if_ipw.c revision 1.33
1/*	$Id: if_ipw.c,v 1.33 2004/12/05 20:00:38 damien Exp $  */
2
3/*-
4 * Copyright (c) 2004
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46#include <sys/device.h>
47
48#include <machine/bus.h>
49#include <machine/endian.h>
50#include <machine/intr.h>
51
52#include <dev/pci/pcireg.h>
53#include <dev/pci/pcivar.h>
54#include <dev/pci/pcidevs.h>
55
56#if NBPFILTER > 0
57#include <net/bpf.h>
58#endif
59#include <net/if.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_media.h>
63#include <net/if_types.h>
64
65#include <netinet/in.h>
66#include <netinet/in_systm.h>
67#include <netinet/in_var.h>
68#include <netinet/if_ether.h>
69#include <netinet/ip.h>
70
71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <dev/pci/if_ipwreg.h>
75#include <dev/pci/if_ipwvar.h>
76
77static const struct ieee80211_rateset ipw_rateset_11b =
78	{ 4, { 2, 4, 11, 22 } };
79
80int ipw_match(struct device *, void *, void *);
81void ipw_attach(struct device *, struct device *, void *);
82int ipw_detach(struct device *, int);
83int ipw_dma_alloc(struct ipw_softc *);
84void ipw_release(struct ipw_softc *);
85int ipw_media_change(struct ifnet *);
86void ipw_media_status(struct ifnet *, struct ifmediareq *);
87int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
88u_int16_t ipw_read_prom_word(struct ipw_softc *, u_int8_t);
89void ipw_scan_result(struct ipw_softc *);
90void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
91void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
92void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
93    struct ipw_soft_bd *, struct ipw_soft_buf *);
94void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
95void ipw_rx_intr(struct ipw_softc *);
96void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
97void ipw_tx_intr(struct ipw_softc *);
98int ipw_intr(void *);
99int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
100int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
101void ipw_start(struct ifnet *);
102void ipw_watchdog(struct ifnet *);
103int ipw_get_table1(struct ipw_softc *, u_int32_t *);
104int ipw_get_radio(struct ipw_softc *, int *);
105int ipw_ioctl(struct ifnet *, u_long, caddr_t);
106u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
107void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
108int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
109void ipw_stop_master(struct ipw_softc *);
110int ipw_reset(struct ipw_softc *);
111int ipw_load_ucode(struct ipw_softc *, u_char *, int);
112int ipw_load_firmware(struct ipw_softc *, u_char *, int);
113int ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
114int ipw_config(struct ipw_softc *);
115int ipw_init(struct ifnet *);
116void ipw_stop(struct ifnet *, int);
117void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
118void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
119
120static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
121{
122	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
123	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
124}
125
126static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
127{
128	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
129	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
130}
131
132#ifdef IPW_DEBUG
133#define DPRINTF(x)	if (ipw_debug > 0) printf x
134#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
135int ipw_debug = 0;
136#else
137#define DPRINTF(x)
138#define DPRINTFN(n, x)
139#endif
140
141struct cfattach ipw_ca = {
142	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
143};
144
145int
146ipw_match(struct device *parent, void *match, void *aux)
147{
148	struct pci_attach_args *pa = aux;
149
150	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
151	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
152		return 1;
153
154	return 0;
155}
156
157/* Base Address Register */
158#define IPW_PCI_BAR0	0x10
159
160void
161ipw_attach(struct device *parent, struct device *self, void *aux)
162{
163	struct ipw_softc *sc = (struct ipw_softc *)self;
164	struct ieee80211com *ic = &sc->sc_ic;
165	struct ifnet *ifp = &ic->ic_if;
166	struct pci_attach_args *pa = aux;
167	const char *intrstr;
168	bus_space_tag_t memt;
169	bus_space_handle_t memh;
170	bus_addr_t base;
171	pci_intr_handle_t ih;
172	pcireg_t data;
173	u_int16_t val;
174	int error, i;
175
176	sc->sc_pct = pa->pa_pc;
177
178	data = pci_conf_read(sc->sc_pct, pa->pa_tag, 0x40);
179	data &= ~0x0000ff00;
180	pci_conf_write(sc->sc_pct, pa->pa_tag, 0x40, data);
181
182	/* enable bus-mastering */
183	data = pci_conf_read(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG);
184	data |= PCI_COMMAND_MASTER_ENABLE;
185	pci_conf_write(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG, data);
186
187	/* map the register window */
188	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
189	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
190	if (error != 0) {
191		printf(": could not map memory space\n");
192		return;
193	}
194
195	sc->sc_st = memt;
196	sc->sc_sh = memh;
197	sc->sc_dmat = pa->pa_dmat;
198
199	/* disable interrupts */
200	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
201
202	if (pci_intr_map(pa, &ih) != 0) {
203		printf(": could not map interrupt\n");
204		return;
205	}
206
207	intrstr = pci_intr_string(sc->sc_pct, ih);
208	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
209	    sc->sc_dev.dv_xname);
210	if (sc->sc_ih == NULL) {
211		printf(": could not establish interrupt");
212		if (intrstr != NULL)
213			printf(" at %s", intrstr);
214		printf("\n");
215		return;
216	}
217	printf(": %s", intrstr);
218
219	if (ipw_reset(sc) != 0) {
220		printf(": could not reset adapter\n");
221		return;
222	}
223
224	if (ipw_dma_alloc(sc) != 0) {
225		printf(": failed to allocate DMA resources\n");
226		return;
227	}
228
229	ic->ic_phytype = IEEE80211_T_DS;
230	ic->ic_opmode = IEEE80211_M_STA;
231	ic->ic_state = IEEE80211_S_INIT;
232
233	/* set device capabilities */
234	ic->ic_caps = IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
235	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP |
236	    IEEE80211_C_SHPREAMBLE;
237
238	/* read MAC address from EEPROM */
239	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
240	ic->ic_myaddr[0] = val >> 8;
241	ic->ic_myaddr[1] = val & 0xff;
242	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
243	ic->ic_myaddr[2] = val >> 8;
244	ic->ic_myaddr[3] = val & 0xff;
245	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
246	ic->ic_myaddr[4] = val >> 8;
247	ic->ic_myaddr[5] = val & 0xff;
248
249	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
250
251	/* set supported .11b rates */
252	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
253
254	/* set supported .11b channels (1 through 14) */
255	for (i = 1; i <= 14; i++) {
256		ic->ic_channels[i].ic_freq =
257		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
258		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
