/*      $OpenBSD: acx.c,v 1.128 2023/11/10 15:51:20 bluhm Exp $ */

/*
 * Copyright (c) 2006 Jonathan Gray <jsg@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/*
 * Copyright (c) 2006 The DragonFly Project.  All rights reserved.
 *
 * This code is derived from software contributed to The DragonFly Project
 * by Sepherosa Ziehau <sepherosa@gmail.com>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 * 3. Neither the name of The DragonFly Project nor the names of its
 *    contributors may be used to endorse or promote products derived
 *    from this software without specific, prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * Copyright (c) 2003-2004 wlan.kewl.org Project
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *
 *    This product includes software developed by the wlan.kewl.org Project.
 *
 * 4. Neither the name of the wlan.kewl.org Project nor the names of its
 *    contributors may be used to endorse or promote products derived from
 *    this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
 * THE wlan.kewl.org Project BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "bpfilter.h"

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <sys/ioctl.h>
#include <sys/errno.h>
#include <sys/device.h>
#include <sys/endian.h>

#include <machine/bus.h>
#include <machine/intr.h>

#include <net/if.h>
#include <net/if_media.h>

#if NBPFILTER > 0
#include <net/bpf.h>
#endif

#include <netinet/in.h>
#include <netinet/if_ether.h>

#include <net80211/ieee80211_var.h>
#include <net80211/ieee80211_amrr.h>
#include <net80211/ieee80211_radiotap.h>

#include <dev/ic/acxvar.h>
#include <dev/ic/acxreg.h>

#ifdef ACX_DEBUG
int acxdebug = 0;
#endif

int      acx_attach(struct acx_softc *);
int      acx_detach(void *);

int      acx_init(struct ifnet *);
int      acx_stop(struct acx_softc *);
void     acx_init_info_reg(struct acx_softc *);
int      acx_config(struct acx_softc *);
int      acx_read_config(struct acx_softc *, struct acx_config *);
int      acx_write_config(struct acx_softc *, struct acx_config *);
int      acx_rx_config(struct acx_softc *);
int      acx_set_crypt_keys(struct acx_softc *);
void     acx_next_scan(void *);

void     acx_start(struct ifnet *);
void     acx_watchdog(struct ifnet *);

int      acx_ioctl(struct ifnet *, u_long, caddr_t);

int      acx_intr(void *);
void     acx_disable_intr(struct acx_softc *);
void     acx_enable_intr(struct acx_softc *);
void     acx_txeof(struct acx_softc *);
void     acx_txerr(struct acx_softc *, uint8_t);
void     acx_rxeof(struct acx_softc *);

int      acx_dma_alloc(struct acx_softc *);
void     acx_dma_free(struct acx_softc *);
void     acx_init_tx_ring(struct acx_softc *);
int      acx_init_rx_ring(struct acx_softc *);
int      acx_newbuf(struct acx_softc *, struct acx_rxbuf *, int);
int      acx_encap(struct acx_softc *, struct acx_txbuf *,
             struct mbuf *, struct ieee80211_node *, int);

int      acx_reset(struct acx_softc *);

int      acx_set_null_tmplt(struct acx_softc *);
int      acx_set_probe_req_tmplt(struct acx_softc *, const char *, int);
#ifndef IEEE80211_STA_ONLY
int      acx_set_probe_resp_tmplt(struct acx_softc *, struct ieee80211_node *);
int      acx_beacon_locate(struct mbuf *, u_int8_t);
int      acx_set_beacon_tmplt(struct acx_softc *, struct ieee80211_node *);
#endif

int      acx_read_eeprom(struct acx_softc *, uint32_t, uint8_t *);
int      acx_read_phyreg(struct acx_softc *, uint32_t, uint8_t *);
const char *    acx_get_rf(int);
int      acx_get_maxrssi(int);

int      acx_load_firmware(struct acx_softc *, uint32_t,
             const uint8_t *, int);
int      acx_load_radio_firmware(struct acx_softc *, const char *);
int      acx_load_base_firmware(struct acx_softc *, const char *);

struct ieee80211_node
        *acx_node_alloc(struct ieee80211com *);
int      acx_newstate(struct ieee80211com *, enum ieee80211_state, int);

void     acx_init_cmd_reg(struct acx_softc *);
int      acx_join_bss(struct acx_softc *, uint8_t, struct ieee80211_node *);
int      acx_set_channel(struct acx_softc *, uint8_t);
int      acx_init_radio(struct acx_softc *, uint32_t, uint32_t);

void     acx_iter_func(void *, struct ieee80211_node *);
void     acx_amrr_timeout(void *);
void     acx_newassoc(struct ieee80211com *, struct ieee80211_node *, int);
#ifndef IEEE80211_STA_ONLY
void     acx_set_tim(struct ieee80211com *, int, int);
#endif

int             acx_beacon_intvl = 100; /* 100 TU */

/*
 * Possible values for the second parameter of acx_join_bss()
 */
#define ACX_MODE_ADHOC  0
#define ACX_MODE_UNUSED 1
#define ACX_MODE_STA    2
#define ACX_MODE_AP     3

struct cfdriver acx_cd = {
        NULL, "acx", DV_IFNET
};

int
acx_attach(struct acx_softc *sc)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        int i, error;

        /* Initialize channel scanning timer */
        timeout_set(&sc->sc_chanscan_timer, acx_next_scan, sc);

        /* Allocate busdma stuffs */
        error = acx_dma_alloc(sc);
        if (error) {
                printf("%s: attach failed, could not allocate DMA!\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        /* Reset Hardware */
        error = acx_reset(sc);
        if (error) {
                printf("%s: attach failed, could not reset device!\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        /* Disable interrupts before firmware is loaded */
        acx_disable_intr(sc);

        /* Get radio type and form factor */
#define EEINFO_RETRY_MAX        50
        for (i = 0; i < EEINFO_RETRY_MAX; ++i) {
                uint16_t ee_info;

                ee_info = CSR_READ_2(sc, ACXREG_EEPROM_INFO);
                if (ACX_EEINFO_HAS_RADIO_TYPE(ee_info)) {
                        sc->sc_form_factor = ACX_EEINFO_FORM_FACTOR(ee_info);
                        sc->sc_radio_type = ACX_EEINFO_RADIO_TYPE(ee_info);
                        break;
                }
                DELAY(10000);
        }
        if (i == EEINFO_RETRY_MAX) {
                printf("%s: attach failed, could not get radio type!\n",
                    sc->sc_dev.dv_xname);
                return (ENXIO);
        }
#undef EEINFO_RETRY_MAX

#ifdef DUMP_EEPROM
        for (i = 0; i < 0x40; ++i) {
                uint8_t val;

                error = acx_read_eeprom(sc, i, &val);
                if (error)
                        return (error);
                if (i % 10 == 0)
                        printf("\n");
                printf("%02x ", val);
        }
        printf("\n");
#endif  /* DUMP_EEPROM */

        /* Get EEPROM version */
        error = acx_read_eeprom(sc, ACX_EE_VERSION_OFS, &sc->sc_eeprom_ver);
        if (error) {
                printf("%s: attach failed, could not get EEPROM version!\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        ifp->if_softc = sc;
        ifp->if_ioctl = acx_ioctl;
        ifp->if_start = acx_start;
        ifp->if_watchdog = acx_watchdog;
        ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
        strlcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
        ifq_init_maxlen(&ifp->if_snd, IFQ_MAXLEN);

        /* Set channels */
        for (i = 1; i <= 14; ++i) {
                ic->ic_channels[i].ic_freq =
                    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
                ic->ic_channels[i].ic_flags = sc->chip_chan_flags;
        }

        ic->ic_opmode = IEEE80211_M_STA;
        ic->ic_state = IEEE80211_S_INIT;

        /*
         * NOTE: Don't overwrite ic_caps set by chip specific code
         */
        ic->ic_caps =
            IEEE80211_C_WEP |                   /* WEP */
            IEEE80211_C_MONITOR |               /* Monitor mode */
#ifndef IEEE80211_STA_ONLY
            IEEE80211_C_IBSS |                  /* IBSS mode */
            IEEE80211_C_HOSTAP |                /* Access Point */
            IEEE80211_C_APPMGT |                /* AP Power Mgmt */
#endif
            IEEE80211_C_SHPREAMBLE;             /* Short preamble */

        /* Get station id */
        for (i = 0; i < IEEE80211_ADDR_LEN; ++i) {
                error = acx_read_eeprom(sc, sc->chip_ee_eaddr_ofs - i,
                    &ic->ic_myaddr[i]);
                if (error) {
                        printf("%s: attach failed, could not get station id\n",
                            sc->sc_dev.dv_xname);
                        return error;
                }
        }

        printf("%s: %s, radio %s (0x%02x), EEPROM ver %u, address %s\n",
            sc->sc_dev.dv_xname,
            (sc->sc_flags & ACX_FLAG_ACX111) ? "ACX111" : "ACX100",
            acx_get_rf(sc->sc_radio_type), sc->sc_radio_type,
            sc->sc_eeprom_ver, ether_sprintf(ic->ic_myaddr));

        if_attach(ifp);
        ieee80211_ifattach(ifp);

        /* Override node alloc */
        ic->ic_node_alloc = acx_node_alloc;
        ic->ic_newassoc = acx_newassoc;

#ifndef IEEE80211_STA_ONLY
        /* Override set TIM */
        ic->ic_set_tim = acx_set_tim;
#endif

        /* Override newstate */
        sc->sc_newstate = ic->ic_newstate;
        ic->ic_newstate = acx_newstate;

        /* Set maximal rssi */
        ic->ic_max_rssi = acx_get_maxrssi(sc->sc_radio_type);

        ieee80211_media_init(ifp, ieee80211_media_change,
            ieee80211_media_status);

        /* AMRR rate control */
        sc->amrr.amrr_min_success_threshold = 1;
        sc->amrr.amrr_max_success_threshold = 15;
        timeout_set(&sc->amrr_ch, acx_amrr_timeout, sc);

        sc->sc_long_retry_limit = 4;
        sc->sc_short_retry_limit = 7;
        sc->sc_msdu_lifetime = 4096;

#if NBPFILTER > 0
        bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
            sizeof(struct ieee80211_frame) + 64);

        sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
        sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
        sc->sc_rxtap.wr_ihdr.it_present = htole32(ACX_RX_RADIOTAP_PRESENT);

        sc->sc_txtap_len = sizeof(sc->sc_txtapu);
        sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
        sc->sc_txtap.wt_ihdr.it_present = htole32(ACX_TX_RADIOTAP_PRESENT);
#endif

        return (0);
}

int
acx_detach(void *xsc)
{
        struct acx_softc *sc = xsc;
        struct ieee80211com *ic = &sc->sc_ic;
        struct ifnet *ifp = &ic->ic_if;

        acx_stop(sc);
        ieee80211_ifdetach(ifp);
        if_detach(ifp);

        acx_dma_free(sc);

        return (0);
}

int
acx_init(struct ifnet *ifp)
{
        struct acx_softc *sc = ifp->if_softc;
        struct ieee80211com *ic = &sc->sc_ic;
        char fname[] = "tiacx111c16";
        int error, combined = 0;

        error = acx_stop(sc);
        if (error)
                return (EIO);

