPRINTF(("%s: resetting\n", sc->sc_dev.dv_xname));
sc->sc_flags &= ~SC_POWERSAVE;
sc->sc_flags |= SC_NEEDS_FIRMWARE;
error = pgt_reset(sc);
  535                 if (error == 0) {
tsleep(&sc->sc_flags, 0, "pgtres", hz);
  537                         if (sc->sc_flags & SC_UNINITIALIZED) {
printf("%s: not responding\n",
sc->sc_dev.dv_xname);
  540                                 /* Thud.  It was probably removed. */
  541                                 if (tryagain)
panic("pgt went for lunch"); /* XXX */
tryagain = 1;
  544                         } else {
  545                                 /* await all interrupts */
pgt_write_4_flush(sc, PGT_REG_INT_EN,
PGT_INT_STAT_SOURCES);      
DELAY(PGT_WRITEIO_DELAY);
ic->ic_if.if_flags |= IFF_RUNNING;
  550                         }
  551                 }
  553                 if (tryagain)
  554                         goto trying_again;
sc->sc_flags &= ~flag;
  557                 if (ic->ic_if.if_flags & IFF_RUNNING)
pgt_update_hw_from_sw(sc,
ic->ic_state != IEEE80211_S_INIT,
ic->ic_opmode != IEEE80211_M_MONITOR);
  561         }
ic->ic_if.if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
  565 }
  567 void
pgt_attach(void *xsc)
  569 {
  570         struct pgt_softc *sc = xsc;
  571         int error;
  573         /* debug flags */
  574         //sc->sc_debug |= SC_DEBUG_QUEUES;      /* super verbose */
  575         //sc->sc_debug |= SC_DEBUG_MGMT;
sc->sc_debug |= SC_DEBUG_UNEXPECTED;
  577         //sc->sc_debug |= SC_DEBUG_TRIGGER;     /* verbose */
  578         //sc->sc_debug |= SC_DEBUG_EVENTS;      /* super verbose */
  579         //sc->sc_debug |= SC_DEBUG_POWER;
sc->sc_debug |= SC_DEBUG_TRAP;
sc->sc_debug |= SC_DEBUG_LINK;
  582         //sc->sc_debug |= SC_DEBUG_RXANNEX;
  583         //sc->sc_debug |= SC_DEBUG_RXFRAG;
  584         //sc->sc_debug |= SC_DEBUG_RXETHER;
  586         /* enable card if possible */
  587         if (sc->sc_enable != NULL)
  588                 (*sc->sc_enable)(sc);
error = pgt_dma_alloc(sc);
  591         if (error)
  592                 return;
sc->sc_ic.ic_if.if_softc = sc;
TAILQ_INIT(&sc->sc_mgmtinprog);
TAILQ_INIT(&sc->sc_kthread.sck_traps);
sc->sc_flags |= SC_NEEDS_FIRMWARE | SC_UNINITIALIZED;
sc->sc_80211_ioc_auth = IEEE80211_AUTH_OPEN;
error = pgt_reset(sc);
  601         if (error)
  602                 return;
tsleep(&sc->sc_flags, 0, "pgtres", hz);
  605         if (sc->sc_flags & SC_UNINITIALIZED) {
printf("%s: not responding\n", sc->sc_dev.dv_xname);
  607                 return;
  608         } else {
  609                 /* await all interrupts */
pgt_write_4_flush(sc, PGT_REG_INT_EN, PGT_INT_STAT_SOURCES);
DELAY(PGT_WRITEIO_DELAY);
  612         }
error = pgt_net_attach(sc);
  615         if (error)
  616                 return;
  618         if (kthread_create(pgt_per_device_kthread, sc, NULL,
sc->sc_dev.dv_xname) != 0)
  620                 return;
ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
  623 }
  625 int
pgt_detach(struct pgt_softc *sc)
  627 {
  628         if (sc->sc_flags & SC_NEEDS_FIRMWARE || sc->sc_flags & SC_UNINITIALIZED)
  629                 /* device was not initialized correctly, so leave early */
  630                 goto out;
  632         /* stop card */
pgt_stop(sc, SC_DYING);
pgt_reboot(sc);
  636         /*
  637          * Disable shutdown and power hooks
  638          */
  639         if (sc->sc_shutdown_hook != NULL)
shutdownhook_disestablish(sc->sc_shutdown_hook);
  641         if (sc->sc_power_hook != NULL)
powerhook_disestablish(sc->sc_power_hook);
ieee80211_ifdetach(&sc->sc_ic.ic_if);
if_detach(&sc->sc_ic.ic_if);
out:
  648         /* disable card if possible */
  649         if (sc->sc_disable != NULL)
  650                 (*sc->sc_disable)(sc);
pgt_dma_free(sc);
  654         return (0);
  655 }
  657 void
pgt_reboot(struct pgt_softc *sc)
  659 {
uint32_t reg;
reg = pgt_read_4(sc, PGT_REG_CTRL_STAT);
reg &= ~(PGT_CTRL_STAT_RESET | PGT_CTRL_STAT_RAMBOOT);
pgt_write_4(sc, PGT_REG_CTRL_STAT, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY);
reg |= PGT_CTRL_STAT_RESET;
pgt_write_4(sc, PGT_REG_CTRL_STAT, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY);
reg &= ~PGT_CTRL_STAT_RESET;
pgt_write_4(sc, PGT_REG_CTRL_STAT, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_RESET_DELAY);
  677 }
  679 void
pgt_init_intr(struct pgt_softc *sc)
  681 {
  682         if ((sc->sc_flags & SC_UNINITIALIZED) == 0) {
  683                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: spurious initialization\n",
sc->sc_dev.dv_xname));
  686         } else {
sc->sc_flags &= ~SC_UNINITIALIZED;
wakeup(&sc->sc_flags);
  689         }
  690 }
  692 /*
  693  * If called with a NULL last_nextpkt, only the mgmt queue will be checked
  694  * for new packets.
  695  */
  696 void
pgt_update_intr(struct pgt_softc *sc, int hack)
  698 {
  699         /* priority order */
  700         enum pgt_queue pqs[PGT_QUEUE_COUNT] = {
PGT_QUEUE_MGMT_TX, PGT_QUEUE_MGMT_RX, 
PGT_QUEUE_DATA_HIGH_TX, PGT_QUEUE_DATA_HIGH_RX, 
PGT_QUEUE_DATA_LOW_TX, PGT_QUEUE_DATA_LOW_RX
  704         };
  705         struct mbuf *m;
uint32_t npend;
  707         unsigned int dirtycount;
  708         int i;
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE);
pgt_debug_events(sc, "intr");
  714         /*
  715          * Check for completion of tx in their dirty queues.
  716          * Check completion of rx into their dirty queues.
  717          */
  718         for (i = 0; i < PGT_QUEUE_COUNT; i++) {
size_t qdirty, qfree, qtotal;
qdirty = sc->sc_dirtyq_count[pqs[i]];
qfree = sc->sc_freeq_count[pqs[i]];
qtotal = qdirty + qfree;
  724                 /*
  725                  * We want the wrap-around here.
  726                  */
  727                 if (pgt_queue_is_rx(pqs[i])) {
  728                         int data;
data = pgt_queue_is_data(pqs[i]);
  731 #ifdef PGT_BUGGY_INTERRUPT_RECOVERY
  732                         if (hack && data)
  733                                 continue;
  734 #endif
npend = pgt_queue_frags_pending(sc, pqs[i]);
  736                         /*
  737                          * Receive queues clean up below, so qfree must
  738                          * always be qtotal (qdirty is 0).
  739                          */
  740                         if (npend > qfree) {
  741                                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: rx queue [%u] "
  743                                             "overflowed by %u\n",
sc->sc_dev.dv_xname, pqs[i],
npend - qfree));
sc->sc_flags |= SC_INTR_RESET;
  747                                 break;
  748                         }
  749                         while (qfree-- > npend)
pgt_rxdone(sc, pqs[i]);
  751                 } else {
npend = pgt_queue_frags_pending(sc, pqs[i]);
  753                         if (npend > qdirty) {
  754                                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: tx queue [%u] "
  756                                             "underflowed by %u\n",
sc->sc_dev.dv_xname, pqs[i],
npend - qdirty));
sc->sc_flags |= SC_INTR_RESET;
  760                                 break;
  761                         }
  762                         /*
  763                          * If the free queue was empty, or the data transmit
  764                          * queue just became empty, wake up any waiters.
  765                          */
  766                         if (qdirty > npend) {
  767                                 if (pgt_queue_is_data(pqs[i])) {
sc->sc_ic.ic_if.if_timer = 0;
sc->sc_ic.ic_if.if_flags &=
  770                                             ~IFF_OACTIVE;
  771                                 }
  772                                 while (qdirty-- > npend)
pgt_txdone(sc, pqs[i]);
  774                         }
  775                 }
  776         }
  778         /*
  779          * This is the deferred completion for received management frames
  780          * and where we queue network frames for stack input. 
  781          */
dirtycount = sc->sc_dirtyq_count[PGT_QUEUE_MGMT_RX];
  783         while (!TAILQ_EMPTY(&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX])) {
  784                 struct pgt_mgmt_desc *pmd;
pmd = TAILQ_FIRST(&sc->sc_mgmtinprog);
  787                 /*
  788                  * If there is no mgmt request in progress or the operation
  789                  * returned is explicitly a trap, this pmd will essentially
  790                  * be ignored.
  791                  */
pgt_mgmtrx_completion(sc, pmd);
  793         }
sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_MGMT_RX] =
htole32(dirtycount +
letoh32(sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_MGMT_RX]));
dirtycount = sc->sc_dirtyq_count[PGT_QUEUE_DATA_HIGH_RX];
  799         while (!TAILQ_EMPTY(&sc->sc_dirtyq[PGT_QUEUE_DATA_HIGH_RX])) {
  800                 if ((m = pgt_datarx_completion(sc, PGT_QUEUE_DATA_HIGH_RX)))
pgt_input_frames(sc, m);
  802         }
sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_HIGH_RX] =
htole32(dirtycount +
letoh32(sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_HIGH_RX]));
dirtycount = sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_RX];
  808         while (!TAILQ_EMPTY(&sc->sc_dirtyq[PGT_QUEUE_DATA_LOW_RX])) {
  809                 if ((m = pgt_datarx_completion(sc, PGT_QUEUE_DATA_LOW_RX)))
pgt_input_frames(sc, m);
  811         }
sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_LOW_RX] =
htole32(dirtycount +
letoh32(sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_LOW_RX]));
  816         /*
  817          * Write out what we've finished with.
  818          */
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD);
  822 }
  824 struct mbuf *
pgt_ieee80211_encap(struct pgt_softc *sc, struct ether_header *eh,
  826     struct mbuf *m, struct ieee80211_node **ni)
  827 {
  828         struct ieee80211com *ic;
  829         struct ieee80211_frame *frame;
  830         struct llc *snap;
ic = &sc->sc_ic;
  833         if (ni != NULL && ic->ic_opmode == IEEE80211_M_MONITOR) {
  834                 *ni = ieee80211_ref_node(ic->ic_bss);
  835                 (*ni)->ni_inact = 0;
  836                 return (m);
  837         }
M_PREPEND(m, sizeof(*frame) + sizeof(*snap), M_DONTWAIT);
  840         if (m != NULL)
m = m_pullup(m, sizeof(*frame) + sizeof(*snap));
  842         if (m == NULL)
  843                 return (m);
frame = mtod(m, struct ieee80211_frame *);
snap = (struct llc *)&frame[1];
  846         if (ni != NULL) {
  847                 if (ic->ic_opmode == IEEE80211_M_STA) {
  848                         *ni = ieee80211_ref_node(ic->ic_bss);
  849                 } else {
  850                         *ni = ieee80211_find_node(ic, eh->ether_shost);
  851                         /*
  852                          * Make up associations for ad-hoc mode.  To support
  853                          * ad-hoc WPA, we'll need to maintain a bounded
  854                          * pool of ad-hoc stations.
  855                          */
  856                         if (*ni == NULL &&
ic->ic_opmode != IEEE80211_M_HOSTAP) {
  858                                 *ni = ieee80211_dup_bss(ic, eh->ether_shost);
  859                                 if (*ni != NULL) {
  860                                         (*ni)->ni_associd = 1;
ic->ic_newassoc(ic, *ni, 1);
  862                                 }
  863                         }
  864                         if (*ni == NULL) {
m_freem(m);
  866                                 return (NULL);
  867                         }
  868                 }
  869                 (*ni)->ni_inact = 0;
  870         }
snap->llc_dsap = snap->llc_ssap = LLC_SNAP_LSAP;
snap->llc_control = LLC_UI;
snap->llc_snap.org_code[0] = 0;
snap->llc_snap.org_code[1] = 0;
snap->llc_snap.org_code[2] = 0;
snap->llc_snap.ether_type = eh->ether_type;
frame->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
  878         /* Doesn't look like much of the 802.11 header is available. */
  879         *(uint16_t *)frame->i_dur = *(uint16_t *)frame->i_seq = 0;
  880         /*
  881          * Translate the addresses; WDS is not handled.
