sys/dev/netif/ipw/if_ipw.c

   1 /*-
   2  * Copyright (c) 2004, 2005
   3  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice unmodified, this list of conditions, and the following
  10  *    disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  *
  27  *
  28  * $Id: if_ipw.c,v 1.7.2.1 2005/01/13 20:01:03 damien Exp $
  29  * $DragonFly: src/sys/dev/netif/ipw/Attic/if_ipw.c,v 1.9 2005/10/12 17:35:52 dillon Exp $
  30  */
  31
  32 /*-
  33  * Intel(R) PRO/Wireless 2100 MiniPCI driver
  34  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
  35  */
  36
  37 #include <sys/param.h>
  38 #include <sys/sysctl.h>
  39 #include <sys/sockio.h>
  40 #include <sys/mbuf.h>
  41 #include <sys/kernel.h>
  42 #include <sys/socket.h>
  43 #include <sys/systm.h>
  44 #include <sys/malloc.h>
  45 #include <sys/module.h>
  46 #include <sys/bus.h>
  47 #include <sys/endian.h>
  48 #include <sys/proc.h>
  49 #include <sys/thread2.h>
  50 #include <sys/ucred.h>
  51
  52 #include <machine/bus.h>
  53 #include <machine/resource.h>
  54 #include <machine/clock.h>
  55 #include <sys/rman.h>
  56
  57 #include <bus/pci/pcireg.h>
  58 #include <bus/pci/pcivar.h>
  59
  60 #include <net/bpf.h>
  61 #include <net/if.h>
  62 #include <net/if_arp.h>
  63 #include <net/ethernet.h>
  64 #include <net/if_dl.h>
  65 #include <net/if_media.h>
  66 #include <net/if_types.h>
  67 #include <net/ifq_var.h>
  68
  69 #include <netinet/in.h>
  70 #include <netinet/in_systm.h>
  71 #include <netinet/in_var.h>
  72 #include <netinet/ip.h>
  73 #include <netinet/if_ether.h>
  74
  75 #include <netproto/802_11/ieee80211_var.h>
  76 #include <netproto/802_11/ieee80211_ioctl.h>
  77 #include <netproto/802_11/ieee80211_radiotap.h>
  78 #include <netproto/802_11/if_wavelan_ieee.h>
  79
  80 #include "if_ipwreg.h"
  81 #include "if_ipwvar.h"
  82
  83 #ifdef IPW_DEBUG
  84 #define DPRINTF(x)      if (ipw_debug > 0) printf x
  85 #define DPRINTFN(n, x)  if (ipw_debug >= (n)) printf x
  86 int ipw_debug = 0;
  87 SYSCTL_INT(_debug, OID_AUTO, ipw, CTLFLAG_RW, &ipw_debug, 0, "ipw debug level");
  88 #else
  89 #define DPRINTF(x)
  90 #define DPRINTFN(n, x)
  91 #endif
  92
  93 MODULE_DEPEND(ipw, pci,  1, 1, 1);
  94 MODULE_DEPEND(ipw, wlan, 1, 1, 1);
  95
  96 struct ipw_ident {
  97         u_int16_t       vendor;
  98         u_int16_t       device;
  99         const char      *name;
 100 };
 101
 102 static const struct ipw_ident ipw_ident_table[] = {
 103         { 0x8086, 0x1043, "Intel(R) PRO/Wireless 2100 MiniPCI" },
 104
 105         { 0, 0, NULL }
 106 };
 107
 108 static const struct ieee80211_rateset ipw_rateset_11b =
 109         { 4, { 2, 4, 11, 22 } };
 110
 111 static int              ipw_dma_alloc(device_t);
 112 static void             ipw_release(struct ipw_softc *);
 113 static int              ipw_media_change(struct ifnet *);
 114 static void             ipw_media_status(struct ifnet *, struct ifmediareq *);
 115 static int              ipw_newstate(struct ieee80211com *,
 116                             enum ieee80211_state, int);
 117 static u_int16_t        ipw_read_prom_word(struct ipw_softc *, u_int8_t);
 118 static void             ipw_command_intr(struct ipw_softc *,
 119                             struct ipw_soft_buf *);
 120 static void             ipw_newstate_intr(struct ipw_softc *,
 121                             struct ipw_soft_buf *);
 122 static void             ipw_data_intr(struct ipw_softc *, struct ipw_status *,
 123                             struct ipw_soft_bd *, struct ipw_soft_buf *);
 124 static void             ipw_notification_intr(struct ipw_softc *,
 125                             struct ipw_soft_buf *);
 126 static void             ipw_rx_intr(struct ipw_softc *);
 127 static void             ipw_release_sbd(struct ipw_softc *,
 128                             struct ipw_soft_bd *);
 129 static void             ipw_tx_intr(struct ipw_softc *);
 130 static void             ipw_intr(void *);
 131 static void             ipw_dma_map_txbuf(void *, bus_dma_segment_t *, int,
 132                             bus_size_t, int);
 133 static void             ipw_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 134 static int              ipw_cmd(struct ipw_softc *, u_int32_t, void *,
 135                             u_int32_t);
 136 static int              ipw_tx_start(struct ifnet *, struct mbuf *,
 137                             struct ieee80211_node *);
 138 static void             ipw_start(struct ifnet *);
 139 static void             ipw_watchdog(struct ifnet *);
 140 static int              ipw_ioctl(struct ifnet *, u_long, caddr_t,
 141                                 struct ucred *cr);
 142 static void             ipw_stop_master(struct ipw_softc *);
 143 static int              ipw_reset(struct ipw_softc *);
 144 static int              ipw_load_ucode(struct ipw_softc *, u_char *, int);
 145 static int              ipw_load_firmware(struct ipw_softc *, u_char *, int);
 146 static int              ipw_cache_firmware(struct ipw_softc *, void *);
 147 static void             ipw_free_firmware(struct ipw_softc *);
 148 static int              ipw_config(struct ipw_softc *);
 149 static void             ipw_init(void *);
 150 static void             ipw_stop(void *);
 151 static int              ipw_sysctl_stats(SYSCTL_HANDLER_ARGS);
 152 static int              ipw_sysctl_radio(SYSCTL_HANDLER_ARGS);
 153 static u_int32_t        ipw_read_table1(struct ipw_softc *, u_int32_t);
 154 static void             ipw_write_table1(struct ipw_softc *, u_int32_t,
 155                             u_int32_t);
 156 static int              ipw_read_table2(struct ipw_softc *, u_int32_t, void *,
 157                             u_int32_t *);
 158 static void             ipw_read_mem_1(struct ipw_softc *, bus_size_t,
 159                             u_int8_t *, bus_size_t);
 160 static void             ipw_write_mem_1(struct ipw_softc *, bus_size_t,
 161                             u_int8_t *, bus_size_t);
 162
 163 static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
 164 {
 165         CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
 166         return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
 167 }
 168
 169 static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
 170 {
 171         CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
 172         return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
 173 }
 174
 175 static int ipw_probe(device_t);
 176 static int ipw_attach(device_t);
 177 static int ipw_detach(device_t);
 178 static int ipw_shutdown(device_t);
 179 static int ipw_suspend(device_t);
 180 static int ipw_resume(device_t);
 181
 182 static device_method_t ipw_methods[] = {
 183         /* Device interface */
 184         DEVMETHOD(device_probe,         ipw_probe),
 185         DEVMETHOD(device_attach,        ipw_attach),
 186         DEVMETHOD(device_detach,        ipw_detach),
 187         DEVMETHOD(device_shutdown,      ipw_shutdown),
 188         DEVMETHOD(device_suspend,       ipw_suspend),
 189         DEVMETHOD(device_resume,        ipw_resume),
 190
 191         { 0, 0 }
 192 };
 193
 194 static DEFINE_CLASS_0(ipw, ipw_driver, ipw_methods, sizeof(struct ipw_softc));
 195 static devclass_t ipw_devclass;
 196
 197 DRIVER_MODULE(ipw, pci, ipw_driver, ipw_devclass, 0, 0);
 198
 199 static int
 200 ipw_probe(device_t dev)
 201 {
 202         const struct ipw_ident *ident;
 203
 204         for (ident = ipw_ident_table; ident->name != NULL; ident++) {
 205                 if (pci_get_vendor(dev) == ident->vendor &&
 206                     pci_get_device(dev) == ident->device) {
 207                         device_set_desc(dev, ident->name);
 208                         return 0;
 209                 }
 210         }
 211         return ENXIO;
 212 }
 213
 214 /* Base Address Register */
 215 #define IPW_PCI_BAR0    0x10
 216
 217 static int
 218 ipw_attach(device_t dev)
 219 {
 220         struct ipw_softc *sc = device_get_softc(dev);
 221         struct ieee80211com *ic = &sc->sc_ic;
 222         struct ifnet *ifp = &ic->ic_if;
 223         struct sysctl_oid *sysctl_tree;
 224         u_int16_t val;
 225         int error, rid, i;
 226
 227         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 228                 device_printf(dev, "chip is in D%d power mode "
 229                     "-- setting to D0\n", pci_get_powerstate(dev));
 230                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 231         }
 232
 233         pci_write_config(dev, 0x41, 0, 1);
 234
 235         /* enable bus-mastering */
 236         pci_enable_busmaster(dev);
 237
 238         /* map the register window */
 239         rid = IPW_PCI_BAR0;
 240         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid, RF_ACTIVE);
 241         if (sc->mem == NULL) {
 242                 device_printf(dev, "could not allocate memory resource\n");
 243                 goto fail;
 244         }
 245
 246         sc->sc_st = rman_get_bustag(sc->mem);
 247         sc->sc_sh = rman_get_bushandle(sc->mem);
 248
 249         rid = 0;
 250         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
 251             RF_SHAREABLE);
 252         if (sc->irq == NULL) {
 253                 device_printf(dev, "could not allocate interrupt resource\n");
 254                 goto fail;
 255         }
 256
 257         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 258
 259         if (ipw_reset(sc) != 0) {
 260                 device_printf(dev, "could not reset adapter\n");
 261                 goto fail;
 262         }
 263
 264         sysctl_ctx_init(&sc->sysctl_ctx);
 265         sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
 266                 SYSCTL_STATIC_CHILDREN(_hw),
 267                 OID_AUTO,
 268                 device_get_nameunit(dev),
 269                 CTLFLAG_RD,
 270                 0, "");
 271
 272         if (ipw_dma_alloc(dev) != 0) {
 273                 device_printf(dev, "could not allocate DMA resources\n");
 274                 goto fail;
 275         }
 276
 277         ic->ic_phytype = IEEE80211_T_DS;
 278         ic->ic_opmode = IEEE80211_M_STA;
 279         ic->ic_state = IEEE80211_S_INIT;
 280
 281         /* set device capabilities */
