if_ipw.c revision 1.21
1/*	$Id: if_ipw.c,v 1.21 2004/11/03 17:10:03 damien Exp $  */
2
3/*-
4 * Copyright (c) 2004
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46
47#include <machine/bus.h>
48#include <machine/endian.h>
49#include <machine/intr.h>
50
51#include <dev/pci/pcireg.h>
52#include <dev/pci/pcivar.h>
53#include <dev/pci/pcidevs.h>
54
55#if NBPFILTER > 0
56#include <net/bpf.h>
57#endif
58#include <net/if.h>
59#include <net/if_arp.h>
60#include <net/if_dl.h>
61#include <net/if_media.h>
62#include <net/if_types.h>
63
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/in_var.h>
67#include <netinet/if_ether.h>
68#include <netinet/ip.h>
69
70#include <net80211/ieee80211_var.h>
71#include <net80211/ieee80211_radiotap.h>
72
73#include <dev/pci/if_ipwreg.h>
74#include <dev/pci/if_ipwvar.h>
75
76static const struct ieee80211_rateset ipw_rateset_11b =
77	{ 4, { 2, 4, 11, 22 } };
78
79int ipw_match(struct device *, void *, void *);
80void ipw_attach(struct device *, struct device *, void *);
81int ipw_detach(struct device *, int);
82int ipw_media_change(struct ifnet *);
83void ipw_media_status(struct ifnet *, struct ifmediareq *);
84int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
85u_int16_t ipw_read_prom_word(struct ipw_softc *, u_int8_t);
86void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
87void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
88void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
89    struct ipw_soft_bd *, struct ipw_soft_buf *);
90void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
91void ipw_rx_intr(struct ipw_softc *);
92void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
93void ipw_tx_intr(struct ipw_softc *);
94int ipw_intr(void *);
95int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
96int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
97void ipw_start(struct ifnet *);
98void ipw_watchdog(struct ifnet *);
99int ipw_get_table1(struct ipw_softc *, u_int32_t *);
100int ipw_get_radio(struct ipw_softc *, int *);
101int ipw_ioctl(struct ifnet *, u_long, caddr_t);
102u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
103void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
104int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
105int ipw_dmamem_init(struct ipw_softc *);
106void ipw_dmamem_stop(struct ipw_softc *);
107int ipw_tx_init(struct ipw_softc *);
108void ipw_tx_stop(struct ipw_softc *);
109int ipw_rx_init(struct ipw_softc *);
110void ipw_rx_stop(struct ipw_softc *);
111void ipw_stop_master(struct ipw_softc *);
112int ipw_reset(struct ipw_softc *);
113int ipw_load_ucode(struct ipw_softc *, u_char *, int);
114int ipw_load_firmware(struct ipw_softc *, u_char *, int);
115int ipw_cache_firmware(struct ipw_softc *, void *);
116void ipw_free_firmware(struct ipw_softc *);
117int ipw_config(struct ipw_softc *);
118int ipw_init(struct ifnet *);
119void ipw_stop(struct ifnet *, int);
120void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
121void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
122
123static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
124{
125	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
126	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
127}
128
129static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
130{
131	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
132	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
133}
134
135#ifdef IPW_DEBUG
136#define DPRINTF(x)	if (ipw_debug > 0) printf x
137#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
138int ipw_debug = 0;
139#else
140#define DPRINTF(x)
141#define DPRINTFN(n, x)
142#endif
143
144struct cfattach ipw_ca = {
145	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
146};
147
148int
149ipw_match(struct device *parent, void *match, void *aux)
150{
151	struct pci_attach_args *pa = aux;
152
153	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
154	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
155		return 1;
156
157	return 0;
158}
159
160/* Base Address Register */
161#define IPW_PCI_BAR0	0x10
162
163void
164ipw_attach(struct device *parent, struct device *self, void *aux)
165{
166	struct ipw_softc *sc = (struct ipw_softc *)self;
167	struct ieee80211com *ic = &sc->sc_ic;
168	struct ifnet *ifp = &ic->ic_if;
169	struct pci_attach_args *pa = aux;
170	const char *intrstr;
171	bus_space_tag_t memt;
172	bus_space_handle_t memh;
173	bus_addr_t base;
174	pci_intr_handle_t ih;
175	pcireg_t data;
176	u_int16_t val;
177	int error, i;
178
179	sc->sc_pct = pa->pa_pc;
180
181	data = pci_conf_read(sc->sc_pct, pa->pa_tag, 0x40);
182	data &= ~0x00ff0000;
183	pci_conf_write(sc->sc_pct, pa->pa_tag, 0x40, data);
184
185	/* enable bus-mastering */
186	data = pci_conf_read(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG);
187	data |= PCI_COMMAND_MASTER_ENABLE;
188	pci_conf_write(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG, data);
189
190	/* map the register window */
191	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
192	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
193	if (error != 0) {
194		printf(": could not map memory space\n");
195		return;
196	}
197
198	sc->sc_st = memt;
199	sc->sc_sh = memh;
200	sc->sc_dmat = pa->pa_dmat;
201
202	/* disable interrupts */
203	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
204
205	if (pci_intr_map(pa, &ih) != 0) {
206		printf(": could not map interrupt\n");
207		return;
208	}
209
210	intrstr = pci_intr_string(sc->sc_pct, ih);
211	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
212	    sc->sc_dev.dv_xname);
213	if (sc->sc_ih == NULL) {
214		printf(": could not establish interrupt");
215		if (intrstr != NULL)
216			printf(" at %s", intrstr);
217		printf("\n");
218		return;
219	}
220	printf(": %s", intrstr);
221
222	if (ipw_reset(sc) != 0) {
223		printf(": could not reset adapter\n");
224		return;
225	}
226
227	/* set up dma memory */
228	if (ipw_dmamem_init(sc) != 0) {
229		printf(": failed to initialize DMA memory\n");
230		return;
231	}
232
233	ic->ic_phytype = IEEE80211_T_DS;
234	ic->ic_opmode = IEEE80211_M_STA;
235	ic->ic_state = IEEE80211_S_INIT;
236
237	/* set device capabilities */
238	ic->ic_caps =  IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
239	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP;
240
241	/* read MAC address from EEPROM */
242	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
243	ic->ic_myaddr[0] = val >> 8;
244	ic->ic_myaddr[1] = val & 0xff;
245	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
246	ic->ic_myaddr[2] = val >> 8;
247	ic->ic_myaddr[3] = val & 0xff;
248	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
249	ic->ic_myaddr[4] = val >> 8;
250	ic->ic_myaddr[5] = val & 0xff;
251
252	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
253
254	/* set supported .11b rates */
255	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
256
257	/* set supported .11b channels (1 through 14) */
258	for (i = 1; i <= 14; i++) {
259		ic->ic_channels[i].ic_freq =
260		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
261		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
262	}
263
264	/* default to authmode OPEN */
265	sc->authmode = IEEE80211_AUTH_OPEN;
266
267	/* IBSS channel undefined for now */
268	ic->ic_ibss_chan = &ic->ic_channels[0];
269
270	ifp->if_softc = sc;
271	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
272	ifp->if_init = ipw_init;
273	ifp->if_ioctl = ipw_ioctl;
274	ifp->if_start = ipw_start;
275	ifp->if_watchdog = ipw_watchdog;
276	IFQ_SET_READY(&ifp->if_snd);
277	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
278
279	if_attach(ifp);
280	ieee80211_ifattach(ifp);
281	/* override state transition machine */
282	sc->sc_newstate = ic->ic_newstate;
283	ic->ic_newstate = ipw_newstate;
284	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
285
286#if NBPFILTER > 0
287	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
288	    sizeof (struct ieee80211_frame) + 64);