  882          */
  883         switch (ic->ic_opmode) {
  884         case IEEE80211_M_STA:
frame->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
IEEE80211_ADDR_COPY(frame->i_addr1, eh->ether_dhost);
IEEE80211_ADDR_COPY(frame->i_addr2, ic->ic_bss->ni_bssid);
IEEE80211_ADDR_COPY(frame->i_addr3, eh->ether_shost);
  889                 break;
  890         case IEEE80211_M_IBSS:
  891         case IEEE80211_M_AHDEMO:
frame->i_fc[1] = IEEE80211_FC1_DIR_NODS;
IEEE80211_ADDR_COPY(frame->i_addr1, eh->ether_dhost);
IEEE80211_ADDR_COPY(frame->i_addr2, eh->ether_shost);
IEEE80211_ADDR_COPY(frame->i_addr3, ic->ic_bss->ni_bssid);
  896                 break;
  897         case IEEE80211_M_HOSTAP:
  898                 /* HostAP forwarding defaults to being done on firmware. */
frame->i_fc[1] = IEEE80211_FC1_DIR_TODS;
IEEE80211_ADDR_COPY(frame->i_addr1, ic->ic_bss->ni_bssid);
IEEE80211_ADDR_COPY(frame->i_addr2, eh->ether_shost);
IEEE80211_ADDR_COPY(frame->i_addr3, eh->ether_dhost);
  903                 break;
  904         default:
  905                 break;
  906         }
  907         return (m);
  908 }
  910 void
pgt_input_frames(struct pgt_softc *sc, struct mbuf *m)
  912 {
  913         struct ether_header eh;
  914         struct ifnet *ifp;
  915         struct ieee80211_channel *chan;
  916         struct ieee80211_node *ni;
  917         struct ieee80211com *ic;
  918         struct pgt_rx_annex *pra;
  919         struct pgt_rx_header *pha;
  920         struct mbuf *next;
  921         unsigned int n;
uint32_t rstamp;
uint8_t rate, rssi;
ic = &sc->sc_ic;
ifp = &ic->ic_if;
  927         for (next = m; m != NULL; m = next) {
next = m->m_nextpkt;
m->m_nextpkt = NULL;
  931                 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
  932                         if (m->m_len < sizeof(*pha)) {
m = m_pullup(m, sizeof(*pha));
  934                                 if (m == NULL) {
  935                                         if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: m_pullup "
  937                                                     "failure\n",
sc->sc_dev.dv_xname));
ifp->if_ierrors++;
  940                                         continue;
  941                                 }
  942                         }
pha = mtod(m, struct pgt_rx_header *);
pra = NULL;
  945                         goto input;
  946                 }
  948                 if (m->m_len < sizeof(*pra)) {
m = m_pullup(m, sizeof(*pra));
  950                         if (m == NULL) {
  951                                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: m_pullup failure\n",
sc->sc_dev.dv_xname));
ifp->if_ierrors++;
  955                                 continue;
  956                         }
  957                 }
pra = mtod(m, struct pgt_rx_annex *);
pha = &pra->pra_header;
  960                 if (sc->sc_debug & SC_DEBUG_RXANNEX)
DPRINTF(("%s: rx annex: ? %04x "
  962                             "len %u clock %u flags %02x ? %02x rate %u ? %02x "
  963                             "freq %u ? %04x rssi %u pad %02x%02x%02x\n",
sc->sc_dev.dv_xname,
letoh16(pha->pra_unknown0),
letoh16(pha->pra_length),
letoh32(pha->pra_clock), pha->pra_flags,
pha->pra_unknown1, pha->pra_rate,
pha->pra_unknown2, letoh32(pha->pra_frequency),
pha->pra_unknown3, pha->pra_rssi,
pha->pra_pad[0], pha->pra_pad[1], pha->pra_pad[2]));
  972                 if (sc->sc_debug & SC_DEBUG_RXETHER)
DPRINTF(("%s: rx ether: %s < %s 0x%04x\n",
sc->sc_dev.dv_xname,
ether_sprintf(pra->pra_ether_dhost),
ether_sprintf(pra->pra_ether_shost),
ntohs(pra->pra_ether_type)));
memcpy(eh.ether_dhost, pra->pra_ether_dhost, ETHER_ADDR_LEN);
memcpy(eh.ether_shost, pra->pra_ether_shost, ETHER_ADDR_LEN);
eh.ether_type = pra->pra_ether_type;
input:
  984                 /*
  985                  * This flag is set if e.g. packet could not be decrypted.
  986                  */
  987                 if (pha->pra_flags & PRA_FLAG_BAD) {
ifp->if_ierrors++;
m_freem(m);
  990                         continue;
  991                 }
  993                 /*
  994                  * After getting what we want, chop off the annex, then
  995                  * turn into something that looks like it really was
  996                  * 802.11.
  997                  */
rssi = pha->pra_rssi;
rstamp = letoh32(pha->pra_clock);
rate = pha->pra_rate;
n = ieee80211_mhz2ieee(letoh32(pha->pra_frequency), 0);
 1002                 if (n <= IEEE80211_CHAN_MAX)
chan = &ic->ic_channels[n];
 1004                 else
chan = ic->ic_bss->ni_chan;
 1006                 /* Send to 802.3 listeners. */
 1007                 if (pra) {
m_adj(m, sizeof(*pra));
 1009                 } else
m_adj(m, sizeof(*pha));
m = pgt_ieee80211_encap(sc, &eh, m, &ni);
 1013                 if (m != NULL) {
 1014 #if NBPFILTER > 0
 1015                         if (sc->sc_drvbpf != NULL) {
 1016                                 struct mbuf mb;
 1017                                 struct pgt_rx_radiotap_hdr *tap = &sc->sc_rxtap;
tap->wr_flags = 0;
tap->wr_chan_freq = htole16(chan->ic_freq);
tap->wr_chan_flags = htole16(chan->ic_flags);
tap->wr_rssi = rssi;
tap->wr_max_rssi = ic->ic_max_rssi;
mb.m_data = (caddr_t)tap;
mb.m_len = sc->sc_rxtap_len;
mb.m_next = m;
mb.m_nextpkt = NULL;
mb.m_type = 0;
mb.m_flags = 0;
bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
 1032                         }
 1033 #endif
ni->ni_rssi = rssi;
ni->ni_rstamp = rstamp;
ieee80211_input(ifp, m, ni, rssi, rstamp);
 1037                         /*
 1038                          * The frame may have caused the node to be marked for
 1039                          * reclamation (e.g. in response to a DEAUTH message)
 1040                          * so use free_node here instead of unref_node.
 1041                          */
 1042                         if (ni == ic->ic_bss)
ieee80211_unref_node(&ni);
 1044                         else
ieee80211_release_node(&sc->sc_ic, ni);
 1046                 } else {
ifp->if_ierrors++;
 1048                 }
 1049         }
 1050 }
 1052 void
pgt_wakeup_intr(struct pgt_softc *sc)
 1054 {
 1055         int shouldupdate;
 1056         int i;
shouldupdate = 0;
 1059         /* Check for any queues being empty before updating. */
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTREAD);
 1063         for (i = 0; !shouldupdate && i < PGT_QUEUE_COUNT; i++) {
 1064                 if (pgt_queue_is_tx(i))
shouldupdate = pgt_queue_frags_pending(sc, i);
 1066                 else
shouldupdate = pgt_queue_frags_pending(sc, i) <
sc->sc_freeq_count[i];
 1069         }
 1070         if (!TAILQ_EMPTY(&sc->sc_mgmtinprog))
shouldupdate = 1;
 1072         if (sc->sc_debug & SC_DEBUG_POWER)
DPRINTF(("%s: wakeup interrupt (update = %d)\n",
sc->sc_dev.dv_xname, shouldupdate));
sc->sc_flags &= ~SC_POWERSAVE;
 1076         if (shouldupdate) {
pgt_write_4_flush(sc, PGT_REG_DEV_INT, PGT_DEV_INT_UPDATE);
DELAY(PGT_WRITEIO_DELAY);
 1079         }
 1080 }
 1082 void
pgt_sleep_intr(struct pgt_softc *sc)
 1084 {
 1085         int allowed;
 1086         int i;
allowed = 1;
 1089         /* Check for any queues not being empty before allowing. */
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTREAD);
 1093         for (i = 0; allowed && i < PGT_QUEUE_COUNT; i++) {
 1094                 if (pgt_queue_is_tx(i))
allowed = pgt_queue_frags_pending(sc, i) == 0;
 1096                 else
allowed = pgt_queue_frags_pending(sc, i) >=
sc->sc_freeq_count[i];
 1099         }
 1100         if (!TAILQ_EMPTY(&sc->sc_mgmtinprog))
allowed = 0;
 1102         if (sc->sc_debug & SC_DEBUG_POWER)
DPRINTF(("%s: sleep interrupt (allowed = %d)\n",
sc->sc_dev.dv_xname, allowed));
 1105         if (allowed && sc->sc_ic.ic_flags & IEEE80211_F_PMGTON) {
sc->sc_flags |= SC_POWERSAVE;
pgt_write_4_flush(sc, PGT_REG_DEV_INT, PGT_DEV_INT_SLEEP);
DELAY(PGT_WRITEIO_DELAY);
 1109         }
 1110 }
 1112 void
pgt_empty_traps(struct pgt_softc_kthread *sck)
 1114 {
 1115         struct pgt_async_trap *pa;
 1116         struct mbuf *m;
 1118         while (!TAILQ_EMPTY(&sck->sck_traps)) {
pa = TAILQ_FIRST(&sck->sck_traps);
TAILQ_REMOVE(&sck->sck_traps, pa, pa_link);
m = pa->pa_mbuf;
m_freem(m);
 1123         }
 1124 }
 1126 void
pgt_per_device_kthread(void *argp)
 1128 {
 1129         struct pgt_softc *sc;
 1130         struct pgt_softc_kthread *sck;
 1131         struct pgt_async_trap *pa;
 1132         struct mbuf *m;
 1133         int s;
sc = argp;
sck = &sc->sc_kthread;
 1137         while (!sck->sck_exit) {
 1138                 if (!sck->sck_update && !sck->sck_reset &&
TAILQ_EMPTY(&sck->sck_traps))
tsleep(&sc->sc_kthread, 0, "pgtkth", 0);
 1141                 if (sck->sck_reset) {
DPRINTF(("%s: [thread] async reset\n",
sc->sc_dev.dv_xname));
sck->sck_reset = 0;
sck->sck_update = 0;
pgt_empty_traps(sck);
s = splnet();
pgt_stop(sc, SC_NEEDS_RESET);
splx(s);
 1150                 } else if (!TAILQ_EMPTY(&sck->sck_traps)) {
DPRINTF(("%s: [thread] got a trap\n",
sc->sc_dev.dv_xname));
pa = TAILQ_FIRST(&sck->sck_traps);
TAILQ_REMOVE(&sck->sck_traps, pa, pa_link);
m = pa->pa_mbuf;
m_adj(m, sizeof(*pa));
pgt_update_sw_from_hw(sc, pa, m);
m_freem(m);
 1159                 } else if (sck->sck_update) {
sck->sck_update = 0;
pgt_update_sw_from_hw(sc, NULL, NULL);
 1162                 }
 1163         }
pgt_empty_traps(sck);
kthread_exit(0);
 1166 }
 1168 void
pgt_async_reset(struct pgt_softc *sc)
 1170 {
 1171         if (sc->sc_flags & (SC_DYING | SC_NEEDS_RESET))
 1172                 return;
sc->sc_kthread.sck_reset = 1;
wakeup(&sc->sc_kthread);
 1175 }
 1177 void
pgt_async_update(struct pgt_softc *sc)
 1179 {
 1180         if (sc->sc_flags & SC_DYING)
 1181                 return;
sc->sc_kthread.sck_update = 1;
wakeup(&sc->sc_kthread);
 1184 }
 1186 int
pgt_intr(void *arg)
 1188 {
 1189         struct pgt_softc *sc;
 1190         struct ifnet *ifp;
u_int32_t reg;
sc = arg;
ifp = &sc->sc_ic.ic_if;
 1196         /*
 1197          * Here the Linux driver ands in the value of the INT_EN register,
 1198          * and masks off everything but the documented interrupt bits.  Why?
 1199          *
 1200          * Unknown bit 0x4000 is set upon initialization, 0x8000000 some
 1201          * other times.
 1202          */
 1203         if (sc->sc_ic.ic_flags & IEEE80211_F_PMGTON &&
sc->sc_flags & SC_POWERSAVE) {
 1205                 /*
 1206                  * Don't try handling the interrupt in sleep mode.
 1207                  */
reg = pgt_read_4(sc, PGT_REG_CTRL_STAT);
 1209                 if (reg & PGT_CTRL_STAT_SLEEPMODE)
 1210                         return (0);
 1211         }
reg = pgt_read_4(sc, PGT_REG_INT_STAT);
 1213         if (reg == 0)
 1214                 return (0); /* This interrupt is not from us */
pgt_write_4_flush(sc, PGT_REG_INT_ACK, reg);
 1217         if (reg & PGT_INT_STAT_INIT)
pgt_init_intr(sc);
 1219         if (reg & PGT_INT_STAT_UPDATE) {
pgt_update_intr(sc, 0);
 1221                 /*
 1222                  * If we got an update, it's not really asleep.
 1223                  */
sc->sc_flags &= ~SC_POWERSAVE;
 1225                 /*
 1226                  * Pretend I have any idea what the documentation
 1227                  * would say, and just give it a shot sending an
 1228                  * "update" after acknowledging the interrupt
 1229                  * bits and writing out the new control block.
