if_ipw.c revision 1.27
1/*	$Id: if_ipw.c,v 1.27 2004/11/24 20:50:55 damien Exp $  */
2
3/*-
4 * Copyright (c) 2004
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46#include <sys/device.h>
47
48#include <machine/bus.h>
49#include <machine/endian.h>
50#include <machine/intr.h>
51
52#include <dev/pci/pcireg.h>
53#include <dev/pci/pcivar.h>
54#include <dev/pci/pcidevs.h>
55
56#if NBPFILTER > 0
57#include <net/bpf.h>
58#endif
59#include <net/if.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_media.h>
63#include <net/if_types.h>
64
65#include <netinet/in.h>
66#include <netinet/in_systm.h>
67#include <netinet/in_var.h>
68#include <netinet/if_ether.h>
69#include <netinet/ip.h>
70
71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <dev/pci/if_ipwreg.h>
75#include <dev/pci/if_ipwvar.h>
76
77static const struct ieee80211_rateset ipw_rateset_11b =
78	{ 4, { 2, 4, 11, 22 } };
79
80int ipw_match(struct device *, void *, void *);
81void ipw_attach(struct device *, struct device *, void *);
82int ipw_detach(struct device *, int);
83int ipw_media_change(struct ifnet *);
84void ipw_media_status(struct ifnet *, struct ifmediareq *);
85int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
86u_int16_t ipw_read_prom_word(struct ipw_softc *, u_int8_t);
87void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
88void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
89void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
90    struct ipw_soft_bd *, struct ipw_soft_buf *);
91void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
92void ipw_rx_intr(struct ipw_softc *);
93void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
94void ipw_tx_intr(struct ipw_softc *);
95int ipw_intr(void *);
96int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
97int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
98void ipw_start(struct ifnet *);
99void ipw_watchdog(struct ifnet *);
100int ipw_get_table1(struct ipw_softc *, u_int32_t *);
101int ipw_get_radio(struct ipw_softc *, int *);
102int ipw_ioctl(struct ifnet *, u_long, caddr_t);
103u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
104void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
105int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
106int ipw_dmamem_init(struct ipw_softc *);
107void ipw_dmamem_stop(struct ipw_softc *);
108int ipw_tx_init(struct ipw_softc *);
109void ipw_tx_stop(struct ipw_softc *);
110int ipw_rx_init(struct ipw_softc *);
111void ipw_rx_stop(struct ipw_softc *);
112void ipw_stop_master(struct ipw_softc *);
113int ipw_reset(struct ipw_softc *);
114int ipw_load_ucode(struct ipw_softc *, u_char *, int);
115int ipw_load_firmware(struct ipw_softc *, u_char *, int);
116int ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
117int ipw_config(struct ipw_softc *);
118int ipw_init(struct ifnet *);
119void ipw_stop(struct ifnet *, int);
120void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
121void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
122
123static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
124{
125	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
126	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
127}
128
129static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
130{
131	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
132	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
133}
134
135#ifdef IPW_DEBUG
136#define DPRINTF(x)	if (ipw_debug > 0) printf x
137#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
138int ipw_debug = 0;
139#else
140#define DPRINTF(x)
141#define DPRINTFN(n, x)
142#endif
143
144struct cfattach ipw_ca = {
145	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
146};
147
148int
149ipw_match(struct device *parent, void *match, void *aux)
150{
151	struct pci_attach_args *pa = aux;
152
153	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
154	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
155		return 1;
156
157	return 0;
158}
159
160/* Base Address Register */
161#define IPW_PCI_BAR0	0x10
162
163void
164ipw_attach(struct device *parent, struct device *self, void *aux)
165{
166	struct ipw_softc *sc = (struct ipw_softc *)self;
167	struct ieee80211com *ic = &sc->sc_ic;
168	struct ifnet *ifp = &ic->ic_if;
169	struct pci_attach_args *pa = aux;
170	const char *intrstr;
171	bus_space_tag_t memt;
172	bus_space_handle_t memh;
173	bus_addr_t base;
174	pci_intr_handle_t ih;
175	pcireg_t data;
176	u_int16_t val;
177	int error, i;
178
179	sc->sc_pct = pa->pa_pc;
180
181	data = pci_conf_read(sc->sc_pct, pa->pa_tag, 0x40);
182	data &= ~0x0000ff00;
183	pci_conf_write(sc->sc_pct, pa->pa_tag, 0x40, data);
184
185	/* enable bus-mastering */
186	data = pci_conf_read(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG);
187	data |= PCI_COMMAND_MASTER_ENABLE;
188	pci_conf_write(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG, data);
189
190	/* map the register window */
191	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
192	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
193	if (error != 0) {
194		printf(": could not map memory space\n");
195		return;
196	}
197
198	sc->sc_st = memt;
199	sc->sc_sh = memh;
200	sc->sc_dmat = pa->pa_dmat;
201
202	/* disable interrupts */
203	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
204
205	if (pci_intr_map(pa, &ih) != 0) {
206		printf(": could not map interrupt\n");
207		return;
208	}
209
210	intrstr = pci_intr_string(sc->sc_pct, ih);
211	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
212	    sc->sc_dev.dv_xname);
213	if (sc->sc_ih == NULL) {
214		printf(": could not establish interrupt");
215		if (intrstr != NULL)
216			printf(" at %s", intrstr);
217		printf("\n");
218		return;
219	}
220	printf(": %s", intrstr);
221
222	if (ipw_reset(sc) != 0) {
223		printf(": could not reset adapter\n");
224		return;
225	}
226
227	/* set up dma memory */
228	if (ipw_dmamem_init(sc) != 0) {
229		printf(": failed to initialize DMA memory\n");
230		return;
231	}
232
233	ic->ic_phytype = IEEE80211_T_DS;
234	ic->ic_opmode = IEEE80211_M_STA;
235	ic->ic_state = IEEE80211_S_INIT;
236
237	/* set device capabilities */
238	ic->ic_caps =  IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
239	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP;
240
241	/* read MAC address from EEPROM */
242	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
243	ic->ic_myaddr[0] = val >> 8;
244	ic->ic_myaddr[1] = val & 0xff;
245	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
246	ic->ic_myaddr[2] = val >> 8;
247	ic->ic_myaddr[3] = val & 0xff;
248	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
249	ic->ic_myaddr[4] = val >> 8;
250	ic->ic_myaddr[5] = val & 0xff;
251
252	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
253
254	/* set supported .11b rates */
255	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
256
257	/* set supported .11b channels (1 through 14) */
258	for (i = 1; i <= 14; i++) {
259		ic->ic_channels[i].ic_freq =
260		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
261		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
262	}
263
264	/* default to authmode OPEN */
265	sc->authmode = IEEE80211_AUTH_OPEN;
266
267	/* IBSS channel undefined for now */
268	ic->ic_ibss_chan = &ic->ic_channels[0];
269
270	ifp->if_softc = sc;
271	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
272	ifp->if_init = ipw_init;
273	ifp->if_ioctl = ipw_ioctl;
274	ifp->if_start = ipw_start;
275	ifp->if_watchdog = ipw_watchdog;
276	IFQ_SET_READY(&ifp->if_snd);
277	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
278
279	if_attach(ifp);
280	ieee80211_ifattach(ifp);
281	/* override state transition machine */
282	sc->sc_newstate = ic->ic_newstate;
283	ic->ic_newstate = ipw_newstate;
284	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
285
286#if NBPFILTER > 0
287	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
288	    sizeof (struct ieee80211_frame) + 64);
289