289
290	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
291	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
292	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
293
294	sc->sc_txtap_len = sizeof sc->sc_txtapu;
295	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
296	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
297#endif
298}
299
300int
301ipw_detach(struct device* self, int flags)
302{
303	struct ipw_softc *sc = (struct ipw_softc *)self;
304	struct ifnet *ifp = &sc->sc_ic.ic_if;
305
306	ipw_stop(ifp, 1);
307	ipw_dmamem_stop(sc);
308	ipw_free_firmware(sc);
309
310#if NBPFILTER > 0
311	bpfdetach(ifp);
312#endif
313	ieee80211_ifdetach(ifp);
314	if_detach(ifp);
315
316	if (sc->sc_ih != NULL) {
317		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
318		sc->sc_ih = NULL;
319	}
320
321	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
322
323	return 0;
324}
325
326int
327ipw_media_change(struct ifnet *ifp)
328{
329	int error;
330
331	error = ieee80211_media_change(ifp);
332	if (error != ENETRESET)
333		return error;
334
335	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
336		ipw_init(ifp);
337
338	return 0;
339}
340
341void
342ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
343{
344	struct ipw_softc *sc = ifp->if_softc;
345	struct ieee80211com *ic = &sc->sc_ic;
346#define N(a)	(sizeof (a) / sizeof (a[0]))
347	static const struct {
348		u_int32_t	val;
349		int		rate;
350	} rates[] = {
351		{ IPW_RATE_DS1,   2 },
352		{ IPW_RATE_DS2,   4 },
353		{ IPW_RATE_DS5,  11 },
354		{ IPW_RATE_DS11, 22 },
355	};
356	u_int32_t val;
357	int rate, i;
358
359	imr->ifm_status = IFM_AVALID;
360	imr->ifm_active = IFM_IEEE80211;
361	if (ic->ic_state == IEEE80211_S_RUN)
362		imr->ifm_status |= IFM_ACTIVE;
363
364	/* read current transmission rate from adapter */
365	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
366	val &= 0xf;
367
368	/* convert rate to 802.11 rate */
369	for (i = 0; i < N(rates) && rates[i].val != val; i++);
370	rate = (i < N(rates)) ? rates[i].rate : 0;
371
372	imr->ifm_active |= IFM_IEEE80211_11B;
373	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
374	switch (ic->ic_opmode) {
375	case IEEE80211_M_STA:
376		break;
377
378	case IEEE80211_M_IBSS:
379		imr->ifm_active |= IFM_IEEE80211_ADHOC;
380		break;
381
382	case IEEE80211_M_MONITOR:
383		imr->ifm_active |= IFM_IEEE80211_MONITOR;
384		break;
385
386	case IEEE80211_M_AHDEMO:
387	case IEEE80211_M_HOSTAP:
388		/* should not get there */
389		break;
390	}
391#undef N
392}
393
394int
395ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
396{
397	struct ipw_softc *sc = ic->ic_softc;
398	struct ieee80211_node *ni = ic->ic_bss;
399	u_int32_t val, len;
400
401	switch (nstate) {
402	case IEEE80211_S_RUN:
403		len = IEEE80211_NWID_LEN;
404		ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
405		ni->ni_esslen = len;
406
407		val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
408		ni->ni_chan = &ic->ic_channels[val];
409
410		DELAY(100); /* firmware needs a short delay here */
411
412		len = IEEE80211_ADDR_LEN;
413		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
414		break;
415
416	case IEEE80211_S_INIT:
417	case IEEE80211_S_SCAN:
418	case IEEE80211_S_AUTH:
419	case IEEE80211_S_ASSOC:
420		break;
421	}
422
423	ic->ic_state = nstate;
424	return 0;
425}
426
427/*
428 * Read 16 bits at address 'addr' from the Microwire EEPROM.
429 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
430 */
431u_int16_t
432ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
433{
434	u_int32_t tmp;
435	u_int16_t val;
436	int n;
437
438	/* Clock C once before the first command */
439	IPW_EEPROM_CTL(sc, 0);
440	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
441	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
442	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
443
444	/* Write start bit (1) */
445	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
446	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
447
448	/* Write READ opcode (10) */
449	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
450	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
451	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
452	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
453
454	/* Write address A7-A0 */
455	for (n = 7; n >= 0; n--) {
456		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
457		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
458		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
459		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
460	}
461
462	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
463
464	/* Read data Q15-Q0 */
465	val = 0;
466	for (n = 15; n >= 0; n--) {
467		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
468		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
469		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
470		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
471	}
472
473	IPW_EEPROM_CTL(sc, 0);
474
475	/* Clear Chip Select and clock C */
476	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
477	IPW_EEPROM_CTL(sc, 0);
478	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
479
480	return letoh16(val);
481}
482
483void
484ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
485{
486	struct ipw_cmd *cmd;
487
488	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
489	    BUS_DMASYNC_POSTREAD);
490
491	cmd = mtod(sbuf->m, struct ipw_cmd *);
492
493	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
494	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
495	    letoh32(cmd->len), letoh32(cmd->status)));
496
497	wakeup(sc);
498}
499
500void
501ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
502{
503	struct ieee80211com *ic = &sc->sc_ic;
504	u_int32_t state;
505
506	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
507	    BUS_DMASYNC_POSTREAD);
508
509	state = letoh32(*mtod(sbuf->m, u_int32_t *));
510
511	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
512
513	switch (state) {
514	case IPW_STATE_ASSOCIATED:
515		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
516		break;
517
518	case IPW_STATE_SCANNING:
519		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
520		break;
521
522	case IPW_STATE_ASSOCIATION_LOST:
523		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
524		break;
525
526	case IPW_STATE_RADIO_DISABLED:
527		/* XXX should turn the interface down */
528		break;
529	}
530}
531
532void
533ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
534    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
535{
536	struct ieee80211com *ic = &sc->sc_ic;
537	struct ifnet *ifp = &ic->ic_if;
538	struct mbuf *m;
539	struct ieee80211_frame *wh;
540	struct ieee80211_node *ni;
541	int error;
542
543	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
544
545	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
546	    BUS_DMASYNC_POSTREAD);
547
548	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
549
550	/* Finalize mbuf */
551	m = sbuf->m;
552	m->m_pkthdr.rcvif = ifp;
553	m->m_pkthdr.len = m->m_len = letoh32(status->len);
554
555#if NBPFILTER > 0
556	if (sc->sc_drvbpf != NULL) {
557		struct mbuf mb;
558		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
559
560		tap->wr_flags = 0;
561		tap->wr_antsignal = status->rssi;
562		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
563		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
564
565		M_DUP_PKTHDR(&mb, m);
566		mb.m_data = (caddr_t)tap;
567		mb.m_len = sc->sc_rxtap_len;
568		mb.m_next = m;
569		mb.m_pkthdr.len += mb.m_len;
570		bpf_mtap(sc->sc_drvbpf, &mb);
571	}
572#endif
573
574	wh = mtod(m, struct ieee80211_frame *);
575
576	ni = ieee80211_find_rxnode(ic, wh);
577
578	/* Send it up to the upper layer */
579	ieee80211_input(ifp, m, ni, status->rssi, 0);
580
581	if (ni == ic->ic_bss)
582		ieee80211_unref_node(&ni);
583	else
584		ieee80211_free_node(ic, ni);
585
586	MGETHDR(m, M_DONTWAIT, MT_DATA);
