if_ipw.c revision 1.38
1/*	$OpenBSD: if_ipw.c,v 1.38 2005/01/05 09:07:16 jsg Exp $	*/
2
3/*-
4 * Copyright (c) 2004
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46#include <sys/device.h>
47
48#include <machine/bus.h>
49#include <machine/endian.h>
50#include <machine/intr.h>
51
52#include <dev/pci/pcireg.h>
53#include <dev/pci/pcivar.h>
54#include <dev/pci/pcidevs.h>
55
56#if NBPFILTER > 0
57#include <net/bpf.h>
58#endif
59#include <net/if.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_media.h>
63#include <net/if_types.h>
64
65#include <netinet/in.h>
66#include <netinet/in_systm.h>
67#include <netinet/in_var.h>
68#include <netinet/if_ether.h>
69#include <netinet/ip.h>
70
71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <dev/pci/if_ipwreg.h>
75#include <dev/pci/if_ipwvar.h>
76
77static const struct ieee80211_rateset ipw_rateset_11b =
78	{ 4, { 2, 4, 11, 22 } };
79
80int ipw_match(struct device *, void *, void *);
81void ipw_attach(struct device *, struct device *, void *);
82int ipw_detach(struct device *, int);
83void ipw_power(int, void *);
84int ipw_dma_alloc(struct ipw_softc *);
85void ipw_release(struct ipw_softc *);
86int ipw_media_change(struct ifnet *);
87void ipw_media_status(struct ifnet *, struct ifmediareq *);
88int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
89u_int16_t ipw_read_prom_word(struct ipw_softc *, u_int8_t);
90void ipw_scan_result(struct ipw_softc *);
91void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
92void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
93void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
94    struct ipw_soft_bd *, struct ipw_soft_buf *);
95void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
96void ipw_rx_intr(struct ipw_softc *);
97void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
98void ipw_tx_intr(struct ipw_softc *);
99int ipw_intr(void *);
100int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
101int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
102void ipw_start(struct ifnet *);
103void ipw_watchdog(struct ifnet *);
104int ipw_get_table1(struct ipw_softc *, u_int32_t *);
105int ipw_get_radio(struct ipw_softc *, int *);
106int ipw_ioctl(struct ifnet *, u_long, caddr_t);
107u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
108void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
109int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
110void ipw_stop_master(struct ipw_softc *);
111int ipw_reset(struct ipw_softc *);
112int ipw_load_ucode(struct ipw_softc *, u_char *, int);
113int ipw_load_firmware(struct ipw_softc *, u_char *, int);
114int ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
115int ipw_config(struct ipw_softc *);
116int ipw_init(struct ifnet *);
117void ipw_stop(struct ifnet *, int);
118void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
119void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
120
121static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
122{
123	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
124	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
125}
126
127static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
128{
129	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
130	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
131}
132
133#ifdef IPW_DEBUG
134#define DPRINTF(x)	if (ipw_debug > 0) printf x
135#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
136int ipw_debug = 0;
137#else
138#define DPRINTF(x)
139#define DPRINTFN(n, x)
140#endif
141
142struct cfattach ipw_ca = {
143	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
144};
145
146int
147ipw_match(struct device *parent, void *match, void *aux)
148{
149	struct pci_attach_args *pa = aux;
150
151	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
152	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
153		return 1;
154
155	return 0;
156}
157
158/* Base Address Register */
159#define IPW_PCI_BAR0	0x10
160
161void
162ipw_attach(struct device *parent, struct device *self, void *aux)
163{
164	struct ipw_softc *sc = (struct ipw_softc *)self;
165	struct ieee80211com *ic = &sc->sc_ic;
166	struct ifnet *ifp = &ic->ic_if;
167	struct pci_attach_args *pa = aux;
168	const char *intrstr;
169	bus_space_tag_t memt;
170	bus_space_handle_t memh;
171	bus_addr_t base;
172	pci_intr_handle_t ih;
173	pcireg_t data;
174	u_int16_t val;
175	int error, i;
176
177	sc->sc_pct = pa->pa_pc;
178	sc->sc_pcitag = pa->pa_tag,
179
180	/* clear device specific PCI configuration register 0x41 */
181	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