290	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
291	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
292	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
293
294	sc->sc_txtap_len = sizeof sc->sc_txtapu;
295	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
296	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
297#endif
298}
299
300int
301ipw_detach(struct device* self, int flags)
302{
303	struct ipw_softc *sc = (struct ipw_softc *)self;
304	struct ifnet *ifp = &sc->sc_ic.ic_if;
305
306	ipw_stop(ifp, 1);
307	ipw_dmamem_stop(sc);
308
309#if NBPFILTER > 0
310	bpfdetach(ifp);
311#endif
312	ieee80211_ifdetach(ifp);
313	if_detach(ifp);
314
315	if (sc->sc_ih != NULL) {
316		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
317		sc->sc_ih = NULL;
318	}
319
320	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
321
322	return 0;
323}
324
325int
326ipw_media_change(struct ifnet *ifp)
327{
328	int error;
329
330	error = ieee80211_media_change(ifp);
331	if (error != ENETRESET)
332		return error;
333
334	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
335		ipw_init(ifp);
336
337	return 0;
338}
339
340void
341ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
342{
343	struct ipw_softc *sc = ifp->if_softc;
344	struct ieee80211com *ic = &sc->sc_ic;
345#define N(a)	(sizeof (a) / sizeof (a[0]))
346	static const struct {
347		u_int32_t	val;
348		int		rate;
349	} rates[] = {
350		{ IPW_RATE_DS1,   2 },
351		{ IPW_RATE_DS2,   4 },
352		{ IPW_RATE_DS5,  11 },
353		{ IPW_RATE_DS11, 22 },
354	};
355	u_int32_t val;
356	int rate, i;
357
358	imr->ifm_status = IFM_AVALID;
359	imr->ifm_active = IFM_IEEE80211;
360	if (ic->ic_state == IEEE80211_S_RUN)
361		imr->ifm_status |= IFM_ACTIVE;
362
363	/* read current transmission rate from adapter */
364	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
365	val &= 0xf;
366
367	/* convert rate to 802.11 rate */
368	for (i = 0; i < N(rates) && rates[i].val != val; i++);
369	rate = (i < N(rates)) ? rates[i].rate : 0;
370
371	imr->ifm_active |= IFM_IEEE80211_11B;
372	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
373	switch (ic->ic_opmode) {
374	case IEEE80211_M_STA:
375		break;
376
377	case IEEE80211_M_IBSS:
378		imr->ifm_active |= IFM_IEEE80211_IBSS;
379		break;
380
381	case IEEE80211_M_MONITOR:
382		imr->ifm_active |= IFM_IEEE80211_MONITOR;
383		break;
384
385	case IEEE80211_M_AHDEMO:
386	case IEEE80211_M_HOSTAP:
387		/* should not get there */
388		break;
389	}
390#undef N
391}
392
393int
394ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
395{
396	struct ipw_softc *sc = ic->ic_softc;
397	struct ieee80211_node *ni = ic->ic_bss;
398	u_int32_t val, len;
399
400	switch (nstate) {
401	case IEEE80211_S_RUN:
402		len = IEEE80211_NWID_LEN;
403		ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
404		ni->ni_esslen = len;
405
406		val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
407		ni->ni_chan = &ic->ic_channels[val];
408
409		DELAY(100); /* firmware needs a short delay here */
410
411		len = IEEE80211_ADDR_LEN;
412		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
413		break;
414
415	case IEEE80211_S_INIT:
416	case IEEE80211_S_SCAN:
417	case IEEE80211_S_AUTH:
418	case IEEE80211_S_ASSOC:
419		break;
420	}
421
422	ic->ic_state = nstate;
423	return 0;
424}
425
426/*
427 * Read 16 bits at address 'addr' from the Microwire EEPROM.
428 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
429 */
430u_int16_t
431ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
432{
433	u_int32_t tmp;
434	u_int16_t val;
435	int n;
436
437	/* Clock C once before the first command */
438	IPW_EEPROM_CTL(sc, 0);
439	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
440	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
441	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
442
443	/* Write start bit (1) */
444	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
445	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
446
447	/* Write READ opcode (10) */
448	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
449	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
450	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
451	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
452
453	/* Write address A7-A0 */
454	for (n = 7; n >= 0; n--) {
455		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
456		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
457		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
458		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
459	}
460
461	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
462
463	/* Read data Q15-Q0 */
464	val = 0;
465	for (n = 15; n >= 0; n--) {
466		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
467		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
468		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
469		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
470	}
471
472	IPW_EEPROM_CTL(sc, 0);
473
474	/* Clear Chip Select and clock C */
475	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
476	IPW_EEPROM_CTL(sc, 0);
477	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
478
479	return letoh16(val);
480}
481
482void
483ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
484{
485	struct ipw_cmd *cmd;
486
487	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
488	    BUS_DMASYNC_POSTREAD);
489
490	cmd = mtod(sbuf->m, struct ipw_cmd *);
491
492	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
493	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
494	    letoh32(cmd->len), letoh32(cmd->status)));
495
496	wakeup(sc);
497}
498
499void
500ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
501{
502	struct ieee80211com *ic = &sc->sc_ic;
503	u_int32_t state;
504
505	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
506	    BUS_DMASYNC_POSTREAD);
507
508	state = letoh32(*mtod(sbuf->m, u_int32_t *));
509
510	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
511
512	switch (state) {
513	case IPW_STATE_ASSOCIATED:
514		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
515		break;
516
517	case IPW_STATE_SCANNING:
518		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
519		break;
520
521	case IPW_STATE_ASSOCIATION_LOST:
522		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
523		break;
524
525	case IPW_STATE_RADIO_DISABLED:
526		ipw_stop(&ic->ic_if, 1);
527		break;
528	}
529}
530
531void
532ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
533    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
534{
535	struct ieee80211com *ic = &sc->sc_ic;
536	struct ifnet *ifp = &ic->ic_if;
537	struct mbuf *m;
538	struct ieee80211_frame *wh;
539	struct ieee80211_node *ni;
540	int error;
541
542	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
543
544	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
545	    BUS_DMASYNC_POSTREAD);
546
547	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
548
549	/* Finalize mbuf */
550	m = sbuf->m;
551	m->m_pkthdr.rcvif = ifp;
552	m->m_pkthdr.len = m->m_len = letoh32(status->len);
553
554#if NBPFILTER > 0
555	if (sc->sc_drvbpf != NULL) {
556		struct mbuf mb;
557		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
558
559		tap->wr_flags = 0;
560		tap->wr_antsignal = status->rssi;
561		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
562		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
563
564		M_DUP_PKTHDR(&mb, m);
565		mb.m_data = (caddr_t)tap;
566		mb.m_len = sc->sc_rxtap_len;
567		mb.m_next = m;
568		mb.m_pkthdr.len += mb.m_len;
569		bpf_mtap(sc->sc_drvbpf, &mb);
570	}
571#endif
572
573	wh = mtod(m, struct ieee80211_frame *);
574
575	ni = ieee80211_find_rxnode(ic, wh);
576
577	/* Send it up to the upper layer */
578	ieee80211_input(ifp, m, ni, status->rssi, 0);
579
580	if (ni == ic->ic_bss)
581		ieee80211_unref_node(&ni);
582	else
583		ieee80211_free_node(ic, ni);
584
585	MGETHDR(m, M_DONTWAIT, MT_DATA);
586	if (m == NULL) {