587	if (m == NULL) {
588		printf("%s: could not allocate rx mbuf\n",
589		    sc->sc_dev.dv_xname);
590		return;
591	}
592	MCLGET(m, M_DONTWAIT);
593	if (!(m->m_flags & M_EXT)) {
594		m_freem(m);
595		printf("%s: could not allocate rx mbuf cluster\n",
596		    sc->sc_dev.dv_xname);
597		return;
598	}
599
600	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
601	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
602	if (error != 0) {
603		printf("%s: could not map rxbuf dma memory\n",
604		    sc->sc_dev.dv_xname);
605		m_freem(m);
606		return;
607	}
608
609	sbuf->m = m;
610	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
611}
612
613void
614ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
615{
616	DPRINTFN(2, ("RX!NOTIFICATION\n"));
617}
618
619void
620ipw_rx_intr(struct ipw_softc *sc)
621{
622	struct ipw_status *status;
623	struct ipw_soft_bd *sbd;
624	struct ipw_soft_buf *sbuf;
625	u_int32_t r, i;
626
627	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
628
629	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
630
631		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
632		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
633		    BUS_DMASYNC_POSTREAD);
634
635		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
636		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
637		    BUS_DMASYNC_POSTREAD);
638
639		status = &sc->status_list[i];
640		sbd = &sc->srbd_list[i];
641		sbuf = sbd->priv;
642
643		switch (letoh16(status->code) & 0xf) {
644		case IPW_STATUS_CODE_COMMAND:
645			ipw_command_intr(sc, sbuf);
646			break;
647
648		case IPW_STATUS_CODE_NEWSTATE:
649			ipw_newstate_intr(sc, sbuf);
650			break;
651
652		case IPW_STATUS_CODE_DATA_802_3:
653		case IPW_STATUS_CODE_DATA_802_11:
654			ipw_data_intr(sc, status, sbd, sbuf);
655			break;
656
657		case IPW_STATUS_CODE_NOTIFICATION:
658			ipw_notification_intr(sc, sbuf);
659			break;
660
661		default:
662			printf("%s: unknown status code %u\n",
663			    sc->sc_dev.dv_xname, letoh16(status->code));
664		}
665		sbd->bd->flags = 0;
666
667		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
668		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
669		    BUS_DMASYNC_PREWRITE);
670	}
671
672	/* Tell the firmware what we have processed */
673	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
674	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
675}
676
677void
678ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
679{
680	struct ieee80211com *ic;
681	struct ipw_soft_hdr *shdr;
682	struct ipw_soft_buf *sbuf;
683
684	switch (sbd->type) {
685	case IPW_SBD_TYPE_COMMAND:
686		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
687		break;
688
689	case IPW_SBD_TYPE_HEADER:
690		shdr = sbd->priv;
691		bus_dmamap_unload(sc->sc_dmat, shdr->map);
692		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
693		break;
694
695	case IPW_SBD_TYPE_DATA:
696		ic = &sc->sc_ic;
697		sbuf = sbd->priv;
698		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
699		m_freem(sbuf->m);
700		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
701			ieee80211_free_node(ic, sbuf->ni);
702		/* kill watchdog timer */
703		sc->sc_tx_timer = 0;
704		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
705		break;
706	}
707	sbd->type = IPW_SBD_TYPE_NOASSOC;
708}
709
710void
711ipw_tx_intr(struct ipw_softc *sc)
712{
713	struct ifnet *ifp = &sc->sc_ic.ic_if;
714	u_int32_t r, i;
715
716	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
717
718	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD)
719		ipw_release_sbd(sc, &sc->stbd_list[i]);
720
721	/* Remember what the firmware has processed */
722	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
723
724	/* Call start() since some buffer descriptors have been released */
725	ifp->if_flags &= ~IFF_OACTIVE;
726	(*ifp->if_start)(ifp);
727}
728
729int
730ipw_intr(void *arg)
731{
732	struct ipw_softc *sc = arg;
733	u_int32_t r;
734
735	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0)
736		return 0;
737
738	/* Disable interrupts */
739	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
740
741	DPRINTFN(8, ("INTR!0x%08x\n", r));
742
743	if (r & IPW_INTR_RX_TRANSFER)
744		ipw_rx_intr(sc);
745
746	if (r & IPW_INTR_TX_TRANSFER)
747		ipw_tx_intr(sc);
748
749	if (r & IPW_INTR_FW_INIT_DONE) {
750		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
751			wakeup(sc);
752	}
753
754	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
755		printf("%s: fatal error\n", sc->sc_dev.dv_xname);
756		ipw_stop(&sc->sc_ic.ic_if, 1);
757	}
758
759	/* Acknowledge interrupts */
760	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
761
762	/* Re-enable interrupts */
763	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
764
765	return 0;
766}
767
768int
769ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
770{
771	struct ipw_soft_bd *sbd;
772	int error;
773
774	sbd = &sc->stbd_list[sc->txcur];
775
776	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, sc->cmd,
777	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
778	if (error != 0) {
779		printf("%s: could not map cmd dma memory\n",
780		    sc->sc_dev.dv_xname);
781		return error;
782	}
783
784	sc->cmd->type = htole32(type);
785	sc->cmd->subtype = htole32(0);
786	sc->cmd->len = htole32(len);
787	sc->cmd->seq = htole32(0);
788	if (data != NULL)
789		bcopy(data, sc->cmd->data, len);
790
791	sbd->type = IPW_SBD_TYPE_COMMAND;
792	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
793	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
794	sbd->bd->nfrag = 1;
795	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
796			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
797
798	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
799	    BUS_DMASYNC_PREWRITE);
800
801	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
802	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
803	    BUS_DMASYNC_PREWRITE);
804
805	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
806	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
807
808	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
809
810	/* Wait at most one second for command to complete */
811	return tsleep(sc, 0, "ipwcmd", hz);
812}
813
814int
815ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
816{
817	struct ipw_softc *sc = ifp->if_softc;
818	struct ieee80211com *ic = &sc->sc_ic;
819	struct ieee80211_frame *wh;
820	struct ipw_soft_bd *sbd;
821	struct ipw_soft_hdr *shdr;
822	struct ipw_soft_buf *sbuf;
823	int error, i;
824
825	if (ic->ic_flags & IEEE80211_F_WEPON) {
826		m = ieee80211_wep_crypt(ifp, m, 1);
827		if (m == NULL)
828			return ENOBUFS;
829	}
830
831#if NBPFILTER > 0
832	if (sc->sc_drvbpf != NULL) {
833		struct mbuf mb;
834		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
835
836		tap->wt_flags = 0;
837		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
838		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
839
840		M_DUP_PKTHDR(&mb, m);
841		mb.m_data = (caddr_t)tap;
842		mb.m_len = sc->sc_txtap_len;
843		mb.m_next = m;
844		mb.m_pkthdr.len += mb.m_len;
845		bpf_mtap(sc->sc_drvbpf, &mb);
846	}
847#endif
848
849	wh = mtod(m, struct ieee80211_frame *);
850
851	shdr = TAILQ_FIRST(&sc->sc_free_shdr);
852	sbuf = TAILQ_FIRST(&sc->sc_free_sbuf);
853
854	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
855	shdr->hdr.subtype = htole32(0);
856	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
857	shdr->hdr.encrypt = 0;
858	shdr->hdr.keyidx = 0;
859	shdr->hdr.keysz = 0;
860	shdr->hdr.fragmentsz = htole16(0);
861	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
862	if (ic->ic_opmode == IEEE80211_M_STA)
863		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
864	else
865		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
866
867	/* trim IEEE802.11 header */
868	m_adj(m, sizeof (struct ieee80211_frame));
869
870	/*
871	 * We need to map the mbuf first to know how many buffer descriptors
872	 * are needed for this transfer.
