When you call MiniportInitialize() for an 802.11 driver, it will

at some point result in a status event being triggered (it should
be a link down event: the Microsoft driver design guide says you
should generate one when the NIC is initialized). Some drivers
generate the event during MiniportInitialize(), such that by the
time MiniportInitialize() completes, the NIC is ready to go. But
some drivers, in particular the ones for Atheros wireless NICs,
don't generate the event until after a device interrupt occurs
at some point after MiniportInitialize() has completed.

The gotcha is that you have to wait until the link status event
occurs one way or the other before you try to fiddle with any
settings (ssid, channel, etc...). For the drivers that set the
event sycnhronously this isn't a problem, but for the others
we have to pause after calling ndis_init_nic() and wait for the event
to arrive before continuing. Failing to wait can cause big trouble:
on my SMP system, calling ndis_setstate_80211() after ndis_init_nic()
completes, but _before_ the link event arrives, will lock up or
reset the system.

What we do now is check to see if a link event arrived while
ndis_init_nic() was running, and if it didn't we msleep() until
it does.

Along the way, I discovered a few other problems:

- Defered procedure calls run at PASSIVE_LEVEL, not DISPATCH_LEVEL.
  ntoskrnl_run_dpc() has been fixed accordingly. (I read the documentation
  wrong.)

- Similarly, the NDIS interrupt handler, which is essentially a
  DPC, also doesn't need to run at DISPATCH_LEVEL. ndis_intrtask()
  has been fixed accordingly.

- MiniportQueryInformation() and MiniportSetInformation() run at
  DISPATCH_LEVEL, and each request must complete before another
  can be submitted. ndis_get_info() and ndis_set_info() have been
  fixed accordingly.

- Turned the sleep lock that guards the NDIS thread job list into
  a spin lock. We never do anything with this lock held except manage
  the job list (no other locks are held), so it's safe to do this,
  and it's possible that ndis_sched() and ndis_unsched() can be
  called from DISPATCH_LEVEL, so using a sleep lock here is
  semantically incorrect. Also updated subr_witness.c to add the
  lock to the order list.

1 files changed, 38 insertions, 4 deletions

diff --git a/sys/dev/if_ndis/if_ndis.c b/sys/dev/if_ndis/if_ndis.c
index e59b8b6..fbf9170 100644
--- a/sys/dev/if_ndis/if_ndis.c
+++ b/sys/dev/if_ndis/if_ndis.c
@@ -44,6 +44,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/socket.h>
 #include <sys/queue.h>
 #include <sys/module.h>
+#include <sys/proc.h>
 #if __FreeBSD_version < 502113
 #include <sys/sysctl.h>
 #endif
@@ -1080,9 +1081,14 @@ ndis_linksts(adapter, status, sbuf, slen)
 	uint32_t		slen;
 {
 	ndis_miniport_block	*block;
+	struct ndis_softc	*sc;
 
 	block = adapter;
+	sc = device_get_softc(block->nmb_physdeviceobj->do_devext);
+
+	NDIS_LOCK(sc);
 	block->nmb_getstat = status;
+	NDIS_UNLOCK(sc);
 
 	return;
 }
@@ -1113,6 +1119,10 @@ ndis_linksts_done(adapter)
 	case NDIS_STATUS_MEDIA_DISCONNECT:
 		if (sc->ndis_link)
 			ndis_sched(ndis_ticktask, sc, NDIS_TASKQUEUE);
+		else {
+			if (sc->ndis_80211)
+				wakeup(&block->nmb_getstat);
+		}
 		break;
 	default:
 		break;
@@ -1128,14 +1138,11 @@ ndis_intrtask(arg)
 {
 	struct ndis_softc	*sc;
 	struct ifnet		*ifp;
-	uint8_t			irql;
 
 	sc = arg;
 	ifp = &sc->arpcom.ac_if;
 
-	irql = KeRaiseIrql(DISPATCH_LEVEL);
 	ndis_intrhand(sc);
-	KeLowerIrql(irql);
 
 	ndis_enable_intr(sc);
 
@@ -1170,7 +1177,7 @@ ndis_intr(arg)
 	KeReleaseSpinLock(&intr->ni_dpccountlock, irql);
 
 	if ((is_our_intr || call_isr))
-		ndis_sched(ndis_intrtask, ifp->if_softc, NDIS_SWI);
+		ndis_sched(ndis_intrtask, sc, NDIS_SWI);
 
 	return;
 }
@@ -1459,9 +1466,36 @@ ndis_init(xsc)
 	 * Cancel pending I/O and free all RX/TX buffers.
 	 */
 	ndis_stop(sc);
+
+	NDIS_LOCK(sc);
+	sc->ndis_block->nmb_getstat = 0;
 	if (ndis_init_nic(sc))
 		return;
 
+	/*
+	 * 802.11 NDIS drivers are supposed to generate a link
+	 * down event right when you initialize them. You wait
+	 * until this event occurs before trying to futz with
+	 * the device. Some drivers will actually set the event
+	 * during the course of MiniportInitialize(), which means
+	 * by the time it completes, the device is ready for us
+	 * to interact with it. But some drivers don't signal the
+	 * event until after MiniportInitialize() (they probably
+	 * need to wait for a device interrupt to occur first).
+	 * We have to be careful to handle both cases. After we
+	 * call ndis_init_nic(), we have to see if a status event
+	 * was triggered. If it wasn't, we have to wait for it
+	 * to occur before we can proceed.
+	 */
+	if (sc->ndis_80211 & !sc->ndis_block->nmb_getstat) {
+		error = msleep(&sc->ndis_block->nmb_getstat,
+		    &sc->ndis_mtx, curthread->td_priority,
+		    "ndiswait", 5 * hz);
+	}
+
+	sc->ndis_block->nmb_getstat = 0;
+	NDIS_UNLOCK(sc);
+
 	/* Init our MAC address */
 
 	/* Program the packet filter */