 1230                  */
pgt_write_4_flush(sc, PGT_REG_DEV_INT, PGT_DEV_INT_UPDATE);
DELAY(PGT_WRITEIO_DELAY);
 1233         }
 1234         if (reg & PGT_INT_STAT_SLEEP && !(reg & PGT_INT_STAT_WAKEUP))
pgt_sleep_intr(sc);
 1236         if (reg & PGT_INT_STAT_WAKEUP)
pgt_wakeup_intr(sc);
 1239         if (sc->sc_flags & SC_INTR_RESET) {
sc->sc_flags &= ~SC_INTR_RESET;
pgt_async_reset(sc);
 1242         }
 1244         if (reg & ~PGT_INT_STAT_SOURCES && sc->sc_debug & SC_DEBUG_UNEXPECTED) {
DPRINTF(("%s: unknown interrupt bits %#x (stat %#x)\n",
sc->sc_dev.dv_xname,
reg & ~PGT_INT_STAT_SOURCES,
pgt_read_4(sc, PGT_REG_CTRL_STAT)));
 1249         }
 1251         if (!IFQ_IS_EMPTY(&ifp->if_snd))
pgt_start(ifp);
 1254         return (1);
 1255 }
 1257 void
pgt_txdone(struct pgt_softc *sc, enum pgt_queue pq)
 1259 {
 1260         struct pgt_desc *pd;
pd = TAILQ_FIRST(&sc->sc_dirtyq[pq]);
TAILQ_REMOVE(&sc->sc_dirtyq[pq], pd, pd_link);
sc->sc_dirtyq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link);
sc->sc_freeq_count[pq]++;
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0,
pd->pd_dmam->dm_mapsize,
BUS_DMASYNC_POSTREAD);
 1270         /* Management frames want completion information. */
 1271         if (sc->sc_debug & SC_DEBUG_QUEUES) {
DPRINTF(("%s: queue: tx %u <- [%u]\n",
sc->sc_dev.dv_xname, pd->pd_fragnum, pq));
 1274                 if (sc->sc_debug & SC_DEBUG_MGMT && pgt_queue_is_mgmt(pq)) {
 1275                         struct pgt_mgmt_frame *pmf;
pmf = (struct pgt_mgmt_frame *)pd->pd_mem;
DPRINTF(("%s: queue: txmgmt %p <- "
 1279                             "(ver %u, op %u, flags %#x)\n",
sc->sc_dev.dv_xname,
pd, pmf->pmf_version, pmf->pmf_operation,
pmf->pmf_flags));
 1283                 }
 1284         }
pgt_unload_tx_desc_frag(sc, pd);
 1286 }
 1288 void
pgt_rxdone(struct pgt_softc *sc, enum pgt_queue pq)
 1290 {
 1291         struct pgt_desc *pd;
pd = TAILQ_FIRST(&sc->sc_freeq[pq]);
TAILQ_REMOVE(&sc->sc_freeq[pq], pd, pd_link);
sc->sc_freeq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_dirtyq[pq], pd, pd_link);
sc->sc_dirtyq_count[pq]++;
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0,
pd->pd_dmam->dm_mapsize,
BUS_DMASYNC_POSTREAD);
 1301         if (sc->sc_debug & SC_DEBUG_QUEUES)
DPRINTF(("%s: queue: rx %u <- [%u]\n",
sc->sc_dev.dv_xname, pd->pd_fragnum, pq));
 1304         if (sc->sc_debug & SC_DEBUG_UNEXPECTED &&
pd->pd_fragp->pf_flags & ~htole16(PF_FLAG_MF))
DPRINTF(("%s: unknown flags on rx [%u]: %#x\n",
sc->sc_dev.dv_xname, pq, letoh16(pd->pd_fragp->pf_flags)));
 1308 }
 1310 /*
 1311  * Traps are generally used for the firmware to report changes in state
 1312  * back to the host.  Mostly this processes changes in link state, but
 1313  * it needs to also be used to initiate WPA and other authentication
 1314  * schemes in terms of client (station) or server (access point).
 1315  */
 1316 void
pgt_trap_received(struct pgt_softc *sc, uint32_t oid, void *trapdata,
size_t size)
 1319 {
 1320         struct pgt_async_trap *pa;
 1321         struct mbuf *m;
 1322         char *p;
size_t total;
 1325         if (sc->sc_flags & SC_DYING)
 1326                 return;
total = sizeof(oid) + size + sizeof(struct pgt_async_trap);
 1329         if (total >= MINCLSIZE) {
MGETHDR(m, M_DONTWAIT, MT_DATA);
 1331                 if (m == NULL)
 1332                         return;
MCLGET(m, M_DONTWAIT);
 1334                 if (!(m->m_flags & M_EXT)) {
m_freem(m);
m = NULL;
 1337                 }
 1338         } else
m = m_get(M_DONTWAIT, MT_DATA);
 1341         if (m == NULL)
 1342                 return;
 1343         else
m->m_len = total;
pa = mtod(m, struct pgt_async_trap *);
p = mtod(m, char *) + sizeof(*pa);
 1348         *(uint32_t *)p = oid;
p += sizeof(uint32_t);
memcpy(p, trapdata, size);
pa->pa_mbuf = m;
TAILQ_INSERT_TAIL(&sc->sc_kthread.sck_traps, pa, pa_link);
wakeup(&sc->sc_kthread);
 1355 }
 1357 /*
 1358  * Process a completed management response (all requests should be
 1359  * responded to, quickly) or an event (trap).
 1360  */
 1361 void
pgt_mgmtrx_completion(struct pgt_softc *sc, struct pgt_mgmt_desc *pmd)
 1363 {
 1364         struct pgt_desc *pd;
 1365         struct pgt_mgmt_frame *pmf;
uint32_t oid, size;
pd = TAILQ_FIRST(&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX]);
TAILQ_REMOVE(&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX], pd, pd_link);
sc->sc_dirtyq_count[PGT_QUEUE_MGMT_RX]--;
TAILQ_INSERT_TAIL(&sc->sc_freeq[PGT_QUEUE_MGMT_RX],
pd, pd_link);
sc->sc_freeq_count[PGT_QUEUE_MGMT_RX]++;
 1374         if (letoh16(pd->pd_fragp->pf_size) < sizeof(*pmf)) {
 1375                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: mgmt desc too small: %u\n",
sc->sc_dev.dv_xname,
letoh16(pd->pd_fragp->pf_size)));
 1379                 goto out_nopmd;
 1380         }
pmf = (struct pgt_mgmt_frame *)pd->pd_mem;
 1382         if (pmf->pmf_version != PMF_VER) {
 1383                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: unknown mgmt version %u\n",
sc->sc_dev.dv_xname, pmf->pmf_version));
 1386                 goto out_nopmd;
 1387         }
 1388         if (pmf->pmf_device != PMF_DEV) {
 1389                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: unknown mgmt dev %u\n",
sc->sc_dev.dv_xname, pmf->pmf_device));
 1392                 goto out;
 1393         }
 1394         if (pmf->pmf_flags & ~PMF_FLAG_VALID) {
 1395                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: unknown mgmt flags %x\n",
sc->sc_dev.dv_xname,
pmf->pmf_flags & ~PMF_FLAG_VALID));
 1399                 goto out;
 1400         }
 1401         if (pmf->pmf_flags & PMF_FLAG_LE) {
oid = letoh32(pmf->pmf_oid);
size = letoh32(pmf->pmf_size);
 1404         } else {
oid = betoh32(pmf->pmf_oid);
size = betoh32(pmf->pmf_size);
 1407         }
 1408         if (pmf->pmf_operation == PMF_OP_TRAP) {
pmd = NULL; /* ignored */
DPRINTF(("%s: mgmt trap received (op %u, oid %#x, len %u)\n",
sc->sc_dev.dv_xname,
pmf->pmf_operation, oid, size));
pgt_trap_received(sc, oid, (char *)pmf + sizeof(*pmf),
min(size, PGT_FRAG_SIZE - sizeof(*pmf)));
 1415                 goto out_nopmd;
 1416         }
 1417         if (pmd == NULL) {
 1418                 if (sc->sc_debug & (SC_DEBUG_UNEXPECTED | SC_DEBUG_MGMT))
DPRINTF(("%s: spurious mgmt received "
 1420                             "(op %u, oid %#x, len %u)\n", sc->sc_dev.dv_xname,
pmf->pmf_operation, oid, size));
 1422                 goto out_nopmd;
 1423         }
 1424         switch (pmf->pmf_operation) {
 1425         case PMF_OP_RESPONSE:
pmd->pmd_error = 0;
 1427                 break;
 1428         case PMF_OP_ERROR:
pmd->pmd_error = EPERM;
 1430                 goto out;
 1431         default:
 1432                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: unknown mgmt op %u\n",
sc->sc_dev.dv_xname, pmf->pmf_operation));
pmd->pmd_error = EIO;
 1436                 goto out;
 1437         }
 1438         if (oid != pmd->pmd_oid) {
 1439                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: mgmt oid changed from %#x -> %#x\n",
sc->sc_dev.dv_xname, pmd->pmd_oid, oid));
pmd->pmd_oid = oid;
 1443         }
 1444         if (pmd->pmd_recvbuf != NULL) {
 1445                 if (size > PGT_FRAG_SIZE) {
 1446                         if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: mgmt oid %#x has bad size %u\n",
sc->sc_dev.dv_xname, oid, size));
pmd->pmd_error = EIO;
 1450                         goto out;
 1451                 }
 1452                 if (size > pmd->pmd_len)
pmd->pmd_error = ENOMEM;
 1454                 else
memcpy(pmd->pmd_recvbuf, (char *)pmf + sizeof(*pmf),
size);
pmd->pmd_len = size;
 1458         }
out:
TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link);
wakeup_one(pmd);
 1463         if (sc->sc_debug & SC_DEBUG_MGMT)
DPRINTF(("%s: queue: mgmt %p <- (op %u, oid %#x, len %u)\n",
sc->sc_dev.dv_xname, pmd, pmf->pmf_operation,
pmd->pmd_oid, pmd->pmd_len));
out_nopmd:
pgt_reinit_rx_desc_frag(sc, pd);
 1469 }
 1471 /*
 1472  * Queue packets for reception and defragmentation.  I don't know now
 1473  * whether the rx queue being full enough to start, but not finish,
 1474  * queueing a fragmented packet, can happen.
 1475  */
 1476 struct mbuf *
pgt_datarx_completion(struct pgt_softc *sc, enum pgt_queue pq)
 1478 {
 1479         struct ifnet *ifp;
 1480         struct pgt_desc *pd;
 1481         struct mbuf *top, **mp, *m;
size_t datalen;
uint16_t morefrags, dataoff;
 1484         int tlen = 0;
ifp = &sc->sc_ic.ic_if;
m = NULL;
top = NULL;
mp = &top;
 1491         while ((pd = TAILQ_FIRST(&sc->sc_dirtyq[pq])) != NULL) {
TAILQ_REMOVE(&sc->sc_dirtyq[pq], pd, pd_link);
sc->sc_dirtyq_count[pq]--;
datalen = letoh16(pd->pd_fragp->pf_size);
dataoff = letoh32(pd->pd_fragp->pf_addr) - pd->pd_dmaaddr;
morefrags = pd->pd_fragp->pf_flags & htole16(PF_FLAG_MF);
 1498                 if (sc->sc_debug & SC_DEBUG_RXFRAG)
DPRINTF(("%s: rx frag: len %u memoff %u flags %x\n",
sc->sc_dev.dv_xname, datalen, dataoff,
pd->pd_fragp->pf_flags));
 1503                 /* Add the (two+?) bytes for the header. */
 1504                 if (datalen + dataoff > PGT_FRAG_SIZE) {
 1505                         if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s data rx too big: %u\n",
sc->sc_dev.dv_xname, datalen));
 1508                         goto fail;
 1509                 }
 1511                 if (m == NULL)
MGETHDR(m, M_DONTWAIT, MT_DATA);
 1513                 else
m = m_get(M_DONTWAIT, MT_DATA);
 1516                 if (m == NULL)
 1517                         goto fail;
 1518                 if (datalen >= MINCLSIZE) {
MCLGET(m, M_DONTWAIT);
 1520                         if (!(m->m_flags & M_EXT)) {
m_free(m);
 1522                                 goto fail;
 1523                         }
 1524                 }
bcopy(pd->pd_mem + dataoff, mtod(m, char *), datalen);
m->m_len = datalen;
tlen += datalen;
 1529                 *mp = m;
mp = &m->m_next;
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link);
sc->sc_freeq_count[pq]++;
pgt_reinit_rx_desc_frag(sc, pd);
 1536                 if (!morefrags)
 1537                         break;
 1538         }
 1540         if (top) {
ifp->if_ipackets++;
top->m_pkthdr.len = tlen;
top->m_pkthdr.rcvif = ifp;
 1544         }
 1545         return (top);
fail:
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link);
sc->sc_freeq_count[pq]++;
pgt_reinit_rx_desc_frag(sc, pd);
ifp->if_ierrors++;
 1553         if (top)
m_freem(top);
 1555         return (NULL);
 1556 }
 1558 int
pgt_oid_get(struct pgt_softc *sc, enum pgt_oid oid,
 1560     void *arg, size_t arglen)
 1561 {
 1562         struct pgt_mgmt_desc pmd;
 1563         int error;
bzero(&pmd, sizeof(pmd));
pmd.pmd_recvbuf = arg;
pmd.pmd_len = arglen;
pmd.pmd_oid = oid;
error = pgt_mgmt_request(sc, &pmd);
 1571         if (error == 0)
error = pmd.pmd_error;
 1573         if (error != 0 && error != EPERM && sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: failure getting oid %#x: %d\n",
sc->sc_dev.dv_xname, oid, error));
 1577         return (error);
 1578 }
 1580 int
pgt_oid_retrieve(struct pgt_softc *sc, enum pgt_oid oid,
 1582     void *arg, size_t arglen)
 1583 {
 1584         struct pgt_mgmt_desc pmd;
 1585         int error;
bzero(&pmd, sizeof(pmd));
pmd.pmd_sendbuf = arg;
pmd.pmd_recvbuf = arg;
pmd.pmd_len = arglen;
pmd.pmd_oid = oid;
error = pgt_mgmt_request(sc, &pmd);
 1594         if (error == 0)
error = pmd.pmd_error;
 1596         if (error != 0 && error != EPERM && sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: failure retrieving oid %#x: %d\n",
sc->sc_dev.dv_xname, oid, error));
 1600         return (error);
 1601 }
 1603 int
pgt_oid_set(struct pgt_softc *sc, enum pgt_oid oid,
 1605     const void *arg, size_t arglen)
 1606 {
 1607         struct pgt_mgmt_desc pmd;
 1608         int error;
bzero(&pmd, sizeof(pmd));
pmd.pmd_sendbuf = arg;
pmd.pmd_len = arglen;
pmd.pmd_oid = oid;
error = pgt_mgmt_request(sc, &pmd);
 1616         if (error == 0)
error = pmd.pmd_error;
 1618         if (error != 0 && error != EPERM && sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: failure setting oid %#x: %d\n",
sc->sc_dev.dv_xname, oid, error));
 1622         return (error);
 1623 }
 1625 void
pgt_state_dump(struct pgt_softc *sc)
 1627 {
printf("%s: state dump: control 0x%08x interrupt 0x%08x\n",
sc->sc_dev.dv_xname,
pgt_read_4(sc, PGT_REG_CTRL_STAT),
pgt_read_4(sc, PGT_REG_INT_STAT));
printf("%s: state dump: driver curfrag[]\n",
sc->sc_dev.dv_xname);
printf("%s: 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
sc->sc_dev.dv_xname,
letoh32(sc->sc_cb->pcb_driver_curfrag[0]),
letoh32(sc->sc_cb->pcb_driver_curfrag[1]),
letoh32(sc->sc_cb->pcb_driver_curfrag[2]),
letoh32(sc->sc_cb->pcb_driver_curfrag[3]),
letoh32(sc->sc_cb->pcb_driver_curfrag[4]),
letoh32(sc->sc_cb->pcb_driver_curfrag[5]));
printf("%s: state dump: device curfrag[]\n",
sc->sc_dev.dv_xname);
printf("%s: 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
sc->sc_dev.dv_xname,
letoh32(sc->sc_cb->pcb_device_curfrag[0]),
letoh32(sc->sc_cb->pcb_device_curfrag[1]),
letoh32(sc->sc_cb->pcb_device_curfrag[2]),
letoh32(sc->sc_cb->pcb_device_curfrag[3]),
letoh32(sc->sc_cb->pcb_device_curfrag[4]),
letoh32(sc->sc_cb->pcb_device_curfrag[5]));
 1656 }
 1658 int
pgt_mgmt_request(struct pgt_softc *sc, struct pgt_mgmt_desc *pmd)
 1660 {
 1661         struct pgt_desc *pd;
 1662         struct pgt_mgmt_frame *pmf;
 1663         int error, i;
 1665         if (sc->sc_flags & (SC_DYING | SC_NEEDS_RESET))
 1666                 return (EIO);
 1667         if (pmd->pmd_len > PGT_FRAG_SIZE - sizeof(*pmf))
 1668                 return (ENOMEM);
pd = TAILQ_FIRST(&sc->sc_freeq[PGT_QUEUE_MGMT_TX]);
 1670         if (pd == NULL)
 1671                 return (ENOMEM);
error = pgt_load_tx_desc_frag(sc, PGT_QUEUE_MGMT_TX, pd);
 1673         if (error)
 1674                 return (error);
pmf = (struct pgt_mgmt_frame *)pd->pd_mem;
pmf->pmf_version = PMF_VER;
 1677         /* "get" and "retrieve" operations look the same */
 1678         if (pmd->pmd_recvbuf != NULL)
pmf->pmf_operation = PMF_OP_GET;
 1680         else
pmf->pmf_operation = PMF_OP_SET;
pmf->pmf_oid = htobe32(pmd->pmd_oid);
pmf->pmf_device = PMF_DEV;
pmf->pmf_flags = 0;
pmf->pmf_size = htobe32(pmd->pmd_len);
 1686         /* "set" and "retrieve" operations both send data */
 1687         if (pmd->pmd_sendbuf != NULL)
memcpy((char *)pmf + sizeof(*pmf), pmd->pmd_sendbuf,
pmd->pmd_len);
 1690         else
bzero((char *)pmf + sizeof(*pmf), pmd->pmd_len);
pmd->pmd_error = EINPROGRESS;
TAILQ_INSERT_TAIL(&sc->sc_mgmtinprog, pmd, pmd_link);
 1694         if (sc->sc_debug & SC_DEBUG_MGMT)
DPRINTF(("%s: queue: mgmt %p -> (op %u, oid %#x, len %u)\n",
sc->sc_dev.dv_xname,
pmd, pmf->pmf_operation,
pmd->pmd_oid, pmd->pmd_len));
pgt_desc_transmit(sc, PGT_QUEUE_MGMT_TX, pd,
 1700             sizeof(*pmf) + pmd->pmd_len, 0);
 1701         /*
 1702          * Try for one second, triggering 10 times.