182	data &= ~0x0000ff00;
183	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
184
185	/* enable bus-mastering */
186	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG);
187	data |= PCI_COMMAND_MASTER_ENABLE;
188	pci_conf_write(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG, data);
189
190	/* map the register window */
191	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
192	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
193	if (error != 0) {
194		printf(": could not map memory space\n");
195		return;
196	}
197
198	sc->sc_st = memt;
199	sc->sc_sh = memh;
200	sc->sc_dmat = pa->pa_dmat;
201
202	/* disable interrupts */
203	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
204
205	if (pci_intr_map(pa, &ih) != 0) {
206		printf(": could not map interrupt\n");
207		return;
208	}
209
210	intrstr = pci_intr_string(sc->sc_pct, ih);
211	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
212	    sc->sc_dev.dv_xname);
213	if (sc->sc_ih == NULL) {
214		printf(": could not establish interrupt");
215		if (intrstr != NULL)
216			printf(" at %s", intrstr);
217		printf("\n");
218		return;
219	}
220	printf(": %s", intrstr);
221
222	if (ipw_reset(sc) != 0) {
223		printf(": could not reset adapter\n");
224		return;
225	}
226
227	if (ipw_dma_alloc(sc) != 0) {
228		printf(": failed to allocate DMA resources\n");
229		return;
230	}
231
232	ic->ic_phytype = IEEE80211_T_DS;
233	ic->ic_opmode = IEEE80211_M_STA;
234	ic->ic_state = IEEE80211_S_INIT;
235
236	/* set device capabilities */
237	ic->ic_caps = IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
238	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP |
239	    IEEE80211_C_SHPREAMBLE;
240
241	/* read MAC address from EEPROM */
242	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
243	ic->ic_myaddr[0] = val >> 8;
244	ic->ic_myaddr[1] = val & 0xff;
245	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
246	ic->ic_myaddr[2] = val >> 8;
247	ic->ic_myaddr[3] = val & 0xff;
248	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
249	ic->ic_myaddr[4] = val >> 8;
250	ic->ic_myaddr[5] = val & 0xff;
251
252	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
253
254	/* set supported .11b rates */
255	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
256
257	/* set supported .11b channels (1 through 14) */
258	for (i = 1; i <= 14; i++) {
259		ic->ic_channels[i].ic_freq =
260		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
261		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
262	}
263
264	/* default to authmode OPEN */
265	sc->authmode = IEEE80211_AUTH_OPEN;
266
267	/* IBSS channel undefined for now */
268	ic->ic_ibss_chan = &ic->ic_channels[0];
269
270	ifp->if_softc = sc;
271	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
272	ifp->if_init = ipw_init;
273	ifp->if_ioctl = ipw_ioctl;
274	ifp->if_start = ipw_start;
275	ifp->if_watchdog = ipw_watchdog;
276	IFQ_SET_READY(&ifp->if_snd);
277	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
278
279	if_attach(ifp);
280	ieee80211_ifattach(ifp);
281	/* override state transition machine */
282	sc->sc_newstate = ic->ic_newstate;
283	ic->ic_newstate = ipw_newstate;
284	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
285
286	sc->powerhook = powerhook_establish(ipw_power, sc);
287
288#if NBPFILTER > 0
289	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
290	    sizeof (struct ieee80211_frame) + 64);
291
292	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
293	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
294	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
295
296	sc->sc_txtap_len = sizeof sc->sc_txtapu;
297	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
298	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
299#endif
300}
301
302int
303ipw_detach(struct device* self, int flags)
304{
305	struct ipw_softc *sc = (struct ipw_softc *)self;
306	struct ifnet *ifp = &sc->sc_ic.ic_if;
307
308	ipw_stop(ifp, 1);
309
310#if NBPFILTER > 0
311	bpfdetach(ifp);
312#endif
313	ieee80211_ifdetach(ifp);
314	if_detach(ifp);
315
316	ipw_release(sc);
317
318	if (sc->sc_ih != NULL) {
319		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
320		sc->sc_ih = NULL;
321	}
322
323	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
324
325	return 0;
326}
327
328void
329ipw_power(int why, void *arg)
330{
331	struct ipw_softc *sc = arg;
332	struct ifnet *ifp;
333	pcireg_t data;
334
335	if (why != PWR_RESUME)
336		return;
337
338	/* clear device specific PCI configuration register 0x41 */