873	 */
874	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
875	if (error != 0) {
876		printf("%s: could not map mbuf (error %d)\n",
877		    sc->sc_dev.dv_xname, error);
878		m_freem(m);
879		return error;
880	}
881
882	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
883	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
884	if (error != 0) {
885		printf("%s: could not map header (error %d)\n",
886		    sc->sc_dev.dv_xname, error);
887		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
888		m_freem(m);
889		return error;
890	}
891
892	TAILQ_REMOVE(&sc->sc_free_sbuf, sbuf, next);
893	TAILQ_REMOVE(&sc->sc_free_shdr, shdr, next);
894
895	sbd = &sc->stbd_list[sc->txcur];
896	sbd->type = IPW_SBD_TYPE_HEADER;
897	sbd->priv = shdr;
898	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
899	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
900	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
901	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
902			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
903
904	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
905	    shdr->hdr.encrypted, shdr->hdr.encrypt));
906	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
907	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
908
909	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
910	    sc->txcur * sizeof (struct ipw_bd),
911	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
912
913	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
914
915	sbuf->m = m;
916	sbuf->ni = ni;
917
918	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
919		sbd = &sc->stbd_list[sc->txcur];
920		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
921		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
922		sbd->bd->nfrag = 0; /* used only in first bd */
923		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
924		if (i == sbuf->map->dm_nsegs - 1) {
925			sbd->type = IPW_SBD_TYPE_DATA;
926			sbd->priv = sbuf;
927			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
928		} else {
929			sbd->type = IPW_SBD_TYPE_NOASSOC;
930			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
931		}
932
933		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
934		    sbuf->map->dm_segs[i].ds_len));
935
936		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
937		    sc->txcur * sizeof (struct ipw_bd),
938		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
939
940		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
941	}
942
943	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
944	    BUS_DMASYNC_PREWRITE);
945
946	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
947	    BUS_DMASYNC_PREWRITE);
948
949	/* Inform firmware about this new packet */
950	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
951
952	return 0;
953}
954
955void
956ipw_start(struct ifnet *ifp)
957{
958	struct ipw_softc *sc = ifp->if_softc;
959	struct ieee80211com *ic = &sc->sc_ic;
960	struct mbuf *m;
961	struct ieee80211_node *ni;
962
963	if (ic->ic_state != IEEE80211_S_RUN)
964		return;
965
966	for (;;) {
967		IF_DEQUEUE(&ifp->if_snd, m);
968		if (m == NULL)
969			break;
970
971#if NBPFILTER > 0
972		if (ifp->if_bpf != NULL)
973			bpf_mtap(ifp->if_bpf, m);
974#endif
975
976		m = ieee80211_encap(ifp, m, &ni);
977		if (m == NULL)
978			continue;
979
980#if NBPFILTER > 0
981		if (ic->ic_rawbpf != NULL)
982			bpf_mtap(ic->ic_rawbpf, m);
983#endif
984
985		if (ipw_tx_start(ifp, m, ni) != 0) {
986			if (ni != NULL && ni != ic->ic_bss)
987				ieee80211_free_node(ic, ni);
988			break;
989		}
990
991		/* start watchdog timer */
992		sc->sc_tx_timer = 5;
993		ifp->if_timer = 1;
994	}
995}
996
997void
998ipw_watchdog(struct ifnet *ifp)
999{
1000	struct ipw_softc *sc = ifp->if_softc;
1001
1002	ifp->if_timer = 0;
1003
1004	if (sc->sc_tx_timer > 0) {
1005		if (--sc->sc_tx_timer == 0) {
1006			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1007			ipw_stop(ifp, 1);
1008			return;
1009		}
1010		ifp->if_timer = 1;
1011	}
1012
1013	ieee80211_watchdog(ifp);
1014}
1015
1016int
1017ipw_get_table1(struct ipw_softc *sc, u_int32_t *tbl)
1018{
1019	u_int32_t i, size, buf[256];
1020
1021	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
1022		bzero(buf, sizeof buf);
1023		return copyout(buf, tbl, sizeof buf);
1024	}
1025
1026	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
1027
1028	size = CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA);
1029	for (i = 1; i < size; i++)
1030		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
1031
1032	return copyout(buf, tbl, size * sizeof (u_int32_t));
1033}
1034
1035int
1036ipw_get_radio(struct ipw_softc *sc, int *ret)
1037{
1038	int val;
1039
1040	val = (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ? 0 : 1;
1041	return copyout(&val, ret, sizeof val);
1042}
1043
1044int
1045ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1046{
1047	struct ipw_softc *sc = ifp->if_softc;
1048	struct ifreq *ifr;
1049	struct ifaddr *ifa;
1050	int s, error = 0;
1051
1052	s = splnet();
1053
1054	switch (cmd) {
1055	case SIOCSIFADDR:
1056		ifa = (struct ifaddr *) data;
1057		ifp->if_flags |= IFF_UP;
1058		switch (ifa->ifa_addr->sa_family) {
1059#ifdef INET
1060		case AF_INET:
1061			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
1062			ipw_init(ifp);
1063			break;
1064#endif
1065		default:
1066			ipw_init(ifp);
1067		}
1068		break;
1069
1070	case SIOCSIFFLAGS:
1071		if (ifp->if_flags & IFF_UP) {
1072			if (!(ifp->if_flags & IFF_RUNNING))
1073				ipw_init(ifp);
1074		} else {
1075			if (ifp->if_flags & IFF_RUNNING)
1076				ipw_stop(ifp, 1);
1077		}
1078		break;
1079
1080	case SIOCGTABLE1:
1081		ifr = (struct ifreq *)data;
1082		error = ipw_get_table1(sc, (u_int32_t *)ifr->ifr_data);
1083		break;
1084
1085	case SIOCGRADIO:
1086		ifr = (struct ifreq *)data;
1087		error = ipw_get_radio(sc, (int *)ifr->ifr_data);
1088		break;
1089
1090	case SIOCSLOADFW:
1091		/* only super-user can do that! */
1092		if ((error = suser(curproc, 0)) != 0)
1093			break;
1094
1095		ifr = (struct ifreq *)data;
1096		error = ipw_cache_firmware(sc, ifr->ifr_data);
1097		break;
1098
1099	case SIOCSKILLFW:
1100		/* only super-user can do that! */
1101		if ((error = suser(curproc, 0)) != 0)
1102			break;
1103
1104		ipw_stop(ifp, 1);
1105		ipw_free_firmware(sc);
1106		break;
1107
1108	case SIOCG80211AUTH:
1109		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1110		break;
1111
1112	case SIOCS80211AUTH:
1113		/* only super-user can do that! */
1114		if ((error = suser(curproc, 0)) != 0)
1115			break;
1116
1117		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1118		break;
1119
1120	default:
1121		error = ieee80211_ioctl(ifp, cmd, data);
1122	}
1123
1124	if (error == ENETRESET && cmd != SIOCADDMULTI) {
1125		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1126		    (IFF_UP | IFF_RUNNING))
1127			ipw_init(ifp);
1128		error = 0;
1129	}
1130
1131	splx(s);
1132	return error;
1133}
1134
1135u_int32_t
1136ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1137{
1138	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1139}
1140
1141void
1142ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1143{
1144	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1145}
1146
1147int
1148ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1149{
1150	u_int32_t addr, info;
1151	u_int16_t count, size;
1152	u_int32_t total;
1153
1154	/* addr[4] + count[2] + size[2] */
1155	addr = MEM_READ_4(sc, sc->table2_base + off);
1156	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1157
1158	count = info >> 16;
1159	size = info & 0xffff;
1160	total = count * size;
1161
1162	if (total > *len) {
1163		*len = total;
1164		return EINVAL;
1165	}
1166
1167	*len = total;
1168	ipw_read_mem_1(sc, addr, buf, total);
1169
1170	return 0;
1171}
1172
1173/*
1174 * Allocate and map DMAble memory.  Do not call in interrupt context.