        /* enable card if possible */
        if (sc->sc_enable != NULL) {
                error = (*sc->sc_enable)(sc);
                if (error)
                        return (EIO);
        }

        acx_init_tx_ring(sc);

        error = acx_init_rx_ring(sc);
        if (error) {
                printf("%s: can't initialize RX ring\n",
                    sc->sc_dev.dv_xname);
                goto back;
        }

        if (sc->sc_flags & ACX_FLAG_ACX111) {
                snprintf(fname, sizeof(fname), "tiacx111c%02X",
                    sc->sc_radio_type);
                error = acx_load_base_firmware(sc, fname);

                if (!error)
                        combined = 1;
        }

        if (!combined) {
                snprintf(fname, sizeof(fname), "tiacx%s",
                    (sc->sc_flags & ACX_FLAG_ACX111) ? "111" : "100");
                error = acx_load_base_firmware(sc, fname);
        }

        if (error)
                goto back;

        /*
         * Initialize command and information registers
         * NOTE: This should be done after base firmware is loaded
         */
        acx_init_cmd_reg(sc);
        acx_init_info_reg(sc);

        sc->sc_flags |= ACX_FLAG_FW_LOADED;

        if (!combined) {
                snprintf(fname, sizeof(fname), "tiacx%sr%02X",
                    (sc->sc_flags & ACX_FLAG_ACX111) ? "111" : "100",
                    sc->sc_radio_type);
                error = acx_load_radio_firmware(sc, fname);

                if (error)
                        goto back;
        }

        error = sc->chip_init(sc);
        if (error)
                goto back;

        /* Get and set device various configuration */
        error = acx_config(sc);
        if (error)
                goto back;

        /* Setup crypto stuffs */
        if (sc->sc_ic.ic_flags & IEEE80211_F_WEPON) {
                error = acx_set_crypt_keys(sc);
                if (error)
                        goto back;
        }

        /* Turn on power led */
        CSR_CLRB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);

        acx_enable_intr(sc);

        ifp->if_flags |= IFF_RUNNING;
        ifq_clr_oactive(&ifp->if_snd);

        if (ic->ic_opmode != IEEE80211_M_MONITOR)
                /* start background scanning */
                ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
        else
                /* in monitor mode change directly into run state */
                ieee80211_new_state(ic, IEEE80211_S_RUN, -1);

        return (0);
back:
        acx_stop(sc);
        return (error);
}

void
acx_init_info_reg(struct acx_softc *sc)
{
        sc->sc_info = CSR_READ_4(sc, ACXREG_INFO_REG_OFFSET);
        sc->sc_info_param = sc->sc_info + ACX_INFO_REG_SIZE;
}

int
acx_set_crypt_keys(struct acx_softc *sc)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_conf_wep_txkey wep_txkey;
        int i, error, got_wk = 0;

        for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
                struct ieee80211_key *k = &ic->ic_nw_keys[i];

                if (k->k_len == 0)
                        continue;

                if (sc->chip_hw_crypt) {
                        error = sc->chip_set_wepkey(sc, k, i);
                        if (error)
                                return (error);
                        got_wk = 1;
                }
        }

        if (!got_wk)
                return (0);

        /* Set current WEP key index */
        wep_txkey.wep_txkey = ic->ic_wep_txkey;
        if (acx_set_conf(sc, ACX_CONF_WEP_TXKEY, &wep_txkey,
            sizeof(wep_txkey)) != 0) {
                printf("%s: set WEP txkey failed\n", sc->sc_dev.dv_xname);
                return (ENXIO);
        }

        return (0);
}

void
acx_next_scan(void *arg)
{
        struct acx_softc *sc = arg;
        struct ieee80211com *ic = &sc->sc_ic;
        struct ifnet *ifp = &ic->ic_if;

        if (ic->ic_state == IEEE80211_S_SCAN)
                ieee80211_next_scan(ifp);
}

int
acx_stop(struct acx_softc *sc)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct ifnet *ifp = &ic->ic_if;
        struct acx_buf_data *bd = &sc->sc_buf_data;
        struct acx_ring_data *rd = &sc->sc_ring_data;
        int i, error;

        sc->sc_firmware_ver = 0;
        sc->sc_hardware_id = 0;

        /* Reset hardware */
        error = acx_reset(sc);
        if (error)
                return (error);

        /* Firmware no longer functions after hardware reset */
        sc->sc_flags &= ~ACX_FLAG_FW_LOADED;

        acx_disable_intr(sc);

        /* Stop background scanning */
        timeout_del(&sc->sc_chanscan_timer);

        /* Turn off power led */
        CSR_SETB_2(sc, ACXREG_GPIO_OUT, sc->chip_gpio_pled);

        /* Free TX mbuf */
        for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
                struct acx_txbuf *buf;
                struct ieee80211_node *ni;

                buf = &bd->tx_buf[i];

                if (buf->tb_mbuf != NULL) {
                        bus_dmamap_unload(sc->sc_dmat, buf->tb_mbuf_dmamap);
                        m_freem(buf->tb_mbuf);
                        buf->tb_mbuf = NULL;
                }

                ni = (struct ieee80211_node *)buf->tb_node;
                if (ni != NULL)
                        ieee80211_release_node(ic, ni);
                buf->tb_node = NULL;
        }

        /* Clear TX host descriptors */
        bzero(rd->tx_ring, ACX_TX_RING_SIZE);

        /* Free RX mbuf */
        for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
                if (bd->rx_buf[i].rb_mbuf != NULL) {
                        bus_dmamap_unload(sc->sc_dmat,
                            bd->rx_buf[i].rb_mbuf_dmamap);
                        m_freem(bd->rx_buf[i].rb_mbuf);
                        bd->rx_buf[i].rb_mbuf = NULL;
                }
        }

        /* Clear RX host descriptors */
        bzero(rd->rx_ring, ACX_RX_RING_SIZE);

        sc->sc_txtimer = 0;
        ifp->if_timer = 0;
        ifp->if_flags &= ~IFF_RUNNING;
        ifq_clr_oactive(&ifp->if_snd);
        ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);

        /* disable card if possible */
        if (sc->sc_disable != NULL)
                (*sc->sc_disable)(sc);

        return (0);
}

int
acx_config(struct acx_softc *sc)
{
        struct acx_config conf;
        int error;

        error = acx_read_config(sc, &conf);
        if (error)
                return (error);

        error = acx_write_config(sc, &conf);
        if (error)
                return (error);

        error = acx_rx_config(sc);
        if (error)
                return (error);

        if (acx_set_probe_req_tmplt(sc, "", 0) != 0) {
                printf("%s: can't set probe req template "
                    "(empty ssid)\n", sc->sc_dev.dv_xname);
                return (ENXIO);
        }

        /* XXX for PM?? */
        if (acx_set_null_tmplt(sc) != 0) {
                printf("%s: can't set null data template\n",
                    sc->sc_dev.dv_xname);
                return (ENXIO);
        }

        return (0);
}

int
acx_read_config(struct acx_softc *sc, struct acx_config *conf)
{
        struct acx_conf_regdom reg_dom;
        struct acx_conf_antenna ant;
        struct acx_conf_fwrev fw_rev;
        uint32_t fw_rev_no;
        uint8_t sen;
        int error;

        /* Get region domain */
        if (acx_get_conf(sc, ACX_CONF_REGDOM, &reg_dom, sizeof(reg_dom)) != 0) {
                printf("%s: can't get region domain\n", sc->sc_dev.dv_xname);
                return (ENXIO);
        }
        conf->regdom = reg_dom.regdom;
        DPRINTF(("%s: regdom %02x\n", sc->sc_dev.dv_xname, reg_dom.regdom));

        /* Get antenna */
        if (acx_get_conf(sc, ACX_CONF_ANTENNA, &ant, sizeof(ant)) != 0) {
                printf("%s: can't get antenna\n", sc->sc_dev.dv_xname);
                return (ENXIO);
        }
        conf->antenna = ant.antenna;
        DPRINTF(("%s: antenna %02x\n", sc->sc_dev.dv_xname, ant.antenna));

        /* Get sensitivity XXX not used */
        if (sc->sc_radio_type == ACX_RADIO_TYPE_MAXIM ||
            sc->sc_radio_type == ACX_RADIO_TYPE_RFMD ||
            sc->sc_radio_type == ACX_RADIO_TYPE_RALINK) {
                error = acx_read_phyreg(sc, ACXRV_PHYREG_SENSITIVITY, &sen);
                if (error) {
                        printf("%s: can't get sensitivity\n",
                            sc->sc_dev.dv_xname);
                        return (error);
                }
        } else
                sen = 0;
        DPRINTF(("%s: sensitivity %02x\n", sc->sc_dev.dv_xname, sen));

        /* Get firmware revision */
        if (acx_get_conf(sc, ACX_CONF_FWREV, &fw_rev, sizeof(fw_rev)) != 0) {
                printf("%s: can't get firmware revision\n",
                    sc->sc_dev.dv_xname);
                return (ENXIO);
        }

        if (strncmp(fw_rev.fw_rev, "Rev ", 4) != 0) {
                printf("%s: strange revision string -- %s\n",
                    sc->sc_dev.dv_xname, fw_rev.fw_rev);
                fw_rev_no = 0x01090407;
        } else {
                /*
                 *  01234
                 * "Rev xx.xx.xx.xx"
                 *      ^ Start from here
                 */
                fw_rev_no  = fw_rev.fw_rev[0] << 24;
                fw_rev_no |= fw_rev.fw_rev[1] << 16;
                fw_rev_no |= fw_rev.fw_rev[2] <<  8;
                fw_rev_no |= fw_rev.fw_rev[3];
        }
        sc->sc_firmware_ver = fw_rev_no;
        sc->sc_hardware_id = letoh32(fw_rev.hw_id);
        DPRINTF(("%s: fw rev %08x, hw id %08x\n",
            sc->sc_dev.dv_xname, sc->sc_firmware_ver, sc->sc_hardware_id));

        if (sc->chip_read_config != NULL) {
                error = sc->chip_read_config(sc, conf);
                if (error)
                        return (error);
        }

        return (0);
}

int
acx_write_config(struct acx_softc *sc, struct acx_config *conf)
{
        struct acx_conf_nretry_short sretry;
        struct acx_conf_nretry_long lretry;
        struct acx_conf_msdu_lifetime msdu_lifetime;
        struct acx_conf_rate_fallback rate_fb;
        struct acx_conf_antenna ant;
        struct acx_conf_regdom reg_dom;
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        int error;

