sys/dev/netif/ipw/if_ipw.c

   1 /*-
   2  * Copyright (c) 2004, 2005
   3  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice unmodified, this list of conditions, and the following
  10  *    disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  *
  27  *
  28  * $Id: if_ipw.c,v 1.7.2.1 2005/01/13 20:01:03 damien Exp $
  29  * $DragonFly: src/sys/dev/netif/ipw/Attic/if_ipw.c,v 1.5 2005/03/09 20:07:45 joerg Exp $
  30  */
  31
  32 /*-
  33  * Intel(R) PRO/Wireless 2100 MiniPCI driver
  34  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
  35  */
  36
  37 #include <sys/param.h>
  38 #include <sys/sysctl.h>
  39 #include <sys/sockio.h>
  40 #include <sys/mbuf.h>
  41 #include <sys/kernel.h>
  42 #include <sys/socket.h>
  43 #include <sys/systm.h>
  44 #include <sys/malloc.h>
  45 #include <sys/module.h>
  46 #include <sys/bus.h>
  47 #include <sys/endian.h>
  48 #include <sys/proc.h>
  49 #include <sys/ucred.h>
  50
  51 #include <machine/bus.h>
  52 #include <machine/resource.h>
  53 #include <machine/clock.h>
  54 #include <sys/rman.h>
  55
  56 #include <bus/pci/pcireg.h>
  57 #include <bus/pci/pcivar.h>
  58
  59 #include <net/bpf.h>
  60 #include <net/if.h>
  61 #include <net/if_arp.h>
  62 #include <net/ethernet.h>
  63 #include <net/if_dl.h>
  64 #include <net/if_media.h>
  65 #include <net/if_types.h>
  66 #include <net/ifq_var.h>
  67
  68 #include <netinet/in.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/in_var.h>
  71 #include <netinet/ip.h>
  72 #include <netinet/if_ether.h>
  73
  74 #include <netproto/802_11/ieee80211_var.h>
  75 #include <netproto/802_11/ieee80211_ioctl.h>
  76 #include <netproto/802_11/ieee80211_radiotap.h>
  77 #include <netproto/802_11/if_wavelan_ieee.h>
  78
  79 #include "if_ipwreg.h"
  80 #include "if_ipwvar.h"
  81
  82 #ifdef IPW_DEBUG
  83 #define DPRINTF(x)      if (ipw_debug > 0) printf x
  84 #define DPRINTFN(n, x)  if (ipw_debug >= (n)) printf x
  85 int ipw_debug = 0;
  86 SYSCTL_INT(_debug, OID_AUTO, ipw, CTLFLAG_RW, &ipw_debug, 0, "ipw debug level");
  87 #else
  88 #define DPRINTF(x)
  89 #define DPRINTFN(n, x)
  90 #endif
  91
  92 MODULE_DEPEND(ipw, pci,  1, 1, 1);
  93 MODULE_DEPEND(ipw, wlan, 1, 1, 1);
  94
  95 struct ipw_ident {
  96         u_int16_t       vendor;
  97         u_int16_t       device;
  98         const char      *name;
  99 };
 100
 101 static const struct ipw_ident ipw_ident_table[] = {
 102         { 0x8086, 0x1043, "Intel(R) PRO/Wireless 2100 MiniPCI" },
 103
 104         { 0, 0, NULL }
 105 };
 106
 107 static const struct ieee80211_rateset ipw_rateset_11b =
 108         { 4, { 2, 4, 11, 22 } };
 109
 110 static int              ipw_dma_alloc(struct ipw_softc *);
 111 static void             ipw_release(struct ipw_softc *);
 112 static int              ipw_media_change(struct ifnet *);
 113 static void             ipw_media_status(struct ifnet *, struct ifmediareq *);
 114 static int              ipw_newstate(struct ieee80211com *,
 115                             enum ieee80211_state, int);
 116 static u_int16_t        ipw_read_prom_word(struct ipw_softc *, u_int8_t);
 117 static void             ipw_command_intr(struct ipw_softc *,
 118                             struct ipw_soft_buf *);
 119 static void             ipw_newstate_intr(struct ipw_softc *,
 120                             struct ipw_soft_buf *);
 121 static void             ipw_data_intr(struct ipw_softc *, struct ipw_status *,
 122                             struct ipw_soft_bd *, struct ipw_soft_buf *);
 123 static void             ipw_notification_intr(struct ipw_softc *,
 124                             struct ipw_soft_buf *);
 125 static void             ipw_rx_intr(struct ipw_softc *);
 126 static void             ipw_release_sbd(struct ipw_softc *,
 127                             struct ipw_soft_bd *);
 128 static void             ipw_tx_intr(struct ipw_softc *);
 129 static void             ipw_intr(void *);
 130 static void             ipw_dma_map_txbuf(void *, bus_dma_segment_t *, int,
 131                             bus_size_t, int);
 132 static void             ipw_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 133 static int              ipw_cmd(struct ipw_softc *, u_int32_t, void *,
 134                             u_int32_t);
 135 static int              ipw_tx_start(struct ifnet *, struct mbuf *,
 136                             struct ieee80211_node *);
 137 static void             ipw_start(struct ifnet *);
 138 static void             ipw_watchdog(struct ifnet *);
 139 static int              ipw_ioctl(struct ifnet *, u_long, caddr_t,
 140                                 struct ucred *cr);
 141 static void             ipw_stop_master(struct ipw_softc *);
 142 static int              ipw_reset(struct ipw_softc *);
 143 static int              ipw_load_ucode(struct ipw_softc *, u_char *, int);
 144 static int              ipw_load_firmware(struct ipw_softc *, u_char *, int);
 145 static int              ipw_cache_firmware(struct ipw_softc *, void *);
 146 static void             ipw_free_firmware(struct ipw_softc *);
 147 static int              ipw_config(struct ipw_softc *);
 148 static void             ipw_init(void *);
 149 static void             ipw_stop(void *);
 150 static int              ipw_sysctl_stats(SYSCTL_HANDLER_ARGS);
 151 static int              ipw_sysctl_radio(SYSCTL_HANDLER_ARGS);
 152 static u_int32_t        ipw_read_table1(struct ipw_softc *, u_int32_t);
 153 static void             ipw_write_table1(struct ipw_softc *, u_int32_t,
 154                             u_int32_t);
 155 static int              ipw_read_table2(struct ipw_softc *, u_int32_t, void *,
 156                             u_int32_t *);
 157 static void             ipw_read_mem_1(struct ipw_softc *, bus_size_t,
 158                             u_int8_t *, bus_size_t);
 159 static void             ipw_write_mem_1(struct ipw_softc *, bus_size_t,
 160                             u_int8_t *, bus_size_t);
 161
 162 static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
 163 {
 164         CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
 165         return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
 166 }
 167
 168 static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
 169 {
 170         CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
 171         return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
 172 }
 173
 174 static int ipw_probe(device_t);
 175 static int ipw_attach(device_t);
 176 static int ipw_detach(device_t);
 177 static int ipw_shutdown(device_t);
 178 static int ipw_suspend(device_t);
 179 static int ipw_resume(device_t);
 180
 181 static device_method_t ipw_methods[] = {
 182         /* Device interface */
 183         DEVMETHOD(device_probe,         ipw_probe),
 184         DEVMETHOD(device_attach,        ipw_attach),
 185         DEVMETHOD(device_detach,        ipw_detach),
 186         DEVMETHOD(device_shutdown,      ipw_shutdown),
 187         DEVMETHOD(device_suspend,       ipw_suspend),
 188         DEVMETHOD(device_resume,        ipw_resume),
 189
 190         { 0, 0 }
 191 };
 192
 193 static DEFINE_CLASS_0(ipw, ipw_driver, ipw_methods, sizeof(struct ipw_softc));
 194 static devclass_t ipw_devclass;
 195
 196 DRIVER_MODULE(ipw, pci, ipw_driver, ipw_devclass, 0, 0);
 197
 198 static int
 199 ipw_probe(device_t dev)
 200 {
 201         const struct ipw_ident *ident;
 202
 203         for (ident = ipw_ident_table; ident->name != NULL; ident++) {
 204                 if (pci_get_vendor(dev) == ident->vendor &&
 205                     pci_get_device(dev) == ident->device) {
 206                         device_set_desc(dev, ident->name);
 207                         return 0;
 208                 }
 209         }
 210         return ENXIO;
 211 }
 212
 213 /* Base Address Register */
 214 #define IPW_PCI_BAR0    0x10
 215
 216 static int
 217 ipw_attach(device_t dev)
 218 {
 219         struct ipw_softc *sc = device_get_softc(dev);
 220         struct ieee80211com *ic = &sc->sc_ic;
 221         struct ifnet *ifp = &ic->ic_if;
 222         struct sysctl_oid *sysctl_tree;
 223         u_int16_t val;
 224         int error, rid, i;
 225
 226         sc->sc_dev = dev;
 227
 228         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 229                 device_printf(dev, "chip is in D%d power mode "
 230                     "-- setting to D0\n", pci_get_powerstate(dev));
 231                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 232         }
 233
 234         pci_write_config(dev, 0x41, 0, 1);
 235
 236         /* enable bus-mastering */
 237         pci_enable_busmaster(dev);
 238
 239         /* map the register window */
 240         rid = IPW_PCI_BAR0;
 241         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid, RF_ACTIVE);
 242         if (sc->mem == NULL) {
 243                 device_printf(dev, "could not allocate memory resource\n");
 244                 goto fail;
 245         }
 246
 247         sc->sc_st = rman_get_bustag(sc->mem);
 248         sc->sc_sh = rman_get_bushandle(sc->mem);
 249
 250         rid = 0;
 251         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
 252             RF_SHAREABLE);
 253         if (sc->irq == NULL) {
 254                 device_printf(dev, "could not allocate interrupt resource\n");
 255                 goto fail;
 256         }
 257
 258         if (ipw_reset(sc) != 0) {
 259                 device_printf(dev, "could not reset adapter\n");
 260                 goto fail;
 261         }
 262
 263         sysctl_ctx_init(&sc->sysctl_ctx);
 264         sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
 265                 SYSCTL_STATIC_CHILDREN(_hw),
 266                 OID_AUTO,
 267                 device_get_nameunit(dev),
 268                 CTLFLAG_RD,
 269                 0, "");
 270
 271         if (ipw_dma_alloc(sc) != 0) {
 272                 device_printf(dev, "could not allocate DMA resources\n");
 273                 goto fail;
 274         }
 275
 276         ic->ic_phytype = IEEE80211_T_DS;
 277         ic->ic_opmode = IEEE80211_M_STA;
 278         ic->ic_state = IEEE80211_S_INIT;
 279
 280         /* set device capabilities */
 281        ic->ic_caps = IEEE80211_C_SHPREAMBLE | IEEE80211_C_TXPMGT |
 282            IEEE80211_C_PMGT | IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