1175 */
1176int
1177ipw_dmamem_init(struct ipw_softc *sc)
1178{
1179	int error, nsegs;
1180	char *errmsg;
1181
1182	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
1183	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1184	if (error != 0) {
1185		errmsg = "could not allocate tbd dma memory";
1186		goto fail;
1187	}
1188
1189	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
1190	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
1191	if (error != 0) {
1192		errmsg = "could not map tbd dma memory";
1193		goto fail;
1194	}
1195
1196	error = bus_dmamem_alloc(sc->sc_dmat, sizeof (struct ipw_cmd),
1197	    PAGE_SIZE, 0, &sc->cmd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1198	if (error != 0) {
1199		errmsg = "could not allocate cmd dma memory";
1200		goto fail;
1201	}
1202
1203	error = bus_dmamem_map(sc->sc_dmat, &sc->cmd_seg, nsegs,
1204	    sizeof (struct ipw_cmd), (caddr_t *)&sc->cmd, BUS_DMA_NOWAIT);
1205	if (error != 0) {
1206		errmsg = "could not map cmd dma memory";
1207		goto fail;
1208	}
1209
1210	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
1211	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1212	if (error != 0) {
1213		errmsg = "could not allocate rbd dma memory";
1214		goto fail;
1215	}
1216
1217	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
1218	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
1219	if (error != 0) {
1220		errmsg = "could not map rbd dma memory";
1221		goto fail;
1222	}
1223
1224	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
1225	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1226	if (error != 0) {
1227		errmsg = "could not allocate status dma memory";
1228		goto fail;
1229	}
1230
1231	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
1232	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
1233	if (error != 0) {
1234		errmsg = "could not map status dma memory";
1235		goto fail;
1236	}
1237
1238	return 0;
1239
1240fail:	printf("%s: %s", sc->sc_dev.dv_xname, errmsg);
1241	ipw_dmamem_stop(sc);
1242
1243	return error;
1244}
1245
1246/*
1247 * Unmap and free DMAble memory.
1248 */
1249void
1250ipw_dmamem_stop(struct ipw_softc *sc)
1251{
1252	if (sc->tbd_list != NULL) {
1253		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
1254		    IPW_TBD_SZ);
1255		bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
1256		sc->tbd_list = NULL;
1257	}
1258
1259	if (sc->cmd != NULL) {
1260		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->cmd,
1261		    sizeof (struct ipw_cmd));
1262		bus_dmamem_free(sc->sc_dmat, &sc->cmd_seg, 1);
1263		sc->cmd = NULL;
1264	}
1265
1266	if (sc->rbd_list != NULL) {
1267		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
1268		    IPW_RBD_SZ);
1269		bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
1270		sc->rbd_list = NULL;
1271	}
1272
1273	if (sc->status_list != NULL) {
1274		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
1275		    IPW_STATUS_SZ);
1276		bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
1277		sc->status_list = NULL;
1278	}
1279}
1280
1281int
1282ipw_tx_init(struct ipw_softc *sc)
1283{
1284	char *errmsg;
1285	struct ipw_bd *bd;
1286	struct ipw_soft_bd *sbd;
1287	struct ipw_soft_hdr *shdr;
1288	struct ipw_soft_buf *sbuf;
1289	int error, i;
1290
1291	/* Allocate transmission buffer descriptors */
1292	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
1293	    BUS_DMA_NOWAIT, &sc->tbd_map);
1294	if (error != 0) {
1295		errmsg = "could not create tbd dma map";
1296		goto fail;
1297	}
1298
1299	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
1300	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
1301	if (error != 0) {
1302		errmsg = "could not load tbd dma memory";
1303		goto fail;
1304	}
1305
1306	sc->stbd_list = malloc(IPW_NTBD * sizeof (struct ipw_soft_bd),
1307	    M_DEVBUF, M_NOWAIT);
1308	if (sc->stbd_list == NULL) {
1309		errmsg = "could not allocate soft tbd";
1310		error = ENOMEM;
1311		goto fail;
1312	}
1313	sbd = sc->stbd_list;
1314	bd = sc->tbd_list;
1315	for (i = 0; i < IPW_NTBD; i++, sbd++, bd++) {
1316		sbd->type = IPW_SBD_TYPE_NOASSOC;
1317		sbd->bd = bd;
1318	}
1319
1320	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1321	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1322	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1323	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1324	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1325	sc->txcur = 0; /* bd index to write to */
1326
1327	/* Allocate a DMA-able command */
1328	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
1329	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
1330	if (error != 0) {
1331		errmsg = "could not create cmd dma map";
1332		goto fail;
1333	}
1334
1335	/* Allocate a pool of DMA-able headers */
1336	sc->shdr_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_hdr),
1337	    M_DEVBUF, M_NOWAIT);
1338	if (sc->shdr_list == NULL) {
1339		errmsg = "could not allocate soft hdr";
1340		error = ENOMEM;
1341		goto fail;
1342	}
1343	TAILQ_INIT(&sc->sc_free_shdr);
1344	for (i = 0, shdr = sc->shdr_list; i < IPW_NDATA; i++, shdr++) {
1345		error = bus_dmamap_create(sc->sc_dmat,
1346		    sizeof (struct ipw_soft_hdr), 1,
1347	 	    sizeof (struct ipw_soft_hdr), 0, BUS_DMA_NOWAIT,
1348		    &shdr->map);
1349		if (error != 0) {
1350			errmsg = "could not create hdr dma map";
1351			goto fail;
1352		}
1353		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
1354	}
1355
1356	/* Allocate a pool of DMA-able buffers */
1357	sc->tx_sbuf_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_buf),
1358	    M_DEVBUF, M_NOWAIT);
1359	if (sc->tx_sbuf_list == NULL) {
1360		errmsg = "could not allocate soft txbuf";
1361		error = ENOMEM;
1362		goto fail;
1363	}
1364	TAILQ_INIT(&sc->sc_free_sbuf);
1365	for (i = 0, sbuf = sc->tx_sbuf_list; i < IPW_NDATA; i++, sbuf++) {
1366		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_NDATA,
1367		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
1368		if (error != 0) {
1369			errmsg = "could not create txbuf dma map";
1370			goto fail;
1371		}
1372		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
1373	}
1374
1375	return 0;
1376
1377fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1378	ipw_tx_stop(sc);
1379
1380	return error;
1381}
1382
1383void
1384ipw_tx_stop(struct ipw_softc *sc)
1385{
1386	struct ipw_soft_hdr *shdr;
1387	struct ipw_soft_buf *sbuf;
1388	int i;
1389
1390	if (sc->tbd_map != NULL) {
1391		if (sc->tbd_list != NULL)
1392			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
1393		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
1394		sc->tbd_map = NULL;
1395	}
1396
1397	if (sc->stbd_list != NULL) {
1398		for (i = 0; i < IPW_NTBD; i++)
1399			ipw_release_sbd(sc, &sc->stbd_list[i]);
1400		free(sc->stbd_list, M_DEVBUF);
1401		sc->stbd_list = NULL;