 1703          *
 1704          * Do our best to work around seemingly buggy CardBus controllers
 1705          * on Soekris 4521 that fail to get interrupts with alarming
 1706          * regularity: run as if an interrupt occurred and service every
 1707          * queue except for mbuf reception.
 1708          */
i = 0;
 1710         do {
 1711                 if (tsleep(pmd, 0, "pgtmgm", hz / 10) != EWOULDBLOCK)
 1712                         break;
 1713                 if (pmd->pmd_error != EINPROGRESS)
 1714                         break;
 1715                 if (sc->sc_flags & (SC_DYING | SC_NEEDS_RESET)) {
pmd->pmd_error = EIO;
TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link);
 1718                         break;
 1719                 }
 1720                 if (i != 9)
pgt_maybe_trigger(sc, PGT_QUEUE_MGMT_RX);
 1722 #ifdef PGT_BUGGY_INTERRUPT_RECOVERY
pgt_update_intr(sc, 0);
 1724 #endif
 1725         } while (i++ < 10);
 1727         if (pmd->pmd_error == EINPROGRESS) {
printf("%s: timeout waiting for management "
 1729                     "packet response to %#x\n",
sc->sc_dev.dv_xname, pmd->pmd_oid);
TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link);
 1732                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
pgt_state_dump(sc);
pgt_async_reset(sc);
error = ETIMEDOUT;
 1736         } else
error = 0;
 1739         return (error);
 1740 }
 1742 void
pgt_desc_transmit(struct pgt_softc *sc, enum pgt_queue pq, struct pgt_desc *pd,
uint16_t len, int morecoming)
 1745 {
TAILQ_REMOVE(&sc->sc_freeq[pq], pd, pd_link);
sc->sc_freeq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_dirtyq[pq], pd, pd_link);
sc->sc_dirtyq_count[pq]++;
 1750         if (sc->sc_debug & SC_DEBUG_QUEUES)
DPRINTF(("%s: queue: tx %u -> [%u]\n", sc->sc_dev.dv_xname,
pd->pd_fragnum, pq));
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE);
 1756         if (morecoming)
pd->pd_fragp->pf_flags |= htole16(PF_FLAG_MF);
pd->pd_fragp->pf_size = htole16(len);
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0,
pd->pd_dmam->dm_mapsize,
BUS_DMASYNC_POSTWRITE);
sc->sc_cb->pcb_driver_curfrag[pq] =
htole32(letoh32(sc->sc_cb->pcb_driver_curfrag[pq]) + 1);
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD);
 1767         if (!morecoming)
pgt_maybe_trigger(sc, pq);
 1769 }
 1771 void
pgt_maybe_trigger(struct pgt_softc *sc, enum pgt_queue pq)
 1773 {
 1774         unsigned int tries = 1000000 / PGT_WRITEIO_DELAY; /* one second */
uint32_t reg;
 1777         if (sc->sc_debug & SC_DEBUG_TRIGGER)
DPRINTF(("%s: triggered by queue [%u]\n",
sc->sc_dev.dv_xname, pq));
pgt_debug_events(sc, "trig");
 1781         if (sc->sc_flags & SC_POWERSAVE) {
 1782                 /* Magic values ahoy? */
 1783                 if (pgt_read_4(sc, PGT_REG_INT_STAT) == 0xabadface) {
 1784                         do {
reg = pgt_read_4(sc, PGT_REG_CTRL_STAT);
 1786                                 if (!(reg & PGT_CTRL_STAT_SLEEPMODE))
DELAY(PGT_WRITEIO_DELAY);
 1788                         } while (tries-- != 0);
 1789                         if (!(reg & PGT_CTRL_STAT_SLEEPMODE)) {
 1790                                 if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: timeout triggering from "
 1792                                             "sleep mode\n",
sc->sc_dev.dv_xname));
pgt_async_reset(sc);
 1795                                 return;
 1796                         }
 1797                 }
pgt_write_4_flush(sc, PGT_REG_DEV_INT,
PGT_DEV_INT_WAKEUP);
DELAY(PGT_WRITEIO_DELAY);
 1801                 /* read the status back in */
 1802                 (void)pgt_read_4(sc, PGT_REG_CTRL_STAT);
DELAY(PGT_WRITEIO_DELAY);
 1804         } else {
pgt_write_4_flush(sc, PGT_REG_DEV_INT, PGT_DEV_INT_UPDATE);
DELAY(PGT_WRITEIO_DELAY);
 1807         }
 1808 }
 1810 struct ieee80211_node *
pgt_ieee80211_node_alloc(struct ieee80211com *ic)
 1812 {
 1813         struct pgt_ieee80211_node *pin;
pin = malloc(sizeof(*pin), M_DEVBUF, M_NOWAIT);
 1816         if (pin != NULL) {
bzero(pin, sizeof *pin);
pin->pin_dot1x_auth = PIN_DOT1X_UNAUTHORIZED;
 1819         }
 1820         return (struct ieee80211_node *)pin;
 1821 }
 1823 void
pgt_ieee80211_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni,
 1825     int reallynew)
 1826 {
ieee80211_ref_node(ni);
 1828 }
 1830 void
pgt_ieee80211_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
 1832 {
 1833         struct pgt_ieee80211_node *pin;
pin = (struct pgt_ieee80211_node *)ni;
free(pin, M_DEVBUF);
 1837 }
 1839 void
pgt_ieee80211_node_copy(struct ieee80211com *ic, struct ieee80211_node *dst,
 1841     const struct ieee80211_node *src)
 1842 {
 1843         const struct pgt_ieee80211_node *psrc;
 1844         struct pgt_ieee80211_node *pdst;
psrc = (const struct pgt_ieee80211_node *)src;
pdst = (struct pgt_ieee80211_node *)dst;
bcopy(psrc, pdst, sizeof(*psrc));
 1849 }
 1851 int
pgt_ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
 1853     int type, int arg)
 1854 {
 1855         return (EOPNOTSUPP);
 1856 }
 1858 int
pgt_net_attach(struct pgt_softc *sc)
 1860 {
 1861         struct ieee80211com *ic = &sc->sc_ic;
 1862         struct ifnet *ifp = &ic->ic_if;
 1863         struct ieee80211_rateset *rs;
uint8_t rates[IEEE80211_RATE_MAXSIZE];
 1865         struct pgt_obj_buffer psbuffer;
 1866         struct pgt_obj_frequencies *freqs;
uint32_t phymode, country;
 1868         unsigned int chan, i, j, firstchan = -1;
 1869         int error;
psbuffer.pob_size = htole32(PGT_FRAG_SIZE * PGT_PSM_BUFFER_FRAME_COUNT);
psbuffer.pob_addr = htole32(sc->sc_psmdmam->dm_segs[0].ds_addr);
error = pgt_oid_set(sc, PGT_OID_PSM_BUFFER, &psbuffer, sizeof(country));
 1874         if (error)
 1875                 return (error);
error = pgt_oid_get(sc, PGT_OID_PHY, &phymode, sizeof(phymode));
 1877         if (error)
 1878                 return (error);
error = pgt_oid_get(sc, PGT_OID_MAC_ADDRESS, ic->ic_myaddr,
 1880             sizeof(ic->ic_myaddr));
 1881         if (error)
 1882                 return (error);
error = pgt_oid_get(sc, PGT_OID_COUNTRY, &country, sizeof(country));
 1884         if (error)
 1885                 return (error);
ifp->if_softc = sc;
ifp->if_init = pgt_init;
ifp->if_ioctl = pgt_ioctl;
ifp->if_start = pgt_start;
ifp->if_watchdog = pgt_watchdog;
ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
strlcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
IFQ_SET_READY(&ifp->if_snd);
 1898         /*
 1899          * Set channels
 1900          *
 1901          * Prism hardware likes to report supported frequencies that are
 1902          * not actually available for the country of origin.