 282        ic->ic_caps = IEEE80211_C_SHPREAMBLE | IEEE80211_C_TXPMGT |
 283            IEEE80211_C_PMGT | IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
 284            IEEE80211_C_WEP;
 285
 286         /* read MAC address from EEPROM */
 287         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
 288         ic->ic_myaddr[0] = val >> 8;
 289         ic->ic_myaddr[1] = val & 0xff;
 290         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
 291         ic->ic_myaddr[2] = val >> 8;
 292         ic->ic_myaddr[3] = val & 0xff;
 293         val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
 294         ic->ic_myaddr[4] = val >> 8;
 295         ic->ic_myaddr[5] = val & 0xff;
 296
 297         /* set supported .11b rates */
 298         ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
 299
 300         /* set supported .11b channels (read from EEPROM) */
 301         if ((val = ipw_read_prom_word(sc, IPW_EEPROM_CHANNEL_LIST)) == 0)
 302                 val = 0x7ff; /* default to channels 1-11 */
 303         val <<= 1;
 304         for (i = 1; i < 16; i++) {
 305                 if (val & (1 << i)) {
 306                         ic->ic_channels[i].ic_freq =
 307                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
 308                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
 309                 }
 310         }
 311
 312         /* check support for radio transmitter switch in EEPROM */
 313         if (!(ipw_read_prom_word(sc, IPW_EEPROM_RADIO) & 8))
 314                 sc->flags |= IPW_FLAG_HAS_RADIO_SWITCH;
 315
 316         /* default to authmode OPEN */
 317         sc->authmode = IEEE80211_AUTH_OPEN;
 318
 319         /* IBSS channel undefined for now */
 320         ic->ic_ibss_chan = &ic->ic_channels[0];
 321
 322         ifp->if_softc = sc;
 323         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 324         ifp->if_init = ipw_init;
 325         ifp->if_ioctl = ipw_ioctl;
 326         ifp->if_start = ipw_start;
 327         ifp->if_watchdog = ipw_watchdog;
 328         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 329         ifq_set_ready(&ifp->if_snd);
 330
 331         ieee80211_ifattach(ifp);
 332         /* override state transition machine */
 333         sc->sc_newstate = ic->ic_newstate;
 334         ic->ic_newstate = ipw_newstate;
 335         ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
 336
 337         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 338             sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
 339
 340         sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
 341         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
 342         sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
 343
 344         sc->sc_txtap_len = sizeof sc->sc_txtapu;
 345         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
 346         sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
 347
 348         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 349             SYSCTL_CHILDREN(sysctl_tree), OID_AUTO, "radio",
 350             CTLTYPE_INT | CTLFLAG_RD, sc, 0, ipw_sysctl_radio, "I",
 351             "Radio transmitter switch");
 352
 353         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 354             SYSCTL_CHILDREN(sysctl_tree), OID_AUTO, "stats",
 355             CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, ipw_sysctl_stats, "S",
 356             "Statistics");
 357
 358         /*
 359          * Hook our interrupt after all initialization is complete
 360          */
 361         error = bus_setup_intr(dev, sc->irq, INTR_MPSAFE,
 362                                ipw_intr, sc, &sc->sc_ih, NULL);
 363         if (error != 0) {
 364                 device_printf(dev, "could not set up interrupt\n");
 365                 goto fail;
 366         }
 367
 368         return 0;
 369
 370 fail:   ipw_detach(dev);
 371         return ENXIO;
 372 }
 373
 374 static int
 375 ipw_detach(device_t dev)
 376 {
 377         struct ipw_softc *sc = device_get_softc(dev);
 378         struct ifnet *ifp = &sc->sc_ic.ic_if;
 379         IPW_LOCK_DECL();
 380
 381         IPW_LOCK(sc);
 382
 383         ipw_stop(sc);
 384         ipw_free_firmware(sc);
 385
 386         IPW_UNLOCK(sc);
 387
 388         bpfdetach(ifp);
 389
 390         ieee80211_ifdetach(ifp);
 391
 392         ipw_release(sc);
 393
 394         if (sc->irq != NULL) {
 395                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
 396                 bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq);
 397         }
 398
 399         if (sc->mem != NULL)
 400                 bus_release_resource(dev, SYS_RES_MEMORY, IPW_PCI_BAR0,
 401                     sc->mem);
 402
 403         sysctl_ctx_free(&sc->sysctl_ctx);
 404
 405         return 0;
 406 }
 407
 408 static int
 409 ipw_dma_alloc(device_t dev)
 410 {
 411         struct ipw_soft_bd *sbd;
 412         struct ipw_soft_hdr *shdr;
 413         struct ipw_soft_buf *sbuf;
 414         bus_addr_t physaddr;
 415         int error, i;
 416         struct ipw_softc *sc;
 417
 418         sc = device_get_softc(dev);
 419         /*
 420          * Allocate and map tx ring
 421          */
 422         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 423             BUS_SPACE_MAXADDR, NULL, NULL, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
 424             &sc->tbd_dmat);
 425         if (error != 0) {
 426                 device_printf(dev, "could not create tx ring DMA tag\n");
 427                 goto fail;
 428         }
 429
 430         error = bus_dmamem_alloc(sc->tbd_dmat, (void **)&sc->tbd_list,
 431             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->tbd_map);
 432         if (error != 0) {
 433                 device_printf(dev, "could not allocate tx ring DMA memory\n");
 434                 goto fail;
 435         }
 436
 437         error = bus_dmamap_load(sc->tbd_dmat, sc->tbd_map, sc->tbd_list,
 438             IPW_TBD_SZ, ipw_dma_map_addr, &sc->tbd_phys, 0);
 439         if (error != 0) {
 440                 device_printf(dev, "could not map tx ring DMA memory\n");
 441                 goto fail;
 442         }
 443
 444         /*
 445          * Allocate and map rx ring
 446          */
 447         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 448             BUS_SPACE_MAXADDR, NULL, NULL, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
 449             &sc->rbd_dmat);
 450         if (error != 0) {
 451                 device_printf(dev, "could not create rx ring DMA tag\n");
 452                 goto fail;
 453         }
 454
 455         error = bus_dmamem_alloc(sc->rbd_dmat, (void **)&sc->rbd_list,
 456             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->rbd_map);
 457         if (error != 0) {
 458                 device_printf(dev, "could not allocate rx ring DMA memory\n");
 459                 goto fail;
 460         }
 461
 462         error = bus_dmamap_load(sc->rbd_dmat, sc->rbd_map, sc->rbd_list,
 463             IPW_RBD_SZ, ipw_dma_map_addr, &sc->rbd_phys, 0);
 464         if (error != 0) {
 465                 device_printf(dev, "could not map rx ring DMA memory\n");
 466                 goto fail;
 467         }
 468
 469         /*
 470          * Allocate and map status ring
 471          */
 472         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 473             BUS_SPACE_MAXADDR, NULL, NULL, IPW_STATUS_SZ, 1, IPW_STATUS_SZ, 0,
 474             &sc->status_dmat);
 475         if (error != 0) {
 476                 device_printf(dev, "could not create status ring DMA tag\n");
 477                 goto fail;
 478         }
 479
 480         error = bus_dmamem_alloc(sc->status_dmat, (void **)&sc->status_list,
 481             BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->status_map);
 482         if (error != 0) {
 483                 device_printf(dev,
 484                     "could not allocate status ring DMA memory\n");
 485                 goto fail;
 486         }
 487
 488         error = bus_dmamap_load(sc->status_dmat, sc->status_map,
 489             sc->status_list, IPW_STATUS_SZ, ipw_dma_map_addr, &sc->status_phys,
 490             0);
 491         if (error != 0) {
 492                 device_printf(dev, "could not map status ring DMA memory\n");
 493                 goto fail;
 494         }
 495
 496         /*
 497          * Allocate command DMA map
 498          */
 499         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 500             BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_cmd), 1,
 501             sizeof (struct ipw_cmd), 0, &sc->cmd_dmat);
 502         if (error != 0) {
 503                 device_printf(dev, "could not create command DMA tag\n");
 504                 goto fail;
 505         }
 506
 507         error = bus_dmamap_create(sc->cmd_dmat, 0, &sc->cmd_map);
 508         if (error != 0) {
 509                 device_printf(dev, "could not create command DMA map\n");
 510                 goto fail;
 511         }
 512
 513         /*
 514          * Allocate headers DMA maps
 515          */
 516         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 517             BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_hdr), 1,
 518             sizeof (struct ipw_hdr), 0, &sc->hdr_dmat);
 519         if (error != 0) {
 520                 device_printf(dev, "could not create header DMA tag\n");
 521                 goto fail;
 522         }
 523
 524         SLIST_INIT(&sc->free_shdr);
 525         for (i = 0; i < IPW_NDATA; i++) {
 526                 shdr = &sc->shdr_list[i];
 527                 error = bus_dmamap_create(sc->hdr_dmat, 0, &shdr->map);
 528                 if (error != 0) {
 529                         device_printf(dev, "could not create header DMA map\n");
 530                         goto fail;
 531                 }
 532                 SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
 533         }
 534
 535         /*
 536          * Allocate tx buffers DMA maps
 537          */
 538         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 539             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IPW_MAX_NSEG, MCLBYTES, 0,
 540             &sc->txbuf_dmat);