 283            IEEE80211_C_WEP;
 284
 285         /* read MAC address from EEPROM */
 286         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
 287         ic->ic_myaddr[0] = val >> 8;
 288         ic->ic_myaddr[1] = val & 0xff;
 289         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
 290         ic->ic_myaddr[2] = val >> 8;
 291         ic->ic_myaddr[3] = val & 0xff;
 292         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
 293         ic->ic_myaddr[4] = val >> 8;
 294         ic->ic_myaddr[5] = val & 0xff;
 295
 296         /* set supported .11b rates */
 297         ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
 298
 299         /* set supported .11b channels (read from EEPROM) */
 300         if ((val = ipw_read_prom_word(sc, IPW_EEPROM_CHANNEL_LIST)) == 0)
 301                 val = 0x7ff; /* default to channels 1-11 */
 302         val <<= 1;
 303         for (i = 1; i < 16; i++) {
 304                 if (val & (1 << i)) {
 305                         ic->ic_channels[i].ic_freq =
 306                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
 307                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
 308                 }
 309         }
 310
 311         /* check support for radio transmitter switch in EEPROM */
 312         if (!(ipw_read_prom_word(sc, IPW_EEPROM_RADIO) & 8))
 313                 sc->flags |= IPW_FLAG_HAS_RADIO_SWITCH;
 314
 315         /* default to authmode OPEN */
 316         sc->authmode = IEEE80211_AUTH_OPEN;
 317
 318         /* IBSS channel undefined for now */
 319         ic->ic_ibss_chan = &ic->ic_channels[0];
 320
 321         ifp->if_softc = sc;
 322         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 323         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 324         ifp->if_init = ipw_init;
 325         ifp->if_ioctl = ipw_ioctl;
 326         ifp->if_start = ipw_start;
 327         ifp->if_watchdog = ipw_watchdog;
 328         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 329         ifq_set_ready(&ifp->if_snd);
 330
 331         ieee80211_ifattach(ifp);
 332         /* override state transition machine */
 333         sc->sc_newstate = ic->ic_newstate;
 334         ic->ic_newstate = ipw_newstate;
 335         ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
 336
 337         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 338             sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
 339
 340         sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
 341         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
 342         sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
 343
 344         sc->sc_txtap_len = sizeof sc->sc_txtapu;
 345         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
 346         sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
 347
 348         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 349             SYSCTL_CHILDREN(sysctl_tree), OID_AUTO, "radio",
 350             CTLTYPE_INT | CTLFLAG_RD, sc, 0, ipw_sysctl_radio, "I",
 351             "Radio transmitter switch");
 352
 353         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 354             SYSCTL_CHILDREN(sysctl_tree), OID_AUTO, "stats",
 355             CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, ipw_sysctl_stats, "S",
 356             "Statistics");
 357
 358         /*
 359          * Hook our interrupt after all initialization is complete
 360          */
 361         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
 362             ipw_intr, sc, &sc->sc_ih);
 363         if (error != 0) {
 364                 device_printf(dev, "could not set up interrupt\n");
 365                 goto fail;
 366         }
 367
 368         return 0;
 369
 370 fail:   ipw_detach(dev);
 371         return ENXIO;
 372 }
 373
 374 static int
 375 ipw_detach(device_t dev)
 376 {
 377         struct ipw_softc *sc = device_get_softc(dev);
 378         struct ifnet *ifp = &sc->sc_ic.ic_if;
 379         IPW_LOCK_DECL();
 380
 381         IPW_LOCK(sc);
 382
 383         ipw_stop(sc);
 384         ipw_free_firmware(sc);
 385
 386         IPW_UNLOCK(sc);
 387
 388         bpfdetach(ifp);
 389
 390         ieee80211_ifdetach(ifp);
 391
 392         ipw_release(sc);
 393
 394         if (sc->irq != NULL) {
 395                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
 396                 bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq);
 397         }
 398
 399         if (sc->mem != NULL)
 400                 bus_release_resource(dev, SYS_RES_MEMORY, IPW_PCI_BAR0,
 401                     sc->mem);
 402
 403         sysctl_ctx_free(&sc->sysctl_ctx);
 404
 405         return 0;
 406 }
 407
 408 static int
 409 ipw_dma_alloc(struct ipw_softc *sc)
 410 {
 411         struct ipw_soft_bd *sbd;
 412         struct ipw_soft_hdr *shdr;
 413         struct ipw_soft_buf *sbuf;
 414         bus_addr_t physaddr;
 415         int error, i;
 416
 417         /*
 418          * Allocate and map tx ring
 419          */
 420         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 421             BUS_SPACE_MAXADDR, NULL, NULL, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
 422             &sc->tbd_dmat);
 423         if (error != 0) {
 424                 device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
 425                 goto fail;
 426         }
 427
 428         error = bus_dmamem_alloc(sc->tbd_dmat, (void **)&sc->tbd_list,
 429             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->tbd_map);
 430         if (error != 0) {
 431                 device_printf(sc->sc_dev,
 432                     "could not allocate tx ring DMA memory\n");
 433                 goto fail;
 434         }
 435
 436         error = bus_dmamap_load(sc->tbd_dmat, sc->tbd_map, sc->tbd_list,
 437             IPW_TBD_SZ, ipw_dma_map_addr, &sc->tbd_phys, 0);
 438         if (error != 0) {
 439                 device_printf(sc->sc_dev, "could not map tx ring DMA memory\n");
 440                 goto fail;
 441         }
 442
 443         /*
 444          * Allocate and map rx ring
 445          */
 446         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 447             BUS_SPACE_MAXADDR, NULL, NULL, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
 448             &sc->rbd_dmat);
 449         if (error != 0) {
 450                 device_printf(sc->sc_dev, "could not create rx ring DMA tag\n");
 451                 goto fail;
 452         }
 453
 454         error = bus_dmamem_alloc(sc->rbd_dmat, (void **)&sc->rbd_list,
 455             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->rbd_map);
 456         if (error != 0) {
 457                 device_printf(sc->sc_dev,
 458                     "could not allocate rx ring DMA memory\n");
 459                 goto fail;
 460         }
 461
 462         error = bus_dmamap_load(sc->rbd_dmat, sc->rbd_map, sc->rbd_list,
 463             IPW_RBD_SZ, ipw_dma_map_addr, &sc->rbd_phys, 0);
 464         if (error != 0) {
 465                 device_printf(sc->sc_dev, "could not map rx ring DMA memory\n");
 466                 goto fail;
 467         }
 468
 469         /*
 470          * Allocate and map status ring
 471          */
 472         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 473             BUS_SPACE_MAXADDR, NULL, NULL, IPW_STATUS_SZ, 1, IPW_STATUS_SZ, 0,
 474             &sc->status_dmat);
 475         if (error != 0) {
 476                 device_printf(sc->sc_dev,
 477                     "could not create status ring DMA tag\n");
 478                 goto fail;
 479         }
 480
 481         error = bus_dmamem_alloc(sc->status_dmat, (void **)&sc->status_list,
 482             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->status_map);
 483         if (error != 0) {
 484                 device_printf(sc->sc_dev,
 485                     "could not allocate status ring DMA memory\n");
 486                 goto fail;
 487         }
 488
 489         error = bus_dmamap_load(sc->status_dmat, sc->status_map,
 490             sc->status_list, IPW_STATUS_SZ, ipw_dma_map_addr, &sc->status_phys,
 491             0);
 492         if (error != 0) {
 493                 device_printf(sc->sc_dev,
 494                     "could not map status ring DMA memory\n");
 495                 goto fail;
 496         }
 497
 498         /*
 499          * Allocate command DMA map
 500          */
 501         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 502             BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_cmd), 1,
 503             sizeof (struct ipw_cmd), 0, &sc->cmd_dmat);
 504         if (error != 0) {
 505                 device_printf(sc->sc_dev, "could not create command DMA tag\n");
 506                 goto fail;
 507         }
 508
 509         error = bus_dmamap_create(sc->cmd_dmat, 0, &sc->cmd_map);
 510         if (error != 0) {
 511                 device_printf(sc->sc_dev,
 512                     "could not create command DMA map\n");
 513                 goto fail;
 514         }
 515
 516         /*
 517          * Allocate headers DMA maps
 518          */
 519         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 520             BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_hdr), 1,
 521             sizeof (struct ipw_hdr), 0, &sc->hdr_dmat);
 522         if (error != 0) {
 523                 device_printf(sc->sc_dev, "could not create header DMA tag\n");
 524                 goto fail;
 525         }
 526
 527         SLIST_INIT(&sc->free_shdr);
 528         for (i = 0; i < IPW_NDATA; i++) {
 529                 shdr = &sc->shdr_list[i];
 530                 error = bus_dmamap_create(sc->hdr_dmat, 0, &shdr->map);
 531                 if (error != 0) {
 532                         device_printf(sc->sc_dev,
 533                             "could not create header DMA map\n");
 534                         goto fail;
 535                 }
 536                 SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
 537         }
 538
 539         /*
 540          * Allocate tx buffers DMA maps
 541          */
 542         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 543             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IPW_MAX_NSEG, MCLBYTES, 0,
