if_ipw.c revision 1.35
1/*	$Id: if_ipw.c,v 1.35 2004/12/06 20:27:15 damien Exp $  */
2
3/*-
4 * Copyright (c) 2004
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46#include <sys/device.h>
47
48#include <machine/bus.h>
49#include <machine/endian.h>
50#include <machine/intr.h>
51
52#include <dev/pci/pcireg.h>
53#include <dev/pci/pcivar.h>
54#include <dev/pci/pcidevs.h>
55
56#if NBPFILTER > 0
57#include <net/bpf.h>
58#endif
59#include <net/if.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_media.h>
63#include <net/if_types.h>
64
65#include <netinet/in.h>
66#include <netinet/in_systm.h>
67#include <netinet/in_var.h>
68#include <netinet/if_ether.h>
69#include <netinet/ip.h>
70
71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <dev/pci/if_ipwreg.h>
75#include <dev/pci/if_ipwvar.h>
76
77static const struct ieee80211_rateset ipw_rateset_11b =
78	{ 4, { 2, 4, 11, 22 } };
79
80int ipw_match(struct device *, void *, void *);
81void ipw_attach(struct device *, struct device *, void *);
82int ipw_detach(struct device *, int);
83int ipw_dma_alloc(struct ipw_softc *);
84void ipw_release(struct ipw_softc *);
85int ipw_media_change(struct ifnet *);
86void ipw_media_status(struct ifnet *, struct ifmediareq *);
87int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
88u_int16_t ipw_read_prom_word(struct ipw_softc *, u_int8_t);
89void ipw_scan_result(struct ipw_softc *);
90void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
91void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
92void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
93    struct ipw_soft_bd *, struct ipw_soft_buf *);
94void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
95void ipw_rx_intr(struct ipw_softc *);
96void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
97void ipw_tx_intr(struct ipw_softc *);
98int ipw_intr(void *);
99int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
100int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
101void ipw_start(struct ifnet *);
102void ipw_watchdog(struct ifnet *);
103int ipw_get_table1(struct ipw_softc *, u_int32_t *);
104int ipw_get_radio(struct ipw_softc *, int *);
105int ipw_ioctl(struct ifnet *, u_long, caddr_t);
106u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
107void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
108int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
109void ipw_stop_master(struct ipw_softc *);
110int ipw_reset(struct ipw_softc *);
111int ipw_load_ucode(struct ipw_softc *, u_char *, int);
112int ipw_load_firmware(struct ipw_softc *, u_char *, int);
113int ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
114int ipw_config(struct ipw_softc *);
115int ipw_init(struct ifnet *);
116void ipw_stop(struct ifnet *, int);
117void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
118void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
119
120static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
121{
122	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
123	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
124}
125
126static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
127{
128	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
129	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
130}
131
132#ifdef IPW_DEBUG
133#define DPRINTF(x)	if (ipw_debug > 0) printf x
134#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
135int ipw_debug = 0;
136#else
137#define DPRINTF(x)
138#define DPRINTFN(n, x)
139#endif
140
141struct cfattach ipw_ca = {
142	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
143};
144
145int
146ipw_match(struct device *parent, void *match, void *aux)
147{
148	struct pci_attach_args *pa = aux;
149
150	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
151	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
152		return 1;
153
154	return 0;
155}
156
157/* Base Address Register */
158#define IPW_PCI_BAR0	0x10
159
160void
161ipw_attach(struct device *parent, struct device *self, void *aux)
162{
163	struct ipw_softc *sc = (struct ipw_softc *)self;
164	struct ieee80211com *ic = &sc->sc_ic;
165	struct ifnet *ifp = &ic->ic_if;
166	struct pci_attach_args *pa = aux;
167	const char *intrstr;
168	bus_space_tag_t memt;
169	bus_space_handle_t memh;
170	bus_addr_t base;
171	pci_intr_handle_t ih;
172	pcireg_t data;
173	u_int16_t val;
174	int error, i;
175
176	sc->sc_pct = pa->pa_pc;
177
178	data = pci_conf_read(sc->sc_pct, pa->pa_tag, 0x40);
179	data &= ~0x0000ff00;
180	pci_conf_write(sc->sc_pct, pa->pa_tag, 0x40, data);
181
182	/* enable bus-mastering */
183	data = pci_conf_read(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG);
184	data |= PCI_COMMAND_MASTER_ENABLE;
185	pci_conf_write(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG, data);
186
187	/* map the register window */
188	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
189	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
190	if (error != 0) {
191		printf(": could not map memory space\n");
192		return;
193	}
194
195	sc->sc_st = memt;
196	sc->sc_sh = memh;
197	sc->sc_dmat = pa->pa_dmat;
198
199	/* disable interrupts */
200	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
201
202	if (pci_intr_map(pa, &ih) != 0) {
203		printf(": could not map interrupt\n");
204		return;
205	}
206
207	intrstr = pci_intr_string(sc->sc_pct, ih);
208	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
209	    sc->sc_dev.dv_xname);
210	if (sc->sc_ih == NULL) {
211		printf(": could not establish interrupt");
212		if (intrstr != NULL)
213			printf(" at %s", intrstr);
214		printf("\n");
215		return;
216	}
217	printf(": %s", intrstr);
218
219	if (ipw_reset(sc) != 0) {
220		printf(": could not reset adapter\n");
221		return;
222	}
223
224	if (ipw_dma_alloc(sc) != 0) {
225		printf(": failed to allocate DMA resources\n");
226		return;
227	}
228
229	ic->ic_phytype = IEEE80211_T_DS;
230	ic->ic_opmode = IEEE80211_M_STA;
231	ic->ic_state = IEEE80211_S_INIT;
232
233	/* set device capabilities */
234	ic->ic_caps = IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
235	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP |
236	    IEEE80211_C_SHPREAMBLE;
237
238	/* read MAC address from EEPROM */
239	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
240	ic->ic_myaddr[0] = val >> 8;
241	ic->ic_myaddr[1] = val & 0xff;
242	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
243	ic->ic_myaddr[2] = val >> 8;
244	ic->ic_myaddr[3] = val & 0xff;
245	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
246	ic->ic_myaddr[4] = val >> 8;
247	ic->ic_myaddr[5] = val & 0xff;
248
249	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
250
251	/* set supported .11b rates */
252	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
253
254	/* set supported .11b channels (1 through 14) */
255	for (i = 1; i <= 14; i++) {
256		ic->ic_channels[i].ic_freq =
257		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
258		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
259	}
260
261	/* default to authmode OPEN */
262	sc->authmode = IEEE80211_AUTH_OPEN;
263
264	/* IBSS channel undefined for now */