 541         if (error != 0) {
 542                 device_printf(dev, "could not create tx DMA tag\n");
 543                 goto fail;
 544         }
 545
 546         SLIST_INIT(&sc->free_sbuf);
 547         for (i = 0; i < IPW_NDATA; i++) {
 548                 sbuf = &sc->tx_sbuf_list[i];
 549                 error = bus_dmamap_create(sc->txbuf_dmat, 0, &sbuf->map);
 550                 if (error != 0) {
 551                         device_printf(dev, "could not create tx DMA map\n");
 552                         goto fail;
 553                 }
 554                 SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
 555         }
 556
 557         /*
 558          * Initialize tx ring
 559          */
 560         for (i = 0; i < IPW_NTBD; i++) {
 561                 sbd = &sc->stbd_list[i];
 562                 sbd->bd = &sc->tbd_list[i];
 563                 sbd->type = IPW_SBD_TYPE_NOASSOC;
 564         }
 565
 566         /*
 567          * Pre-allocate rx buffers and DMA maps
 568          */
 569         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 570             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IPW_NRBD, MCLBYTES, 0,
 571             &sc->rxbuf_dmat);
 572         if (error != 0) {
 573                 device_printf(dev, "could not create rx DMA tag\n");
 574                 goto fail;
 575         }
 576
 577         for (i = 0; i < IPW_NRBD; i++) {
 578                 sbd = &sc->srbd_list[i];
 579                 sbuf = &sc->rx_sbuf_list[i];
 580                 sbd->bd = &sc->rbd_list[i];
 581
 582                 sbuf->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 583                 if (sbuf->m == NULL) {
 584                         device_printf(dev, "could not allocate rx mbuf\n");
 585                         error = ENOMEM;
 586                         goto fail;
 587                 }
 588
 589                 error = bus_dmamap_create(sc->rxbuf_dmat, 0, &sbuf->map);
 590                 if (error != 0) {
 591                         device_printf(dev, "could not create rx DMA map\n");
 592                         goto fail;
 593                 }
 594
 595                 error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map,
 596                     mtod(sbuf->m, void *), MCLBYTES, ipw_dma_map_addr,
 597                     &physaddr, 0);
 598                 if (error != 0) {
 599                         device_printf(dev, "could not map rx DMA memory\n");
 600                         goto fail;
 601                 }
 602
 603                 sbd->type = IPW_SBD_TYPE_DATA;
 604                 sbd->priv = sbuf;
 605                 sbd->bd->physaddr = htole32(physaddr);
 606                 sbd->bd->len = htole32(MCLBYTES);
 607         }
 608
 609         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
 610
 611         return 0;
 612
 613 fail:   ipw_release(sc);
 614         return error;
 615 }
 616
 617 static void
 618 ipw_release(struct ipw_softc *sc)
 619 {
 620         struct ipw_soft_buf *sbuf;
 621         int i;
 622
 623         if (sc->tbd_dmat != NULL) {
 624                 if (sc->stbd_list != NULL) {
 625                         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map,
 626                             BUS_DMASYNC_POSTWRITE);
 627                         bus_dmamap_unload(sc->tbd_dmat, sc->tbd_map);
 628                         bus_dmamem_free(sc->tbd_dmat, sc->tbd_list,
 629                             sc->tbd_map);
 630                 }
 631                 bus_dma_tag_destroy(sc->tbd_dmat);
 632         }
 633
 634         if (sc->rbd_dmat != NULL) {
 635                 if (sc->rbd_list != NULL) {
 636                         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map,
 637                             BUS_DMASYNC_POSTWRITE);
 638                         bus_dmamap_unload(sc->rbd_dmat, sc->rbd_map);
 639                         bus_dmamem_free(sc->rbd_dmat, sc->rbd_list,
 640                             sc->rbd_map);
 641                 }
 642                 bus_dma_tag_destroy(sc->rbd_dmat);
 643         }
 644
 645         if (sc->status_dmat != NULL) {
 646                 if (sc->status_list != NULL) {
 647                         bus_dmamap_sync(sc->status_dmat, sc->status_map,
 648                             BUS_DMASYNC_POSTWRITE);
 649                         bus_dmamap_unload(sc->status_dmat, sc->status_map);
 650                         bus_dmamem_free(sc->status_dmat, sc->status_list,
 651                             sc->status_map);
 652                 }
 653                 bus_dma_tag_destroy(sc->status_dmat);
 654         }
 655
 656         for (i = 0; i < IPW_NTBD; i++)
 657                 ipw_release_sbd(sc, &sc->stbd_list[i]);
 658
 659         if (sc->cmd_dmat != NULL) {
 660                 bus_dmamap_destroy(sc->cmd_dmat, sc->cmd_map);
 661                 bus_dma_tag_destroy(sc->cmd_dmat);
 662         }
 663
 664         if (sc->hdr_dmat != NULL) {
 665                 for (i = 0; i < IPW_NDATA; i++)
 666                         bus_dmamap_destroy(sc->hdr_dmat, sc->shdr_list[i].map);
 667                 bus_dma_tag_destroy(sc->hdr_dmat);
 668         }
 669
 670         if (sc->txbuf_dmat != NULL) {
 671                 for (i = 0; i < IPW_NDATA; i++) {
 672                         bus_dmamap_destroy(sc->txbuf_dmat,
 673                             sc->tx_sbuf_list[i].map);
 674                 }
 675                 bus_dma_tag_destroy(sc->txbuf_dmat);
 676         }
 677
 678         if (sc->rxbuf_dmat != NULL) {
 679                 for (i = 0; i < IPW_NRBD; i++) {
 680                         sbuf = &sc->rx_sbuf_list[i];
 681                         if (sbuf->m != NULL) {
 682                                 bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map,
 683                                     BUS_DMASYNC_POSTREAD);
 684                                 bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
 685                                 m_freem(sbuf->m);
 686                         }
 687                         bus_dmamap_destroy(sc->rxbuf_dmat, sbuf->map);
 688                 }
 689                 bus_dma_tag_destroy(sc->rxbuf_dmat);
 690         }
 691 }
 692
 693 static int
 694 ipw_shutdown(device_t dev)
 695 {
 696         struct ipw_softc *sc = device_get_softc(dev);
 697         IPW_LOCK_DECL();
 698
 699         IPW_LOCK(sc);
 700
 701         ipw_stop(sc);
 702
 703         IPW_UNLOCK(sc);
 704
 705         return 0;
 706 }
 707
 708 static int
 709 ipw_suspend(device_t dev)
 710 {
 711         struct ipw_softc *sc = device_get_softc(dev);
 712         IPW_LOCK_DECL();
 713
 714         IPW_LOCK(sc);
 715
 716         ipw_stop(sc);
 717
 718         IPW_UNLOCK(sc);
 719
 720         return 0;
 721 }
 722
 723 static int
 724 ipw_resume(device_t dev)
 725 {
 726         struct ipw_softc *sc = device_get_softc(dev);
 727         struct ifnet *ifp = &sc->sc_ic.ic_if;
 728         IPW_LOCK_DECL();
 729
 730         IPW_LOCK(sc);
 731
 732         pci_write_config(dev, 0x41, 0, 1);
 733
 734         if (ifp->if_flags & IFF_UP) {
 735                 ifp->if_init(ifp->if_softc);
 736                 if (ifp->if_flags & IFF_RUNNING)
 737                         ifp->if_start(ifp);
 738         }
 739
 740         IPW_UNLOCK(sc);
 741
 742         return 0;
 743 }
 744
 745 static int
 746 ipw_media_change(struct ifnet *ifp)
 747 {
 748         struct ipw_softc *sc = ifp->if_softc;
 749         int error;
 750         IPW_LOCK_DECL();
 751
 752         IPW_LOCK(sc);
 753
 754         error = ieee80211_media_change(ifp);
 755         if (error != ENETRESET) {
 756                 IPW_UNLOCK(sc);
 757                 return error;
 758         }
 759
 760         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
 761                 ipw_init(sc);
 762
 763         IPW_UNLOCK(sc);
 764
 765         return 0;
 766 }
 767
 768 static void
 769 ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
 770 {
 771         struct ipw_softc *sc = ifp->if_softc;
 772         struct ieee80211com *ic = &sc->sc_ic;
 773 #define N(a)    (sizeof (a) / sizeof (a[0]))
 774         static const struct {
 775                 u_int32_t       val;
 776                 int             rate;
 777         } rates[] = {
 778                 { IPW_RATE_DS1,   2 },
 779                 { IPW_RATE_DS2,   4 },
 780                 { IPW_RATE_DS5,  11 },
 781                 { IPW_RATE_DS11, 22 },
 782         };
 783         u_int32_t val, i;
 784         int rate;
 785
 786         imr->ifm_status = IFM_AVALID;
 787         imr->ifm_active = IFM_IEEE80211;
 788         if (ic->ic_state == IEEE80211_S_RUN)
 789                 imr->ifm_status |= IFM_ACTIVE;
 790
 791         /* read current transmission rate from adapter */
 792         val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE) & 0xf;
 793
 794         /* convert rate to 802.11 rate */
 795         for (i = 0; i < N(rates) && rates[i].val != val; i++);
 796         rate = (i < N(rates)) ? rates[i].rate : 0;
 797
 798         imr->ifm_active |= IFM_IEEE80211_11B;
 799         imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
 800         switch (ic->ic_opmode) {
 801         case IEEE80211_M_STA:
 802                 break;
 803
 804         case IEEE80211_M_IBSS:
 805                 imr->ifm_active |= IFM_IEEE80211_IBSS;
 806                 break;
 807
 808         case IEEE80211_M_MONITOR:
 809                 imr->ifm_active |= IFM_IEEE80211_MONITOR;
 810                 break;
 811
 812         case IEEE80211_M_AHDEMO:
 813         case IEEE80211_M_HOSTAP:
 814                 /* should not get there */
 815                 break;
 816         }
 817 #undef N
 818 }
 819
 820 static int
 821 ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg __unused)
 822 {
 823         struct ipw_softc *sc = ic->ic_softc;
 824         struct ieee80211_node *ni = ic->ic_bss;
 825         u_int32_t len;
 826         u_int8_t val;
 827
 828         switch (nstate) {
 829         case IEEE80211_S_RUN:
 830                 len = IEEE80211_NWID_LEN;
 831                 ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
 832                 ni->ni_esslen = len;
 833
 834                 val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