 544             &sc->txbuf_dmat);
 545         if (error != 0) {
 546                 device_printf(sc->sc_dev, "could not create tx DMA tag\n");
 547                 goto fail;
 548         }
 549
 550         SLIST_INIT(&sc->free_sbuf);
 551         for (i = 0; i < IPW_NDATA; i++) {
 552                 sbuf = &sc->tx_sbuf_list[i];
 553                 error = bus_dmamap_create(sc->txbuf_dmat, 0, &sbuf->map);
 554                 if (error != 0) {
 555                         device_printf(sc->sc_dev,
 556                             "could not create tx DMA map\n");
 557                         goto fail;
 558                 }
 559                 SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
 560         }
 561
 562         /*
 563          * Initialize tx ring
 564          */
 565         for (i = 0; i < IPW_NTBD; i++) {
 566                 sbd = &sc->stbd_list[i];
 567                 sbd->bd = &sc->tbd_list[i];
 568                 sbd->type = IPW_SBD_TYPE_NOASSOC;
 569         }
 570
 571         /*
 572          * Pre-allocate rx buffers and DMA maps
 573          */
 574         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 575             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IPW_NRBD, MCLBYTES, 0,
 576             &sc->rxbuf_dmat);
 577         if (error != 0) {
 578                 device_printf(sc->sc_dev, "could not create rx DMA tag\n");
 579                 goto fail;
 580         }
 581
 582         for (i = 0; i < IPW_NRBD; i++) {
 583                 sbd = &sc->srbd_list[i];
 584                 sbuf = &sc->rx_sbuf_list[i];
 585                 sbd->bd = &sc->rbd_list[i];
 586
 587                 sbuf->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 588                 if (sbuf->m == NULL) {
 589                         device_printf(sc->sc_dev,
 590                             "could not allocate rx mbuf\n");
 591                         error = ENOMEM;
 592                         goto fail;
 593                 }
 594
 595                 error = bus_dmamap_create(sc->rxbuf_dmat, 0, &sbuf->map);
 596                 if (error != 0) {
 597                         device_printf(sc->sc_dev,
 598                             "could not create rx DMA map\n");
 599                         goto fail;
 600                 }
 601
 602                 error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map,
 603                     mtod(sbuf->m, void *), MCLBYTES, ipw_dma_map_addr,
 604                     &physaddr, 0);
 605                 if (error != 0) {
 606                         device_printf(sc->sc_dev,
 607                             "could not map rx DMA memory\n");
 608                         goto fail;
 609                 }
 610
 611                 sbd->type = IPW_SBD_TYPE_DATA;
 612                 sbd->priv = sbuf;
 613                 sbd->bd->physaddr = htole32(physaddr);
 614                 sbd->bd->len = htole32(MCLBYTES);
 615         }
 616
 617         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
 618
 619         return 0;
 620
 621 fail:   ipw_release(sc);
 622         return error;
 623 }
 624
 625 static void
 626 ipw_release(struct ipw_softc *sc)
 627 {
 628         struct ipw_soft_buf *sbuf;
 629         int i;
 630
 631         if (sc->tbd_dmat != NULL) {
 632                 if (sc->stbd_list != NULL) {
 633                         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map,
 634                             BUS_DMASYNC_POSTWRITE);
 635                         bus_dmamap_unload(sc->tbd_dmat, sc->tbd_map);
 636                         bus_dmamem_free(sc->tbd_dmat, sc->tbd_list,
 637                             sc->tbd_map);
 638                 }
 639                 bus_dma_tag_destroy(sc->tbd_dmat);
 640         }
 641
 642         if (sc->rbd_dmat != NULL) {
 643                 if (sc->rbd_list != NULL) {
 644                         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map,
 645                             BUS_DMASYNC_POSTWRITE);
 646                         bus_dmamap_unload(sc->rbd_dmat, sc->rbd_map);
 647                         bus_dmamem_free(sc->rbd_dmat, sc->rbd_list,
 648                             sc->rbd_map);
 649                 }
 650                 bus_dma_tag_destroy(sc->rbd_dmat);
 651         }
 652
 653         if (sc->status_dmat != NULL) {
 654                 if (sc->status_list != NULL) {
 655                         bus_dmamap_sync(sc->status_dmat, sc->status_map,
 656                             BUS_DMASYNC_POSTWRITE);
 657                         bus_dmamap_unload(sc->status_dmat, sc->status_map);
 658                         bus_dmamem_free(sc->status_dmat, sc->status_list,
 659                             sc->status_map);
 660                 }
 661                 bus_dma_tag_destroy(sc->status_dmat);
 662         }
 663
 664         for (i = 0; i < IPW_NTBD; i++)
 665                 ipw_release_sbd(sc, &sc->stbd_list[i]);
 666
 667         if (sc->cmd_dmat != NULL) {
 668                 bus_dmamap_destroy(sc->cmd_dmat, sc->cmd_map);
 669                 bus_dma_tag_destroy(sc->cmd_dmat);
 670         }
 671
 672         if (sc->hdr_dmat != NULL) {
 673                 for (i = 0; i < IPW_NDATA; i++)
 674                         bus_dmamap_destroy(sc->hdr_dmat, sc->shdr_list[i].map);
 675                 bus_dma_tag_destroy(sc->hdr_dmat);
 676         }
 677
 678         if (sc->txbuf_dmat != NULL) {
 679                 for (i = 0; i < IPW_NDATA; i++) {
 680                         bus_dmamap_destroy(sc->txbuf_dmat,
 681                             sc->tx_sbuf_list[i].map);
 682                 }
 683                 bus_dma_tag_destroy(sc->txbuf_dmat);
 684         }
 685
 686         if (sc->rxbuf_dmat != NULL) {
 687                 for (i = 0; i < IPW_NRBD; i++) {
 688                         sbuf = &sc->rx_sbuf_list[i];
 689                         if (sbuf->m != NULL) {
 690                                 bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map,
 691                                     BUS_DMASYNC_POSTREAD);
 692                                 bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
 693                                 m_freem(sbuf->m);
 694                         }
 695                         bus_dmamap_destroy(sc->rxbuf_dmat, sbuf->map);
 696                 }
 697                 bus_dma_tag_destroy(sc->rxbuf_dmat);
 698         }
 699 }
 700
 701 static int
 702 ipw_shutdown(device_t dev)
 703 {
 704         struct ipw_softc *sc = device_get_softc(dev);
 705         IPW_LOCK_DECL();
 706
 707         IPW_LOCK(sc);
 708
 709         ipw_stop(sc);
 710
 711         IPW_UNLOCK(sc);
 712
 713         return 0;
 714 }
 715
 716 static int
 717 ipw_suspend(device_t dev)
 718 {
 719         struct ipw_softc *sc = device_get_softc(dev);
 720         IPW_LOCK_DECL();
 721
 722         IPW_LOCK(sc);
 723
 724         ipw_stop(sc);
 725
 726         IPW_UNLOCK(sc);
 727
 728         return 0;
 729 }
 730
 731 static int
 732 ipw_resume(device_t dev)
 733 {
 734         struct ipw_softc *sc = device_get_softc(dev);
 735         struct ifnet *ifp = &sc->sc_ic.ic_if;
 736         IPW_LOCK_DECL();
 737
 738         IPW_LOCK(sc);
 739
 740         pci_write_config(dev, 0x41, 0, 1);
 741
 742         if (ifp->if_flags & IFF_UP) {
 743                 ifp->if_init(ifp->if_softc);
 744                 if (ifp->if_flags & IFF_RUNNING)
 745                         ifp->if_start(ifp);
 746         }
 747
 748         IPW_UNLOCK(sc);
 749
 750         return 0;
 751 }
 752
 753 static int
 754 ipw_media_change(struct ifnet *ifp)
 755 {
 756         struct ipw_softc *sc = ifp->if_softc;
 757         int error;
 758         IPW_LOCK_DECL();
 759
 760         IPW_LOCK(sc);
 761
 762         error = ieee80211_media_change(ifp);
 763         if (error != ENETRESET) {
 764                 IPW_UNLOCK(sc);
 765                 return error;
 766         }
 767
 768         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
 769                 ipw_init(sc);
 770
 771         IPW_UNLOCK(sc);
 772
 773         return 0;
 774 }
 775
 776 static void
 777 ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
 778 {
 779         struct ipw_softc *sc = ifp->if_softc;
 780         struct ieee80211com *ic = &sc->sc_ic;
 781 #define N(a)    (sizeof (a) / sizeof (a[0]))
 782         static const struct {
 783                 u_int32_t       val;
 784                 int             rate;
 785         } rates[] = {
 786                 { IPW_RATE_DS1,   2 },
 787                 { IPW_RATE_DS2,   4 },
 788                 { IPW_RATE_DS5,  11 },
 789                 { IPW_RATE_DS11, 22 },
 790         };
 791         u_int32_t val, i;
 792         int rate;
 793
 794         imr->ifm_status = IFM_AVALID;
 795         imr->ifm_active = IFM_IEEE80211;
 796         if (ic->ic_state == IEEE80211_S_RUN)
 797                 imr->ifm_status |= IFM_ACTIVE;
 798
 799         /* read current transmission rate from adapter */
 800         val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE) & 0xf;
 801
 802         /* convert rate to 802.11 rate */
 803         for (i = 0; i < N(rates) && rates[i].val != val; i++);
 804         rate = (i < N(rates)) ? rates[i].rate : 0;
 805
 806         imr->ifm_active |= IFM_IEEE80211_11B;
 807         imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
 808         switch (ic->ic_opmode) {
 809         case IEEE80211_M_STA:
 810                 break;
 811
 812         case IEEE80211_M_IBSS:
 813                 imr->ifm_active |= IFM_IEEE80211_IBSS;
 814                 break;
 815
 816         case IEEE80211_M_MONITOR:
 817                 imr->ifm_active |= IFM_IEEE80211_MONITOR;
 818                 break;
 819
 820         case IEEE80211_M_AHDEMO:
 821         case IEEE80211_M_HOSTAP:
 822                 /* should not get there */
 823                 break;
 824         }
 825 #undef N
 826 }
 827
 828 static int
 829 ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg __unused)
 830 {
 831         struct ipw_softc *sc = ic->ic_softc;
 832         struct ieee80211_node *ni = ic->ic_bss;
 833         u_int32_t len;
 834         u_int8_t val;
 835
 836         switch (nstate) {
 837         case IEEE80211_S_RUN:
 838                 len = IEEE80211_NWID_LEN;