1402	}
1403
1404	if (sc->cmd_map != NULL) {
1405		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
1406		sc->cmd_map = NULL;
1407	}
1408
1409	if (sc->shdr_list != NULL) {
1410		TAILQ_FOREACH(shdr, &sc->sc_free_shdr, next)
1411			bus_dmamap_destroy(sc->sc_dmat, shdr->map);
1412		free(sc->shdr_list, M_DEVBUF);
1413		sc->shdr_list = NULL;
1414	}
1415
1416	if (sc->tx_sbuf_list != NULL) {
1417		TAILQ_FOREACH(sbuf, &sc->sc_free_sbuf, next)
1418			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1419		free(sc->tx_sbuf_list, M_DEVBUF);
1420		sc->tx_sbuf_list = NULL;
1421	}
1422}
1423
1424int
1425ipw_rx_init(struct ipw_softc *sc)
1426{
1427	char *errmsg;
1428	struct ipw_bd *bd;
1429	struct ipw_soft_bd *sbd;
1430	struct ipw_soft_buf *sbuf;
1431	int error, i;
1432
1433	/* Allocate reception buffer descriptors */
1434	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
1435	    BUS_DMA_NOWAIT, &sc->rbd_map);
1436	if (error != 0) {
1437		errmsg = "could not create rbd dma map";
1438		goto fail;
1439	}
1440
1441	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
1442	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
1443	if (error != 0) {
1444		errmsg = "could not load rbd dma memory";
1445		goto fail;
1446	}
1447
1448	sc->srbd_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_bd),
1449	    M_DEVBUF, M_NOWAIT);
1450	if (sc->srbd_list == NULL) {
1451		errmsg = "could not allocate soft rbd";
1452		error = ENOMEM;
1453		goto fail;
1454	}
1455	sbd = sc->srbd_list;
1456	bd = sc->rbd_list;
1457	for (i = 0; i < IPW_NRBD; i++, sbd++, bd++) {
1458		sbd->type = IPW_SBD_TYPE_NOASSOC;
1459		sbd->bd = bd;
1460	}
1461
1462	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1463	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1464	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1465	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1466	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
1467
1468	/* Allocate status descriptors */
1469	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
1470	    0, BUS_DMA_NOWAIT, &sc->status_map);
1471	if (error != 0) {
1472		errmsg = "could not create status dma map";
1473		goto fail;
1474	}
1475
1476	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
1477	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
1478	if (error != 0) {
1479		errmsg = "could not load status dma memory";
1480		goto fail;
1481	}
1482
1483	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1484	    sc->status_map->dm_segs[0].ds_addr);
1485
1486	sc->rx_sbuf_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_buf),
1487	    M_DEVBUF, M_NOWAIT);
1488	if (sc->rx_sbuf_list == NULL) {
1489		errmsg = "could not allocate soft rxbuf";
1490		error = ENOMEM;
1491		goto fail;
1492	}
1493
1494	sbuf = sc->rx_sbuf_list;
1495	sbd = sc->srbd_list;
1496	for (i = 0; i < IPW_NRBD; i++, sbuf++, sbd++) {
1497
1498		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
1499		if (sbuf->m == NULL) {
1500			errmsg = "could not allocate rx mbuf";
1501			error = ENOMEM;
1502			goto fail;
1503		}
1504		MCLGET(sbuf->m, M_DONTWAIT);
1505		if (!(sbuf->m->m_flags & M_EXT)) {
1506			m_freem(sbuf->m);
1507			errmsg = "could not allocate rx mbuf cluster";
1508			error = ENOMEM;
1509			goto fail;
1510		}
1511
1512		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
1513		    0, BUS_DMA_NOWAIT, &sbuf->map);
1514		if (error != 0) {
1515			m_freem(sbuf->m);
1516			errmsg = "could not create rxbuf dma map";
1517			goto fail;
1518		}
1519		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
1520		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1521		if (error != 0) {
1522			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1523			m_freem(sbuf->m);
1524			errmsg = "could not map rxbuf dma memory";
1525			goto fail;
1526		}
1527		sbd->type = IPW_SBD_TYPE_DATA;
1528		sbd->priv = sbuf;
1529		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
1530		sbd->bd->len = htole32(MCLBYTES);
1531	}
1532
1533	return 0;
1534
1535fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1536	ipw_rx_stop(sc);
1537
1538	return error;
1539}
1540
1541void
1542ipw_rx_stop(struct ipw_softc *sc)
1543{
1544	struct ipw_soft_bd *sbd;
1545	struct ipw_soft_buf *sbuf;
1546	int i;
1547
1548	if (sc->rbd_map != NULL) {
1549		if (sc->rbd_list != NULL)
1550			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
1551		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
1552		sc->rbd_map = NULL;
1553	}
1554
1555	if (sc->status_map != NULL) {
1556		if (sc->status_list != NULL)
1557			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
1558		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
1559		sc->status_map = NULL;
1560	}
1561
1562	if (sc->srbd_list != NULL) {
1563		for (i = 0, sbd = sc->srbd_list; i < IPW_NRBD; i++, sbd++) {
1564			if (sbd->type == IPW_SBD_TYPE_NOASSOC)
1565				continue;
1566
1567			sbuf = sbd->priv;
1568			bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1569			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1570			m_freem(sbuf->m);
1571		}
1572		free(sc->srbd_list, M_DEVBUF);
1573		sc->srbd_list = NULL;
1574	}
1575
1576	if (sc->rx_sbuf_list != NULL) {
1577		free(sc->rx_sbuf_list, M_DEVBUF);
1578		sc->rx_sbuf_list = NULL;
1579	}
1580}
1581
1582void
1583ipw_stop_master(struct ipw_softc *sc)
1584{
1585	int ntries;
1586
1587	/* Disable interrupts */
1588	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1589
1590	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1591	for (ntries = 0; ntries < 5; ntries++) {
1592		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1593			break;
1594		DELAY(10);
1595	}
1596	if (ntries == 5)
1597		printf("%s: timeout waiting for master\n",
1598		    sc->sc_dev.dv_xname);
1599
1600	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1601	    IPW_RST_PRINCETON_RESET);
1602
1603	sc->flags &= ~IPW_FLAG_FW_INITED;
1604}
1605
1606int
1607ipw_reset(struct ipw_softc *sc)
1608{
1609	int ntries;
1610
1611	ipw_stop_master(sc);
1612
1613	/* Move adapter to D0 state */
1614	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1615	    IPW_CTL_INIT);
1616
1617	/* Wait for clock stabilization */
1618	for (ntries = 0; ntries < 1000; ntries++) {
1619		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1620			break;
1621		DELAY(200);
1622	}
1623	if (ntries == 1000)
1624		return EIO;
1625
1626	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1627	    IPW_RST_SW_RESET);
1628
1629	DELAY(10);
1630
1631	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1632	    IPW_CTL_INIT);
1633
1634	return 0;
1635}
1636
1637int
1638ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1639{
1640	int ntries;
1641
1642	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1643	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1644
1645	MEM_WRITE_2(sc, 0x220000, 0x0703);