587		printf("%s: could not allocate rx mbuf\n",
588		    sc->sc_dev.dv_xname);
589		return;
590	}
591	MCLGET(m, M_DONTWAIT);
592	if (!(m->m_flags & M_EXT)) {
593		m_freem(m);
594		printf("%s: could not allocate rx mbuf cluster\n",
595		    sc->sc_dev.dv_xname);
596		return;
597	}
598
599	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
600	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
601	if (error != 0) {
602		printf("%s: could not map rxbuf dma memory\n",
603		    sc->sc_dev.dv_xname);
604		m_freem(m);
605		return;
606	}
607
608	sbuf->m = m;
609	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
610}
611
612void
613ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
614{
615	DPRINTFN(2, ("RX!NOTIFICATION\n"));
616}
617
618void
619ipw_rx_intr(struct ipw_softc *sc)
620{
621	struct ipw_status *status;
622	struct ipw_soft_bd *sbd;
623	struct ipw_soft_buf *sbuf;
624	u_int32_t r, i;
625
626	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
627
628	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
629
630		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
631		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
632		    BUS_DMASYNC_POSTREAD);
633
634		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
635		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
636		    BUS_DMASYNC_POSTREAD);
637
638		status = &sc->status_list[i];
639		sbd = &sc->srbd_list[i];
640		sbuf = sbd->priv;
641
642		switch (letoh16(status->code) & 0xf) {
643		case IPW_STATUS_CODE_COMMAND:
644			ipw_command_intr(sc, sbuf);
645			break;
646
647		case IPW_STATUS_CODE_NEWSTATE:
648			ipw_newstate_intr(sc, sbuf);
649			break;
650
651		case IPW_STATUS_CODE_DATA_802_3:
652		case IPW_STATUS_CODE_DATA_802_11:
653			ipw_data_intr(sc, status, sbd, sbuf);
654			break;
655
656		case IPW_STATUS_CODE_NOTIFICATION:
657			ipw_notification_intr(sc, sbuf);
658			break;
659
660		default:
661			printf("%s: unknown status code %u\n",
662			    sc->sc_dev.dv_xname, letoh16(status->code));
663		}
664		sbd->bd->flags = 0;
665
666		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
667		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
668		    BUS_DMASYNC_PREWRITE);
669	}
670
671	/* Tell the firmware what we have processed */
672	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
673	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
674}
675
676void
677ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
678{
679	struct ieee80211com *ic;
680	struct ipw_soft_hdr *shdr;
681	struct ipw_soft_buf *sbuf;
682
683	switch (sbd->type) {
684	case IPW_SBD_TYPE_COMMAND:
685		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
686		break;
687
688	case IPW_SBD_TYPE_HEADER:
689		shdr = sbd->priv;
690		bus_dmamap_unload(sc->sc_dmat, shdr->map);
691		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
692		break;
693
694	case IPW_SBD_TYPE_DATA:
695		ic = &sc->sc_ic;
696		sbuf = sbd->priv;
697		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
698		m_freem(sbuf->m);
699		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
700			ieee80211_free_node(ic, sbuf->ni);
701		/* kill watchdog timer */
702		sc->sc_tx_timer = 0;
703		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
704		break;
705	}
706	sbd->type = IPW_SBD_TYPE_NOASSOC;
707}
708
709void
710ipw_tx_intr(struct ipw_softc *sc)
711{
712	struct ifnet *ifp = &sc->sc_ic.ic_if;
713	u_int32_t r, i;
714
715	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
716
717	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD)
718		ipw_release_sbd(sc, &sc->stbd_list[i]);
719
720	/* Remember what the firmware has processed */
721	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
722
723	/* Call start() since some buffer descriptors have been released */
724	ifp->if_flags &= ~IFF_OACTIVE;
725	(*ifp->if_start)(ifp);
726}
727
728int
729ipw_intr(void *arg)
730{
731	struct ipw_softc *sc = arg;
732	u_int32_t r;
733
734	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
735		return 0;
736
737	/* Disable interrupts */
738	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
739
740	DPRINTFN(8, ("INTR!0x%08x\n", r));
741
742	if (r & IPW_INTR_RX_TRANSFER)
743		ipw_rx_intr(sc);
744
745	if (r & IPW_INTR_TX_TRANSFER)
746		ipw_tx_intr(sc);
747
748	if (r & IPW_INTR_FW_INIT_DONE) {
749		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
750			wakeup(sc);
751	}
752
753	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
754		printf("%s: fatal error\n", sc->sc_dev.dv_xname);
755		ipw_stop(&sc->sc_ic.ic_if, 1);
756	}
757
758	/* Acknowledge interrupts */
759	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
760
761	/* Re-enable interrupts */
762	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
763
764	return 1;
765}
766
767int
768ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
769{
770	struct ipw_soft_bd *sbd;
771	int error;
772
773	sbd = &sc->stbd_list[sc->txcur];
774
775	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, sc->cmd,
776	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
777	if (error != 0) {
778		printf("%s: could not map cmd dma memory\n",
779		    sc->sc_dev.dv_xname);
780		return error;
781	}
782
783	sc->cmd->type = htole32(type);
784	sc->cmd->subtype = htole32(0);
785	sc->cmd->len = htole32(len);
786	sc->cmd->seq = htole32(0);
787	if (data != NULL)
788		bcopy(data, sc->cmd->data, len);
789
790	sbd->type = IPW_SBD_TYPE_COMMAND;
791	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
792	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
793	sbd->bd->nfrag = 1;
794	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
795			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
796
797	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
798	    BUS_DMASYNC_PREWRITE);
799
800	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
801	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
802	    BUS_DMASYNC_PREWRITE);
803
804	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
805	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
806
807	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
808
809	/* Wait at most one second for command to complete */
810	return tsleep(sc, 0, "ipwcmd", hz);
811}
812
813int
814ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
815{
816	struct ipw_softc *sc = ifp->if_softc;
817	struct ieee80211com *ic = &sc->sc_ic;
818	struct ieee80211_frame *wh;
819	struct ipw_soft_bd *sbd;
820	struct ipw_soft_hdr *shdr;
821	struct ipw_soft_buf *sbuf;
822	int error, i;
823
824	if (ic->ic_flags & IEEE80211_F_WEPON) {
825		m = ieee80211_wep_crypt(ifp, m, 1);
826		if (m == NULL)
827			return ENOBUFS;
828	}
829
830#if NBPFILTER > 0
831	if (sc->sc_drvbpf != NULL) {
832		struct mbuf mb;
833		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
834
835		tap->wt_flags = 0;
836		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
837		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
838
839		M_DUP_PKTHDR(&mb, m);
840		mb.m_data = (caddr_t)tap;
841		mb.m_len = sc->sc_txtap_len;
842		mb.m_next = m;
843		mb.m_pkthdr.len += mb.m_len;
844		bpf_mtap(sc->sc_drvbpf, &mb);
845	}
846#endif
847
848	wh = mtod(m, struct ieee80211_frame *);
849
850	shdr = TAILQ_FIRST(&sc->sc_free_shdr);
851	sbuf = TAILQ_FIRST(&sc->sc_free_sbuf);
852
853	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
854	shdr->hdr.subtype = htole32(0);
855	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
856	shdr->hdr.encrypt = 0;
857	shdr->hdr.keyidx = 0;
858	shdr->hdr.keysz = 0;
859	shdr->hdr.fragmentsz = htole16(0);
860	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
861	if (ic->ic_opmode == IEEE80211_M_STA)
862		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
863	else
864		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
865
866	/* trim IEEE802.11 header */
867	m_adj(m, sizeof (struct ieee80211_frame));
868
869	/*
870	 * We need to map the mbuf first to know how many buffer descriptors
871	 * are needed for this transfer.