265	ic->ic_ibss_chan = &ic->ic_channels[0];
266
267	ifp->if_softc = sc;
268	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
269	ifp->if_init = ipw_init;
270	ifp->if_ioctl = ipw_ioctl;
271	ifp->if_start = ipw_start;
272	ifp->if_watchdog = ipw_watchdog;
273	IFQ_SET_READY(&ifp->if_snd);
274	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
275
276	if_attach(ifp);
277	ieee80211_ifattach(ifp);
278	/* override state transition machine */
279	sc->sc_newstate = ic->ic_newstate;
280	ic->ic_newstate = ipw_newstate;
281	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
282
283#if NBPFILTER > 0
284	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
285	    sizeof (struct ieee80211_frame) + 64);
286
287	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
288	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
289	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
290
291	sc->sc_txtap_len = sizeof sc->sc_txtapu;
292	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
293	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
294#endif
295}
296
297int
298ipw_detach(struct device* self, int flags)
299{
300	struct ipw_softc *sc = (struct ipw_softc *)self;
301	struct ifnet *ifp = &sc->sc_ic.ic_if;
302
303	ipw_stop(ifp, 1);
304
305#if NBPFILTER > 0
306	bpfdetach(ifp);
307#endif
308	ieee80211_ifdetach(ifp);
309	if_detach(ifp);
310
311	ipw_release(sc);
312
313	if (sc->sc_ih != NULL) {
314		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
315		sc->sc_ih = NULL;
316	}
317
318	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
319
320	return 0;
321}
322
323int
324ipw_dma_alloc(struct ipw_softc *sc)
325{
326	struct ipw_soft_bd *sbd;
327	struct ipw_soft_hdr *shdr;
328	struct ipw_soft_buf *sbuf;
329	int i, nsegs, error;
330
331	/*
332	 * Allocate and map tx ring
333	 */
334	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
335	    BUS_DMA_NOWAIT, &sc->tbd_map);
336	if (error != 0) {
337		printf("%s: could not create tx ring DMA map\n",
338		    sc->sc_dev.dv_xname);
339		goto fail;
340	}
341
342	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
343	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
344	if (error != 0) {
345		printf("%s: could not allocate tx ring DMA memory\n",
346		    sc->sc_dev.dv_xname);
347		goto fail;
348	}
349
350	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
351	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
352	if (error != 0) {
353		printf("%s: could not map tx ring DMA memory\n",
354		    sc->sc_dev.dv_xname);
355		goto fail;
356	}
357
358	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
359	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
360	if (error != 0) {
361		printf("%s: could not load tx ring DMA map\n",
362		    sc->sc_dev.dv_xname);
363		goto fail;
364	}
365
366	/*
367	 * Allocate and map rx ring
368	 */
369	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
370	    BUS_DMA_NOWAIT, &sc->rbd_map);
371	if (error != 0) {
372		printf("%s: could not create rx ring DMA map\n",
373		    sc->sc_dev.dv_xname);
374		goto fail;
375	}
376
377	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
378	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
379	if (error != 0) {
380		printf("%s: could not allocate rx ring DMA memory\n",
381		    sc->sc_dev.dv_xname);
382		goto fail;
383	}
384
385	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
386	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
387	if (error != 0) {
388		printf("%s: could not map rx ring DMA memory\n",
389		    sc->sc_dev.dv_xname);
390		goto fail;
391	}
392
393	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
394	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
395	if (error != 0) {
396		printf("%s: could not load tx ring DMA map\n",
397		    sc->sc_dev.dv_xname);
398		goto fail;
399	}
400
401	/*
402	 * Allocate and map status ring
403	 */
404	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
405	    0, BUS_DMA_NOWAIT, &sc->status_map);
406	if (error != 0) {
407		printf("%s: could not create status ring DMA map\n",
408		    sc->sc_dev.dv_xname);
409		goto fail;
410	}
411
412	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
413	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
414	if (error != 0) {
415		printf("%s: could not allocate status ring DMA memory\n",
416		    sc->sc_dev.dv_xname);
417		goto fail;
418	}
419
420	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
421	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
422	if (error != 0) {
423		printf("%s: could not map status ring DMA memory\n",
424		    sc->sc_dev.dv_xname);
425		goto fail;
426	}
427
428	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
429	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
430	if (error != 0) {
431		printf("%s: could not load status ring DMA map\n",
432		    sc->sc_dev.dv_xname);
433		goto fail;
434	}
435
436	/*
437	 * Allocate command DMA map
438	 */
439	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
440	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
441	if (error != 0) {
442		printf("%s: could not create command DMA map\n",
443		    sc->sc_dev.dv_xname);
444		goto fail;
445	}
446
447	/*
448	 * Allocate headers DMA maps
449	 */
450	SLIST_INIT(&sc->free_shdr);
451	for (i = 0; i < IPW_NDATA; i++) {
452		shdr = &sc->shdr_list[i];
453		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
454		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
455		if (error != 0) {
456			printf("%s: could not create header DMA map\n",
457			    sc->sc_dev.dv_xname);
458			goto fail;
459		}
460		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
461	}
462
463	/*
464	 * Allocate tx buffers DMA maps
465	 */
466	SLIST_INIT(&sc->free_sbuf);
467	for (i = 0; i < IPW_NDATA; i++) {
468		sbuf = &sc->tx_sbuf_list[i];
469		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
470		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
471		if (error != 0) {
472			printf("%s: could not create tx DMA map\n",
473			    sc->sc_dev.dv_xname);
474			goto fail;
475		}
476		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
477	}
478
479	/*
480	 * Initialize tx ring
481	 */
482	for (i = 0; i < IPW_NTBD; i++) {
483		sbd = &sc->stbd_list[i];
484		sbd->bd = &sc->tbd_list[i];
485		sbd->type = IPW_SBD_TYPE_NOASSOC;
486	}
487
488	/*
489	 * Pre-allocate rx buffers and DMA maps
490	 */
491	for (i = 0; i < IPW_NRBD; i++) {
492		sbd = &sc->srbd_list[i];
493		sbuf = &sc->rx_sbuf_list[i];
494		sbd->bd = &sc->rbd_list[i];
495
496		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
497		if (sbuf->m == NULL) {
498			printf("%s: could not allocate rx mbuf\n",
499			    sc->sc_dev.dv_xname);
500			error = ENOMEM;
501			goto fail;
502		}
503
504		MCLGET(sbuf->m, M_DONTWAIT);
505		if (!(sbuf->m->m_flags & M_EXT)) {
506			m_freem(sbuf->m);
507			printf("%s: could not allocate rx mbuf cluster\n",
508			    sc->sc_dev.dv_xname);
509			error = ENOMEM;
510			goto fail;
511		}
512
513		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
514		    0, BUS_DMA_NOWAIT, &sbuf->map);
515		if (error != 0) {
516			printf("%s: could not create rx DMA map\n",
517			    sc->sc_dev.dv_xname);