259	}
260
261	/* default to authmode OPEN */
262	sc->authmode = IEEE80211_AUTH_OPEN;
263
264	/* IBSS channel undefined for now */
265	ic->ic_ibss_chan = &ic->ic_channels[0];
266
267	ifp->if_softc = sc;
268	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
269	ifp->if_init = ipw_init;
270	ifp->if_ioctl = ipw_ioctl;
271	ifp->if_start = ipw_start;
272	ifp->if_watchdog = ipw_watchdog;
273	IFQ_SET_READY(&ifp->if_snd);
274	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
275
276	if_attach(ifp);
277	ieee80211_ifattach(ifp);
278	/* override state transition machine */
279	sc->sc_newstate = ic->ic_newstate;
280	ic->ic_newstate = ipw_newstate;
281	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
282
283#if NBPFILTER > 0
284	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
285	    sizeof (struct ieee80211_frame) + 64);
286
287	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
288	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
289	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
290
291	sc->sc_txtap_len = sizeof sc->sc_txtapu;
292	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
293	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
294#endif
295}
296
297int
298ipw_detach(struct device* self, int flags)
299{
300	struct ipw_softc *sc = (struct ipw_softc *)self;
301	struct ifnet *ifp = &sc->sc_ic.ic_if;
302
303	ipw_stop(ifp, 1);
304
305#if NBPFILTER > 0
306	bpfdetach(ifp);
307#endif
308	ieee80211_ifdetach(ifp);
309	if_detach(ifp);
310
311	ipw_release(sc);
312
313	if (sc->sc_ih != NULL) {
314		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
315		sc->sc_ih = NULL;
316	}
317
318	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
319
320	return 0;
321}
322
323int
324ipw_dma_alloc(struct ipw_softc *sc)
325{
326	struct ipw_soft_bd *sbd;
327	struct ipw_soft_hdr *shdr;
328	struct ipw_soft_buf *sbuf;
329	int i, nsegs, error;
330
331	/*
332	 * Allocate and map tx ring
333	 */
334	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
335	    BUS_DMA_NOWAIT, &sc->tbd_map);
336	if (error != 0) {
337		printf("%s: could not create tx ring DMA map\n");
338		goto fail;
339	}
340
341	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
342	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
343	if (error != 0) {
344		printf("%s: could not allocate tx ring DMA memory\n");
345		goto fail;
346	}
347
348	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
349	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
350	if (error != 0) {
351		printf("%s: could not map tx ring DMA memory\n");
352		goto fail;
353	}
354
355	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
356	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
357	if (error != 0) {
358		printf("%s: could not load tx ring DMA map\n");
359		goto fail;
360	}
361
362	/*
363	 * Allocate and map rx ring
364	 */
365	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
366	    BUS_DMA_NOWAIT, &sc->rbd_map);
367	if (error != 0) {
368		printf("%s: could not create rx ring DMA map\n");
369		goto fail;
370	}
371
372	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
373	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
374	if (error != 0) {
375		printf("%s: could not allocate rx ring DMA memory\n");
376		goto fail;
377	}
378
379	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
380	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
381	if (error != 0) {
382		printf("%s: could not map rx ring DMA memory\n");
383		goto fail;
384	}
385
386	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
387	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
388	if (error != 0) {
389		printf("%s: could not load tx ring DMA map\n");
390		goto fail;
391	}
392
393	/*
394	 * Allocate and map status ring
395	 */
396	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
397	    0, BUS_DMA_NOWAIT, &sc->status_map);
398	if (error != 0) {
399		printf("%s: could not create status ring DMA map\n");
400		goto fail;
401	}
402
403	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
404	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
405	if (error != 0) {
406		printf("%s: could not allocate status ring DMA memory\n");
407		goto fail;
408	}
409
410	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
411	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
412	if (error != 0) {
413		printf("%s: could not map status ring DMA memory\n");
414		goto fail;
415	}
416
417	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
418	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
419	if (error != 0) {
420		printf("%s: could not load status ring DMA map\n");
421		goto fail;
422	}
423
424	/*
425	 * Allocate command DMA map
426	 */
427	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
428	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
429	if (error != 0) {
430		printf("%s: could not create command DMA map\n");
431		goto fail;
432	}
433
434	/*
435	 * Allocate headers DMA maps
436	 */
437	SLIST_INIT(&sc->free_shdr);
438	for (i = 0; i < IPW_NDATA; i++) {
439		shdr = &sc->shdr_list[i];
440		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
441		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
442		if (error != 0) {
443			printf("%s: could not create header DMA map\n");
444			goto fail;
445		}
446		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
447	}
448
449	/*
450	 * Allocate tx buffers DMA maps
451	 */
452	SLIST_INIT(&sc->free_sbuf);
453	for (i = 0; i < IPW_NDATA; i++) {
454		sbuf = &sc->tx_sbuf_list[i];
455		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
456		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
457		if (error != 0) {
458			printf("%s: could not create tx DMA map\n");
459			goto fail;
460		}
461		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
462	}
463
464	/*
465	 * Initialize tx ring
466	 */
467	for (i = 0; i < IPW_NTBD; i++) {
468		sbd = &sc->stbd_list[i];
469		sbd->bd = &sc->tbd_list[i];
470		sbd->type = IPW_SBD_TYPE_NOASSOC;
471	}
472
473	/*
474	 * Pre-allocate rx buffers and DMA maps
475	 */
476	for (i = 0; i < IPW_NRBD; i++) {
477		sbd = &sc->srbd_list[i];
478		sbuf = &sc->rx_sbuf_list[i];
479		sbd->bd = &sc->rbd_list[i];
480
481		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
482		if (sbuf->m == NULL) {
483			printf("%s: could not allocate rx mbuf\n");
484			error = ENOMEM;
485			goto fail;
486		}
487
488		MCLGET(sbuf->m, M_DONTWAIT);
489		if (!(sbuf->m->m_flags & M_EXT)) {
490			m_freem(sbuf->m);
491			printf("%s: could not allocate rx mbuf cluster\n");
492			error = ENOMEM;
493			goto fail;
494		}
495
496		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
497		    0, BUS_DMA_NOWAIT, &sbuf->map);
498		if (error != 0) {
499			printf("%s: could not create rx DMA map\n");
500			goto fail;
501		}
502
503		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
504		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
505		if (error != 0) {