        /* Set number of long/short retry */
        sretry.nretry = sc->sc_short_retry_limit;
        if (acx_set_conf(sc, ACX_CONF_NRETRY_SHORT, &sretry,
            sizeof(sretry)) != 0) {
                printf("%s: can't set short retry limit\n", ifp->if_xname);
                return (ENXIO);
        }

        lretry.nretry = sc->sc_long_retry_limit;
        if (acx_set_conf(sc, ACX_CONF_NRETRY_LONG, &lretry,
            sizeof(lretry)) != 0) {
                printf("%s: can't set long retry limit\n", ifp->if_xname);
                return (ENXIO);
        }

        /* Set MSDU lifetime */
        msdu_lifetime.lifetime = htole32(sc->sc_msdu_lifetime);
        if (acx_set_conf(sc, ACX_CONF_MSDU_LIFETIME, &msdu_lifetime,
            sizeof(msdu_lifetime)) != 0) {
                printf("%s: can't set MSDU lifetime\n", ifp->if_xname);
                return (ENXIO);
        }

        /* Enable rate fallback */
        rate_fb.ratefb_enable = 1;
        if (acx_set_conf(sc, ACX_CONF_RATE_FALLBACK, &rate_fb,
            sizeof(rate_fb)) != 0) {
                printf("%s: can't enable rate fallback\n", ifp->if_xname);
                return (ENXIO);
        }

        /* Set antenna */
        ant.antenna = conf->antenna;
        if (acx_set_conf(sc, ACX_CONF_ANTENNA, &ant, sizeof(ant)) != 0) {
                printf("%s: can't set antenna\n", ifp->if_xname);
                return (ENXIO);
        }

        /* Set region domain */
        reg_dom.regdom = conf->regdom;
        if (acx_set_conf(sc, ACX_CONF_REGDOM, &reg_dom, sizeof(reg_dom)) != 0) {
                printf("%s: can't set region domain\n", ifp->if_xname);
                return (ENXIO);
        }

        if (sc->chip_write_config != NULL) {
                error = sc->chip_write_config(sc, conf);
                if (error)
                        return (error);
        }

        return (0);
}

int
acx_rx_config(struct acx_softc *sc)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_conf_rxopt rx_opt;

        /* tell the RX receiver what frames we want to have */
        rx_opt.opt1 = htole16(RXOPT1_INCL_RXBUF_HDR);
        rx_opt.opt2 = htole16(
            RXOPT2_RECV_ASSOC_REQ |
            RXOPT2_RECV_AUTH |
            RXOPT2_RECV_BEACON |
            RXOPT2_RECV_CF |
            RXOPT2_RECV_CTRL |
            RXOPT2_RECV_DATA |
            RXOPT2_RECV_MGMT |
            RXOPT2_RECV_PROBE_REQ |
            RXOPT2_RECV_PROBE_RESP |
            RXOPT2_RECV_OTHER);

        /* in monitor mode go promiscuous */
        if (ic->ic_opmode == IEEE80211_M_MONITOR) {
                rx_opt.opt1 |= RXOPT1_PROMISC;
                rx_opt.opt2 |= RXOPT2_RECV_BROKEN | RXOPT2_RECV_ACK;
        } else
                rx_opt.opt1 |= RXOPT1_FILT_FDEST;

        /* finally set the RX options */
        if (acx_set_conf(sc, ACX_CONF_RXOPT, &rx_opt, sizeof(rx_opt)) != 0) {
                printf("%s: can not set RX options!\n", sc->sc_dev.dv_xname);
                return (ENXIO);
        }

        return (0);
}

int
acx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
{
        struct acx_softc *sc = ifp->if_softc;
        struct ieee80211com *ic = &sc->sc_ic;
        int s, error = 0;
        uint8_t chan;

        s = splnet();

        switch (cmd) {
        case SIOCSIFADDR:
                ifp->if_flags |= IFF_UP;
                /* FALLTHROUGH */
        case SIOCSIFFLAGS:
                if (ifp->if_flags & IFF_UP) {
                        if ((ifp->if_flags & IFF_RUNNING) == 0)
                                error = acx_init(ifp);
                } else {
                        if (ifp->if_flags & IFF_RUNNING)
                                error = acx_stop(sc);
                }
                break;
        case SIOCS80211CHANNEL:
                /* allow fast channel switching in monitor mode */
                error = ieee80211_ioctl(ifp, cmd, data);
                if (error == ENETRESET &&
                    ic->ic_opmode == IEEE80211_M_MONITOR) {
                        if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
                            (IFF_UP | IFF_RUNNING)) {
                                ic->ic_bss->ni_chan = ic->ic_ibss_chan;
                                chan = ieee80211_chan2ieee(ic,
                                    ic->ic_bss->ni_chan);
                                (void)acx_set_channel(sc, chan);
                        }
                        error = 0;
                }
                break;
        default:
                error = ieee80211_ioctl(ifp, cmd, data);
                break;
        }

        if (error == ENETRESET) {
                if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
                    (IFF_RUNNING | IFF_UP))
                        error = acx_init(ifp);
                else
                        error = 0;
        }

        splx(s);

        return (error);
}

void
acx_start(struct ifnet *ifp)
{
        struct acx_softc *sc = ifp->if_softc;
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_buf_data *bd = &sc->sc_buf_data;
        struct acx_txbuf *buf;
        int trans, idx;

        if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0 ||
            (ifp->if_flags & IFF_RUNNING) == 0 ||
            ifq_is_oactive(&ifp->if_snd))
                return;

        /*
         * NOTE:
         * We can't start from a random position that TX descriptor
         * is free, since hardware will be confused by that.
         * We have to follow the order of the TX ring.
         */
        idx = bd->tx_free_start;
        trans = 0;
        for (buf = &bd->tx_buf[idx]; buf->tb_mbuf == NULL;
             buf = &bd->tx_buf[idx]) {
                struct ieee80211_frame *wh;
                struct ieee80211_node *ni = NULL;
                struct mbuf *m;
                int rate;

                m = mq_dequeue(&ic->ic_mgtq);
                /* first dequeue management frames */
                if (m != NULL) {
                        ni = m->m_pkthdr.ph_cookie;

                        /*
                         * probe response mgmt frames are handled by the
                         * firmware already.  So, don't send them twice.
                         */
                        wh = mtod(m, struct ieee80211_frame *);
                        if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
                            IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
                                if (ni != NULL)
                                        ieee80211_release_node(ic, ni);
                                m_freem(m);
                                continue;
                        }

                        /*
                         * mgmt frames are sent at the lowest available
                         * bit-rate.
                         */
                        rate = ni->ni_rates.rs_rates[0];
                        rate &= IEEE80211_RATE_VAL;
                } else {
                        struct ether_header *eh;

                        /* then dequeue packets on the powersave queue */
                        m = mq_dequeue(&ic->ic_pwrsaveq);
                        if (m != NULL) {
                                ni = m->m_pkthdr.ph_cookie;
                                goto encapped;
                        } else {
                                m = ifq_dequeue(&ifp->if_snd);
                                if (m == NULL)
                                        break;
                        }
                        if (ic->ic_state != IEEE80211_S_RUN) {
                                DPRINTF(("%s: data packet dropped due to "
                                    "not RUN.  Current state %d\n",
                                    ifp->if_xname, ic->ic_state));
                                m_freem(m);
                                break;
                        }

                        if (m->m_len < sizeof(struct ether_header)) {
                                m = m_pullup(m, sizeof(struct ether_header));
                                if (m == NULL) {
                                        ifp->if_oerrors++;
                                        continue;
                                }
                        }
                        eh = mtod(m, struct ether_header *);

                        /* TODO power save */

#if NBPFILTER > 0
                        if (ifp->if_bpf != NULL)
                                bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
#endif

                        if ((m = ieee80211_encap(ifp, m, &ni)) == NULL) {
                                ifp->if_oerrors++;
                                continue;
                        }
encapped:
                        if (ic->ic_fixed_rate != -1) {
                                rate = ic->ic_sup_rates[ic->ic_curmode].
                                    rs_rates[ic->ic_fixed_rate];
                        } else
                                rate = ni->ni_rates.rs_rates[ni->ni_txrate];
                        rate &= IEEE80211_RATE_VAL;
                } 

#if NBPFILTER > 0
                if (ic->ic_rawbpf != NULL)
                        bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
#endif

                wh = mtod(m, struct ieee80211_frame *);
                if ((wh->i_fc[1] & IEEE80211_FC1_WEP) && !sc->chip_hw_crypt) {
                        struct ieee80211_key *k;

                        k = ieee80211_get_txkey(ic, wh, ni);
                        if ((m = ieee80211_encrypt(ic, m, k)) == NULL) {
                                ieee80211_release_node(ic, ni);
                                ifp->if_oerrors++;
                                continue;
                        }
                }

#if NBPFILTER > 0
                if (sc->sc_drvbpf != NULL) {
                        struct mbuf mb;
                        struct acx_tx_radiotap_hdr *tap = &sc->sc_txtap;

                        tap->wt_flags = 0;
                        tap->wt_rate = rate;
                        tap->wt_chan_freq =
                            htole16(ic->ic_bss->ni_chan->ic_freq);
                        tap->wt_chan_flags =
                            htole16(ic->ic_bss->ni_chan->ic_flags);

                        mb.m_data = (caddr_t)tap;
                        mb.m_len = sc->sc_txtap_len;
                        mb.m_next = m;
                        mb.m_nextpkt = NULL;
                        mb.m_type = 0;
                        mb.m_flags = 0;
                        bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
                }
#endif

                if (acx_encap(sc, buf, m, ni, rate) != 0) {
                        /*
                         * NOTE: `m' will be freed in acx_encap()
                         * if we reach here.
                         */
                        if (ni != NULL)
                                ieee80211_release_node(ic, ni);
                        ifp->if_oerrors++;
                        continue;
                }

                /*
                 * NOTE:
                 * 1) `m' should not be touched after acx_encap()
                 * 2) `node' will be used to do TX rate control during
                 *    acx_txeof(), so it is not freed here.  acx_txeof()
                 *    will free it for us
                 */
                trans++;
                bd->tx_used_count++;
                idx = (idx + 1) % ACX_TX_DESC_CNT;
        }
        bd->tx_free_start = idx;

        if (bd->tx_used_count == ACX_TX_DESC_CNT)
                ifq_set_oactive(&ifp->if_snd);

        if (trans && sc->sc_txtimer == 0)
                sc->sc_txtimer = 5;
        ifp->if_timer = 1;
}

void
acx_watchdog(struct ifnet *ifp)
{
        struct acx_softc *sc = ifp->if_softc;

        ifp->if_timer = 0;

        if ((ifp->if_flags & IFF_RUNNING) == 0)
                return;

        if (sc->sc_txtimer) {
                if (--sc->sc_txtimer == 0) {
                        printf("%s: watchdog timeout\n", ifp->if_xname);
                        acx_init(ifp);
                        ifp->if_oerrors++;
                        return;
                } else
                        ifp->if_timer = 1;
        }

        ieee80211_watchdog(ifp);
}

int
acx_intr(void *arg)
{
        struct acx_softc *sc = arg;
        uint16_t intr_status;

        if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0)
                return (0);

        intr_status = CSR_READ_2(sc, ACXREG_INTR_STATUS_CLR);
        if (intr_status == ACXRV_INTR_ALL) {
                /* not our interrupt */
                return (0);
        }

