sys/dev/netif/ipw/if_ipw.c

   1 /*-
   2  * Copyright (c) 2004, 2005
   3  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice unmodified, this list of conditions, and the following
  10  *    disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  *
  27  *
  28  * $Id: if_ipw.c,v 1.7.2.1 2005/01/13 20:01:03 damien Exp $
  29  * $DragonFly: src/sys/dev/netif/ipw/Attic/if_ipw.c,v 1.7 2005/06/01 20:21:47 joerg Exp $
  30  */
  31
  32 /*-
  33  * Intel(R) PRO/Wireless 2100 MiniPCI driver
  34  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
  35  */
  36
  37 #include <sys/param.h>
  38 #include <sys/sysctl.h>
  39 #include <sys/sockio.h>
  40 #include <sys/mbuf.h>
  41 #include <sys/kernel.h>
  42 #include <sys/socket.h>
  43 #include <sys/systm.h>
  44 #include <sys/malloc.h>
  45 #include <sys/module.h>
  46 #include <sys/bus.h>
  47 #include <sys/endian.h>
  48 #include <sys/proc.h>
  49 #include <sys/ucred.h>
  50
  51 #include <machine/bus.h>
  52 #include <machine/resource.h>
  53 #include <machine/clock.h>
  54 #include <sys/rman.h>
  55
  56 #include <bus/pci/pcireg.h>
  57 #include <bus/pci/pcivar.h>
  58
  59 #include <net/bpf.h>
  60 #include <net/if.h>
  61 #include <net/if_arp.h>
  62 #include <net/ethernet.h>
  63 #include <net/if_dl.h>
  64 #include <net/if_media.h>
  65 #include <net/if_types.h>
  66 #include <net/ifq_var.h>
  67
  68 #include <netinet/in.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/in_var.h>
  71 #include <netinet/ip.h>
  72 #include <netinet/if_ether.h>
  73
  74 #include <netproto/802_11/ieee80211_var.h>
  75 #include <netproto/802_11/ieee80211_ioctl.h>
  76 #include <netproto/802_11/ieee80211_radiotap.h>
  77 #include <netproto/802_11/if_wavelan_ieee.h>
  78
  79 #include "if_ipwreg.h"
  80 #include "if_ipwvar.h"
  81
  82 #ifdef IPW_DEBUG
  83 #define DPRINTF(x)      if (ipw_debug > 0) printf x
  84 #define DPRINTFN(n, x)  if (ipw_debug >= (n)) printf x
  85 int ipw_debug = 0;
  86 SYSCTL_INT(_debug, OID_AUTO, ipw, CTLFLAG_RW, &ipw_debug, 0, "ipw debug level");
  87 #else
  88 #define DPRINTF(x)
  89 #define DPRINTFN(n, x)
  90 #endif
  91
  92 MODULE_DEPEND(ipw, pci,  1, 1, 1);
  93 MODULE_DEPEND(ipw, wlan, 1, 1, 1);
  94
  95 struct ipw_ident {
  96         u_int16_t       vendor;
  97         u_int16_t       device;
  98         const char      *name;
  99 };
 100
 101 static const struct ipw_ident ipw_ident_table[] = {
 102         { 0x8086, 0x1043, "Intel(R) PRO/Wireless 2100 MiniPCI" },
 103
 104         { 0, 0, NULL }
 105 };
 106
 107 static const struct ieee80211_rateset ipw_rateset_11b =
 108         { 4, { 2, 4, 11, 22 } };
 109
 110 static int              ipw_dma_alloc(device_t);
 111 static void             ipw_release(struct ipw_softc *);
 112 static int              ipw_media_change(struct ifnet *);
 113 static void             ipw_media_status(struct ifnet *, struct ifmediareq *);
 114 static int              ipw_newstate(struct ieee80211com *,
 115                             enum ieee80211_state, int);
 116 static u_int16_t        ipw_read_prom_word(struct ipw_softc *, u_int8_t);
 117 static void             ipw_command_intr(struct ipw_softc *,
 118                             struct ipw_soft_buf *);
 119 static void             ipw_newstate_intr(struct ipw_softc *,
 120                             struct ipw_soft_buf *);
 121 static void             ipw_data_intr(struct ipw_softc *, struct ipw_status *,
 122                             struct ipw_soft_bd *, struct ipw_soft_buf *);
 123 static void             ipw_notification_intr(struct ipw_softc *,
 124                             struct ipw_soft_buf *);
 125 static void             ipw_rx_intr(struct ipw_softc *);
 126 static void             ipw_release_sbd(struct ipw_softc *,
 127                             struct ipw_soft_bd *);
 128 static void             ipw_tx_intr(struct ipw_softc *);
 129 static void             ipw_intr(void *);
 130 static void             ipw_dma_map_txbuf(void *, bus_dma_segment_t *, int,
 131                             bus_size_t, int);
 132 static void             ipw_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 133 static int              ipw_cmd(struct ipw_softc *, u_int32_t, void *,
 134                             u_int32_t);
 135 static int              ipw_tx_start(struct ifnet *, struct mbuf *,
 136                             struct ieee80211_node *);
 137 static void             ipw_start(struct ifnet *);
 138 static void             ipw_watchdog(struct ifnet *);
 139 static int              ipw_ioctl(struct ifnet *, u_long, caddr_t,
 140                                 struct ucred *cr);
 141 static void             ipw_stop_master(struct ipw_softc *);
 142 static int              ipw_reset(struct ipw_softc *);
 143 static int              ipw_load_ucode(struct ipw_softc *, u_char *, int);
 144 static int              ipw_load_firmware(struct ipw_softc *, u_char *, int);
 145 static int              ipw_cache_firmware(struct ipw_softc *, void *);
 146 static void             ipw_free_firmware(struct ipw_softc *);
 147 static int              ipw_config(struct ipw_softc *);
 148 static void             ipw_init(void *);
 149 static void             ipw_stop(void *);
 150 static int              ipw_sysctl_stats(SYSCTL_HANDLER_ARGS);
 151 static int              ipw_sysctl_radio(SYSCTL_HANDLER_ARGS);
 152 static u_int32_t        ipw_read_table1(struct ipw_softc *, u_int32_t);
 153 static void             ipw_write_table1(struct ipw_softc *, u_int32_t,
 154                             u_int32_t);
 155 static int              ipw_read_table2(struct ipw_softc *, u_int32_t, void *,
 156                             u_int32_t *);
 157 static void             ipw_read_mem_1(struct ipw_softc *, bus_size_t,
 158                             u_int8_t *, bus_size_t);
 159 static void             ipw_write_mem_1(struct ipw_softc *, bus_size_t,
 160                             u_int8_t *, bus_size_t);
 161
 162 static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
 163 {
 164         CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
 165         return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
 166 }
 167
 168 static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
 169 {
 170         CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
 171         return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
 172 }
 173
 174 static int ipw_probe(device_t);
 175 static int ipw_attach(device_t);
 176 static int ipw_detach(device_t);
 177 static int ipw_shutdown(device_t);
 178 static int ipw_suspend(device_t);
 179 static int ipw_resume(device_t);
 180
 181 static device_method_t ipw_methods[] = {
 182         /* Device interface */
 183         DEVMETHOD(device_probe,         ipw_probe),
 184         DEVMETHOD(device_attach,        ipw_attach),
 185         DEVMETHOD(device_detach,        ipw_detach),
 186         DEVMETHOD(device_shutdown,      ipw_shutdown),
 187         DEVMETHOD(device_suspend,       ipw_suspend),
 188         DEVMETHOD(device_resume,        ipw_resume),
 189
 190         { 0, 0 }
 191 };
 192
 193 static DEFINE_CLASS_0(ipw, ipw_driver, ipw_methods, sizeof(struct ipw_softc));
 194 static devclass_t ipw_devclass;
 195
 196 DRIVER_MODULE(ipw, pci, ipw_driver, ipw_devclass, 0, 0);
 197
 198 static int
 199 ipw_probe(device_t dev)
 200 {
 201         const struct ipw_ident *ident;
 202
 203         for (ident = ipw_ident_table; ident->name != NULL; ident++) {
 204                 if (pci_get_vendor(dev) == ident->vendor &&
 205                     pci_get_device(dev) == ident->device) {
 206                         device_set_desc(dev, ident->name);
 207                         return 0;
 208                 }
 209         }
 210         return ENXIO;
 211 }
 212
 213 /* Base Address Register */
 214 #define IPW_PCI_BAR0    0x10
 215
 216 static int
 217 ipw_attach(device_t dev)
 218 {
 219         struct ipw_softc *sc = device_get_softc(dev);
 220         struct ieee80211com *ic = &sc->sc_ic;
 221         struct ifnet *ifp = &ic->ic_if;
 222         struct sysctl_oid *sysctl_tree;
 223         u_int16_t val;
 224         int error, rid, i;
 225
 226         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 227                 device_printf(dev, "chip is in D%d power mode "
 228                     "-- setting to D0\n", pci_get_powerstate(dev));
 229                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 230         }
 231
 232         pci_write_config(dev, 0x41, 0, 1);
 233
 234         /* enable bus-mastering */
 235         pci_enable_busmaster(dev);
 236
 237         /* map the register window */
 238         rid = IPW_PCI_BAR0;
 239         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid, RF_ACTIVE);
 240         if (sc->mem == NULL) {
 241                 device_printf(dev, "could not allocate memory resource\n");
 242                 goto fail;
 243         }
 244
 245         sc->sc_st = rman_get_bustag(sc->mem);
 246         sc->sc_sh = rman_get_bushandle(sc->mem);
 247
 248         rid = 0;
 249         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
 250             RF_SHAREABLE);
 251         if (sc->irq == NULL) {
 252                 device_printf(dev, "could not allocate interrupt resource\n");
 253                 goto fail;
 254         }
 255
 256         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 257
 258         if (ipw_reset(sc) != 0) {
 259                 device_printf(dev, "could not reset adapter\n");
 260                 goto fail;
 261         }
 262
 263         sysctl_ctx_init(&sc->sysctl_ctx);
 264         sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
 265                 SYSCTL_STATIC_CHILDREN(_hw),
 266                 OID_AUTO,
 267                 device_get_nameunit(dev),
 268                 CTLFLAG_RD,
 269                 0, "");
 270
 271         if (ipw_dma_alloc(dev) != 0) {
 272                 device_printf(dev, "could not allocate DMA resources\n");
 273                 goto fail;
 274         }
 275
 276         ic->ic_phytype = IEEE80211_T_DS;
 277         ic->ic_opmode = IEEE80211_M_STA;
 278         ic->ic_state = IEEE80211_S_INIT;
 279
 280         /* set device capabilities */
 281        ic->ic_caps = IEEE80211_C_SHPREAMBLE | IEEE80211_C_TXPMGT |
 282            IEEE80211_C_PMGT | IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
 283            IEEE80211_C_WEP;
 284
 285         /* read MAC address from EEPROM */
 286         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