518			goto fail;
519		}
520
521		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
522		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
523		if (error != 0) {
524			printf("%s: could not map rx DMA memory\n",
525			    sc->sc_dev.dv_xname);
526			goto fail;
527		}
528
529		sbd->type = IPW_SBD_TYPE_DATA;
530		sbd->priv = sbuf;
531		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
532		sbd->bd->len = htole32(MCLBYTES);
533	}
534
535	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
536	    BUS_DMASYNC_PREWRITE);
537
538	return 0;
539
540fail:	ipw_release(sc);
541	return error;
542}
543
544void
545ipw_release(struct ipw_softc *sc)
546{
547	struct ipw_soft_buf *sbuf;
548	int i;
549
550	if (sc->tbd_map != NULL) {
551		if (sc->tbd_list != NULL) {
552			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
553			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
554			    IPW_TBD_SZ);
555			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
556		}
557		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
558	}
559
560	if (sc->rbd_map != NULL) {
561		if (sc->rbd_list != NULL) {
562			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
563			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
564			    IPW_RBD_SZ);
565			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
566		}
567		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
568	}
569
570	if (sc->status_map != NULL) {
571		if (sc->status_list != NULL) {
572			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
573			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
574			    IPW_RBD_SZ);
575			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
576		}
577		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
578	}
579
580	if (sc->cmd_map != NULL)
581		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
582
583	for (i = 0; i < IPW_NDATA; i++)
584		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
585
586	for (i = 0; i < IPW_NDATA; i++)
587		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
588
589	for (i = 0; i < IPW_NRBD; i++) {
590		sbuf = &sc->rx_sbuf_list[i];
591		if (sbuf->map != NULL) {
592			if (sbuf->m != NULL) {
593				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
594				m_freem(sbuf->m);
595			}
596			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
597		}
598	}
599}
600
601int
602ipw_media_change(struct ifnet *ifp)
603{
604	int error;
605
606	error = ieee80211_media_change(ifp);
607	if (error != ENETRESET)
608		return error;
609
610	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
611		ipw_init(ifp);
612
613	return 0;
614}
615
616void
617ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
618{
619	struct ipw_softc *sc = ifp->if_softc;
620	struct ieee80211com *ic = &sc->sc_ic;
621#define N(a)	(sizeof (a) / sizeof (a[0]))
622	static const struct {
623		u_int32_t	val;
624		int		rate;
625	} rates[] = {
626		{ IPW_RATE_DS1,   2 },
627		{ IPW_RATE_DS2,   4 },
628		{ IPW_RATE_DS5,  11 },
629		{ IPW_RATE_DS11, 22 },
630	};
631	u_int32_t val;
632	int rate, i;
633
634	imr->ifm_status = IFM_AVALID;
635	imr->ifm_active = IFM_IEEE80211;
636	if (ic->ic_state == IEEE80211_S_RUN)
637		imr->ifm_status |= IFM_ACTIVE;
638
639	/* read current transmission rate from adapter */
640	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
641	val &= 0xf;
642
643	/* convert rate to 802.11 rate */
644	for (i = 0; i < N(rates) && rates[i].val != val; i++);
645	rate = (i < N(rates)) ? rates[i].rate : 0;
646
647	imr->ifm_active |= IFM_IEEE80211_11B;
648	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
649	switch (ic->ic_opmode) {
650	case IEEE80211_M_STA:
651		break;
652
653	case IEEE80211_M_IBSS:
654		imr->ifm_active |= IFM_IEEE80211_IBSS;
655		break;
656
657	case IEEE80211_M_MONITOR:
658		imr->ifm_active |= IFM_IEEE80211_MONITOR;
659		break;
660
661	case IEEE80211_M_AHDEMO:
662	case IEEE80211_M_HOSTAP:
663		/* should not get there */
664		break;
665	}
666#undef N
667}
668
669int
670ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
671{
672	struct ipw_softc *sc = ic->ic_softc;
673	struct ieee80211_node *ni = ic->ic_bss;
674	u_int32_t len;
675	u_int8_t val;
676
677	switch (nstate) {
678	case IEEE80211_S_RUN:
679		len = IEEE80211_NWID_LEN;
680		ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
681		ni->ni_esslen = len;
682
683		val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
684		ni->ni_chan = &ic->ic_channels[val];
685
686		DELAY(100); /* firmware needs a short delay here */
687
688		len = IEEE80211_ADDR_LEN;
689		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
690		break;
691
692	case IEEE80211_S_INIT:
693	case IEEE80211_S_SCAN:
694	case IEEE80211_S_AUTH:
695	case IEEE80211_S_ASSOC:
696		break;
697	}
698
699	ic->ic_state = nstate;
700	return 0;
701}
702
703/*
704 * Read 16 bits at address 'addr' from the Microwire EEPROM.
705 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
706 */
707u_int16_t
708ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
709{
710	u_int32_t tmp;
711	u_int16_t val;
712	int n;
713
714	/* Clock C once before the first command */
715	IPW_EEPROM_CTL(sc, 0);
716	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
717	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
718	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
719
720	/* Write start bit (1) */
721	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
722	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
723
724	/* Write READ opcode (10) */
725	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
726	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
727	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
728	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
729
730	/* Write address A7-A0 */
731	for (n = 7; n >= 0; n--) {
732		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
733		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
734		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
735		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
736	}
737
738	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
739
740	/* Read data Q15-Q0 */
741	val = 0;
742	for (n = 15; n >= 0; n--) {
743		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
744		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
745		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
746		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
747	}
748
749	IPW_EEPROM_CTL(sc, 0);
750
751	/* Clear Chip Select and clock C */
752	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
753	IPW_EEPROM_CTL(sc, 0);
754	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
755
756	return letoh16(val);
757}
758
759void
760ipw_scan_result(struct ipw_softc *sc)
761{
762	struct ieee80211com *ic = &sc->sc_ic;
763	struct ieee80211_node *ni;
764	u_int32_t i, cnt, off;
765	struct ipw_node ap;
766
767	/* flush previously seen access points */
768	ieee80211_free_allnodes(ic);
769
770	cnt = ipw_read_table1(sc, IPW_INFO_APS_CNT);
771	off = ipw_read_table1(sc, IPW_INFO_APS_BASE);
772
773	DPRINTF(("Found %u APs\n", cnt));
774
775	for (i = 0; i < cnt; i++) {
