if_ipw.c revision 190579
1/*	$FreeBSD: head/sys/dev/ipw/if_ipw.c 190579 2009-03-30 21:53:27Z sam $	*/
2
3/*-
4 * Copyright (c) 2004-2006
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 * Copyright (c) 2006 Sam Leffler, Errno Consulting
7 * Copyright (c) 2007 Andrew Thompson <thompsa@FreeBSD.org>
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice unmodified, this list of conditions, and the following
14 *    disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33__FBSDID("$FreeBSD: head/sys/dev/ipw/if_ipw.c 190579 2009-03-30 21:53:27Z sam $");
34
35/*-
36 * Intel(R) PRO/Wireless 2100 MiniPCI driver
37 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
38 */
39
40#include <sys/param.h>
41#include <sys/sysctl.h>
42#include <sys/sockio.h>
43#include <sys/mbuf.h>
44#include <sys/kernel.h>
45#include <sys/socket.h>
46#include <sys/systm.h>
47#include <sys/malloc.h>
48#include <sys/queue.h>
49#include <sys/taskqueue.h>
50#include <sys/module.h>
51#include <sys/bus.h>
52#include <sys/endian.h>
53#include <sys/linker.h>
54#include <sys/firmware.h>
55
56#include <machine/bus.h>
57#include <machine/resource.h>
58#include <sys/rman.h>
59
60#include <dev/pci/pcireg.h>
61#include <dev/pci/pcivar.h>
62
63#include <net/bpf.h>
64#include <net/if.h>
65#include <net/if_arp.h>
66#include <net/ethernet.h>
67#include <net/if_dl.h>
68#include <net/if_media.h>
69#include <net/if_types.h>
70
71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <netinet/in.h>
75#include <netinet/in_systm.h>
76#include <netinet/in_var.h>
77#include <netinet/ip.h>
78#include <netinet/if_ether.h>
79
80#include <dev/ipw/if_ipwreg.h>
81#include <dev/ipw/if_ipwvar.h>
82
83#define IPW_DEBUG
84#ifdef IPW_DEBUG
85#define DPRINTF(x)	do { if (ipw_debug > 0) printf x; } while (0)
86#define DPRINTFN(n, x)	do { if (ipw_debug >= (n)) printf x; } while (0)
87int ipw_debug = 0;
88SYSCTL_INT(_debug, OID_AUTO, ipw, CTLFLAG_RW, &ipw_debug, 0, "ipw debug level");
89#else
90#define DPRINTF(x)
91#define DPRINTFN(n, x)
92#endif
93
94MODULE_DEPEND(ipw, pci,  1, 1, 1);
95MODULE_DEPEND(ipw, wlan, 1, 1, 1);
96MODULE_DEPEND(ipw, firmware, 1, 1, 1);
97
98struct ipw_ident {
99	uint16_t	vendor;
100	uint16_t	device;
101	const char	*name;
102};
103
104static const struct ipw_ident ipw_ident_table[] = {
105	{ 0x8086, 0x1043, "Intel(R) PRO/Wireless 2100 MiniPCI" },
106
107	{ 0, 0, NULL }
108};
109
110static struct ieee80211vap *ipw_vap_create(struct ieee80211com *,
111		    const char name[IFNAMSIZ], int unit, int opmode, int flags,
112		    const uint8_t bssid[IEEE80211_ADDR_LEN],
113		    const uint8_t mac[IEEE80211_ADDR_LEN]);
114static void	ipw_vap_delete(struct ieee80211vap *);
115static int	ipw_dma_alloc(struct ipw_softc *);
116static void	ipw_release(struct ipw_softc *);
117static void	ipw_media_status(struct ifnet *, struct ifmediareq *);
118static int	ipw_newstate(struct ieee80211vap *, enum ieee80211_state, int);
119static uint16_t	ipw_read_prom_word(struct ipw_softc *, uint8_t);
120static void	ipw_rx_cmd_intr(struct ipw_softc *, struct ipw_soft_buf *);
121static void	ipw_assocsuccess(void *, int);
122static void	ipw_assocfailed(void *, int);
123static void	ipw_scandone(void *, int);
124static void	ipw_bmiss(void *, int);
125static void	ipw_rx_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
126static void	ipw_rx_data_intr(struct ipw_softc *, struct ipw_status *,
127		    struct ipw_soft_bd *, struct ipw_soft_buf *);
128static void	ipw_rx_intr(struct ipw_softc *);
129static void	ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
130static void	ipw_tx_intr(struct ipw_softc *);
131static void	ipw_intr(void *);
132static void	ipw_dma_map_addr(void *, bus_dma_segment_t *, int, int);
133static const char * ipw_cmdname(int);
134static int	ipw_cmd(struct ipw_softc *, uint32_t, void *, uint32_t);
135static int	ipw_tx_start(struct ifnet *, struct mbuf *,
136		    struct ieee80211_node *);
137static int	ipw_raw_xmit(struct ieee80211_node *, struct mbuf *,
138		    const struct ieee80211_bpf_params *);
139static void	ipw_start(struct ifnet *);
140static void	ipw_start_locked(struct ifnet *);
141static void	ipw_watchdog(void *);
142static int	ipw_ioctl(struct ifnet *, u_long, caddr_t);
143static void	ipw_stop_master(struct ipw_softc *);
144static int	ipw_enable(struct ipw_softc *);
145static int	ipw_disable(struct ipw_softc *);
146static int	ipw_reset(struct ipw_softc *);
147static int	ipw_load_ucode(struct ipw_softc *, const char *, int);
148static int	ipw_load_firmware(struct ipw_softc *, const char *, int);
149static int	ipw_config(struct ipw_softc *);
150static void	ipw_assoc_task(void *, int);
151static void	ipw_disassoc_task(void *, int);
152static void	ipw_init_task(void *, int);
153static void	ipw_init(void *);
154static void	ipw_init_locked(struct ipw_softc *);
155static void	ipw_stop(void *);
156static void	ipw_stop_locked(struct ipw_softc *);
157static int	ipw_sysctl_stats(SYSCTL_HANDLER_ARGS);
158static int	ipw_sysctl_radio(SYSCTL_HANDLER_ARGS);
159static uint32_t	ipw_read_table1(struct ipw_softc *, uint32_t);
160static void	ipw_write_table1(struct ipw_softc *, uint32_t, uint32_t);
161#if 0
162static int	ipw_read_table2(struct ipw_softc *, uint32_t, void *,
163		    uint32_t *);
164static void	ipw_read_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
165		    bus_size_t);
166#endif
167static void	ipw_write_mem_1(struct ipw_softc *, bus_size_t,
168		    const uint8_t *, bus_size_t);
169static void	ipw_scan_task(void *, int);
170static int	ipw_scan(struct ipw_softc *);
171static void	ipw_scan_start(struct ieee80211com *);
172static void	ipw_scan_end(struct ieee80211com *);
173static void	ipw_set_channel(struct ieee80211com *);
174static void	ipw_scan_curchan(struct ieee80211_scan_state *,
175		    unsigned long maxdwell);
176static void	ipw_scan_mindwell(struct ieee80211_scan_state *);
177
178static int ipw_probe(device_t);
179static int ipw_attach(device_t);
180static int ipw_detach(device_t);
181static int ipw_shutdown(device_t);
182static int ipw_suspend(device_t);
183static int ipw_resume(device_t);
184
185static device_method_t ipw_methods[] = {
186	/* Device interface */
187	DEVMETHOD(device_probe,		ipw_probe),
188	DEVMETHOD(device_attach,	ipw_attach),
189	DEVMETHOD(device_detach,	ipw_detach),
190	DEVMETHOD(device_shutdown,	ipw_shutdown),
191	DEVMETHOD(device_suspend,	ipw_suspend),
192	DEVMETHOD(device_resume,	ipw_resume),
193
194	{ 0, 0 }
195};
196
197static driver_t ipw_driver = {
198	"ipw",
199	ipw_methods,
200	sizeof (struct ipw_softc)
201};
202
203static devclass_t ipw_devclass;
204
205DRIVER_MODULE(ipw, pci, ipw_driver, ipw_devclass, 0, 0);
206
207static int
208ipw_probe(device_t dev)
209{
210	const struct ipw_ident *ident;
211
212	for (ident = ipw_ident_table; ident->name != NULL; ident++) {
213		if (pci_get_vendor(dev) == ident->vendor &&
214		    pci_get_device(dev) == ident->device) {
215			device_set_desc(dev, ident->name);
216			return 0;
217		}
218	}
219	return ENXIO;
220}
221
222/* Base Address Register */
223#define IPW_PCI_BAR0	0x10
224
225static int
226ipw_attach(device_t dev)
227{
228	struct ipw_softc *sc = device_get_softc(dev);
229	struct ifnet *ifp;
230	struct ieee80211com *ic;
231	struct ieee80211_channel *c;
232	uint16_t val;
233	int error, i;
234	uint8_t macaddr[IEEE80211_ADDR_LEN];
235
236	sc->sc_dev = dev;
237
238	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
239	    MTX_DEF | MTX_RECURSE);
240
241	TASK_INIT(&sc->sc_init_task, 0, ipw_init_task, sc);
242	TASK_INIT(&sc->sc_scan_task, 0, ipw_scan_task, sc);
243	TASK_INIT(&sc->sc_bmiss_task, 0, ipw_bmiss, sc);
244	callout_init_mtx(&sc->sc_wdtimer, &sc->sc_mtx, 0);
245
246	if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
247		device_printf(dev, "chip is in D%d power mode "
248		    "-- setting to D0\n", pci_get_powerstate(dev));
249		pci_set_powerstate(dev, PCI_POWERSTATE_D0);
250	}
251
252	pci_write_config(dev, 0x41, 0, 1);
253
254	/* enable bus-mastering */
255	pci_enable_busmaster(dev);
256
257	sc->mem_rid = IPW_PCI_BAR0;
258	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
259	    RF_ACTIVE);
260	if (sc->mem == NULL) {
261		device_printf(dev, "could not allocate memory resource\n");
262		goto fail;
263	}
264
265	sc->sc_st = rman_get_bustag(sc->mem);
266	sc->sc_sh = rman_get_bushandle(sc->mem);
267
268	sc->irq_rid = 0;
269	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
270	    RF_ACTIVE | RF_SHAREABLE);
271	if (sc->irq == NULL) {
272		device_printf(dev, "could not allocate interrupt resource\n");
273		goto fail1;
274	}
275
276	if (ipw_reset(sc) != 0) {
277		device_printf(dev, "could not reset adapter\n");
278		goto fail2;
279	}
280
281	if (ipw_dma_alloc(sc) != 0) {
282		device_printf(dev, "could not allocate DMA resources\n");
283		goto fail2;
284	}
285
286	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
287	if (ifp == NULL) {
288		device_printf(dev, "can not if_alloc()\n");
289		goto fail3;
290	}
291	ic = ifp->if_l2com;
292
293	ifp->if_softc = sc;
294	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
295	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
296	ifp->if_init = ipw_init;
297	ifp->if_ioctl = ipw_ioctl;
298	ifp->if_start = ipw_start;
299	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
300	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
301	IFQ_SET_READY(&ifp->if_snd);
302
303	ic->ic_ifp = ifp;
304	ic->ic_opmode = IEEE80211_M_STA;
305	ic->ic_phytype = IEEE80211_T_DS;
306
307	/* set device capabilities */
308	ic->ic_caps =
309		  IEEE80211_C_STA		/* station mode supported */
310		| IEEE80211_C_IBSS		/* IBSS mode supported */
311		| IEEE80211_C_MONITOR		/* monitor mode supported */
312		| IEEE80211_C_PMGT		/* power save supported */
313		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
314		| IEEE80211_C_WPA		/* 802.11i supported */
315		;
316
317	/* read MAC address from EEPROM */
318	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
319	macaddr[0] = val >> 8;
320	macaddr[1] = val & 0xff;
321	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
322	macaddr[2] = val >> 8;
323	macaddr[3] = val & 0xff;
324	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
325	macaddr[4] = val >> 8;
326	macaddr[5] = val & 0xff;
327
328	/* set supported .11b channels (read from EEPROM) */
329	if ((val = ipw_read_prom_word(sc, IPW_EEPROM_CHANNEL_LIST)) == 0)
330		val = 0x7ff; /* default to channels 1-11 */
331	val <<= 1;
332	for (i = 1; i < 16; i++) {
333		if (val & (1 << i)) {
334			c = &ic->ic_channels[ic->ic_nchans++];
335			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
336			c->ic_flags = IEEE80211_CHAN_B;
337			c->ic_ieee = i;
338		}
339	}
340
341	/* check support for radio transmitter switch in EEPROM */
342	if (!(ipw_read_prom_word(sc, IPW_EEPROM_RADIO) & 8))
343		sc->flags |= IPW_FLAG_HAS_RADIO_SWITCH;
344
345	ieee80211_ifattach(ic, macaddr);
346	ic->ic_scan_start = ipw_scan_start;
347	ic->ic_scan_end = ipw_scan_end;
348	ic->ic_set_channel = ipw_set_channel;
349	ic->ic_scan_curchan = ipw_scan_curchan;
350	ic->ic_scan_mindwell = ipw_scan_mindwell;
351	ic->ic_raw_xmit = ipw_raw_xmit;
352
353	ic->ic_vap_create = ipw_vap_create;
354	ic->ic_vap_delete = ipw_vap_delete;
355
356	bpfattach(ifp, DLT_IEEE802_11_RADIO,
357	    sizeof (struct ieee80211_frame) + sizeof (sc->sc_txtap));
358
359	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
360	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
361	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
362
363	sc->sc_txtap_len = sizeof sc->sc_txtap;
364	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
365	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
366
367	/*
368	 * Add a few sysctl knobs.