339	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
340	data &= ~0x0000ff00;
341	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
342
343	ifp = &sc->sc_ic.ic_if;
344	if (ifp->if_flags & IFF_UP) {
345		ifp->if_init(ifp);
346		if (ifp->if_flags & IFF_RUNNING)
347			ifp->if_start(ifp);
348	}
349}
350
351int
352ipw_dma_alloc(struct ipw_softc *sc)
353{
354	struct ipw_soft_bd *sbd;
355	struct ipw_soft_hdr *shdr;
356	struct ipw_soft_buf *sbuf;
357	int i, nsegs, error;
358
359	/*
360	 * Allocate and map tx ring
361	 */
362	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
363	    BUS_DMA_NOWAIT, &sc->tbd_map);
364	if (error != 0) {
365		printf("%s: could not create tx ring DMA map\n",
366		    sc->sc_dev.dv_xname);
367		goto fail;
368	}
369
370	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
371	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
372	if (error != 0) {
373		printf("%s: could not allocate tx ring DMA memory\n",
374		    sc->sc_dev.dv_xname);
375		goto fail;
376	}
377
378	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
379	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
380	if (error != 0) {
381		printf("%s: could not map tx ring DMA memory\n",
382		    sc->sc_dev.dv_xname);
383		goto fail;
384	}
385
386	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
387	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
388	if (error != 0) {
389		printf("%s: could not load tx ring DMA map\n",
390		    sc->sc_dev.dv_xname);
391		goto fail;
392	}
393
394	/*
395	 * Allocate and map rx ring
396	 */
397	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
398	    BUS_DMA_NOWAIT, &sc->rbd_map);
399	if (error != 0) {
400		printf("%s: could not create rx ring DMA map\n",
401		    sc->sc_dev.dv_xname);
402		goto fail;
403	}
404
405	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
406	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
407	if (error != 0) {
408		printf("%s: could not allocate rx ring DMA memory\n",
409		    sc->sc_dev.dv_xname);
410		goto fail;
411	}
412
413	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
414	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
415	if (error != 0) {
416		printf("%s: could not map rx ring DMA memory\n",
417		    sc->sc_dev.dv_xname);
418		goto fail;
419	}
420
421	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
422	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
423	if (error != 0) {
424		printf("%s: could not load tx ring DMA map\n",
425		    sc->sc_dev.dv_xname);
426		goto fail;
427	}
428
429	/*
430	 * Allocate and map status ring
431	 */
432	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
433	    0, BUS_DMA_NOWAIT, &sc->status_map);
434	if (error != 0) {
435		printf("%s: could not create status ring DMA map\n",
436		    sc->sc_dev.dv_xname);
437		goto fail;
438	}
439
440	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
441	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
442	if (error != 0) {
443		printf("%s: could not allocate status ring DMA memory\n",
444		    sc->sc_dev.dv_xname);
445		goto fail;
446	}
447
448	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
449	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
450	if (error != 0) {
451		printf("%s: could not map status ring DMA memory\n",
452		    sc->sc_dev.dv_xname);
453		goto fail;
454	}
455
456	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
457	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
458	if (error != 0) {
459		printf("%s: could not load status ring DMA map\n",
460		    sc->sc_dev.dv_xname);
461		goto fail;
462	}
463
464	/*
465	 * Allocate command DMA map
466	 */
467	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
468	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
469	if (error != 0) {
470		printf("%s: could not create command DMA map\n",
471		    sc->sc_dev.dv_xname);
472		goto fail;
473	}
474
475	/*
476	 * Allocate headers DMA maps
477	 */
478	SLIST_INIT(&sc->free_shdr);
479	for (i = 0; i < IPW_NDATA; i++) {
480		shdr = &sc->shdr_list[i];
481		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
482		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
483		if (error != 0) {
484			printf("%s: could not create header DMA map\n",
485			    sc->sc_dev.dv_xname);
486			goto fail;
487		}
488		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
489	}
490
491	/*
492	 * Allocate tx buffers DMA maps
493	 */
494	SLIST_INIT(&sc->free_sbuf);
495	for (i = 0; i < IPW_NDATA; i++) {
496		sbuf = &sc->tx_sbuf_list[i];
497		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