 839                 ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
 840                 ni->ni_esslen = len;
 841
 842                 val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
 843                 ni->ni_chan = &ic->ic_channels[val];
 844
 845                 DELAY(100); /* firmware needs a short delay here */
 846
 847                 len = IEEE80211_ADDR_LEN;
 848                 ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
 849                 IEEE80211_ADDR_COPY(ni->ni_macaddr, ni->ni_bssid);
 850                 break;
 851
 852         case IEEE80211_S_INIT:
 853         case IEEE80211_S_SCAN:
 854         case IEEE80211_S_AUTH:
 855         case IEEE80211_S_ASSOC:
 856                 break;
 857         }
 858
 859         ic->ic_state = nstate;
 860         return 0;
 861 }
 862
 863 /*
 864  * Read 16 bits at address 'addr' from the Microwire EEPROM.
 865  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
 866  */
 867 static u_int16_t
 868 ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
 869 {
 870         u_int32_t tmp;
 871         u_int16_t val;
 872         int n;
 873
 874         /* Clock C once before the first command */
 875         IPW_EEPROM_CTL(sc, 0);
 876         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 877         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 878         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 879
 880         /* Write start bit (1) */
 881         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
 882         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
 883
 884         /* Write READ opcode (10) */
 885         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
 886         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
 887         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 888         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 889
 890         /* Write address A7-A0 */
 891         for (n = 7; n >= 0; n--) {
 892                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
 893                     (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
 894                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
 895                     (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
 896         }
 897
 898         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 899
 900         /* Read data Q15-Q0 */
 901         val = 0;
 902         for (n = 15; n >= 0; n--) {
 903                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 904                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 905                 tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
 906                 val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
 907         }
 908
 909         IPW_EEPROM_CTL(sc, 0);
 910
 911         /* Clear Chip Select and clock C */
 912         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 913         IPW_EEPROM_CTL(sc, 0);
 914         IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
 915
 916         return le16toh(val);
 917 }
 918
 919 static void
 920 ipw_scan_result(struct ipw_softc *sc)
 921 {
 922         struct ieee80211com *ic = &sc->sc_ic;
 923         struct ieee80211_node *ni;
 924         u_int32_t i, cnt, off;
 925         struct ipw_node ap;
 926
 927         /* flush previously seen access points */
 928         ieee80211_free_allnodes(ic);
 929
 930         cnt = ipw_read_table1(sc, IPW_INFO_APS_CNT);
 931         off = ipw_read_table1(sc, IPW_INFO_APS_BASE);
 932
 933         DPRINTF(("Found %u APs\n", cnt));
 934
 935         for (i = 0; i < cnt; i++) {
 936                 ipw_read_mem_1(sc, off, (u_int8_t *)&ap, sizeof ap);
 937                 off += sizeof ap;
 938
 939 #ifdef IPW_DEBUG
 940                 if (ipw_debug >= 2) {
 941                         u_char *p = (u_char *)&ap;
 942                         int j;
 943
 944                         printf("AP%u\n", i);
 945                         for (j = 0; j < sizeof ap; j++)
 946                                 printf("%02x", *p++);
 947                         printf("\n");
 948                 }
 949 #endif
 950
 951                 ni = ieee80211_lookup_node(ic, ap.bssid,
 952                     &ic->ic_channels[ap.chan]);
 953                 if (ni != NULL)
 954                         continue;
 955
 956                 ni = ieee80211_alloc_node(ic, ap.bssid);
 957                 if (ni == NULL)
 958                         return;
 959
 960                 IEEE80211_ADDR_COPY(ni->ni_bssid, ap.bssid);
 961                 ni->ni_rssi = ap.rssi;
 962                 ni->ni_intval = le16toh(ap.intval);
 963                 ni->ni_capinfo = le16toh(ap.capinfo);
 964                 ni->ni_chan = &ic->ic_channels[ap.chan];
 965                 ni->ni_esslen = ap.esslen;
 966                 bcopy(ap.essid, ni->ni_essid, IEEE80211_NWID_LEN);
 967         }
 968 }
 969
 970 static void
 971 ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
 972 {
 973         struct ipw_cmd *cmd;
 974
 975         cmd = mtod(sbuf->m, struct ipw_cmd *);
 976
 977         DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
 978             le32toh(cmd->type), le32toh(cmd->subtype), le32toh(cmd->seq),
 979             le32toh(cmd->len), le32toh(cmd->status)));
 980
 981         wakeup(sc);
 982 }
 983
 984 static void
 985 ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
 986 {
 987         struct ieee80211com *ic = &sc->sc_ic;
 988         u_int32_t state;
 989
 990         state = le32toh(*mtod(sbuf->m, u_int32_t *));
 991
 992         DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
 993
 994         switch (state) {
 995         case IPW_STATE_ASSOCIATED:
 996                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 997                 break;
 998
 999         case IPW_STATE_SCANNING:
1000                 /* don't leave run state on background scan */
1001                 if (ic->ic_state != IEEE80211_S_RUN)
1002                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1003                 break;
1004
1005         case IPW_STATE_SCAN_COMPLETE:
1006                 ipw_scan_result(sc);
1007                 break;
1008
1009         case IPW_STATE_ASSOCIATION_LOST:
1010                 ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1011                 break;
1012
1013         case IPW_STATE_RADIO_DISABLED:
1014                 sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1015                 ipw_stop(sc);
1016                 break;
1017         }
1018 }
1019
1020 static void
1021 ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
1022     struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
1023 {
1024         struct ieee80211com *ic = &sc->sc_ic;
1025         struct ifnet *ifp = &ic->ic_if;
1026         struct mbuf *m;
1027         struct ieee80211_frame *wh;
1028         struct ieee80211_node *ni;
1029         bus_addr_t physaddr;
1030         int error;
1031
1032         DPRINTFN(5, ("RX!DATA!%u!%u\n", le32toh(status->len), status->rssi));
1033
1034         if (le32toh(status->len) < sizeof (struct ieee80211_frame_min) ||
1035             le32toh(status->len) > MCLBYTES) {
1036                 device_printf(sc->sc_dev, "bad frame length\n");
1037                 return;
1038         }
1039
1040         bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
1041
1042         /* Finalize mbuf */
1043         m = sbuf->m;
1044         m->m_pkthdr.rcvif = ifp;
1045         m->m_pkthdr.len = m->m_len = le32toh(status->len);
1046
1047         if (sc->sc_drvbpf != NULL) {
1048                 struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
1049
1050                 tap->wr_flags = 0;
1051                 tap->wr_antsignal = status->rssi;
1052                 tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1053                 tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1054
1055                 bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1056         }
1057
1058         wh = mtod(m, struct ieee80211_frame *);
1059
1060         if (ic->ic_opmode != IEEE80211_M_STA) {
1061                 ni = ieee80211_find_node(ic, wh->i_addr2);
1062                 if (ni == NULL)
1063                         ni = ieee80211_ref_node(ic->ic_bss);
1064         } else
1065                 ni = ieee80211_ref_node(ic->ic_bss);
1066
1067         /* Send the frame to the upper layer */
1068         ieee80211_input(ifp, m, ni, status->rssi, 0);
1069
1070         if (ni == ic->ic_bss)
1071                 ieee80211_unref_node(&ni);
1072         else
1073                 ieee80211_free_node(ic, ni);
1074
1075         m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1076         if (m == NULL) {
1077                 device_printf(sc->sc_dev, "could not allocate rx mbuf\n");
1078                 sbuf->m = NULL;
1079                 return;
1080         }
1081
1082         error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map, mtod(m, void *),
1083             MCLBYTES, ipw_dma_map_addr, &physaddr, 0);
1084         if (error != 0) {
1085                 device_printf(sc->sc_dev, "could not map rx DMA memory\n");
1086                 m_freem(m);
1087                 sbuf->m = NULL;
1088                 return;
1089         }
1090
1091         sbuf->m = m;
1092         sbd->bd->physaddr = htole32(physaddr);
1093 }
1094
1095 static void
1096 ipw_notification_intr(struct ipw_softc *sc __unused, struct ipw_soft_buf *sbuf __unused)
1097 {
1098         DPRINTFN(2, ("RX!NOTIFICATION\n"));
1099 }
1100
1101 static void
1102 ipw_rx_intr(struct ipw_softc *sc)
1103 {
1104         struct ipw_status *status;
1105         struct ipw_soft_bd *sbd;
1106         struct ipw_soft_buf *sbuf;
1107         u_int32_t r, i;
1108
1109         if (!(sc->flags & IPW_FLAG_FW_INITED))
1110                 return;
1111
1112         r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
1113
1114         bus_dmamap_sync(sc->status_dmat, sc->status_map, BUS_DMASYNC_POSTREAD);
1115
1116         for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
1117
1118                 status = &sc->status_list[i];
1119                 sbd = &sc->srbd_list[i];
1120                 sbuf = sbd->priv;
1121
1122                 bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map,