369	 */
370	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
371	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "radio",
372	    CTLTYPE_INT | CTLFLAG_RD, sc, 0, ipw_sysctl_radio, "I",
373	    "radio transmitter switch state (0=off, 1=on)");
374
375	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
376	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "stats",
377	    CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, ipw_sysctl_stats, "S",
378	    "statistics");
379
380	/*
381	 * Hook our interrupt after all initialization is complete.
382	 */
383	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
384	    NULL, ipw_intr, sc, &sc->sc_ih);
385	if (error != 0) {
386		device_printf(dev, "could not set up interrupt\n");
387		goto fail4;
388	}
389
390	if (bootverbose)
391		ieee80211_announce(ic);
392
393	return 0;
394fail4:
395	if_free(ifp);
396fail3:
397	ipw_release(sc);
398fail2:
399	bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
400fail1:
401	bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
402fail:
403	mtx_destroy(&sc->sc_mtx);
404	return ENXIO;
405}
406
407static int
408ipw_detach(device_t dev)
409{
410	struct ipw_softc *sc = device_get_softc(dev);
411	struct ifnet *ifp = sc->sc_ifp;
412	struct ieee80211com *ic = ifp->if_l2com;
413
414	ipw_stop(sc);
415
416	bpfdetach(ifp);
417	ieee80211_ifdetach(ic);
418
419	callout_drain(&sc->sc_wdtimer);
420	taskqueue_drain(taskqueue_fast, &sc->sc_init_task);
421	taskqueue_drain(taskqueue_fast, &sc->sc_scan_task);
422	taskqueue_drain(taskqueue_fast, &sc->sc_bmiss_task);
423
424	ipw_release(sc);
425
426	bus_teardown_intr(dev, sc->irq, sc->sc_ih);
427	bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
428
429	bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
430
431	if_free(ifp);
432
433	if (sc->sc_firmware != NULL) {
434		firmware_put(sc->sc_firmware, FIRMWARE_UNLOAD);
435		sc->sc_firmware = NULL;
436	}
437
438	mtx_destroy(&sc->sc_mtx);
439
440	return 0;
441}
442
443static struct ieee80211vap *
444ipw_vap_create(struct ieee80211com *ic,
445	const char name[IFNAMSIZ], int unit, int opmode, int flags,
446	const uint8_t bssid[IEEE80211_ADDR_LEN],
447	const uint8_t mac[IEEE80211_ADDR_LEN])
448{
449	struct ifnet *ifp = ic->ic_ifp;
450	struct ipw_softc *sc = ifp->if_softc;
451	struct ipw_vap *ivp;
452	struct ieee80211vap *vap;
453	const struct firmware *fp;
454	const struct ipw_firmware_hdr *hdr;
455	const char *imagename;
456
457	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
458		return NULL;
459
460	switch (opmode) {
461	case IEEE80211_M_STA:
462		imagename = "ipw_bss";
463		break;
464	case IEEE80211_M_IBSS:
465		imagename = "ipw_ibss";
466		break;
467	case IEEE80211_M_MONITOR:
468		imagename = "ipw_monitor";
469		break;
470	default:
471		return NULL;
472	}
473
474	/*
475	 * Load firmware image using the firmware(9) subsystem.  Doing
476	 * this unlocked is ok since we're single-threaded by the
477	 * 802.11 layer.
478	 */
479	if (sc->sc_firmware == NULL ||
480	    strcmp(sc->sc_firmware->name, imagename) != 0) {
481		if (sc->sc_firmware != NULL)
482			firmware_put(sc->sc_firmware, FIRMWARE_UNLOAD);
483		sc->sc_firmware = firmware_get(imagename);
484	}
485	if (sc->sc_firmware == NULL) {
486		device_printf(sc->sc_dev,
487		    "could not load firmware image '%s'\n", imagename);
488		return NULL;
489	}
490	fp = sc->sc_firmware;
491	if (fp->datasize < sizeof *hdr) {
492		device_printf(sc->sc_dev,
493		    "firmware image too short %zu\n", fp->datasize);
494		firmware_put(sc->sc_firmware, FIRMWARE_UNLOAD);
495		sc->sc_firmware = NULL;
496		return NULL;
497	}
498	hdr = (const struct ipw_firmware_hdr *)fp->data;
499	if (fp->datasize < sizeof *hdr + le32toh(hdr->mainsz) +
500	    le32toh(hdr->ucodesz)) {
501		device_printf(sc->sc_dev,
502		    "firmware image too short %zu\n", fp->datasize);
503		firmware_put(sc->sc_firmware, FIRMWARE_UNLOAD);
504		sc->sc_firmware = NULL;
505		return NULL;
506	}
507
508	ivp = (struct ipw_vap *) malloc(sizeof(struct ipw_vap),
509	    M_80211_VAP, M_NOWAIT | M_ZERO);
510	if (ivp == NULL)
511		return NULL;
512	vap = &ivp->vap;
513
514	TASK_INIT(&ivp->assoc_task, 0, ipw_assoc_task, vap);
515	TASK_INIT(&ivp->disassoc_task, 0, ipw_disassoc_task, vap);
516	TASK_INIT(&ivp->assoc_success_task, 0, ipw_assocsuccess, vap);
517	TASK_INIT(&ivp->assoc_failed_task, 0, ipw_assocfailed, vap);
518	TASK_INIT(&ivp->scandone_task, 0, ipw_scandone, vap);
519
520	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
521	/* override with driver methods */
522	ivp->newstate = vap->iv_newstate;
523	vap->iv_newstate = ipw_newstate;
524
525	/* complete setup */
526	ieee80211_vap_attach(vap, ieee80211_media_change, ipw_media_status);
527	ic->ic_opmode = opmode;
528	return vap;
529}
530
531static void
532ipw_vap_delete(struct ieee80211vap *vap)
533{
534	struct ipw_vap *ivp = IPW_VAP(vap);
535
536	ieee80211_vap_detach(vap);
537	free(ivp, M_80211_VAP);
538}
539
540static int
541ipw_dma_alloc(struct ipw_softc *sc)
542{
543	struct ipw_soft_bd *sbd;
544	struct ipw_soft_hdr *shdr;
545	struct ipw_soft_buf *sbuf;
546	bus_addr_t physaddr;
547	int error, i;
548
549	/*
550	 * Allocate and map tx ring.
551	 */
552	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
553	    BUS_SPACE_MAXADDR, NULL, NULL, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0, NULL,
554	    NULL, &sc->tbd_dmat);
555	if (error != 0) {
556		device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
557		goto fail;
558	}
559
560	error = bus_dmamem_alloc(sc->tbd_dmat, (void **)&sc->tbd_list,
561	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &sc->tbd_map);
562	if (error != 0) {
563		device_printf(sc->sc_dev,
564		    "could not allocate tx ring DMA memory\n");
565		goto fail;
566	}
567
568	error = bus_dmamap_load(sc->tbd_dmat, sc->tbd_map, sc->tbd_list,
569	    IPW_TBD_SZ, ipw_dma_map_addr, &sc->tbd_phys, 0);
570	if (error != 0) {
571		device_printf(sc->sc_dev, "could not map tx ring DMA memory\n");
572		goto fail;
573	}
574
575	/*
576	 * Allocate and map rx ring.
577	 */
578	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
579	    BUS_SPACE_MAXADDR, NULL, NULL, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0, NULL,
580	    NULL, &sc->rbd_dmat);
581	if (error != 0) {
582		device_printf(sc->sc_dev, "could not create rx ring DMA tag\n");
583		goto fail;
584	}
585
586	error = bus_dmamem_alloc(sc->rbd_dmat, (void **)&sc->rbd_list,
587	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &sc->rbd_map);
588	if (error != 0) {
589		device_printf(sc->sc_dev,
590		    "could not allocate rx ring DMA memory\n");
591		goto fail;
592	}
593
594	error = bus_dmamap_load(sc->rbd_dmat, sc->rbd_map, sc->rbd_list,
595	    IPW_RBD_SZ, ipw_dma_map_addr, &sc->rbd_phys, 0);
596	if (error != 0) {
597		device_printf(sc->sc_dev, "could not map rx ring DMA memory\n");
598		goto fail;
599	}
600
601	/*
602	 * Allocate and map status ring.
603	 */
604	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
605	    BUS_SPACE_MAXADDR, NULL, NULL, IPW_STATUS_SZ, 1, IPW_STATUS_SZ, 0,
606	    NULL, NULL, &sc->status_dmat);
607	if (error != 0) {
608		device_printf(sc->sc_dev,
609		    "could not create status ring DMA tag\n");
610		goto fail;
611	}
612
613	error = bus_dmamem_alloc(sc->status_dmat, (void **)&sc->status_list,
614	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &sc->status_map);
615	if (error != 0) {
616		device_printf(sc->sc_dev,
617		    "could not allocate status ring DMA memory\n");
618		goto fail;
619	}
620
621	error = bus_dmamap_load(sc->status_dmat, sc->status_map,
622	    sc->status_list, IPW_STATUS_SZ, ipw_dma_map_addr, &sc->status_phys,
623	    0);
624	if (error != 0) {
625		device_printf(sc->sc_dev,
626		    "could not map status ring DMA memory\n");
627		goto fail;
628	}
629
630	/*
631	 * Allocate command DMA map.
632	 */
633	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
634	    BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_cmd), 1,
635	    sizeof (struct ipw_cmd), 0, NULL, NULL, &sc->cmd_dmat);
636	if (error != 0) {
637		device_printf(sc->sc_dev, "could not create command DMA tag\n");
638		goto fail;
639	}
640
641	error = bus_dmamap_create(sc->cmd_dmat, 0, &sc->cmd_map);
642	if (error != 0) {
643		device_printf(sc->sc_dev,
644		    "could not create command DMA map\n");
645		goto fail;
646	}
647
648	/*
649	 * Allocate headers DMA maps.
650	 */
651	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
652	    BUS_SPACE_MAXADDR, NULL, NULL, sizeof (struct ipw_hdr), 1,
653	    sizeof (struct ipw_hdr), 0, NULL, NULL, &sc->hdr_dmat);
654	if (error != 0) {
655		device_printf(sc->sc_dev, "could not create header DMA tag\n");
656		goto fail;
657	}
658
659	SLIST_INIT(&sc->free_shdr);
660	for (i = 0; i < IPW_NDATA; i++) {
661		shdr = &sc->shdr_list[i];
662		error = bus_dmamap_create(sc->hdr_dmat, 0, &shdr->map);
663		if (error != 0) {
664			device_printf(sc->sc_dev,
665			    "could not create header DMA map\n");
666			goto fail;
667		}
668		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
669	}
670
671	/*
672	 * Allocate tx buffers DMA maps.