498		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
499		if (error != 0) {
500			printf("%s: could not create tx DMA map\n",
501			    sc->sc_dev.dv_xname);
502			goto fail;
503		}
504		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
505	}
506
507	/*
508	 * Initialize tx ring
509	 */
510	for (i = 0; i < IPW_NTBD; i++) {
511		sbd = &sc->stbd_list[i];
512		sbd->bd = &sc->tbd_list[i];
513		sbd->type = IPW_SBD_TYPE_NOASSOC;
514	}
515
516	/*
517	 * Pre-allocate rx buffers and DMA maps
518	 */
519	for (i = 0; i < IPW_NRBD; i++) {
520		sbd = &sc->srbd_list[i];
521		sbuf = &sc->rx_sbuf_list[i];
522		sbd->bd = &sc->rbd_list[i];
523
524		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
525		if (sbuf->m == NULL) {
526			printf("%s: could not allocate rx mbuf\n",
527			    sc->sc_dev.dv_xname);
528			error = ENOMEM;
529			goto fail;
530		}
531
532		MCLGET(sbuf->m, M_DONTWAIT);
533		if (!(sbuf->m->m_flags & M_EXT)) {
534			m_freem(sbuf->m);
535			printf("%s: could not allocate rx mbuf cluster\n",
536			    sc->sc_dev.dv_xname);
537			error = ENOMEM;
538			goto fail;
539		}
540
541		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
542		    0, BUS_DMA_NOWAIT, &sbuf->map);
543		if (error != 0) {
544			printf("%s: could not create rx DMA map\n",
545			    sc->sc_dev.dv_xname);
546			goto fail;
547		}
548
549		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
550		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
551		if (error != 0) {
552			printf("%s: could not map rx DMA memory\n",
553			    sc->sc_dev.dv_xname);
554			goto fail;
555		}
556
557		sbd->type = IPW_SBD_TYPE_DATA;
558		sbd->priv = sbuf;
559		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
560		sbd->bd->len = htole32(MCLBYTES);
561	}
562
563	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
564	    BUS_DMASYNC_PREWRITE);
565
566	return 0;
567
568fail:	ipw_release(sc);
569	return error;
570}
571
572void
573ipw_release(struct ipw_softc *sc)
574{
575	struct ipw_soft_buf *sbuf;
576	int i;
577
578	if (sc->tbd_map != NULL) {
579		if (sc->tbd_list != NULL) {
580			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
581			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
582			    IPW_TBD_SZ);
583			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
584		}
585		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
586	}
587
588	if (sc->rbd_map != NULL) {
589		if (sc->rbd_list != NULL) {
590			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
591			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
592			    IPW_RBD_SZ);
593			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
594		}
595		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
596	}
597
598	if (sc->status_map != NULL) {
599		if (sc->status_list != NULL) {
600			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
601			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
602			    IPW_RBD_SZ);
603			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
604		}
605		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
606	}
607
608	if (sc->cmd_map != NULL)
609		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
610
611	for (i = 0; i < IPW_NDATA; i++)
612		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
613
614	for (i = 0; i < IPW_NDATA; i++)
615		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
616
617	for (i = 0; i < IPW_NRBD; i++) {
618		sbuf = &sc->rx_sbuf_list[i];
619		if (sbuf->map != NULL) {
620			if (sbuf->m != NULL) {
621				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
622				m_freem(sbuf->m);
623			}
624			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
625		}
626	}
627}
628
629int
630ipw_media_change(struct ifnet *ifp)
631{
632	int error;
633
634	error = ieee80211_media_change(ifp);
635	if (error != ENETRESET)
636		return error;
637
638	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
639		ipw_init(ifp);
640
641	return 0;
642}
643
644void
645ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
646{
647	struct ipw_softc *sc = ifp->if_softc;
648	struct ieee80211com *ic = &sc->sc_ic;
649#define N(a)	(sizeof (a) / sizeof (a[0]))
650	static const struct {
651		u_int32_t	val;
652		int		rate;
653	} rates[] = {
654		{ IPW_RATE_DS1,   2 },
655		{ IPW_RATE_DS2,   4 },
656		{ IPW_RATE_DS5,  11 },
657		{ IPW_RATE_DS11, 22 },
658	};
659	u_int32_t val;
660	int rate, i;
661
662	imr->ifm_status = IFM_AVALID;
663	imr->ifm_active = IFM_IEEE80211;
664	if (ic->ic_state == IEEE80211_S_RUN)
665		imr->ifm_status |= IFM_ACTIVE;
666
667	/* read current transmission rate from adapter */