506			printf("%s: could not map rx DMA memory\n");
507			goto fail;
508		}
509
510		sbd->type = IPW_SBD_TYPE_DATA;
511		sbd->priv = sbuf;
512		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
513		sbd->bd->len = htole32(MCLBYTES);
514	}
515
516	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
517	    BUS_DMASYNC_PREWRITE);
518
519	return 0;
520
521fail:	ipw_release(sc);
522	return error;
523}
524
525void
526ipw_release(struct ipw_softc *sc)
527{
528	struct ipw_soft_buf *sbuf;
529	int i;
530
531	if (sc->tbd_map != NULL) {
532		if (sc->tbd_list != NULL) {
533			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
534			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
535			    IPW_TBD_SZ);
536			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
537		}
538		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
539	}
540
541	if (sc->rbd_map != NULL) {
542		if (sc->rbd_list != NULL) {
543			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
544			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
545			    IPW_RBD_SZ);
546			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
547		}
548		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
549	}
550
551	if (sc->status_map != NULL) {
552		if (sc->status_list != NULL) {
553			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
554			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
555			    IPW_RBD_SZ);
556			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
557		}
558		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
559	}
560
561	if (sc->cmd_map != NULL)
562		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
563
564	for (i = 0; i < IPW_NDATA; i++)
565		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
566
567	for (i = 0; i < IPW_NDATA; i++)
568		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
569
570	for (i = 0; i < IPW_NRBD; i++) {
571		sbuf = &sc->rx_sbuf_list[i];
572		if (sbuf->map != NULL) {
573			if (sbuf->m != NULL) {
574				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
575				m_freem(sbuf->m);
576			}
577			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
578		}
579	}
580}
581
582int
583ipw_media_change(struct ifnet *ifp)
584{
585	int error;
586
587	error = ieee80211_media_change(ifp);
588	if (error != ENETRESET)
589		return error;
590
591	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
592		ipw_init(ifp);
593
594	return 0;
595}
596
597void
598ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
599{
600	struct ipw_softc *sc = ifp->if_softc;
601	struct ieee80211com *ic = &sc->sc_ic;
602#define N(a)	(sizeof (a) / sizeof (a[0]))
603	static const struct {
604		u_int32_t	val;
605		int		rate;
606	} rates[] = {
607		{ IPW_RATE_DS1,   2 },
608		{ IPW_RATE_DS2,   4 },
609		{ IPW_RATE_DS5,  11 },
610		{ IPW_RATE_DS11, 22 },
611	};
612	u_int32_t val;
613	int rate, i;
614
615	imr->ifm_status = IFM_AVALID;
616	imr->ifm_active = IFM_IEEE80211;
617	if (ic->ic_state == IEEE80211_S_RUN)
618		imr->ifm_status |= IFM_ACTIVE;
619
620	/* read current transmission rate from adapter */
621	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
622	val &= 0xf;
623
624	/* convert rate to 802.11 rate */
625	for (i = 0; i < N(rates) && rates[i].val != val; i++);
626	rate = (i < N(rates)) ? rates[i].rate : 0;
627
628	imr->ifm_active |= IFM_IEEE80211_11B;
629	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
630	switch (ic->ic_opmode) {
631	case IEEE80211_M_STA:
632		break;
633
634	case IEEE80211_M_IBSS:
635		imr->ifm_active |= IFM_IEEE80211_IBSS;
636		break;
637
638	case IEEE80211_M_MONITOR:
639		imr->ifm_active |= IFM_IEEE80211_MONITOR;
640		break;
641
642	case IEEE80211_M_AHDEMO:
643	case IEEE80211_M_HOSTAP:
644		/* should not get there */
645		break;
646	}
647#undef N
648}
649
650int
651ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
652{
653	struct ipw_softc *sc = ic->ic_softc;
654	struct ieee80211_node *ni = ic->ic_bss;
655	u_int32_t len;
656	u_int8_t val;
657
658	switch (nstate) {
659	case IEEE80211_S_RUN:
660		len = IEEE80211_NWID_LEN;
661		ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
662		ni->ni_esslen = len;
663
664		val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
665		ni->ni_chan = &ic->ic_channels[val];
666
667		DELAY(100); /* firmware needs a short delay here */
668
669		len = IEEE80211_ADDR_LEN;
670		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
671		break;
672
673	case IEEE80211_S_INIT:
674	case IEEE80211_S_SCAN:
675	case IEEE80211_S_AUTH:
676	case IEEE80211_S_ASSOC:
677		break;
678	}
679
680	ic->ic_state = nstate;
681	return 0;
682}
683
684/*
685 * Read 16 bits at address 'addr' from the Microwire EEPROM.
686 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
687 */
688u_int16_t
689ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
690{
691	u_int32_t tmp;
692	u_int16_t val;
693	int n;
694
695	/* Clock C once before the first command */
696	IPW_EEPROM_CTL(sc, 0);
697	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
698	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
699	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
700
701	/* Write start bit (1) */
702	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
703	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
704
705	/* Write READ opcode (10) */
706	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
707	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
708	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
709	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
710
711	/* Write address A7-A0 */
712	for (n = 7; n >= 0; n--) {
713		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
714		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
715		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
716		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
717	}
718
719	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
720
721	/* Read data Q15-Q0 */
722	val = 0;
723	for (n = 15; n >= 0; n--) {
724		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
725		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
726		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
727		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
728	}
729
730	IPW_EEPROM_CTL(sc, 0);
731
732	/* Clear Chip Select and clock C */
733	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
734	IPW_EEPROM_CTL(sc, 0);
735	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
736
737	return letoh16(val);
738}
739
740void
741ipw_scan_result(struct ipw_softc *sc)
742{
743	struct ieee80211com *ic = &sc->sc_ic;
744	struct ieee80211_node *ni;
745	u_int32_t i, cnt, off;
746	struct ipw_node ap;
747
748	/* flush previously seen access points */
749	ieee80211_free_allnodes(ic);
750
751	cnt = ipw_read_table1(sc, IPW_INFO_APS_CNT);
752	off = ipw_read_table1(sc, IPW_INFO_APS_BASE);
753
754	DPRINTF(("Found %u APs\n", cnt));
755
756	for (i = 0; i < cnt; i++) {
757		ipw_read_mem_1(sc, off, (u_int8_t *)&ap, sizeof ap);