776		ipw_read_mem_1(sc, off, (u_int8_t *)&ap, sizeof ap);
777		off += sizeof ap;
778
779#ifdef IPW_DEBUG
780		if (ipw_debug >= 2) {
781			u_char *p = (u_char *)&ap;
782			int j;
783
784			printf("AP%u\n", i);
785			for (j = 0; j < sizeof ap; j++)
786				printf("%02x", *p++);
787			printf("\n");
788		}
789#endif
790
791		ni = ieee80211_lookup_node(ic, ap.bssid,
792		    &ic->ic_channels[ap.chan]);
793		if (ni != NULL)
794			continue;
795
796		ni = ieee80211_alloc_node(ic, ap.bssid);
797		if (ni == NULL)
798			return;
799
800		IEEE80211_ADDR_COPY(ni->ni_bssid, ap.bssid);
801		ni->ni_rssi = ap.rssi;
802		ni->ni_intval = letoh16(ap.intval);
803		ni->ni_capinfo = letoh16(ap.capinfo);
804		ni->ni_chan = &ic->ic_channels[ap.chan];
805		ni->ni_esslen = ap.esslen;
806		bcopy(ap.essid, ni->ni_essid, IEEE80211_NWID_LEN);
807	}
808}
809
810void
811ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
812{
813	struct ipw_cmd *cmd;
814
815	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
816	    BUS_DMASYNC_POSTREAD);
817
818	cmd = mtod(sbuf->m, struct ipw_cmd *);
819
820	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
821	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
822	    letoh32(cmd->len), letoh32(cmd->status)));
823
824	wakeup(sc);
825}
826
827void
828ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
829{
830	struct ieee80211com *ic = &sc->sc_ic;
831	u_int32_t state;
832
833	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
834	    BUS_DMASYNC_POSTREAD);
835
836	state = letoh32(*mtod(sbuf->m, u_int32_t *));
837
838	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
839
840	switch (state) {
841	case IPW_STATE_ASSOCIATED:
842		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
843		break;
844
845	case IPW_STATE_SCANNING:
846		/* don't leave run state on background scan */
847		if (ic->ic_state != IEEE80211_S_RUN)
848			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
849		break;
850
851	case IPW_STATE_SCAN_COMPLETE:
852		ipw_scan_result(sc);
853		break;
854
855	case IPW_STATE_ASSOCIATION_LOST:
856		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
857		break;
858
859	case IPW_STATE_RADIO_DISABLED:
860		ipw_stop(&ic->ic_if, 1);
861		break;
862	}
863}
864
865void
866ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
867    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
868{
869	struct ieee80211com *ic = &sc->sc_ic;
870	struct ifnet *ifp = &ic->ic_if;
871	struct mbuf *m;
872	struct ieee80211_frame *wh;
873	struct ieee80211_node *ni;
874	int error;
875
876	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
877
878	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
879	    BUS_DMASYNC_POSTREAD);
880
881	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
882
883	/* Finalize mbuf */
884	m = sbuf->m;
885	m->m_pkthdr.rcvif = ifp;
886	m->m_pkthdr.len = m->m_len = letoh32(status->len);
887
888#if NBPFILTER > 0
889	if (sc->sc_drvbpf != NULL) {
890		struct mbuf mb;
891		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
892
893		tap->wr_flags = 0;
894		tap->wr_antsignal = status->rssi;
895		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
896		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
897
898		M_DUP_PKTHDR(&mb, m);
899		mb.m_data = (caddr_t)tap;
900		mb.m_len = sc->sc_rxtap_len;
901		mb.m_next = m;
902		mb.m_pkthdr.len += mb.m_len;
903		bpf_mtap(sc->sc_drvbpf, &mb);
904	}
905#endif
906
907	wh = mtod(m, struct ieee80211_frame *);
908
909	ni = ieee80211_find_rxnode(ic, wh);
910
911	/* Send the frame to the upper layer */
912	ieee80211_input(ifp, m, ni, status->rssi, 0);
913
914	if (ni == ic->ic_bss)
915		ieee80211_unref_node(&ni);
916	else
917		ieee80211_free_node(ic, ni);
918
919	MGETHDR(m, M_DONTWAIT, MT_DATA);
920	if (m == NULL) {
921		printf("%s: could not allocate rx mbuf\n",
922		    sc->sc_dev.dv_xname);
923		return;
924	}
925	MCLGET(m, M_DONTWAIT);
926	if (!(m->m_flags & M_EXT)) {
927		m_freem(m);
928		printf("%s: could not allocate rx mbuf cluster\n",
929		    sc->sc_dev.dv_xname);
930		return;
931	}
932
933	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
934	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
935	if (error != 0) {
936		printf("%s: could not map rx DMA memory\n",
937		    sc->sc_dev.dv_xname);
938		m_freem(m);
939		return;
940	}
941
942	sbuf->m = m;
943	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
944}
945
946void
947ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
948{
949	DPRINTFN(2, ("RX!NOTIFICATION\n"));
950}
951
952void
953ipw_rx_intr(struct ipw_softc *sc)
954{
955	struct ipw_status *status;
956	struct ipw_soft_bd *sbd;
957	struct ipw_soft_buf *sbuf;
958	u_int32_t r, i;
959
960	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
961
962	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
963
964		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
965		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
966		    BUS_DMASYNC_POSTREAD);
967
968		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
969		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
970		    BUS_DMASYNC_POSTREAD);
971
972		status = &sc->status_list[i];
973		sbd = &sc->srbd_list[i];
974		sbuf = sbd->priv;
975
976		switch (letoh16(status->code) & 0xf) {
977		case IPW_STATUS_CODE_COMMAND:
978			ipw_command_intr(sc, sbuf);
979			break;
980
981		case IPW_STATUS_CODE_NEWSTATE:
982			ipw_newstate_intr(sc, sbuf);
983			break;
984
985		case IPW_STATUS_CODE_DATA_802_3:
986		case IPW_STATUS_CODE_DATA_802_11:
987			ipw_data_intr(sc, status, sbd, sbuf);
988			break;
989
990		case IPW_STATUS_CODE_NOTIFICATION:
991			ipw_notification_intr(sc, sbuf);
992			break;
993
994		default:
995			printf("%s: unknown status code %u\n",
996			    sc->sc_dev.dv_xname, letoh16(status->code));
997		}
998		sbd->bd->flags = 0;
999
1000		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
1001		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1002		    BUS_DMASYNC_PREWRITE);
1003	}
1004
1005	/* Tell the firmware what we have processed */
1006	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
1007	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
1008}
1009
1010void
1011ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1012{
1013	struct ieee80211com *ic = &sc->sc_ic;
1014	struct ipw_soft_hdr *shdr;
1015	struct ipw_soft_buf *sbuf;
1016
1017	switch (sbd->type) {
1018	case IPW_SBD_TYPE_COMMAND:
1019		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
1020		break;
1021
1022	case IPW_SBD_TYPE_HEADER:
1023		shdr = sbd->priv;
1024		bus_dmamap_unload(sc->sc_dmat, shdr->map);
1025		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1026		break;
1027
1028	case IPW_SBD_TYPE_DATA:
1029		sbuf = sbd->priv;
1030		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1031		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1032
1033		m_freem(sbuf->m);
1034
1035		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
1036			ieee80211_free_node(ic, sbuf->ni);
1037
1038		/* kill watchdog timer */
1039		sc->sc_tx_timer = 0;
1040		break;
1041	}
1042	sbd->type = IPW_SBD_TYPE_NOASSOC;
1043}
1044
1045void
1046ipw_tx_intr(struct ipw_softc *sc)
1047{