 287         ic->ic_myaddr[0] = val >> 8;
 288         ic->ic_myaddr[1] = val & 0xff;
 289         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
 290         ic->ic_myaddr[2] = val >> 8;
 291         ic->ic_myaddr[3] = val & 0xff;
 292         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
 293         ic->ic_myaddr[4] = val >> 8;
 294         ic->ic_myaddr[5] = val & 0xff;
 295
 296         /* set supported .11b rates */
 297         ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
 298
 299         /* set supported .11b channels (read from EEPROM) */
 300         if ((val = ipw_read_prom_word(sc, IPW_EEPROM_CHANNEL_LIST)) == 0)
 301                 val = 0x7ff; /* default to channels 1-11 */
 302         val <<= 1;
 303         for (i = 1; i < 16; i++) {
 304                 if (val & (1 << i)) {
 305                         ic->ic_channels[i].ic_freq =
 306                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
 307                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
 308                 }
 309         }
 310
 311         /* check support for radio transmitter switch in EEPROM */
 312         if (!(ipw_read_prom_word(sc, IPW_EEPROM_RADIO) & 8))
 313                 sc->flags |= IPW_FLAG_HAS_RADIO_SWITCH;
 314
 315         /* default to authmode OPEN */
 316         sc->authmode = IEEE80211_AUTH_OPEN;
 317
 318         /* IBSS channel undefined for now */
 319         ic->ic_ibss_chan = &ic->ic_channels[0];
 320
 321         ifp->if_softc = sc;
 322         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 323         ifp->if_init = ipw_init;
 324         ifp->if_ioctl = ipw_ioctl;
 325         ifp->if_start = ipw_start;
 326         ifp->if_watchdog = ipw_watchdog;
 327         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 328         ifq_set_ready(&ifp->if_snd);
 329
 330         ieee80211_ifattach(ifp);
 331         /* override state transition machine */
 332         sc->sc_newstate = ic->ic_newstate;
 333         ic->ic_newstate = ipw_newstate;
 334         ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
 335
 336         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 337             sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
 338
 339         sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
 340         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
 341         sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
 342
 343         sc->sc_txtap_len = sizeof sc->sc_txtapu;
 344         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
 345         sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
 346
 347         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 348             SYSCTL_CHILDREN(sysctl_tree), OID_AUTO, "radio",
 349             CTLTYPE_INT | CTLFLAG_RD, sc, 0, ipw_sysctl_radio, "I",
 350             "Radio transmitter switch");
 351
 352         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 353             SYSCTL_CHILDREN(sysctl_tree), OID_AUTO, "stats",
 354             CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, ipw_sysctl_stats, "S",
 355             "Statistics");
 356
 357         /*
 358          * Hook our interrupt after all initialization is complete
 359          */
 360         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
 361                                ipw_intr, sc, &sc->sc_ih, NULL);
 362         if (error != 0) {
 363                 device_printf(dev, "could not set up interrupt\n");
 364                 goto fail;
 365         }
 366
 367         return 0;
 368
 369 fail:   ipw_detach(dev);
 370         return ENXIO;
 371 }
 372
 373 static int
 374 ipw_detach(device_t dev)
 375 {
 376         struct ipw_softc *sc = device_get_softc(dev);
 377         struct ifnet *ifp = &sc->sc_ic.ic_if;
 378         IPW_LOCK_DECL();
 379
 380         IPW_LOCK(sc);
 381
 382         ipw_stop(sc);
 383         ipw_free_firmware(sc);
 384
 385         IPW_UNLOCK(sc);
 386
 387         bpfdetach(ifp);
 388
 389         ieee80211_ifdetach(ifp);
 390
 391         ipw_release(sc);
 392
 393         if (sc->irq != NULL) {
 394                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
 395                 bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq);
 396         }
 397
 398         if (sc->mem != NULL)
 399                 bus_release_resource(dev, SYS_RES_MEMORY, IPW_PCI_BAR0,
 400                     sc->mem);
 401
 402         sysctl_ctx_free(&sc->sysctl_ctx);
 403
 404         return 0;
 405 }
 406
 407 static int
 408 ipw_dma_alloc(device_t dev)
 409 {
 410         struct ipw_soft_bd *sbd;
 411         struct ipw_soft_hdr *shdr;
 412         struct ipw_soft_buf *sbuf;
 413         bus_addr_t physaddr;
 414         int error, i;
 415         struct ipw_softc *sc;
 416
 417         sc = device_get_softc(dev);
 418         /*
 419          * Allocate and map tx ring
 420          */
 421         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 422             BUS_SPACE_MAXADDR, NULL, NULL, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
 423             &sc->tbd_dmat);
 424         if (error != 0) {
 425                 device_printf(dev, "could not create tx ring DMA tag\n");
 426                 goto fail;
 427         }
 428
 429         error = bus_dmamem_alloc(sc->tbd_dmat, (void **)&sc->tbd_list,
 430             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->tbd_map);
 431         if (error != 0) {
 432                 device_printf(dev, "could not allocate tx ring DMA memory\n");
 433                 goto fail;
 434         }
 435
 436         error = bus_dmamap_load(sc->tbd_dmat, sc->tbd_map, sc->tbd_list,
 437             IPW_TBD_SZ, ipw_dma_map_addr, &sc->tbd_phys, 0);
 438         if (error != 0) {
 439                 device_printf(dev, "could not map tx ring DMA memory\n");
 440                 goto fail;
 441         }
 442
 443         /*
 444          * Allocate and map rx ring
 445          */
 446         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 447             BUS_SPACE_MAXADDR, NULL, NULL, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
 448             &sc->rbd_dmat);
 449         if (error != 0) {
 450                 device_printf(dev, "could not create rx ring DMA tag\n");
 451                 goto fail;
 452         }
 453
 454         error = bus_dmamem_alloc(sc->rbd_dmat, (void **)&sc->rbd_list,
 455             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->rbd_map);
 456         if (error != 0) {
 457                 device_printf(dev, "could not allocate rx ring DMA memory\n");
 458                 goto fail;
 459         }
 460
 461         error = bus_dmamap_load(sc->rbd_dmat, sc->rbd_map, sc->rbd_list,
 462             IPW_RBD_SZ, ipw_dma_map_addr, &sc->rbd_phys, 0);
 463         if (error != 0) {
 464                 device_printf(dev, "could not map rx ring DMA memory\n");
 465                 goto fail;
 466         }
 467
 468         /*
 469          * Allocate and map status ring
 470          */
 471         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 472             BUS_SPACE_MAXADDR, NULL, NULL, IPW_STATUS_SZ, 1, IPW_STATUS_SZ, 0,
 473             &sc->status_dmat);
 474         if (error != 0) {
 475                 device_printf(dev, "could not create status ring DMA tag\n");
 476                 goto fail;
 477         }
 478
 479         error = bus_dmamem_alloc(sc->status_dmat, (void **)&sc->status_list,
 480             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->status_map);
 481         if (error != 0) {
 482                 device_printf(dev,
 483                     "could not allocate status ring DMA memory\n");
 484                 goto fail;
 485         }
 486
 487         error = bus_dmamap_load(sc->status_dmat, sc->status_map,
 488             sc->status_list, IPW_STATUS_SZ, ipw_dma_map_addr, &sc->status_phys,
 489             0);
 490         if (error != 0) {
 491                 device_printf(dev, "could not map status ring DMA memory\n");
 492                 goto fail;
 493         }
 494
 495         /*
 496          * Allocate command DMA map
 497          */
 498         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 499             BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_cmd), 1,
 500             sizeof (struct ipw_cmd), 0, &sc->cmd_dmat);
 501         if (error != 0) {
 502                 device_printf(dev, "could not create command DMA tag\n");
 503                 goto fail;
 504         }
 505
 506         error = bus_dmamap_create(sc->cmd_dmat, 0, &sc->cmd_map);
 507         if (error != 0) {
 508                 device_printf(dev, "could not create command DMA map\n");
 509                 goto fail;
 510         }
 511
 512         /*
 513          * Allocate headers DMA maps
 514          */
 515         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 516             BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_hdr), 1,
 517             sizeof (struct ipw_hdr), 0, &sc->hdr_dmat);
 518         if (error != 0) {
 519                 device_printf(dev, "could not create header DMA tag\n");
 520                 goto fail;
 521         }
 522
 523         SLIST_INIT(&sc->free_shdr);
 524         for (i = 0; i < IPW_NDATA; i++) {
 525                 shdr = &sc->shdr_list[i];
 526                 error = bus_dmamap_create(sc->hdr_dmat, 0, &shdr->map);
 527                 if (error != 0) {
 528                         device_printf(dev, "could not create header DMA map\n");
 529                         goto fail;
 530                 }
 531                 SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
 532         }
 533
 534         /*
 535          * Allocate tx buffers DMA maps
 536          */
 537         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 538             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IPW_MAX_NSEG, MCLBYTES, 0,
 539             &sc->txbuf_dmat);
 540         if (error != 0) {
 541                 device_printf(dev, "could not create tx DMA tag\n");
 542                 goto fail;
 543         }
 544
 545         SLIST_INIT(&sc->free_sbuf);
 546         for (i = 0; i < IPW_NDATA; i++) {
 547                 sbuf = &sc->tx_sbuf_list[i];
 548                 error = bus_dmamap_create(sc->txbuf_dmat, 0, &sbuf->map);
 549                 if (error != 0) {
 550                         device_printf(dev, "could not create tx DMA map\n");