1123                     BUS_DMASYNC_POSTREAD);
1124
1125                 switch (le16toh(status->code) & 0xf) {
1126                 case IPW_STATUS_CODE_COMMAND:
1127                         ipw_command_intr(sc, sbuf);
1128                         break;
1129
1130                 case IPW_STATUS_CODE_NEWSTATE:
1131                         ipw_newstate_intr(sc, sbuf);
1132                         break;
1133
1134                 case IPW_STATUS_CODE_DATA_802_3:
1135                 case IPW_STATUS_CODE_DATA_802_11:
1136                         ipw_data_intr(sc, status, sbd, sbuf);
1137                         break;
1138
1139                 case IPW_STATUS_CODE_NOTIFICATION:
1140                         ipw_notification_intr(sc, sbuf);
1141                         break;
1142
1143                 default:
1144                         device_printf(sc->sc_dev, "unknown status code %u\n",
1145                             le16toh(status->code));
1146                 }
1147
1148                 /* firmware was killed, stop processing received frames */
1149                 if (!(sc->flags & IPW_FLAG_FW_INITED))
1150                         return;
1151
1152                 sbd->bd->flags = 0;
1153         }
1154         /* Some buffer descriptors may have changed */
1155         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
1156
1157         /* Tell the firmware what we have processed */
1158         sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
1159         CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
1160 }
1161
1162 static void
1163 ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1164 {
1165         struct ieee80211com *ic = &sc->sc_ic;
1166         struct ipw_soft_hdr *shdr;
1167         struct ipw_soft_buf *sbuf;
1168
1169         switch (sbd->type) {
1170         case IPW_SBD_TYPE_COMMAND:
1171                 bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map,
1172                     BUS_DMASYNC_POSTWRITE);
1173                 bus_dmamap_unload(sc->cmd_dmat, sc->cmd_map);
1174                 break;
1175
1176         case IPW_SBD_TYPE_HEADER:
1177                 shdr = sbd->priv;
1178                 bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_POSTWRITE);
1179                 bus_dmamap_unload(sc->hdr_dmat, shdr->map);
1180                 SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1181                 break;
1182
1183         case IPW_SBD_TYPE_DATA:
1184                 sbuf = sbd->priv;
1185                 bus_dmamap_sync(sc->txbuf_dmat, sbuf->map,
1186                     BUS_DMASYNC_POSTWRITE);
1187                 bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1188                 SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1189
1190                 m_freem(sbuf->m);
1191
1192                 if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
1193                         ieee80211_free_node(ic, sbuf->ni);
1194
1195                 /* kill watchdog timer */
1196                 sc->sc_tx_timer = 0;
1197                 break;
1198         }
1199         sbd->type = IPW_SBD_TYPE_NOASSOC;
1200 }
1201
1202 static void
1203 ipw_tx_intr(struct ipw_softc *sc)
1204 {
1205         struct ifnet *ifp = &sc->sc_ic.ic_if;
1206         u_int32_t r, i;
1207
1208         if (!(sc->flags & IPW_FLAG_FW_INITED))
1209                 return;
1210
1211         r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1212
1213         for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1214                 ipw_release_sbd(sc, &sc->stbd_list[i]);
1215                 sc->txfree++;
1216         }
1217
1218         /* Remember what the firmware has processed */
1219         sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1220
1221         /* Call start() since some buffer descriptors have been released */
1222         ifp->if_flags &= ~IFF_OACTIVE;
1223         (*ifp->if_start)(ifp);
1224 }
1225
1226 static void
1227 ipw_intr(void *arg)
1228 {
1229         struct ipw_softc *sc = arg;
1230         u_int32_t r;
1231         IPW_LOCK_DECL();
1232
1233         IPW_LOCK(sc);
1234
1235         if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff) {
1236                 IPW_UNLOCK(sc);
1237                 return;
1238         }
1239
1240         /* Disable interrupts */
1241         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1242
1243         DPRINTFN(8, ("INTR!0x%08x\n", r));
1244
1245         if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1246                 device_printf(sc->sc_dev, "fatal error\n");
1247                 sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1248                 ipw_stop(sc);
1249         }
1250
1251         if (r & IPW_INTR_FW_INIT_DONE) {
1252                 if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1253                         wakeup(sc);
1254         }
1255
1256         if (r & IPW_INTR_RX_TRANSFER)
1257                 ipw_rx_intr(sc);
1258
1259         if (r & IPW_INTR_TX_TRANSFER)
1260                 ipw_tx_intr(sc);
1261
1262         /* Acknowledge interrupts */
1263         CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1264
1265         /* Re-enable interrupts */
1266         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1267
1268         IPW_UNLOCK(sc);
1269 }
1270
1271 static void
1272 ipw_dma_map_txbuf(void *arg, bus_dma_segment_t *segs, int nseg,
1273     bus_size_t mapsize, int error)
1274 {
1275         struct ipw_dma_mapping *map = arg;
1276
1277         if (error != 0)
1278                 return;
1279
1280         KASSERT(nseg <= IPW_MAX_NSEG, ("too many DMA segments %d", nseg));
1281
1282         bcopy(segs, map->segs, nseg * sizeof (bus_dma_segment_t));
1283         map->nseg = nseg;
1284         map->mapsize = mapsize;
1285 }
1286
1287 static void
1288 ipw_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg __unused, int error)
1289 {
1290         if (error != 0)
1291                 return;
1292
1293         KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
1294
1295         *(bus_addr_t *)arg = segs[0].ds_addr;
1296 }
1297
1298 static int
1299 ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
1300 {
1301         struct ipw_soft_bd *sbd;
1302         bus_addr_t physaddr;
1303         int error;
1304
1305         sbd = &sc->stbd_list[sc->txcur];
1306
1307         error = bus_dmamap_load(sc->cmd_dmat, sc->cmd_map, &sc->cmd,
1308             sizeof (struct ipw_cmd), ipw_dma_map_addr, &physaddr, 0);
1309         if (error != 0) {
1310                 device_printf(sc->sc_dev, "could not map command DMA memory\n");
1311                 return error;
1312         }
1313
1314         sc->cmd.type = htole32(type);
1315         sc->cmd.subtype = htole32(0);
1316         sc->cmd.len = htole32(len);
1317         sc->cmd.seq = htole32(0);
1318         if (data != NULL)
1319                 bcopy(data, sc->cmd.data, len);
1320
1321         sbd->type = IPW_SBD_TYPE_COMMAND;
1322         sbd->bd->physaddr = htole32(physaddr);
1323         sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1324         sbd->bd->nfrag = 1;
1325         sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1326                          IPW_BD_FLAG_TX_LAST_FRAGMENT;
1327
1328         bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map, BUS_DMASYNC_PREWRITE);
1329         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1330
1331         sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1332         sc->txfree--;
1333         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1334
1335         DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1336
1337         /* wait at most one second for command to complete */
1338         return tsleep(sc, 0, "ipwcmd", hz);
1339 }
1340
1341 static int
1342 ipw_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1343 {
1344         struct ipw_softc *sc = ifp->if_softc;
1345         struct ieee80211com *ic = &sc->sc_ic;
1346         struct ieee80211_frame *wh;
1347         struct ipw_dma_mapping map;
1348         struct ipw_soft_bd *sbd;
1349         struct ipw_soft_hdr *shdr;
1350         struct ipw_soft_buf *sbuf;
1351         struct mbuf *mnew;
1352         bus_addr_t physaddr;
1353         int error, i;
1354
1355         if (ic->ic_flags & IEEE80211_F_WEPON) {
1356                 m0 = ieee80211_wep_crypt(ifp, m0, 1);
1357                 if (m0 == NULL)
1358                         return ENOBUFS;
1359         }
1360
1361         if (sc->sc_drvbpf != NULL) {
1362                 struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1363
1364                 tap->wt_flags = 0;
1365                 tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1366                 tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1367
1368                 bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1369         }
1370
1371         wh = mtod(m0, struct ieee80211_frame *);
1372
1373         shdr = SLIST_FIRST(&sc->free_shdr);
1374         sbuf = SLIST_FIRST(&sc->free_sbuf);
1375         KASSERT(shdr != NULL && sbuf != NULL, ("empty sw hdr/buf pool"));
1376
1377         shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1378         shdr->hdr.subtype = htole32(0);
1379         shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1380         shdr->hdr.encrypt = 0;
1381         shdr->hdr.keyidx = 0;
1382         shdr->hdr.keysz = 0;
1383         shdr->hdr.fragmentsz = htole16(0);
1384         IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1385         if (ic->ic_opmode == IEEE80211_M_STA)
1386                 IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1387         else
1388                 IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1389
1390         /* trim IEEE802.11 header */
1391         m_adj(m0, sizeof (struct ieee80211_frame));
1392
1393         error = bus_dmamap_load_mbuf(sc->txbuf_dmat, sbuf->map, m0,
1394             ipw_dma_map_txbuf, &map, 0);
1395         if (error != 0 && error != EFBIG) {
1396                 device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1397                     error);
1398                 m_freem(m0);
1399                 return error;
1400         }
1401         if (error != 0) {
1402                 mnew = m_defrag(m0, MB_DONTWAIT);
1403                 if (mnew == NULL) {