758		off += sizeof ap;
759
760#ifdef IPW_DEBUG
761		if (ipw_debug >= 2) {
762			u_char *p = (u_char *)&ap;
763			int j;
764
765			printf("AP%u\n", i);
766			for (j = 0; j < sizeof ap; j++)
767				printf("%02x", *p++);
768			printf("\n");
769		}
770#endif
771
772		ni = ieee80211_lookup_node(ic, ap.bssid,
773		    &ic->ic_channels[ap.chan]);
774		if (ni != NULL)
775			continue;
776
777		ni = ieee80211_alloc_node(ic, ap.bssid);
778		if (ni == NULL)
779			return;
780
781		IEEE80211_ADDR_COPY(ni->ni_bssid, ap.bssid);
782		ni->ni_rssi = ap.rssi;
783		ni->ni_intval = letoh16(ap.intval);
784		ni->ni_capinfo = letoh16(ap.capinfo);
785		ni->ni_chan = &ic->ic_channels[ap.chan];
786		ni->ni_esslen = ap.esslen;
787		bcopy(ap.essid, ni->ni_essid, IEEE80211_NWID_LEN);
788	}
789}
790
791void
792ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
793{
794	struct ipw_cmd *cmd;
795
796	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
797	    BUS_DMASYNC_POSTREAD);
798
799	cmd = mtod(sbuf->m, struct ipw_cmd *);
800
801	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
802	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
803	    letoh32(cmd->len), letoh32(cmd->status)));
804
805	wakeup(sc);
806}
807
808void
809ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
810{
811	struct ieee80211com *ic = &sc->sc_ic;
812	u_int32_t state;
813
814	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
815	    BUS_DMASYNC_POSTREAD);
816
817	state = letoh32(*mtod(sbuf->m, u_int32_t *));
818
819	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
820
821	switch (state) {
822	case IPW_STATE_ASSOCIATED:
823		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
824		break;
825
826	case IPW_STATE_SCANNING:
827		/* don't leave run state on background scan */
828		if (ic->ic_state != IEEE80211_S_RUN)
829			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
830		break;
831
832	case IPW_STATE_SCAN_COMPLETE:
833		ipw_scan_result(sc);
834		break;
835
836	case IPW_STATE_ASSOCIATION_LOST:
837		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
838		break;
839
840	case IPW_STATE_RADIO_DISABLED:
841		ipw_stop(&ic->ic_if, 1);
842		break;
843	}
844}
845
846void
847ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
848    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
849{
850	struct ieee80211com *ic = &sc->sc_ic;
851	struct ifnet *ifp = &ic->ic_if;
852	struct mbuf *m;
853	struct ieee80211_frame *wh;
854	struct ieee80211_node *ni;
855	int error;
856
857	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
858
859	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
860	    BUS_DMASYNC_POSTREAD);
861
862	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
863
864	/* Finalize mbuf */
865	m = sbuf->m;
866	m->m_pkthdr.rcvif = ifp;
867	m->m_pkthdr.len = m->m_len = letoh32(status->len);
868
869#if NBPFILTER > 0
870	if (sc->sc_drvbpf != NULL) {
871		struct mbuf mb;
872		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
873
874		tap->wr_flags = 0;
875		tap->wr_antsignal = status->rssi;
876		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
877		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
878
879		M_DUP_PKTHDR(&mb, m);
880		mb.m_data = (caddr_t)tap;
881		mb.m_len = sc->sc_rxtap_len;
882		mb.m_next = m;
883		mb.m_pkthdr.len += mb.m_len;
884		bpf_mtap(sc->sc_drvbpf, &mb);
885	}
886#endif
887
888	wh = mtod(m, struct ieee80211_frame *);
889
890	ni = ieee80211_find_rxnode(ic, wh);
891
892	/* Send the frame to the upper layer */
893	ieee80211_input(ifp, m, ni, status->rssi, 0);
894
895	if (ni == ic->ic_bss)
896		ieee80211_unref_node(&ni);
897	else
898		ieee80211_free_node(ic, ni);
899
900	MGETHDR(m, M_DONTWAIT, MT_DATA);
901	if (m == NULL) {
902		printf("%s: could not allocate rx mbuf\n",
903		    sc->sc_dev.dv_xname);
904		return;
905	}
906	MCLGET(m, M_DONTWAIT);
907	if (!(m->m_flags & M_EXT)) {
908		m_freem(m);
909		printf("%s: could not allocate rx mbuf cluster\n",
910		    sc->sc_dev.dv_xname);
911		return;
912	}
913
914	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
915	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
916	if (error != 0) {
917		printf("%s: could not map rx DMA memory\n",
918		    sc->sc_dev.dv_xname);
919		m_freem(m);
920		return;
921	}
922
923	sbuf->m = m;
924	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
925}
926
927void
928ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
929{
930	DPRINTFN(2, ("RX!NOTIFICATION\n"));
931}
932
933void
934ipw_rx_intr(struct ipw_softc *sc)
935{
936	struct ipw_status *status;
937	struct ipw_soft_bd *sbd;
938	struct ipw_soft_buf *sbuf;
939	u_int32_t r, i;
940
941	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
942
943	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
944
945		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
946		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
947		    BUS_DMASYNC_POSTREAD);
948
949		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
950		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
951		    BUS_DMASYNC_POSTREAD);
952
953		status = &sc->status_list[i];
954		sbd = &sc->srbd_list[i];
955		sbuf = sbd->priv;
956
957		switch (letoh16(status->code) & 0xf) {
958		case IPW_STATUS_CODE_COMMAND:
959			ipw_command_intr(sc, sbuf);
960			break;
961
962		case IPW_STATUS_CODE_NEWSTATE:
963			ipw_newstate_intr(sc, sbuf);
964			break;
965
966		case IPW_STATUS_CODE_DATA_802_3:
967		case IPW_STATUS_CODE_DATA_802_11:
968			ipw_data_intr(sc, status, sbd, sbuf);
969			break;
970
971		case IPW_STATUS_CODE_NOTIFICATION:
972			ipw_notification_intr(sc, sbuf);
973			break;
974
975		default:
976			printf("%s: unknown status code %u\n",
977			    sc->sc_dev.dv_xname, letoh16(status->code));
978		}
979		sbd->bd->flags = 0;
980
981		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
982		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
983		    BUS_DMASYNC_PREWRITE);
984	}
985
986	/* Tell the firmware what we have processed */
987	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
988	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
989}
990
991void
992ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
993{
994	struct ieee80211com *ic = &sc->sc_ic;
995	struct ipw_soft_hdr *shdr;
996	struct ipw_soft_buf *sbuf;
997
998	switch (sbd->type) {
999	case IPW_SBD_TYPE_COMMAND:
1000		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
1001		break;
1002
1003	case IPW_SBD_TYPE_HEADER:
1004		shdr = sbd->priv;
1005		bus_dmamap_unload(sc->sc_dmat, shdr->map);
1006		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1007		break;
1008
1009	case IPW_SBD_TYPE_DATA:
1010		sbuf = sbd->priv;
1011		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1012		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1013
1014		m_freem(sbuf->m);
1015
1016		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
1017			ieee80211_free_node(ic, sbuf->ni);
1018
1019		/* kill watchdog timer */
1020		sc->sc_tx_timer = 0;