 551                         goto fail;
 552                 }
 553                 SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
 554         }
 555
 556         /*
 557          * Initialize tx ring
 558          */
 559         for (i = 0; i < IPW_NTBD; i++) {
 560                 sbd = &sc->stbd_list[i];
 561                 sbd->bd = &sc->tbd_list[i];
 562                 sbd->type = IPW_SBD_TYPE_NOASSOC;
 563         }
 564
 565         /*
 566          * Pre-allocate rx buffers and DMA maps
 567          */
 568         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 569             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IPW_NRBD, MCLBYTES, 0,
 570             &sc->rxbuf_dmat);
 571         if (error != 0) {
 572                 device_printf(dev, "could not create rx DMA tag\n");
 573                 goto fail;
 574         }
 575
 576         for (i = 0; i < IPW_NRBD; i++) {
 577                 sbd = &sc->srbd_list[i];
 578                 sbuf = &sc->rx_sbuf_list[i];
 579                 sbd->bd = &sc->rbd_list[i];
 580
 581                 sbuf->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 582                 if (sbuf->m == NULL) {
 583                         device_printf(dev, "could not allocate rx mbuf\n");
 584                         error = ENOMEM;
 585                         goto fail;
 586                 }
 587
 588                 error = bus_dmamap_create(sc->rxbuf_dmat, 0, &sbuf->map);
 589                 if (error != 0) {
 590                         device_printf(dev, "could not create rx DMA map\n");
 591                         goto fail;
 592                 }
 593
 594                 error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map,
 595                     mtod(sbuf->m, void *), MCLBYTES, ipw_dma_map_addr,
 596                     &physaddr, 0);
 597                 if (error != 0) {
 598                         device_printf(dev, "could not map rx DMA memory\n");
 599                         goto fail;
 600                 }
 601
 602                 sbd->type = IPW_SBD_TYPE_DATA;
 603                 sbd->priv = sbuf;
 604                 sbd->bd->physaddr = htole32(physaddr);
 605                 sbd->bd->len = htole32(MCLBYTES);
 606         }
 607
 608         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
 609
 610         return 0;
 611
 612 fail:   ipw_release(sc);
 613         return error;
 614 }
 615
 616 static void
 617 ipw_release(struct ipw_softc *sc)
 618 {
 619         struct ipw_soft_buf *sbuf;
 620         int i;
 621
 622         if (sc->tbd_dmat != NULL) {
 623                 if (sc->stbd_list != NULL) {
 624                         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map,
 625                             BUS_DMASYNC_POSTWRITE);
 626                         bus_dmamap_unload(sc->tbd_dmat, sc->tbd_map);
 627                         bus_dmamem_free(sc->tbd_dmat, sc->tbd_list,
 628                             sc->tbd_map);
 629                 }
 630                 bus_dma_tag_destroy(sc->tbd_dmat);
 631         }
 632
 633         if (sc->rbd_dmat != NULL) {
 634                 if (sc->rbd_list != NULL) {
 635                         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map,
 636                             BUS_DMASYNC_POSTWRITE);
 637                         bus_dmamap_unload(sc->rbd_dmat, sc->rbd_map);
 638                         bus_dmamem_free(sc->rbd_dmat, sc->rbd_list,
 639                             sc->rbd_map);
 640                 }
 641                 bus_dma_tag_destroy(sc->rbd_dmat);
 642         }
 643
 644         if (sc->status_dmat != NULL) {
 645                 if (sc->status_list != NULL) {
 646                         bus_dmamap_sync(sc->status_dmat, sc->status_map,
 647                             BUS_DMASYNC_POSTWRITE);
 648                         bus_dmamap_unload(sc->status_dmat, sc->status_map);
 649                         bus_dmamem_free(sc->status_dmat, sc->status_list,
 650                             sc->status_map);
 651                 }
 652                 bus_dma_tag_destroy(sc->status_dmat);
 653         }
 654
 655         for (i = 0; i < IPW_NTBD; i++)
 656                 ipw_release_sbd(sc, &sc->stbd_list[i]);
 657
 658         if (sc->cmd_dmat != NULL) {
 659                 bus_dmamap_destroy(sc->cmd_dmat, sc->cmd_map);
 660                 bus_dma_tag_destroy(sc->cmd_dmat);
 661         }
 662
 663         if (sc->hdr_dmat != NULL) {
 664                 for (i = 0; i < IPW_NDATA; i++)
 665                         bus_dmamap_destroy(sc->hdr_dmat, sc->shdr_list[i].map);
 666                 bus_dma_tag_destroy(sc->hdr_dmat);
 667         }
 668
 669         if (sc->txbuf_dmat != NULL) {
 670                 for (i = 0; i < IPW_NDATA; i++) {
 671                         bus_dmamap_destroy(sc->txbuf_dmat,
 672                             sc->tx_sbuf_list[i].map);
 673                 }
 674                 bus_dma_tag_destroy(sc->txbuf_dmat);
 675         }
 676
 677         if (sc->rxbuf_dmat != NULL) {
 678                 for (i = 0; i < IPW_NRBD; i++) {
 679                         sbuf = &sc->rx_sbuf_list[i];
 680                         if (sbuf->m != NULL) {
 681                                 bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map,
 682                                     BUS_DMASYNC_POSTREAD);
 683                                 bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
 684                                 m_freem(sbuf->m);
 685                         }
 686                         bus_dmamap_destroy(sc->rxbuf_dmat, sbuf->map);
 687                 }
 688                 bus_dma_tag_destroy(sc->rxbuf_dmat);
 689         }
 690 }
 691
 692 static int
 693 ipw_shutdown(device_t dev)
 694 {
 695         struct ipw_softc *sc = device_get_softc(dev);
 696         IPW_LOCK_DECL();
 697
 698         IPW_LOCK(sc);
 699
 700         ipw_stop(sc);
 701
 702         IPW_UNLOCK(sc);
 703
 704         return 0;
 705 }
 706
 707 static int
 708 ipw_suspend(device_t dev)
 709 {
 710         struct ipw_softc *sc = device_get_softc(dev);
 711         IPW_LOCK_DECL();
 712
 713         IPW_LOCK(sc);
 714
 715         ipw_stop(sc);
 716
 717         IPW_UNLOCK(sc);
 718
 719         return 0;
 720 }
 721
 722 static int
 723 ipw_resume(device_t dev)
 724 {
 725         struct ipw_softc *sc = device_get_softc(dev);
 726         struct ifnet *ifp = &sc->sc_ic.ic_if;
 727         IPW_LOCK_DECL();
 728
 729         IPW_LOCK(sc);
 730
 731         pci_write_config(dev, 0x41, 0, 1);
 732
 733         if (ifp->if_flags & IFF_UP) {
 734                 ifp->if_init(ifp->if_softc);
 735                 if (ifp->if_flags & IFF_RUNNING)
 736                         ifp->if_start(ifp);
 737         }
 738
 739         IPW_UNLOCK(sc);
 740
 741         return 0;
 742 }
 743
 744 static int
 745 ipw_media_change(struct ifnet *ifp)
 746 {
 747         struct ipw_softc *sc = ifp->if_softc;
 748         int error;
 749         IPW_LOCK_DECL();
 750
 751         IPW_LOCK(sc);
 752
 753         error = ieee80211_media_change(ifp);
 754         if (error != ENETRESET) {
 755                 IPW_UNLOCK(sc);
 756                 return error;
 757         }
 758
 759         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
 760                 ipw_init(sc);
 761
 762         IPW_UNLOCK(sc);
 763
 764         return 0;
 765 }
 766
 767 static void
 768 ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
 769 {
 770         struct ipw_softc *sc = ifp->if_softc;
 771         struct ieee80211com *ic = &sc->sc_ic;
 772 #define N(a)    (sizeof (a) / sizeof (a[0]))
 773         static const struct {
 774                 u_int32_t       val;
 775                 int             rate;
 776         } rates[] = {
 777                 { IPW_RATE_DS1,   2 },
 778                 { IPW_RATE_DS2,   4 },
 779                 { IPW_RATE_DS5,  11 },
 780                 { IPW_RATE_DS11, 22 },
 781         };
 782         u_int32_t val, i;
 783         int rate;
 784
 785         imr->ifm_status = IFM_AVALID;
 786         imr->ifm_active = IFM_IEEE80211;
 787         if (ic->ic_state == IEEE80211_S_RUN)
 788                 imr->ifm_status |= IFM_ACTIVE;
 789
 790         /* read current transmission rate from adapter */
 791         val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE) & 0xf;
 792
 793         /* convert rate to 802.11 rate */
 794         for (i = 0; i < N(rates) && rates[i].val != val; i++);
 795         rate = (i < N(rates)) ? rates[i].rate : 0;
 796
 797         imr->ifm_active |= IFM_IEEE80211_11B;
 798         imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
 799         switch (ic->ic_opmode) {
 800         case IEEE80211_M_STA:
 801                 break;
 802
 803         case IEEE80211_M_IBSS:
 804                 imr->ifm_active |= IFM_IEEE80211_IBSS;
 805                 break;
 806
 807         case IEEE80211_M_MONITOR:
 808                 imr->ifm_active |= IFM_IEEE80211_MONITOR;
 809                 break;
 810
 811         case IEEE80211_M_AHDEMO:
 812         case IEEE80211_M_HOSTAP:
 813                 /* should not get there */
 814                 break;
 815         }
 816 #undef N
 817 }
 818
 819 static int
 820 ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg __unused)
 821 {
 822         struct ipw_softc *sc = ic->ic_softc;
 823         struct ieee80211_node *ni = ic->ic_bss;
 824         u_int32_t len;
 825         u_int8_t val;
 826
 827         switch (nstate) {
 828         case IEEE80211_S_RUN:
 829                 len = IEEE80211_NWID_LEN;
 830                 ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
 831                 ni->ni_esslen = len;
 832
 833                 val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
 834                 ni->ni_chan = &ic->ic_channels[val];
 835
 836                 DELAY(100); /* firmware needs a short delay here */
 837
 838                 len = IEEE80211_ADDR_LEN;
 839                 ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
 840                 IEEE80211_ADDR_COPY(ni->ni_macaddr, ni->ni_bssid);
 841                 break;
 842
 843         case IEEE80211_S_INIT:
 844         case IEEE80211_S_SCAN:
 845         case IEEE80211_S_AUTH:
 846         case IEEE80211_S_ASSOC:
 847                 break;
 848         }
 849
 850         ic->ic_state = nstate;
 851         return 0;
 852 }
 853
 854 /*
 855  * Read 16 bits at address 'addr' from the Microwire EEPROM.