668	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
669	val &= 0xf;
670
671	/* convert rate to 802.11 rate */
672	for (i = 0; i < N(rates) && rates[i].val != val; i++);
673	rate = (i < N(rates)) ? rates[i].rate : 0;
674
675	imr->ifm_active |= IFM_IEEE80211_11B;
676	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
677	switch (ic->ic_opmode) {
678	case IEEE80211_M_STA:
679		break;
680
681	case IEEE80211_M_IBSS:
682		imr->ifm_active |= IFM_IEEE80211_IBSS;
683		break;
684
685	case IEEE80211_M_MONITOR:
686		imr->ifm_active |= IFM_IEEE80211_MONITOR;
687		break;
688
689	case IEEE80211_M_AHDEMO:
690	case IEEE80211_M_HOSTAP:
691		/* should not get there */
692		break;
693	}
694#undef N
695}
696
697int
698ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
699{
700	struct ipw_softc *sc = ic->ic_softc;
701	struct ieee80211_node *ni = ic->ic_bss;
702	u_int32_t len;
703	u_int8_t val;
704
705	switch (nstate) {
706	case IEEE80211_S_RUN:
707		len = IEEE80211_NWID_LEN;
708		ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
709		ni->ni_esslen = len;
710
711		val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
712		ni->ni_chan = &ic->ic_channels[val];
713
714		DELAY(100); /* firmware needs a short delay here */
715
716		len = IEEE80211_ADDR_LEN;
717		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
718		break;
719
720	case IEEE80211_S_INIT:
721	case IEEE80211_S_SCAN:
722	case IEEE80211_S_AUTH:
723	case IEEE80211_S_ASSOC:
724		break;
725	}
726
727	ic->ic_state = nstate;
728	return 0;
729}
730
731/*
732 * Read 16 bits at address 'addr' from the Microwire EEPROM.
733 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
734 */
735u_int16_t
736ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
737{
738	u_int32_t tmp;
739	u_int16_t val;
740	int n;
741
742	/* Clock C once before the first command */
743	IPW_EEPROM_CTL(sc, 0);
744	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
745	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
746	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
747
748	/* Write start bit (1) */
749	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
750	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
751
752	/* Write READ opcode (10) */
753	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
754	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
755	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
756	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
757
758	/* Write address A7-A0 */
759	for (n = 7; n >= 0; n--) {
760		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
761		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
762		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
763		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
764	}
765
766	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
767
768	/* Read data Q15-Q0 */
769	val = 0;
770	for (n = 15; n >= 0; n--) {
771		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
772		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
773		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
774		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
775	}
776
777	IPW_EEPROM_CTL(sc, 0);
778
779	/* Clear Chip Select and clock C */
780	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
781	IPW_EEPROM_CTL(sc, 0);
782	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
783
784	return letoh16(val);
785}
786
787void
788ipw_scan_result(struct ipw_softc *sc)
789{
790	struct ieee80211com *ic = &sc->sc_ic;
791	struct ieee80211_node *ni;
792	u_int32_t i, cnt, off;
793	struct ipw_node ap;
794
795	/* flush previously seen access points */
796	ieee80211_free_allnodes(ic);
797
798	cnt = ipw_read_table1(sc, IPW_INFO_APS_CNT);
799	off = ipw_read_table1(sc, IPW_INFO_APS_BASE);
800
801	DPRINTF(("Found %u APs\n", cnt));
802
803	for (i = 0; i < cnt; i++) {
804		ipw_read_mem_1(sc, off, (u_int8_t *)&ap, sizeof ap);
805		off += sizeof ap;
806
807#ifdef IPW_DEBUG
808		if (ipw_debug >= 2) {
809			u_char *p = (u_char *)&ap;
810			int j;
811
812			printf("AP%u\n", i);
813			for (j = 0; j < sizeof ap; j++)
814				printf("%02x", *p++);
815			printf("\n");
816		}
817#endif
818
819		ni = ieee80211_lookup_node(ic, ap.bssid,
820		    &ic->ic_channels[ap.chan]);
821		if (ni != NULL)
822			continue;
823
824		ni = ieee80211_alloc_node(ic, ap.bssid);
825		if (ni == NULL)
826			return;
827
828		IEEE80211_ADDR_COPY(ni->ni_bssid, ap.bssid);
829		ni->ni_rssi = ap.rssi;
830		ni->ni_intval = letoh16(ap.intval);
831		ni->ni_capinfo = letoh16(ap.capinfo);
832		ni->ni_chan = &ic->ic_channels[ap.chan];