1646	MEM_WRITE_2(sc, 0x220000, 0x0707);
1647
1648	MEM_WRITE_1(sc, 0x210014, 0x72);
1649	MEM_WRITE_1(sc, 0x210014, 0x72);
1650
1651	MEM_WRITE_1(sc, 0x210000, 0x40);
1652	MEM_WRITE_1(sc, 0x210000, 0x00);
1653	MEM_WRITE_1(sc, 0x210000, 0x40);
1654
1655	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1656
1657	MEM_WRITE_1(sc, 0x210000, 0x00);
1658	MEM_WRITE_1(sc, 0x210000, 0x00);
1659	MEM_WRITE_1(sc, 0x210000, 0x80);
1660
1661	MEM_WRITE_2(sc, 0x220000, 0x0703);
1662	MEM_WRITE_2(sc, 0x220000, 0x0707);
1663
1664	MEM_WRITE_1(sc, 0x210014, 0x72);
1665	MEM_WRITE_1(sc, 0x210014, 0x72);
1666
1667	MEM_WRITE_1(sc, 0x210000, 0x00);
1668	MEM_WRITE_1(sc, 0x210000, 0x80);
1669
1670	for (ntries = 0; ntries < 100; ntries++) {
1671		if (MEM_READ_1(sc, 0x210000) & 1)
1672			break;
1673		DELAY(1000);
1674	}
1675	if (ntries == 100) {
1676		printf("%s: timeout waiting for ucode to initialize\n",
1677		    sc->sc_dev.dv_xname);
1678		return EIO;
1679	}
1680
1681	MEM_WRITE_4(sc, 0x3000e0, 0);
1682
1683	return 0;
1684}
1685
1686/* set of macros to handle unaligned little endian data in firmware image */
1687#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1688#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1689int
1690ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1691{
1692	u_char *p, *end;
1693	u_int32_t dst;
1694	u_int16_t len;
1695	int error;
1696
1697	p = fw;
1698	end = fw + size;
1699	while (p < end) {
1700		if (p + 6 > end)
1701			return EINVAL;
1702
1703		dst = GETLE32(p); p += 4;
1704		len = GETLE16(p); p += 2;
1705
1706		if (p + len > end)
1707			return EINVAL;
1708
1709		ipw_write_mem_1(sc, dst, p, len);
1710		p += len;
1711	}
1712
1713	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1714	    IPW_IO_LED_OFF);
1715
1716	/* Allow interrupts so we know when the firmware is inited */
1717	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1718
1719	/* Tell the adapter to initialize the firmware */
1720	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1721	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1722	    IPW_CTL_ALLOW_STANDBY);
1723
1724	/* Wait at most one second for firmware initialization to complete */
1725	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1726		printf("%s: timeout waiting for firmware initialization to "
1727		    "complete\n", sc->sc_dev.dv_xname);
1728		return error;
1729	}
1730
1731	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1732	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1733
1734	return 0;
1735}
1736
1737/*
1738 * Store firmware into kernel memory so we can download it when we need to,
1739 * e.g when the adapter wakes up from suspend mode.
1740 */
1741int
1742ipw_cache_firmware(struct ipw_softc *sc, void *data)
1743{
1744	struct ipw_firmware *fw = &sc->fw;
1745	struct ipw_firmware_hdr hdr;
1746	u_char *p = data;
1747	int error;
1748
1749	ipw_free_firmware(sc);
1750
1751	if ((error = copyin(data, &hdr, sizeof hdr)) != 0)
1752		goto fail1;
1753
1754	fw->main_size  = letoh32(hdr.main_size);
1755	fw->ucode_size = letoh32(hdr.ucode_size);
1756	p += sizeof hdr;
1757
1758	fw->main = malloc(fw->main_size, M_DEVBUF, M_NOWAIT);
1759	if (fw->main == NULL) {
1760		error = ENOMEM;
1761		goto fail1;
1762	}
1763
1764	fw->ucode = malloc(fw->ucode_size, M_DEVBUF, M_NOWAIT);
1765	if (fw->ucode == NULL) {
1766		error = ENOMEM;
1767		goto fail2;
1768	}
1769
1770	if ((error = copyin(p, fw->main, fw->main_size)) != 0)
1771		goto fail3;
1772
1773	p += fw->main_size;
1774	if ((error = copyin(p, fw->ucode, fw->ucode_size)) != 0)
1775		goto fail3;
1776
1777	DPRINTF(("Firmware cached: main %u, ucode %u\n", fw->main_size,
1778	    fw->ucode_size));
1779
1780	sc->flags |= IPW_FLAG_FW_CACHED;
1781
1782	return 0;
1783
1784fail3:	free(fw->ucode, M_DEVBUF);
1785fail2:	free(fw->main, M_DEVBUF);
1786fail1:	return error;
1787}
1788
1789void
1790ipw_free_firmware(struct ipw_softc *sc)
1791{
1792	if (!(sc->flags & IPW_FLAG_FW_CACHED))
1793		return;
1794
1795	free(sc->fw.main, M_DEVBUF);
1796	free(sc->fw.ucode, M_DEVBUF);
1797
1798	sc->flags &= ~IPW_FLAG_FW_CACHED;
1799}
1800
1801int
1802ipw_config(struct ipw_softc *sc)
1803{
1804	struct ieee80211com *ic = &sc->sc_ic;
1805	struct ifnet *ifp = &ic->ic_if;
1806	struct ipw_security security;
1807	struct ieee80211_wepkey *k;
1808	struct ipw_wep_key wepkey;
1809	struct ipw_scan_options options;
1810	struct ipw_configuration config;
1811	u_int32_t data;
1812	int error, i;
1813
1814	switch (ic->ic_opmode) {
1815	case IEEE80211_M_STA:
1816	case IEEE80211_M_HOSTAP:
1817		data = htole32(IPW_MODE_BSS);
1818		break;
1819
1820	case IEEE80211_M_IBSS:
1821	case IEEE80211_M_AHDEMO:
1822		data = htole32(IPW_MODE_IBSS);
1823		break;
1824
1825	case IEEE80211_M_MONITOR:
1826		data = htole32(IPW_MODE_MONITOR);
1827		break;
1828	}
1829	DPRINTF(("Setting adapter mode to %u\n", data));
1830	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1831	if (error != 0)
1832		return error;
1833
1834	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1835	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1836		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1837		DPRINTF(("Setting adapter channel to %u\n", data));
1838		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1839		if (error != 0)
1840			return error;
1841	}
1842
1843	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1844		DPRINTF(("Enabling adapter\n"));
1845		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1846	}
1847
1848	DPRINTF(("Setting adapter MAC to %s\n", ether_sprintf(ic->ic_myaddr)));
1849	IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1850	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1851	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1852	    IEEE80211_ADDR_LEN);
1853	if (error != 0)
1854		return error;
1855
1856	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1857			       IPW_CFG_PREAMBLE_LEN | IPW_CFG_802_1x_ENABLE);
1858	if (ic->ic_opmode == IEEE80211_M_IBSS)
1859		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1860	if (ifp->if_flags & IFF_PROMISC)
1861		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1862	config.channels = htole32(0x3fff); /* channels 1-14 */
1863	config.ibss_chan = htole32(0x7ff);
1864	DPRINTF(("Setting adapter configuration 0x%08x\n", config.flags));
1865	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1866	if (error != 0)
1867		return error;
1868
1869	data = htole32(0x3); /* 1, 2 */
1870	DPRINTF(("Setting adapter basic tx rates to 0x%x\n", data));
1871	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1872	if (error != 0)
1873		return error;
1874
1875	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1876	DPRINTF(("Setting adapter tx rates to 0x%x\n", data));
1877	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1878	if (error != 0)