1048	struct ifnet *ifp = &sc->sc_ic.ic_if;
1049	u_int32_t r, i;
1050
1051	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1052
1053	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1054		ipw_release_sbd(sc, &sc->stbd_list[i]);
1055		sc->txfree++;
1056	}
1057
1058	/* Remember what the firmware has processed */
1059	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1060
1061	/* Call start() since some buffer descriptors have been released */
1062	if (sc->txfree >= 1 + IPW_MAX_NSEG) {
1063		ifp->if_flags &= ~IFF_OACTIVE;
1064		(*ifp->if_start)(ifp);
1065	}
1066}
1067
1068int
1069ipw_intr(void *arg)
1070{
1071	struct ipw_softc *sc = arg;
1072	u_int32_t r;
1073
1074	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1075		return 0;
1076
1077	/* Disable interrupts */
1078	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1079
1080	DPRINTFN(8, ("INTR!0x%08x\n", r));
1081
1082	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1083		printf("%s: fatal error\n", sc->sc_dev.dv_xname);
1084		ipw_stop(&sc->sc_ic.ic_if, 1);
1085	}
1086
1087	if (r & IPW_INTR_FW_INIT_DONE) {
1088		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1089			wakeup(sc);
1090	}
1091
1092	if (r & IPW_INTR_RX_TRANSFER)
1093		ipw_rx_intr(sc);
1094
1095	if (r & IPW_INTR_TX_TRANSFER)
1096		ipw_tx_intr(sc);
1097
1098	/* Acknowledge interrupts */
1099	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1100
1101	/* Re-enable interrupts */
1102	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1103
1104	return 1;
1105}
1106
1107int
1108ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
1109{
1110	struct ipw_soft_bd *sbd;
1111	int error;
1112
1113	sbd = &sc->stbd_list[sc->txcur];
1114
1115	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1116	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1117	if (error != 0) {
1118		printf("%s: could not map command DMA memory\n",
1119		    sc->sc_dev.dv_xname);
1120		return error;
1121	}
1122
1123	sc->cmd.type = htole32(type);
1124	sc->cmd.subtype = htole32(0);
1125	sc->cmd.len = htole32(len);
1126	sc->cmd.seq = htole32(0);
1127	if (data != NULL)
1128		bcopy(data, sc->cmd.data, len);
1129
1130	sbd->type = IPW_SBD_TYPE_COMMAND;
1131	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1132	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1133	sbd->bd->nfrag = 1;
1134	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1135			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
1136
1137	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1138	    BUS_DMASYNC_PREWRITE);
1139
1140	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1141	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1142	    BUS_DMASYNC_PREWRITE);
1143
1144	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1145	sc->txfree--;
1146	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1147
1148	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1149
1150	/* Wait at most one second for command to complete */
1151	return tsleep(sc, 0, "ipwcmd", hz);
1152}
1153
1154int
1155ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1156{
1157	struct ipw_softc *sc = ifp->if_softc;
1158	struct ieee80211com *ic = &sc->sc_ic;
1159	struct ieee80211_frame *wh;
1160	struct ipw_soft_bd *sbd;
1161	struct ipw_soft_hdr *shdr;
1162	struct ipw_soft_buf *sbuf;
1163	struct mbuf *mnew;
1164	int error, i;
1165
1166	if (ic->ic_flags & IEEE80211_F_WEPON) {
1167		m = ieee80211_wep_crypt(ifp, m, 1);
1168		if (m == NULL)
1169			return ENOBUFS;
1170	}
1171
1172#if NBPFILTER > 0
1173	if (sc->sc_drvbpf != NULL) {
1174		struct mbuf mb;
1175		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1176
1177		tap->wt_flags = 0;
1178		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1179		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1180
1181		M_DUP_PKTHDR(&mb, m);
1182		mb.m_data = (caddr_t)tap;
1183		mb.m_len = sc->sc_txtap_len;
1184		mb.m_next = m;
1185		mb.m_pkthdr.len += mb.m_len;
1186		bpf_mtap(sc->sc_drvbpf, &mb);
1187	}
1188#endif
1189
1190	wh = mtod(m, struct ieee80211_frame *);
1191
1192	shdr = SLIST_FIRST(&sc->free_shdr);
1193	sbuf = SLIST_FIRST(&sc->free_sbuf);
1194
1195	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1196	shdr->hdr.subtype = htole32(0);
1197	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1198	shdr->hdr.encrypt = 0;
1199	shdr->hdr.keyidx = 0;
1200	shdr->hdr.keysz = 0;
1201	shdr->hdr.fragmentsz = htole16(0);
1202	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1203	if (ic->ic_opmode == IEEE80211_M_STA)
1204		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1205	else
1206		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1207
1208	/* trim IEEE802.11 header */
1209	m_adj(m, sizeof (struct ieee80211_frame));
1210
1211	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1212	if (error != 0 && error != EFBIG) {
1213		printf("%s: could not map mbuf (error %d)\n",
1214		    sc->sc_dev.dv_xname, error);
1215		m_freem(m);
1216		return error;
1217	}
1218	if (error != 0) {
1219		/* too many fragments, linearize */
1220
1221		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1222		if (mnew == NULL) {
1223			m_freem(m);
1224			return ENOMEM;
1225		}
1226
1227		M_DUP_PKTHDR(mnew, m);
1228		MCLGET(mnew, M_DONTWAIT);
1229		if (!(mnew->m_flags & M_EXT)) {
1230			m_freem(m);
1231			m_freem(mnew);
1232			return ENOMEM;
1233		}
1234
1235		m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew, caddr_t));
1236		m_freem(m);
1237		m->m_len = m->m_pkthdr.len;
1238		m = mnew;
1239
1240		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1241		    BUS_DMA_NOWAIT);
1242		if (error != 0) {
1243			printf("%s: could not map mbuf (error %d)\n",
1244			    sc->sc_dev.dv_xname, error);
1245			m_freem(m);
1246			return error;
1247		}
1248	}
1249
1250	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1251	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1252	if (error != 0) {
1253		printf("%s: could not map header DMA memory (error %d)\n",
1254		    sc->sc_dev.dv_xname, error);
1255		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1256		m_freem(m);
1257		return error;
1258	}
1259
1260	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1261	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1262
1263	sbd = &sc->stbd_list[sc->txcur];
1264	sbd->type = IPW_SBD_TYPE_HEADER;
1265	sbd->priv = shdr;
1266	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1267	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1268	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1269	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1270			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1271
1272	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1273	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1274	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1275	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1276
1277	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1278	    sc->txcur * sizeof (struct ipw_bd),
1279	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1280
1281	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1282	sc->txfree--;
1283