872	 */
873	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
874	if (error != 0) {
875		printf("%s: could not map mbuf (error %d)\n",
876		    sc->sc_dev.dv_xname, error);
877		m_freem(m);
878		return error;
879	}
880
881	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
882	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
883	if (error != 0) {
884		printf("%s: could not map header (error %d)\n",
885		    sc->sc_dev.dv_xname, error);
886		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
887		m_freem(m);
888		return error;
889	}
890
891	TAILQ_REMOVE(&sc->sc_free_sbuf, sbuf, next);
892	TAILQ_REMOVE(&sc->sc_free_shdr, shdr, next);
893
894	sbd = &sc->stbd_list[sc->txcur];
895	sbd->type = IPW_SBD_TYPE_HEADER;
896	sbd->priv = shdr;
897	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
898	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
899	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
900	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
901			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
902
903	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
904	    shdr->hdr.encrypted, shdr->hdr.encrypt));
905	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
906	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
907
908	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
909	    sc->txcur * sizeof (struct ipw_bd),
910	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
911
912	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
913
914	sbuf->m = m;
915	sbuf->ni = ni;
916
917	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
918		sbd = &sc->stbd_list[sc->txcur];
919		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
920		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
921		sbd->bd->nfrag = 0; /* used only in first bd */
922		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
923		if (i == sbuf->map->dm_nsegs - 1) {
924			sbd->type = IPW_SBD_TYPE_DATA;
925			sbd->priv = sbuf;
926			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
927		} else {
928			sbd->type = IPW_SBD_TYPE_NOASSOC;
929			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
930		}
931
932		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
933		    sbuf->map->dm_segs[i].ds_len));
934
935		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
936		    sc->txcur * sizeof (struct ipw_bd),
937		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
938
939		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
940	}
941
942	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
943	    BUS_DMASYNC_PREWRITE);
944
945	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
946	    BUS_DMASYNC_PREWRITE);
947
948	/* Inform firmware about this new packet */
949	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
950
951	return 0;
952}
953
954void
955ipw_start(struct ifnet *ifp)
956{
957	struct ipw_softc *sc = ifp->if_softc;
958	struct ieee80211com *ic = &sc->sc_ic;
959	struct mbuf *m;
960	struct ieee80211_node *ni;
961
962	if (ic->ic_state != IEEE80211_S_RUN)
963		return;
964
965	for (;;) {
966		IF_DEQUEUE(&ifp->if_snd, m);
967		if (m == NULL)
968			break;
969
970#if NBPFILTER > 0
971		if (ifp->if_bpf != NULL)
972			bpf_mtap(ifp->if_bpf, m);
973#endif
974
975		m = ieee80211_encap(ifp, m, &ni);
976		if (m == NULL)
977			continue;
978
979#if NBPFILTER > 0
980		if (ic->ic_rawbpf != NULL)
981			bpf_mtap(ic->ic_rawbpf, m);
982#endif
983
984		if (ipw_tx_start(ifp, m, ni) != 0) {
985			if (ni != NULL && ni != ic->ic_bss)
986				ieee80211_free_node(ic, ni);
987			break;
988		}
989
990		/* start watchdog timer */
991		sc->sc_tx_timer = 5;
992		ifp->if_timer = 1;
993	}
994}
995
996void
997ipw_watchdog(struct ifnet *ifp)
998{
999	struct ipw_softc *sc = ifp->if_softc;
1000
1001	ifp->if_timer = 0;
1002
1003	if (sc->sc_tx_timer > 0) {
1004		if (--sc->sc_tx_timer == 0) {
1005			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1006			ipw_stop(ifp, 1);
1007			return;
1008		}
1009		ifp->if_timer = 1;
1010	}
1011
1012	ieee80211_watchdog(ifp);
1013}
1014
1015int
1016ipw_get_table1(struct ipw_softc *sc, u_int32_t *tbl)
1017{
1018	u_int32_t i, size, buf[256];
1019
1020	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
1021		bzero(buf, sizeof buf);
1022		return copyout(buf, tbl, sizeof buf);
1023	}
1024
1025	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
1026
1027	size = CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA);
1028	for (i = 1; i < size; i++)
1029		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
1030
1031	return copyout(buf, tbl, size * sizeof (u_int32_t));
1032}
1033
1034int
1035ipw_get_radio(struct ipw_softc *sc, int *ret)
1036{
1037	int val;
1038
1039	val = (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ? 0 : 1;
1040	return copyout(&val, ret, sizeof val);
1041}
1042
1043int
1044ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1045{
1046	struct ipw_softc *sc = ifp->if_softc;
1047	struct ifreq *ifr;
1048	struct ifaddr *ifa;
1049	int s, error = 0;
1050
1051	s = splnet();
1052
1053	switch (cmd) {
1054	case SIOCSIFADDR:
1055		ifa = (struct ifaddr *) data;
1056		ifp->if_flags |= IFF_UP;
1057		switch (ifa->ifa_addr->sa_family) {
1058#ifdef INET
1059		case AF_INET:
1060			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
1061			ipw_init(ifp);
1062			break;
1063#endif
1064		default:
1065			ipw_init(ifp);
1066		}
1067		break;
1068
1069	case SIOCSIFFLAGS:
1070		if (ifp->if_flags & IFF_UP) {
1071			if (!(ifp->if_flags & IFF_RUNNING))
1072				ipw_init(ifp);
1073		} else {
1074			if (ifp->if_flags & IFF_RUNNING)
1075				ipw_stop(ifp, 1);
1076		}
1077		break;
1078
1079	case SIOCGTABLE1:
1080		ifr = (struct ifreq *)data;
1081		error = ipw_get_table1(sc, (u_int32_t *)ifr->ifr_data);
1082		break;
1083
1084	case SIOCGRADIO:
1085		ifr = (struct ifreq *)data;
1086		error = ipw_get_radio(sc, (int *)ifr->ifr_data);
1087		break;
1088
1089	case SIOCG80211AUTH:
1090		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1091		break;
1092
1093	case SIOCS80211AUTH:
1094		/* only super-user can do that! */
1095		if ((error = suser(curproc, 0)) != 0)
1096			break;
1097
1098		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1099		break;
1100
1101	default:
1102		error = ieee80211_ioctl(ifp, cmd, data);
1103	}
1104
1105	if (error == ENETRESET && cmd != SIOCADDMULTI) {
1106		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1107		    (IFF_UP | IFF_RUNNING))
1108			ipw_init(ifp);
1109		error = 0;
1110	}
1111
1112	splx(s);
1113	return error;
1114}
1115
1116u_int32_t
1117ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1118{
1119	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1120}
1121
1122void
1123ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1124{
1125	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1126}
1127
1128int
1129ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1130{
1131	u_int32_t addr, info;
1132	u_int16_t count, size;
1133	u_int32_t total;
1134
1135	/* addr[4] + count[2] + size[2] */
1136	addr = MEM_READ_4(sc, sc->table2_base + off);
1137	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1138
1139	count = info >> 16;
1140	size = info & 0xffff;
1141	total = count * size;
1142
1143	if (total > *len) {
1144		*len = total;
1145		return EINVAL;
1146	}
1147
1148	*len = total;
1149	ipw_read_mem_1(sc, addr, buf, total);
1150
1151	return 0;
1152}
1153
1154/*
1155 * Allocate and map DMAble memory.  Do not call in interrupt context.