 856  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
 857  */
 858 static u_int16_t
 859 ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
 860 {
 861         u_int32_t tmp;
 862         u_int16_t val;
 863         int n;
 864
 865         /* Clock C once before the first command */
 866         IPW_EEPROM_CTL(sc, 0);
 867         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 868         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 869         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 870
 871         /* Write start bit (1) */
 872         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
 873         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
 874
 875         /* Write READ opcode (10) */
 876         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
 877         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
 878         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 879         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 880
 881         /* Write address A7-A0 */
 882         for (n = 7; n >= 0; n--) {
 883                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
 884                     (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
 885                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
 886                     (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
 887         }
 888
 889         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 890
 891         /* Read data Q15-Q0 */
 892         val = 0;
 893         for (n = 15; n >= 0; n--) {
 894                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 895                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 896                 tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
 897                 val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
 898         }
 899
 900         IPW_EEPROM_CTL(sc, 0);
 901
 902         /* Clear Chip Select and clock C */
 903         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 904         IPW_EEPROM_CTL(sc, 0);
 905         IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
 906
 907         return le16toh(val);
 908 }
 909
 910 static void
 911 ipw_scan_result(struct ipw_softc *sc)
 912 {
 913         struct ieee80211com *ic = &sc->sc_ic;
 914         struct ieee80211_node *ni;
 915         u_int32_t i, cnt, off;
 916         struct ipw_node ap;
 917
 918         /* flush previously seen access points */
 919         ieee80211_free_allnodes(ic);
 920
 921         cnt = ipw_read_table1(sc, IPW_INFO_APS_CNT);
 922         off = ipw_read_table1(sc, IPW_INFO_APS_BASE);
 923
 924         DPRINTF(("Found %u APs\n", cnt));
 925
 926         for (i = 0; i < cnt; i++) {
 927                 ipw_read_mem_1(sc, off, (u_int8_t *)&ap, sizeof ap);
 928                 off += sizeof ap;
 929
 930 #ifdef IPW_DEBUG
 931                 if (ipw_debug >= 2) {
 932                         u_char *p = (u_char *)&ap;
 933                         int j;
 934
 935                         printf("AP%u\n", i);
 936                         for (j = 0; j < sizeof ap; j++)
 937                                 printf("%02x", *p++);
 938                         printf("\n");
 939                 }
 940 #endif
 941
 942                 ni = ieee80211_lookup_node(ic, ap.bssid,
 943                     &ic->ic_channels[ap.chan]);
 944                 if (ni != NULL)
 945                         continue;
 946
 947                 ni = ieee80211_alloc_node(ic, ap.bssid);
 948                 if (ni == NULL)
 949                         return;
 950
 951                 IEEE80211_ADDR_COPY(ni->ni_bssid, ap.bssid);
 952                 ni->ni_rssi = ap.rssi;
 953                 ni->ni_intval = le16toh(ap.intval);
 954                 ni->ni_capinfo = le16toh(ap.capinfo);
 955                 ni->ni_chan = &ic->ic_channels[ap.chan];
 956                 ni->ni_esslen = ap.esslen;
 957                 bcopy(ap.essid, ni->ni_essid, IEEE80211_NWID_LEN);
 958         }
 959 }
 960
 961 static void
 962 ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
 963 {
 964         struct ipw_cmd *cmd;
 965
 966         cmd = mtod(sbuf->m, struct ipw_cmd *);
 967
 968         DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
 969             le32toh(cmd->type), le32toh(cmd->subtype), le32toh(cmd->seq),
 970             le32toh(cmd->len), le32toh(cmd->status)));
 971
 972         wakeup(sc);
 973 }
 974
 975 static void
 976 ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
 977 {
 978         struct ieee80211com *ic = &sc->sc_ic;
 979         u_int32_t state;
 980
 981         state = le32toh(*mtod(sbuf->m, u_int32_t *));
 982
 983         DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
 984
 985         switch (state) {
 986         case IPW_STATE_ASSOCIATED:
 987                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 988                 break;
 989
 990         case IPW_STATE_SCANNING:
 991                 /* don't leave run state on background scan */
 992                 if (ic->ic_state != IEEE80211_S_RUN)
 993                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 994                 break;
 995
 996         case IPW_STATE_SCAN_COMPLETE:
 997                 ipw_scan_result(sc);
 998                 break;
 999
1000         case IPW_STATE_ASSOCIATION_LOST:
1001                 ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1002                 break;
1003
1004         case IPW_STATE_RADIO_DISABLED:
1005                 sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1006                 ipw_stop(sc);
1007                 break;
1008         }
1009 }
1010
1011 static void
1012 ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
1013     struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
1014 {
1015         struct ieee80211com *ic = &sc->sc_ic;
1016         struct ifnet *ifp = &ic->ic_if;
1017         struct mbuf *m;
1018         struct ieee80211_frame *wh;
1019         struct ieee80211_node *ni;
1020         bus_addr_t physaddr;
1021         int error;
1022
1023         DPRINTFN(5, ("RX!DATA!%u!%u\n", le32toh(status->len), status->rssi));
1024
1025         if (le32toh(status->len) < sizeof (struct ieee80211_frame_min) ||
1026             le32toh(status->len) > MCLBYTES) {
1027                 if_printf(ifp, "bad frame length\n");
1028                 return;
1029         }
1030
1031         bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
1032
1033         /* Finalize mbuf */
1034         m = sbuf->m;
1035         m->m_pkthdr.rcvif = ifp;
1036         m->m_pkthdr.len = m->m_len = le32toh(status->len);
1037
1038         if (sc->sc_drvbpf != NULL) {
1039                 struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
1040
1041                 tap->wr_flags = 0;
1042                 tap->wr_antsignal = status->rssi;
1043                 tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1044                 tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1045
1046                 bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1047         }
1048
1049         wh = mtod(m, struct ieee80211_frame *);
1050
1051         if (ic->ic_opmode != IEEE80211_M_STA) {
1052                 ni = ieee80211_find_node(ic, wh->i_addr2);
1053                 if (ni == NULL)
1054                         ni = ieee80211_ref_node(ic->ic_bss);
1055         } else
1056                 ni = ieee80211_ref_node(ic->ic_bss);
1057
1058         /* Send the frame to the upper layer */
1059         ieee80211_input(ifp, m, ni, status->rssi, 0);
1060
1061         if (ni == ic->ic_bss)
1062                 ieee80211_unref_node(&ni);
1063         else
1064                 ieee80211_free_node(ic, ni);
1065
1066         m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1067         if (m == NULL) {
1068                 if_printf(ifp, "could not allocate rx mbuf\n");
1069                 sbuf->m = NULL;
1070                 return;
1071         }
1072
1073         error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map, mtod(m, void *),
1074             MCLBYTES, ipw_dma_map_addr, &physaddr, 0);
1075         if (error != 0) {
1076                 if_printf(ifp, "could not map rx DMA memory\n");
1077                 m_freem(m);
1078                 sbuf->m = NULL;
1079                 return;
1080         }
1081
1082         sbuf->m = m;
1083         sbd->bd->physaddr = htole32(physaddr);
1084 }
1085
1086 static void
1087 ipw_notification_intr(struct ipw_softc *sc __unused, struct ipw_soft_buf *sbuf __unused)
1088 {
1089         DPRINTFN(2, ("RX!NOTIFICATION\n"));
1090 }
1091
1092 static void
1093 ipw_rx_intr(struct ipw_softc *sc)
1094 {
1095         struct ipw_status *status;
1096         struct ipw_soft_bd *sbd;
1097         struct ipw_soft_buf *sbuf;
1098         u_int32_t r, i;
1099
1100         if (!(sc->flags & IPW_FLAG_FW_INITED))
1101                 return;
1102
1103         r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
1104
1105         bus_dmamap_sync(sc->status_dmat, sc->status_map, BUS_DMASYNC_POSTREAD);
1106
1107         for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
1108
1109                 status = &sc->status_list[i];
1110                 sbd = &sc->srbd_list[i];
1111                 sbuf = sbd->priv;
1112
1113                 bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map,
1114                     BUS_DMASYNC_POSTREAD);
1115
1116                 switch (le16toh(status->code) & 0xf) {
1117                 case IPW_STATUS_CODE_COMMAND:
1118                         ipw_command_intr(sc, sbuf);
1119                         break;
1120
1121                 case IPW_STATUS_CODE_NEWSTATE:
1122                         ipw_newstate_intr(sc, sbuf);
1123                         break;
1124
1125                 case IPW_STATUS_CODE_DATA_802_3:
1126                 case IPW_STATUS_CODE_DATA_802_11:
1127                         ipw_data_intr(sc, status, sbd, sbuf);
1128                         break;
1129
1130                 case IPW_STATUS_CODE_NOTIFICATION:
1131                         ipw_notification_intr(sc, sbuf);
1132                         break;
1133
1134                 default:
1135                         if_printf(&sc->sc_ic.ic_if, "unknown status code %u\n",
1136                                   le16toh(status->code));
1137                 }
1138
1139                 /* firmware was killed, stop processing received frames */
1140                 if (!(sc->flags & IPW_FLAG_FW_INITED))
1141                         return;
1142
1143                 sbd->bd->flags = 0;
1144         }
1145         /* Some buffer descriptors may have changed */
1146         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
1147
1148         /* Tell the firmware what we have processed */
1149         sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
1150         CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
1151 }
1152
1153 static void
1154 ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1155 {
1156         struct ieee80211com *ic = &sc->sc_ic;
1157         struct ipw_soft_hdr *shdr;
1158         struct ipw_soft_buf *sbuf;
1159
1160         switch (sbd->type) {
1161         case IPW_SBD_TYPE_COMMAND:
1162                 bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map,
1163                     BUS_DMASYNC_POSTWRITE);
1164                 bus_dmamap_unload(sc->cmd_dmat, sc->cmd_map);
1165                 break;
1166
1167         case IPW_SBD_TYPE_HEADER:
1168                 shdr = sbd->priv;
1169                 bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_POSTWRITE);
1170                 bus_dmamap_unload(sc->hdr_dmat, shdr->map);
1171                 SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1172                 break;
1173
1174         case IPW_SBD_TYPE_DATA:
1175                 sbuf = sbd->priv;
1176                 bus_dmamap_sync(sc->txbuf_dmat, sbuf->map,
1177                     BUS_DMASYNC_POSTWRITE);
1178                 bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1179                 SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1180
1181                 m_freem(sbuf->m);
1182
1183                 if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
1184                         ieee80211_free_node(ic, sbuf->ni);
1185
1186                 /* kill watchdog timer */
1187                 sc->sc_tx_timer = 0;
1188                 break;
1189         }
1190         sbd->type = IPW_SBD_TYPE_NOASSOC;
1191 }
1192
1193 static void
1194 ipw_tx_intr(struct ipw_softc *sc)
1195 {
1196         struct ifnet *ifp = &sc->sc_ic.ic_if;
1197         u_int32_t r, i;
1198
1199         if (!(sc->flags & IPW_FLAG_FW_INITED))
1200                 return;
1201
1202         r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1203
1204         for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1205                 ipw_release_sbd(sc, &sc->stbd_list[i]);
1206                 sc->txfree++;
1207         }
1208
1209         /* Remember what the firmware has processed */
1210         sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1211
1212         /* Call start() since some buffer descriptors have been released */
1213         ifp->if_flags &= ~IFF_OACTIVE;
1214         (*ifp->if_start)(ifp);
1215 }
1216
1217 static void
1218 ipw_intr(void *arg)
1219 {
1220         struct ipw_softc *sc = arg;
1221         u_int32_t r;
1222         IPW_LOCK_DECL();
1223
1224         IPW_LOCK(sc);
1225
1226         if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff) {
1227                 IPW_UNLOCK(sc);
1228                 return;
1229         }
1230
1231         /* Disable interrupts */
1232         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1233
1234         DPRINTFN(8, ("INTR!0x%08x\n", r));
1235
1236         if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1237                 if_printf(&sc->sc_ic.ic_if, "fatal error\n");
1238                 sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1239                 ipw_stop(sc);
1240         }
1241
1242         if (r & IPW_INTR_FW_INIT_DONE) {
1243                 if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1244                         wakeup(sc);
1245         }
1246
1247         if (r & IPW_INTR_RX_TRANSFER)
1248                 ipw_rx_intr(sc);
1249
1250         if (r & IPW_INTR_TX_TRANSFER)
1251                 ipw_tx_intr(sc);
1252
1253         /* Acknowledge interrupts */
1254         CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1255
1256         /* Re-enable interrupts */
1257         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1258
1259         IPW_UNLOCK(sc);
1260 }
1261
1262 static void
1263 ipw_dma_map_txbuf(void *arg, bus_dma_segment_t *segs, int nseg,
1264     bus_size_t mapsize, int error)
1265 {
1266         struct ipw_dma_mapping *map = arg;
1267
1268         if (error != 0)
1269                 return;
1270
1271         KASSERT(nseg <= IPW_MAX_NSEG, ("too many DMA segments %d", nseg));
1272
1273         bcopy(segs, map->segs, nseg * sizeof (bus_dma_segment_t));
1274         map->nseg = nseg;
1275         map->mapsize = mapsize;
1276 }
1277
1278 static void
1279 ipw_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg __unused, int error)
1280 {
1281         if (error != 0)
1282                 return;
1283
1284         KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
1285
1286         *(bus_addr_t *)arg = segs[0].ds_addr;
1287 }
1288
1289 static int
1290 ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
1291 {
1292         struct ipw_soft_bd *sbd;
1293         bus_addr_t physaddr;
1294         int error;
1295
1296         sbd = &sc->stbd_list[sc->txcur];
1297
1298         error = bus_dmamap_load(sc->cmd_dmat, sc->cmd_map, &sc->cmd,
1299             sizeof (struct ipw_cmd), ipw_dma_map_addr, &physaddr, 0);
1300         if (error != 0) {
1301                 if_printf(&sc->sc_ic.ic_if,
1302                           "could not map command DMA memory\n");
1303                 return error;
1304         }
1305
1306         sc->cmd.type = htole32(type);
1307         sc->cmd.subtype = htole32(0);
1308         sc->cmd.len = htole32(len);
1309         sc->cmd.seq = htole32(0);
1310         if (data != NULL)
1311                 bcopy(data, sc->cmd.data, len);
1312
1313         sbd->type = IPW_SBD_TYPE_COMMAND;
1314         sbd->bd->physaddr = htole32(physaddr);
1315         sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1316         sbd->bd->nfrag = 1;
1317         sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1318                          IPW_BD_FLAG_TX_LAST_FRAGMENT;
1319
1320         bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map, BUS_DMASYNC_PREWRITE);
1321         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1322
1323         sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1324         sc->txfree--;
1325         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1326
1327         DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1328
1329         /* wait at most one second for command to complete */
1330         return tsleep(sc, 0, "ipwcmd", hz);
1331 }
1332
1333 static int
1334 ipw_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1335 {
1336         struct ipw_softc *sc = ifp->if_softc;
1337         struct ieee80211com *ic = &sc->sc_ic;
1338         struct ieee80211_frame *wh;
1339         struct ipw_dma_mapping map;
1340         struct ipw_soft_bd *sbd;
1341         struct ipw_soft_hdr *shdr;
1342         struct ipw_soft_buf *sbuf;
1343         struct mbuf *mnew;
1344         bus_addr_t physaddr;
1345         int error, i;
1346
1347         if (ic->ic_flags & IEEE80211_F_WEPON) {
1348                 m0 = ieee80211_wep_crypt(ifp, m0, 1);
1349                 if (m0 == NULL)
1350                         return ENOBUFS;
1351         }
1352
1353         if (sc->sc_drvbpf != NULL) {
1354                 struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1355
1356                 tap->wt_flags = 0;
1357                 tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1358                 tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1359
1360                 bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1361         }
1362
1363         wh = mtod(m0, struct ieee80211_frame *);
1364
1365         shdr = SLIST_FIRST(&sc->free_shdr);
1366         sbuf = SLIST_FIRST(&sc->free_sbuf);
1367         KASSERT(shdr != NULL && sbuf != NULL, ("empty sw hdr/buf pool"));
1368
1369         shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1370         shdr->hdr.subtype = htole32(0);
1371         shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1372         shdr->hdr.encrypt = 0;
1373         shdr->hdr.keyidx = 0;
1374         shdr->hdr.keysz = 0;
1375         shdr->hdr.fragmentsz = htole16(0);
1376         IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1377         if (ic->ic_opmode == IEEE80211_M_STA)
1378                 IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1379         else
1380                 IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1381
1382         /* trim IEEE802.11 header */
1383         m_adj(m0, sizeof (struct ieee80211_frame));
1384
1385         error = bus_dmamap_load_mbuf(sc->txbuf_dmat, sbuf->map, m0,
1386             ipw_dma_map_txbuf, &map, 0);
1387         if (error != 0 && error != EFBIG) {
1388                 if_printf(ifp, "could not map mbuf (error %d)\n", error);
1389                 m_freem(m0);
1390                 return error;
1391         }
1392         if (error != 0) {
1393                 mnew = m_defrag(m0, MB_DONTWAIT);
1394                 if (mnew == NULL) {
1395                         if_printf(ifp, "could not defragment mbuf\n");
1396                         m_freem(m0);
1397                         return ENOBUFS;
1398                 }
1399                 m0 = mnew;
1400
1401                 error = bus_dmamap_load_mbuf(sc->txbuf_dmat, sbuf->map, m0,
1402                     ipw_dma_map_txbuf, &map, 0);
1403                 if (error != 0) {
1404                         if_printf(ifp,
1405                                   "could not map mbuf (error %d)\n", error);