1284	sbuf->m = m;
1285	sbuf->ni = ni;
1286
1287	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1288		sbd = &sc->stbd_list[sc->txcur];
1289		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1290		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1291		sbd->bd->nfrag = 0; /* used only in first bd */
1292		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1293		if (i == sbuf->map->dm_nsegs - 1) {
1294			sbd->type = IPW_SBD_TYPE_DATA;
1295			sbd->priv = sbuf;
1296			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1297		} else {
1298			sbd->type = IPW_SBD_TYPE_NOASSOC;
1299			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1300		}
1301
1302		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1303		    sbuf->map->dm_segs[i].ds_len));
1304
1305		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1306		    sc->txcur * sizeof (struct ipw_bd),
1307		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1308
1309		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1310		sc->txfree--;
1311	}
1312
1313	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1314	    BUS_DMASYNC_PREWRITE);
1315
1316	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
1317	    BUS_DMASYNC_PREWRITE);
1318
1319	/* Inform firmware about this new packet */
1320	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1321
1322	if (sc->txfree < 1 + IPW_MAX_NSEG)
1323		ifp->if_flags |= IFF_OACTIVE;
1324
1325	return 0;
1326}
1327
1328void
1329ipw_start(struct ifnet *ifp)
1330{
1331	struct ipw_softc *sc = ifp->if_softc;
1332	struct ieee80211com *ic = &sc->sc_ic;
1333	struct mbuf *m;
1334	struct ieee80211_node *ni;
1335
1336	if (ic->ic_state != IEEE80211_S_RUN)
1337		return;
1338
1339	for (;;) {
1340		IF_DEQUEUE(&ifp->if_snd, m);
1341		if (m == NULL)
1342			break;
1343
1344#if NBPFILTER > 0
1345		if (ifp->if_bpf != NULL)
1346			bpf_mtap(ifp->if_bpf, m);
1347#endif
1348
1349		m = ieee80211_encap(ifp, m, &ni);
1350		if (m == NULL)
1351			continue;
1352
1353#if NBPFILTER > 0
1354		if (ic->ic_rawbpf != NULL)
1355			bpf_mtap(ic->ic_rawbpf, m);
1356#endif
1357
1358		if (ipw_tx_start(ifp, m, ni) != 0) {
1359			if (ni != NULL && ni != ic->ic_bss)
1360				ieee80211_free_node(ic, ni);
1361			break;
1362		}
1363
1364		/* start watchdog timer */
1365		sc->sc_tx_timer = 5;
1366		ifp->if_timer = 1;
1367	}
1368}
1369
1370void
1371ipw_watchdog(struct ifnet *ifp)
1372{
1373	struct ipw_softc *sc = ifp->if_softc;
1374
1375	ifp->if_timer = 0;
1376
1377	if (sc->sc_tx_timer > 0) {
1378		if (--sc->sc_tx_timer == 0) {
1379			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1380			ipw_stop(ifp, 1);
1381			return;
1382		}
1383		ifp->if_timer = 1;
1384	}
1385
1386	ieee80211_watchdog(ifp);
1387}
1388
1389int
1390ipw_get_table1(struct ipw_softc *sc, u_int32_t *tbl)
1391{
1392	u_int32_t i, size, buf[256];
1393
1394	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
1395		bzero(buf, sizeof buf);
1396		return copyout(buf, tbl, sizeof buf);
1397	}
1398
1399	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
1400
1401	size = min(CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA), 256);
1402	for (i = 1; i < size; i++)
1403		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
1404
1405	return copyout(buf, tbl, sizeof buf);
1406}
1407
1408int
1409ipw_get_radio(struct ipw_softc *sc, int *ret)
1410{
1411	int val;
1412
1413	val = (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ? 0 : 1;
1414	return copyout(&val, ret, sizeof val);
1415}
1416
1417int
1418ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1419{
1420	struct ipw_softc *sc = ifp->if_softc;
1421	struct ifreq *ifr;
1422	struct ifaddr *ifa;
1423	int s, error = 0;
1424
1425	s = splnet();
1426
1427	switch (cmd) {
1428	case SIOCSIFADDR:
1429		ifa = (struct ifaddr *) data;
1430		ifp->if_flags |= IFF_UP;
1431		switch (ifa->ifa_addr->sa_family) {
1432#ifdef INET
1433		case AF_INET:
1434			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
1435			ipw_init(ifp);
1436			break;
1437#endif
1438		default:
1439			ipw_init(ifp);
1440		}
1441		break;
1442
1443	case SIOCSIFFLAGS:
1444		if (ifp->if_flags & IFF_UP) {
1445			if (!(ifp->if_flags & IFF_RUNNING))
1446				ipw_init(ifp);
1447		} else {
1448			if (ifp->if_flags & IFF_RUNNING)
1449				ipw_stop(ifp, 1);
1450		}
1451		break;
1452
1453	case SIOCGTABLE1:
1454		ifr = (struct ifreq *)data;
1455		error = ipw_get_table1(sc, (u_int32_t *)ifr->ifr_data);
1456		break;
1457
1458	case SIOCGRADIO:
1459		ifr = (struct ifreq *)data;
1460		error = ipw_get_radio(sc, (int *)ifr->ifr_data);
1461		break;
1462
1463	case SIOCG80211AUTH:
1464		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1465		break;
1466
1467	case SIOCS80211AUTH:
1468		/* only super-user can do that! */
1469		if ((error = suser(curproc, 0)) != 0)
1470			break;
1471
1472		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1473		break;
1474
1475	default:
1476		error = ieee80211_ioctl(ifp, cmd, data);
1477	}
1478
1479	if (error == ENETRESET && cmd != SIOCADDMULTI) {
1480		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1481		    (IFF_UP | IFF_RUNNING))
1482			ipw_init(ifp);
1483		error = 0;
1484	}
1485
1486	splx(s);
1487	return error;
1488}
1489
1490u_int32_t
1491ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1492{
1493	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1494}
1495
1496void
1497ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1498{
1499	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1500}
1501
1502int
1503ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1504{
1505	u_int32_t addr, info;
1506	u_int16_t count, size;
1507	u_int32_t total;
1508
1509	/* addr[4] + count[2] + size[2] */
1510	addr = MEM_READ_4(sc, sc->table2_base + off);
1511	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1512
1513	count = info >> 16;
1514	size = info & 0xffff;
1515	total = count * size;
1516
1517	if (total > *len) {
1518		*len = total;
1519		return EINVAL;
1520	}
1521
1522	*len = total;
1523	ipw_read_mem_1(sc, addr, buf, total);
1524
1525	return 0;
1526}
1527
1528void
1529ipw_stop_master(struct ipw_softc *sc)
1530{
1531	int ntries;
1532
1533	/* Disable interrupts */
1534	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1535
1536	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1537	for (ntries = 0; ntries < 50; ntries++) {
1538		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1539			break;
1540		DELAY(10);
1541	}
1542	if (ntries == 50)
1543		printf("%s: timeout waiting for master\n",
1544		    sc->sc_dev.dv_xname);
1545
1546	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1547	    IPW_RST_PRINCETON_RESET);
1548
1549	sc->flags &= ~IPW_FLAG_FW_INITED;
1550}
1551
1552int
1553ipw_reset(struct ipw_softc *sc)
1554{
1555	int ntries;
1556
1557	ipw_stop_master(sc);
1558
1559	/* Move adapter to D0 state */
1560	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1561	    IPW_CTL_INIT);
1562
1563	/* Wait for clock stabilization */
1564	for (ntries = 0; ntries < 1000; ntries++) {
1565		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1566			break;
1567		DELAY(200);
1568	}
1569	if (ntries == 1000)
1570		return EIO;
1571