1156 */
1157int
1158ipw_dmamem_init(struct ipw_softc *sc)
1159{
1160	int error, nsegs;
1161	char *errmsg;
1162
1163	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
1164	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1165	if (error != 0) {
1166		errmsg = "could not allocate tbd dma memory";
1167		goto fail;
1168	}
1169
1170	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
1171	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
1172	if (error != 0) {
1173		errmsg = "could not map tbd dma memory";
1174		goto fail;
1175	}
1176
1177	error = bus_dmamem_alloc(sc->sc_dmat, sizeof (struct ipw_cmd),
1178	    PAGE_SIZE, 0, &sc->cmd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1179	if (error != 0) {
1180		errmsg = "could not allocate cmd dma memory";
1181		goto fail;
1182	}
1183
1184	error = bus_dmamem_map(sc->sc_dmat, &sc->cmd_seg, nsegs,
1185	    sizeof (struct ipw_cmd), (caddr_t *)&sc->cmd, BUS_DMA_NOWAIT);
1186	if (error != 0) {
1187		errmsg = "could not map cmd dma memory";
1188		goto fail;
1189	}
1190
1191	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
1192	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1193	if (error != 0) {
1194		errmsg = "could not allocate rbd dma memory";
1195		goto fail;
1196	}
1197
1198	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
1199	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
1200	if (error != 0) {
1201		errmsg = "could not map rbd dma memory";
1202		goto fail;
1203	}
1204
1205	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
1206	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1207	if (error != 0) {
1208		errmsg = "could not allocate status dma memory";
1209		goto fail;
1210	}
1211
1212	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
1213	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
1214	if (error != 0) {
1215		errmsg = "could not map status dma memory";
1216		goto fail;
1217	}
1218
1219	return 0;
1220
1221fail:	printf("%s: %s", sc->sc_dev.dv_xname, errmsg);
1222	ipw_dmamem_stop(sc);
1223
1224	return error;
1225}
1226
1227/*
1228 * Unmap and free DMAble memory.
1229 */
1230void
1231ipw_dmamem_stop(struct ipw_softc *sc)
1232{
1233	if (sc->tbd_list != NULL) {
1234		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
1235		    IPW_TBD_SZ);
1236		bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
1237		sc->tbd_list = NULL;
1238	}
1239
1240	if (sc->cmd != NULL) {
1241		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->cmd,
1242		    sizeof (struct ipw_cmd));
1243		bus_dmamem_free(sc->sc_dmat, &sc->cmd_seg, 1);
1244		sc->cmd = NULL;
1245	}
1246
1247	if (sc->rbd_list != NULL) {
1248		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
1249		    IPW_RBD_SZ);
1250		bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
1251		sc->rbd_list = NULL;
1252	}
1253
1254	if (sc->status_list != NULL) {
1255		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
1256		    IPW_STATUS_SZ);
1257		bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
1258		sc->status_list = NULL;
1259	}
1260}
1261
1262int
1263ipw_tx_init(struct ipw_softc *sc)
1264{
1265	char *errmsg;
1266	struct ipw_bd *bd;
1267	struct ipw_soft_bd *sbd;
1268	struct ipw_soft_hdr *shdr;
1269	struct ipw_soft_buf *sbuf;
1270	int error, i;
1271
1272	/* Allocate transmission buffer descriptors */
1273	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
1274	    BUS_DMA_NOWAIT, &sc->tbd_map);
1275	if (error != 0) {
1276		errmsg = "could not create tbd dma map";
1277		goto fail;
1278	}
1279
1280	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
1281	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
1282	if (error != 0) {
1283		errmsg = "could not load tbd dma memory";
1284		goto fail;
1285	}
1286
1287	sc->stbd_list = malloc(IPW_NTBD * sizeof (struct ipw_soft_bd),
1288	    M_DEVBUF, M_NOWAIT);
1289	if (sc->stbd_list == NULL) {
1290		errmsg = "could not allocate soft tbd";
1291		error = ENOMEM;
1292		goto fail;
1293	}
1294	sbd = sc->stbd_list;
1295	bd = sc->tbd_list;
1296	for (i = 0; i < IPW_NTBD; i++, sbd++, bd++) {
1297		sbd->type = IPW_SBD_TYPE_NOASSOC;
1298		sbd->bd = bd;
1299	}
1300
1301	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1302	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1303	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1304	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1305	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1306	sc->txcur = 0; /* bd index to write to */
1307
1308	/* Allocate a DMA-able command */
1309	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
1310	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
1311	if (error != 0) {
1312		errmsg = "could not create cmd dma map";
1313		goto fail;
1314	}
1315
1316	/* Allocate a pool of DMA-able headers */
1317	sc->shdr_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_hdr),
1318	    M_DEVBUF, M_NOWAIT);
1319	if (sc->shdr_list == NULL) {
1320		errmsg = "could not allocate soft hdr";
1321		error = ENOMEM;
1322		goto fail;
1323	}
1324	TAILQ_INIT(&sc->sc_free_shdr);
1325	for (i = 0, shdr = sc->shdr_list; i < IPW_NDATA; i++, shdr++) {
1326		error = bus_dmamap_create(sc->sc_dmat,
1327		    sizeof (struct ipw_soft_hdr), 1,
1328	 	    sizeof (struct ipw_soft_hdr), 0, BUS_DMA_NOWAIT,
1329		    &shdr->map);
1330		if (error != 0) {
1331			errmsg = "could not create hdr dma map";
1332			goto fail;
1333		}
1334		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
1335	}
1336
1337	/* Allocate a pool of DMA-able buffers */
1338	sc->tx_sbuf_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_buf),
1339	    M_DEVBUF, M_NOWAIT);
1340	if (sc->tx_sbuf_list == NULL) {
1341		errmsg = "could not allocate soft txbuf";
1342		error = ENOMEM;
1343		goto fail;
1344	}
1345	TAILQ_INIT(&sc->sc_free_sbuf);
1346	for (i = 0, sbuf = sc->tx_sbuf_list; i < IPW_NDATA; i++, sbuf++) {
1347		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_NDATA,
1348		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
1349		if (error != 0) {
1350			errmsg = "could not create txbuf dma map";
1351			goto fail;
1352		}
1353		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
1354	}
1355
1356	return 0;
1357
1358fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1359	ipw_tx_stop(sc);
1360
1361	return error;
1362}
1363
1364void
1365ipw_tx_stop(struct ipw_softc *sc)
1366{
1367	struct ipw_soft_hdr *shdr;
1368	struct ipw_soft_buf *sbuf;
1369	int i;
1370
1371	if (sc->tbd_map != NULL) {
1372		if (sc->tbd_list != NULL)
1373			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
1374		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
1375		sc->tbd_map = NULL;
1376	}
1377
1378	if (sc->stbd_list != NULL) {
1379		for (i = 0; i < IPW_NTBD; i++)