1879		return error;
1880
1881	data = htole32(IPW_POWER_MODE_CAM);
1882	DPRINTF(("Setting adapter power mode to %u\n", data));
1883	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1884	if (error != 0)
1885		return error;
1886
1887	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1888		data = htole32(ic->ic_txpower);
1889		DPRINTF(("Setting adapter tx power index to %u\n", data));
1890		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1891		    sizeof data);
1892		if (error != 0)
1893			return error;
1894	}
1895
1896	data = htole32(ic->ic_rtsthreshold);
1897	DPRINTF(("Setting adapter RTS threshold to %u\n", data));
1898	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1899	if (error != 0)
1900		return error;
1901
1902	data = htole32(ic->ic_fragthreshold);
1903	DPRINTF(("Setting adapter frag threshold to %u\n", data));
1904	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1905	if (error != 0)
1906		return error;
1907
1908#ifdef IPW_DEBUG
1909	if (ipw_debug > 0) {
1910		printf("Setting adapter ESSID to ");
1911		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1912		printf("\n");
1913	}
1914#endif
1915	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1916	    ic->ic_des_esslen);
1917	if (error != 0)
1918		return error;
1919
1920	/* no mandatory BSSID */
1921	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1922	if (error != 0)
1923		return error;
1924
1925	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1926		DPRINTF(("Setting adapter desired BSSID to %s\n",
1927		    ether_sprintf(ic->ic_des_bssid)));
1928		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1929		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1930		if (error != 0)
1931			return error;
1932	}
1933
1934	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1935	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1936	security.ciphers = htole32(IPW_CIPHER_NONE);
1937	security.version = htole16(0);
1938	security.replay_counters_number = 0;
1939	security.unicast_using_group = 0;
1940	DPRINTF(("Setting adapter authmode to %u\n", security.authmode));
1941	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1942	    sizeof security);
1943	if (error != 0)
1944		return error;
1945
1946	if (ic->ic_flags & IEEE80211_F_WEPON) {
1947		k = ic->ic_nw_keys;
1948		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1949			if (k->wk_len == 0)
1950				continue;
1951
1952			wepkey.idx = i;
1953			wepkey.len = k->wk_len;
1954			bzero(wepkey.key, sizeof wepkey.key);
1955			bcopy(k->wk_key, wepkey.key, k->wk_len);
1956			DPRINTF(("Setting wep key index %d len %d\n",
1957			    wepkey.idx, wepkey.len));
1958			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1959			    sizeof wepkey);
1960			if (error != 0)
1961				return error;
1962		}
1963
1964		data = htole32(ic->ic_wep_txkey);
1965		DPRINTF(("Setting adapter tx key index to %u\n", data));
1966		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1967		    sizeof data);
1968		if (error != 0)
1969			return error;
1970	}
1971
1972	data = htole32((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) ? 0x8 : 0);
1973	DPRINTF(("Setting adapter wep flags to 0x%x\n", data));
1974	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1975	if (error != 0)
1976		return error;
1977
1978	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1979	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1980		data = htole32(ic->ic_lintval);
1981		DPRINTF(("Setting adapter beacon interval to %u\n", data));
1982		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1983		    sizeof data);
1984		if (error != 0)
1985			return error;
1986	}
1987
1988	options.flags = htole32(0);
1989	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1990	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1991	if (error != 0)
1992		return error;
1993
1994	/* finally, enable adapter (start scanning for an access point) */
1995	DPRINTF(("Enabling adapter\n"));
1996	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1997}
1998
1999int
2000ipw_init(struct ifnet *ifp)
2001{
2002	struct ipw_softc *sc = ifp->if_softc;
2003	struct ipw_firmware *fw = &sc->fw;
2004	int error;
2005
2006	/* exit immediately if firmware has not been ioctl'd */
2007	if (!(sc->flags & IPW_FLAG_FW_CACHED)) {
2008		ifp->if_flags &= ~IFF_UP;
2009		return EIO;
2010	}
2011
2012	if ((error = ipw_reset(sc)) != 0) {
2013		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
2014		goto fail;
2015	}
2016
2017	if ((error = ipw_load_ucode(sc, fw->ucode, fw->ucode_size)) != 0) {
2018		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
2019		goto fail;
2020	}
2021
2022	ipw_stop_master(sc);
2023
2024	if ((error = ipw_rx_init(sc)) != 0) {
2025		printf("%s: could not initialize rx queue\n",
2026		    sc->sc_dev.dv_xname);
2027		goto fail;
2028	}
2029
2030	if ((error = ipw_tx_init(sc)) != 0) {
2031		printf("%s: could not initialize tx queue\n",
2032		    sc->sc_dev.dv_xname);
2033		goto fail;
2034	}
2035
2036	if ((error = ipw_load_firmware(sc, fw->main, fw->main_size)) != 0) {
2037		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
2038		goto fail;
2039	}
2040
2041	sc->flags |= IPW_FLAG_FW_INITED;
2042
2043	/* Retrieve information tables base addresses */
2044	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2045	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2046
2047	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2048
2049	if ((error = ipw_config(sc)) != 0) {
2050		printf("%s: device configuration failed\n",
2051		    sc->sc_dev.dv_xname);
2052		goto fail;
2053	}
2054
2055	ifp->if_flags &= ~IFF_OACTIVE;
2056	ifp->if_flags |= IFF_RUNNING;
2057
2058	return 0;
2059
2060fail:	ipw_stop(ifp, 0);
2061
2062	return error;
2063}
2064
2065void
2066ipw_stop(struct ifnet *ifp, int disable)
2067{
2068	struct ipw_softc *sc = ifp->if_softc;
2069	struct ieee80211com *ic = &sc->sc_ic;
2070
2071	ipw_stop_master(sc);
2072	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2073
2074	ipw_tx_stop(sc);
2075	ipw_rx_stop(sc);
2076
2077	ifp->if_timer = 0;
2078	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2079
2080	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2081}
2082
2083void
2084ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2085    bus_size_t count)
2086{
2087	for (; count > 0; offset++, datap++, count--) {
2088		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2089		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2090	}
2091}
2092
2093void
2094ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2095    bus_size_t count)
2096{
2097	for (; count > 0; offset++, datap++, count--) {
2098		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2099		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2100	}
2101}
2102
2103struct cfdriver ipw_cd = {
2104	0, "ipw", DV_IFNET
2105};
2106