 1903          */
j = sizeof(*freqs) + (IEEE80211_CHAN_MAX + 1) * sizeof(uint16_t);
freqs = malloc(j, M_DEVBUF, M_WAITOK);
error = pgt_oid_get(sc, PGT_OID_SUPPORTED_FREQUENCIES, freqs, j);
 1907         if (error) {
free(freqs, M_DEVBUF);
 1909                 return (error);
 1910         }
 1912         for (i = 0, j = letoh16(freqs->pof_count); i < j; i++) {
chan = ieee80211_mhz2ieee(letoh16(freqs->pof_freqlist_mhz[i]),
 1914                     0);
 1916                 if (chan > IEEE80211_CHAN_MAX) {
printf("%s: reported bogus channel (%uMHz)\n",
sc->sc_dev.dv_xname, chan);
free(freqs, M_DEVBUF);
 1920                         return (EIO);
 1921                 }
 1923                 if (letoh16(freqs->pof_freqlist_mhz[i]) < 5000) {
 1924                         if (!(phymode & htole32(PGT_OID_PHY_2400MHZ)))
 1925                                 continue;
 1926                         if (country == letoh32(PGT_COUNTRY_USA)) {
 1927                                 if (chan >= 12 && chan <= 14)
 1928                                         continue;
 1929                         }
 1930                         if (chan <= 14)
ic->ic_channels[chan].ic_flags |=
IEEE80211_CHAN_B;
ic->ic_channels[chan].ic_flags |= IEEE80211_CHAN_PUREG;
 1934                 } else {
 1935                         if (!(phymode & htole32(PGT_OID_PHY_5000MHZ)))
 1936                                 continue;
ic->ic_channels[chan].ic_flags |= IEEE80211_CHAN_A;
 1938                 }
ic->ic_channels[chan].ic_freq =
letoh16(freqs->pof_freqlist_mhz[i]);
 1943                 if (firstchan == -1)
firstchan = chan;
DPRINTF(("%s: set channel %d to freq %uMHz\n",
sc->sc_dev.dv_xname, chan,
letoh16(freqs->pof_freqlist_mhz[i])));
 1949         }
free(freqs, M_DEVBUF);
 1951         if (firstchan == -1) {
printf("%s: no channels found\n", sc->sc_dev.dv_xname);
 1953                 return (EIO);
 1954         }
 1956         /*
 1957          * Set rates
 1958          */
bzero(rates, sizeof(rates));
error = pgt_oid_get(sc, PGT_OID_SUPPORTED_RATES, rates, sizeof(rates));
 1961         if (error)
 1962                 return (error);
 1963         for (i = 0; i < sizeof(rates) && rates[i] != 0; i++) {
 1964                 switch (rates[i]) {
 1965                 case 2:
 1966                 case 4:
 1967                 case 11:
 1968                 case 22:
 1969                 case 44: /* maybe */
 1970                         if (phymode & htole32(PGT_OID_PHY_2400MHZ)) {
rs = &ic->ic_sup_rates[IEEE80211_MODE_11B];
rs->rs_rates[rs->rs_nrates++] = rates[i];
 1973                         }
 1974                 default:
 1975                         if (phymode & htole32(PGT_OID_PHY_2400MHZ)) {
rs = &ic->ic_sup_rates[IEEE80211_MODE_11G];
rs->rs_rates[rs->rs_nrates++] = rates[i];
 1978                         }
 1979                         if (phymode & htole32(PGT_OID_PHY_5000MHZ)) {
rs = &ic->ic_sup_rates[IEEE80211_MODE_11A];
rs->rs_rates[rs->rs_nrates++] = rates[i];
 1982                         }
rs = &ic->ic_sup_rates[IEEE80211_MODE_AUTO];
rs->rs_rates[rs->rs_nrates++] = rates[i];
 1985                 }
 1986         }
ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_IBSS | IEEE80211_C_PMGT |
IEEE80211_C_HOSTAP | IEEE80211_C_TXPMGT | IEEE80211_C_SHSLOT |
IEEE80211_C_SHPREAMBLE | IEEE80211_C_MONITOR;
ic->ic_opmode = IEEE80211_M_STA;
ic->ic_state = IEEE80211_S_INIT;
if_attach(ifp);
ieee80211_ifattach(ifp);
 1998         /* setup post-attach/pre-lateattach vector functions */
sc->sc_newstate = ic->ic_newstate;
ic->ic_newstate = pgt_newstate;
ic->ic_node_alloc = pgt_ieee80211_node_alloc;
ic->ic_newassoc = pgt_ieee80211_newassoc;
ic->ic_node_free = pgt_ieee80211_node_free;
ic->ic_node_copy = pgt_ieee80211_node_copy;
ic->ic_send_mgmt = pgt_ieee80211_send_mgmt;
ic->ic_max_rssi = 255;  /* rssi is a u_int8_t */
 2008         /* let net80211 handle switching around the media + resetting */
ieee80211_media_init(ifp, pgt_media_change, pgt_media_status);
 2011 #if NBPFILTER > 0
bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
 2013             sizeof(struct ieee80211_frame) + 64);
sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
sc->sc_rxtap.wr_ihdr.it_present = htole32(PGT_RX_RADIOTAP_PRESENT);
sc->sc_txtap_len = sizeof(sc->sc_txtapu);
sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
sc->sc_txtap.wt_ihdr.it_present = htole32(PGT_TX_RADIOTAP_PRESENT);
 2022 #endif
 2024         /*
 2025          * Enable shutdown and power hooks
 2026          */
sc->sc_shutdown_hook = shutdownhook_establish(pgt_shutdown, sc);
 2028         if (sc->sc_shutdown_hook == NULL)
printf("%s: WARNING: unable to establish shutdown hook\n",
sc->sc_dev.dv_xname);
sc->sc_power_hook = powerhook_establish(pgt_power, sc);
 2032         if (sc->sc_power_hook == NULL)
printf("%s: WARNING: unable to establish power hook\n",
sc->sc_dev.dv_xname);
 2036         return (0);
 2037 }
 2039 int
pgt_media_change(struct ifnet *ifp)
 2041 {
 2042         struct pgt_softc *sc = ifp->if_softc;
 2043         int error;
error = ieee80211_media_change(ifp);
 2046         if (error == ENETRESET) {
pgt_update_hw_from_sw(sc, 0, 0);
error = 0;
 2049         }
 2051         return (error);
 2052 }
 2054 void
pgt_media_status(struct ifnet *ifp, struct ifmediareq *imr)
 2056 {
 2057         struct pgt_softc *sc = ifp->if_softc;
 2058         struct ieee80211com *ic = &sc->sc_ic;
uint32_t rate;
 2060         int s;
imr->ifm_status = 0;
imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
 2065         if (!(ifp->if_flags & IFF_UP))
 2066                 return;
s = splnet();
 2070         if (ic->ic_fixed_rate != -1) {
rate = ic->ic_sup_rates[ic->ic_curmode].
rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
 2073         } else {
 2074                 if (pgt_oid_get(sc, PGT_OID_LINK_STATE, &rate, sizeof(rate)))
 2075                         return;
rate = letoh32(rate);
 2077                 if (sc->sc_debug & SC_DEBUG_LINK) {
DPRINTF(("%s: %s: link rate %u\n",
sc->sc_dev.dv_xname, __func__, rate));
 2080                 }
 2081                 if (rate == 0)
 2082                         return;
 2083         }
imr->ifm_status = IFM_AVALID;
imr->ifm_active = IFM_IEEE80211;
 2087         if (ic->ic_state == IEEE80211_S_RUN)
imr->ifm_status |= IFM_ACTIVE;
imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
 2092         switch (ic->ic_opmode) {
 2093         case IEEE80211_M_STA:
 2094                 break;
 2095         case IEEE80211_M_IBSS:
imr->ifm_active |= IFM_IEEE80211_ADHOC;
 2097                 break;
 2098         case IEEE80211_M_AHDEMO:
imr->ifm_active |= IFM_IEEE80211_ADHOC | IFM_FLAG0;
 2100                 break;
 2101         case IEEE80211_M_HOSTAP:
imr->ifm_active |= IFM_IEEE80211_HOSTAP;
 2103                 break;
 2104         case IEEE80211_M_MONITOR:
imr->ifm_active |= IFM_IEEE80211_MONITOR;
 2106                 break;
 2107         default:
 2108                 break;
 2109         }
splx(s);
 2112 }
 2114 /*
 2115  * Start data frames.  Critical sections surround the boundary of
 2116  * management frame transmission / transmission acknowledgement / response
 2117  * and data frame transmission / transmission acknowledgement.
 2118  */
 2119 void
pgt_start(struct ifnet *ifp)
 2121 {
 2122         struct pgt_softc *sc;
 2123         struct ieee80211com *ic;
 2124         struct pgt_desc *pd;
 2125         struct mbuf *m;
 2126         int error;
sc = ifp->if_softc;
ic = &sc->sc_ic;
 2131         if (sc->sc_flags & (SC_DYING | SC_NEEDS_RESET) ||
 2132             !(ifp->if_flags & IFF_RUNNING) ||
ic->ic_state != IEEE80211_S_RUN) {
 2134                 return;
 2135         }
 2137         /*
 2138          * Management packets should probably be MLME frames
 2139          * (i.e. hostap "managed" mode); we don't touch the
 2140          * net80211 management queue.
 2141          */
 2142         for (; sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] <
PGT_QUEUE_FULL_THRESHOLD && !IFQ_IS_EMPTY(&ifp->if_snd);) {
pd = TAILQ_FIRST(&sc->sc_freeq[PGT_QUEUE_DATA_LOW_TX]);
IFQ_POLL(&ifp->if_snd, m);
 2146                 if (m == NULL)
 2147                         break;
 2148                 if (m->m_pkthdr.len <= PGT_FRAG_SIZE) {
error = pgt_load_tx_desc_frag(sc,
PGT_QUEUE_DATA_LOW_TX, pd);
 2151                         if (error)
 2152                                 break;
IFQ_DEQUEUE(&ifp->if_snd, m);
m_copydata(m, 0, m->m_pkthdr.len, pd->pd_mem);
pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
pd, m->m_pkthdr.len, 0);
 2157                 } else if (m->m_pkthdr.len <= PGT_FRAG_SIZE * 2) {
 2158                         struct pgt_desc *pd2;
 2160                         /*
 2161                          * Transmit a fragmented frame if there is
 2162                          * not enough room in one fragment; limit
 2163                          * to two fragments (802.11 itself couldn't
 2164                          * even support a full two.)
 2165                          */
 2166                         if (sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] + 2 >
PGT_QUEUE_FULL_THRESHOLD)
 2168                                 break;
pd2 = TAILQ_NEXT(pd, pd_link);
error = pgt_load_tx_desc_frag(sc,
PGT_QUEUE_DATA_LOW_TX, pd);
 2172                         if (error == 0) {
error = pgt_load_tx_desc_frag(sc,
PGT_QUEUE_DATA_LOW_TX, pd2);
 2175                                 if (error) {
pgt_unload_tx_desc_frag(sc, pd);
TAILQ_INSERT_HEAD(&sc->sc_freeq[
PGT_QUEUE_DATA_LOW_TX], pd,
pd_link);
 2180                                 }
 2181                         }
 2182                         if (error)
 2183                                 break;
IFQ_DEQUEUE(&ifp->if_snd, m);
m_copydata(m, 0, PGT_FRAG_SIZE, pd->pd_mem);
pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
pd, PGT_FRAG_SIZE, 1);
m_copydata(m, PGT_FRAG_SIZE,
m->m_pkthdr.len - PGT_FRAG_SIZE, pd2->pd_mem);
pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
pd2, m->m_pkthdr.len - PGT_FRAG_SIZE, 0);
 2192                 } else {
IFQ_DEQUEUE(&ifp->if_snd, m);
ifp->if_oerrors++;
m_freem(m);
m = NULL;
 2197                 }
 2198                 if (m != NULL) {
 2199                         struct ieee80211_node *ni;
 2200 #if NBPFILTER > 0
 2201                         if (ifp->if_bpf != NULL)
bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
 2203 #endif
ifp->if_opackets++;
ifp->if_timer = 1;
sc->sc_txtimer = 5;
ni = ieee80211_find_txnode(&sc->sc_ic,
mtod(m, struct ether_header *)->ether_dhost);
 2209                         if (ni != NULL) {
ni->ni_inact = 0;
 2211                                 if (ni != ic->ic_bss)
ieee80211_release_node(&sc->sc_ic, ni);
 2213                         }
 2214 #if NBPFILTER > 0
 2215                         if (sc->sc_drvbpf != NULL) {
 2216                                 struct mbuf mb;
 2217                                 struct ether_header eh;
 2218                                 struct pgt_tx_radiotap_hdr *tap = &sc->sc_txtap;
bcopy(mtod(m, struct ether_header *), &eh,
 2221                                     sizeof(eh));
m_adj(m, sizeof(eh));
m = pgt_ieee80211_encap(sc, &eh, m, NULL);
tap->wt_flags = 0;
 2226                                 //tap->wt_rate = rate;
tap->wt_rate = 0;
tap->wt_chan_freq =
htole16(ic->ic_bss->ni_chan->ic_freq);
tap->wt_chan_flags =
htole16(ic->ic_bss->ni_chan->ic_flags);
 2233                                 if (m != NULL) {
mb.m_data = (caddr_t)tap;
mb.m_len = sc->sc_txtap_len;
mb.m_next = m;
mb.m_nextpkt = NULL;
mb.m_type = 0;
mb.m_flags = 0;
bpf_mtap(sc->sc_drvbpf, &mb,
BPF_DIRECTION_OUT);
 2243                                 }
 2244                         }
 2245 #endif
 2246                         if (m != NULL)
m_freem(m);
 2248                 }
 2249         }
 2250 }
 2252 int
pgt_ioctl(struct ifnet *ifp, u_long cmd, caddr_t req)
 2254 {
 2255         struct pgt_softc *sc = ifp->if_softc;
 2256         struct ifaddr *ifa;
 2257         struct ifreq *ifr;
 2258         struct wi_req *wreq;
 2259         struct ieee80211_nodereq_all *na;
 2260         struct ieee80211com *ic;
 2261         struct pgt_obj_bsslist *pob;
 2262         struct wi_scan_p2_hdr *p2hdr;
 2263         struct wi_scan_res *res;
uint32_t noise;
 2265         int maxscan, i, j, s, error = 0;
ic = &sc->sc_ic;
ifr = (struct ifreq *)req;
s = splnet();
 2271         switch (cmd) {
 2272         case SIOCS80211SCAN:
 2273                 /*
 2274                  * This chip scans always as soon as it gets initialized.
 2275                  */
 2277                 /*
 2278                  * Give us a bit time to scan in case we were not
 2279                  * initialized before and let the userland process wait.