        /* Acknowledge all interrupts */
        CSR_WRITE_2(sc, ACXREG_INTR_ACK, intr_status);

        intr_status &= sc->chip_intr_enable;
        if (intr_status == 0) {
                /* not interrupts we care about */
                return (1);
        }

#ifndef IEEE80211_STA_ONLY
        if (intr_status & ACXRV_INTR_DTIM)
                ieee80211_notify_dtim(&sc->sc_ic);
#endif

        if (intr_status & ACXRV_INTR_TX_FINI)
                acx_txeof(sc);

        if (intr_status & ACXRV_INTR_RX_FINI)
                acx_rxeof(sc);

        return (1);
}

void
acx_disable_intr(struct acx_softc *sc)
{
        CSR_WRITE_2(sc, ACXREG_INTR_MASK, sc->chip_intr_disable);
        CSR_WRITE_2(sc, ACXREG_EVENT_MASK, 0);
}

void
acx_enable_intr(struct acx_softc *sc)
{
        /* Mask out interrupts that are not in the enable set */
        CSR_WRITE_2(sc, ACXREG_INTR_MASK, ~sc->chip_intr_enable);
        CSR_WRITE_2(sc, ACXREG_EVENT_MASK, ACXRV_EVENT_DISABLE);
}

void
acx_txeof(struct acx_softc *sc)
{
        struct acx_buf_data *bd;
        struct acx_txbuf *buf;
        struct ifnet *ifp;
        int idx;

        ifp = &sc->sc_ic.ic_if;

        bd = &sc->sc_buf_data;
        idx = bd->tx_used_start;
        for (buf = &bd->tx_buf[idx]; buf->tb_mbuf != NULL;
             buf = &bd->tx_buf[idx]) {
                uint8_t ctrl, error;

                ctrl = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_ctrl);
                if ((ctrl & (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE)) !=
                    (DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE))
                        break;

                bus_dmamap_unload(sc->sc_dmat, buf->tb_mbuf_dmamap);
                m_freem(buf->tb_mbuf);
                buf->tb_mbuf = NULL;

                error = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_error);
                if (error) {
                        acx_txerr(sc, error);
                        ifp->if_oerrors++;
                }

                /* Update rate control statistics for the node */
                if (buf->tb_node != NULL) {
                        struct ieee80211com *ic;
                        struct ieee80211_node *ni;
                        struct acx_node *wn;
                        int ntries;

                        ic = &sc->sc_ic;
                        ni = (struct ieee80211_node *)buf->tb_node;
                        wn = (struct acx_node *)ni;
                        ntries = FW_TXDESC_GETFIELD_1(sc, buf, f_tx_rts_fail) +
                            FW_TXDESC_GETFIELD_1(sc, buf, f_tx_ack_fail);

                        wn->amn.amn_txcnt++;
                        if (ntries > 0) {
                                DPRINTFN(2, ("%s: tx intr ntries %d\n",
                                    sc->sc_dev.dv_xname, ntries));
                                wn->amn.amn_retrycnt++;
                        }

                        ieee80211_release_node(ic, ni);
                        buf->tb_node = NULL;
                }

                FW_TXDESC_SETFIELD_1(sc, buf, f_tx_ctrl, DESC_CTRL_HOSTOWN);

                bd->tx_used_count--;

                idx = (idx + 1) % ACX_TX_DESC_CNT;
        }
        bd->tx_used_start = idx;

        sc->sc_txtimer = bd->tx_used_count == 0 ? 0 : 5;

        if (bd->tx_used_count != ACX_TX_DESC_CNT) {
                ifq_clr_oactive(&ifp->if_snd);
                acx_start(ifp);
        }
}

void
acx_txerr(struct acx_softc *sc, uint8_t err)
{
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        struct acx_stats *stats = &sc->sc_stats;

        if (err == DESC_ERR_EXCESSIVE_RETRY) {
                /*
                 * This a common error (see comment below),
                 * so print it using DPRINTF().
                 */
                DPRINTF(("%s: TX failed -- excessive retry\n",
                    sc->sc_dev.dv_xname));
        } else
                printf("%s: TX failed -- ", ifp->if_xname);

        /*
         * Although `err' looks like bitmask, it never
         * has multiple bits set.
         */
        switch (err) {
#if 0
        case DESC_ERR_OTHER_FRAG:
                /* XXX what's this */
                printf("error in other fragment\n");
                stats->err_oth_frag++;
                break;
#endif
        case DESC_ERR_ABORT:
                printf("aborted\n");
                stats->err_abort++;
                break;
        case DESC_ERR_PARAM:
                printf("wrong parameters in descriptor\n");
                stats->err_param++;
                break;
        case DESC_ERR_NO_WEPKEY:
                printf("WEP key missing\n");
                stats->err_no_wepkey++;
                break;
        case DESC_ERR_MSDU_TIMEOUT:
                printf("MSDU life timeout\n");
                stats->err_msdu_timeout++;
                break;
        case DESC_ERR_EXCESSIVE_RETRY:
                /*
                 * Possible causes:
                 * 1) Distance is too long
                 * 2) Transmit failed (e.g. no MAC level ACK)
                 * 3) Chip overheated (this should be rare)
                 */
                stats->err_ex_retry++;
                break;
        case DESC_ERR_BUF_OVERFLOW:
                printf("buffer overflow\n");
                stats->err_buf_oflow++;
                break;
        case DESC_ERR_DMA:
                printf("DMA error\n");
                stats->err_dma++;
                break;
        default:
                printf("unknown error %d\n", err);
                stats->err_unkn++;
                break;
        }
}

void
acx_rxeof(struct acx_softc *sc)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_ring_data *rd = &sc->sc_ring_data;
        struct acx_buf_data *bd = &sc->sc_buf_data;
        struct ifnet *ifp = &ic->ic_if;
        int idx, ready;

        bus_dmamap_sync(sc->sc_dmat, rd->rx_ring_dmamap, 0,
            rd->rx_ring_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);

        /*
         * Locate first "ready" rx buffer,
         * start from last stopped position.
         */
        idx = bd->rx_scan_start;
        ready = 0;
        do {
                struct acx_rxbuf *buf;

                buf = &bd->rx_buf[idx];
                if ((buf->rb_desc->h_ctrl & htole16(DESC_CTRL_HOSTOWN)) &&
                    (buf->rb_desc->h_status & htole32(DESC_STATUS_FULL))) {
                        ready = 1;
                        break;
                }
                idx = (idx + 1) % ACX_RX_DESC_CNT;
        } while (idx != bd->rx_scan_start);

        if (!ready)
                return;

        /*
         * NOTE: don't mess up `idx' here, it will
         * be used in the following code.
         */
        do {
                struct acx_rxbuf_hdr *head;
                struct acx_rxbuf *buf;
                struct mbuf *m;
                struct ieee80211_rxinfo rxi;
                uint32_t desc_status;
                uint16_t desc_ctrl;
                int len, error;

                buf = &bd->rx_buf[idx];

                desc_ctrl = letoh16(buf->rb_desc->h_ctrl);
                desc_status = letoh32(buf->rb_desc->h_status);
                if (!(desc_ctrl & DESC_CTRL_HOSTOWN) ||
                    !(desc_status & DESC_STATUS_FULL))
                        break;

                bus_dmamap_sync(sc->sc_dmat, buf->rb_mbuf_dmamap, 0,
                    buf->rb_mbuf_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);

                m = buf->rb_mbuf;

                error = acx_newbuf(sc, buf, 0);
                if (error) {
                        ifp->if_ierrors++;
                        goto next;
                }

                head = mtod(m, struct acx_rxbuf_hdr *);

                len = letoh16(head->rbh_len) & ACX_RXBUF_LEN_MASK;
                if (len >= sizeof(struct ieee80211_frame_min) &&
                    len < MCLBYTES) {
                        struct ieee80211_frame *wh;
                        struct ieee80211_node *ni;

                        m_adj(m, sizeof(struct acx_rxbuf_hdr) +
                            sc->chip_rxbuf_exhdr);
                        wh = mtod(m, struct ieee80211_frame *);

                        memset(&rxi, 0, sizeof(rxi));
                        if ((wh->i_fc[1] & IEEE80211_FC1_WEP) &&
                            sc->chip_hw_crypt) {
                                /* Short circuit software WEP */
                                wh->i_fc[1] &= ~IEEE80211_FC1_WEP;

                                /* Do chip specific RX buffer processing */
                                if (sc->chip_proc_wep_rxbuf != NULL) {
                                        sc->chip_proc_wep_rxbuf(sc, m, &len);
                                        wh = mtod(m, struct ieee80211_frame *);
                                }
                                rxi.rxi_flags |= IEEE80211_RXI_HWDEC;
                        }

                        m->m_len = m->m_pkthdr.len = len;

#if NBPFILTER > 0
                        if (sc->sc_drvbpf != NULL) {
                                struct mbuf mb;
                                struct acx_rx_radiotap_hdr *tap = &sc->sc_rxtap;

                                tap->wr_flags = 0;
                                tap->wr_chan_freq =
                                    htole16(ic->ic_bss->ni_chan->ic_freq);
                                tap->wr_chan_flags =
                                    htole16(ic->ic_bss->ni_chan->ic_flags);
                                tap->wr_rssi = head->rbh_level;
                                tap->wr_max_rssi = ic->ic_max_rssi;

                                mb.m_data = (caddr_t)tap;
                                mb.m_len = sc->sc_rxtap_len;
                                mb.m_next = m;
                                mb.m_nextpkt = NULL;
                                mb.m_type = 0;
                                mb.m_flags = 0;
                                bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
                        }
#endif

                        ni = ieee80211_find_rxnode(ic, wh);

                        rxi.rxi_rssi = head->rbh_level;
                        rxi.rxi_tstamp = letoh32(head->rbh_time);
                        ieee80211_input(ifp, m, ni, &rxi);

                        ieee80211_release_node(ic, ni);
                } else {
                        m_freem(m);
                        ifp->if_ierrors++;
                }

next:
                buf->rb_desc->h_ctrl = htole16(desc_ctrl & ~DESC_CTRL_HOSTOWN);
                buf->rb_desc->h_status = 0;
                bus_dmamap_sync(sc->sc_dmat, rd->rx_ring_dmamap, 0,
                    rd->rx_ring_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);

                idx = (idx + 1) % ACX_RX_DESC_CNT;
        } while (idx != bd->rx_scan_start);

        /*
         * Record the position so that next
         * time we can start from it.
         */
        bd->rx_scan_start = idx;
}

int
acx_reset(struct acx_softc *sc)
{
        uint16_t reg;

        /* Halt ECPU */
        CSR_SETB_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_HALT);