1380			ipw_release_sbd(sc, &sc->stbd_list[i]);
1381		free(sc->stbd_list, M_DEVBUF);
1382		sc->stbd_list = NULL;
1383	}
1384
1385	if (sc->cmd_map != NULL) {
1386		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
1387		sc->cmd_map = NULL;
1388	}
1389
1390	if (sc->shdr_list != NULL) {
1391		TAILQ_FOREACH(shdr, &sc->sc_free_shdr, next)
1392			bus_dmamap_destroy(sc->sc_dmat, shdr->map);
1393		free(sc->shdr_list, M_DEVBUF);
1394		sc->shdr_list = NULL;
1395	}
1396
1397	if (sc->tx_sbuf_list != NULL) {
1398		TAILQ_FOREACH(sbuf, &sc->sc_free_sbuf, next)
1399			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1400		free(sc->tx_sbuf_list, M_DEVBUF);
1401		sc->tx_sbuf_list = NULL;
1402	}
1403}
1404
1405int
1406ipw_rx_init(struct ipw_softc *sc)
1407{
1408	char *errmsg;
1409	struct ipw_bd *bd;
1410	struct ipw_soft_bd *sbd;
1411	struct ipw_soft_buf *sbuf;
1412	int error, i;
1413
1414	/* Allocate reception buffer descriptors */
1415	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
1416	    BUS_DMA_NOWAIT, &sc->rbd_map);
1417	if (error != 0) {
1418		errmsg = "could not create rbd dma map";
1419		goto fail;
1420	}
1421
1422	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
1423	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
1424	if (error != 0) {
1425		errmsg = "could not load rbd dma memory";
1426		goto fail;
1427	}
1428
1429	sc->srbd_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_bd),
1430	    M_DEVBUF, M_NOWAIT);
1431	if (sc->srbd_list == NULL) {
1432		errmsg = "could not allocate soft rbd";
1433		error = ENOMEM;
1434		goto fail;
1435	}
1436	sbd = sc->srbd_list;
1437	bd = sc->rbd_list;
1438	for (i = 0; i < IPW_NRBD; i++, sbd++, bd++) {
1439		sbd->type = IPW_SBD_TYPE_NOASSOC;
1440		sbd->bd = bd;
1441	}
1442
1443	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1444	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1445	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1446	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1447	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
1448
1449	/* Allocate status descriptors */
1450	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
1451	    0, BUS_DMA_NOWAIT, &sc->status_map);
1452	if (error != 0) {
1453		errmsg = "could not create status dma map";
1454		goto fail;
1455	}
1456
1457	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
1458	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
1459	if (error != 0) {
1460		errmsg = "could not load status dma memory";
1461		goto fail;
1462	}
1463
1464	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1465	    sc->status_map->dm_segs[0].ds_addr);
1466
1467	sc->rx_sbuf_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_buf),
1468	    M_DEVBUF, M_NOWAIT);
1469	if (sc->rx_sbuf_list == NULL) {
1470		errmsg = "could not allocate soft rxbuf";
1471		error = ENOMEM;
1472		goto fail;
1473	}
1474
1475	sbuf = sc->rx_sbuf_list;
1476	sbd = sc->srbd_list;
1477	for (i = 0; i < IPW_NRBD; i++, sbuf++, sbd++) {
1478
1479		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
1480		if (sbuf->m == NULL) {
1481			errmsg = "could not allocate rx mbuf";
1482			error = ENOMEM;
1483			goto fail;
1484		}
1485		MCLGET(sbuf->m, M_DONTWAIT);
1486		if (!(sbuf->m->m_flags & M_EXT)) {
1487			m_freem(sbuf->m);
1488			errmsg = "could not allocate rx mbuf cluster";
1489			error = ENOMEM;
1490			goto fail;
1491		}
1492
1493		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
1494		    0, BUS_DMA_NOWAIT, &sbuf->map);
1495		if (error != 0) {
1496			m_freem(sbuf->m);
1497			errmsg = "could not create rxbuf dma map";
1498			goto fail;
1499		}
1500		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
1501		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1502		if (error != 0) {
1503			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1504			m_freem(sbuf->m);
1505			errmsg = "could not map rxbuf dma memory";
1506			goto fail;
1507		}
1508		sbd->type = IPW_SBD_TYPE_DATA;
1509		sbd->priv = sbuf;
1510		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
1511		sbd->bd->len = htole32(MCLBYTES);
1512	}
1513
1514	return 0;
1515
1516fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1517	ipw_rx_stop(sc);
1518
1519	return error;
1520}
1521
1522void
1523ipw_rx_stop(struct ipw_softc *sc)
1524{
1525	struct ipw_soft_bd *sbd;
1526	struct ipw_soft_buf *sbuf;
1527	int i;
1528
1529	if (sc->rbd_map != NULL) {
1530		if (sc->rbd_list != NULL)
1531			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
1532		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
1533		sc->rbd_map = NULL;
1534	}
1535
1536	if (sc->status_map != NULL) {
1537		if (sc->status_list != NULL)
1538			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
1539		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
1540		sc->status_map = NULL;
1541	}
1542
1543	if (sc->srbd_list != NULL) {
1544		for (i = 0, sbd = sc->srbd_list; i < IPW_NRBD; i++, sbd++) {
1545			if (sbd->type == IPW_SBD_TYPE_NOASSOC)
1546				continue;
1547
1548			sbuf = sbd->priv;
1549			bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1550			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1551			m_freem(sbuf->m);
1552		}
1553		free(sc->srbd_list, M_DEVBUF);
1554		sc->srbd_list = NULL;
1555	}
1556
1557	if (sc->rx_sbuf_list != NULL) {
1558		free(sc->rx_sbuf_list, M_DEVBUF);
1559		sc->rx_sbuf_list = NULL;
1560	}
1561}
1562
1563void
1564ipw_stop_master(struct ipw_softc *sc)
1565{
1566	int ntries;
1567
1568	/* Disable interrupts */
1569	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1570
1571	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1572	for (ntries = 0; ntries < 5; ntries++) {
1573		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1574			break;
1575		DELAY(10);
1576	}
1577	if (ntries == 5)
1578		printf("%s: timeout waiting for master\n",
1579		    sc->sc_dev.dv_xname);
1580
1581	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1582	    IPW_RST_PRINCETON_RESET);
1583
1584	sc->flags &= ~IPW_FLAG_FW_INITED;
1585}
1586
1587int
1588ipw_reset(struct ipw_softc *sc)
1589{
1590	int ntries;
1591
1592	ipw_stop_master(sc);
1593
1594	/* Move adapter to D0 state */
1595	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1596	    IPW_CTL_INIT);
1597
1598	/* Wait for clock stabilization */
1599	for (ntries = 0; ntries < 1000; ntries++) {
1600		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1601			break;
1602		DELAY(200);
1603	}
1604	if (ntries == 1000)
1605		return EIO;
1606
1607	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1608	    IPW_RST_SW_RESET);
1609
1610	DELAY(10);
1611
1612	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1613	    IPW_CTL_INIT);
1614
1615	return 0;
1616}
1617
1618int
1619ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1620{