673	 */
674	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
675	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IPW_MAX_NSEG, MCLBYTES, 0,
676	    NULL, NULL, &sc->txbuf_dmat);
677	if (error != 0) {
678		device_printf(sc->sc_dev, "could not create tx DMA tag\n");
679		goto fail;
680	}
681
682	SLIST_INIT(&sc->free_sbuf);
683	for (i = 0; i < IPW_NDATA; i++) {
684		sbuf = &sc->tx_sbuf_list[i];
685		error = bus_dmamap_create(sc->txbuf_dmat, 0, &sbuf->map);
686		if (error != 0) {
687			device_printf(sc->sc_dev,
688			    "could not create tx DMA map\n");
689			goto fail;
690		}
691		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
692	}
693
694	/*
695	 * Initialize tx ring.
696	 */
697	for (i = 0; i < IPW_NTBD; i++) {
698		sbd = &sc->stbd_list[i];
699		sbd->bd = &sc->tbd_list[i];
700		sbd->type = IPW_SBD_TYPE_NOASSOC;
701	}
702
703	/*
704	 * Pre-allocate rx buffers and DMA maps.
705	 */
706	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
707	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0, NULL,
708	    NULL, &sc->rxbuf_dmat);
709	if (error != 0) {
710		device_printf(sc->sc_dev, "could not create rx DMA tag\n");
711		goto fail;
712	}
713
714	for (i = 0; i < IPW_NRBD; i++) {
715		sbd = &sc->srbd_list[i];
716		sbuf = &sc->rx_sbuf_list[i];
717		sbd->bd = &sc->rbd_list[i];
718
719		sbuf->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
720		if (sbuf->m == NULL) {
721			device_printf(sc->sc_dev,
722			    "could not allocate rx mbuf\n");
723			error = ENOMEM;
724			goto fail;
725		}
726
727		error = bus_dmamap_create(sc->rxbuf_dmat, 0, &sbuf->map);
728		if (error != 0) {
729			device_printf(sc->sc_dev,
730			    "could not create rx DMA map\n");
731			goto fail;
732		}
733
734		error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map,
735		    mtod(sbuf->m, void *), MCLBYTES, ipw_dma_map_addr,
736		    &physaddr, 0);
737		if (error != 0) {
738			device_printf(sc->sc_dev,
739			    "could not map rx DMA memory\n");
740			goto fail;
741		}
742
743		sbd->type = IPW_SBD_TYPE_DATA;
744		sbd->priv = sbuf;
745		sbd->bd->physaddr = htole32(physaddr);
746		sbd->bd->len = htole32(MCLBYTES);
747	}
748
749	bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
750
751	return 0;
752
753fail:	ipw_release(sc);
754	return error;
755}
756
757static void
758ipw_release(struct ipw_softc *sc)
759{
760	struct ipw_soft_buf *sbuf;
761	int i;
762
763	if (sc->tbd_dmat != NULL) {
764		if (sc->stbd_list != NULL) {
765			bus_dmamap_unload(sc->tbd_dmat, sc->tbd_map);
766			bus_dmamem_free(sc->tbd_dmat, sc->tbd_list,
767			    sc->tbd_map);
768		}
769		bus_dma_tag_destroy(sc->tbd_dmat);
770	}
771
772	if (sc->rbd_dmat != NULL) {
773		if (sc->rbd_list != NULL) {
774			bus_dmamap_unload(sc->rbd_dmat, sc->rbd_map);
775			bus_dmamem_free(sc->rbd_dmat, sc->rbd_list,
776			    sc->rbd_map);
777		}
778		bus_dma_tag_destroy(sc->rbd_dmat);
779	}
780
781	if (sc->status_dmat != NULL) {
782		if (sc->status_list != NULL) {
783			bus_dmamap_unload(sc->status_dmat, sc->status_map);
784			bus_dmamem_free(sc->status_dmat, sc->status_list,
785			    sc->status_map);
786		}
787		bus_dma_tag_destroy(sc->status_dmat);
788	}
789
790	for (i = 0; i < IPW_NTBD; i++)
791		ipw_release_sbd(sc, &sc->stbd_list[i]);
792
793	if (sc->cmd_dmat != NULL) {
794		bus_dmamap_destroy(sc->cmd_dmat, sc->cmd_map);
795		bus_dma_tag_destroy(sc->cmd_dmat);
796	}
797
798	if (sc->hdr_dmat != NULL) {
799		for (i = 0; i < IPW_NDATA; i++)
800			bus_dmamap_destroy(sc->hdr_dmat, sc->shdr_list[i].map);
801		bus_dma_tag_destroy(sc->hdr_dmat);
802	}
803
804	if (sc->txbuf_dmat != NULL) {
805		for (i = 0; i < IPW_NDATA; i++) {
806			bus_dmamap_destroy(sc->txbuf_dmat,
807			    sc->tx_sbuf_list[i].map);
808		}
809		bus_dma_tag_destroy(sc->txbuf_dmat);
810	}
811
812	if (sc->rxbuf_dmat != NULL) {
813		for (i = 0; i < IPW_NRBD; i++) {
814			sbuf = &sc->rx_sbuf_list[i];
815			if (sbuf->m != NULL) {
816				bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map,
817				    BUS_DMASYNC_POSTREAD);
818				bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
819				m_freem(sbuf->m);
820			}
821			bus_dmamap_destroy(sc->rxbuf_dmat, sbuf->map);
822		}
823		bus_dma_tag_destroy(sc->rxbuf_dmat);
824	}
825}
826
827static int
828ipw_shutdown(device_t dev)
829{
830	struct ipw_softc *sc = device_get_softc(dev);
831
832	ipw_stop(sc);
833
834	return 0;
835}
836
837static int
838ipw_suspend(device_t dev)
839{
840	struct ipw_softc *sc = device_get_softc(dev);
841
842	ipw_stop(sc);
843
844	return 0;
845}
846
847static int
848ipw_resume(device_t dev)
849{
850	struct ipw_softc *sc = device_get_softc(dev);
851	struct ifnet *ifp = sc->sc_ifp;
852
853	pci_write_config(dev, 0x41, 0, 1);
854
855	if (ifp->if_flags & IFF_UP)
856		ipw_init(sc);
857
858	return 0;
859}
860
861static int
862ipw_cvtrate(int ipwrate)
863{
864	switch (ipwrate) {
865	case IPW_RATE_DS1:	return 2;
866	case IPW_RATE_DS2:	return 4;
867	case IPW_RATE_DS5:	return 11;
868	case IPW_RATE_DS11:	return 22;
869	}
870	return 0;
871}
872
873/*
874 * The firmware automatically adapts the transmit speed. We report its current
875 * value here.
876 */
877static void
878ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
879{
880	struct ieee80211vap *vap = ifp->if_softc;
881	struct ieee80211com *ic = vap->iv_ic;
882	struct ipw_softc *sc = ic->ic_ifp->if_softc;
883
884	/* read current transmission rate from adapter */
885	vap->iv_bss->ni_txrate = ipw_cvtrate(
886	    ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE) & 0xf);
887	ieee80211_media_status(ifp, imr);
888}
889
890static int
891ipw_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
892{
893	struct ipw_vap *ivp = IPW_VAP(vap);
894	struct ieee80211com *ic = vap->iv_ic;
895	struct ifnet *ifp = ic->ic_ifp;
896	struct ipw_softc *sc = ifp->if_softc;
897
898	DPRINTF(("%s: %s -> %s flags 0x%x\n", __func__,
899		ieee80211_state_name[vap->iv_state],
900		ieee80211_state_name[nstate], sc->flags));
901
902	switch (nstate) {
903	case IEEE80211_S_RUN:
904		if (ic->ic_opmode == IEEE80211_M_IBSS) {
905			/*
906			 * XXX when joining an ibss network we are called
907			 * with a SCAN -> RUN transition on scan complete.
908			 * Use that to call ipw_auth_and_assoc.  On completing
909			 * the join we are then called again with an
910			 * AUTH -> RUN transition and we want to do nothing.
911			 * This is all totally bogus and needs to be redone.
912			 */
913			if (vap->iv_state == IEEE80211_S_SCAN) {
914				taskqueue_enqueue(taskqueue_swi,
915				    &IPW_VAP(vap)->assoc_task);
916				return EINPROGRESS;
917			}
918		}
919		break;
920
921	case IEEE80211_S_INIT:
922		if (sc->flags & IPW_FLAG_ASSOCIATED)
923			taskqueue_enqueue(taskqueue_swi,
924			    &IPW_VAP(vap)->disassoc_task);
925		break;
926
927	case IEEE80211_S_AUTH:
928		taskqueue_enqueue(taskqueue_swi, &IPW_VAP(vap)->assoc_task);
929		return EINPROGRESS;
930
931	case IEEE80211_S_ASSOC:
932		/*
933		 * If we are not transitioning from AUTH the resend the
934		 * association request.
935		 */
936		if (vap->iv_state != IEEE80211_S_AUTH) {
937			taskqueue_enqueue(taskqueue_swi,
938			    &IPW_VAP(vap)->assoc_task);
939			return EINPROGRESS;
940		}
941		break;
942
943	default:
944		break;
945	}
946	return ivp->newstate(vap, nstate, arg);
947}
948
949/*
950 * Read 16 bits at address 'addr' from the serial EEPROM.
951 */
952static uint16_t
953ipw_read_prom_word(struct ipw_softc *sc, uint8_t addr)
954{
955	uint32_t tmp;
956	uint16_t val;
957	int n;
958
959	/* clock C once before the first command */
960	IPW_EEPROM_CTL(sc, 0);
961	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
962	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
963	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
964
965	/* write start bit (1) */
966	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
967	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
968
969	/* write READ opcode (10) */
970	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
971	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
972	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
973	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
974
975	/* write address A7-A0 */
976	for (n = 7; n >= 0; n--) {
977		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
978		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
979		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
980		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
981	}
982
983	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
984
985	/* read data Q15-Q0 */
986	val = 0;
987	for (n = 15; n >= 0; n--) {
988		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
989		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
990		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
991		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
992	}
993
994	IPW_EEPROM_CTL(sc, 0);
995
996	/* clear Chip Select and clock C */
997	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
998	IPW_EEPROM_CTL(sc, 0);
999	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
1000
1001	return le16toh(val);
1002}
1003
1004static void
1005ipw_rx_cmd_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
1006{
1007	struct ipw_cmd *cmd;
1008
1009	bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map, BUS_DMASYNC_POSTREAD);
1010
1011	cmd = mtod(sbuf->m, struct ipw_cmd *);
1012
1013	DPRINTFN(9, ("cmd ack'ed %s(%u, %u, %u, %u, %u)\n",
1014	    ipw_cmdname(le32toh(cmd->type)), le32toh(cmd->type),
1015	    le32toh(cmd->subtype), le32toh(cmd->seq), le32toh(cmd->len),
1016	    le32toh(cmd->status)));
1017
1018	sc->flags &= ~IPW_FLAG_BUSY;
1019	wakeup(sc);
1020}
1021
1022static void
1023ipw_assocsuccess(void *arg, int npending)
1024{
1025	struct ieee80211vap *vap = arg;
1026
1027	ieee80211_new_state(vap, IEEE80211_S_RUN, -1);
1028}
1029
1030static void
1031ipw_assocfailed(void *arg, int npending)
1032{
1033	struct ieee80211vap *vap = arg;
1034
1035	ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
1036}
1037
1038static void
1039ipw_scandone(void *arg, int npending)
1040{
1041	struct ieee80211vap *vap = arg;
1042
1043	ieee80211_scan_done(vap);
1044}
1045
1046static void
1047ipw_bmiss(void *arg, int npending)
1048{
1049	struct ieee80211com *ic = arg;
1050
1051	ieee80211_beacon_miss(ic);
1052}
1053
1054static void
1055ipw_rx_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
1056{
1057#define	IEEESTATE(vap)	ieee80211_state_name[vap->iv_state]
1058	struct ifnet *ifp = sc->sc_ifp;
1059	struct ieee80211com *ic = ifp->if_l2com;
1060	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1061	uint32_t state;
1062
1063	bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map, BUS_DMASYNC_POSTREAD);
1064
1065	state = le32toh(*mtod(sbuf->m, uint32_t *));
1066
1067	switch (state) {
1068	case IPW_STATE_ASSOCIATED:
1069		DPRINTFN(2, ("Association succeeded (%s flags 0x%x)\n",
1070			IEEESTATE(vap), sc->flags));
1071		/* XXX suppress state change in case the fw auto-associates */
1072		if ((sc->flags & IPW_FLAG_ASSOCIATING) == 0) {
1073			DPRINTF(("Unexpected association (%s, flags 0x%x)\n",
1074				IEEESTATE(vap), sc->flags));
1075			break;
1076		}
1077		sc->flags &= ~IPW_FLAG_ASSOCIATING;
1078		sc->flags |= IPW_FLAG_ASSOCIATED;
1079		taskqueue_enqueue(taskqueue_swi,
1080		    &IPW_VAP(vap)->assoc_success_task);
1081		break;
1082
1083	case IPW_STATE_SCANNING:
1084		DPRINTFN(3, ("Scanning (%s flags 0x%x)\n",
1085			IEEESTATE(vap), sc->flags));
1086		/*
1087		 * NB: Check driver state for association on assoc
1088		 * loss as the firmware will immediately start to
1089		 * scan and we would treat it as a beacon miss if
1090		 * we checked the 802.11 layer state.