1404                         device_printf(sc->sc_dev,
1405                             "could not defragment mbuf\n");
1406                         m_freem(m0);
1407                         return ENOBUFS;
1408                 }
1409                 m0 = mnew;
1410
1411                 error = bus_dmamap_load_mbuf(sc->txbuf_dmat, sbuf->map, m0,
1412                     ipw_dma_map_txbuf, &map, 0);
1413                 if (error != 0) {
1414                         device_printf(sc->sc_dev,
1415                             "could not map mbuf (error %d)\n", error);
1416                         m_freem(m0);
1417                         return error;
1418                 }
1419         }
1420
1421         error = bus_dmamap_load(sc->hdr_dmat, shdr->map, &shdr->hdr,
1422             sizeof (struct ipw_hdr), ipw_dma_map_addr, &physaddr, 0);
1423         if (error != 0) {
1424                 device_printf(sc->sc_dev, "could not map header DMA memory\n");
1425                 bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1426                 m_freem(m0);
1427                 return error;
1428         }
1429
1430         SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1431         SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1432
1433         sbd = &sc->stbd_list[sc->txcur];
1434         sbd->type = IPW_SBD_TYPE_HEADER;
1435         sbd->priv = shdr;
1436         sbd->bd->physaddr = htole32(physaddr);
1437         sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1438         sbd->bd->nfrag = 1 + map.nseg;
1439         sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1440                          IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1441
1442         DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u!%6D!%6D\n", shdr->hdr.type,
1443             shdr->hdr.subtype, shdr->hdr.encrypted, shdr->hdr.encrypt,
1444             shdr->hdr.src_addr, ":", shdr->hdr.dst_addr, ":"));
1445         sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1446         sc->txfree--;
1447
1448         sbuf->m = m0;
1449         sbuf->ni = ni;
1450
1451         for (i = 0; i < map.nseg; i++) {
1452                 sbd = &sc->stbd_list[sc->txcur];
1453
1454                 sbd->bd->physaddr = htole32(map.segs[i].ds_addr);
1455                 sbd->bd->len = htole32(map.segs[i].ds_len);
1456                 sbd->bd->nfrag = 0; /* used only in first bd */
1457                 sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1458                 if (i == map.nseg - 1) {
1459                         sbd->type = IPW_SBD_TYPE_DATA;
1460                         sbd->priv = sbuf;
1461                         sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1462                 } else {
1463                         sbd->type = IPW_SBD_TYPE_NOASSOC;
1464                         sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1465                 }
1466
1467                 DPRINTFN(5, ("TX!FRAG!%d!%d\n", i, map.segs[i].ds_len));
1468                 sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1469                 sc->txfree--;
1470         }
1471
1472         bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_PREWRITE);
1473         bus_dmamap_sync(sc->txbuf_dmat, sbuf->map, BUS_DMASYNC_PREWRITE);
1474         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1475
1476         /* Inform firmware about this new packet */
1477         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1478
1479         return 0;
1480 }
1481
1482 static void
1483 ipw_start(struct ifnet *ifp)
1484 {
1485         struct ipw_softc *sc = ifp->if_softc;
1486         struct ieee80211com *ic = &sc->sc_ic;
1487         struct mbuf *m0;
1488         struct ieee80211_node *ni;
1489
1490         if (ic->ic_state != IEEE80211_S_RUN) {
1491                 return;
1492         }
1493
1494         for (;;) {
1495                 m0 = ifq_poll(&ifp->if_snd);
1496                 if (m0 == NULL)
1497                         break;
1498                 if (sc->txfree < 1 + IPW_MAX_NSEG) {
1499                         ifp->if_flags |= IFF_OACTIVE;
1500                         break;
1501                 }
1502                 m0 = ifq_dequeue(&ifp->if_snd);
1503
1504                 BPF_MTAP(ifp, m0);
1505
1506                 m0 = ieee80211_encap(ifp, m0, &ni);
1507                 if (m0 == NULL)
1508                         continue;
1509
1510                 if (ic->ic_rawbpf != NULL)
1511                         bpf_mtap(ic->ic_rawbpf, m0);
1512
1513                 if (ipw_tx_start(ifp, m0, ni) != 0) {
1514                         if (ni != NULL && ni != ic->ic_bss)
1515                                 ieee80211_free_node(ic, ni);
1516                         break;
1517                 }
1518
1519                 /* start watchdog timer */
1520                 sc->sc_tx_timer = 5;
1521                 ifp->if_timer = 1;
1522         }
1523 }
1524
1525 static void
1526 ipw_watchdog(struct ifnet *ifp)
1527 {
1528         struct ipw_softc *sc = ifp->if_softc;
1529
1530         ifp->if_timer = 0;
1531
1532         if (sc->sc_tx_timer > 0) {
1533                 if (--sc->sc_tx_timer == 0) {
1534                         if_printf(ifp, "device timeout\n");
1535                         ifp->if_flags &= ~IFF_UP;
1536                         ipw_stop(sc);
1537                         return;
1538                 }
1539                 ifp->if_timer = 1;
1540         }
1541
1542         ieee80211_watchdog(ifp);
1543 }
1544
1545 static int
1546 ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1547 {
1548         struct ipw_softc *sc = ifp->if_softc;
1549         struct ieee80211com *ic = &sc->sc_ic;
1550         struct ifreq *ifr;
1551         struct ieee80211req *ireq;
1552         int error = 0;
1553         IPW_LOCK_DECL();
1554
1555         IPW_LOCK(sc);
1556
1557         switch (cmd) {
1558         case SIOCSIFFLAGS:
1559                 if (ifp->if_flags & IFF_UP) {
1560                         if (!(ifp->if_flags & IFF_RUNNING))
1561                                 ipw_init(sc);
1562                 } else {
1563                         if (ifp->if_flags & IFF_RUNNING)
1564                                 ipw_stop(sc);
1565                 }
1566                 break;
1567
1568         case SIOCSLOADFW:
1569                 /* only super-user can do that! */
1570                 if ((error = suser(curthread)) != 0)
1571                         break;
1572
1573                 ifr = (struct ifreq *)data;
1574                 error = ipw_cache_firmware(sc, ifr->ifr_data);
1575                 break;
1576
1577         case SIOCSKILLFW:
1578                 /* only super-user can do that! */
1579                 if ((error = suser(curthread)) != 0)
1580                         break;
1581
1582                 ifp->if_flags &= ~IFF_UP;
1583                 ipw_stop(sc);
1584                 ipw_free_firmware(sc);
1585                 break;
1586
1587         case SIOCG80211:
1588                 ireq = (struct ieee80211req *)data;
1589                 switch (ireq->i_type) {
1590                 case IEEE80211_IOC_AUTHMODE:
1591                         ireq->i_val = sc->authmode;
1592                         break;
1593
1594                 case IEEE80211_IOC_TXPOWER:
1595                         ireq->i_val = (CSR_READ_4(sc, IPW_CSR_IO) &
1596                             IPW_IO_RADIO_DISABLED) ? 0 : ic->ic_txpower;
1597                         break;
1598
1599                 default:
1600                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1601                 }
1602                 break;
1603
1604         case SIOCS80211:
1605                 /* only super-user can do that! */
1606                 if ((error = suser(curthread)) != 0)
1607                         break;
1608
1609                 ireq = (struct ieee80211req *)data;
1610                 switch (ireq->i_type) {
1611                 case IEEE80211_IOC_AUTHMODE:
1612                         sc->authmode = ireq->i_val;
1613                         break;
1614
1615                 default:
1616                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1617                 }
1618                 break;
1619
1620         default:
1621                 error = ieee80211_ioctl(ifp, cmd, data, cr);
1622         }
1623
1624         if (error == ENETRESET) {
1625                 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1626                     (IFF_UP | IFF_RUNNING))
1627                         ipw_init(sc);
1628                 error = 0;
1629         }
1630
1631         IPW_UNLOCK(sc);
1632
1633         return error;
1634 }
1635
1636 static void
1637 ipw_stop_master(struct ipw_softc *sc)
1638 {
1639         int ntries;
1640
1641         /* Disable interrupts */
1642         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1643
1644         CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1645         for (ntries = 0; ntries < 5; ntries++) {
1646                 if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1647                         break;
1648                 DELAY(10);
1649         }
1650         if (ntries == 5)
1651                 device_printf(sc->sc_dev, "timeout waiting for master\n");
1652
1653         CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1654             IPW_RST_PRINCETON_RESET);
1655
1656         sc->flags &= ~IPW_FLAG_FW_INITED;
1657 }
1658
1659 static int
1660 ipw_reset(struct ipw_softc *sc)
1661 {
1662         int ntries;
1663
1664         ipw_stop_master(sc);
1665
1666         /* Move adapter to D0 state */
1667         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1668             IPW_CTL_INIT);
1669
1670         /* Wait for clock stabilization */
1671         for (ntries = 0; ntries < 1000; ntries++) {
1672                 if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1673                         break;
1674                 DELAY(200);
1675         }
1676         if (ntries == 1000)
1677                 return EIO;
1678
1679         CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1680             IPW_RST_SW_RESET);
1681
1682         DELAY(10);
1683
1684         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1685             IPW_CTL_INIT);
1686
1687         return 0;
1688 }
1689
1690 static int