        /* Software reset */
        reg = CSR_READ_2(sc, ACXREG_SOFT_RESET);
        CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg | ACXRV_SOFT_RESET);
        DELAY(100);
        CSR_WRITE_2(sc, ACXREG_SOFT_RESET, reg);

        /* Initialize EEPROM */
        CSR_SETB_2(sc, ACXREG_EEPROM_INIT, ACXRV_EEPROM_INIT);
        DELAY(50000);

        /* Test whether ECPU is stopped */
        reg = CSR_READ_2(sc, ACXREG_ECPU_CTRL);
        if (!(reg & ACXRV_ECPU_HALT)) {
                printf("%s: can't halt ECPU\n", sc->sc_dev.dv_xname);
                return (ENXIO);
        }

        return (0);
}

int
acx_read_eeprom(struct acx_softc *sc, uint32_t offset, uint8_t *val)
{
        int i;

        CSR_WRITE_4(sc, ACXREG_EEPROM_CONF, 0);
        CSR_WRITE_4(sc, ACXREG_EEPROM_ADDR, offset);
        CSR_WRITE_4(sc, ACXREG_EEPROM_CTRL, ACXRV_EEPROM_READ);

#define EE_READ_RETRY_MAX       100
        for (i = 0; i < EE_READ_RETRY_MAX; ++i) {
                if (CSR_READ_2(sc, ACXREG_EEPROM_CTRL) == 0)
                        break;
                DELAY(10000);
        }
        if (i == EE_READ_RETRY_MAX) {
                printf("%s: can't read EEPROM offset %x (timeout)\n",
                    sc->sc_dev.dv_xname, offset);
                return (ETIMEDOUT);
        }
#undef EE_READ_RETRY_MAX

        *val = CSR_READ_1(sc, ACXREG_EEPROM_DATA);

        return (0);
}

int
acx_read_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t *val)
{
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        int i;

        CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
        CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_READ);

#define PHY_READ_RETRY_MAX      100
        for (i = 0; i < PHY_READ_RETRY_MAX; ++i) {
                if (CSR_READ_4(sc, ACXREG_PHY_CTRL) == 0)
                        break;
                DELAY(10000);
        }
        if (i == PHY_READ_RETRY_MAX) {
                printf("%s: can't read phy reg %x (timeout)\n",
                    ifp->if_xname, reg);
                return (ETIMEDOUT);
        }
#undef PHY_READ_RETRY_MAX

        *val = CSR_READ_1(sc, ACXREG_PHY_DATA);

        return (0);
}

void
acx_write_phyreg(struct acx_softc *sc, uint32_t reg, uint8_t val)
{
        CSR_WRITE_4(sc, ACXREG_PHY_DATA, val);
        CSR_WRITE_4(sc, ACXREG_PHY_ADDR, reg);
        CSR_WRITE_4(sc, ACXREG_PHY_CTRL, ACXRV_PHY_WRITE);
}

int
acx_load_base_firmware(struct acx_softc *sc, const char *name)
{
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        int i, error;
        uint8_t *ucode;
        size_t size;

        error = loadfirmware(name, &ucode, &size);

        if (error != 0) {
                printf("%s: error %d, could not read firmware %s\n",
                    ifp->if_xname, error, name);
                return (EIO);
        }

        /* Load base firmware */
        error = acx_load_firmware(sc, 0, ucode, size);

        free(ucode, M_DEVBUF, size);

        if (error) {
                printf("%s: can't load base firmware\n", ifp->if_xname);
                return error;
        }
        DPRINTF(("%s: base firmware loaded\n", sc->sc_dev.dv_xname));

        /* Start ECPU */
        CSR_WRITE_2(sc, ACXREG_ECPU_CTRL, ACXRV_ECPU_START);

        /* Wait for ECPU to be up */
        for (i = 0; i < 500; ++i) {
                uint16_t reg;

                reg = CSR_READ_2(sc, ACXREG_INTR_STATUS);
                if (reg & ACXRV_INTR_FCS_THRESH) {
                        CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_FCS_THRESH);
                        return (0);
                }
                DELAY(10000);
        }

        printf("%s: can't initialize ECPU (timeout)\n", ifp->if_xname);

        return (ENXIO);
}

int
acx_load_radio_firmware(struct acx_softc *sc, const char *name)
{
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        struct acx_conf_mmap mem_map;
        uint32_t radio_fw_ofs;
        int error;
        uint8_t *ucode;
        size_t size;

        error = loadfirmware(name, &ucode, &size);

        if (error != 0) {
                printf("%s: error %d, could not read firmware %s\n",
                    ifp->if_xname, error, name);
                return (EIO);
        }

        /*
         * Get the position, where base firmware is loaded, so that
         * radio firmware can be loaded after it.
         */
        if (acx_get_conf(sc, ACX_CONF_MMAP, &mem_map, sizeof(mem_map)) != 0) {
                free(ucode, M_DEVBUF, size);
                return (ENXIO);
        }
        radio_fw_ofs = letoh32(mem_map.code_end);

        /* Put ECPU into sleeping state, before loading radio firmware */
        if (acx_exec_command(sc, ACXCMD_SLEEP, NULL, 0, NULL, 0) != 0) {
                free(ucode, M_DEVBUF, size);
                return (ENXIO);
        }

        /* Load radio firmware */
        error = acx_load_firmware(sc, radio_fw_ofs, ucode, size);

        free(ucode, M_DEVBUF, size);

        if (error) {
                printf("%s: can't load radio firmware\n", ifp->if_xname);
                return (ENXIO);
        }
        DPRINTF(("%s: radio firmware loaded\n", sc->sc_dev.dv_xname));

        /* Wake up sleeping ECPU, after radio firmware is loaded */
        if (acx_exec_command(sc, ACXCMD_WAKEUP, NULL, 0, NULL, 0) != 0)
                return (ENXIO);

        /* Initialize radio */
        if (acx_init_radio(sc, radio_fw_ofs, size) != 0)
                return (ENXIO);

        /* Verify radio firmware's loading position */
        if (acx_get_conf(sc, ACX_CONF_MMAP, &mem_map, sizeof(mem_map)) != 0)
                return (ENXIO);

        if (letoh32(mem_map.code_end) != radio_fw_ofs + size) {
                printf("%s: loaded radio firmware position mismatch\n",
                    ifp->if_xname);
                return (ENXIO);
        }

        DPRINTF(("%s: radio firmware initialized\n", sc->sc_dev.dv_xname));

        return (0);
}

int
acx_load_firmware(struct acx_softc *sc, uint32_t offset, const uint8_t *data,
    int data_len)
{
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        const uint32_t *fw;
        u_int32_t csum = 0;
        int i, fw_len;

        for (i = 4; i < data_len; i++)
                csum += data[i];

        fw = (const uint32_t *)data;

        if (*fw != htole32(csum)) {
                printf("%s: firmware checksum 0x%x does not match 0x%x!\n",
                    ifp->if_xname, *fw, htole32(csum));
                return (ENXIO);
        }

        /* skip csum + length */
        data += 8;
        data_len -= 8;

        fw = (const uint32_t *)data;
        fw_len = data_len / sizeof(uint32_t);

        /*
         * LOADFW_AUTO_INC only works with some older firmware:
         * 1) acx100's firmware
         * 2) acx111's firmware whose rev is 0x00010011
         */

        /* Load firmware */
        CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
#ifndef LOADFW_AUTO_INC
        CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
#else
        CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
        CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
#endif

        for (i = 0; i < fw_len; ++i) {
#ifndef LOADFW_AUTO_INC
                CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
#endif
                CSR_WRITE_4(sc, ACXREG_FWMEM_DATA, betoh32(fw[i]));
        }

        /* Verify firmware */
        CSR_WRITE_4(sc, ACXREG_FWMEM_START, ACXRV_FWMEM_START_OP);
#ifndef LOADFW_AUTO_INC
        CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, 0);
#else
        CSR_WRITE_4(sc, ACXREG_FWMEM_CTRL, ACXRV_FWMEM_ADDR_AUTOINC);
        CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset);
#endif

        for (i = 0; i < fw_len; ++i) {
                uint32_t val;

#ifndef LOADFW_AUTO_INC
                CSR_WRITE_4(sc, ACXREG_FWMEM_ADDR, offset + (i * 4));
#endif
                val = CSR_READ_4(sc, ACXREG_FWMEM_DATA);
                if (betoh32(fw[i]) != val) {
                        printf("%s: firmware mismatch fw %08x  loaded %08x\n",
                            ifp->if_xname, fw[i], val);
                        return (ENXIO);
                }
        }

        return (0);
}

struct ieee80211_node *
acx_node_alloc(struct ieee80211com *ic)
{
        struct acx_node *wn;

        wn = malloc(sizeof(*wn), M_DEVBUF, M_NOWAIT | M_ZERO);
        if (wn == NULL)
                return (NULL);

        return ((struct ieee80211_node *)wn);
}

int
acx_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
{
        struct acx_softc *sc = ic->ic_if.if_softc;
        struct ifnet *ifp = &ic->ic_if;
        int error = 0;

        timeout_del(&sc->amrr_ch);

        switch (nstate) {
        case IEEE80211_S_INIT:
                break;
        case IEEE80211_S_SCAN: {
                        uint8_t chan;

                        chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
                        if (acx_set_channel(sc, chan) != 0) {
                                error = 1;
                                goto back;
                        }

                        /* 200ms => 5 channels per second */
                        timeout_add_msec(&sc->sc_chanscan_timer, 200);
                }
                break;
        case IEEE80211_S_AUTH:
                if (ic->ic_opmode == IEEE80211_M_STA) {
                        struct ieee80211_node *ni;
#ifdef ACX_DEBUG
                        int i;
#endif

                        ni = ic->ic_bss;

                        if (acx_join_bss(sc, ACX_MODE_STA, ni) != 0) {
                                printf("%s: join BSS failed\n", ifp->if_xname);
                                error = 1;
                                goto back;
                        }

                        DPRINTF(("%s: join BSS\n", sc->sc_dev.dv_xname));
                        if (ic->ic_state == IEEE80211_S_ASSOC) {
                                DPRINTF(("%s: change from assoc to run\n",
                                    sc->sc_dev.dv_xname));
                                ic->ic_state = IEEE80211_S_RUN;
                        }

#ifdef ACX_DEBUG
                        printf("%s: AP rates: ", sc->sc_dev.dv_xname);
                        for (i = 0; i < ni->ni_rates.rs_nrates; ++i)
                                printf("%d ", ni->ni_rates.rs_rates[i]);
                        ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
                        printf(" %s\n", ether_sprintf(ni->ni_bssid));
#endif
                }
                break;
        case IEEE80211_S_RUN:
#ifndef IEEE80211_STA_ONLY
                if (ic->ic_opmode == IEEE80211_M_IBSS ||
                    ic->ic_opmode == IEEE80211_M_HOSTAP) {
                        struct ieee80211_node *ni;
                        uint8_t chan;