1091		 */
1092		if (sc->flags & IPW_FLAG_ASSOCIATED) {
1093			/* XXX probably need to issue disassoc to fw */
1094			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmiss_task);
1095		}
1096		break;
1097
1098	case IPW_STATE_SCAN_COMPLETE:
1099		/*
1100		 * XXX For some reason scan requests generate scan
1101		 * started + scan done events before any traffic is
1102		 * received (e.g. probe response frames).  We work
1103		 * around this by marking the HACK flag and skipping
1104		 * the first scan complete event.
1105		*/
1106		DPRINTFN(3, ("Scan complete (%s flags 0x%x)\n",
1107			    IEEESTATE(vap), sc->flags));
1108		if (sc->flags & IPW_FLAG_HACK) {
1109			sc->flags &= ~IPW_FLAG_HACK;
1110			break;
1111		}
1112		if (sc->flags & IPW_FLAG_SCANNING) {
1113			taskqueue_enqueue(taskqueue_swi,
1114			    &IPW_VAP(vap)->scandone_task);
1115			sc->flags &= ~IPW_FLAG_SCANNING;
1116			sc->sc_scan_timer = 0;
1117		}
1118		break;
1119
1120	case IPW_STATE_ASSOCIATION_LOST:
1121		DPRINTFN(2, ("Association lost (%s flags 0x%x)\n",
1122			IEEESTATE(vap), sc->flags));
1123		sc->flags &= ~(IPW_FLAG_ASSOCIATING | IPW_FLAG_ASSOCIATED);
1124		if (vap->iv_state == IEEE80211_S_RUN)
1125			taskqueue_enqueue(taskqueue_swi,
1126			    &IPW_VAP(vap)->assoc_failed_task);
1127		break;
1128
1129	case IPW_STATE_DISABLED:
1130		/* XXX? is this right? */
1131		sc->flags &= ~(IPW_FLAG_HACK | IPW_FLAG_SCANNING |
1132		    IPW_FLAG_ASSOCIATING | IPW_FLAG_ASSOCIATED);
1133		DPRINTFN(2, ("Firmware disabled (%s flags 0x%x)\n",
1134			IEEESTATE(vap), sc->flags));
1135		break;
1136
1137	case IPW_STATE_RADIO_DISABLED:
1138		device_printf(sc->sc_dev, "radio turned off\n");
1139		ieee80211_notify_radio(ic, 0);
1140		ipw_stop_locked(sc);
1141		/* XXX start polling thread to detect radio on */
1142		break;
1143
1144	default:
1145		DPRINTFN(2, ("%s: unhandled state %u %s flags 0x%x\n",
1146			__func__, state, IEEESTATE(vap), sc->flags));
1147		break;
1148	}
1149#undef IEEESTATE
1150}
1151
1152/*
1153 * Set driver state for current channel.
1154 */
1155static void
1156ipw_setcurchan(struct ipw_softc *sc, struct ieee80211_channel *chan)
1157{
1158	struct ifnet *ifp = sc->sc_ifp;
1159	struct ieee80211com *ic = ifp->if_l2com;
1160
1161	ic->ic_curchan = chan;
1162	sc->sc_rxtap.wr_chan_freq = sc->sc_txtap.wt_chan_freq =
1163		htole16(ic->ic_curchan->ic_freq);
1164	sc->sc_rxtap.wr_chan_flags = sc->sc_txtap.wt_chan_flags =
1165		htole16(ic->ic_curchan->ic_flags);
1166}
1167
1168/*
1169 * XXX: Hack to set the current channel to the value advertised in beacons or
1170 * probe responses. Only used during AP detection.
1171 */
1172static void
1173ipw_fix_channel(struct ipw_softc *sc, struct mbuf *m)
1174{
1175	struct ifnet *ifp = sc->sc_ifp;
1176	struct ieee80211com *ic = ifp->if_l2com;
1177	struct ieee80211_channel *c;
1178	struct ieee80211_frame *wh;
1179	uint8_t subtype;
1180	uint8_t *frm, *efrm;
1181
1182	wh = mtod(m, struct ieee80211_frame *);
1183
1184	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
1185		return;
1186
1187	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1188
1189	if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
1190	    subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1191		return;
1192
1193	/* XXX use ieee80211_parse_beacon */
1194	frm = (uint8_t *)(wh + 1);
1195	efrm = mtod(m, uint8_t *) + m->m_len;
1196
1197	frm += 12;	/* skip tstamp, bintval and capinfo fields */
1198	while (frm < efrm) {
1199		if (*frm == IEEE80211_ELEMID_DSPARMS)
1200#if IEEE80211_CHAN_MAX < 255
1201		if (frm[2] <= IEEE80211_CHAN_MAX)
1202#endif
1203		{
1204			DPRINTF(("Fixing channel to %d\n", frm[2]));
1205			c = ieee80211_find_channel(ic,
1206				ieee80211_ieee2mhz(frm[2], 0),
1207				IEEE80211_CHAN_B);
1208			if (c == NULL)
1209				c = &ic->ic_channels[0];
1210			ipw_setcurchan(sc, c);
1211		}
1212
1213		frm += frm[1] + 2;
1214	}
1215}
1216
1217static void
1218ipw_rx_data_intr(struct ipw_softc *sc, struct ipw_status *status,
1219    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
1220{
1221	struct ifnet *ifp = sc->sc_ifp;
1222	struct ieee80211com *ic = ifp->if_l2com;
1223	struct mbuf *mnew, *m;
1224	struct ieee80211_node *ni;
1225	bus_addr_t physaddr;
1226	int error;
1227	IPW_LOCK_DECL;
1228
1229	DPRINTFN(5, ("received frame len=%u, rssi=%u\n", le32toh(status->len),
1230	    status->rssi));
1231
1232	if (le32toh(status->len) < sizeof (struct ieee80211_frame_min) ||
1233	    le32toh(status->len) > MCLBYTES)
1234		return;
1235
1236	/*
1237	 * Try to allocate a new mbuf for this ring element and load it before
1238	 * processing the current mbuf. If the ring element cannot be loaded,
1239	 * drop the received packet and reuse the old mbuf. In the unlikely
1240	 * case that the old mbuf can't be reloaded either, explicitly panic.
1241	 */
1242	mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1243	if (mnew == NULL) {
1244		ifp->if_ierrors++;
1245		return;
1246	}
1247
1248	bus_dmamap_sync(sc->rxbuf_dmat, sbuf->map, BUS_DMASYNC_POSTREAD);
1249	bus_dmamap_unload(sc->rxbuf_dmat, sbuf->map);
1250
1251	error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map, mtod(mnew, void *),
1252	    MCLBYTES, ipw_dma_map_addr, &physaddr, 0);
1253	if (error != 0) {
1254		m_freem(mnew);
1255
1256		/* try to reload the old mbuf */
1257		error = bus_dmamap_load(sc->rxbuf_dmat, sbuf->map,
1258		    mtod(sbuf->m, void *), MCLBYTES, ipw_dma_map_addr,
1259		    &physaddr, 0);
1260		if (error != 0) {
1261			/* very unlikely that it will fail... */
1262			panic("%s: could not load old rx mbuf",
1263			    device_get_name(sc->sc_dev));
1264		}
1265		ifp->if_ierrors++;
1266		return;
1267	}
1268
1269	/*
1270	 * New mbuf successfully loaded, update Rx ring and continue
1271	 * processing.
1272	 */
1273	m = sbuf->m;
1274	sbuf->m = mnew;
1275	sbd->bd->physaddr = htole32(physaddr);
1276
1277	/* finalize mbuf */
1278	m->m_pkthdr.rcvif = ifp;
1279	m->m_pkthdr.len = m->m_len = le32toh(status->len);
1280
1281	if (bpf_peers_present(ifp->if_bpf)) {
1282		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
1283
1284		tap->wr_flags = 0;
1285		tap->wr_antsignal = status->rssi + IPW_RSSI_TO_DBM;
1286		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1287		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1288
1289		bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1290	}
1291
1292	if (sc->flags & IPW_FLAG_SCANNING)
1293		ipw_fix_channel(sc, m);
1294
1295	IPW_UNLOCK(sc);
1296	ni = ieee80211_find_rxnode(ic, mtod(m, struct ieee80211_frame_min *));
1297	if (ni != NULL) {
1298		(void) ieee80211_input(ni, m, status->rssi, -95, 0);
1299		ieee80211_free_node(ni);
1300	} else
1301		(void) ieee80211_input_all(ic, m, status->rssi, -95, 0);
1302	IPW_LOCK(sc);
1303
1304	bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
1305}
1306
1307static void
1308ipw_rx_intr(struct ipw_softc *sc)
1309{
1310	struct ipw_status *status;
1311	struct ipw_soft_bd *sbd;
1312	struct ipw_soft_buf *sbuf;
1313	uint32_t r, i;
1314
1315	if (!(sc->flags & IPW_FLAG_FW_INITED))
1316		return;
1317
1318	r = CSR_READ_4(sc, IPW_CSR_RX_READ);
1319
1320	bus_dmamap_sync(sc->status_dmat, sc->status_map, BUS_DMASYNC_POSTREAD);
1321
1322	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
1323		status = &sc->status_list[i];
1324		sbd = &sc->srbd_list[i];
1325		sbuf = sbd->priv;
1326
1327		switch (le16toh(status->code) & 0xf) {
1328		case IPW_STATUS_CODE_COMMAND:
1329			ipw_rx_cmd_intr(sc, sbuf);
1330			break;
1331
1332		case IPW_STATUS_CODE_NEWSTATE:
1333			ipw_rx_newstate_intr(sc, sbuf);
1334			break;
1335
1336		case IPW_STATUS_CODE_DATA_802_3:
1337		case IPW_STATUS_CODE_DATA_802_11:
1338			ipw_rx_data_intr(sc, status, sbd, sbuf);
1339			break;
1340
1341		case IPW_STATUS_CODE_NOTIFICATION:
1342			DPRINTFN(2, ("notification status, len %u flags 0x%x\n",
1343			    le32toh(status->len), status->flags));
1344			/* XXX maybe drive state machine AUTH->ASSOC? */
1345			break;
1346
1347		default:
1348			device_printf(sc->sc_dev, "unexpected status code %u\n",
1349			    le16toh(status->code));
1350		}
1351
1352		/* firmware was killed, stop processing received frames */
1353		if (!(sc->flags & IPW_FLAG_FW_INITED))
1354			return;
1355
1356		sbd->bd->flags = 0;
1357	}
1358
1359	bus_dmamap_sync(sc->rbd_dmat, sc->rbd_map, BUS_DMASYNC_PREWRITE);
1360
1361	/* kick the firmware */
1362	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
1363	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE, sc->rxcur);
1364}
1365
1366static void
1367ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1368{
1369	struct ipw_soft_hdr *shdr;
1370	struct ipw_soft_buf *sbuf;
1371
1372	switch (sbd->type) {
1373	case IPW_SBD_TYPE_COMMAND:
1374		bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map,
1375		    BUS_DMASYNC_POSTWRITE);
1376		bus_dmamap_unload(sc->cmd_dmat, sc->cmd_map);
1377		break;
1378
1379	case IPW_SBD_TYPE_HEADER:
1380		shdr = sbd->priv;
1381		bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_POSTWRITE);
1382		bus_dmamap_unload(sc->hdr_dmat, shdr->map);
1383		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1384		break;
1385
1386	case IPW_SBD_TYPE_DATA:
1387		sbuf = sbd->priv;
1388		bus_dmamap_sync(sc->txbuf_dmat, sbuf->map,
1389		    BUS_DMASYNC_POSTWRITE);
1390		bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1391		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1392
1393		if (sbuf->m->m_flags & M_TXCB)
1394			ieee80211_process_callback(sbuf->ni, sbuf->m, 0/*XXX*/);
1395		m_freem(sbuf->m);
1396		ieee80211_free_node(sbuf->ni);
1397
1398		sc->sc_tx_timer = 0;
1399		break;
1400	}
1401
1402	sbd->type = IPW_SBD_TYPE_NOASSOC;
1403}
1404
1405static void
1406ipw_tx_intr(struct ipw_softc *sc)
1407{
1408	struct ifnet *ifp = sc->sc_ifp;
1409	struct ipw_soft_bd *sbd;
1410	uint32_t r, i;
1411
1412	if (!(sc->flags & IPW_FLAG_FW_INITED))
1413		return;
1414
1415	r = CSR_READ_4(sc, IPW_CSR_TX_READ);
1416
1417	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1418		sbd = &sc->stbd_list[i];
1419
1420		if (sbd->type == IPW_SBD_TYPE_DATA)
1421			ifp->if_opackets++;
1422
1423		ipw_release_sbd(sc, sbd);
1424		sc->txfree++;
1425	}
1426
1427	/* remember what the firmware has processed */
1428	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1429
1430	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1431	ipw_start_locked(ifp);
1432}
1433
1434static void
1435ipw_intr(void *arg)
1436{
1437	struct ipw_softc *sc = arg;
1438	uint32_t r;
1439	IPW_LOCK_DECL;