 835                 ni->ni_chan = &ic->ic_channels[val];
 836
 837                 DELAY(100); /* firmware needs a short delay here */
 838
 839                 len = IEEE80211_ADDR_LEN;
 840                 ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
 841                 IEEE80211_ADDR_COPY(ni->ni_macaddr, ni->ni_bssid);
 842                 break;
 843
 844         case IEEE80211_S_INIT:
 845         case IEEE80211_S_SCAN:
 846         case IEEE80211_S_AUTH:
 847         case IEEE80211_S_ASSOC:
 848                 break;
 849         }
 850
 851         ic->ic_state = nstate;
 852         return 0;
 853 }
 854
 855 /*
 856  * Read 16 bits at address 'addr' from the Microwire EEPROM.
 857  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
 858  */
 859 static u_int16_t
 860 ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
 861 {
 862         u_int32_t tmp;
 863         u_int16_t val;
 864         int n;
 865
 866         /* Clock C once before the first command */
 867         IPW_EEPROM_CTL(sc, 0);
 868         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 869         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 870         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 871
 872         /* Write start bit (1) */
 873         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
 874         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
 875
 876         /* Write READ opcode (10) */
 877         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
 878         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
 879         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 880         IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 881
 882         /* Write address A7-A0 */
 883         for (n = 7; n >= 0; n--) {
 884                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
 885                     (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
 886                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
 887                     (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
 888         }
 889
 890         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 891
 892         /* Read data Q15-Q0 */
 893         val = 0;
 894         for (n = 15; n >= 0; n--) {
 895                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
 896                 IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 897                 tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
 898                 val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
 899         }
 900
 901         IPW_EEPROM_CTL(sc, 0);
 902
 903         /* Clear Chip Select and clock C */
 904         IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
 905         IPW_EEPROM_CTL(sc, 0);
 906         IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
 907
 908         return le16toh(val);
 909 }
 910
 911 static void
 912 ipw_scan_result(struct ipw_softc *sc)
 913 {
 914         struct ieee80211com *ic = &sc->sc_ic;
 915         struct ieee80211_node *ni;
 916         u_int32_t i, cnt, off;
 917         struct ipw_node ap;
 918
 919         /* flush previously seen access points */
 920         ieee80211_free_allnodes(ic);
 921
 922         cnt = ipw_read_table1(sc, IPW_INFO_APS_CNT);
 923         off = ipw_read_table1(sc, IPW_INFO_APS_BASE);
 924
 925         DPRINTF(("Found %u APs\n", cnt));
 926
 927         for (i = 0; i < cnt; i++) {
 928                 ipw_read_mem_1(sc, off, (u_int8_t *)&ap, sizeof ap);
 929                 off += sizeof ap;
 930
 931 #ifdef IPW_DEBUG
 932                 if (ipw_debug >= 2) {
 933                         u_char *p = (u_char *)&ap;
 934                         int j;
 935
 936                         printf("AP%u\n", i);
 937                         for (j = 0; j < sizeof ap; j++)
 938                                 printf("%02x", *p++);
 939                         printf("\n");
 940                 }
 941 #endif
 942
 943                 ni = ieee80211_lookup_node(ic, ap.bssid,
 944                     &ic->ic_channels[ap.chan]);
 945                 if (ni != NULL)
 946                         continue;
 947
 948                 ni = ieee80211_alloc_node(ic, ap.bssid);
 949                 if (ni == NULL)
 950                         return;
 951
 952                 IEEE80211_ADDR_COPY(ni->ni_bssid, ap.bssid);
 953                 ni->ni_rssi = ap.rssi;
 954                 ni->ni_intval = le16toh(ap.intval);
 955                 ni->ni_capinfo = le16toh(ap.capinfo);
 956                 ni->ni_chan = &ic->ic_channels[ap.chan];
 957                 ni->ni_esslen = ap.esslen;
 958                 bcopy(ap.essid, ni->ni_essid, IEEE80211_NWID_LEN);
 959         }
 960 }
 961
 962 static void
 963 ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
 964 {
 965         struct ipw_cmd *cmd;
 966
 967         cmd = mtod(sbuf->m, struct ipw_cmd *);
 968
 969         DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
 970             le32toh(cmd->type), le32toh(cmd->subtype), le32toh(cmd->seq),
 971             le32toh(cmd->len), le32toh(cmd->status)));
 972
 973         wakeup(sc);
 974 }
 975
 976 static void
 977 ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
 978 {
 979         struct ieee80211com *ic = &sc->sc_ic;
 980         u_int32_t state;
 981
 982         state = le32toh(*mtod(sbuf->m, u_int32_t *));
 983
 984         DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
 985
 986         switch (state) {
 987         case IPW_STATE_ASSOCIATED:
 988                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 989                 break;
 990
 991         case IPW_STATE_SCANNING:
 992                 /* don't leave run state on background scan */
 993                 if (ic->ic_state != IEEE80211_S_RUN)
 994                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 995                 break;
 996
 997         case IPW_STATE_SCAN_COMPLETE:
 998                 ipw_scan_result(sc);
 999                 break;
1000
1001         case IPW_STATE_ASSOCIATION_LOST:
1002                 ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1003                 break;
1004
1005         case IPW_STATE_RADIO_DISABLED:
1006                 sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1007                 ipw_stop(sc);
1008                 break;
1009         }
1010 }
1011
1012 static void
1013 ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
1014     struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
1015 {
1016         struct ieee80211com *ic = &sc->sc_ic;
1017         struct ifnet *ifp = &ic->ic_if;
1018         struct mbuf *m;
1019         struct ieee80211_frame *wh;
1020         struct ieee80211_node *ni;
1021         bus_addr_t physaddr;
1022         int error;
1023
1024         DPRINTFN(5, ("RX!DATA!%u!%u\n", le32toh(status->len), status->rssi));
1025
1026         if (le32toh(status->len) < sizeof (struct ieee80211_frame_min) ||
1027             le32toh(status->len) > MCLBYTES) {
1028                 if_printf(ifp, "bad frame length\n");
1029                 return;
1030         }
1031
1032         bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
1033
1034         /* Finalize mbuf */
1035         m = sbuf->m;
1036         m->m_pkthdr.rcvif = ifp;
1037         m->m_pkthdr.len = m->m_len = le32toh(status->len);
1038
1039         if (sc->sc_drvbpf != NULL) {
1040                 struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
1041
1042                 tap->wr_flags = 0;
1043                 tap->wr_antsignal = status->rssi;
1044                 tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1045                 tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1046
1047                 bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1048         }
1049
1050         wh = mtod(m, struct ieee80211_frame *);
1051
1052         if (ic->ic_opmode != IEEE80211_M_STA) {
1053                 ni = ieee80211_find_node(ic, wh->i_addr2);
1054                 if (ni == NULL)
1055                         ni = ieee80211_ref_node(ic->ic_bss);
1056         } else
1057                 ni = ieee80211_ref_node(ic->ic_bss);
1058
1059         /* Send the frame to the upper layer */
1060         ieee80211_input(ifp, m, ni, status->rssi, 0);
1061
1062         if (ni == ic->ic_bss)
1063                 ieee80211_unref_node(&ni);
1064         else
1065                 ieee80211_free_node(ic, ni);
1066
1067         m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1068         if (m == NULL) {
1069                 if_printf(ifp, "could not allocate rx mbuf\n");
1070                 sbuf->m = NULL;
1071                 return;
1072         }
1073
1074         error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map, mtod(m, void *),
1075             MCLBYTES, ipw_dma_map_addr, &physaddr, 0);
1076         if (error != 0) {
1077                 if_printf(ifp, "could not map rx DMA memory\n");
1078                 m_freem(m);
1079                 sbuf->m = NULL;
1080                 return;
1081         }
1082
1083         sbuf->m = m;
1084         sbd->bd->physaddr = htole32(physaddr);
1085 }
1086
1087 static void
1088 ipw_notification_intr(struct ipw_softc *sc __unused, struct ipw_soft_buf *sbuf __unused)
1089 {
1090         DPRINTFN(2, ("RX!NOTIFICATION\n"));
1091 }
1092
1093 static void
1094 ipw_rx_intr(struct ipw_softc *sc)
1095 {
1096         struct ipw_status *status;
1097         struct ipw_soft_bd *sbd;
1098         struct ipw_soft_buf *sbuf;
1099         u_int32_t r, i;
1100
1101         if (!(sc->flags & IPW_FLAG_FW_INITED))
1102                 return;
1103
1104         r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
1105
1106         bus_dmamap_sync(sc->status_dmat, sc->status_map, BUS_DMASYNC_POSTREAD);
1107
1108         for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
1109
1110                 status = &sc->status_list[i];
1111                 sbd = &sc->srbd_list[i];
1112                 sbuf = sbd->priv;
1113
1114                 bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map,
1115                     BUS_DMASYNC_POSTREAD);
1116
1117                 switch (le16toh(status->code) & 0xf) {