                        ni = ic->ic_bss;
                        chan = ieee80211_chan2ieee(ic, ni->ni_chan);

                        error = 1;

                        if (acx_set_channel(sc, chan) != 0)
                                goto back;

                        if (acx_set_beacon_tmplt(sc, ni) != 0) {
                                printf("%s: set beacon template failed\n",
                                    ifp->if_xname);
                                goto back;
                        }

                        if (acx_set_probe_resp_tmplt(sc, ni) != 0) {
                                printf("%s: set probe response template "
                                    "failed\n", ifp->if_xname);
                                goto back;
                        }

                        if (ic->ic_opmode == IEEE80211_M_IBSS) {
                                if (acx_join_bss(sc, ACX_MODE_ADHOC, ni) != 0) {
                                        printf("%s: join IBSS failed\n",
                                            ifp->if_xname);
                                        goto back;
                                }
                        } else {
                                if (acx_join_bss(sc, ACX_MODE_AP, ni) != 0) {
                                        printf("%s: join HOSTAP failed\n",
                                            ifp->if_xname);
                                        goto back;
                                }
                        }

                        DPRINTF(("%s: join IBSS\n", sc->sc_dev.dv_xname));
                        error = 0;
                }
#endif
                /* fake a join to init the tx rate */
                if (ic->ic_opmode == IEEE80211_M_STA)
                        acx_newassoc(ic, ic->ic_bss, 1);

                /* start automatic rate control timer */
                if (ic->ic_fixed_rate == -1)
                        timeout_add_msec(&sc->amrr_ch, 500);
                break;
        default:
                break;
        }

back:
        if (error) {
                /* XXX */
                nstate = IEEE80211_S_INIT;
                arg = -1;
        }

        return (sc->sc_newstate(ic, nstate, arg));
}

int
acx_init_tmplt_ordered(struct acx_softc *sc)
{
        union {
                struct acx_tmplt_beacon         beacon;
                struct acx_tmplt_null_data      null;
                struct acx_tmplt_probe_req      preq;
                struct acx_tmplt_probe_resp     presp;
                struct acx_tmplt_tim            tim;
        } data;

        bzero(&data, sizeof(data));
        /*
         * NOTE:
         * Order of templates initialization:
         * 1) Probe request
         * 2) NULL data
         * 3) Beacon
         * 4) TIM
         * 5) Probe response
         * Above order is critical to get a correct memory map.
         */
        if (acx_set_tmplt(sc, ACXCMD_TMPLT_PROBE_REQ, &data.preq,
            sizeof(data.preq)) != 0)
                return (1);

        if (acx_set_tmplt(sc, ACXCMD_TMPLT_NULL_DATA, &data.null,
            sizeof(data.null)) != 0)
                return (1);

        if (acx_set_tmplt(sc, ACXCMD_TMPLT_BEACON, &data.beacon,
            sizeof(data.beacon)) != 0)
                return (1);

        if (acx_set_tmplt(sc, ACXCMD_TMPLT_TIM, &data.tim,
            sizeof(data.tim)) != 0)
                return (1);

        if (acx_set_tmplt(sc, ACXCMD_TMPLT_PROBE_RESP, &data.presp,
            sizeof(data.presp)) != 0)
                return (1);

        return (0);
}

int
acx_dma_alloc(struct acx_softc *sc)
{
        struct acx_ring_data *rd = &sc->sc_ring_data;
        struct acx_buf_data *bd = &sc->sc_buf_data;
        int i, error, nsegs;

        /* Allocate DMA stuffs for RX descriptors  */
        error = bus_dmamap_create(sc->sc_dmat, ACX_RX_RING_SIZE, 1,
            ACX_RX_RING_SIZE, 0, BUS_DMA_NOWAIT, &rd->rx_ring_dmamap);

        if (error) {
                printf("%s: can't create rx ring dma tag\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        error = bus_dmamem_alloc(sc->sc_dmat, ACX_RX_RING_SIZE, PAGE_SIZE,
            0, &rd->rx_ring_seg, 1, &nsegs, BUS_DMA_NOWAIT);

        if (error != 0) {
                printf("%s: can't allocate rx ring dma memory\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        error = bus_dmamem_map(sc->sc_dmat, &rd->rx_ring_seg, nsegs,
            ACX_RX_RING_SIZE, (caddr_t *)&rd->rx_ring,
            BUS_DMA_NOWAIT);

        if (error != 0) {
                printf("%s: can't map rx desc DMA memory\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        error = bus_dmamap_load(sc->sc_dmat, rd->rx_ring_dmamap,
            rd->rx_ring, ACX_RX_RING_SIZE, NULL, BUS_DMA_WAITOK);

        if (error) {
                printf("%s: can't get rx ring dma address\n",
                    sc->sc_dev.dv_xname);
                bus_dmamem_free(sc->sc_dmat, &rd->rx_ring_seg, 1);
                return (error);
        }

        rd->rx_ring_paddr = rd->rx_ring_dmamap->dm_segs[0].ds_addr;

        /* Allocate DMA stuffs for TX descriptors */
        error = bus_dmamap_create(sc->sc_dmat, ACX_TX_RING_SIZE, 1,
            ACX_TX_RING_SIZE, 0, BUS_DMA_NOWAIT, &rd->tx_ring_dmamap);

        if (error) {
                printf("%s: can't create tx ring dma tag\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        error = bus_dmamem_alloc(sc->sc_dmat, ACX_TX_RING_SIZE, PAGE_SIZE,
            0, &rd->tx_ring_seg, 1, &nsegs, BUS_DMA_NOWAIT);

        if (error) {
                printf("%s: can't allocate tx ring dma memory\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        error = bus_dmamem_map(sc->sc_dmat, &rd->tx_ring_seg, nsegs,
            ACX_TX_RING_SIZE, (caddr_t *)&rd->tx_ring, BUS_DMA_NOWAIT);

        if (error != 0) {
                printf("%s: can't map tx desc DMA memory\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        error = bus_dmamap_load(sc->sc_dmat, rd->tx_ring_dmamap,
            rd->tx_ring, ACX_TX_RING_SIZE, NULL, BUS_DMA_WAITOK);

        if (error) {
                printf("%s: can't get tx ring dma address\n",
                    sc->sc_dev.dv_xname);
                bus_dmamem_free(sc->sc_dmat, &rd->tx_ring_seg, 1);
                return (error);
        }

        rd->tx_ring_paddr = rd->tx_ring_dmamap->dm_segs[0].ds_addr;

        /* Create a spare RX DMA map */
        error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
            0, 0, &bd->mbuf_tmp_dmamap);

        if (error) {
                printf("%s: can't create tmp mbuf dma map\n",
                    sc->sc_dev.dv_xname);
                return (error);
        }

        /* Create DMA map for RX mbufs */
        for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
                error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
                    MCLBYTES, 0, 0, &bd->rx_buf[i].rb_mbuf_dmamap);
                if (error) {
                        printf("%s: can't create rx mbuf dma map (%d)\n",
                            sc->sc_dev.dv_xname, i);
                        return (error);
                }
                bd->rx_buf[i].rb_desc = &rd->rx_ring[i];
        }

        /* Create DMA map for TX mbufs */
        for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
                error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
                    MCLBYTES, 0, 0, &bd->tx_buf[i].tb_mbuf_dmamap);
                if (error) {
                        printf("%s: can't create tx mbuf dma map (%d)\n",
                            sc->sc_dev.dv_xname, i);
                        return (error);
                }
                bd->tx_buf[i].tb_desc1 = &rd->tx_ring[i * 2];
                bd->tx_buf[i].tb_desc2 = &rd->tx_ring[(i * 2) + 1];
        }

        return (0);
}

void
acx_dma_free(struct acx_softc *sc)
{
        struct acx_ring_data *rd = &sc->sc_ring_data;
        struct acx_buf_data *bd = &sc->sc_buf_data;
        int i;

        if (rd->rx_ring != NULL) {
                bus_dmamap_unload(sc->sc_dmat, rd->rx_ring_dmamap);
                bus_dmamem_free(sc->sc_dmat, &rd->rx_ring_seg, 1);
        }

        if (rd->tx_ring != NULL) {
                bus_dmamap_unload(sc->sc_dmat, rd->tx_ring_dmamap);
                bus_dmamem_free(sc->sc_dmat, &rd->tx_ring_seg, 1);
        }

        for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
                if (bd->rx_buf[i].rb_desc != NULL) {
                        if (bd->rx_buf[i].rb_mbuf != NULL) {
                                bus_dmamap_unload(sc->sc_dmat,
                                    bd->rx_buf[i].rb_mbuf_dmamap);
                                m_freem(bd->rx_buf[i].rb_mbuf);
                        }
                        bus_dmamap_destroy(sc->sc_dmat,
                            bd->rx_buf[i].rb_mbuf_dmamap);
                }
        }

        for (i = 0; i < ACX_TX_DESC_CNT; ++i) {
                if (bd->tx_buf[i].tb_desc1 != NULL) {
                        if (bd->tx_buf[i].tb_mbuf != NULL) {
                                bus_dmamap_unload(sc->sc_dmat,
                                    bd->tx_buf[i].tb_mbuf_dmamap);
                                m_freem(bd->tx_buf[i].tb_mbuf);
                        }
                        bus_dmamap_destroy(sc->sc_dmat,
                            bd->tx_buf[i].tb_mbuf_dmamap);
                }
        }

        if (bd->mbuf_tmp_dmamap != NULL)
                bus_dmamap_destroy(sc->sc_dmat, bd->mbuf_tmp_dmamap);
}

void
acx_init_tx_ring(struct acx_softc *sc)
{
        struct acx_ring_data *rd;
        struct acx_buf_data *bd;
        uint32_t paddr;
        int i;

        rd = &sc->sc_ring_data;
        paddr = rd->tx_ring_paddr;
        for (i = 0; i < (ACX_TX_DESC_CNT * 2) - 1; ++i) {
                paddr += sizeof(struct acx_host_desc);

                bzero(&rd->tx_ring[i], sizeof(struct acx_host_desc));
                rd->tx_ring[i].h_ctrl = htole16(DESC_CTRL_HOSTOWN);

                if (i == (ACX_TX_DESC_CNT * 2) - 1)
                        rd->tx_ring[i].h_next_desc = htole32(rd->tx_ring_paddr);
                else
                        rd->tx_ring[i].h_next_desc = htole32(paddr);
        }

        bus_dmamap_sync(sc->sc_dmat, rd->tx_ring_dmamap, 0,
            rd->tx_ring_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);

        bd = &sc->sc_buf_data;
        bd->tx_free_start = 0;
        bd->tx_used_start = 0;
        bd->tx_used_count = 0;
}

int
acx_init_rx_ring(struct acx_softc *sc)
{
        struct acx_ring_data *rd;
        struct acx_buf_data *bd;
        uint32_t paddr;
        int i;

        bd = &sc->sc_buf_data;
        rd = &sc->sc_ring_data;
        paddr = rd->rx_ring_paddr;

        for (i = 0; i < ACX_RX_DESC_CNT; ++i) {
                int error;

                paddr += sizeof(struct acx_host_desc);
                bzero(&rd->rx_ring[i], sizeof(struct acx_host_desc));

                error = acx_newbuf(sc, &bd->rx_buf[i], 1);
                if (error)
                        return (error);

                if (i == ACX_RX_DESC_CNT - 1)
                        rd->rx_ring[i].h_next_desc = htole32(rd->rx_ring_paddr);
                else
                        rd->rx_ring[i].h_next_desc = htole32(paddr);
        }

        bus_dmamap_sync(sc->sc_dmat, rd->rx_ring_dmamap, 0,
            rd->rx_ring_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);

        bd->rx_scan_start = 0;

        return (0);
}

int
acx_newbuf(struct acx_softc *sc, struct acx_rxbuf *rb, int wait)
{
        struct acx_buf_data *bd;
        struct mbuf *m;
        bus_dmamap_t map;
        uint32_t paddr;
        int error;

        bd = &sc->sc_buf_data;