1021		break;
1022	}
1023	sbd->type = IPW_SBD_TYPE_NOASSOC;
1024}
1025
1026void
1027ipw_tx_intr(struct ipw_softc *sc)
1028{
1029	struct ifnet *ifp = &sc->sc_ic.ic_if;
1030	u_int32_t r, i;
1031
1032	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1033
1034	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1035		ipw_release_sbd(sc, &sc->stbd_list[i]);
1036		sc->txfree++;
1037	}
1038
1039	/* Remember what the firmware has processed */
1040	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1041
1042	/* Call start() since some buffer descriptors have been released */
1043	if (sc->txfree >= 1 + IPW_MAX_NSEG) {
1044		ifp->if_flags &= ~IFF_OACTIVE;
1045		(*ifp->if_start)(ifp);
1046	}
1047}
1048
1049int
1050ipw_intr(void *arg)
1051{
1052	struct ipw_softc *sc = arg;
1053	u_int32_t r;
1054
1055	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1056		return 0;
1057
1058	/* Disable interrupts */
1059	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1060
1061	DPRINTFN(8, ("INTR!0x%08x\n", r));
1062
1063	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1064		printf("%s: fatal error\n", sc->sc_dev.dv_xname);
1065		ipw_stop(&sc->sc_ic.ic_if, 1);
1066	}
1067
1068	if (r & IPW_INTR_FW_INIT_DONE) {
1069		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1070			wakeup(sc);
1071	}
1072
1073	if (r & IPW_INTR_RX_TRANSFER)
1074		ipw_rx_intr(sc);
1075
1076	if (r & IPW_INTR_TX_TRANSFER)
1077		ipw_tx_intr(sc);
1078
1079	/* Acknowledge interrupts */
1080	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1081
1082	/* Re-enable interrupts */
1083	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1084
1085	return 1;
1086}
1087
1088int
1089ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
1090{
1091	struct ipw_soft_bd *sbd;
1092	int error;
1093
1094	sbd = &sc->stbd_list[sc->txcur];
1095
1096	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1097	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1098	if (error != 0) {
1099		printf("%s: could not map command DMA memory\n",
1100		    sc->sc_dev.dv_xname);
1101		return error;
1102	}
1103
1104	sc->cmd.type = htole32(type);
1105	sc->cmd.subtype = htole32(0);
1106	sc->cmd.len = htole32(len);
1107	sc->cmd.seq = htole32(0);
1108	if (data != NULL)
1109		bcopy(data, sc->cmd.data, len);
1110
1111	sbd->type = IPW_SBD_TYPE_COMMAND;
1112	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1113	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1114	sbd->bd->nfrag = 1;
1115	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1116			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
1117
1118	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1119	    BUS_DMASYNC_PREWRITE);
1120
1121	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1122	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1123	    BUS_DMASYNC_PREWRITE);
1124
1125	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1126	sc->txfree--;
1127	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1128
1129	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1130
1131	/* Wait at most one second for command to complete */
1132	return tsleep(sc, 0, "ipwcmd", hz);
1133}
1134
1135int
1136ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1137{
1138	struct ipw_softc *sc = ifp->if_softc;
1139	struct ieee80211com *ic = &sc->sc_ic;
1140	struct ieee80211_frame *wh;
1141	struct ipw_soft_bd *sbd;
1142	struct ipw_soft_hdr *shdr;
1143	struct ipw_soft_buf *sbuf;
1144	int error, i;
1145
1146	if (ic->ic_flags & IEEE80211_F_WEPON) {
1147		m = ieee80211_wep_crypt(ifp, m, 1);
1148		if (m == NULL)
1149			return ENOBUFS;
1150	}
1151
1152#if NBPFILTER > 0
1153	if (sc->sc_drvbpf != NULL) {
1154		struct mbuf mb;
1155		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1156
1157		tap->wt_flags = 0;
1158		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1159		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1160
1161		M_DUP_PKTHDR(&mb, m);
1162		mb.m_data = (caddr_t)tap;
1163		mb.m_len = sc->sc_txtap_len;
1164		mb.m_next = m;
1165		mb.m_pkthdr.len += mb.m_len;
1166		bpf_mtap(sc->sc_drvbpf, &mb);
1167	}
1168#endif
1169
1170	wh = mtod(m, struct ieee80211_frame *);
1171
1172	shdr = SLIST_FIRST(&sc->free_shdr);
1173	sbuf = SLIST_FIRST(&sc->free_sbuf);
1174
1175	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1176	shdr->hdr.subtype = htole32(0);
1177	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1178	shdr->hdr.encrypt = 0;
1179	shdr->hdr.keyidx = 0;
1180	shdr->hdr.keysz = 0;
1181	shdr->hdr.fragmentsz = htole16(0);
1182	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1183	if (ic->ic_opmode == IEEE80211_M_STA)
1184		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1185	else
1186		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1187
1188	/* trim IEEE802.11 header */
1189	m_adj(m, sizeof (struct ieee80211_frame));
1190
1191	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1192	if (error != 0) {
1193		printf("%s: could not map mbuf (error %d)\n",
1194		    sc->sc_dev.dv_xname, error);
1195		m_freem(m);
1196		return error;
1197	}
1198
1199	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1200	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1201	if (error != 0) {
1202		printf("%s: could not map header DMA memory (error %d)\n",
1203		    sc->sc_dev.dv_xname, error);
1204		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1205		m_freem(m);
1206		return error;
1207	}
1208
1209	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1210	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1211
1212	sbd = &sc->stbd_list[sc->txcur];
1213	sbd->type = IPW_SBD_TYPE_HEADER;
1214	sbd->priv = shdr;
1215	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1216	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1217	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1218	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1219			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1220
1221	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1222	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1223	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1224	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1225
1226	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1227	    sc->txcur * sizeof (struct ipw_bd),
1228	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1229
1230	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1231	sc->txfree--;
1232
1233	sbuf->m = m;
1234	sbuf->ni = ni;
1235
1236	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1237		sbd = &sc->stbd_list[sc->txcur];
1238		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1239		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1240		sbd->bd->nfrag = 0; /* used only in first bd */
1241		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1242		if (i == sbuf->map->dm_nsegs - 1) {
1243			sbd->type = IPW_SBD_TYPE_DATA;
1244			sbd->priv = sbuf;
1245			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1246		} else {