1572	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1573	    IPW_RST_SW_RESET);
1574
1575	DELAY(10);
1576
1577	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1578	    IPW_CTL_INIT);
1579
1580	return 0;
1581}
1582
1583int
1584ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1585{
1586	int ntries;
1587
1588	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1589	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1590
1591	MEM_WRITE_2(sc, 0x220000, 0x0703);
1592	MEM_WRITE_2(sc, 0x220000, 0x0707);
1593
1594	MEM_WRITE_1(sc, 0x210014, 0x72);
1595	MEM_WRITE_1(sc, 0x210014, 0x72);
1596
1597	MEM_WRITE_1(sc, 0x210000, 0x40);
1598	MEM_WRITE_1(sc, 0x210000, 0x00);
1599	MEM_WRITE_1(sc, 0x210000, 0x40);
1600
1601	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1602
1603	MEM_WRITE_1(sc, 0x210000, 0x00);
1604	MEM_WRITE_1(sc, 0x210000, 0x00);
1605	MEM_WRITE_1(sc, 0x210000, 0x80);
1606
1607	MEM_WRITE_2(sc, 0x220000, 0x0703);
1608	MEM_WRITE_2(sc, 0x220000, 0x0707);
1609
1610	MEM_WRITE_1(sc, 0x210014, 0x72);
1611	MEM_WRITE_1(sc, 0x210014, 0x72);
1612
1613	MEM_WRITE_1(sc, 0x210000, 0x00);
1614	MEM_WRITE_1(sc, 0x210000, 0x80);
1615
1616	for (ntries = 0; ntries < 100; ntries++) {
1617		if (MEM_READ_1(sc, 0x210000) & 1)
1618			break;
1619		DELAY(1000);
1620	}
1621	if (ntries == 100) {
1622		printf("%s: timeout waiting for ucode to initialize\n",
1623		    sc->sc_dev.dv_xname);
1624		return EIO;
1625	}
1626
1627	MEM_WRITE_4(sc, 0x3000e0, 0);
1628
1629	return 0;
1630}
1631
1632/* set of macros to handle unaligned little endian data in firmware image */
1633#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1634#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1635int
1636ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1637{
1638	u_char *p, *end;
1639	u_int32_t dst;
1640	u_int16_t len;
1641	int error;
1642
1643	p = fw;
1644	end = fw + size;
1645	while (p < end) {
1646		if (p + 6 > end)
1647			return EINVAL;
1648
1649		dst = GETLE32(p); p += 4;
1650		len = GETLE16(p); p += 2;
1651
1652		if (p + len > end)
1653			return EINVAL;
1654
1655		ipw_write_mem_1(sc, dst, p, len);
1656		p += len;
1657	}
1658
1659	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1660	    IPW_IO_LED_OFF);
1661
1662	/* Allow interrupts so we know when the firmware is inited */
1663	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1664
1665	/* Tell the adapter to initialize the firmware */
1666	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1667	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1668	    IPW_CTL_ALLOW_STANDBY);
1669
1670	/* Wait at most one second for firmware initialization to complete */
1671	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1672		printf("%s: timeout waiting for firmware initialization to "
1673		    "complete\n", sc->sc_dev.dv_xname);
1674		return error;
1675	}
1676
1677	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1678	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1679
1680	return 0;
1681}
1682
1683int
1684ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1685{
1686	struct ipw_firmware_hdr *hdr;
1687	const char *name;
1688	u_char *p;
1689	size_t size;
1690	int error;
1691
1692	switch (sc->sc_ic.ic_opmode) {
1693	case IEEE80211_M_STA:
1694	case IEEE80211_M_HOSTAP:
1695		name = "ipw-bss";
1696		break;
1697
1698	case IEEE80211_M_IBSS:
1699	case IEEE80211_M_AHDEMO:
1700		name = "ipw-ibss";
1701		break;
1702
1703	case IEEE80211_M_MONITOR:
1704		name = "ipw-monitor";
1705		break;
1706	}
1707
1708	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1709		return error;
1710
1711	if (size < sizeof (struct ipw_firmware_hdr)) {
1712		error = EINVAL;
1713		goto fail;
1714	}
1715
1716	p = fw->data;
1717	hdr = (struct ipw_firmware_hdr *)p;
1718	fw->main_size = letoh32(hdr->main_size);
1719	fw->ucode_size = letoh32(hdr->ucode_size);
1720
1721	p += sizeof (struct ipw_firmware_hdr);
1722	size -= sizeof (struct ipw_firmware_hdr);
1723
1724	if (size < fw->main_size + fw->ucode_size) {
1725		error = EINVAL;
1726		goto fail;
1727	}
1728
1729	fw->main = p;
1730	fw->ucode = p + fw->main_size;
1731
1732	return 0;
1733
1734fail:	free(fw->data, M_DEVBUF);
1735	return error;
1736}
1737
1738int
1739ipw_config(struct ipw_softc *sc)
1740{
1741	struct ieee80211com *ic = &sc->sc_ic;
1742	struct ifnet *ifp = &ic->ic_if;
1743	struct ipw_security security;
1744	struct ieee80211_wepkey *k;
1745	struct ipw_wep_key wepkey;
1746	struct ipw_scan_options options;
1747	struct ipw_configuration config;
1748	u_int32_t data;
1749	int error, i;
1750
1751	switch (ic->ic_opmode) {
1752	case IEEE80211_M_STA:
1753	case IEEE80211_M_HOSTAP:
1754		data = htole32(IPW_MODE_BSS);
1755		break;
1756
1757	case IEEE80211_M_IBSS:
1758	case IEEE80211_M_AHDEMO:
1759		data = htole32(IPW_MODE_IBSS);
1760		break;
1761
1762	case IEEE80211_M_MONITOR:
1763		data = htole32(IPW_MODE_MONITOR);
1764		break;
1765	}
1766	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1767	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1768	if (error != 0)
1769		return error;
1770
1771	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1772	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1773		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1774		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1775		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1776		if (error != 0)
1777			return error;
1778	}
1779
1780	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1781		DPRINTF(("Enabling adapter\n"));
1782		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1783	}
1784
1785	IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1786	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1787	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1788	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1789	    IEEE80211_ADDR_LEN);
1790	if (error != 0)
1791		return error;
1792
1793	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1794	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1795	if (ic->ic_opmode == IEEE80211_M_IBSS)
1796		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1797	if (ifp->if_flags & IFF_PROMISC)
1798		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1799	config.bss_chan = htole32(0x3fff); /* channels 1-14 */
1800	config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
1801	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1802	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1803	if (error != 0)
1804		return error;
1805
1806	data = htole32(0x3); /* 1, 2 */
1807	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1808	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1809	if (error != 0)
1810		return error;
1811
1812	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1813	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1814	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1815	if (error != 0)
1816		return error;
1817
1818	data = htole32(IPW_POWER_MODE_CAM);
1819	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1820	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1821	if (error != 0)
1822		return error;
1823