1118                 case IPW_STATUS_CODE_COMMAND:
1119                         ipw_command_intr(sc, sbuf);
1120                         break;
1121
1122                 case IPW_STATUS_CODE_NEWSTATE:
1123                         ipw_newstate_intr(sc, sbuf);
1124                         break;
1125
1126                 case IPW_STATUS_CODE_DATA_802_3:
1127                 case IPW_STATUS_CODE_DATA_802_11:
1128                         ipw_data_intr(sc, status, sbd, sbuf);
1129                         break;
1130
1131                 case IPW_STATUS_CODE_NOTIFICATION:
1132                         ipw_notification_intr(sc, sbuf);
1133                         break;
1134
1135                 default:
1136                         if_printf(&sc->sc_ic.ic_if, "unknown status code %u\n",
1137                                   le16toh(status->code));
1138                 }
1139
1140                 /* firmware was killed, stop processing received frames */
1141                 if (!(sc->flags & IPW_FLAG_FW_INITED))
1142                         return;
1143
1144                 sbd->bd->flags = 0;
1145         }
1146         /* Some buffer descriptors may have changed */
1147         bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
1148
1149         /* Tell the firmware what we have processed */
1150         sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
1151         CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
1152 }
1153
1154 static void
1155 ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1156 {
1157         struct ieee80211com *ic = &sc->sc_ic;
1158         struct ipw_soft_hdr *shdr;
1159         struct ipw_soft_buf *sbuf;
1160
1161         switch (sbd->type) {
1162         case IPW_SBD_TYPE_COMMAND:
1163                 bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map,
1164                     BUS_DMASYNC_POSTWRITE);
1165                 bus_dmamap_unload(sc->cmd_dmat, sc->cmd_map);
1166                 break;
1167
1168         case IPW_SBD_TYPE_HEADER:
1169                 shdr = sbd->priv;
1170                 bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_POSTWRITE);
1171                 bus_dmamap_unload(sc->hdr_dmat, shdr->map);
1172                 SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1173                 break;
1174
1175         case IPW_SBD_TYPE_DATA:
1176                 sbuf = sbd->priv;
1177                 bus_dmamap_sync(sc->txbuf_dmat, sbuf->map,
1178                     BUS_DMASYNC_POSTWRITE);
1179                 bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1180                 SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1181
1182                 m_freem(sbuf->m);
1183
1184                 if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
1185                         ieee80211_free_node(ic, sbuf->ni);
1186
1187                 /* kill watchdog timer */
1188                 sc->sc_tx_timer = 0;
1189                 break;
1190         }
1191         sbd->type = IPW_SBD_TYPE_NOASSOC;
1192 }
1193
1194 static void
1195 ipw_tx_intr(struct ipw_softc *sc)
1196 {
1197         struct ifnet *ifp = &sc->sc_ic.ic_if;
1198         u_int32_t r, i;
1199
1200         if (!(sc->flags & IPW_FLAG_FW_INITED))
1201                 return;
1202
1203         r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1204
1205         for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1206                 ipw_release_sbd(sc, &sc->stbd_list[i]);
1207                 sc->txfree++;
1208         }
1209
1210         /* Remember what the firmware has processed */
1211         sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1212
1213         /* Call start() since some buffer descriptors have been released */
1214         ifp->if_flags &= ~IFF_OACTIVE;
1215         (*ifp->if_start)(ifp);
1216 }
1217
1218 static void
1219 ipw_intr(void *arg)
1220 {
1221         struct ipw_softc *sc = arg;
1222         u_int32_t r;
1223         IPW_LOCK_DECL();
1224
1225         IPW_LOCK(sc);
1226
1227         if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff) {
1228                 IPW_UNLOCK(sc);
1229                 return;
1230         }
1231
1232         /* Disable interrupts */
1233         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1234
1235         DPRINTFN(8, ("INTR!0x%08x\n", r));
1236
1237         if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1238                 if_printf(&sc->sc_ic.ic_if, "fatal error\n");
1239                 sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1240                 ipw_stop(sc);
1241         }
1242
1243         if (r & IPW_INTR_FW_INIT_DONE) {
1244                 if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1245                         wakeup(sc);
1246         }
1247
1248         if (r & IPW_INTR_RX_TRANSFER)
1249                 ipw_rx_intr(sc);
1250
1251         if (r & IPW_INTR_TX_TRANSFER)
1252                 ipw_tx_intr(sc);
1253
1254         /* Acknowledge interrupts */
1255         CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1256
1257         /* Re-enable interrupts */
1258         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1259
1260         IPW_UNLOCK(sc);
1261 }
1262
1263 static void
1264 ipw_dma_map_txbuf(void *arg, bus_dma_segment_t *segs, int nseg,
1265     bus_size_t mapsize, int error)
1266 {
1267         struct ipw_dma_mapping *map = arg;
1268
1269         if (error != 0)
1270                 return;
1271
1272         KASSERT(nseg <= IPW_MAX_NSEG, ("too many DMA segments %d", nseg));
1273
1274         bcopy(segs, map->segs, nseg * sizeof (bus_dma_segment_t));
1275         map->nseg = nseg;
1276         map->mapsize = mapsize;
1277 }
1278
1279 static void
1280 ipw_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg __unused, int error)
1281 {
1282         if (error != 0)
1283                 return;
1284
1285         KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
1286
1287         *(bus_addr_t *)arg = segs[0].ds_addr;
1288 }
1289
1290 static int
1291 ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
1292 {
1293         struct ipw_soft_bd *sbd;
1294         bus_addr_t physaddr;
1295         int error;
1296
1297         sbd = &sc->stbd_list[sc->txcur];
1298
1299         error = bus_dmamap_load(sc->cmd_dmat, sc->cmd_map, &sc->cmd,
1300             sizeof (struct ipw_cmd), ipw_dma_map_addr, &physaddr, 0);
1301         if (error != 0) {
1302                 if_printf(&sc->sc_ic.ic_if,
1303                           "could not map command DMA memory\n");
1304                 return error;
1305         }
1306
1307         sc->cmd.type = htole32(type);
1308         sc->cmd.subtype = htole32(0);
1309         sc->cmd.len = htole32(len);
1310         sc->cmd.seq = htole32(0);
1311         if (data != NULL)
1312                 bcopy(data, sc->cmd.data, len);
1313
1314         sbd->type = IPW_SBD_TYPE_COMMAND;
1315         sbd->bd->physaddr = htole32(physaddr);
1316         sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1317         sbd->bd->nfrag = 1;
1318         sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1319                          IPW_BD_FLAG_TX_LAST_FRAGMENT;
1320
1321         bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map, BUS_DMASYNC_PREWRITE);
1322         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1323
1324         sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1325         sc->txfree--;
1326         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1327
1328         DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1329
1330         /* wait at most one second for command to complete */
1331         return tsleep(sc, 0, "ipwcmd", hz);
1332 }
1333
1334 static int
1335 ipw_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1336 {
1337         struct ipw_softc *sc = ifp->if_softc;
1338         struct ieee80211com *ic = &sc->sc_ic;
1339         struct ieee80211_frame *wh;
1340         struct ipw_dma_mapping map;
1341         struct ipw_soft_bd *sbd;
1342         struct ipw_soft_hdr *shdr;
1343         struct ipw_soft_buf *sbuf;
1344         struct mbuf *mnew;
1345         bus_addr_t physaddr;
1346         int error, i;
1347
1348         if (ic->ic_flags & IEEE80211_F_WEPON) {
1349                 m0 = ieee80211_wep_crypt(ifp, m0, 1);
1350                 if (m0 == NULL)
1351                         return ENOBUFS;
1352         }
1353
1354         if (sc->sc_drvbpf != NULL) {
1355                 struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1356
1357                 tap->wt_flags = 0;
1358                 tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1359                 tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1360
1361                 bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1362         }
1363
1364         wh = mtod(m0, struct ieee80211_frame *);
1365
1366         shdr = SLIST_FIRST(&sc->free_shdr);
1367         sbuf = SLIST_FIRST(&sc->free_sbuf);
1368         KASSERT(shdr != NULL && sbuf != NULL, ("empty sw hdr/buf pool"));
1369
1370         shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1371         shdr->hdr.subtype = htole32(0);
1372         shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1373         shdr->hdr.encrypt = 0;
1374         shdr->hdr.keyidx = 0;
1375         shdr->hdr.keysz = 0;
1376         shdr->hdr.fragmentsz = htole16(0);
1377         IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1378         if (ic->ic_opmode == IEEE80211_M_STA)
1379                 IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1380         else
1381                 IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1382
1383         /* trim IEEE802.11 header */
1384         m_adj(m0, sizeof (struct ieee80211_frame));
1385
1386         error = bus_dmamap_load_mbuf(sc->txbuf_dmat, sbuf->map, m0,
1387             ipw_dma_map_txbuf, &map, 0);
1388         if (error != 0 && error != EFBIG) {
1389                 if_printf(ifp, "could not map mbuf (error %d)\n", error);
1390                 m_freem(m0);
1391                 return error;
1392         }
1393         if (error != 0) {
1394                 mnew = m_defrag(m0, MB_DONTWAIT);
1395                 if (mnew == NULL) {
1396                         if_printf(ifp, "could not defragment mbuf\n");