 2280                  */
tsleep(&sc->sc_flags, 0, "pgtsca", hz * SCAN_TIMEOUT);
 2283                 break;
 2284         case SIOCG80211ALLNODES: {
 2285                 struct ieee80211_nodereq *nr = NULL;
na = (struct ieee80211_nodereq_all *)req;
wreq = malloc(sizeof(*wreq), M_DEVBUF, M_WAITOK);
bzero(wreq, sizeof(*wreq));
maxscan = PGT_OBJ_BSSLIST_NBSS;
pob = malloc(sizeof(*pob) +
 2292                     sizeof(struct pgt_obj_bss) * maxscan, M_DEVBUF, M_WAITOK);
error = pgt_oid_get(sc, PGT_OID_NOISE_FLOOR, &noise,
 2294                     sizeof(noise));
 2296                 if (error == 0) {
noise = letoh32(noise);
error = pgt_oid_get(sc, PGT_OID_BSS_LIST, pob,
 2299                             sizeof(*pob) +
 2300                             sizeof(struct pgt_obj_bss) * maxscan);
 2301                 }
 2303                 if (error == 0) {
maxscan = min(PGT_OBJ_BSSLIST_NBSS,
letoh32(pob->pob_count));
maxscan = min(maxscan,
 2307                             (sizeof(wreq->wi_val) - sizeof(*p2hdr)) /
WI_PRISM2_RES_SIZE);
p2hdr = (struct wi_scan_p2_hdr *)&wreq->wi_val;
p2hdr->wi_rsvd = 0;
p2hdr->wi_reason = 1;
wreq->wi_len = (maxscan * WI_PRISM2_RES_SIZE) / 2 +
 2313                             sizeof(*p2hdr) / 2;
wreq->wi_type = WI_RID_SCAN_RES;
 2315                 }
 2317                 for (na->na_nodes = j = i = 0; i < maxscan &&
 2318                     (na->na_size >= j + sizeof(struct ieee80211_nodereq));
i++) {
 2320                         /* allocate node space */
 2321                         if (nr == NULL)
nr = malloc(sizeof(*nr), M_DEVBUF, M_WAITOK);
 2324                         /* get next BSS scan result */
res = (struct wi_scan_res *)
 2326                             ((char *)&wreq->wi_val + sizeof(*p2hdr) +
i * WI_PRISM2_RES_SIZE);
pgt_obj_bss2scanres(sc, &pob->pob_bsslist[i],
res, noise);
 2331                         /* copy it to node structure for ifconfig to read */
bzero(nr, sizeof(*nr));
IEEE80211_ADDR_COPY(nr->nr_macaddr, res->wi_bssid);
IEEE80211_ADDR_COPY(nr->nr_bssid, res->wi_bssid);
nr->nr_channel = letoh16(res->wi_chan);
nr->nr_chan_flags = IEEE80211_CHAN_B;
nr->nr_rssi = letoh16(res->wi_signal);
nr->nr_max_rssi = 0; /* XXX */
nr->nr_nwid_len = letoh16(res->wi_ssid_len);
bcopy(res->wi_ssid, nr->nr_nwid, nr->nr_nwid_len);
nr->nr_intval = letoh16(res->wi_interval);
nr->nr_capinfo = letoh16(res->wi_capinfo);
nr->nr_txrate = res->wi_rate == WI_WAVELAN_RES_1M ? 2 :
 2344                             (res->wi_rate == WI_WAVELAN_RES_2M ? 4 :
 2345                             (res->wi_rate == WI_WAVELAN_RES_5M ? 11 :
 2346                             (res->wi_rate == WI_WAVELAN_RES_11M ? 22 : 0)));
nr->nr_nrates = 0;
 2348                         while (res->wi_srates[nr->nr_nrates] != 0) {
nr->nr_rates[nr->nr_nrates] =
res->wi_srates[nr->nr_nrates] &
WI_VAR_SRATES_MASK;
nr->nr_nrates++;
 2353                         }
nr->nr_flags = 0;
 2355                         if (bcmp(nr->nr_macaddr, nr->nr_bssid,
IEEE80211_ADDR_LEN) == 0)
nr->nr_flags |= IEEE80211_NODEREQ_AP;
error = copyout(nr, (caddr_t)na->na_node + j,
 2359                             sizeof(struct ieee80211_nodereq));
 2360                         if (error)
 2361                                 break;
 2363                         /* point to next node entry */
j += sizeof(struct ieee80211_nodereq);
na->na_nodes++;
 2366                 }
 2367                 if (nr)
free(nr, M_DEVBUF);
free(pob, M_DEVBUF);
 2370                 break;
 2371         }
 2372         case SIOCSIFADDR:
ifa = (struct ifaddr *)req;
ifp->if_flags |= IFF_UP;
 2375 #ifdef INET
 2376                 if (ifa->ifa_addr->sa_family == AF_INET)
arp_ifinit(&sc->sc_ic.ic_ac, ifa);
 2378 #endif
 2379                 /* FALLTHROUGH */
 2380         case SIOCSIFFLAGS:
 2381                 if (ifp->if_flags & IFF_UP) {
 2382                         if ((ifp->if_flags & IFF_RUNNING) == 0) {
pgt_init(ifp);
error = ENETRESET;
 2385                         }
 2386                 } else {
 2387                         if (ifp->if_flags & IFF_RUNNING) {
pgt_stop(sc, SC_NEEDS_RESET);
error = ENETRESET;
 2390                         }
 2391                 }
 2392                 break;
 2393         case SIOCADDMULTI:
 2394         case SIOCDELMULTI:
error = (cmd == SIOCADDMULTI) ?
ether_addmulti(ifr, &ic->ic_ac) :
ether_delmulti(ifr, &ic->ic_ac);
 2399                 if (error == ENETRESET)
error = 0;
 2401                 break;
 2402         case SIOCSIFMTU:
 2403                 if (ifr->ifr_mtu > PGT_FRAG_SIZE) {
error = EINVAL;
 2405                         break;
 2406                 }
 2407                 /* FALLTHROUGH */
 2408         default:
error = ieee80211_ioctl(ifp, cmd, req);
 2410                 break;
 2411         }
 2413         if (error == ENETRESET) {
pgt_update_hw_from_sw(sc, 0, 0);
error = 0;
 2416         }
splx(s);
 2419         return (error);
 2420 }
 2422 void
pgt_obj_bss2scanres(struct pgt_softc *sc, struct pgt_obj_bss *pob,
 2424     struct wi_scan_res *scanres, uint32_t noise)
 2425 {
 2426         struct ieee80211_rateset *rs;
 2427         struct wi_scan_res ap;
 2428         unsigned int i, n;
rs = &sc->sc_ic.ic_sup_rates[IEEE80211_MODE_AUTO];
bzero(&ap, sizeof(ap));
ap.wi_chan = ieee80211_mhz2ieee(letoh16(pob->pob_channel), 0);
ap.wi_noise = noise;
ap.wi_signal = letoh16(pob->pob_rssi);
IEEE80211_ADDR_COPY(ap.wi_bssid, pob->pob_address);
ap.wi_interval = letoh16(pob->pob_beacon_period);
ap.wi_capinfo = letoh16(pob->pob_capinfo);
ap.wi_ssid_len = min(sizeof(ap.wi_ssid), pob->pob_ssid.pos_length);
memcpy(ap.wi_ssid, pob->pob_ssid.pos_ssid, ap.wi_ssid_len);
n = 0;
 2441         for (i = 0; i < 16; i++) {
 2442                 if (letoh16(pob->pob_rates) & (1 << i)) {
 2443                         if (i > rs->rs_nrates)
 2444                                 break;
ap.wi_srates[n++] = ap.wi_rate = rs->rs_rates[i];
 2446                         if (n >= sizeof(ap.wi_srates) / sizeof(ap.wi_srates[0]))
 2447                                 break;
 2448                 }
 2449         }
memcpy(scanres, &ap, WI_PRISM2_RES_SIZE);
 2451 }
 2453 void
node_mark_active_ap(void *arg, struct ieee80211_node *ni)
 2455 {
 2456         /*
 2457          * HostAP mode lets all nodes stick around unless
 2458          * the firmware AP kicks them off.
 2459          */
ni->ni_inact = 0;
 2461 }
 2463 void
node_mark_active_adhoc(void *arg, struct ieee80211_node *ni)
 2465 {
 2466         struct pgt_ieee80211_node *pin;
 2468         /*
 2469          * As there is no association in ad-hoc, we let links just
 2470          * time out naturally as long they are not holding any private
 2471          * configuration, such as 802.1x authorization.
 2472          */
pin = (struct pgt_ieee80211_node *)ni;
 2474         if (pin->pin_dot1x_auth == PIN_DOT1X_AUTHORIZED)
pin->pin_node.ni_inact = 0;
 2476 }
 2478 void
pgt_watchdog(struct ifnet *ifp)
 2480 {
 2481         struct pgt_softc *sc;
sc = ifp->if_softc;
 2484         /*
 2485          * Check for timed out transmissions (and make sure to set
 2486          * this watchdog to fire again if there is still data in the
 2487          * output device queue).
 2488          */
 2489         if (sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] != 0) {
 2490                 int count;
ifp->if_timer = 1;
 2493                 if (sc->sc_txtimer && --sc->sc_txtimer == 0) {
count = pgt_drain_tx_queue(sc, PGT_QUEUE_DATA_LOW_TX);
 2495                         if (sc->sc_debug & SC_DEBUG_UNEXPECTED)
DPRINTF(("%s: timeout %d data transmissions\n",
sc->sc_dev.dv_xname, count));
 2498                 }
 2499         }
 2500         if (sc->sc_flags & (SC_DYING | SC_NEEDS_RESET))
 2501                 return;
 2502         /*
 2503          * If we're goign to kick the device out of power-save mode
 2504          * just to update the BSSID and such, we should not do it
 2505          * very often; need to determine in what way to do that.
 2506          */
 2507         if (ifp->if_flags & IFF_RUNNING &&
sc->sc_ic.ic_state != IEEE80211_S_INIT &&
sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
pgt_async_update(sc);
 2512         /*
 2513          * As a firmware-based HostAP, we should not time out
 2514          * nodes inside the driver additionally to the timeout
 2515          * that exists in the firmware.  The only things we
 2516          * should have to deal with timing out when doing HostAP
 2517          * are the privacy-related.
 2518          */
 2519         switch (sc->sc_ic.ic_opmode) {
 2520         case IEEE80211_M_HOSTAP:
ieee80211_iterate_nodes(&sc->sc_ic,
node_mark_active_ap, NULL);
 2523                 break;
 2524         case IEEE80211_M_IBSS:
ieee80211_iterate_nodes(&sc->sc_ic,
node_mark_active_adhoc, NULL);
 2527                 break;
 2528         default:
 2529                 break;
 2530         }
ieee80211_watchdog(ifp);
ifp->if_timer = 1;
 2533 }
 2535 int
pgt_init(struct ifnet *ifp)
 2537 {
 2538         struct pgt_softc *sc = ifp->if_softc;
 2539         struct ieee80211com *ic = &sc->sc_ic;
 2541         /* set default channel */
ic->ic_bss->ni_chan = ic->ic_ibss_chan;
 2544         if (!(sc->sc_flags & (SC_DYING | SC_UNINITIALIZED)))
pgt_update_hw_from_sw(sc,
ic->ic_state != IEEE80211_S_INIT,
ic->ic_opmode != IEEE80211_M_MONITOR);
ifp->if_flags |= IFF_RUNNING;
ifp->if_flags &= ~IFF_OACTIVE;
 2552         /* Begin background scanning */
ieee80211_new_state(&sc->sc_ic, IEEE80211_S_SCAN, -1);
 2555         return (0);
 2556 }
 2558 /*
 2559  * After most every configuration change, everything needs to be fully
 2560  * reinitialized.  For some operations (currently, WEP settings
 2561  * in ad-hoc+802.1x mode), the change is "soft" and doesn't remove
 2562  * "associations," and allows EAP authorization to occur again.
 2563  * If keepassoc is specified, the reset operation should try to go
 2564  * back to the BSS had before.
 2565  */
 2566 void
pgt_update_hw_from_sw(struct pgt_softc *sc, int keepassoc, int keepnodes)
 2568 {
 2569         struct ieee80211com *ic = &sc->sc_ic;
 2570         struct arpcom *ac = &ic->ic_ac;
 2571         struct ifnet *ifp = &ac->ac_if;
 2572         struct pgt_obj_key keyobj;
 2573         struct pgt_obj_ssid essid;
uint8_t availrates[IEEE80211_RATE_MAXSIZE + 1];
uint32_t mode, bsstype, config, profile, channel, slot, preamble;
uint32_t wep, exunencrypted, wepkey, dot1x, auth, mlme;
 2577         unsigned int i;
 2578         int success, shouldbeup, s;
config = PGT_CONFIG_MANUAL_RUN | PGT_CONFIG_RX_ANNEX;
 2582         /*
 2583          * Promiscuous mode is currently a no-op since packets transmitted,
 2584          * while in promiscuous mode, don't ever seem to go anywhere.
 2585          */
shouldbeup = ifp->if_flags & IFF_RUNNING && ifp->if_flags & IFF_UP;
 2588         if (shouldbeup) {
 2589                 switch (ic->ic_opmode) {
 2590                 case IEEE80211_M_STA:
 2591                         if (ifp->if_flags & IFF_PROMISC)
mode = PGT_MODE_CLIENT; /* what to do? */
 2593                         else
mode = PGT_MODE_CLIENT;
bsstype = PGT_BSS_TYPE_STA;
dot1x = PGT_DOT1X_AUTH_ENABLED;
 2597                         break;
 2598                 case IEEE80211_M_IBSS:
 2599                         if (ifp->if_flags & IFF_PROMISC)
mode = PGT_MODE_CLIENT; /* what to do? */
 2601                         else
mode = PGT_MODE_CLIENT;
bsstype = PGT_BSS_TYPE_IBSS;
dot1x = PGT_DOT1X_AUTH_ENABLED;
 2605                         break;
 2606                 case IEEE80211_M_HOSTAP:
mode = PGT_MODE_AP;
bsstype = PGT_BSS_TYPE_STA;
 2609                         /*
 2610                          * For IEEE 802.1x, we need to authenticate and
 2611                          * authorize hosts from here on or they remain
 2612                          * associated but without the ability to send or
 2613                          * receive normal traffic to us (courtesy the
 2614                          * firmware AP implementation).
 2615                          */
dot1x = PGT_DOT1X_AUTH_ENABLED;
 2617                         /*
 2618                          * WDS mode needs several things to work:
 2619                          * discovery of exactly how creating the WDS
 2620                          * links is meant to function, an interface
 2621                          * for this, and ability to encode or decode
 2622                          * the WDS frames.