1621	int ntries;
1622
1623	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1624	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1625
1626	MEM_WRITE_2(sc, 0x220000, 0x0703);
1627	MEM_WRITE_2(sc, 0x220000, 0x0707);
1628
1629	MEM_WRITE_1(sc, 0x210014, 0x72);
1630	MEM_WRITE_1(sc, 0x210014, 0x72);
1631
1632	MEM_WRITE_1(sc, 0x210000, 0x40);
1633	MEM_WRITE_1(sc, 0x210000, 0x00);
1634	MEM_WRITE_1(sc, 0x210000, 0x40);
1635
1636	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1637
1638	MEM_WRITE_1(sc, 0x210000, 0x00);
1639	MEM_WRITE_1(sc, 0x210000, 0x00);
1640	MEM_WRITE_1(sc, 0x210000, 0x80);
1641
1642	MEM_WRITE_2(sc, 0x220000, 0x0703);
1643	MEM_WRITE_2(sc, 0x220000, 0x0707);
1644
1645	MEM_WRITE_1(sc, 0x210014, 0x72);
1646	MEM_WRITE_1(sc, 0x210014, 0x72);
1647
1648	MEM_WRITE_1(sc, 0x210000, 0x00);
1649	MEM_WRITE_1(sc, 0x210000, 0x80);
1650
1651	for (ntries = 0; ntries < 100; ntries++) {
1652		if (MEM_READ_1(sc, 0x210000) & 1)
1653			break;
1654		DELAY(1000);
1655	}
1656	if (ntries == 100) {
1657		printf("%s: timeout waiting for ucode to initialize\n",
1658		    sc->sc_dev.dv_xname);
1659		return EIO;
1660	}
1661
1662	MEM_WRITE_4(sc, 0x3000e0, 0);
1663
1664	return 0;
1665}
1666
1667/* set of macros to handle unaligned little endian data in firmware image */
1668#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1669#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1670int
1671ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1672{
1673	u_char *p, *end;
1674	u_int32_t dst;
1675	u_int16_t len;
1676	int error;
1677
1678	p = fw;
1679	end = fw + size;
1680	while (p < end) {
1681		if (p + 6 > end)
1682			return EINVAL;
1683
1684		dst = GETLE32(p); p += 4;
1685		len = GETLE16(p); p += 2;
1686
1687		if (p + len > end)
1688			return EINVAL;
1689
1690		ipw_write_mem_1(sc, dst, p, len);
1691		p += len;
1692	}
1693
1694	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1695	    IPW_IO_LED_OFF);
1696
1697	/* Allow interrupts so we know when the firmware is inited */
1698	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1699
1700	/* Tell the adapter to initialize the firmware */
1701	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1702	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1703	    IPW_CTL_ALLOW_STANDBY);
1704
1705	/* Wait at most one second for firmware initialization to complete */
1706	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1707		printf("%s: timeout waiting for firmware initialization to "
1708		    "complete\n", sc->sc_dev.dv_xname);
1709		return error;
1710	}
1711
1712	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1713	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1714
1715	return 0;
1716}
1717
1718int
1719ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1720{
1721	struct ipw_firmware_hdr *hdr;
1722	const char *name;
1723	u_char *p;
1724	size_t size;
1725	int error;
1726
1727	switch (sc->sc_ic.ic_opmode) {
1728	case IEEE80211_M_STA:
1729	case IEEE80211_M_HOSTAP:
1730		name = "ipw-bss";
1731		break;
1732
1733	case IEEE80211_M_IBSS:
1734	case IEEE80211_M_AHDEMO:
1735		name = "ipw-ibss";
1736		break;
1737
1738	case IEEE80211_M_MONITOR:
1739		name = "ipw-monitor";
1740		break;
1741	}
1742
1743	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1744		return error;
1745
1746	if (size < sizeof (struct ipw_firmware_hdr)) {
1747		error = EINVAL;
1748		goto fail;
1749	}
1750
1751	p = fw->data;
1752	hdr = (struct ipw_firmware_hdr *)p;
1753	fw->main_size = letoh32(hdr->main_size);
1754	fw->ucode_size = letoh32(hdr->ucode_size);
1755
1756	p += sizeof (struct ipw_firmware_hdr);
1757	size -= sizeof (struct ipw_firmware_hdr);
1758
1759	if (size < fw->main_size + fw->ucode_size) {
1760		error = EINVAL;
1761		goto fail;
1762	}
1763
1764	fw->main = p;
1765	fw->ucode = p + fw->main_size;
1766
1767	return 0;
1768
1769fail:	free(fw->data, M_DEVBUF);
1770	return error;
1771}
1772
1773int
1774ipw_config(struct ipw_softc *sc)
1775{
1776	struct ieee80211com *ic = &sc->sc_ic;
1777	struct ifnet *ifp = &ic->ic_if;
1778	struct ipw_security security;
1779	struct ieee80211_wepkey *k;
1780	struct ipw_wep_key wepkey;
1781	struct ipw_scan_options options;
1782	struct ipw_configuration config;
1783	u_int32_t data;
1784	int error, i;
1785
1786	switch (ic->ic_opmode) {
1787	case IEEE80211_M_STA:
1788	case IEEE80211_M_HOSTAP:
1789		data = htole32(IPW_MODE_BSS);
1790		break;
1791
1792	case IEEE80211_M_IBSS:
1793	case IEEE80211_M_AHDEMO:
1794		data = htole32(IPW_MODE_IBSS);
1795		break;
1796
1797	case IEEE80211_M_MONITOR:
1798		data = htole32(IPW_MODE_MONITOR);
1799		break;
1800	}
1801	DPRINTF(("Setting adapter mode to %u\n", data));
1802	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1803	if (error != 0)
1804		return error;
1805
1806	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1807	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1808		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1809		DPRINTF(("Setting adapter channel to %u\n", data));
1810		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1811		if (error != 0)
1812			return error;
1813	}
1814
1815	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1816		DPRINTF(("Enabling adapter\n"));
1817		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1818	}
1819
1820	DPRINTF(("Setting adapter MAC to %s\n", ether_sprintf(ic->ic_myaddr)));
1821	IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1822	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1823	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1824	    IEEE80211_ADDR_LEN);
1825	if (error != 0)
1826		return error;
1827
1828	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1829			       IPW_CFG_PREAMBLE_LEN | IPW_CFG_802_1x_ENABLE);
1830	if (ic->ic_opmode == IEEE80211_M_IBSS)
1831		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1832	if (ifp->if_flags & IFF_PROMISC)
1833		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1834	config.channels = htole32(0x3fff); /* channels 1-14 */
1835	config.ibss_chan = htole32(0x7ff);
1836	DPRINTF(("Setting adapter configuration 0x%08x\n", config.flags));
1837	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1838	if (error != 0)
1839		return error;
1840
1841	data = htole32(0x3); /* 1, 2 */
1842	DPRINTF(("Setting adapter basic tx rates to 0x%x\n", data));
1843	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1844	if (error != 0)
1845		return error;
1846
1847	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1848	DPRINTF(("Setting adapter tx rates to 0x%x\n", data));
1849	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1850	if (error != 0)
1851		return error;
1852
1853	data = htole32(IPW_POWER_MODE_CAM);
1854	DPRINTF(("Setting adapter power mode to %u\n", data));