1440
1441	IPW_LOCK(sc);
1442
1443	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff) {
1444		IPW_UNLOCK(sc);
1445		return;
1446	}
1447
1448	/* disable interrupts */
1449	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1450
1451	/* acknowledge all interrupts */
1452	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1453
1454	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1455		device_printf(sc->sc_dev, "firmware error\n");
1456		taskqueue_enqueue(taskqueue_swi, &sc->sc_init_task);
1457		r = 0;	/* don't process more interrupts */
1458	}
1459
1460	if (r & IPW_INTR_FW_INIT_DONE)
1461		wakeup(sc);
1462
1463	if (r & IPW_INTR_RX_TRANSFER)
1464		ipw_rx_intr(sc);
1465
1466	if (r & IPW_INTR_TX_TRANSFER)
1467		ipw_tx_intr(sc);
1468
1469	/* re-enable interrupts */
1470	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1471
1472	IPW_UNLOCK(sc);
1473}
1474
1475static void
1476ipw_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1477{
1478	if (error != 0)
1479		return;
1480
1481	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
1482
1483	*(bus_addr_t *)arg = segs[0].ds_addr;
1484}
1485
1486static const char *
1487ipw_cmdname(int cmd)
1488{
1489#define	N(a)	(sizeof(a) / sizeof(a[0]))
1490	static const struct {
1491		int	cmd;
1492		const char *name;
1493	} cmds[] = {
1494		{ IPW_CMD_ADD_MULTICAST,	"ADD_MULTICAST" },
1495		{ IPW_CMD_BROADCAST_SCAN,	"BROADCAST_SCAN" },
1496		{ IPW_CMD_DISABLE,		"DISABLE" },
1497		{ IPW_CMD_DISABLE_PHY,		"DISABLE_PHY" },
1498		{ IPW_CMD_ENABLE,		"ENABLE" },
1499		{ IPW_CMD_PREPARE_POWER_DOWN,	"PREPARE_POWER_DOWN" },
1500		{ IPW_CMD_SET_BASIC_TX_RATES,	"SET_BASIC_TX_RATES" },
1501		{ IPW_CMD_SET_BEACON_INTERVAL,	"SET_BEACON_INTERVAL" },
1502		{ IPW_CMD_SET_CHANNEL,		"SET_CHANNEL" },
1503		{ IPW_CMD_SET_CONFIGURATION,	"SET_CONFIGURATION" },
1504		{ IPW_CMD_SET_DESIRED_BSSID,	"SET_DESIRED_BSSID" },
1505		{ IPW_CMD_SET_ESSID,		"SET_ESSID" },
1506		{ IPW_CMD_SET_FRAG_THRESHOLD,	"SET_FRAG_THRESHOLD" },
1507		{ IPW_CMD_SET_MAC_ADDRESS,	"SET_MAC_ADDRESS" },
1508		{ IPW_CMD_SET_MANDATORY_BSSID,	"SET_MANDATORY_BSSID" },
1509		{ IPW_CMD_SET_MODE,		"SET_MODE" },
1510		{ IPW_CMD_SET_MSDU_TX_RATES,	"SET_MSDU_TX_RATES" },
1511		{ IPW_CMD_SET_POWER_MODE,	"SET_POWER_MODE" },
1512		{ IPW_CMD_SET_RTS_THRESHOLD,	"SET_RTS_THRESHOLD" },
1513		{ IPW_CMD_SET_SCAN_OPTIONS,	"SET_SCAN_OPTIONS" },
1514		{ IPW_CMD_SET_SECURITY_INFO,	"SET_SECURITY_INFO" },
1515		{ IPW_CMD_SET_TX_POWER_INDEX,	"SET_TX_POWER_INDEX" },
1516		{ IPW_CMD_SET_TX_RATES,		"SET_TX_RATES" },
1517		{ IPW_CMD_SET_WEP_FLAGS,	"SET_WEP_FLAGS" },
1518		{ IPW_CMD_SET_WEP_KEY,		"SET_WEP_KEY" },
1519		{ IPW_CMD_SET_WEP_KEY_INDEX,	"SET_WEP_KEY_INDEX" },
1520		{ IPW_CMD_SET_WPA_IE,		"SET_WPA_IE" },
1521
1522	};
1523	static char buf[12];
1524	int i;
1525
1526	for (i = 0; i < N(cmds); i++)
1527		if (cmds[i].cmd == cmd)
1528			return cmds[i].name;
1529	snprintf(buf, sizeof(buf), "%u", cmd);
1530	return buf;
1531#undef N
1532}
1533
1534/*
1535 * Send a command to the firmware and wait for the acknowledgement.
1536 */
1537static int
1538ipw_cmd(struct ipw_softc *sc, uint32_t type, void *data, uint32_t len)
1539{
1540	struct ipw_soft_bd *sbd;
1541	bus_addr_t physaddr;
1542	int error;
1543
1544	IPW_LOCK_ASSERT(sc);
1545
1546	if (sc->flags & IPW_FLAG_BUSY) {
1547		device_printf(sc->sc_dev, "%s: %s not sent, busy\n",
1548			__func__, ipw_cmdname(type));
1549		return EAGAIN;
1550	}
1551	sc->flags |= IPW_FLAG_BUSY;
1552
1553	sbd = &sc->stbd_list[sc->txcur];
1554
1555	error = bus_dmamap_load(sc->cmd_dmat, sc->cmd_map, &sc->cmd,
1556	    sizeof (struct ipw_cmd), ipw_dma_map_addr, &physaddr, 0);
1557	if (error != 0) {
1558		device_printf(sc->sc_dev, "could not map command DMA memory\n");
1559		sc->flags &= ~IPW_FLAG_BUSY;
1560		return error;
1561	}
1562
1563	sc->cmd.type = htole32(type);
1564	sc->cmd.subtype = 0;
1565	sc->cmd.len = htole32(len);
1566	sc->cmd.seq = 0;
1567	memcpy(sc->cmd.data, data, len);
1568
1569	sbd->type = IPW_SBD_TYPE_COMMAND;
1570	sbd->bd->physaddr = htole32(physaddr);
1571	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1572	sbd->bd->nfrag = 1;
1573	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1574	    IPW_BD_FLAG_TX_LAST_FRAGMENT;
1575
1576	bus_dmamap_sync(sc->cmd_dmat, sc->cmd_map, BUS_DMASYNC_PREWRITE);
1577	bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1578
1579#ifdef IPW_DEBUG
1580	if (ipw_debug >= 4) {
1581		printf("sending %s(%u, %u, %u, %u)", ipw_cmdname(type), type,
1582		    0, 0, len);
1583		/* Print the data buffer in the higher debug level */
1584		if (ipw_debug >= 9 && len > 0) {
1585			printf(" data: 0x");
1586			for (int i = 1; i <= len; i++)
1587				printf("%1D", (u_char *)data + len - i, "");
1588		}
1589		printf("\n");
1590	}
1591#endif
1592
1593	/* kick firmware */
1594	sc->txfree--;
1595	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1596	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE, sc->txcur);
1597
1598	/* wait at most one second for command to complete */
1599	error = msleep(sc, &sc->sc_mtx, 0, "ipwcmd", hz);
1600	if (error != 0) {
1601		device_printf(sc->sc_dev, "%s: %s failed, timeout (error %u)\n",
1602		    __func__, ipw_cmdname(type), error);
1603		sc->flags &= ~IPW_FLAG_BUSY;
1604		return (error);
1605	}
1606	return (0);
1607}
1608
1609static int
1610ipw_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1611{
1612	struct ipw_softc *sc = ifp->if_softc;
1613	struct ieee80211com *ic = ifp->if_l2com;
1614	struct ieee80211_frame *wh;
1615	struct ipw_soft_bd *sbd;
1616	struct ipw_soft_hdr *shdr;
1617	struct ipw_soft_buf *sbuf;
1618	struct ieee80211_key *k;
1619	struct mbuf *mnew;
1620	bus_dma_segment_t segs[IPW_MAX_NSEG];
1621	bus_addr_t physaddr;
1622	int nsegs, error, i;
1623
1624	wh = mtod(m0, struct ieee80211_frame *);
1625
1626	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1627		k = ieee80211_crypto_encap(ni, m0);
1628		if (k == NULL) {
1629			m_freem(m0);
1630			return ENOBUFS;
1631		}
1632		/* packet header may have moved, reset our local pointer */
1633		wh = mtod(m0, struct ieee80211_frame *);
1634	}
1635
1636	if (bpf_peers_present(ifp->if_bpf)) {
1637		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1638
1639		tap->wt_flags = 0;
1640		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1641		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1642
1643		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m0);
1644	}
1645
1646	shdr = SLIST_FIRST(&sc->free_shdr);
1647	sbuf = SLIST_FIRST(&sc->free_sbuf);
1648	KASSERT(shdr != NULL && sbuf != NULL, ("empty sw hdr/buf pool"));
1649
1650	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1651	shdr->hdr.subtype = 0;
1652	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1653	shdr->hdr.encrypt = 0;
1654	shdr->hdr.keyidx = 0;
1655	shdr->hdr.keysz = 0;
1656	shdr->hdr.fragmentsz = 0;
1657	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1658	if (ic->ic_opmode == IEEE80211_M_STA)
1659		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1660	else
1661		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1662
1663	/* trim IEEE802.11 header */
1664	m_adj(m0, sizeof (struct ieee80211_frame));
1665
1666	error = bus_dmamap_load_mbuf_sg(sc->txbuf_dmat, sbuf->map, m0, segs,
1667	    &nsegs, 0);
1668	if (error != 0 && error != EFBIG) {
1669		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1670		    error);
1671		m_freem(m0);
1672		return error;
1673	}
1674	if (error != 0) {
1675		mnew = m_defrag(m0, M_DONTWAIT);
1676		if (mnew == NULL) {
1677			device_printf(sc->sc_dev,
1678			    "could not defragment mbuf\n");
1679			m_freem(m0);
1680			return ENOBUFS;
1681		}
1682		m0 = mnew;
1683
1684		error = bus_dmamap_load_mbuf_sg(sc->txbuf_dmat, sbuf->map, m0,
1685		    segs, &nsegs, 0);
1686		if (error != 0) {
1687			device_printf(sc->sc_dev,
1688			    "could not map mbuf (error %d)\n", error);
1689			m_freem(m0);
1690			return error;
1691		}
1692	}
1693
1694	error = bus_dmamap_load(sc->hdr_dmat, shdr->map, &shdr->hdr,
1695	    sizeof (struct ipw_hdr), ipw_dma_map_addr, &physaddr, 0);
1696	if (error != 0) {
1697		device_printf(sc->sc_dev, "could not map header DMA memory\n");
1698		bus_dmamap_unload(sc->txbuf_dmat, sbuf->map);
1699		m_freem(m0);
1700		return error;
1701	}
1702
1703	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1704	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1705
1706	sbd = &sc->stbd_list[sc->txcur];
1707	sbd->type = IPW_SBD_TYPE_HEADER;
1708	sbd->priv = shdr;
1709	sbd->bd->physaddr = htole32(physaddr);
1710	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1711	sbd->bd->nfrag = 1 + nsegs;
1712	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1713	    IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1714
1715	DPRINTFN(5, ("sending tx hdr (%u, %u, %u, %u, %6D, %6D)\n",
1716	    shdr->hdr.type, shdr->hdr.subtype, shdr->hdr.encrypted,
1717	    shdr->hdr.encrypt, shdr->hdr.src_addr, ":", shdr->hdr.dst_addr,
1718	    ":"));
1719
1720	sc->txfree--;
1721	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1722
1723	sbuf->m = m0;
1724	sbuf->ni = ni;
1725
1726	for (i = 0; i < nsegs; i++) {
1727		sbd = &sc->stbd_list[sc->txcur];
1728
1729		sbd->bd->physaddr = htole32(segs[i].ds_addr);
1730		sbd->bd->len = htole32(segs[i].ds_len);
1731		sbd->bd->nfrag = 0;
1732		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1733		if (i == nsegs - 1) {
1734			sbd->type = IPW_SBD_TYPE_DATA;
1735			sbd->priv = sbuf;
1736			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1737		} else {
1738			sbd->type = IPW_SBD_TYPE_NOASSOC;
1739			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1740		}
1741
1742		DPRINTFN(5, ("sending fragment (%d)\n", i));
1743
1744		sc->txfree--;
1745		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1746	}
1747
1748	bus_dmamap_sync(sc->hdr_dmat, shdr->map, BUS_DMASYNC_PREWRITE);
1749	bus_dmamap_sync(sc->txbuf_dmat, sbuf->map, BUS_DMASYNC_PREWRITE);
1750	bus_dmamap_sync(sc->tbd_dmat, sc->tbd_map, BUS_DMASYNC_PREWRITE);
1751
1752	/* kick firmware */
1753	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE, sc->txcur);
1754
1755	return 0;
1756}
1757
1758static int
1759ipw_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1760	const struct ieee80211_bpf_params *params)
1761{
1762	/* no support; just discard */
1763	m_freem(m);
1764	ieee80211_free_node(ni);
1765	return 0;
1766}
1767
1768static void
1769ipw_start(struct ifnet *ifp)
1770{
1771	struct ipw_softc *sc = ifp->if_softc;