1406                         m_freem(m0);
1407                         return error;
1408                 }
1409         }
1410
1411         error = bus_dmamap_load(sc->hdr_dmat, shdr->map, &shdr->hdr,
1412             sizeof (struct ipw_hdr), ipw_dma_map_addr, &physaddr, 0);
1413         if (error != 0) {
1414                 if_printf(ifp, "could not map header DMA memory\n");
1415                 bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1416                 m_freem(m0);
1417                 return error;
1418         }
1419
1420         SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1421         SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1422
1423         sbd = &sc->stbd_list[sc->txcur];
1424         sbd->type = IPW_SBD_TYPE_HEADER;
1425         sbd->priv = shdr;
1426         sbd->bd->physaddr = htole32(physaddr);
1427         sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1428         sbd->bd->nfrag = 1 + map.nseg;
1429         sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1430                          IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1431
1432         DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u!%6D!%6D\n", shdr->hdr.type,
1433             shdr->hdr.subtype, shdr->hdr.encrypted, shdr->hdr.encrypt,
1434             shdr->hdr.src_addr, ":", shdr->hdr.dst_addr, ":"));
1435         sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1436         sc->txfree--;
1437
1438         sbuf->m = m0;
1439         sbuf->ni = ni;
1440
1441         for (i = 0; i < map.nseg; i++) {
1442                 sbd = &sc->stbd_list[sc->txcur];
1443
1444                 sbd->bd->physaddr = htole32(map.segs[i].ds_addr);
1445                 sbd->bd->len = htole32(map.segs[i].ds_len);
1446                 sbd->bd->nfrag = 0; /* used only in first bd */
1447                 sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1448                 if (i == map.nseg - 1) {
1449                         sbd->type = IPW_SBD_TYPE_DATA;
1450                         sbd->priv = sbuf;
1451                         sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1452                 } else {
1453                         sbd->type = IPW_SBD_TYPE_NOASSOC;
1454                         sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1455                 }
1456
1457                 DPRINTFN(5, ("TX!FRAG!%d!%d\n", i, map.segs[i].ds_len));
1458                 sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1459                 sc->txfree--;
1460         }
1461
1462         bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_PREWRITE);
1463         bus_dmamap_sync(sc->txbuf_dmat, sbuf->map, BUS_DMASYNC_PREWRITE);
1464         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1465
1466         /* Inform firmware about this new packet */
1467         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1468
1469         return 0;
1470 }
1471
1472 static void
1473 ipw_start(struct ifnet *ifp)
1474 {
1475         struct ipw_softc *sc = ifp->if_softc;
1476         struct ieee80211com *ic = &sc->sc_ic;
1477         struct mbuf *m0;
1478         struct ieee80211_node *ni;
1479
1480         if (ic->ic_state != IEEE80211_S_RUN) {
1481                 return;
1482         }
1483
1484         for (;;) {
1485                 m0 = ifq_poll(&ifp->if_snd);
1486                 if (m0 == NULL)
1487                         break;
1488                 if (sc->txfree < 1 + IPW_MAX_NSEG) {
1489                         ifp->if_flags |= IFF_OACTIVE;
1490                         break;
1491                 }
1492                 m0 = ifq_dequeue(&ifp->if_snd);
1493
1494                 BPF_MTAP(ifp, m0);
1495
1496                 m0 = ieee80211_encap(ifp, m0, &ni);
1497                 if (m0 == NULL)
1498                         continue;
1499
1500                 if (ic->ic_rawbpf != NULL)
1501                         bpf_mtap(ic->ic_rawbpf, m0);
1502
1503                 if (ipw_tx_start(ifp, m0, ni) != 0) {
1504                         if (ni != NULL && ni != ic->ic_bss)
1505                                 ieee80211_free_node(ic, ni);
1506                         break;
1507                 }
1508
1509                 /* start watchdog timer */
1510                 sc->sc_tx_timer = 5;
1511                 ifp->if_timer = 1;
1512         }
1513 }
1514
1515 static void
1516 ipw_watchdog(struct ifnet *ifp)
1517 {
1518         struct ipw_softc *sc = ifp->if_softc;
1519
1520         ifp->if_timer = 0;
1521
1522         if (sc->sc_tx_timer > 0) {
1523                 if (--sc->sc_tx_timer == 0) {
1524                         if_printf(ifp, "device timeout\n");
1525                         ifp->if_flags &= ~IFF_UP;
1526                         ipw_stop(sc);
1527                         return;
1528                 }
1529                 ifp->if_timer = 1;
1530         }
1531
1532         ieee80211_watchdog(ifp);
1533 }
1534
1535 static int
1536 ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1537 {
1538         struct ipw_softc *sc = ifp->if_softc;
1539         struct ieee80211com *ic = &sc->sc_ic;
1540         struct ifreq *ifr;
1541         struct ieee80211req *ireq;
1542         int error = 0;
1543         IPW_LOCK_DECL();
1544
1545         IPW_LOCK(sc);
1546
1547         switch (cmd) {
1548         case SIOCSIFFLAGS:
1549                 if (ifp->if_flags & IFF_UP) {
1550                         if (!(ifp->if_flags & IFF_RUNNING))
1551                                 ipw_init(sc);
1552                 } else {
1553                         if (ifp->if_flags & IFF_RUNNING)
1554                                 ipw_stop(sc);
1555                 }
1556                 break;
1557
1558         case SIOCSLOADFW:
1559                 /* only super-user can do that! */
1560                 if ((error = suser(curthread)) != 0)
1561                         break;
1562
1563                 ifr = (struct ifreq *)data;
1564                 error = ipw_cache_firmware(sc, ifr->ifr_data);
1565                 break;
1566
1567         case SIOCSKILLFW:
1568                 /* only super-user can do that! */
1569                 if ((error = suser(curthread)) != 0)
1570                         break;
1571
1572                 ifp->if_flags &= ~IFF_UP;
1573                 ipw_stop(sc);
1574                 ipw_free_firmware(sc);
1575                 break;
1576
1577         case SIOCG80211:
1578                 ireq = (struct ieee80211req *)data;
1579                 switch (ireq->i_type) {
1580                 case IEEE80211_IOC_AUTHMODE:
1581                         ireq->i_val = sc->authmode;
1582                         break;
1583
1584                 case IEEE80211_IOC_TXPOWER:
1585                         ireq->i_val = (CSR_READ_4(sc, IPW_CSR_IO) &
1586                             IPW_IO_RADIO_DISABLED) ? 0 : ic->ic_txpower;
1587                         break;
1588
1589                 default:
1590                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1591                 }
1592                 break;
1593
1594         case SIOCS80211:
1595                 /* only super-user can do that! */
1596                 if ((error = suser(curthread)) != 0)
1597                         break;
1598
1599                 ireq = (struct ieee80211req *)data;
1600                 switch (ireq->i_type) {
1601                 case IEEE80211_IOC_AUTHMODE:
1602                         sc->authmode = ireq->i_val;
1603                         break;
1604
1605                 default:
1606                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1607                 }
1608                 break;
1609
1610         default:
1611                 error = ieee80211_ioctl(ifp, cmd, data, cr);
1612         }
1613
1614         if (error == ENETRESET) {
1615                 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1616                     (IFF_UP | IFF_RUNNING))
1617                         ipw_init(sc);
1618                 error = 0;
1619         }
1620
1621         IPW_UNLOCK(sc);
1622
1623         return error;
1624 }
1625
1626 static void
1627 ipw_stop_master(struct ipw_softc *sc)
1628 {
1629         int ntries;
1630
1631         /* Disable interrupts */
1632         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1633
1634         CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1635         for (ntries = 0; ntries < 5; ntries++) {
1636                 if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1637                         break;
1638                 DELAY(10);
1639         }
1640         if (ntries == 5)
1641                 if_printf(&sc->sc_ic.ic_if, "timeout waiting for master\n");
1642
1643         CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1644             IPW_RST_PRINCETON_RESET);
1645
1646         sc->flags &= ~IPW_FLAG_FW_INITED;
1647 }
1648
1649 static int
1650 ipw_reset(struct ipw_softc *sc)
1651 {
1652         int ntries;
1653
1654         ipw_stop_master(sc);
1655
1656         /* Move adapter to D0 state */
1657         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1658             IPW_CTL_INIT);
1659
1660         /* Wait for clock stabilization */
1661         for (ntries = 0; ntries < 1000; ntries++) {
1662                 if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1663                         break;
1664                 DELAY(200);
1665         }
1666         if (ntries == 1000)
1667                 return EIO;
1668
1669         CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1670             IPW_RST_SW_RESET);
1671
1672         DELAY(10);
1673
1674         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1675             IPW_CTL_INIT);
1676
1677         return 0;
1678 }
1679
1680 static int
1681 ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1682 {
1683         int ntries;
1684
1685         MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1686         CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1687
1688         MEM_WRITE_2(sc, 0x220000, 0x0703);
1689         MEM_WRITE_2(sc, 0x220000, 0x0707);
1690
1691         MEM_WRITE_1(sc, 0x210014, 0x72);