1397                         m_freem(m0);
1398                         return ENOBUFS;
1399                 }
1400                 m0 = mnew;
1401
1402                 error = bus_dmamap_load_mbuf(sc->txbuf_dmat, sbuf->map, m0,
1403                     ipw_dma_map_txbuf, &map, 0);
1404                 if (error != 0) {
1405                         if_printf(ifp,
1406                                   "could not map mbuf (error %d)\n", error);
1407                         m_freem(m0);
1408                         return error;
1409                 }
1410         }
1411
1412         error = bus_dmamap_load(sc->hdr_dmat, shdr->map, &shdr->hdr,
1413             sizeof (struct ipw_hdr), ipw_dma_map_addr, &physaddr, 0);
1414         if (error != 0) {
1415                 if_printf(ifp, "could not map header DMA memory\n");
1416                 bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1417                 m_freem(m0);
1418                 return error;
1419         }
1420
1421         SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1422         SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1423
1424         sbd = &sc->stbd_list[sc->txcur];
1425         sbd->type = IPW_SBD_TYPE_HEADER;
1426         sbd->priv = shdr;
1427         sbd->bd->physaddr = htole32(physaddr);
1428         sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1429         sbd->bd->nfrag = 1 + map.nseg;
1430         sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1431                          IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1432
1433         DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u!%6D!%6D\n", shdr->hdr.type,
1434             shdr->hdr.subtype, shdr->hdr.encrypted, shdr->hdr.encrypt,
1435             shdr->hdr.src_addr, ":", shdr->hdr.dst_addr, ":"));
1436         sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1437         sc->txfree--;
1438
1439         sbuf->m = m0;
1440         sbuf->ni = ni;
1441
1442         for (i = 0; i < map.nseg; i++) {
1443                 sbd = &sc->stbd_list[sc->txcur];
1444
1445                 sbd->bd->physaddr = htole32(map.segs[i].ds_addr);
1446                 sbd->bd->len = htole32(map.segs[i].ds_len);
1447                 sbd->bd->nfrag = 0; /* used only in first bd */
1448                 sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1449                 if (i == map.nseg - 1) {
1450                         sbd->type = IPW_SBD_TYPE_DATA;
1451                         sbd->priv = sbuf;
1452                         sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1453                 } else {
1454                         sbd->type = IPW_SBD_TYPE_NOASSOC;
1455                         sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1456                 }
1457
1458                 DPRINTFN(5, ("TX!FRAG!%d!%d\n", i, map.segs[i].ds_len));
1459                 sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1460                 sc->txfree--;
1461         }
1462
1463         bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_PREWRITE);
1464         bus_dmamap_sync(sc->txbuf_dmat, sbuf->map, BUS_DMASYNC_PREWRITE);
1465         bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1466
1467         /* Inform firmware about this new packet */
1468         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1469
1470         return 0;
1471 }
1472
1473 static void
1474 ipw_start(struct ifnet *ifp)
1475 {
1476         struct ipw_softc *sc = ifp->if_softc;
1477         struct ieee80211com *ic = &sc->sc_ic;
1478         struct mbuf *m0;
1479         struct ieee80211_node *ni;
1480
1481         if (ic->ic_state != IEEE80211_S_RUN) {
1482                 return;
1483         }
1484
1485         for (;;) {
1486                 m0 = ifq_poll(&ifp->if_snd);
1487                 if (m0 == NULL)
1488                         break;
1489                 if (sc->txfree < 1 + IPW_MAX_NSEG) {
1490                         ifp->if_flags |= IFF_OACTIVE;
1491                         break;
1492                 }
1493                 m0 = ifq_dequeue(&ifp->if_snd);
1494
1495                 BPF_MTAP(ifp, m0);
1496
1497                 m0 = ieee80211_encap(ifp, m0, &ni);
1498                 if (m0 == NULL)
1499                         continue;
1500
1501                 if (ic->ic_rawbpf != NULL)
1502                         bpf_mtap(ic->ic_rawbpf, m0);
1503
1504                 if (ipw_tx_start(ifp, m0, ni) != 0) {
1505                         if (ni != NULL && ni != ic->ic_bss)
1506                                 ieee80211_free_node(ic, ni);
1507                         break;
1508                 }
1509
1510                 /* start watchdog timer */
1511                 sc->sc_tx_timer = 5;
1512                 ifp->if_timer = 1;
1513         }
1514 }
1515
1516 static void
1517 ipw_watchdog(struct ifnet *ifp)
1518 {
1519         struct ipw_softc *sc = ifp->if_softc;
1520
1521         ifp->if_timer = 0;
1522
1523         if (sc->sc_tx_timer > 0) {
1524                 if (--sc->sc_tx_timer == 0) {
1525                         if_printf(ifp, "device timeout\n");
1526                         ifp->if_flags &= ~IFF_UP;
1527                         ipw_stop(sc);
1528                         return;
1529                 }
1530                 ifp->if_timer = 1;
1531         }
1532
1533         ieee80211_watchdog(ifp);
1534 }
1535
1536 static int
1537 ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1538 {
1539         struct ipw_softc *sc = ifp->if_softc;
1540         struct ieee80211com *ic = &sc->sc_ic;
1541         struct ifreq *ifr;
1542         struct ieee80211req *ireq;
1543         int error = 0;
1544         IPW_LOCK_DECL();
1545
1546         IPW_LOCK(sc);
1547
1548         switch (cmd) {
1549         case SIOCSIFFLAGS:
1550                 if (ifp->if_flags & IFF_UP) {
1551                         if (!(ifp->if_flags & IFF_RUNNING))
1552                                 ipw_init(sc);
1553                 } else {
1554                         if (ifp->if_flags & IFF_RUNNING)
1555                                 ipw_stop(sc);
1556                 }
1557                 break;
1558
1559         case SIOCSLOADFW:
1560                 /* only super-user can do that! */
1561                 if ((error = suser(curthread)) != 0)
1562                         break;
1563
1564                 ifr = (struct ifreq *)data;
1565                 error = ipw_cache_firmware(sc, ifr->ifr_data);
1566                 break;
1567
1568         case SIOCSKILLFW:
1569                 /* only super-user can do that! */
1570                 if ((error = suser(curthread)) != 0)
1571                         break;
1572
1573                 ifp->if_flags &= ~IFF_UP;
1574                 ipw_stop(sc);
1575                 ipw_free_firmware(sc);
1576                 break;
1577
1578         case SIOCG80211:
1579                 ireq = (struct ieee80211req *)data;
1580                 switch (ireq->i_type) {
1581                 case IEEE80211_IOC_AUTHMODE:
1582                         ireq->i_val = sc->authmode;
1583                         break;
1584
1585                 case IEEE80211_IOC_TXPOWER:
1586                         ireq->i_val = (CSR_READ_4(sc, IPW_CSR_IO) &
1587                             IPW_IO_RADIO_DISABLED) ? 0 : ic->ic_txpower;
1588                         break;
1589
1590                 default:
1591                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1592                 }
1593                 break;
1594
1595         case SIOCS80211:
1596                 /* only super-user can do that! */
1597                 if ((error = suser(curthread)) != 0)
1598                         break;
1599
1600                 ireq = (struct ieee80211req *)data;
1601                 switch (ireq->i_type) {
1602                 case IEEE80211_IOC_AUTHMODE:
1603                         sc->authmode = ireq->i_val;
1604                         break;
1605
1606                 default:
1607                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1608                 }
1609                 break;
1610
1611         default:
1612                 error = ieee80211_ioctl(ifp, cmd, data, cr);
1613         }
1614
1615         if (error == ENETRESET) {
1616                 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1617                     (IFF_UP | IFF_RUNNING))
1618                         ipw_init(sc);
1619                 error = 0;
1620         }
1621
1622         IPW_UNLOCK(sc);
1623
1624         return error;
1625 }
1626
1627 static void
1628 ipw_stop_master(struct ipw_softc *sc)
1629 {
1630         int ntries;
1631
1632         /* Disable interrupts */
1633         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1634
1635         CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1636         for (ntries = 0; ntries < 5; ntries++) {
1637                 if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1638                         break;
1639                 DELAY(10);
1640         }
1641         if (ntries == 5)
1642                 if_printf(&sc->sc_ic.ic_if, "timeout waiting for master\n");
1643
1644         CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1645             IPW_RST_PRINCETON_RESET);
1646
1647         sc->flags &= ~IPW_FLAG_FW_INITED;
1648 }
1649
1650 static int
1651 ipw_reset(struct ipw_softc *sc)
1652 {
1653         int ntries;
1654
1655         ipw_stop_master(sc);
1656
1657         /* Move adapter to D0 state */
1658         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1659             IPW_CTL_INIT);
1660
1661         /* Wait for clock stabilization */
1662         for (ntries = 0; ntries < 1000; ntries++) {
1663                 if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1664                         break;
1665                 DELAY(200);
1666         }
1667         if (ntries == 1000)
1668                 return EIO;
1669
1670         CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1671             IPW_RST_SW_RESET);
1672
1673         DELAY(10);
1674
1675         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1676             IPW_CTL_INIT);
1677
1678         return 0;
1679 }
1680
1681 static int
1682 ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1683 {