1772	IPW_LOCK_DECL;
1773
1774	IPW_LOCK(sc);
1775	ipw_start_locked(ifp);
1776	IPW_UNLOCK(sc);
1777}
1778
1779static void
1780ipw_start_locked(struct ifnet *ifp)
1781{
1782	struct ipw_softc *sc = ifp->if_softc;
1783	struct ieee80211_node *ni;
1784	struct mbuf *m;
1785
1786	IPW_LOCK_ASSERT(sc);
1787
1788	for (;;) {
1789		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1790		if (m == NULL)
1791			break;
1792		if (sc->txfree < 1 + IPW_MAX_NSEG) {
1793			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1794			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1795			break;
1796		}
1797		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1798		if (ipw_tx_start(ifp, m, ni) != 0) {
1799			ieee80211_free_node(ni);
1800			ifp->if_oerrors++;
1801			break;
1802		}
1803		/* start watchdog timer */
1804		sc->sc_tx_timer = 5;
1805	}
1806}
1807
1808static void
1809ipw_watchdog(void *arg)
1810{
1811	struct ipw_softc *sc = arg;
1812	struct ifnet *ifp = sc->sc_ifp;
1813	struct ieee80211com *ic = ifp->if_l2com;
1814
1815	IPW_LOCK_ASSERT(sc);
1816
1817	if (sc->sc_tx_timer > 0) {
1818		if (--sc->sc_tx_timer == 0) {
1819			if_printf(ifp, "device timeout\n");
1820			ifp->if_oerrors++;
1821			taskqueue_enqueue(taskqueue_swi, &sc->sc_init_task);
1822		}
1823	}
1824	if (sc->sc_scan_timer > 0) {
1825		if (--sc->sc_scan_timer == 0) {
1826			DPRINTFN(3, ("Scan timeout\n"));
1827			/* End the scan */
1828			if (sc->flags & IPW_FLAG_SCANNING) {
1829				ieee80211_scan_done(TAILQ_FIRST(&ic->ic_vaps));
1830				sc->flags &= ~IPW_FLAG_SCANNING;
1831			}
1832		}
1833	}
1834	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1835		callout_reset(&sc->sc_wdtimer, hz, ipw_watchdog, sc);
1836}
1837
1838static int
1839ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1840{
1841	struct ipw_softc *sc = ifp->if_softc;
1842	struct ieee80211com *ic = ifp->if_l2com;
1843	struct ifreq *ifr = (struct ifreq *) data;
1844	int error = 0, startall = 0;
1845	IPW_LOCK_DECL;
1846
1847	switch (cmd) {
1848	case SIOCSIFFLAGS:
1849		IPW_LOCK(sc);
1850		if (ifp->if_flags & IFF_UP) {
1851			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1852				ipw_init_locked(sc);
1853				startall = 1;
1854			}
1855		} else {
1856			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1857				ipw_stop_locked(sc);
1858		}
1859		IPW_UNLOCK(sc);
1860		if (startall)
1861			ieee80211_start_all(ic);
1862		break;
1863	case SIOCGIFMEDIA:
1864		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1865		break;
1866	case SIOCGIFADDR:
1867		error = ether_ioctl(ifp, cmd, data);
1868		break;
1869	default:
1870		error = EINVAL;
1871		break;
1872	}
1873	return error;
1874}
1875
1876static void
1877ipw_stop_master(struct ipw_softc *sc)
1878{
1879	uint32_t tmp;
1880	int ntries;
1881
1882	/* disable interrupts */
1883	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1884
1885	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1886	for (ntries = 0; ntries < 50; ntries++) {
1887		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1888			break;
1889		DELAY(10);
1890	}
1891	if (ntries == 50)
1892		device_printf(sc->sc_dev, "timeout waiting for master\n");
1893
1894	tmp = CSR_READ_4(sc, IPW_CSR_RST);
1895	CSR_WRITE_4(sc, IPW_CSR_RST, tmp | IPW_RST_PRINCETON_RESET);
1896
1897	/* Clear all flags except the following */
1898	sc->flags &= IPW_FLAG_HAS_RADIO_SWITCH;
1899}
1900
1901static int
1902ipw_reset(struct ipw_softc *sc)
1903{
1904	uint32_t tmp;
1905	int ntries;
1906
1907	ipw_stop_master(sc);
1908
1909	/* move adapter to D0 state */
1910	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1911	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_INIT);
1912
1913	/* wait for clock stabilization */
1914	for (ntries = 0; ntries < 1000; ntries++) {
1915		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1916			break;
1917		DELAY(200);
1918	}
1919	if (ntries == 1000)
1920		return EIO;
1921
1922	tmp =  CSR_READ_4(sc, IPW_CSR_RST);
1923	CSR_WRITE_4(sc, IPW_CSR_RST, tmp | IPW_RST_SW_RESET);
1924
1925	DELAY(10);
1926
1927	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1928	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_INIT);
1929
1930	return 0;
1931}
1932
1933static int
1934ipw_waitfordisable(struct ipw_softc *sc, int waitfor)
1935{
1936	int ms = hz < 1000 ? 1 : hz/10;
1937	int i, error;
1938
1939	for (i = 0; i < 100; i++) {
1940		if (ipw_read_table1(sc, IPW_INFO_CARD_DISABLED) == waitfor)
1941			return 0;
1942		error = msleep(sc, &sc->sc_mtx, PCATCH, __func__, ms);
1943		if (error == 0 || error != EWOULDBLOCK)
1944			return 0;
1945	}
1946	DPRINTF(("%s: timeout waiting for %s\n",
1947		__func__, waitfor ? "disable" : "enable"));
1948	return ETIMEDOUT;
1949}
1950
1951static int
1952ipw_enable(struct ipw_softc *sc)
1953{
1954	int error;
1955
1956	if ((sc->flags & IPW_FLAG_ENABLED) == 0) {
1957		DPRINTF(("Enable adapter\n"));
1958		error = ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1959		if (error != 0)
1960			return error;
1961		error = ipw_waitfordisable(sc, 0);
1962		if (error != 0)
1963			return error;
1964		sc->flags |= IPW_FLAG_ENABLED;
1965	}
1966	return 0;
1967}
1968
1969static int
1970ipw_disable(struct ipw_softc *sc)
1971{
1972	int error;
1973
1974	if (sc->flags & IPW_FLAG_ENABLED) {
1975		DPRINTF(("Disable adapter\n"));
1976		error = ipw_cmd(sc, IPW_CMD_DISABLE, NULL, 0);
1977		if (error != 0)
1978			return error;
1979		error = ipw_waitfordisable(sc, 1);
1980		if (error != 0)
1981			return error;
1982		sc->flags &= ~IPW_FLAG_ENABLED;
1983	}
1984	return 0;
1985}
1986
1987/*
1988 * Upload the microcode to the device.
1989 */
1990static int
1991ipw_load_ucode(struct ipw_softc *sc, const char *uc, int size)
1992{
1993	int ntries;
1994
1995	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1996	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1997
1998	MEM_WRITE_2(sc, 0x220000, 0x0703);
1999	MEM_WRITE_2(sc, 0x220000, 0x0707);
2000
2001	MEM_WRITE_1(sc, 0x210014, 0x72);
2002	MEM_WRITE_1(sc, 0x210014, 0x72);
2003
2004	MEM_WRITE_1(sc, 0x210000, 0x40);
2005	MEM_WRITE_1(sc, 0x210000, 0x00);
2006	MEM_WRITE_1(sc, 0x210000, 0x40);
2007
2008	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
2009
2010	MEM_WRITE_1(sc, 0x210000, 0x00);
2011	MEM_WRITE_1(sc, 0x210000, 0x00);
2012	MEM_WRITE_1(sc, 0x210000, 0x80);
2013
2014	MEM_WRITE_2(sc, 0x220000, 0x0703);
2015	MEM_WRITE_2(sc, 0x220000, 0x0707);
2016
2017	MEM_WRITE_1(sc, 0x210014, 0x72);
2018	MEM_WRITE_1(sc, 0x210014, 0x72);
2019
2020	MEM_WRITE_1(sc, 0x210000, 0x00);
2021	MEM_WRITE_1(sc, 0x210000, 0x80);
2022
2023	for (ntries = 0; ntries < 10; ntries++) {
2024		if (MEM_READ_1(sc, 0x210000) & 1)
2025			break;
2026		DELAY(10);
2027	}
2028	if (ntries == 10) {
2029		device_printf(sc->sc_dev,
2030		    "timeout waiting for ucode to initialize\n");
2031		return EIO;
2032	}
2033
2034	MEM_WRITE_4(sc, 0x3000e0, 0);
2035
2036	return 0;
2037}
2038
2039/* set of macros to handle unaligned little endian data in firmware image */
2040#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
2041#define GETLE16(p) ((p)[0] | (p)[1] << 8)
2042static int
2043ipw_load_firmware(struct ipw_softc *sc, const char *fw, int size)
2044{
2045	const uint8_t *p, *end;
2046	uint32_t tmp, dst;
2047	uint16_t len;
2048	int error;
2049
2050	p = fw;
2051	end = fw + size;
2052	while (p < end) {
2053		dst = GETLE32(p); p += 4;
2054		len = GETLE16(p); p += 2;
2055
2056		ipw_write_mem_1(sc, dst, p, len);
2057		p += len;
2058	}
2059
2060	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
2061	    IPW_IO_LED_OFF);
2062
2063	/* enable interrupts */
2064	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
2065
2066	/* kick the firmware */
2067	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
2068
2069	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
2070	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_ALLOW_STANDBY);
2071
2072	/* wait at most one second for firmware initialization to complete */
2073	if ((error = msleep(sc, &sc->sc_mtx, 0, "ipwinit", hz)) != 0) {
2074		device_printf(sc->sc_dev, "timeout waiting for firmware "
2075		    "initialization to complete\n");
2076		return error;
2077	}
2078
2079	tmp = CSR_READ_4(sc, IPW_CSR_IO);
2080	CSR_WRITE_4(sc, IPW_CSR_IO, tmp | IPW_IO_GPIO1_MASK |
2081	    IPW_IO_GPIO3_MASK);
2082
2083	return 0;
2084}
2085
2086static int
2087ipw_setwepkeys(struct ipw_softc *sc)
2088{
2089	struct ifnet *ifp = sc->sc_ifp;
2090	struct ieee80211com *ic = ifp->if_l2com;
2091	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2092	struct ipw_wep_key wepkey;
2093	struct ieee80211_key *wk;
2094	int error, i;
2095
2096	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2097		wk = &vap->iv_nw_keys[i];
2098
2099		if (wk->wk_cipher == NULL ||
2100		    wk->wk_cipher->ic_cipher != IEEE80211_CIPHER_WEP)
2101			continue;
2102
2103		wepkey.idx = i;
2104		wepkey.len = wk->wk_keylen;
2105		memset(wepkey.key, 0, sizeof wepkey.key);
2106		memcpy(wepkey.key, wk->wk_key, wk->wk_keylen);
2107		DPRINTF(("Setting wep key index %u len %u\n", wepkey.idx,
2108		    wepkey.len));
2109		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
2110		    sizeof wepkey);
2111		if (error != 0)
2112			return error;
2113	}
2114	return 0;
2115}
2116
2117static int
2118ipw_setwpaie(struct ipw_softc *sc, const void *ie, int ielen)
2119{
2120	struct ipw_wpa_ie wpaie;
2121
2122	memset(&wpaie, 0, sizeof(wpaie));
2123	wpaie.len = htole32(ielen);
2124	/* XXX verify length */
2125	memcpy(&wpaie.ie, ie, ielen);
2126	DPRINTF(("Setting WPA IE\n"));
2127	return ipw_cmd(sc, IPW_CMD_SET_WPA_IE, &wpaie, sizeof(wpaie));
2128}
2129
2130static int
2131ipw_setbssid(struct ipw_softc *sc, uint8_t *bssid)
2132{
2133	static const uint8_t zerobssid[IEEE80211_ADDR_LEN];
2134
2135	if (bssid == NULL || bcmp(bssid, zerobssid, IEEE80211_ADDR_LEN) == 0) {
2136		DPRINTF(("Setting mandatory BSSID to null\n"));
2137		return ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
2138	} else {
2139		DPRINTF(("Setting mandatory BSSID to %6D\n", bssid, ":"));
2140		return ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID,
2141			bssid, IEEE80211_ADDR_LEN);
2142	}
2143}
2144
2145static int
2146ipw_setssid(struct ipw_softc *sc, void *ssid, size_t ssidlen)
2147{
2148	if (ssidlen == 0) {
2149		/*
2150		 * A bug in the firmware breaks the ``don't associate''
2151		 * bit in the scan options command.  To compensate for
2152		 * this install a bogus ssid when no ssid is specified
2153		 * so the firmware won't try to associate.