1855	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1856	if (error != 0)
1857		return error;
1858
1859	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1860		data = htole32(ic->ic_txpower);
1861		DPRINTF(("Setting adapter tx power index to %u\n", data));
1862		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1863		    sizeof data);
1864		if (error != 0)
1865			return error;
1866	}
1867
1868	data = htole32(ic->ic_rtsthreshold);
1869	DPRINTF(("Setting adapter RTS threshold to %u\n", data));
1870	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1871	if (error != 0)
1872		return error;
1873
1874	data = htole32(ic->ic_fragthreshold);
1875	DPRINTF(("Setting adapter frag threshold to %u\n", data));
1876	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1877	if (error != 0)
1878		return error;
1879
1880#ifdef IPW_DEBUG
1881	if (ipw_debug > 0) {
1882		printf("Setting adapter ESSID to ");
1883		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1884		printf("\n");
1885	}
1886#endif
1887	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1888	    ic->ic_des_esslen);
1889	if (error != 0)
1890		return error;
1891
1892	/* no mandatory BSSID */
1893	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1894	if (error != 0)
1895		return error;
1896
1897	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1898		DPRINTF(("Setting adapter desired BSSID to %s\n",
1899		    ether_sprintf(ic->ic_des_bssid)));
1900		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1901		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1902		if (error != 0)
1903			return error;
1904	}
1905
1906	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1907	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1908	security.ciphers = htole32(IPW_CIPHER_NONE);
1909	security.version = htole16(0);
1910	security.replay_counters_number = 0;
1911	security.unicast_using_group = 0;
1912	DPRINTF(("Setting adapter authmode to %u\n", security.authmode));
1913	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1914	    sizeof security);
1915	if (error != 0)
1916		return error;
1917
1918	if (ic->ic_flags & IEEE80211_F_WEPON) {
1919		k = ic->ic_nw_keys;
1920		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1921			if (k->wk_len == 0)
1922				continue;
1923
1924			wepkey.idx = i;
1925			wepkey.len = k->wk_len;
1926			bzero(wepkey.key, sizeof wepkey.key);
1927			bcopy(k->wk_key, wepkey.key, k->wk_len);
1928			DPRINTF(("Setting wep key index %d len %d\n",
1929			    wepkey.idx, wepkey.len));
1930			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1931			    sizeof wepkey);
1932			if (error != 0)
1933				return error;
1934		}
1935
1936		data = htole32(ic->ic_wep_txkey);
1937		DPRINTF(("Setting adapter tx key index to %u\n", data));
1938		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1939		    sizeof data);
1940		if (error != 0)
1941			return error;
1942	}
1943
1944	data = htole32((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) ? 0x8 : 0);
1945	DPRINTF(("Setting adapter wep flags to 0x%x\n", data));
1946	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1947	if (error != 0)
1948		return error;
1949
1950	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1951	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1952		data = htole32(ic->ic_lintval);
1953		DPRINTF(("Setting adapter beacon interval to %u\n", data));
1954		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1955		    sizeof data);
1956		if (error != 0)
1957			return error;
1958	}
1959
1960	options.flags = htole32(0);
1961	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1962	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1963	if (error != 0)
1964		return error;
1965
1966	/* finally, enable adapter (start scanning for an access point) */
1967	DPRINTF(("Enabling adapter\n"));
1968	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1969}
1970
1971int
1972ipw_init(struct ifnet *ifp)
1973{
1974	struct ipw_softc *sc = ifp->if_softc;
1975	struct ipw_firmware fw;
1976	int error;
1977
1978	ipw_stop(ifp, 0);
1979
1980	if ((error = ipw_reset(sc)) != 0) {
1981		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1982		goto fail1;
1983	}
1984
1985	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1986		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1987		goto fail1;
1988	}
1989
1990	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1991		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1992		goto fail2;
1993	}
1994
1995	ipw_stop_master(sc);
1996
1997	if ((error = ipw_rx_init(sc)) != 0) {
1998		printf("%s: could not initialize rx queue\n",
1999		    sc->sc_dev.dv_xname);
2000		goto fail2;
2001	}
2002
2003	if ((error = ipw_tx_init(sc)) != 0) {
2004		printf("%s: could not initialize tx queue\n",
2005		    sc->sc_dev.dv_xname);
2006		goto fail2;
2007	}
2008
2009	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
2010		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
2011		goto fail2;
2012	}
2013
2014	sc->flags |= IPW_FLAG_FW_INITED;
2015
2016	/* Retrieve information tables base addresses */
2017	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2018	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2019
2020	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2021
2022	if ((error = ipw_config(sc)) != 0) {
2023		printf("%s: device configuration failed\n",
2024		    sc->sc_dev.dv_xname);
2025		goto fail2;
2026	}
2027
2028	ifp->if_flags &= ~IFF_OACTIVE;
2029	ifp->if_flags |= IFF_RUNNING;
2030
2031	return 0;
2032
2033fail2:	free(fw.data, M_DEVBUF);
2034fail1:	ipw_stop(ifp, 0);
2035
2036	return error;
2037}
2038
2039void
2040ipw_stop(struct ifnet *ifp, int disable)
2041{
2042	struct ipw_softc *sc = ifp->if_softc;
2043	struct ieee80211com *ic = &sc->sc_ic;
2044
2045	ipw_stop_master(sc);
2046	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2047
2048	ipw_tx_stop(sc);
2049	ipw_rx_stop(sc);
2050
2051	ifp->if_timer = 0;
2052	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2053
2054	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2055}
2056
2057void
2058ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2059    bus_size_t count)
2060{
2061	for (; count > 0; offset++, datap++, count--) {
2062		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2063		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2064	}
2065}
2066
2067void
2068ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2069    bus_size_t count)
2070{
2071	for (; count > 0; offset++, datap++, count--) {
2072		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2073		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2074	}
2075}
2076
2077struct cfdriver ipw_cd = {
2078	0, "ipw", DV_IFNET
2079};
2080