1684         int ntries;
1685
1686         MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1687         CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1688
1689         MEM_WRITE_2(sc, 0x220000, 0x0703);
1690         MEM_WRITE_2(sc, 0x220000, 0x0707);
1691
1692         MEM_WRITE_1(sc, 0x210014, 0x72);
1693         MEM_WRITE_1(sc, 0x210014, 0x72);
1694
1695         MEM_WRITE_1(sc, 0x210000, 0x40);
1696         MEM_WRITE_1(sc, 0x210000, 0x00);
1697         MEM_WRITE_1(sc, 0x210000, 0x40);
1698
1699         MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1700
1701         MEM_WRITE_1(sc, 0x210000, 0x00);
1702         MEM_WRITE_1(sc, 0x210000, 0x00);
1703         MEM_WRITE_1(sc, 0x210000, 0x80);
1704
1705         MEM_WRITE_2(sc, 0x220000, 0x0703);
1706         MEM_WRITE_2(sc, 0x220000, 0x0707);
1707
1708         MEM_WRITE_1(sc, 0x210014, 0x72);
1709         MEM_WRITE_1(sc, 0x210014, 0x72);
1710
1711         MEM_WRITE_1(sc, 0x210000, 0x00);
1712         MEM_WRITE_1(sc, 0x210000, 0x80);
1713
1714         for (ntries = 0; ntries < 100; ntries++) {
1715                 if (MEM_READ_1(sc, 0x210000) & 1)
1716                         break;
1717                 DELAY(1000);
1718         }
1719         if (ntries == 100) {
1720                 if_printf(&sc->sc_ic.ic_if,
1721                           "timeout waiting for ucode to initialize\n");
1722                 return EIO;
1723         }
1724
1725         MEM_WRITE_4(sc, 0x3000e0, 0);
1726
1727         return 0;
1728 }
1729
1730 /* set of macros to handle unaligned little endian data in firmware image */
1731 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1732 #define GETLE16(p) ((p)[0] | (p)[1] << 8)
1733 static int
1734 ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1735 {
1736         u_char *p, *end;
1737         u_int32_t dst;
1738         u_int16_t len;
1739         int error;
1740
1741         p = fw;
1742         end = fw + size;
1743         while (p < end) {
1744                 if (p + 6 > end)
1745                         return EINVAL;
1746
1747                 dst = GETLE32(p); p += 4;
1748                 len = GETLE16(p); p += 2;
1749
1750                 if (p + len > end)
1751                         return EINVAL;
1752
1753                 ipw_write_mem_1(sc, dst, p, len);
1754                 p += len;
1755         }
1756
1757         CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1758             IPW_IO_LED_OFF);
1759
1760         /* Allow interrupts so we know when the firmware is inited */
1761         CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1762
1763         /* Tell the adapter to initialize the firmware */
1764         CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1765         CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1766             IPW_CTL_ALLOW_STANDBY);
1767
1768         /* Wait at most one second for firmware initialization to complete */
1769         if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1770                 if_printf(&sc->sc_ic.ic_if, "timeout waiting for firmware "
1771                     "initialization to complete\n");
1772                 return error;
1773         }
1774
1775         CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1776             IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1777
1778         return 0;
1779 }
1780
1781 /*
1782  * Store firmware into kernel memory so we can download it when we need to,
1783  * e.g when the adapter wakes up from suspend mode.
1784  */
1785 static int
1786 ipw_cache_firmware(struct ipw_softc *sc, void *data)
1787 {
1788         struct ipw_firmware *fw = &sc->fw;
1789         struct ipw_firmware_hdr hdr;
1790         u_char *p = data;
1791         int error;
1792
1793         ipw_free_firmware(sc);
1794
1795         /*
1796          * mutex(9): no mutexes should be held across functions which access
1797          * memory in userspace, such as copyin(9) [...]
1798          */
1799
1800         if ((error = copyin(data, &hdr, sizeof hdr)) != 0)
1801                 goto fail1;
1802
1803         fw->main_size  = le32toh(hdr.main_size);
1804         fw->ucode_size = le32toh(hdr.ucode_size);
1805         p += sizeof hdr;
1806
1807         fw->main = malloc(fw->main_size, M_DEVBUF, M_WAITOK);
1808         if (fw->main == NULL) {
1809                 error = ENOMEM;
1810                 goto fail1;
1811         }
1812
1813         fw->ucode = malloc(fw->ucode_size, M_DEVBUF, M_WAITOK);
1814         if (fw->ucode == NULL) {
1815                 error = ENOMEM;
1816                 goto fail2;
1817         }
1818
1819         if ((error = copyin(p, fw->main, fw->main_size)) != 0)
1820                 goto fail3;
1821
1822         p += fw->main_size;
1823         if ((error = copyin(p, fw->ucode, fw->ucode_size)) != 0)
1824                 goto fail3;
1825
1826         DPRINTF(("Firmware cached: main %u, ucode %u\n", fw->main_size,
1827             fw->ucode_size));
1828
1829         sc->flags |= IPW_FLAG_FW_CACHED;
1830
1831         return 0;
1832
1833 fail3:  free(fw->ucode, M_DEVBUF);
1834 fail2:  free(fw->main, M_DEVBUF);
1835 fail1:
1836
1837         return error;
1838 }
1839
1840 static void
1841 ipw_free_firmware(struct ipw_softc *sc)
1842 {
1843         if (!(sc->flags & IPW_FLAG_FW_CACHED))
1844                 return;
1845
1846         free(sc->fw.main, M_DEVBUF);
1847         free(sc->fw.ucode, M_DEVBUF);
1848
1849         sc->flags &= ~IPW_FLAG_FW_CACHED;
1850 }
1851
1852 static int
1853 ipw_config(struct ipw_softc *sc)
1854 {
1855         struct ieee80211com *ic = &sc->sc_ic;
1856         struct ifnet *ifp = &ic->ic_if;
1857         struct ipw_security security;
1858         struct ieee80211_wepkey *k;
1859         struct ipw_wep_key wepkey;
1860         struct ipw_scan_options options;
1861         struct ipw_configuration config;
1862         u_int32_t data;
1863         int error, i;
1864
1865         switch (ic->ic_opmode) {
1866         case IEEE80211_M_STA:
1867         case IEEE80211_M_HOSTAP:
1868                 data = htole32(IPW_MODE_BSS);
1869                 break;
1870
1871         case IEEE80211_M_IBSS:
1872         case IEEE80211_M_AHDEMO:
1873                 data = htole32(IPW_MODE_IBSS);
1874                 break;
1875
1876         case IEEE80211_M_MONITOR:
1877                 data = htole32(IPW_MODE_MONITOR);
1878                 break;
1879         }
1880         DPRINTF(("Setting mode to %u\n", le32toh(data)));
1881         error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1882         if (error != 0)
1883                 return error;
1884
1885         if (ic->ic_opmode == IEEE80211_M_IBSS ||
1886             ic->ic_opmode == IEEE80211_M_MONITOR) {
1887                 data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1888                 DPRINTF(("Setting channel to %u\n", le32toh(data)));
1889                 error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1890                 if (error != 0)
1891                         return error;
1892         }
1893
1894         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1895                 DPRINTF(("Enabling adapter\n"));
1896                 return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1897         }
1898
1899         IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1900         IEEE80211_ADDR_COPY(IF_LLADDR(ifp), ic->ic_myaddr);
1901         DPRINTF(("Setting MAC address to %6D\n", ic->ic_myaddr, ":"));
1902         error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1903             IEEE80211_ADDR_LEN);
1904         if (error != 0)
1905                 return error;
1906
1907         config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1908             IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1909         if (ic->ic_opmode == IEEE80211_M_IBSS)
1910                 config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1911         if (ifp->if_flags & IFF_PROMISC)
1912                 config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1913         config.bss_chan = htole32(0x3fff); /* channels 1-14 */
1914         config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
1915         DPRINTF(("Setting configuration to 0x%x\n", le32toh(config.flags)));
1916         error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1917         if (error != 0)
1918                 return error;
1919
1920         data = htole32(0x3); /* 1, 2 */
1921         DPRINTF(("Setting basic tx rates to 0x%x\n", le32toh(data)));
1922         error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1923         if (error != 0)
1924                 return error;
1925
1926         data = htole32(0xf); /* 1, 2, 5.5, 11 */
1927         DPRINTF(("Setting tx rates to 0x%x\n", le32toh(data)));
1928         error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1929         if (error != 0)
1930                 return error;
1931
1932         data = htole32(IPW_POWER_MODE_CAM);
1933         DPRINTF(("Setting power mode to %u\n", le32toh(data)));
1934         error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1935         if (error != 0)
1936                 return error;
1937
1938         if (ic->ic_opmode == IEEE80211_M_IBSS) {
1939                 data = htole32(32); /* default value */
1940                 DPRINTF(("Setting tx power index to %u\n", le32toh(data)));
1941                 error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1942                     sizeof data);
1943                 if (error != 0)
1944                         return error;
1945         }
1946
1947         data = htole32(ic->ic_rtsthreshold);
1948         DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
1949         error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1950         if (error != 0)
1951                 return error;
1952
1953         data = htole32(ic->ic_fragthreshold);
1954         DPRINTF(("Setting frag threshold to %u\n", le32toh(data)));
1955         error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1956         if (error != 0)
1957                 return error;
1958
1959 #ifdef IPW_DEBUG
1960         if (ipw_debug > 0) {
1961                 printf("Setting ESSID to ");
1962                 ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1963                 printf("\n");