1691 ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1692 {
1693         int ntries;
1694
1695         MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1696         CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1697
1698         MEM_WRITE_2(sc, 0x220000, 0x0703);
1699         MEM_WRITE_2(sc, 0x220000, 0x0707);
1700
1701         MEM_WRITE_1(sc, 0x210014, 0x72);
1702         MEM_WRITE_1(sc, 0x210014, 0x72);
1703
1704         MEM_WRITE_1(sc, 0x210000, 0x40);
1705         MEM_WRITE_1(sc, 0x210000, 0x00);
1706         MEM_WRITE_1(sc, 0x210000, 0x40);
1707
1708         MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1709
1710         MEM_WRITE_1(sc, 0x210000, 0x00);
1711         MEM_WRITE_1(sc, 0x210000, 0x00);
1712         MEM_WRITE_1(sc, 0x210000, 0x80);
1713
1714         MEM_WRITE_2(sc, 0x220000, 0x0703);
1715         MEM_WRITE_2(sc, 0x220000, 0x0707);
1716
1717         MEM_WRITE_1(sc, 0x210014, 0x72);
1718         MEM_WRITE_1(sc, 0x210014, 0x72);
1719
1720         MEM_WRITE_1(sc, 0x210000, 0x00);
1721         MEM_WRITE_1(sc, 0x210000, 0x80);
1722
1723         for (ntries = 0; ntries < 100; ntries++) {
1724                 if (MEM_READ_1(sc, 0x210000) & 1)
1725                         break;
1726                 DELAY(1000);
1727         }
1728         if (ntries == 100) {
1729                 device_printf(sc->sc_dev,
1730                     "timeout waiting for ucode to initialize\n");
1731                 return EIO;
1732         }
1733
1734         MEM_WRITE_4(sc, 0x3000e0, 0);
1735
1736         return 0;
1737 }
1738
1739 /* set of macros to handle unaligned little endian data in firmware image */
1740 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1741 #define GETLE16(p) ((p)[0] | (p)[1] << 8)
1742 static int
1743 ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1744 {
1745         u_char *p, *end;
1746         u_int32_t dst;
1747         u_int16_t len;
1748         int error;
1749
1750         p = fw;
1751         end = fw + size;
1752         while (p < end) {
1753                 if (p + 6 > end)
1754                         return EINVAL;
1755
1756                 dst = GETLE32(p); p += 4;
1757                 len = GETLE16(p); p += 2;
1758
1759                 if (p + len > end)
1760                         return EINVAL;
1761
1762                 ipw_write_mem_1(sc, dst, p, len);
1763                 p += len;
1764         }
1765
1766         CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1767             IPW_IO_LED_OFF);
1768
1769         /* Allow interrupts so we know when the firmware is inited */
1770         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1771
1772         /* Tell the adapter to initialize the firmware */
1773         CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1774         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1775             IPW_CTL_ALLOW_STANDBY);
1776
1777         /* Wait at most one second for firmware initialization to complete */
1778         if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1779                 device_printf(sc->sc_dev, "timeout waiting for firmware "
1780                     "initialization to complete\n");
1781                 return error;
1782         }
1783
1784         CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1785             IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1786
1787         return 0;
1788 }
1789
1790 /*
1791  * Store firmware into kernel memory so we can download it when we need to,
1792  * e.g when the adapter wakes up from suspend mode.
1793  */
1794 static int
1795 ipw_cache_firmware(struct ipw_softc *sc, void *data)
1796 {
1797         struct ipw_firmware *fw = &sc->fw;
1798         struct ipw_firmware_hdr hdr;
1799         u_char *p = data;
1800         int error;
1801
1802         ipw_free_firmware(sc);
1803
1804         /*
1805          * mutex(9): no mutexes should be held across functions which access
1806          * memory in userspace, such as copyin(9) [...]
1807          */
1808
1809         if ((error = copyin(data, &hdr, sizeof hdr)) != 0)
1810                 goto fail1;
1811
1812         fw->main_size  = le32toh(hdr.main_size);
1813         fw->ucode_size = le32toh(hdr.ucode_size);
1814         p += sizeof hdr;
1815
1816         fw->main = malloc(fw->main_size, M_DEVBUF, M_WAITOK);
1817         if (fw->main == NULL) {
1818                 error = ENOMEM;
1819                 goto fail1;
1820         }
1821
1822         fw->ucode = malloc(fw->ucode_size, M_DEVBUF, M_WAITOK);
1823         if (fw->ucode == NULL) {
1824                 error = ENOMEM;
1825                 goto fail2;
1826         }
1827
1828         if ((error = copyin(p, fw->main, fw->main_size)) != 0)
1829                 goto fail3;
1830
1831         p += fw->main_size;
1832         if ((error = copyin(p, fw->ucode, fw->ucode_size)) != 0)
1833                 goto fail3;
1834
1835         DPRINTF(("Firmware cached: main %u, ucode %u\n", fw->main_size,
1836             fw->ucode_size));
1837
1838         sc->flags |= IPW_FLAG_FW_CACHED;
1839
1840         return 0;
1841
1842 fail3:  free(fw->ucode, M_DEVBUF);
1843 fail2:  free(fw->main, M_DEVBUF);
1844 fail1:
1845
1846         return error;
1847 }
1848
1849 static void
1850 ipw_free_firmware(struct ipw_softc *sc)
1851 {
1852         if (!(sc->flags & IPW_FLAG_FW_CACHED))
1853                 return;
1854
1855         free(sc->fw.main, M_DEVBUF);
1856         free(sc->fw.ucode, M_DEVBUF);
1857
1858         sc->flags &= ~IPW_FLAG_FW_CACHED;
1859 }
1860
1861 static int
1862 ipw_config(struct ipw_softc *sc)
1863 {
1864         struct ieee80211com *ic = &sc->sc_ic;
1865         struct ifnet *ifp = &ic->ic_if;
1866         struct ipw_security security;
1867         struct ieee80211_wepkey *k;
1868         struct ipw_wep_key wepkey;
1869         struct ipw_scan_options options;
1870         struct ipw_configuration config;
1871         u_int32_t data;
1872         int error, i;
1873
1874         switch (ic->ic_opmode) {
1875         case IEEE80211_M_STA:
1876         case IEEE80211_M_HOSTAP:
1877                 data = htole32(IPW_MODE_BSS);
1878                 break;
1879
1880         case IEEE80211_M_IBSS:
1881         case IEEE80211_M_AHDEMO:
1882                 data = htole32(IPW_MODE_IBSS);
1883                 break;
1884
1885         case IEEE80211_M_MONITOR:
1886                 data = htole32(IPW_MODE_MONITOR);
1887                 break;
1888         }
1889         DPRINTF(("Setting mode to %u\n", le32toh(data)));
1890         error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1891         if (error != 0)
1892                 return error;
1893
1894         if (ic->ic_opmode == IEEE80211_M_IBSS ||
1895             ic->ic_opmode == IEEE80211_M_MONITOR) {
1896                 data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1897                 DPRINTF(("Setting channel to %u\n", le32toh(data)));
1898                 error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1899                 if (error != 0)
1900                         return error;
1901         }
1902
1903         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1904                 DPRINTF(("Enabling adapter\n"));
1905                 return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1906         }
1907
1908         IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1909         IEEE80211_ADDR_COPY(IF_LLADDR(ifp), ic->ic_myaddr);
1910         DPRINTF(("Setting MAC address to %6D\n", ic->ic_myaddr, ":"));
1911         error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1912             IEEE80211_ADDR_LEN);
1913         if (error != 0)
1914                 return error;
1915
1916         config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1917             IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1918         if (ic->ic_opmode == IEEE80211_M_IBSS)
1919                 config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1920         if (ifp->if_flags & IFF_PROMISC)
1921                 config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1922         config.bss_chan = htole32(0x3fff); /* channels 1-14 */
1923         config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
1924         DPRINTF(("Setting configuration to 0x%x\n", le32toh(config.flags)));
1925         error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1926         if (error != 0)
1927                 return error;
1928
1929         data = htole32(0x3); /* 1, 2 */
1930         DPRINTF(("Setting basic tx rates to 0x%x\n", le32toh(data)));
1931         error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1932         if (error != 0)
1933                 return error;
1934
1935         data = htole32(0xf); /* 1, 2, 5.5, 11 */
1936         DPRINTF(("Setting tx rates to 0x%x\n", le32toh(data)));
1937         error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1938         if (error != 0)
1939                 return error;
1940
1941         data = htole32(IPW_POWER_MODE_CAM);
1942         DPRINTF(("Setting power mode to %u\n", le32toh(data)));
1943         error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1944         if (error != 0)
1945                 return error;
1946
1947         if (ic->ic_opmode == IEEE80211_M_IBSS) {
1948                 data = htole32(32); /* default value */
1949                 DPRINTF(("Setting tx power index to %u\n", le32toh(data)));
1950                 error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1951                     sizeof data);
1952                 if (error != 0)
1953                         return error;
1954         }
1955
1956         data = htole32(ic->ic_rtsthreshold);
1957         DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
1958         error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1959         if (error != 0)
1960                 return error;
1961
1962         data = htole32(ic->ic_fragthreshold);
1963         DPRINTF(("Setting frag threshold to %u\n", le32toh(data)));
1964         error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1965         if (error != 0)
1966                 return error;
1967
1968 #ifdef IPW_DEBUG
1969         if (ipw_debug > 0) {
1970                 printf("Setting ESSID to ");
1971                 ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1972                 printf("\n");