1247			sbd->type = IPW_SBD_TYPE_NOASSOC;
1248			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1249		}
1250
1251		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1252		    sbuf->map->dm_segs[i].ds_len));
1253
1254		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1255		    sc->txcur * sizeof (struct ipw_bd),
1256		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1257
1258		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1259		sc->txfree--;
1260	}
1261
1262	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1263	    BUS_DMASYNC_PREWRITE);
1264
1265	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
1266	    BUS_DMASYNC_PREWRITE);
1267
1268	/* Inform firmware about this new packet */
1269	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1270
1271	if (sc->txfree < 1 + IPW_MAX_NSEG)
1272		ifp->if_flags |= IFF_OACTIVE;
1273
1274	return 0;
1275}
1276
1277void
1278ipw_start(struct ifnet *ifp)
1279{
1280	struct ipw_softc *sc = ifp->if_softc;
1281	struct ieee80211com *ic = &sc->sc_ic;
1282	struct mbuf *m;
1283	struct ieee80211_node *ni;
1284
1285	if (ic->ic_state != IEEE80211_S_RUN)
1286		return;
1287
1288	for (;;) {
1289		IF_DEQUEUE(&ifp->if_snd, m);
1290		if (m == NULL)
1291			break;
1292
1293#if NBPFILTER > 0
1294		if (ifp->if_bpf != NULL)
1295			bpf_mtap(ifp->if_bpf, m);
1296#endif
1297
1298		m = ieee80211_encap(ifp, m, &ni);
1299		if (m == NULL)
1300			continue;
1301
1302#if NBPFILTER > 0
1303		if (ic->ic_rawbpf != NULL)
1304			bpf_mtap(ic->ic_rawbpf, m);
1305#endif
1306
1307		if (ipw_tx_start(ifp, m, ni) != 0) {
1308			if (ni != NULL && ni != ic->ic_bss)
1309				ieee80211_free_node(ic, ni);
1310			break;
1311		}
1312
1313		/* start watchdog timer */
1314		sc->sc_tx_timer = 5;
1315		ifp->if_timer = 1;
1316	}
1317}
1318
1319void
1320ipw_watchdog(struct ifnet *ifp)
1321{
1322	struct ipw_softc *sc = ifp->if_softc;
1323
1324	ifp->if_timer = 0;
1325
1326	if (sc->sc_tx_timer > 0) {
1327		if (--sc->sc_tx_timer == 0) {
1328			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1329			ipw_stop(ifp, 1);
1330			return;
1331		}
1332		ifp->if_timer = 1;
1333	}
1334
1335	ieee80211_watchdog(ifp);
1336}
1337
1338int
1339ipw_get_table1(struct ipw_softc *sc, u_int32_t *tbl)
1340{
1341	u_int32_t i, size, buf[256];
1342
1343	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
1344		bzero(buf, sizeof buf);
1345		return copyout(buf, tbl, sizeof buf);
1346	}
1347
1348	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
1349
1350	size = min(CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA), 256);
1351	for (i = 1; i < size; i++)
1352		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
1353
1354	return copyout(buf, tbl, sizeof buf);
1355}
1356
1357int
1358ipw_get_radio(struct ipw_softc *sc, int *ret)
1359{
1360	int val;
1361
1362	val = (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ? 0 : 1;
1363	return copyout(&val, ret, sizeof val);
1364}
1365
1366int
1367ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1368{
1369	struct ipw_softc *sc = ifp->if_softc;
1370	struct ifreq *ifr;
1371	struct ifaddr *ifa;
1372	int s, error = 0;
1373
1374	s = splnet();
1375
1376	switch (cmd) {
1377	case SIOCSIFADDR:
1378		ifa = (struct ifaddr *) data;
1379		ifp->if_flags |= IFF_UP;
1380		switch (ifa->ifa_addr->sa_family) {
1381#ifdef INET
1382		case AF_INET:
1383			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
1384			ipw_init(ifp);
1385			break;
1386#endif
1387		default:
1388			ipw_init(ifp);
1389		}
1390		break;
1391
1392	case SIOCSIFFLAGS:
1393		if (ifp->if_flags & IFF_UP) {
1394			if (!(ifp->if_flags & IFF_RUNNING))
1395				ipw_init(ifp);
1396		} else {
1397			if (ifp->if_flags & IFF_RUNNING)
1398				ipw_stop(ifp, 1);
1399		}
1400		break;
1401
1402	case SIOCGTABLE1:
1403		ifr = (struct ifreq *)data;
1404		error = ipw_get_table1(sc, (u_int32_t *)ifr->ifr_data);
1405		break;
1406
1407	case SIOCGRADIO:
1408		ifr = (struct ifreq *)data;
1409		error = ipw_get_radio(sc, (int *)ifr->ifr_data);
1410		break;
1411
1412	case SIOCG80211AUTH:
1413		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1414		break;
1415
1416	case SIOCS80211AUTH:
1417		/* only super-user can do that! */
1418		if ((error = suser(curproc, 0)) != 0)
1419			break;
1420
1421		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1422		break;
1423
1424	default:
1425		error = ieee80211_ioctl(ifp, cmd, data);
1426	}
1427
1428	if (error == ENETRESET && cmd != SIOCADDMULTI) {
1429		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1430		    (IFF_UP | IFF_RUNNING))
1431			ipw_init(ifp);
1432		error = 0;
1433	}
1434
1435	splx(s);
1436	return error;
1437}
1438
1439u_int32_t
1440ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1441{
1442	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1443}
1444
1445void
1446ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1447{
1448	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1449}
1450
1451int
1452ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1453{
1454	u_int32_t addr, info;
1455	u_int16_t count, size;
1456	u_int32_t total;
1457
1458	/* addr[4] + count[2] + size[2] */
1459	addr = MEM_READ_4(sc, sc->table2_base + off);
1460	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1461
1462	count = info >> 16;
1463	size = info & 0xffff;
1464	total = count * size;
1465
1466	if (total > *len) {
1467		*len = total;
1468		return EINVAL;
1469	}
1470
1471	*len = total;
1472	ipw_read_mem_1(sc, addr, buf, total);
1473
1474	return 0;
1475}
1476
1477void
1478ipw_stop_master(struct ipw_softc *sc)
1479{
1480	int ntries;
1481
1482	/* Disable interrupts */
1483	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1484
1485	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1486	for (ntries = 0; ntries < 50; ntries++) {
1487		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1488			break;
1489		DELAY(10);
1490	}
1491	if (ntries == 50)
1492		printf("%s: timeout waiting for master\n",
1493		    sc->sc_dev.dv_xname);
1494
1495	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1496	    IPW_RST_PRINCETON_RESET);
1497
1498	sc->flags &= ~IPW_FLAG_FW_INITED;
1499}
1500
1501int
1502ipw_reset(struct ipw_softc *sc)
1503{
1504	int ntries;
1505
1506	ipw_stop_master(sc);
1507
1508	/* Move adapter to D0 state */
1509	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1510	    IPW_CTL_INIT);
1511
1512	/* Wait for clock stabilization */
1513	for (ntries = 0; ntries < 1000; ntries++) {
1514		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1515			break;
1516		DELAY(200);
1517	}
1518	if (ntries == 1000)
1519		return EIO;
1520
1521	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1522	    IPW_RST_SW_RESET);
1523
1524	DELAY(10);
1525
1526	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1527	    IPW_CTL_INIT);
1528
1529	return 0;
1530}
1531
1532int
1533ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1534{
1535	int ntries;
1536