1964         }
1965 #endif
1966         error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1967             ic->ic_des_esslen);
1968         if (error != 0)
1969                 return error;
1970
1971         /* no mandatory BSSID */
1972         DPRINTF(("Setting mandatory BSSID to null\n"));
1973         error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1974         if (error != 0)
1975                 return error;
1976
1977         if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1978                 DPRINTF(("Setting desired BSSID to %6D\n", ic->ic_des_bssid,
1979                     ":"));
1980                 error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1981                     ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1982                 if (error != 0)
1983                         return error;
1984         }
1985
1986         bzero(&security, sizeof security);
1987         security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1988             IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1989         security.ciphers = htole32(IPW_CIPHER_NONE);
1990         DPRINTF(("Setting authmode to %u\n", security.authmode));
1991         error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1992             sizeof security);
1993         if (error != 0)
1994                 return error;
1995
1996         if (ic->ic_flags & IEEE80211_F_WEPON) {
1997                 k = ic->ic_nw_keys;
1998                 for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1999                         if (k->wk_len == 0)
2000                                 continue;
2001
2002                         wepkey.idx = i;
2003                         wepkey.len = k->wk_len;
2004                         bzero(wepkey.key, sizeof wepkey.key);
2005                         bcopy(k->wk_key, wepkey.key, k->wk_len);
2006                         DPRINTF(("Setting wep key index %u len %u\n",
2007                             wepkey.idx, wepkey.len));
2008                         error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
2009                             sizeof wepkey);
2010                         if (error != 0)
2011                                 return error;
2012                 }
2013
2014                 data = htole32(ic->ic_wep_txkey);
2015                 DPRINTF(("Setting wep tx key index to %u\n", le32toh(data)));
2016                 error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
2017                     sizeof data);
2018                 if (error != 0)
2019                         return error;
2020         }
2021
2022         data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
2023         DPRINTF(("Setting wep flags to 0x%x\n", le32toh(data)));
2024         error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
2025         if (error != 0)
2026                 return error;
2027
2028         if (ic->ic_opmode == IEEE80211_M_IBSS ||
2029             ic->ic_opmode == IEEE80211_M_HOSTAP) {
2030                 data = htole32(ic->ic_lintval);
2031                 DPRINTF(("Setting beacon interval to %u\n", le32toh(data)));
2032                 error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
2033                     sizeof data);
2034                 if (error != 0)
2035                         return error;
2036         }
2037
2038         options.flags = htole32(0);
2039         options.channels = htole32(0x3fff); /* scan channels 1-14 */
2040         DPRINTF(("Setting scan options to 0x%x\n", le32toh(options.flags)));
2041         error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
2042         if (error != 0)
2043                 return error;
2044
2045         /* finally, enable adapter (start scanning for an access point) */
2046         DPRINTF(("Enabling adapter\n"));
2047         return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
2048 }
2049
2050 static void
2051 ipw_init(void *priv)
2052 {
2053         struct ipw_softc *sc = priv;
2054         struct ieee80211com *ic = &sc->sc_ic;
2055         struct ifnet *ifp = &ic->ic_if;
2056         struct ipw_firmware *fw = &sc->fw;
2057
2058         /* exit immediately if firmware has not been ioctl'd */
2059         if (!(sc->flags & IPW_FLAG_FW_CACHED)) {
2060                 ifp->if_flags &= ~IFF_UP;
2061                 return;
2062         }
2063
2064         ipw_stop(sc);
2065
2066         if (ipw_reset(sc) != 0) {
2067                 if_printf(ifp, "could not reset adapter\n");
2068                 goto fail;
2069         }
2070
2071         if (ipw_load_ucode(sc, fw->ucode, fw->ucode_size) != 0) {
2072                 if_printf(ifp, "could not load microcode\n");
2073                 goto fail;
2074         }
2075
2076         ipw_stop_master(sc);
2077
2078         /*
2079          * Setup tx, rx and status rings
2080          */
2081         CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_phys);
2082         CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
2083         CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
2084         CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
2085         sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
2086         sc->txcur = 0; /* bd index to write to */
2087         sc->txfree = IPW_NTBD - 2;
2088
2089         CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_phys);
2090         CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
2091         CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
2092         CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
2093         sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
2094
2095         CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE, sc->status_phys);
2096
2097         if (ipw_load_firmware(sc, fw->main, fw->main_size) != 0) {
2098                 if_printf(ifp, "could not load firmware\n");
2099                 goto fail;
2100         }
2101
2102         sc->flags |= IPW_FLAG_FW_INITED;
2103
2104         /* Retrieve information tables base addresses */
2105         sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2106         sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2107
2108         ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2109
2110         if (ipw_config(sc) != 0) {
2111                 if_printf(ifp, "device configuration failed\n");
2112                 goto fail;
2113         }
2114
2115         ifp->if_flags &= ~IFF_OACTIVE;
2116         ifp->if_flags |= IFF_RUNNING;
2117
2118         return;
2119
2120 fail:   ifp->if_flags &= ~IFF_UP;
2121         ipw_stop(sc);
2122 }
2123
2124 static void
2125 ipw_stop(void *priv)
2126 {
2127         struct ipw_softc *sc = priv;
2128         struct ieee80211com *ic = &sc->sc_ic;
2129         struct ifnet *ifp = &ic->ic_if;
2130         int i;
2131
2132         ipw_stop_master(sc);
2133         CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2134
2135         /*
2136          * Release tx buffers
2137          */
2138         for (i = 0; i < IPW_NTBD; i++)
2139                 ipw_release_sbd(sc, &sc->stbd_list[i]);
2140
2141         ifp->if_timer = 0;
2142         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2143
2144         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2145 }
2146
2147 static int
2148 ipw_sysctl_stats(SYSCTL_HANDLER_ARGS)
2149 {
2150         struct ipw_softc *sc = arg1;
2151         u_int32_t i, size, buf[256];
2152
2153         (void)arg2; /* silence WARNS == 6 */
2154         (void)oidp; /* silence WARNS == 6 */
2155
2156         if (!(sc->flags & IPW_FLAG_FW_INITED)) {
2157                 bzero(buf, sizeof buf);
2158                 return SYSCTL_OUT(req, buf, sizeof buf);
2159         }
2160
2161         CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
2162
2163         size = min(CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA), 256);
2164         for (i = 1; i < size; i++)
2165                 buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
2166
2167         return SYSCTL_OUT(req, buf, sizeof buf);
2168 }
2169
2170 static int
2171 ipw_sysctl_radio(SYSCTL_HANDLER_ARGS)
2172 {
2173         struct ipw_softc *sc = arg1;
2174         int val;
2175
2176         (void)arg2; /* silence WARNS == 6 */
2177         (void)oidp; /* silence WARNS == 6 */
2178
2179         val = !((sc->flags & IPW_FLAG_HAS_RADIO_SWITCH) &&
2180                 (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED));
2181
2182         return SYSCTL_OUT(req, &val, sizeof val);
2183 }
2184
2185 static u_int32_t
2186 ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
2187 {
2188         return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
2189 }
2190
2191 static void
2192 ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
2193 {
2194         MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
2195 }
2196
2197 static int
2198 ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
2199 {
2200         u_int32_t addr, info;
2201         u_int16_t count, size;
2202         u_int32_t total;
2203
2204         /* addr[4] + count[2] + size[2] */
2205         addr = MEM_READ_4(sc, sc->table2_base + off);
2206         info = MEM_READ_4(sc, sc->table2_base + off + 4);
2207
2208         count = info >> 16;
2209         size = info & 0xffff;
2210         total = count * size;
2211
2212         if (total > *len) {
2213                 *len = total;
2214                 return EINVAL;
2215         }
2216
2217         *len = total;
2218         ipw_read_mem_1(sc, addr, buf, total);
2219
2220         return 0;
2221 }
2222
2223 static void
2224 ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2225     bus_size_t count)
2226 {
2227         for (; count > 0; offset++, datap++, count--) {
2228                 CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2229                 *datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2230         }
2231 }
2232
2233 static void
2234 ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2235     bus_size_t count)
2236 {
2237         for (; count > 0; offset++, datap++, count--) {
2238                 CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2239                 CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2240         }
2241 }