        MGETHDR(m, wait ? M_WAITOK : M_DONTWAIT, MT_DATA);
        if (m == NULL)
                return (ENOBUFS);

        MCLGET(m, wait ? M_WAITOK : M_DONTWAIT);
        if (!(m->m_flags & M_EXT)) {
                m_freem(m);
                return (ENOBUFS);
        }

        m->m_len = m->m_pkthdr.len = MCLBYTES;

        error = bus_dmamap_load_mbuf(sc->sc_dmat, bd->mbuf_tmp_dmamap, m,
            wait ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
        if (error) {
                m_freem(m);
                printf("%s: can't map rx mbuf %d\n",
                    sc->sc_dev.dv_xname, error);
                return (error);
        }

        /* Unload originally mapped mbuf */
        if (rb->rb_mbuf != NULL)
                bus_dmamap_unload(sc->sc_dmat, rb->rb_mbuf_dmamap);

        /* Swap this dmamap with tmp dmamap */
        map = rb->rb_mbuf_dmamap;
        rb->rb_mbuf_dmamap = bd->mbuf_tmp_dmamap;
        bd->mbuf_tmp_dmamap = map;
        paddr = rb->rb_mbuf_dmamap->dm_segs[0].ds_addr;

        rb->rb_mbuf = m;
        rb->rb_desc->h_data_paddr = htole32(paddr);
        rb->rb_desc->h_data_len = htole16(m->m_len);

        bus_dmamap_sync(sc->sc_dmat, rb->rb_mbuf_dmamap, 0,
            rb->rb_mbuf_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);

        return (0);
}

int
acx_encap(struct acx_softc *sc, struct acx_txbuf *txbuf, struct mbuf *m,
    struct ieee80211_node *ni, int rate)
{
        struct acx_ring_data *rd = &sc->sc_ring_data;
        struct acx_node *node = (struct acx_node *)ni;
        struct ifnet *ifp = &sc->sc_ic.ic_if;
        uint32_t paddr;
        uint8_t ctrl;
        int error;

        if (txbuf->tb_mbuf != NULL)
                panic("free TX buf has mbuf installed");

        if (m->m_pkthdr.len > MCLBYTES) {
                printf("%s: mbuf too big\n", ifp->if_xname);
                error = E2BIG;
                goto back;
        } else if (m->m_pkthdr.len < ACX_FRAME_HDRLEN) {
                printf("%s: mbuf too small\n", ifp->if_xname);
                error = EINVAL;
                goto back;
        }

        error = bus_dmamap_load_mbuf(sc->sc_dmat, txbuf->tb_mbuf_dmamap, m,
            BUS_DMA_NOWAIT);

        if (error && error != EFBIG) {
                printf("%s: can't map tx mbuf1 %d\n",
                    sc->sc_dev.dv_xname, error);
                goto back;
        }

        if (error) {    /* error == EFBIG */
                /* too many fragments, linearize */
                if (m_defrag(m, M_DONTWAIT)) {
                        printf("%s: can't defrag tx mbuf\n", ifp->if_xname);
                        goto back;
                }
                error = bus_dmamap_load_mbuf(sc->sc_dmat,
                    txbuf->tb_mbuf_dmamap, m, BUS_DMA_NOWAIT);
                if (error) {
                        printf("%s: can't map tx mbuf2 %d\n",
                            sc->sc_dev.dv_xname, error);
                        goto back;
                }
        }

        error = 0;

        bus_dmamap_sync(sc->sc_dmat, txbuf->tb_mbuf_dmamap, 0,
            txbuf->tb_mbuf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);

        txbuf->tb_mbuf = m;
        txbuf->tb_node = node;
        txbuf->tb_rate = rate;

        /*
         * TX buffers are accessed in following way:
         * acx_fw_txdesc -> acx_host_desc -> buffer
         *
         * It is quite strange that acx also queries acx_host_desc next to
         * the one we have assigned to acx_fw_txdesc even if first one's
         * acx_host_desc.h_data_len == acx_fw_txdesc.f_tx_len
         *
         * So we allocate two acx_host_desc for one acx_fw_txdesc and
         * assign the first acx_host_desc to acx_fw_txdesc
         *
         * For acx111
         * host_desc1.h_data_len = buffer_len
         * host_desc2.h_data_len = buffer_len - mac_header_len
         *
         * For acx100
         * host_desc1.h_data_len = mac_header_len
         * host_desc2.h_data_len = buffer_len - mac_header_len
         */
        paddr = txbuf->tb_mbuf_dmamap->dm_segs[0].ds_addr;
        txbuf->tb_desc1->h_data_paddr = htole32(paddr);
        txbuf->tb_desc2->h_data_paddr = htole32(paddr + ACX_FRAME_HDRLEN);

        txbuf->tb_desc1->h_data_len =
            htole16(sc->chip_txdesc1_len ? sc->chip_txdesc1_len
            : m->m_pkthdr.len);
        txbuf->tb_desc2->h_data_len =
            htole16(m->m_pkthdr.len - ACX_FRAME_HDRLEN);

        /*
         * NOTE:
         * We can't simply assign f_tx_ctrl, we will first read it back
         * and change it bit by bit
         */
        ctrl = FW_TXDESC_GETFIELD_1(sc, txbuf, f_tx_ctrl);
        ctrl |= sc->chip_fw_txdesc_ctrl; /* extra chip specific flags */
        ctrl &= ~(DESC_CTRL_HOSTOWN | DESC_CTRL_ACXDONE);

        FW_TXDESC_SETFIELD_2(sc, txbuf, f_tx_len, m->m_pkthdr.len);
        FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_error, 0);
        FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ack_fail, 0);
        FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_fail, 0);
        FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_rts_ok, 0);
        sc->chip_set_fw_txdesc_rate(sc, txbuf, rate);

        txbuf->tb_desc1->h_ctrl = 0;
        txbuf->tb_desc2->h_ctrl = 0;
        bus_dmamap_sync(sc->sc_dmat, rd->tx_ring_dmamap, 0,
            rd->tx_ring_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);

        FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl2, 0);
        FW_TXDESC_SETFIELD_1(sc, txbuf, f_tx_ctrl, ctrl);

        /* Tell chip to inform us about TX completion */
        CSR_WRITE_2(sc, ACXREG_INTR_TRIG, ACXRV_TRIG_TX_FINI);
back:
        if (error)
                m_freem(m);

        return (error);
}

int
acx_set_null_tmplt(struct acx_softc *sc)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_tmplt_null_data n;
        struct ieee80211_frame *wh;

        bzero(&n, sizeof(n));

        wh = &n.data;
        wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA |
            IEEE80211_FC0_SUBTYPE_NODATA;
        wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
        IEEE80211_ADDR_COPY(wh->i_addr1, etherbroadcastaddr);
        IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
        IEEE80211_ADDR_COPY(wh->i_addr3, etherbroadcastaddr);

        return (acx_set_tmplt(sc, ACXCMD_TMPLT_NULL_DATA, &n, sizeof(n)));
}

int
acx_set_probe_req_tmplt(struct acx_softc *sc, const char *ssid, int ssid_len)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_tmplt_probe_req req;
        struct ieee80211_frame *wh;
        struct ieee80211_rateset *rs;
        uint8_t *frm;
        int len;

        bzero(&req, sizeof(req));

        wh = &req.data.u_data.f;
        wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
            IEEE80211_FC0_SUBTYPE_PROBE_REQ;
        wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
        IEEE80211_ADDR_COPY(wh->i_addr1, etherbroadcastaddr);
        IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
        IEEE80211_ADDR_COPY(wh->i_addr3, etherbroadcastaddr);

        frm = req.data.u_data.var;
        frm = ieee80211_add_ssid(frm, ssid, ssid_len);
        rs = &ic->ic_sup_rates[sc->chip_phymode];
        frm = ieee80211_add_rates(frm, rs);
        if (rs->rs_nrates > IEEE80211_RATE_SIZE)
                frm = ieee80211_add_xrates(frm, rs);
        len = frm - req.data.u_data.var;

        return (acx_set_tmplt(sc, ACXCMD_TMPLT_PROBE_REQ, &req,
            ACX_TMPLT_PROBE_REQ_SIZ(len)));
}

#ifndef IEEE80211_STA_ONLY
struct mbuf *ieee80211_get_probe_resp(struct ieee80211com *,
    struct ieee80211_node *);

int
acx_set_probe_resp_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_tmplt_probe_resp resp;
        struct ieee80211_frame *wh;
        struct mbuf *m;
        int len;

        bzero(&resp, sizeof(resp));

        m = ieee80211_get_probe_resp(ic, ni);
        if (m == NULL)
                return (1);
        M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
        if (m == NULL)
                return (1);
        wh = mtod(m, struct ieee80211_frame *);
        wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
            IEEE80211_FC0_SUBTYPE_PROBE_RESP;
        wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
        *(u_int16_t *)&wh->i_dur[0] = 0;
        IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
        IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
        IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
        *(u_int16_t *)wh->i_seq = 0;

        m_copydata(m, 0, m->m_pkthdr.len, &resp.data);
        len = m->m_pkthdr.len + sizeof(resp.size);
        m_freem(m); 

        return (acx_set_tmplt(sc, ACXCMD_TMPLT_PROBE_RESP, &resp, len));
}

int
acx_beacon_locate(struct mbuf *m, u_int8_t type)
{
        int off;
        u_int8_t *frm;
        /*
         * beacon frame format
         *      [8] time stamp
         *      [2] beacon interval
         *      [2] capability information
         *      from here on [tlv] values
         */

        if (m->m_len != m->m_pkthdr.len)
                panic("beacon not in contiguous mbuf");

        off = sizeof(struct ieee80211_frame) + 8 + 2 + 2;
        frm = mtod(m, u_int8_t *);
        for (; off + 1 < m->m_len; off += frm[off + 1] + 2) {
                if (frm[off] == type)
                        return (off);
        }
        return (-1);
}

int
acx_set_beacon_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct acx_tmplt_beacon beacon;
        struct acx_tmplt_tim tim;
        struct mbuf *m;
        int len, off;

        bzero(&beacon, sizeof(beacon));
        bzero(&tim, sizeof(tim));

        m = ieee80211_beacon_alloc(ic, ni);
        if (m == NULL)
                return (1);

        off = acx_beacon_locate(m, IEEE80211_ELEMID_TIM);
        if (off < 0) {
                m_free(m);
                return (1);
        }

        m_copydata(m, 0, off, &beacon.data);
        len = off + sizeof(beacon.size);

        if (acx_set_tmplt(sc, ACXCMD_TMPLT_BEACON, &beacon, len) != 0) {
                m_freem(m);
                return (1);
        }

        len = m->m_pkthdr.len - off;
        if (len == 0) {
                /* no TIM field */
                m_freem(m);
                return (0);
        }

        m_copydata(m, off, len, &tim.data);
        len += sizeof(beacon.size);
        m_freem(m);

        return (acx_set_tmplt(sc, ACXCMD_TMPLT_TIM, &tim, len));
}
#endif  /* IEEE80211_STA_ONLY */

void
acx_init_cmd_reg(struct acx_softc *sc)
{
        sc->sc_cmd = CSR_READ_4(sc, ACXREG_CMD_REG_OFFSET);
        sc->sc_cmd_param = sc->sc_cmd + ACX_CMD_REG_SIZE;