 2623                          */
 2624                         if (sc->sc_wds)
config |= PGT_CONFIG_WDS;
 2626                         break;
 2627                 case IEEE80211_M_MONITOR:
mode = PGT_MODE_PROMISCUOUS;
bsstype = PGT_BSS_TYPE_ANY;
dot1x = PGT_DOT1X_AUTH_NONE;
 2631                         break;
 2632                 default:
 2633                         goto badopmode;
 2634                 }
 2635         } else {
badopmode:
mode = PGT_MODE_CLIENT;
bsstype = PGT_BSS_TYPE_NONE;
 2639         }
DPRINTF(("%s: current mode is ", sc->sc_dev.dv_xname));
 2642         switch (ic->ic_curmode) {
 2643         case IEEE80211_MODE_11A:
profile = PGT_PROFILE_A_ONLY;
preamble = PGT_OID_PREAMBLE_MODE_DYNAMIC;
DPRINTF(("IEEE80211_MODE_11A\n"));
 2647                 break;
 2648         case IEEE80211_MODE_11B:
profile = PGT_PROFILE_B_ONLY;
preamble = PGT_OID_PREAMBLE_MODE_LONG;
DPRINTF(("IEEE80211_MODE_11B\n"));
 2652                 break;
 2653         case IEEE80211_MODE_11G:
profile = PGT_PROFILE_G_ONLY;
preamble = PGT_OID_PREAMBLE_MODE_SHORT;
DPRINTF(("IEEE80211_MODE_11G\n"));
 2657                 break;
 2658         case IEEE80211_MODE_FH:
 2659                 /* FALLTHROUGH */
 2660         case IEEE80211_MODE_TURBO: /* not handled */
 2661                 /* FALLTHROUGH */
 2662         case IEEE80211_MODE_AUTO:
profile = PGT_PROFILE_MIXED_G_WIFI;
preamble = PGT_OID_PREAMBLE_MODE_DYNAMIC;
DPRINTF(("IEEE80211_MODE_AUTO\n"));
 2666                 break;
 2667         default:
panic("unknown mode %d\n", ic->ic_curmode);
 2669         }
 2671         switch (sc->sc_80211_ioc_auth) {
 2672         case IEEE80211_AUTH_NONE:
auth = PGT_AUTH_MODE_NONE;
 2674                 break;
 2675         case IEEE80211_AUTH_OPEN:
auth = PGT_AUTH_MODE_OPEN;
 2677                 break;
 2678         default:
auth = PGT_AUTH_MODE_SHARED;
 2680                 break;
 2681         }
 2683         if (sc->sc_ic.ic_flags & IEEE80211_F_WEPON) {
wep = 1;
exunencrypted = 1;
 2686         } else {
wep = 0;
exunencrypted = 0;
 2689         }
mlme = htole32(PGT_MLME_AUTO_LEVEL_AUTO);
wep = htole32(wep);
exunencrypted = htole32(exunencrypted);
profile = htole32(profile);
preamble = htole32(preamble);
bsstype = htole32(bsstype);
config = htole32(config);
mode = htole32(mode);
 2700         if (!wep || !sc->sc_dot1x)
dot1x = PGT_DOT1X_AUTH_NONE;
dot1x = htole32(dot1x);
auth = htole32(auth);
 2705         if (ic->ic_flags & IEEE80211_F_SHSLOT)
slot = htole32(PGT_OID_SLOT_MODE_SHORT);
 2707         else
slot = htole32(PGT_OID_SLOT_MODE_DYNAMIC);
 2710         if (ic->ic_des_chan == IEEE80211_CHAN_ANYC) {
 2711                 if (keepassoc)
channel = 0;
 2713                 else
channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
 2715         } else
channel = ieee80211_chan2ieee(ic, ic->ic_des_chan);
DPRINTF(("%s: set rates", sc->sc_dev.dv_xname));
 2719         for (i = 0; i < ic->ic_sup_rates[ic->ic_curmode].rs_nrates; i++) {
availrates[i] = ic->ic_sup_rates[ic->ic_curmode].rs_rates[i];
DPRINTF((" %d", availrates[i]));
 2722         }
DPRINTF(("\n"));
availrates[i++] = 0;
essid.pos_length = min(ic->ic_des_esslen, sizeof(essid.pos_ssid));
memcpy(&essid.pos_ssid, ic->ic_des_essid, essid.pos_length);
s = splnet();
 2730         for (success = 0; success == 0; success = 1) {
SETOID(PGT_OID_PROFILE, &profile, sizeof(profile));
SETOID(PGT_OID_CONFIG, &config, sizeof(config));
SETOID(PGT_OID_MLME_AUTO_LEVEL, &mlme, sizeof(mlme));
 2735                 if (!IEEE80211_ADDR_EQ(ic->ic_myaddr, ac->ac_enaddr)) {
SETOID(PGT_OID_MAC_ADDRESS, ac->ac_enaddr,
 2737                             sizeof(ac->ac_enaddr));
IEEE80211_ADDR_COPY(ic->ic_myaddr, ac->ac_enaddr);
 2739                 }
SETOID(PGT_OID_MODE, &mode, sizeof(mode));
SETOID(PGT_OID_BSS_TYPE, &bsstype, sizeof(bsstype));
 2744                 if (channel != 0 && channel != IEEE80211_CHAN_ANY)
SETOID(PGT_OID_CHANNEL, &channel, sizeof(channel));
 2747                 if (ic->ic_flags & IEEE80211_F_DESBSSID) {
SETOID(PGT_OID_BSSID, ic->ic_des_bssid,
 2749                             sizeof(ic->ic_des_bssid));
 2750                 } else if (keepassoc) {
SETOID(PGT_OID_BSSID, ic->ic_bss->ni_bssid,
 2752                             sizeof(ic->ic_bss->ni_bssid));
 2753                 }
SETOID(PGT_OID_SSID, &essid, sizeof(essid));
 2757                 if (ic->ic_des_esslen > 0)
SETOID(PGT_OID_SSID_OVERRIDE, &essid, sizeof(essid));
SETOID(PGT_OID_RATES, &availrates, i);
SETOID(PGT_OID_EXTENDED_RATES, &availrates, i);
SETOID(PGT_OID_PREAMBLE_MODE, &preamble, sizeof(preamble));
SETOID(PGT_OID_SLOT_MODE, &slot, sizeof(slot));
SETOID(PGT_OID_AUTH_MODE, &auth, sizeof(auth));
SETOID(PGT_OID_EXCLUDE_UNENCRYPTED, &exunencrypted,
 2766                     sizeof(exunencrypted));
SETOID(PGT_OID_DOT1X, &dot1x, sizeof(dot1x));
SETOID(PGT_OID_PRIVACY_INVOKED, &wep, sizeof(wep));
 2769                 /*
 2770                  * Setting WEP key(s)
 2771                  */
 2772                 if (letoh32(wep) != 0) {
keyobj.pok_type = PGT_OBJ_KEY_TYPE_WEP;
 2774                         /* key 1 */
keyobj.pok_length = min(sizeof(keyobj.pok_key),
IEEE80211_KEYBUF_SIZE);
keyobj.pok_length = min(keyobj.pok_length,
ic->ic_nw_keys[0].k_len);
bcopy(ic->ic_nw_keys[0].k_key, keyobj.pok_key,
keyobj.pok_length);
SETOID(PGT_OID_DEFAULT_KEY0, &keyobj, sizeof(keyobj));
 2782                         /* key 2 */
keyobj.pok_length = min(sizeof(keyobj.pok_key),
IEEE80211_KEYBUF_SIZE);
keyobj.pok_length = min(keyobj.pok_length,
ic->ic_nw_keys[1].k_len);
bcopy(ic->ic_nw_keys[1].k_key, keyobj.pok_key,
keyobj.pok_length);
SETOID(PGT_OID_DEFAULT_KEY1, &keyobj, sizeof(keyobj));
 2790                         /* key 3 */
keyobj.pok_length = min(sizeof(keyobj.pok_key),
IEEE80211_KEYBUF_SIZE);
keyobj.pok_length = min(keyobj.pok_length,
ic->ic_nw_keys[2].k_len);
bcopy(ic->ic_nw_keys[2].k_key, keyobj.pok_key,
keyobj.pok_length);
SETOID(PGT_OID_DEFAULT_KEY2, &keyobj, sizeof(keyobj));
 2798                         /* key 4 */
keyobj.pok_length = min(sizeof(keyobj.pok_key),
IEEE80211_KEYBUF_SIZE);
keyobj.pok_length = min(keyobj.pok_length,
ic->ic_nw_keys[3].k_len);
bcopy(ic->ic_nw_keys[3].k_key, keyobj.pok_key,
keyobj.pok_length);
SETOID(PGT_OID_DEFAULT_KEY3, &keyobj, sizeof(keyobj));
wepkey = htole32(ic->ic_wep_txkey);
SETOID(PGT_OID_DEFAULT_KEYNUM, &wepkey, sizeof(wepkey));
 2809                 }
 2810                 /* set mode again to commit */
SETOID(PGT_OID_MODE, &mode, sizeof(mode));
 2812         }
splx(s);
 2815         if (success) {
 2816                 if (shouldbeup && keepnodes)
sc->sc_flags |= SC_NOFREE_ALLNODES;
 2818                 if (shouldbeup)
ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 2820                 else
ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 2822         } else {
printf("%s: problem setting modes\n", sc->sc_dev.dv_xname);
ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 2825         }
 2826 }
 2828 void
pgt_hostap_handle_mlme(struct pgt_softc *sc, uint32_t oid,
 2830     struct pgt_obj_mlme *mlme)
 2831 {
 2832         struct ieee80211com *ic = &sc->sc_ic;
 2833         struct pgt_ieee80211_node *pin;
 2834         struct ieee80211_node *ni;
ni = ieee80211_find_node(ic, mlme->pom_address);
pin = (struct pgt_ieee80211_node *)ni;
 2838         switch (oid) {
 2839         case PGT_OID_DISASSOCIATE:
 2840                 if (ni != NULL)
ieee80211_release_node(&sc->sc_ic, ni);
 2842                 break;
 2843         case PGT_OID_ASSOCIATE:
 2844                 if (ni == NULL) {
ni = ieee80211_dup_bss(ic, mlme->pom_address);
 2846                         if (ni == NULL)
 2847                                 break;
ic->ic_newassoc(ic, ni, 1);
pin = (struct pgt_ieee80211_node *)ni;
 2850                 }
ni->ni_associd = letoh16(mlme->pom_id);
pin->pin_mlme_state = letoh16(mlme->pom_state);
 2853                 break;
 2854         default:
 2855                 if (pin != NULL)
pin->pin_mlme_state = letoh16(mlme->pom_state);
 2857                 break;
 2858         }
 2859 }
 2861 /*
 2862  * Either in response to an event or after a certain amount of time,
 2863  * synchronize our idea of the network we're part of from the hardware.
 2864  */
 2865 void
pgt_update_sw_from_hw(struct pgt_softc *sc, struct pgt_async_trap *pa,
 2867             struct mbuf *args)
 2868 {
 2869         struct ieee80211com *ic = &sc->sc_ic;
 2870         struct pgt_obj_ssid ssid;
 2871         struct pgt_obj_bss bss;
uint32_t channel, noise, ls;
 2873         int error, s;
 2875         if (pa != NULL) {
 2876                 struct pgt_obj_mlme *mlme;
uint32_t oid;
oid = *mtod(args, uint32_t *);
m_adj(args, sizeof(uint32_t));
 2881                 if (sc->sc_debug & SC_DEBUG_TRAP)
DPRINTF(("%s: trap: oid %#x len %u\n",
sc->sc_dev.dv_xname, oid, args->m_len));
 2884                 switch (oid) {
 2885                 case PGT_OID_LINK_STATE:
 2886                         if (args->m_len < sizeof(uint32_t))
 2887                                 break;
ls = letoh32(*mtod(args, uint32_t *));
 2889                         if (sc->sc_debug & (SC_DEBUG_TRAP | SC_DEBUG_LINK))
DPRINTF(("%s: %s: link rate %u\n",
sc->sc_dev.dv_xname, __func__, ls));
 2892                         if (ls)
ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 2894                         else
ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 2896                         goto gotlinkstate;
 2897                 case PGT_OID_DEAUTHENTICATE:
 2898                 case PGT_OID_AUTHENTICATE:
 2899                 case PGT_OID_DISASSOCIATE:
 2900                 case PGT_OID_ASSOCIATE:
 2901                         if (args->m_len < sizeof(struct pgt_obj_mlme))
 2902                                 break;
mlme = mtod(args, struct pgt_obj_mlme *);
 2904                         if (sc->sc_debug & SC_DEBUG_TRAP)
DPRINTF(("%s: mlme: address "
 2906                                     "%s id 0x%02x state 0x%02x code 0x%02x\n",
sc->sc_dev.dv_xname,
ether_sprintf(mlme->pom_address),
letoh16(mlme->pom_id),
letoh16(mlme->pom_state),
letoh16(mlme->pom_code)));
 2912                         if (ic->ic_opmode == IEEE80211_M_HOSTAP)
pgt_hostap_handle_mlme(sc, oid, mlme);
 2914                         break;
 2915                 }
 2916                 return;
 2917         }
 2918         if (ic->ic_state == IEEE80211_S_SCAN) {
s = splnet();
error = pgt_oid_get(sc, PGT_OID_LINK_STATE, &ls, sizeof(ls));
splx(s);
 2922                 if (error)
 2923                         return;
DPRINTF(("%s: up_sw_from_hw: link %u\n", sc->sc_dev.dv_xname,
htole32(ls)));
 2926                 if (ls != 0)
ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 2928         }
gotlinkstate:
s = splnet();
 2932         if (pgt_oid_get(sc, PGT_OID_NOISE_FLOOR, &noise, sizeof(noise)) != 0)
 2933                 goto out;
sc->sc_noise = letoh32(noise);
 2935         if (ic->ic_state == IEEE80211_S_RUN) {
 2936                 if (pgt_oid_get(sc, PGT_OID_CHANNEL, &channel,
 2937                     sizeof(channel)) != 0)
 2938                         goto out;
channel = min(letoh32(channel), IEEE80211_CHAN_MAX);
ic->ic_bss->ni_chan = &ic->ic_channels[channel];
 2941                 if (pgt_oid_get(sc, PGT_OID_BSSID, ic->ic_bss->ni_bssid,
 2942                     sizeof(ic->ic_bss->ni_bssid)) != 0)
 2943                         goto out;
IEEE80211_ADDR_COPY(&bss.pob_address, ic->ic_bss->ni_bssid);
error = pgt_oid_retrieve(sc, PGT_OID_BSS_FIND, &bss,
 2946                     sizeof(bss));
 2947                 if (error == 0)
ic->ic_bss->ni_rssi = bss.pob_rssi;
 2949                 else if (error != EPERM)
 2950                         goto out;
error = pgt_oid_get(sc, PGT_OID_SSID, &ssid, sizeof(ssid));