1537	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1538	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1539
1540	MEM_WRITE_2(sc, 0x220000, 0x0703);
1541	MEM_WRITE_2(sc, 0x220000, 0x0707);
1542
1543	MEM_WRITE_1(sc, 0x210014, 0x72);
1544	MEM_WRITE_1(sc, 0x210014, 0x72);
1545
1546	MEM_WRITE_1(sc, 0x210000, 0x40);
1547	MEM_WRITE_1(sc, 0x210000, 0x00);
1548	MEM_WRITE_1(sc, 0x210000, 0x40);
1549
1550	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1551
1552	MEM_WRITE_1(sc, 0x210000, 0x00);
1553	MEM_WRITE_1(sc, 0x210000, 0x00);
1554	MEM_WRITE_1(sc, 0x210000, 0x80);
1555
1556	MEM_WRITE_2(sc, 0x220000, 0x0703);
1557	MEM_WRITE_2(sc, 0x220000, 0x0707);
1558
1559	MEM_WRITE_1(sc, 0x210014, 0x72);
1560	MEM_WRITE_1(sc, 0x210014, 0x72);
1561
1562	MEM_WRITE_1(sc, 0x210000, 0x00);
1563	MEM_WRITE_1(sc, 0x210000, 0x80);
1564
1565	for (ntries = 0; ntries < 100; ntries++) {
1566		if (MEM_READ_1(sc, 0x210000) & 1)
1567			break;
1568		DELAY(1000);
1569	}
1570	if (ntries == 100) {
1571		printf("%s: timeout waiting for ucode to initialize\n",
1572		    sc->sc_dev.dv_xname);
1573		return EIO;
1574	}
1575
1576	MEM_WRITE_4(sc, 0x3000e0, 0);
1577
1578	return 0;
1579}
1580
1581/* set of macros to handle unaligned little endian data in firmware image */
1582#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1583#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1584int
1585ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1586{
1587	u_char *p, *end;
1588	u_int32_t dst;
1589	u_int16_t len;
1590	int error;
1591
1592	p = fw;
1593	end = fw + size;
1594	while (p < end) {
1595		if (p + 6 > end)
1596			return EINVAL;
1597
1598		dst = GETLE32(p); p += 4;
1599		len = GETLE16(p); p += 2;
1600
1601		if (p + len > end)
1602			return EINVAL;
1603
1604		ipw_write_mem_1(sc, dst, p, len);
1605		p += len;
1606	}
1607
1608	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1609	    IPW_IO_LED_OFF);
1610
1611	/* Allow interrupts so we know when the firmware is inited */
1612	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1613
1614	/* Tell the adapter to initialize the firmware */
1615	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1616	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1617	    IPW_CTL_ALLOW_STANDBY);
1618
1619	/* Wait at most one second for firmware initialization to complete */
1620	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1621		printf("%s: timeout waiting for firmware initialization to "
1622		    "complete\n", sc->sc_dev.dv_xname);
1623		return error;
1624	}
1625
1626	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1627	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1628
1629	return 0;
1630}
1631
1632int
1633ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1634{
1635	struct ipw_firmware_hdr *hdr;
1636	const char *name;
1637	u_char *p;
1638	size_t size;
1639	int error;
1640
1641	switch (sc->sc_ic.ic_opmode) {
1642	case IEEE80211_M_STA:
1643	case IEEE80211_M_HOSTAP:
1644		name = "ipw-bss";
1645		break;
1646
1647	case IEEE80211_M_IBSS:
1648	case IEEE80211_M_AHDEMO:
1649		name = "ipw-ibss";
1650		break;
1651
1652	case IEEE80211_M_MONITOR:
1653		name = "ipw-monitor";
1654		break;
1655	}
1656
1657	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1658		return error;
1659
1660	if (size < sizeof (struct ipw_firmware_hdr)) {
1661		error = EINVAL;
1662		goto fail;
1663	}
1664
1665	p = fw->data;
1666	hdr = (struct ipw_firmware_hdr *)p;
1667	fw->main_size = letoh32(hdr->main_size);
1668	fw->ucode_size = letoh32(hdr->ucode_size);
1669
1670	p += sizeof (struct ipw_firmware_hdr);
1671	size -= sizeof (struct ipw_firmware_hdr);
1672
1673	if (size < fw->main_size + fw->ucode_size) {
1674		error = EINVAL;
1675		goto fail;
1676	}
1677
1678	fw->main = p;
1679	fw->ucode = p + fw->main_size;
1680
1681	return 0;
1682
1683fail:	free(fw->data, M_DEVBUF);
1684	return error;
1685}
1686
1687int
1688ipw_config(struct ipw_softc *sc)
1689{
1690	struct ieee80211com *ic = &sc->sc_ic;
1691	struct ifnet *ifp = &ic->ic_if;
1692	struct ipw_security security;
1693	struct ieee80211_wepkey *k;
1694	struct ipw_wep_key wepkey;
1695	struct ipw_scan_options options;
1696	struct ipw_configuration config;
1697	u_int32_t data;
1698	int error, i;
1699
1700	switch (ic->ic_opmode) {
1701	case IEEE80211_M_STA:
1702	case IEEE80211_M_HOSTAP:
1703		data = htole32(IPW_MODE_BSS);
1704		break;
1705
1706	case IEEE80211_M_IBSS:
1707	case IEEE80211_M_AHDEMO:
1708		data = htole32(IPW_MODE_IBSS);
1709		break;
1710
1711	case IEEE80211_M_MONITOR:
1712		data = htole32(IPW_MODE_MONITOR);
1713		break;
1714	}
1715	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1716	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1717	if (error != 0)
1718		return error;
1719
1720	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1721	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1722		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1723		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1724		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1725		if (error != 0)
1726			return error;
1727	}
1728
1729	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1730		DPRINTF(("Enabling adapter\n"));
1731		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1732	}
1733
1734	IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1735	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1736	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1737	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1738	    IEEE80211_ADDR_LEN);
1739	if (error != 0)
1740		return error;
1741
1742	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1743	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1744	if (ic->ic_opmode == IEEE80211_M_IBSS)
1745		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1746	if (ifp->if_flags & IFF_PROMISC)
1747		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1748	config.bss_chan = htole32(0x3fff); /* channels 1-14 */
1749	config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
1750	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1751	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1752	if (error != 0)
1753		return error;
1754
1755	data = htole32(0x3); /* 1, 2 */
1756	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1757	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1758	if (error != 0)
1759		return error;
1760
1761	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1762	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1763	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1764	if (error != 0)
1765		return error;
1766
1767	data = htole32(IPW_POWER_MODE_CAM);
1768	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1769	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1770	if (error != 0)
1771		return error;
1772
1773	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1774		data = htole32(32); /* default value */
1775		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1776		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1777		    sizeof data);