2154		 */
2155		DPRINTF(("Setting bogus ESSID to WAR firmware bug\n"));
2156		return ipw_cmd(sc, IPW_CMD_SET_ESSID,
2157			"\x18\x19\x20\x21\x22\x23\x24\x25\x26\x27"
2158			"\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31"
2159			"\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b"
2160			"\x3c\x3d", IEEE80211_NWID_LEN);
2161	} else {
2162#ifdef IPW_DEBUG
2163		if (ipw_debug > 0) {
2164			printf("Setting ESSID to ");
2165			ieee80211_print_essid(ssid, ssidlen);
2166			printf("\n");
2167		}
2168#endif
2169		return ipw_cmd(sc, IPW_CMD_SET_ESSID, ssid, ssidlen);
2170	}
2171}
2172
2173static int
2174ipw_setscanopts(struct ipw_softc *sc, uint32_t chanmask, uint32_t flags)
2175{
2176	struct ipw_scan_options opts;
2177
2178	DPRINTF(("Scan options: mask 0x%x flags 0x%x\n", chanmask, flags));
2179	opts.channels = htole32(chanmask);
2180	opts.flags = htole32(flags);
2181	return ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &opts, sizeof(opts));
2182}
2183
2184/*
2185 * Handler for sc_scan_task.  This is a simple wrapper around ipw_scan().
2186 */
2187static void
2188ipw_scan_task(void *context, int pending)
2189{
2190	struct ipw_softc *sc = context;
2191	IPW_LOCK_DECL;
2192
2193	IPW_LOCK(sc);
2194	ipw_scan(sc);
2195	IPW_UNLOCK(sc);
2196}
2197
2198static int
2199ipw_scan(struct ipw_softc *sc)
2200{
2201	uint32_t params;
2202	int error;
2203
2204	DPRINTF(("%s: flags 0x%x\n", __func__, sc->flags));
2205
2206	if (sc->flags & IPW_FLAG_SCANNING)
2207		return (EBUSY);
2208	sc->flags |= IPW_FLAG_SCANNING | IPW_FLAG_HACK;
2209
2210	/* NB: IPW_SCAN_DO_NOT_ASSOCIATE does not work (we set it anyway) */
2211	error = ipw_setscanopts(sc, 0x3fff, IPW_SCAN_DO_NOT_ASSOCIATE);
2212	if (error != 0)
2213		goto done;
2214
2215	/*
2216	 * Setup null/bogus ssid so firmware doesn't use any previous
2217	 * ssid to try and associate.  This is because the ``don't
2218	 * associate'' option bit is broken (sigh).
2219	 */
2220	error = ipw_setssid(sc, NULL, 0);
2221	if (error != 0)
2222		goto done;
2223
2224	/*
2225	 * NB: the adapter may be disabled on association lost;
2226	 *     if so just re-enable it to kick off scanning.
2227	 */
2228	DPRINTF(("Starting scan\n"));
2229	sc->sc_scan_timer = 3;
2230	if (sc->flags & IPW_FLAG_ENABLED) {
2231		params = 0;				/* XXX? */
2232		error = ipw_cmd(sc, IPW_CMD_BROADCAST_SCAN,
2233				&params, sizeof(params));
2234	} else
2235		error = ipw_enable(sc);
2236done:
2237	if (error != 0) {
2238		DPRINTF(("Scan failed\n"));
2239		sc->flags &= ~(IPW_FLAG_SCANNING | IPW_FLAG_HACK);
2240	}
2241	return (error);
2242}
2243
2244static int
2245ipw_setchannel(struct ipw_softc *sc, struct ieee80211_channel *chan)
2246{
2247	struct ifnet *ifp = sc->sc_ifp;
2248	struct ieee80211com *ic = ifp->if_l2com;
2249	uint32_t data;
2250	int error;
2251
2252	data = htole32(ieee80211_chan2ieee(ic, chan));
2253	DPRINTF(("Setting channel to %u\n", le32toh(data)));
2254	error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
2255	if (error == 0)
2256		ipw_setcurchan(sc, chan);
2257	return error;
2258}
2259
2260static void
2261ipw_assoc_task(void *context, int pending)
2262{
2263	struct ieee80211vap *vap = context;
2264	struct ifnet *ifp = vap->iv_ic->ic_ifp;
2265	struct ieee80211com *ic = ifp->if_l2com;
2266	struct ipw_softc *sc = ifp->if_softc;
2267	struct ieee80211_node *ni = vap->iv_bss;
2268	struct ipw_security security;
2269	uint32_t data;
2270	int error;
2271	IPW_LOCK_DECL;
2272
2273	IPW_LOCK(sc);
2274	error = ipw_disable(sc);
2275	if (error != 0)
2276		goto done;
2277
2278	memset(&security, 0, sizeof security);
2279	security.authmode = (ni->ni_authmode == IEEE80211_AUTH_SHARED) ?
2280	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
2281	security.ciphers = htole32(IPW_CIPHER_NONE);
2282	DPRINTF(("Setting authmode to %u\n", security.authmode));
2283	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFO, &security,
2284	    sizeof security);
2285	if (error != 0)
2286		goto done;
2287
2288	data = htole32(vap->iv_rtsthreshold);
2289	DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
2290	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
2291	if (error != 0)
2292		goto done;
2293
2294	data = htole32(vap->iv_fragthreshold);
2295	DPRINTF(("Setting frag threshold to %u\n", le32toh(data)));
2296	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
2297	if (error != 0)
2298		goto done;
2299
2300	if (vap->iv_flags & IEEE80211_F_PRIVACY) {
2301		error = ipw_setwepkeys(sc);
2302		if (error != 0)
2303			goto done;
2304
2305		if (vap->iv_def_txkey != IEEE80211_KEYIX_NONE) {
2306			data = htole32(vap->iv_def_txkey);
2307			DPRINTF(("Setting wep tx key index to %u\n",
2308				le32toh(data)));
2309			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
2310			    sizeof data);
2311			if (error != 0)
2312				goto done;
2313		}
2314	}
2315
2316	data = htole32((vap->iv_flags & IEEE80211_F_PRIVACY) ? IPW_WEPON : 0);
2317	DPRINTF(("Setting wep flags to 0x%x\n", le32toh(data)));
2318	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
2319	if (error != 0)
2320		goto done;
2321
2322	error = ipw_setssid(sc, ni->ni_essid, ni->ni_esslen);
2323	if (error != 0)
2324		goto done;
2325
2326	error = ipw_setbssid(sc, ni->ni_bssid);
2327	if (error != 0)
2328		goto done;
2329
2330	if (vap->iv_appie_assocreq != NULL) {
2331		struct ieee80211_appie *ie = vap->iv_appie_assocreq;
2332		error = ipw_setwpaie(sc, ie->ie_data, ie->ie_len);
2333		if (error != 0)
2334			goto done;
2335	}
2336	if (ic->ic_opmode == IEEE80211_M_IBSS) {
2337		error = ipw_setchannel(sc, ni->ni_chan);
2338		if (error != 0)
2339			goto done;
2340	}
2341
2342	/* lock scan to ap's channel and enable associate */
2343	error = ipw_setscanopts(sc,
2344	    1<<(ieee80211_chan2ieee(ic, ni->ni_chan)-1), 0);
2345	if (error != 0)
2346		goto done;
2347
2348	error = ipw_enable(sc);		/* finally, enable adapter */
2349	if (error == 0)
2350		sc->flags |= IPW_FLAG_ASSOCIATING;
2351done:
2352	IPW_UNLOCK(sc);
2353}
2354
2355static void
2356ipw_disassoc_task(void *context, int pending)
2357{
2358	struct ieee80211vap *vap = context;
2359	struct ifnet *ifp = vap->iv_ic->ic_ifp;
2360	struct ieee80211_node *ni = vap->iv_bss;
2361	struct ipw_softc *sc = ifp->if_softc;
2362	IPW_LOCK_DECL;
2363
2364	IPW_LOCK(sc);
2365	DPRINTF(("Disassociate from %6D\n", ni->ni_bssid, ":"));
2366	/*
2367	 * NB: don't try to do this if ipw_stop_master has
2368	 *     shutdown the firmware and disabled interrupts.
2369	 */
2370	if (sc->flags & IPW_FLAG_FW_INITED) {
2371		sc->flags &= ~IPW_FLAG_ASSOCIATED;
2372		/*
2373		 * NB: firmware currently ignores bssid parameter, but
2374		 *     supply it in case this changes (follow linux driver).
2375		 */
2376		(void) ipw_cmd(sc, IPW_CMD_DISASSOCIATE,
2377			ni->ni_bssid, IEEE80211_ADDR_LEN);
2378	}
2379	IPW_UNLOCK(sc);
2380}
2381
2382/*
2383 * Handler for sc_init_task.  This is a simple wrapper around ipw_init().
2384 * It is called on firmware panics or on watchdog timeouts.