 2952                 if (error)
 2953                         goto out;
ic->ic_bss->ni_esslen = min(ssid.pos_length,
 2955                     sizeof(ic->ic_bss->ni_essid));
memcpy(ic->ic_bss->ni_essid, ssid.pos_ssid,
ssid.pos_length);
 2958         }
out:
splx(s);
 2962 }
 2964 int
pgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 2966 {
 2967         struct pgt_softc *sc = ic->ic_if.if_softc;
 2968         enum ieee80211_state ostate;
ostate = ic->ic_state;
DPRINTF(("%s: newstate %s -> %s\n", sc->sc_dev.dv_xname,
ieee80211_state_name[ostate], ieee80211_state_name[nstate]));
 2975         switch (nstate) {
 2976         case IEEE80211_S_INIT:
 2977                 if (sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] == 0)
ic->ic_if.if_timer = 0;
ic->ic_mgt_timer = 0;
ic->ic_flags &= ~IEEE80211_F_SIBSS;
 2981                 if (ic->ic_wep_ctx != NULL) {
free(ic->ic_wep_ctx, M_DEVBUF);  
ic->ic_wep_ctx = NULL;
 2984                 }
ieee80211_free_allnodes(ic);
 2986                 break;
 2987         case IEEE80211_S_SCAN:
ic->ic_if.if_timer = 1;
ic->ic_mgt_timer = 0;
 2990                 if (sc->sc_flags & SC_NOFREE_ALLNODES)
sc->sc_flags &= ~SC_NOFREE_ALLNODES;
 2992                 else
ieee80211_free_allnodes(ic);
 2995                 /* Just use any old channel; we override it anyway. */
 2996                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
ieee80211_create_ibss(ic, ic->ic_ibss_chan);
 2998                 break;
 2999         case IEEE80211_S_RUN:
ic->ic_if.if_timer = 1;
 3001                 break;
 3002         default:
 3003                 break;
 3004         }
 3006         return (sc->sc_newstate(ic, nstate, arg));
 3007 }
 3009 int
pgt_drain_tx_queue(struct pgt_softc *sc, enum pgt_queue pq)
 3011 {
 3012         int wokeup = 0;
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE);
sc->sc_cb->pcb_device_curfrag[pq] =
sc->sc_cb->pcb_driver_curfrag[pq];
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,
sc->sc_cbdmam->dm_mapsize,
BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD);
 3022         while (!TAILQ_EMPTY(&sc->sc_dirtyq[pq])) {
 3023                 struct pgt_desc *pd;
pd = TAILQ_FIRST(&sc->sc_dirtyq[pq]);
TAILQ_REMOVE(&sc->sc_dirtyq[pq], pd, pd_link);
sc->sc_dirtyq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link);
sc->sc_freeq_count[pq]++;
pgt_unload_tx_desc_frag(sc, pd);
 3031                 if (sc->sc_debug & SC_DEBUG_QUEUES)
DPRINTF(("%s: queue: tx %u <- [%u] (drained)\n",
sc->sc_dev.dv_xname, pd->pd_fragnum, pq));
wokeup++;
 3035                 if (pgt_queue_is_data(pq))
sc->sc_ic.ic_if.if_oerrors++;
 3037         }
 3039         return (wokeup);
 3040 }
 3042 int
pgt_dma_alloc(struct pgt_softc *sc)
 3044 {
size_t size;
 3046         int i, error, nsegs;
 3048         for (i = 0; i < PGT_QUEUE_COUNT; i++) {
TAILQ_INIT(&sc->sc_freeq[i]);
TAILQ_INIT(&sc->sc_dirtyq[i]);
 3051         }
 3053         /*
 3054          * control block
 3055          */
size = sizeof(struct pgt_control_block);
error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
BUS_DMA_NOWAIT, &sc->sc_cbdmam);
 3060         if (error != 0) {
printf("%s: can not create DMA tag for control block\n",
sc->sc_dev.dv_xname);
 3063                 goto out;
 3064         }
error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE,
 3067             0, &sc->sc_cbdmas, 1, &nsegs, BUS_DMA_NOWAIT);
 3068         if (error != 0) {
printf("%s: can not allocate DMA memory for control block\n",
sc->sc_dev.dv_xname);
 3071                 goto out;
 3072         }
error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cbdmas, nsegs,
size, (caddr_t *)&sc->sc_cb, BUS_DMA_NOWAIT);
 3076         if (error != 0) {
printf("%s: can not map DMA memory for control block\n",
sc->sc_dev.dv_xname);
 3079                 goto out;
 3080         }
bzero(sc->sc_cb, size);
error = bus_dmamap_load(sc->sc_dmat, sc->sc_cbdmam,
sc->sc_cb, size, NULL, BUS_DMA_NOWAIT);
 3085         if (error != 0) {
printf("%s: can not load DMA map for control block\n",
sc->sc_dev.dv_xname);
 3088                 goto out;
 3089         }
 3091         /*
 3092          * powersave
 3093          */
size = PGT_FRAG_SIZE * PGT_PSM_BUFFER_FRAME_COUNT;
error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
BUS_DMA_ALLOCNOW, &sc->sc_psmdmam);
 3098         if (error != 0) {
printf("%s: can not create DMA tag for powersave\n",
sc->sc_dev.dv_xname);
 3101                 goto out;
 3102         }
error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE,
 3105            0, &sc->sc_psmdmas, 1, &nsegs, BUS_DMA_NOWAIT);
 3106         if (error != 0) {
printf("%s: can not allocate DMA memory for powersave\n",
sc->sc_dev.dv_xname);
 3109                 goto out;
 3110         }
error = bus_dmamem_map(sc->sc_dmat, &sc->sc_psmdmas, nsegs,
size, (caddr_t *)&sc->sc_psmbuf, BUS_DMA_NOWAIT);
 3114         if (error != 0) {
printf("%s: can not map DMA memory for powersave\n",
sc->sc_dev.dv_xname);
 3117                 goto out;
 3118         }
bzero(sc->sc_psmbuf, size);
error = bus_dmamap_load(sc->sc_dmat, sc->sc_psmdmam,
sc->sc_psmbuf, size, NULL, BUS_DMA_WAITOK);
 3123         if (error != 0) {
printf("%s: can not load DMA map for powersave\n",
sc->sc_dev.dv_xname);
 3126                 goto out;
 3127         }
 3129         /*
 3130          * fragments
 3131          */
error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_LOW_RX);
 3133         if (error != 0)
 3134                 goto out;
error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_LOW_TX);
 3137         if (error != 0)
 3138                 goto out;
error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_HIGH_RX);
 3141         if (error != 0)
 3142                 goto out;
error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_HIGH_TX);
 3145         if (error != 0)
 3146                 goto out;
error = pgt_dma_alloc_queue(sc, PGT_QUEUE_MGMT_RX);
 3149         if (error != 0)
 3150                 goto out;
error = pgt_dma_alloc_queue(sc, PGT_QUEUE_MGMT_TX);
 3153         if (error != 0)
 3154                 goto out;
out:
 3157         if (error) {
printf("%s: error in DMA allocation\n", sc->sc_dev.dv_xname);
pgt_dma_free(sc);
 3160         }
 3162         return (error);
 3163 }
 3165 int
pgt_dma_alloc_queue(struct pgt_softc *sc, enum pgt_queue pq)
 3167 {
 3168         struct pgt_desc *pd;
 3169         struct pgt_frag *pcbqueue;
size_t i, qsize;
 3171         int error, nsegs;
 3173         switch (pq) {
 3174                 case PGT_QUEUE_DATA_LOW_RX:
pcbqueue = sc->sc_cb->pcb_data_low_rx;
qsize = PGT_QUEUE_DATA_RX_SIZE;
 3177                         break;
 3178                 case PGT_QUEUE_DATA_LOW_TX:
pcbqueue = sc->sc_cb->pcb_data_low_tx;
qsize = PGT_QUEUE_DATA_TX_SIZE;
 3181                         break;
 3182                 case PGT_QUEUE_DATA_HIGH_RX:
pcbqueue = sc->sc_cb->pcb_data_high_rx;
qsize = PGT_QUEUE_DATA_RX_SIZE;
 3185                         break;
 3186                 case PGT_QUEUE_DATA_HIGH_TX:
pcbqueue = sc->sc_cb->pcb_data_high_tx;
qsize = PGT_QUEUE_DATA_TX_SIZE;
 3189                         break;
 3190                 case PGT_QUEUE_MGMT_RX:
pcbqueue = sc->sc_cb->pcb_mgmt_rx;
qsize = PGT_QUEUE_MGMT_SIZE;
 3193                         break;
 3194                 case PGT_QUEUE_MGMT_TX:
pcbqueue = sc->sc_cb->pcb_mgmt_tx;
qsize = PGT_QUEUE_MGMT_SIZE;
 3197                         break;
 3198         }
 3200         for (i = 0; i < qsize; i++) {
pd = malloc(sizeof(*pd), M_DEVBUF, M_WAITOK);
error = bus_dmamap_create(sc->sc_dmat, PGT_FRAG_SIZE, 1,
PGT_FRAG_SIZE, 0, BUS_DMA_ALLOCNOW, &pd->pd_dmam);
 3205                 if (error != 0) {
printf("%s: can not create DMA tag for fragment\n",
sc->sc_dev.dv_xname);
free(pd, M_DEVBUF);
 3209                         break;
 3210                 }
error = bus_dmamem_alloc(sc->sc_dmat, PGT_FRAG_SIZE, PAGE_SIZE,
 3213                     0, &pd->pd_dmas, 1, &nsegs, BUS_DMA_WAITOK);
 3214                 if (error != 0) {
printf("%s: error alloc frag %u on queue %u\n",
sc->sc_dev.dv_xname, i, pq);
free(pd, M_DEVBUF);
 3218                         break;
 3219                 }
error = bus_dmamem_map(sc->sc_dmat, &pd->pd_dmas, nsegs,
PGT_FRAG_SIZE, (caddr_t *)&pd->pd_mem, BUS_DMA_WAITOK);
 3223                 if (error != 0) {
printf("%s: error map frag %u on queue %u\n",
sc->sc_dev.dv_xname, i, pq);
free(pd, M_DEVBUF);
 3227                         break;
 3228                 }
 3230                 if (pgt_queue_is_rx(pq)) {
error = bus_dmamap_load(sc->sc_dmat, pd->pd_dmam,
pd->pd_mem, PGT_FRAG_SIZE, NULL, BUS_DMA_NOWAIT);
 3233                         if (error != 0) {
printf("%s: error load frag %u on queue %u\n",
sc->sc_dev.dv_xname, i, pq);
bus_dmamem_free(sc->sc_dmat, &pd->pd_dmas,
nsegs);
free(pd, M_DEVBUF);
 3239                                 break;
 3240                         }
pd->pd_dmaaddr = pd->pd_dmam->dm_segs[0].ds_addr;
 3242                 }
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link);
 3244         }
 3246         return (error);
 3247 }
 3249 void
pgt_dma_free(struct pgt_softc *sc)
 3251 {
 3252         /*
 3253          * fragments
 3254          */
 3255         if (sc->sc_dmat != NULL) {
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_LOW_RX);
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_LOW_TX);
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_HIGH_RX);
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_HIGH_TX);
pgt_dma_free_queue(sc, PGT_QUEUE_MGMT_RX);
pgt_dma_free_queue(sc, PGT_QUEUE_MGMT_TX);
 3262         }
 3264         /*
 3265          * powersave
 3266          */
 3267         if (sc->sc_psmbuf != NULL) {
bus_dmamap_unload(sc->sc_dmat, sc->sc_psmdmam);
bus_dmamem_free(sc->sc_dmat, &sc->sc_psmdmas, 1);
sc->sc_psmbuf = NULL;
sc->sc_psmdmam = NULL;
 3272         }
 3274         /*
 3275          * control block
 3276          */
 3277         if (sc->sc_cb != NULL) {
bus_dmamap_unload(sc->sc_dmat, sc->sc_cbdmam);
bus_dmamem_free(sc->sc_dmat, &sc->sc_cbdmas, 1);
sc->sc_cb = NULL;
sc->sc_cbdmam = NULL;
 3282         }
 3283 }
 3285 void
pgt_dma_free_queue(struct pgt_softc *sc, enum pgt_queue pq)
 3287 {
 3288         struct pgt_desc *pd;
 3290         while (!TAILQ_EMPTY(&sc->sc_freeq[pq])) {
pd = TAILQ_FIRST(&sc->sc_freeq[pq]);
TAILQ_REMOVE(&sc->sc_freeq[pq], pd, pd_link);
 3293                 if (pd->pd_dmam != NULL) {
bus_dmamap_unload(sc->sc_dmat, pd->pd_dmam);
pd->pd_dmam = NULL;
 3296                 }
bus_dmamem_free(sc->sc_dmat, &pd->pd_dmas, 1);
free(pd, M_DEVBUF);
 3299         }
 3300 }
 3302 void
pgt_shutdown(void *arg)
 3304 {
 3305         struct pgt_softc *sc = arg;
DPRINTF(("%s: %s\n", sc->sc_dev.dv_xname, __func__));
pgt_stop(sc, SC_DYING);
 3310 }
 3312 void
pgt_power(int why, void *arg)
 3314 {
 3315         struct pgt_softc *sc = arg;
 3316         struct ifnet *ifp = &sc->sc_ic.ic_if;
 3317         int s;
DPRINTF(("%s: %s(%d)\n", sc->sc_dev.dv_xname, __func__, why));
s = splnet();
 3323         switch (why) {
 3324         case PWR_STANDBY:
 3325         case PWR_SUSPEND:
pgt_stop(sc, SC_NEEDS_RESET);
pgt_update_hw_from_sw(sc, 0, 0);
 3329                 if (sc->sc_power != NULL)
 3330                         (*sc->sc_power)(sc, why);
 3331                 break;
 3332         case PWR_RESUME:
 3333                 if (sc->sc_power != NULL)
 3334                         (*sc->sc_power)(sc, why);
pgt_stop(sc, SC_NEEDS_RESET);
pgt_update_hw_from_sw(sc, 0, 0);
 3339                 if ((ifp->if_flags & IFF_UP) &&
 3340                     !(ifp->if_flags & IFF_RUNNING)) {
pgt_init(ifp);
pgt_update_hw_from_sw(sc, 0, 0);
 3343                 }
 3344                 break;
 3345         }
splx(s);
 3348 }