1692         MEM_WRITE_1(sc, 0x210014, 0x72);
1693
1694         MEM_WRITE_1(sc, 0x210000, 0x40);
1695         MEM_WRITE_1(sc, 0x210000, 0x00);
1696         MEM_WRITE_1(sc, 0x210000, 0x40);
1697
1698         MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1699
1700         MEM_WRITE_1(sc, 0x210000, 0x00);
1701         MEM_WRITE_1(sc, 0x210000, 0x00);
1702         MEM_WRITE_1(sc, 0x210000, 0x80);
1703
1704         MEM_WRITE_2(sc, 0x220000, 0x0703);
1705         MEM_WRITE_2(sc, 0x220000, 0x0707);
1706
1707         MEM_WRITE_1(sc, 0x210014, 0x72);
1708         MEM_WRITE_1(sc, 0x210014, 0x72);
1709
1710         MEM_WRITE_1(sc, 0x210000, 0x00);
1711         MEM_WRITE_1(sc, 0x210000, 0x80);
1712
1713         for (ntries = 0; ntries < 100; ntries++) {
1714                 if (MEM_READ_1(sc, 0x210000) & 1)
1715                         break;
1716                 DELAY(1000);
1717         }
1718         if (ntries == 100) {
1719                 if_printf(&sc->sc_ic.ic_if,
1720                           "timeout waiting for ucode to initialize\n");
1721                 return EIO;
1722         }
1723
1724         MEM_WRITE_4(sc, 0x3000e0, 0);
1725
1726         return 0;
1727 }
1728
1729 /* set of macros to handle unaligned little endian data in firmware image */
1730 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1731 #define GETLE16(p) ((p)[0] | (p)[1] << 8)
1732 static int
1733 ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1734 {
1735         u_char *p, *end;
1736         u_int32_t dst;
1737         u_int16_t len;
1738         int error;
1739
1740         p = fw;
1741         end = fw + size;
1742         while (p < end) {
1743                 if (p + 6 > end)
1744                         return EINVAL;
1745
1746                 dst = GETLE32(p); p += 4;
1747                 len = GETLE16(p); p += 2;
1748
1749                 if (p + len > end)
1750                         return EINVAL;
1751
1752                 ipw_write_mem_1(sc, dst, p, len);
1753                 p += len;
1754         }
1755
1756         CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1757             IPW_IO_LED_OFF);
1758
1759         /* Allow interrupts so we know when the firmware is inited */
1760         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1761
1762         /* Tell the adapter to initialize the firmware */
1763         CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1764         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1765             IPW_CTL_ALLOW_STANDBY);
1766
1767         /* Wait at most one second for firmware initialization to complete */
1768         if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1769                 if_printf(&sc->sc_ic.ic_if, "timeout waiting for firmware "
1770                     "initialization to complete\n");
1771                 return error;
1772         }
1773
1774         CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1775             IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1776
1777         return 0;
1778 }
1779
1780 /*
1781  * Store firmware into kernel memory so we can download it when we need to,
1782  * e.g when the adapter wakes up from suspend mode.
1783  */
1784 static int
1785 ipw_cache_firmware(struct ipw_softc *sc, void *data)
1786 {
1787         struct ipw_firmware *fw = &sc->fw;
1788         struct ipw_firmware_hdr hdr;
1789         u_char *p = data;
1790         int error;
1791
1792         ipw_free_firmware(sc);
1793
1794         /*
1795          * mutex(9): no mutexes should be held across functions which access
1796          * memory in userspace, such as copyin(9) [...]
1797          */
1798
1799         if ((error = copyin(data, &hdr, sizeof hdr)) != 0)
1800                 goto fail1;
1801
1802         fw->main_size  = le32toh(hdr.main_size);
1803         fw->ucode_size = le32toh(hdr.ucode_size);
1804         p += sizeof hdr;
1805
1806         fw->main = malloc(fw->main_size, M_DEVBUF, M_WAITOK);
1807         if (fw->main == NULL) {
1808                 error = ENOMEM;
1809                 goto fail1;
1810         }
1811
1812         fw->ucode = malloc(fw->ucode_size, M_DEVBUF, M_WAITOK);
1813         if (fw->ucode == NULL) {
1814                 error = ENOMEM;
1815                 goto fail2;
1816         }
1817
1818         if ((error = copyin(p, fw->main, fw->main_size)) != 0)
1819                 goto fail3;
1820
1821         p += fw->main_size;
1822         if ((error = copyin(p, fw->ucode, fw->ucode_size)) != 0)
1823                 goto fail3;
1824
1825         DPRINTF(("Firmware cached: main %u, ucode %u\n", fw->main_size,
1826             fw->ucode_size));
1827
1828         sc->flags |= IPW_FLAG_FW_CACHED;
1829
1830         return 0;
1831
1832 fail3:  free(fw->ucode, M_DEVBUF);
1833 fail2:  free(fw->main, M_DEVBUF);
1834 fail1:
1835
1836         return error;
1837 }
1838
1839 static void
1840 ipw_free_firmware(struct ipw_softc *sc)
1841 {
1842         if (!(sc->flags & IPW_FLAG_FW_CACHED))
1843                 return;
1844
1845         free(sc->fw.main, M_DEVBUF);
1846         free(sc->fw.ucode, M_DEVBUF);
1847
1848         sc->flags &= ~IPW_FLAG_FW_CACHED;
1849 }
1850
1851 static int
1852 ipw_config(struct ipw_softc *sc)
1853 {
1854         struct ieee80211com *ic = &sc->sc_ic;
1855         struct ifnet *ifp = &ic->ic_if;
1856         struct ipw_security security;
1857         struct ieee80211_wepkey *k;
1858         struct ipw_wep_key wepkey;
1859         struct ipw_scan_options options;
1860         struct ipw_configuration config;
1861         u_int32_t data;
1862         int error, i;
1863
1864         switch (ic->ic_opmode) {
1865         case IEEE80211_M_STA:
1866         case IEEE80211_M_HOSTAP:
1867                 data = htole32(IPW_MODE_BSS);
1868                 break;
1869
1870         case IEEE80211_M_IBSS:
1871         case IEEE80211_M_AHDEMO:
1872                 data = htole32(IPW_MODE_IBSS);
1873                 break;
1874
1875         case IEEE80211_M_MONITOR:
1876                 data = htole32(IPW_MODE_MONITOR);
1877                 break;
1878         }
1879         DPRINTF(("Setting mode to %u\n", le32toh(data)));
1880         error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1881         if (error != 0)
1882                 return error;
1883
1884         if (ic->ic_opmode == IEEE80211_M_IBSS ||
1885             ic->ic_opmode == IEEE80211_M_MONITOR) {
1886                 data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1887                 DPRINTF(("Setting channel to %u\n", le32toh(data)));
1888                 error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1889                 if (error != 0)
1890                         return error;
1891         }
1892
1893         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1894                 DPRINTF(("Enabling adapter\n"));
1895                 return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1896         }
1897
1898         IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1899         IEEE80211_ADDR_COPY(IF_LLADDR(ifp), ic->ic_myaddr);
1900         DPRINTF(("Setting MAC address to %6D\n", ic->ic_myaddr, ":"));
1901         error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1902             IEEE80211_ADDR_LEN);
1903         if (error != 0)
1904                 return error;
1905
1906         config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1907             IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1908         if (ic->ic_opmode == IEEE80211_M_IBSS)
1909                 config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1910         if (ifp->if_flags & IFF_PROMISC)
1911                 config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1912         config.bss_chan = htole32(0x3fff); /* channels 1-14 */
1913         config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
1914         DPRINTF(("Setting configuration to 0x%x\n", le32toh(config.flags)));
1915         error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1916         if (error != 0)
1917                 return error;
1918
1919         data = htole32(0x3); /* 1, 2 */
1920         DPRINTF(("Setting basic tx rates to 0x%x\n", le32toh(data)));
1921         error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1922         if (error != 0)
1923                 return error;
1924
1925         data = htole32(0xf); /* 1, 2, 5.5, 11 */
1926         DPRINTF(("Setting tx rates to 0x%x\n", le32toh(data)));
1927         error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1928         if (error != 0)
1929                 return error;
1930
1931         data = htole32(IPW_POWER_MODE_CAM);
1932         DPRINTF(("Setting power mode to %u\n", le32toh(data)));
1933         error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1934         if (error != 0)
1935                 return error;
1936
1937         if (ic->ic_opmode == IEEE80211_M_IBSS) {
1938                 data = htole32(32); /* default value */
1939                 DPRINTF(("Setting tx power index to %u\n", le32toh(data)));
1940                 error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1941                     sizeof data);
1942                 if (error != 0)
1943                         return error;
1944         }
1945
1946         data = htole32(ic->ic_rtsthreshold);
1947         DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
1948         error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1949         if (error != 0)
1950                 return error;
1951
1952         data = htole32(ic->ic_fragthreshold);
1953         DPRINTF(("Setting frag threshold to %u\n", le32toh(data)));
1954         error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1955         if (error != 0)
1956                 return error;
1957
1958 #ifdef IPW_DEBUG
1959         if (ipw_debug > 0) {
1960                 printf("Setting ESSID to ");
1961                 ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1962                 printf("\n");
1963         }
1964 #endif
1965         error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1966             ic->ic_des_esslen);