1824	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1825		data = htole32(32); /* default value */
1826		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1827		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1828		    sizeof data);
1829		if (error != 0)
1830			return error;
1831	}
1832
1833	data = htole32(ic->ic_rtsthreshold);
1834	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1835	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1836	if (error != 0)
1837		return error;
1838
1839	data = htole32(ic->ic_fragthreshold);
1840	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1841	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1842	if (error != 0)
1843		return error;
1844
1845#ifdef IPW_DEBUG
1846	if (ipw_debug > 0) {
1847		printf("Setting ESSID to ");
1848		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1849		printf("\n");
1850	}
1851#endif
1852	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1853	    ic->ic_des_esslen);
1854	if (error != 0)
1855		return error;
1856
1857	/* no mandatory BSSID */
1858	DPRINTF(("Setting mandatory BSSID to null\n"));
1859	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1860	if (error != 0)
1861		return error;
1862
1863	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1864		DPRINTF(("Setting adapter BSSID to %s\n",
1865		    ether_sprintf(ic->ic_des_bssid)));
1866		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1867		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1868		if (error != 0)
1869			return error;
1870	}
1871
1872	bzero(&security, sizeof security);
1873	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1874	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1875	security.ciphers = htole32(IPW_CIPHER_NONE);
1876	DPRINTF(("Setting authmode to %u\n", security.authmode));
1877	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1878	    sizeof security);
1879	if (error != 0)
1880		return error;
1881
1882	if (ic->ic_flags & IEEE80211_F_WEPON) {
1883		k = ic->ic_nw_keys;
1884		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1885			if (k->wk_len == 0)
1886				continue;
1887
1888			wepkey.idx = i;
1889			wepkey.len = k->wk_len;
1890			bzero(wepkey.key, sizeof wepkey.key);
1891			bcopy(k->wk_key, wepkey.key, k->wk_len);
1892			DPRINTF(("Setting wep key index %u len %u\n",
1893			    wepkey.idx, wepkey.len));
1894			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1895			    sizeof wepkey);
1896			if (error != 0)
1897				return error;
1898		}
1899
1900		data = htole32(ic->ic_wep_txkey);
1901		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1902		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1903		    sizeof data);
1904		if (error != 0)
1905			return error;
1906	}
1907
1908	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1909	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1910	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1911	if (error != 0)
1912		return error;
1913
1914	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1915	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1916		data = htole32(ic->ic_lintval);
1917		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1918		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1919		    sizeof data);
1920		if (error != 0)
1921			return error;
1922	}
1923
1924	options.flags = htole32(0);
1925	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1926	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1927	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1928	if (error != 0)
1929		return error;
1930
1931	/* finally, enable adapter (start scanning for an access point) */
1932	DPRINTF(("Enabling adapter\n"));
1933	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1934}
1935
1936int
1937ipw_init(struct ifnet *ifp)
1938{
1939	struct ipw_softc *sc = ifp->if_softc;
1940	struct ipw_firmware fw;
1941	int error;
1942
1943	ipw_stop(ifp, 0);
1944
1945	if ((error = ipw_reset(sc)) != 0) {
1946		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1947		goto fail1;
1948	}
1949
1950	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1951		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1952		goto fail1;
1953	}
1954
1955	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1956		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1957		goto fail2;
1958	}
1959
1960	ipw_stop_master(sc);
1961
1962	/*
1963	 * Setup tx, rx and status rings
1964	 */
1965	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1966	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1967	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1968	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1969	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1970	sc->txcur = 0; /* bd index to write to */
1971	sc->txfree = IPW_NTBD - 2;
1972
1973	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1974	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1975	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1976	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1977	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
1978
1979	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1980	    sc->status_map->dm_segs[0].ds_addr);
1981
1982	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1983		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1984		goto fail2;
1985	}
1986
1987	sc->flags |= IPW_FLAG_FW_INITED;
1988
1989	/* Retrieve information tables base addresses */
1990	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1991	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1992
1993	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1994
1995	if ((error = ipw_config(sc)) != 0) {
1996		printf("%s: device configuration failed\n",
1997		    sc->sc_dev.dv_xname);
1998		goto fail2;
1999	}
2000
2001	ifp->if_flags &= ~IFF_OACTIVE;
2002	ifp->if_flags |= IFF_RUNNING;
2003
2004	return 0;
2005
2006fail2:	free(fw.data, M_DEVBUF);
2007fail1:	ipw_stop(ifp, 0);
2008
2009	return error;
2010}
2011
2012void
2013ipw_stop(struct ifnet *ifp, int disable)
2014{
2015	struct ipw_softc *sc = ifp->if_softc;
2016	struct ieee80211com *ic = &sc->sc_ic;
2017	int i;
2018
2019	ipw_stop_master(sc);
2020	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2021
2022	/*
2023	 * Release tx buffers
2024	 */
2025	for (i = 0; i < IPW_NTBD; i++)
2026		ipw_release_sbd(sc, &sc->stbd_list[i]);
2027
2028	ifp->if_timer = 0;
2029	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2030
2031	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2032}
2033
2034void
2035ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2036    bus_size_t count)
2037{
2038	for (; count > 0; offset++, datap++, count--) {
2039		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2040		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2041	}
2042}
2043
2044void
2045ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2046    bus_size_t count)
2047{
2048	for (; count > 0; offset++, datap++, count--) {
2049		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2050		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2051	}
2052}
2053
2054struct cfdriver ipw_cd = {
2055	0, "ipw", DV_IFNET
2056};
2057