1778		if (error != 0)
1779			return error;
1780	}
1781
1782	data = htole32(ic->ic_rtsthreshold);
1783	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1784	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1785	if (error != 0)
1786		return error;
1787
1788	data = htole32(ic->ic_fragthreshold);
1789	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1790	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1791	if (error != 0)
1792		return error;
1793
1794#ifdef IPW_DEBUG
1795	if (ipw_debug > 0) {
1796		printf("Setting ESSID to ");
1797		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1798		printf("\n");
1799	}
1800#endif
1801	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1802	    ic->ic_des_esslen);
1803	if (error != 0)
1804		return error;
1805
1806	/* no mandatory BSSID */
1807	DPRINTF(("Setting mandatory BSSID to null\n"));
1808	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1809	if (error != 0)
1810		return error;
1811
1812	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1813		DPRINTF(("Setting adapter BSSID to %s\n",
1814		    ether_sprintf(ic->ic_des_bssid)));
1815		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1816		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1817		if (error != 0)
1818			return error;
1819	}
1820
1821	bzero(&security, sizeof security);
1822	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1823	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1824	security.ciphers = htole32(IPW_CIPHER_NONE);
1825	DPRINTF(("Setting authmode to %u\n", security.authmode));
1826	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1827	    sizeof security);
1828	if (error != 0)
1829		return error;
1830
1831	if (ic->ic_flags & IEEE80211_F_WEPON) {
1832		k = ic->ic_nw_keys;
1833		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1834			if (k->wk_len == 0)
1835				continue;
1836
1837			wepkey.idx = i;
1838			wepkey.len = k->wk_len;
1839			bzero(wepkey.key, sizeof wepkey.key);
1840			bcopy(k->wk_key, wepkey.key, k->wk_len);
1841			DPRINTF(("Setting wep key index %u len %u\n",
1842			    wepkey.idx, wepkey.len));
1843			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1844			    sizeof wepkey);
1845			if (error != 0)
1846				return error;
1847		}
1848
1849		data = htole32(ic->ic_wep_txkey);
1850		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1851		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1852		    sizeof data);
1853		if (error != 0)
1854			return error;
1855	}
1856
1857	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1858	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1859	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1860	if (error != 0)
1861		return error;
1862
1863	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1864	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1865		data = htole32(ic->ic_lintval);
1866		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1867		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1868		    sizeof data);
1869		if (error != 0)
1870			return error;
1871	}
1872
1873	options.flags = htole32(0);
1874	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1875	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1876	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1877	if (error != 0)
1878		return error;
1879
1880	/* finally, enable adapter (start scanning for an access point) */
1881	DPRINTF(("Enabling adapter\n"));
1882	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1883}
1884
1885int
1886ipw_init(struct ifnet *ifp)
1887{
1888	struct ipw_softc *sc = ifp->if_softc;
1889	struct ipw_firmware fw;
1890	int error;
1891
1892	ipw_stop(ifp, 0);
1893
1894	if ((error = ipw_reset(sc)) != 0) {
1895		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1896		goto fail1;
1897	}
1898
1899	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1900		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1901		goto fail1;
1902	}
1903
1904	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1905		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1906		goto fail2;
1907	}
1908
1909	ipw_stop_master(sc);
1910
1911	/*
1912	 * Setup tx, rx and status rings
1913	 */
1914	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1915	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1916	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1917	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1918	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1919	sc->txcur = 0; /* bd index to write to */
1920	sc->txfree = IPW_NTBD - 2;
1921
1922	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1923	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1924	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1925	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1926	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
1927
1928	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1929	    sc->status_map->dm_segs[0].ds_addr);
1930
1931	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1932		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1933		goto fail2;
1934	}
1935
1936	sc->flags |= IPW_FLAG_FW_INITED;
1937
1938	/* Retrieve information tables base addresses */
1939	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1940	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1941
1942	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1943
1944	if ((error = ipw_config(sc)) != 0) {
1945		printf("%s: device configuration failed\n",
1946		    sc->sc_dev.dv_xname);
1947		goto fail2;
1948	}
1949
1950	ifp->if_flags &= ~IFF_OACTIVE;
1951	ifp->if_flags |= IFF_RUNNING;
1952
1953	return 0;
1954
1955fail2:	free(fw.data, M_DEVBUF);
1956fail1:	ipw_stop(ifp, 0);
1957
1958	return error;
1959}
1960
1961void
1962ipw_stop(struct ifnet *ifp, int disable)
1963{
1964	struct ipw_softc *sc = ifp->if_softc;
1965	struct ieee80211com *ic = &sc->sc_ic;
1966	int i;
1967
1968	ipw_stop_master(sc);
1969	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1970
1971	/*
1972	 * Release tx buffers
1973	 */
1974	for (i = 0; i < IPW_NTBD; i++)
1975		ipw_release_sbd(sc, &sc->stbd_list[i]);
1976
1977	ifp->if_timer = 0;
1978	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1979
1980	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1981}
1982
1983void
1984ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1985    bus_size_t count)
1986{
1987	for (; count > 0; offset++, datap++, count--) {
1988		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1989		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
1990	}
1991}
1992
1993void
1994ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1995    bus_size_t count)
1996{
1997	for (; count > 0; offset++, datap++, count--) {
1998		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1999		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2000	}
2001}
2002
2003struct cfdriver ipw_cd = {
2004	0, "ipw", DV_IFNET
2005};
2006