1967         if (error != 0)
1968                 return error;
1969
1970         /* no mandatory BSSID */
1971         DPRINTF(("Setting mandatory BSSID to null\n"));
1972         error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1973         if (error != 0)
1974                 return error;
1975
1976         if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1977                 DPRINTF(("Setting desired BSSID to %6D\n", ic->ic_des_bssid,
1978                     ":"));
1979                 error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1980                     ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1981                 if (error != 0)
1982                         return error;
1983         }
1984
1985         bzero(&security, sizeof security);
1986         security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1987             IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1988         security.ciphers = htole32(IPW_CIPHER_NONE);
1989         DPRINTF(("Setting authmode to %u\n", security.authmode));
1990         error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1991             sizeof security);
1992         if (error != 0)
1993                 return error;
1994
1995         if (ic->ic_flags & IEEE80211_F_WEPON) {
1996                 k = ic->ic_nw_keys;
1997                 for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1998                         if (k->wk_len == 0)
1999                                 continue;
2000
2001                         wepkey.idx = i;
2002                         wepkey.len = k->wk_len;
2003                         bzero(wepkey.key, sizeof wepkey.key);
2004                         bcopy(k->wk_key, wepkey.key, k->wk_len);
2005                         DPRINTF(("Setting wep key index %u len %u\n",
2006                             wepkey.idx, wepkey.len));
2007                         error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
2008                             sizeof wepkey);
2009                         if (error != 0)
2010                                 return error;
2011                 }
2012
2013                 data = htole32(ic->ic_wep_txkey);
2014                 DPRINTF(("Setting wep tx key index to %u\n", le32toh(data)));
2015                 error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
2016                     sizeof data);
2017                 if (error != 0)
2018                         return error;
2019         }
2020
2021         data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
2022         DPRINTF(("Setting wep flags to 0x%x\n", le32toh(data)));
2023         error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
2024         if (error != 0)
2025                 return error;
2026
2027         if (ic->ic_opmode == IEEE80211_M_IBSS ||
2028             ic->ic_opmode == IEEE80211_M_HOSTAP) {
2029                 data = htole32(ic->ic_lintval);
2030                 DPRINTF(("Setting beacon interval to %u\n", le32toh(data)));
2031                 error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
2032                     sizeof data);
2033                 if (error != 0)
2034                         return error;
2035         }
2036
2037         options.flags = htole32(0);
2038         options.channels = htole32(0x3fff); /* scan channels 1-14 */
2039         DPRINTF(("Setting scan options to 0x%x\n", le32toh(options.flags)));
2040         error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
2041         if (error != 0)
2042                 return error;
2043
2044         /* finally, enable adapter (start scanning for an access point) */
2045         DPRINTF(("Enabling adapter\n"));
2046         return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
2047 }
2048
2049 static void
2050 ipw_init(void *priv)
2051 {
2052         struct ipw_softc *sc = priv;
2053         struct ieee80211com *ic = &sc->sc_ic;
2054         struct ifnet *ifp = &ic->ic_if;
2055         struct ipw_firmware *fw = &sc->fw;
2056
2057         /* exit immediately if firmware has not been ioctl'd */
2058         if (!(sc->flags & IPW_FLAG_FW_CACHED)) {
2059                 ifp->if_flags &= ~IFF_UP;
2060                 return;
2061         }
2062
2063         ipw_stop(sc);
2064
2065         if (ipw_reset(sc) != 0) {
2066                 if_printf(ifp, "could not reset adapter\n");
2067                 goto fail;
2068         }
2069
2070         if (ipw_load_ucode(sc, fw->ucode, fw->ucode_size) != 0) {
2071                 if_printf(ifp, "could not load microcode\n");
2072                 goto fail;
2073         }
2074
2075         ipw_stop_master(sc);
2076
2077         /*
2078          * Setup tx, rx and status rings
2079          */
2080         CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_phys);
2081         CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
2082         CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
2083         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
2084         sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
2085         sc->txcur = 0; /* bd index to write to */
2086         sc->txfree = IPW_NTBD - 2;
2087
2088         CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_phys);
2089         CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
2090         CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
2091         CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
2092         sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
2093
2094         CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE, sc->status_phys);
2095
2096         if (ipw_load_firmware(sc, fw->main, fw->main_size) != 0) {
2097                 if_printf(ifp, "could not load firmware\n");
2098                 goto fail;
2099         }
2100
2101         sc->flags |= IPW_FLAG_FW_INITED;
2102
2103         /* Retrieve information tables base addresses */
2104         sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2105         sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2106
2107         ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2108
2109         if (ipw_config(sc) != 0) {
2110                 if_printf(ifp, "device configuration failed\n");
2111                 goto fail;
2112         }
2113
2114         ifp->if_flags &= ~IFF_OACTIVE;
2115         ifp->if_flags |= IFF_RUNNING;
2116
2117         return;
2118
2119 fail:   ifp->if_flags &= ~IFF_UP;
2120         ipw_stop(sc);
2121 }
2122
2123 static void
2124 ipw_stop(void *priv)
2125 {
2126         struct ipw_softc *sc = priv;
2127         struct ieee80211com *ic = &sc->sc_ic;
2128         struct ifnet *ifp = &ic->ic_if;
2129         int i;
2130
2131         ipw_stop_master(sc);
2132         CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2133
2134         /*
2135          * Release tx buffers
2136          */
2137         for (i = 0; i < IPW_NTBD; i++)
2138                 ipw_release_sbd(sc, &sc->stbd_list[i]);
2139
2140         ifp->if_timer = 0;
2141         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2142
2143         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2144 }
2145
2146 static int
2147 ipw_sysctl_stats(SYSCTL_HANDLER_ARGS)
2148 {
2149         struct ipw_softc *sc = arg1;
2150         u_int32_t i, size, buf[256];
2151
2152         (void)arg2; /* silence WARNS == 6 */
2153         (void)oidp; /* silence WARNS == 6 */
2154
2155         if (!(sc->flags & IPW_FLAG_FW_INITED)) {
2156                 bzero(buf, sizeof buf);
2157                 return SYSCTL_OUT(req, buf, sizeof buf);
2158         }
2159
2160         CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
2161
2162         size = min(CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA), 256);
2163         for (i = 1; i < size; i++)
2164                 buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
2165
2166         return SYSCTL_OUT(req, buf, sizeof buf);
2167 }
2168
2169 static int
2170 ipw_sysctl_radio(SYSCTL_HANDLER_ARGS)
2171 {
2172         struct ipw_softc *sc = arg1;
2173         int val;
2174
2175         (void)arg2; /* silence WARNS == 6 */
2176         (void)oidp; /* silence WARNS == 6 */
2177
2178         val = !((sc->flags & IPW_FLAG_HAS_RADIO_SWITCH) &&
2179                 (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED));
2180
2181         return SYSCTL_OUT(req, &val, sizeof val);
2182 }
2183
2184 static u_int32_t
2185 ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
2186 {
2187         return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
2188 }
2189
2190 static void
2191 ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
2192 {
2193         MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
2194 }
2195
2196 static int
2197 ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
2198 {
2199         u_int32_t addr, info;
2200         u_int16_t count, size;
2201         u_int32_t total;
2202
2203         /* addr[4] + count[2] + size[2] */
2204         addr = MEM_READ_4(sc, sc->table2_base + off);
2205         info = MEM_READ_4(sc, sc->table2_base + off + 4);
2206
2207         count = info >> 16;
2208         size = info & 0xffff;
2209         total = count * size;
2210
2211         if (total > *len) {
2212                 *len = total;
2213                 return EINVAL;
2214         }
2215
2216         *len = total;
2217         ipw_read_mem_1(sc, addr, buf, total);
2218
2219         return 0;
2220 }
2221
2222 static void
2223 ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2224     bus_size_t count)
2225 {
2226         for (; count > 0; offset++, datap++, count--) {
2227                 CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2228                 *datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2229         }
2230 }
2231
2232 static void
2233 ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2234     bus_size_t count)
2235 {
2236         for (; count > 0; offset++, datap++, count--) {
2237                 CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2238                 CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2239         }
2240 }