1973         }
1974 #endif
1975         error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1976             ic->ic_des_esslen);
1977         if (error != 0)
1978                 return error;
1979
1980         /* no mandatory BSSID */
1981         DPRINTF(("Setting mandatory BSSID to null\n"));
1982         error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1983         if (error != 0)
1984                 return error;
1985
1986         if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1987                 DPRINTF(("Setting desired BSSID to %6D\n", ic->ic_des_bssid,
1988                     ":"));
1989                 error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1990                     ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1991                 if (error != 0)
1992                         return error;
1993         }
1994
1995         bzero(&security, sizeof security);
1996         security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1997             IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1998         security.ciphers = htole32(IPW_CIPHER_NONE);
1999         DPRINTF(("Setting authmode to %u\n", security.authmode));
2000         error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
2001             sizeof security);
2002         if (error != 0)
2003                 return error;
2004
2005         if (ic->ic_flags & IEEE80211_F_WEPON) {
2006                 k = ic->ic_nw_keys;
2007                 for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
2008                         if (k->wk_len == 0)
2009                                 continue;
2010
2011                         wepkey.idx = i;
2012                         wepkey.len = k->wk_len;
2013                         bzero(wepkey.key, sizeof wepkey.key);
2014                         bcopy(k->wk_key, wepkey.key, k->wk_len);
2015                         DPRINTF(("Setting wep key index %u len %u\n",
2016                             wepkey.idx, wepkey.len));
2017                         error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
2018                             sizeof wepkey);
2019                         if (error != 0)
2020                                 return error;
2021                 }
2022
2023                 data = htole32(ic->ic_wep_txkey);
2024                 DPRINTF(("Setting wep tx key index to %u\n", le32toh(data)));
2025                 error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
2026                     sizeof data);
2027                 if (error != 0)
2028                         return error;
2029         }
2030
2031         data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
2032         DPRINTF(("Setting wep flags to 0x%x\n", le32toh(data)));
2033         error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
2034         if (error != 0)
2035                 return error;
2036
2037         if (ic->ic_opmode == IEEE80211_M_IBSS ||
2038             ic->ic_opmode == IEEE80211_M_HOSTAP) {
2039                 data = htole32(ic->ic_lintval);
2040                 DPRINTF(("Setting beacon interval to %u\n", le32toh(data)));
2041                 error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
2042                     sizeof data);
2043                 if (error != 0)
2044                         return error;
2045         }
2046
2047         options.flags = htole32(0);
2048         options.channels = htole32(0x3fff); /* scan channels 1-14 */
2049         DPRINTF(("Setting scan options to 0x%x\n", le32toh(options.flags)));
2050         error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
2051         if (error != 0)
2052                 return error;
2053
2054         /* finally, enable adapter (start scanning for an access point) */
2055         DPRINTF(("Enabling adapter\n"));
2056         return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
2057 }
2058
2059 static void
2060 ipw_init(void *priv)
2061 {
2062         struct ipw_softc *sc = priv;
2063         struct ieee80211com *ic = &sc->sc_ic;
2064         struct ifnet *ifp = &ic->ic_if;
2065         struct ipw_firmware *fw = &sc->fw;
2066
2067         /* exit immediately if firmware has not been ioctl'd */
2068         if (!(sc->flags & IPW_FLAG_FW_CACHED)) {
2069                 ifp->if_flags &= ~IFF_UP;
2070                 return;
2071         }
2072
2073         ipw_stop(sc);
2074
2075         if (ipw_reset(sc) != 0) {
2076                 device_printf(sc->sc_dev, "could not reset adapter\n");
2077                 goto fail;
2078         }
2079
2080         if (ipw_load_ucode(sc, fw->ucode, fw->ucode_size) != 0) {
2081                 device_printf(sc->sc_dev, "could not load microcode\n");
2082                 goto fail;
2083         }
2084
2085         ipw_stop_master(sc);
2086
2087         /*
2088          * Setup tx, rx and status rings
2089          */
2090         CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_phys);
2091         CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
2092         CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
2093         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
2094         sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
2095         sc->txcur = 0; /* bd index to write to */
2096         sc->txfree = IPW_NTBD - 2;
2097
2098         CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_phys);
2099         CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
2100         CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
2101         CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
2102         sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
2103
2104         CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE, sc->status_phys);
2105
2106         if (ipw_load_firmware(sc, fw->main, fw->main_size) != 0) {
2107                 device_printf(sc->sc_dev, "could not load firmware\n");
2108                 goto fail;
2109         }
2110
2111         sc->flags |= IPW_FLAG_FW_INITED;
2112
2113         /* Retrieve information tables base addresses */
2114         sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2115         sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2116
2117         ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2118
2119         if (ipw_config(sc) != 0) {
2120                 device_printf(sc->sc_dev, "device configuration failed\n");
2121                 goto fail;
2122         }
2123
2124         ifp->if_flags &= ~IFF_OACTIVE;
2125         ifp->if_flags |= IFF_RUNNING;
2126
2127         return;
2128
2129 fail:   ifp->if_flags &= ~IFF_UP;
2130         ipw_stop(sc);
2131 }
2132
2133 static void
2134 ipw_stop(void *priv)
2135 {
2136         struct ipw_softc *sc = priv;
2137         struct ieee80211com *ic = &sc->sc_ic;
2138         struct ifnet *ifp = &ic->ic_if;
2139         int i;
2140
2141         ipw_stop_master(sc);
2142         CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2143
2144         /*
2145          * Release tx buffers
2146          */
2147         for (i = 0; i < IPW_NTBD; i++)
2148                 ipw_release_sbd(sc, &sc->stbd_list[i]);
2149
2150         ifp->if_timer = 0;
2151         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2152
2153         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2154 }
2155
2156 static int
2157 ipw_sysctl_stats(SYSCTL_HANDLER_ARGS)
2158 {
2159         struct ipw_softc *sc = arg1;
2160         u_int32_t i, size, buf[256];
2161
2162         (void)arg2; /* silence WARNS == 6 */
2163         (void)oidp; /* silence WARNS == 6 */
2164
2165         if (!(sc->flags & IPW_FLAG_FW_INITED)) {
2166                 bzero(buf, sizeof buf);
2167                 return SYSCTL_OUT(req, buf, sizeof buf);
2168         }
2169
2170         CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
2171
2172         size = min(CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA), 256);
2173         for (i = 1; i < size; i++)
2174                 buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
2175
2176         return SYSCTL_OUT(req, buf, sizeof buf);
2177 }
2178
2179 static int
2180 ipw_sysctl_radio(SYSCTL_HANDLER_ARGS)
2181 {
2182         struct ipw_softc *sc = arg1;
2183         int val;
2184
2185         (void)arg2; /* silence WARNS == 6 */
2186         (void)oidp; /* silence WARNS == 6 */
2187
2188         val = !((sc->flags & IPW_FLAG_HAS_RADIO_SWITCH) &&
2189                 (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED));
2190
2191         return SYSCTL_OUT(req, &val, sizeof val);
2192 }
2193
2194 static u_int32_t
2195 ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
2196 {
2197         return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
2198 }
2199
2200 static void
2201 ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
2202 {
2203         MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
2204 }
2205
2206 static int
2207 ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
2208 {
2209         u_int32_t addr, info;
2210         u_int16_t count, size;
2211         u_int32_t total;
2212
2213         /* addr[4] + count[2] + size[2] */
2214         addr = MEM_READ_4(sc, sc->table2_base + off);
2215         info = MEM_READ_4(sc, sc->table2_base + off + 4);
2216
2217         count = info >> 16;
2218         size = info & 0xffff;
2219         total = count * size;
2220
2221         if (total > *len) {
2222                 *len = total;
2223                 return EINVAL;
2224         }
2225
2226         *len = total;
2227         ipw_read_mem_1(sc, addr, buf, total);
2228
2229         return 0;
2230 }
2231
2232 static void
2233 ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2234     bus_size_t count)
2235 {
2236         for (; count > 0; offset++, datap++, count--) {
2237                 CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2238                 *datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2239         }
2240 }
2241
2242 static void
2243 ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2244     bus_size_t count)
2245 {
2246         for (; count > 0; offset++, datap++, count--) {
2247                 CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2248                 CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2249         }
2250 }