        /* Clear command & status */
        CMD_WRITE_4(sc, 0);
}

int
acx_join_bss(struct acx_softc *sc, uint8_t mode, struct ieee80211_node *node)
{
        uint8_t bj_buf[BSS_JOIN_BUFLEN];
        struct bss_join_hdr *bj;
        int i, dtim_intvl;

        bzero(bj_buf, sizeof(bj_buf));
        bj = (struct bss_join_hdr *)bj_buf;

        for (i = 0; i < IEEE80211_ADDR_LEN; ++i)
                bj->bssid[i] = node->ni_bssid[IEEE80211_ADDR_LEN - i - 1];

        bj->beacon_intvl = htole16(acx_beacon_intvl);

        /* TODO tunable */
#ifndef IEEE80211_STA_ONLY
        if (sc->sc_ic.ic_opmode == IEEE80211_M_IBSS)
                dtim_intvl = 1;
        else
#endif
                dtim_intvl = 10;
        sc->chip_set_bss_join_param(sc, bj->chip_spec, dtim_intvl);

        bj->ndata_txrate = ACX_NDATA_TXRATE_1;
        bj->ndata_txopt = 0;
        bj->mode = mode;
        bj->channel = ieee80211_chan2ieee(&sc->sc_ic, node->ni_chan);
        bj->esslen = node->ni_esslen;
        bcopy(node->ni_essid, bj->essid, node->ni_esslen);

        DPRINTF(("%s: join BSS/IBSS on channel %d\n", sc->sc_dev.dv_xname,
            bj->channel));
        return (acx_exec_command(sc, ACXCMD_JOIN_BSS,
            bj, BSS_JOIN_PARAM_SIZE(bj), NULL, 0));
}

int
acx_set_channel(struct acx_softc *sc, uint8_t chan)
{
        if (acx_exec_command(sc, ACXCMD_ENABLE_TXCHAN, &chan, sizeof(chan),
            NULL, 0) != 0) {
                DPRINTF(("%s: setting TX channel %d failed\n",
                    sc->sc_dev.dv_xname, chan));
                return (ENXIO);
        }

        if (acx_exec_command(sc, ACXCMD_ENABLE_RXCHAN, &chan, sizeof(chan),
            NULL, 0) != 0) {
                DPRINTF(("%s: setting RX channel %d failed\n",
                    sc->sc_dev.dv_xname, chan));
                return (ENXIO);
        }

        return (0);
}

int
acx_get_conf(struct acx_softc *sc, uint16_t conf_id, void *conf,
    uint16_t conf_len)
{
        struct acx_conf *confcom;

        if (conf_len < sizeof(*confcom)) {
                printf("%s: %s configure data is too short\n",
                    sc->sc_dev.dv_xname, __func__);
                return (1);
        }

        confcom = conf;
        confcom->conf_id = htole16(conf_id);
        confcom->conf_data_len = htole16(conf_len - sizeof(*confcom));

        return (acx_exec_command(sc, ACXCMD_GET_CONF, confcom, sizeof(*confcom),
            conf, conf_len));
}

int
acx_set_conf(struct acx_softc *sc, uint16_t conf_id, void *conf,
    uint16_t conf_len)
{
        struct acx_conf *confcom;

        if (conf_len < sizeof(*confcom)) {
                printf("%s: %s configure data is too short\n",
                    sc->sc_dev.dv_xname, __func__);
                return (1);
        }

        confcom = conf;
        confcom->conf_id = htole16(conf_id);
        confcom->conf_data_len = htole16(conf_len - sizeof(*confcom));

        return (acx_exec_command(sc, ACXCMD_SET_CONF, conf, conf_len, NULL, 0));
}

int
acx_set_tmplt(struct acx_softc *sc, uint16_t cmd, void *tmplt,
    uint16_t tmplt_len)
{
        uint16_t *size;

        if (tmplt_len < sizeof(*size)) {
                printf("%s: %s template is too short\n",
                    sc->sc_dev.dv_xname, __func__);
                return (1);
        }

        size = tmplt;
        *size = htole16(tmplt_len - sizeof(*size));

        return (acx_exec_command(sc, cmd, tmplt, tmplt_len, NULL, 0));
}

int
acx_init_radio(struct acx_softc *sc, uint32_t radio_ofs, uint32_t radio_len)
{
        struct radio_init r;

        r.radio_ofs = htole32(radio_ofs);
        r.radio_len = htole32(radio_len);

        return (acx_exec_command(sc, ACXCMD_INIT_RADIO, &r, sizeof(r), NULL,
            0));
}

int
acx_exec_command(struct acx_softc *sc, uint16_t cmd, void *param,
    uint16_t param_len, void *result, uint16_t result_len)
{
        uint16_t status;
        int i, ret;

        if ((sc->sc_flags & ACX_FLAG_FW_LOADED) == 0) {
                printf("%s: cmd 0x%04x failed (base firmware not loaded)\n",
                    sc->sc_dev.dv_xname, cmd);
                return (1);
        }

        ret = 0;

        if (param != NULL && param_len != 0) {
                /* Set command param */
                CMDPRM_WRITE_REGION_1(sc, param, param_len);
        }

        /* Set command */
        CMD_WRITE_4(sc, cmd);

        /* Exec command */
        CSR_WRITE_2(sc, ACXREG_INTR_TRIG, ACXRV_TRIG_CMD_FINI);
        DELAY(50);

        /* Wait for command to complete */
        if (cmd == ACXCMD_INIT_RADIO) {
                /* radio initialization is extremely long */
                tsleep_nsec(&cmd, 0, "rdinit", MSEC_TO_NSEC(300));
        }

#define CMDWAIT_RETRY_MAX       1000
        for (i = 0; i < CMDWAIT_RETRY_MAX; ++i) {
                uint16_t reg;

                reg = CSR_READ_2(sc, ACXREG_INTR_STATUS);
                if (reg & ACXRV_INTR_CMD_FINI) {
                        CSR_WRITE_2(sc, ACXREG_INTR_ACK, ACXRV_INTR_CMD_FINI);
                        break;
                }
                DELAY(50);
        }
        if (i == CMDWAIT_RETRY_MAX) {
                printf("%s: cmd %04x failed (timeout)\n",
                    sc->sc_dev.dv_xname, cmd);
                ret = 1;
                goto back;
        }
#undef CMDWAIT_RETRY_MAX

        /* Get command exec status */
        status = (CMD_READ_4(sc) >> ACX_CMD_STATUS_SHIFT);
        if (status != ACX_CMD_STATUS_OK) {
                DPRINTF(("%s: cmd %04x failed\n", sc->sc_dev.dv_xname, cmd));
                ret = 1;
                goto back;
        }

        if (result != NULL && result_len != 0) {
                /* Get command result */
                CMDPRM_READ_REGION_1(sc, result, result_len);
        }

back:
        CMD_WRITE_4(sc, 0);

        return (ret);
}

const char *
acx_get_rf(int rev)
{
        switch (rev) {
        case ACX_RADIO_TYPE_MAXIM:      return "MAX2820";
        case ACX_RADIO_TYPE_RFMD:       return "RFMD";
        case ACX_RADIO_TYPE_RALINK:     return "Ralink";
        case ACX_RADIO_TYPE_RADIA:      return "Radia";
        default:                        return "unknown";
        }
}

int
acx_get_maxrssi(int radio)
{
        switch (radio) {
        case ACX_RADIO_TYPE_MAXIM:      return ACX_RADIO_RSSI_MAXIM;
        case ACX_RADIO_TYPE_RFMD:       return ACX_RADIO_RSSI_RFMD;
        case ACX_RADIO_TYPE_RALINK:     return ACX_RADIO_RSSI_RALINK;
        case ACX_RADIO_TYPE_RADIA:      return ACX_RADIO_RSSI_RADIA;
        default:                        return ACX_RADIO_RSSI_UNKN;
        }
}

void
acx_iter_func(void *arg, struct ieee80211_node *ni)
{
        struct acx_softc *sc = arg;
        struct acx_node *wn = (struct acx_node *)ni;

        ieee80211_amrr_choose(&sc->amrr, ni, &wn->amn);
}

void
acx_amrr_timeout(void *arg)
{
        struct acx_softc *sc = arg;
        struct ieee80211com *ic = &sc->sc_ic;

        if (ic->ic_opmode == IEEE80211_M_STA)
                acx_iter_func(sc, ic->ic_bss);
        else
                ieee80211_iterate_nodes(ic, acx_iter_func, sc);

        timeout_add_msec(&sc->amrr_ch, 500);
}

void
acx_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
{
        struct acx_softc *sc = ic->ic_if.if_softc;
        int i;

        ieee80211_amrr_node_init(&sc->amrr, &((struct acx_node *)ni)->amn);

        /* set rate to some reasonable initial value */
        for (i = ni->ni_rates.rs_nrates - 1;
            i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
            i--);
        ni->ni_txrate = i;
}

#ifndef IEEE80211_STA_ONLY
void
acx_set_tim(struct ieee80211com *ic, int aid, int set)
{
        struct acx_softc *sc = ic->ic_if.if_softc;
        struct acx_tmplt_tim tim;
        u_int8_t *ep;

        ieee80211_set_tim(ic, aid, set);

        bzero(&tim, sizeof(tim));
        ep = ieee80211_add_tim(tim.data.u_mem, ic);

        acx_set_tmplt(sc, ACXCMD_TMPLT_TIM, &tim, ep - (u_int8_t *)&tim);
}
#endif