2385 */
2386static void
2387ipw_init_task(void *context, int pending)
2388{
2389	ipw_init(context);
2390}
2391
2392static void
2393ipw_init(void *priv)
2394{
2395	struct ipw_softc *sc = priv;
2396	struct ifnet *ifp = sc->sc_ifp;
2397	struct ieee80211com *ic = ifp->if_l2com;
2398	IPW_LOCK_DECL;
2399
2400	IPW_LOCK(sc);
2401	ipw_init_locked(sc);
2402	IPW_UNLOCK(sc);
2403
2404	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2405		ieee80211_start_all(ic);		/* start all vap's */
2406}
2407
2408static void
2409ipw_init_locked(struct ipw_softc *sc)
2410{
2411	struct ifnet *ifp = sc->sc_ifp;
2412	struct ieee80211com *ic = ifp->if_l2com;
2413	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2414	const struct firmware *fp;
2415	const struct ipw_firmware_hdr *hdr;
2416	const char *fw;
2417
2418	IPW_LOCK_ASSERT(sc);
2419
2420	DPRINTF(("%s: state %s flags 0x%x\n", __func__,
2421		ieee80211_state_name[vap->iv_state], sc->flags));
2422
2423	/*
2424	 * Avoid re-entrant calls.  We need to release the mutex in ipw_init()
2425	 * when loading the firmware and we don't want to be called during this
2426	 * operation.
2427	 */
2428	if (sc->flags & IPW_FLAG_INIT_LOCKED)
2429		return;
2430	sc->flags |= IPW_FLAG_INIT_LOCKED;
2431
2432	ipw_stop_locked(sc);
2433
2434	if (ipw_reset(sc) != 0) {
2435		device_printf(sc->sc_dev, "could not reset adapter\n");
2436		goto fail;
2437	}
2438
2439	if (sc->sc_firmware == NULL) {
2440		device_printf(sc->sc_dev, "no firmware\n");
2441		goto fail;
2442	}
2443	/* NB: consistency already checked on load */
2444	fp = sc->sc_firmware;
2445	hdr = (const struct ipw_firmware_hdr *)fp->data;
2446
2447	DPRINTF(("Loading firmware image '%s'\n", fp->name));
2448	fw = (const char *)fp->data + sizeof *hdr + le32toh(hdr->mainsz);
2449	if (ipw_load_ucode(sc, fw, le32toh(hdr->ucodesz)) != 0) {
2450		device_printf(sc->sc_dev, "could not load microcode\n");
2451		goto fail;
2452	}
2453
2454	ipw_stop_master(sc);
2455
2456	/*
2457	 * Setup tx, rx and status rings.
2458	 */
2459	sc->txold = IPW_NTBD - 1;
2460	sc->txcur = 0;
2461	sc->txfree = IPW_NTBD - 2;
2462	sc->rxcur = IPW_NRBD - 1;
2463
2464	CSR_WRITE_4(sc, IPW_CSR_TX_BASE,  sc->tbd_phys);
2465	CSR_WRITE_4(sc, IPW_CSR_TX_SIZE,  IPW_NTBD);
2466	CSR_WRITE_4(sc, IPW_CSR_TX_READ,  0);
2467	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE, sc->txcur);
2468
2469	CSR_WRITE_4(sc, IPW_CSR_RX_BASE,  sc->rbd_phys);
2470	CSR_WRITE_4(sc, IPW_CSR_RX_SIZE,  IPW_NRBD);
2471	CSR_WRITE_4(sc, IPW_CSR_RX_READ,  0);
2472	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE, sc->rxcur);
2473
2474	CSR_WRITE_4(sc, IPW_CSR_STATUS_BASE, sc->status_phys);
2475
2476	fw = (const char *)fp->data + sizeof *hdr;
2477	if (ipw_load_firmware(sc, fw, le32toh(hdr->mainsz)) != 0) {
2478		device_printf(sc->sc_dev, "could not load firmware\n");
2479		goto fail;
2480	}
2481
2482	sc->flags |= IPW_FLAG_FW_INITED;
2483
2484	/* retrieve information tables base addresses */
2485	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2486	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2487
2488	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2489
2490	if (ipw_config(sc) != 0) {
2491		device_printf(sc->sc_dev, "device configuration failed\n");
2492		goto fail;
2493	}
2494
2495	callout_reset(&sc->sc_wdtimer, hz, ipw_watchdog, sc);
2496	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2497	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2498
2499	sc->flags &=~ IPW_FLAG_INIT_LOCKED;
2500	return;
2501
2502fail:
2503	ipw_stop_locked(sc);
2504	sc->flags &=~ IPW_FLAG_INIT_LOCKED;
2505}
2506
2507static int
2508ipw_config(struct ipw_softc *sc)
2509{
2510	struct ifnet *ifp = sc->sc_ifp;
2511	struct ieee80211com *ic = ifp->if_l2com;
2512	struct ipw_configuration config;
2513	uint32_t data;
2514	int error;
2515
2516	error = ipw_disable(sc);
2517	if (error != 0)
2518		return error;
2519
2520	switch (ic->ic_opmode) {
2521	case IEEE80211_M_STA:
2522	case IEEE80211_M_HOSTAP:
2523	case IEEE80211_M_WDS:		/* XXX */
2524		data = htole32(IPW_MODE_BSS);
2525		break;
2526	case IEEE80211_M_IBSS:
2527	case IEEE80211_M_AHDEMO:
2528		data = htole32(IPW_MODE_IBSS);
2529		break;
2530	case IEEE80211_M_MONITOR:
2531		data = htole32(IPW_MODE_MONITOR);
2532		break;
2533	}
2534	DPRINTF(("Setting mode to %u\n", le32toh(data)));
2535	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
2536	if (error != 0)
2537		return error;
2538
2539	if (ic->ic_opmode == IEEE80211_M_IBSS ||
2540	    ic->ic_opmode == IEEE80211_M_MONITOR) {
2541		error = ipw_setchannel(sc, ic->ic_curchan);
2542		if (error != 0)
2543			return error;
2544	}
2545
2546	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2547		return ipw_enable(sc);
2548
2549	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
2550	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
2551	if (ic->ic_opmode == IEEE80211_M_IBSS)
2552		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
2553	if (ifp->if_flags & IFF_PROMISC)
2554		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
2555	config.bss_chan = htole32(0x3fff); /* channels 1-14 */
2556	config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
2557	DPRINTF(("Setting configuration to 0x%x\n", le32toh(config.flags)));
2558	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
2559	if (error != 0)
2560		return error;
2561
2562	data = htole32(0x3); /* 1, 2 */
2563	DPRINTF(("Setting basic tx rates to 0x%x\n", le32toh(data)));
2564	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
2565	if (error != 0)
2566		return error;
2567
2568	/* NB: use the same rate set */
2569	DPRINTF(("Setting msdu tx rates to 0x%x\n", le32toh(data)));
2570	error = ipw_cmd(sc, IPW_CMD_SET_MSDU_TX_RATES, &data, sizeof data);
2571	if (error != 0)
2572		return error;
2573
2574	data = htole32(0xf); /* 1, 2, 5.5, 11 */
2575	DPRINTF(("Setting tx rates to 0x%x\n", le32toh(data)));
2576	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
2577	if (error != 0)
2578		return error;
2579
2580	data = htole32(IPW_POWER_MODE_CAM);
2581	DPRINTF(("Setting power mode to %u\n", le32toh(data)));
2582	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
2583	if (error != 0)
2584		return error;
2585
2586	if (ic->ic_opmode == IEEE80211_M_IBSS) {
2587		data = htole32(32); /* default value */
2588		DPRINTF(("Setting tx power index to %u\n", le32toh(data)));
2589		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
2590		    sizeof data);
2591		if (error != 0)
2592			return error;
2593	}
2594
2595	return 0;
2596}
2597
2598static void
2599ipw_stop(void *priv)
2600{
2601	struct ipw_softc *sc = priv;
2602	IPW_LOCK_DECL;
2603
2604	IPW_LOCK(sc);
2605	ipw_stop_locked(sc);
2606	IPW_UNLOCK(sc);
2607}
2608
2609static void
2610ipw_stop_locked(struct ipw_softc *sc)
2611{
2612	struct ifnet *ifp = sc->sc_ifp;
2613	int i;
2614
2615	IPW_LOCK_ASSERT(sc);
2616
2617	callout_stop(&sc->sc_wdtimer);
2618	ipw_stop_master(sc);
2619
2620	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2621
2622	/*
2623	 * Release tx buffers.
2624	 */
2625	for (i = 0; i < IPW_NTBD; i++)
2626		ipw_release_sbd(sc, &sc->stbd_list[i]);
2627
2628	sc->sc_tx_timer = 0;
2629	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2630}
2631
2632static int
2633ipw_sysctl_stats(SYSCTL_HANDLER_ARGS)
2634{
2635	struct ipw_softc *sc = arg1;
2636	uint32_t i, size, buf[256];
2637
2638	memset(buf, 0, sizeof buf);
2639
2640	if (!(sc->flags & IPW_FLAG_FW_INITED))
2641		return SYSCTL_OUT(req, buf, sizeof buf);
2642
2643	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
2644
2645	size = min(CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA), 256);
2646	for (i = 1; i < size; i++)
2647		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
2648
2649	return SYSCTL_OUT(req, buf, size);
2650}
2651
2652static int
2653ipw_sysctl_radio(SYSCTL_HANDLER_ARGS)
2654{
2655	struct ipw_softc *sc = arg1;
2656	int val;
2657
2658	val = !((sc->flags & IPW_FLAG_HAS_RADIO_SWITCH) &&
2659	        (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED));
2660
2661	return SYSCTL_OUT(req, &val, sizeof val);
2662}
2663
2664static uint32_t
2665ipw_read_table1(struct ipw_softc *sc, uint32_t off)
2666{
2667	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
2668}
2669
2670static void
2671ipw_write_table1(struct ipw_softc *sc, uint32_t off, uint32_t info)
2672{
2673	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
2674}
2675
2676#if 0
2677static int
2678ipw_read_table2(struct ipw_softc *sc, uint32_t off, void *buf, uint32_t *len)
2679{
2680	uint32_t addr, info;
2681	uint16_t count, size;
2682	uint32_t total;
2683
2684	/* addr[4] + count[2] + size[2] */
2685	addr = MEM_READ_4(sc, sc->table2_base + off);
2686	info = MEM_READ_4(sc, sc->table2_base + off + 4);
2687
2688	count = info >> 16;
2689	size = info & 0xffff;
2690	total = count * size;
2691
2692	if (total > *len) {
2693		*len = total;
2694		return EINVAL;
2695	}
2696
2697	*len = total;
2698	ipw_read_mem_1(sc, addr, buf, total);
2699
2700	return 0;
2701}
2702
2703static void
2704ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2705    bus_size_t count)
2706{
2707	for (; count > 0; offset++, datap++, count--) {
2708		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2709		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2710	}
2711}
2712#endif
2713
2714static void
2715ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, const uint8_t *datap,
2716    bus_size_t count)
2717{
2718	for (; count > 0; offset++, datap++, count--) {
2719		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2720		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2721	}
2722}
2723
2724static void
2725ipw_scan_start(struct ieee80211com *ic)
2726{
2727	struct ifnet *ifp = ic->ic_ifp;
2728	struct ipw_softc *sc = ifp->if_softc;
2729	IPW_LOCK_DECL;
2730
2731	IPW_LOCK(sc);
2732	if (!(sc->flags & IPW_FLAG_SCANNING))
2733		taskqueue_enqueue(taskqueue_swi, &sc->sc_scan_task);
2734	IPW_UNLOCK(sc);
2735}
2736
2737static void
2738ipw_set_channel(struct ieee80211com *ic)
2739{
2740	struct ifnet *ifp = ic->ic_ifp;
2741	struct ipw_softc *sc = ifp->if_softc;
2742	IPW_LOCK_DECL;
2743
2744	IPW_LOCK(sc);
2745	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2746		ipw_disable(sc);
2747		ipw_setchannel(sc, ic->ic_curchan);
2748		ipw_enable(sc);
2749	}
2750	IPW_UNLOCK(sc);
2751}
2752
2753static void
2754ipw_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
2755{
2756	/* NB: all channels are scanned at once */
2757}
2758
2759static void
2760ipw_scan_mindwell(struct ieee80211_scan_state *ss)
2761{
2762	/* NB: don't try to abort scan; wait for firmware to finish */
2763}
2764
2765static void
2766ipw_scan_end(struct ieee80211com *ic)
2767{
2768	struct ifnet *ifp = ic->ic_ifp;
2769	struct ipw_softc *sc = ifp->if_softc;
2770	IPW_LOCK_DECL;
2771
2772	IPW_LOCK(sc);
2773	sc->flags &= ~IPW_FLAG_SCANNING;
2774	IPW_UNLOCK(sc);
2775}
2776