833		ni->ni_esslen = ap.esslen;
834		bcopy(ap.essid, ni->ni_essid, IEEE80211_NWID_LEN);
835	}
836}
837
838void
839ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
840{
841	struct ipw_cmd *cmd;
842
843	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
844	    BUS_DMASYNC_POSTREAD);
845
846	cmd = mtod(sbuf->m, struct ipw_cmd *);
847
848	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
849	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
850	    letoh32(cmd->len), letoh32(cmd->status)));
851
852	wakeup(sc);
853}
854
855void
856ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
857{
858	struct ieee80211com *ic = &sc->sc_ic;
859	u_int32_t state;
860
861	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
862	    BUS_DMASYNC_POSTREAD);
863
864	state = letoh32(*mtod(sbuf->m, u_int32_t *));
865
866	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
867
868	switch (state) {
869	case IPW_STATE_ASSOCIATED:
870		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
871		break;
872
873	case IPW_STATE_SCANNING:
874		/* don't leave run state on background scan */
875		if (ic->ic_state != IEEE80211_S_RUN)
876			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
877		break;
878
879	case IPW_STATE_SCAN_COMPLETE:
880		ipw_scan_result(sc);
881		break;
882
883	case IPW_STATE_ASSOCIATION_LOST:
884		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
885		break;
886
887	case IPW_STATE_RADIO_DISABLED:
888		ipw_stop(&ic->ic_if, 1);
889		break;
890	}
891}
892
893void
894ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
895    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
896{
897	struct ieee80211com *ic = &sc->sc_ic;
898	struct ifnet *ifp = &ic->ic_if;
899	struct mbuf *m;
900	struct ieee80211_frame *wh;
901	struct ieee80211_node *ni;
902	int error;
903
904	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
905
906	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
907	    BUS_DMASYNC_POSTREAD);
908
909	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
910
911	/* Finalize mbuf */
912	m = sbuf->m;
913	m->m_pkthdr.rcvif = ifp;
914	m->m_pkthdr.len = m->m_len = letoh32(status->len);
915
916#if NBPFILTER > 0
917	if (sc->sc_drvbpf != NULL) {
918		struct mbuf mb;
919		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
920
921		tap->wr_flags = 0;
922		tap->wr_antsignal = status->rssi;
923		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
924		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
925
926		M_DUP_PKTHDR(&mb, m);
927		mb.m_data = (caddr_t)tap;
928		mb.m_len = sc->sc_rxtap_len;
929		mb.m_next = m;
930		mb.m_pkthdr.len += mb.m_len;
931		bpf_mtap(sc->sc_drvbpf, &mb);
932	}
933#endif
934
935	wh = mtod(m, struct ieee80211_frame *);
936
937	ni = ieee80211_find_rxnode(ic, wh);
938
939	/* Send the frame to the upper layer */
940	ieee80211_input(ifp, m, ni, status->rssi, 0);
941
942	if (ni == ic->ic_bss)
943		ieee80211_unref_node(&ni);
944	else
945		ieee80211_free_node(ic, ni);
946
947	MGETHDR(m, M_DONTWAIT, MT_DATA);
948	if (m == NULL) {
949		printf("%s: could not allocate rx mbuf\n",
950		    sc->sc_dev.dv_xname);
951		return;
952	}
953	MCLGET(m, M_DONTWAIT);
954	if (!(m->m_flags & M_EXT)) {
955		m_freem(m);
956		printf("%s: could not allocate rx mbuf cluster\n",
957		    sc->sc_dev.dv_xname);
958		return;
959	}
960
961	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
962	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
963	if (error != 0) {
964		printf("%s: could not map rx DMA memory\n",
965		    sc->sc_dev.dv_xname);
966		m_freem(m);
967		return;
968	}
969
970	sbuf->m = m;
971	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
972}
973
974void
975ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
976{
977	DPRINTFN(2, ("RX!NOTIFICATION\n"));
978}
979
980void
981ipw_rx_intr(struct ipw_softc *sc)
982{
983	struct ipw_status *status;
984	struct ipw_soft_bd *sbd;
985	struct ipw_soft_buf *sbuf;
986	u_int32_t r, i;
987
988	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
989
990	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
991
992		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
993		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
994		    BUS_DMASYNC_POSTREAD);
995
996		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
997		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
998		    BUS_DMASYNC_POSTREAD);
999
1000		status = &sc->status_list[i];
1001		sbd = &sc->srbd_list[i];
1002		sbuf = sbd->priv;
1003
1004		switch (letoh16(status->code) & 0xf) {
1005		case IPW_STATUS_CODE_COMMAND:
1006			ipw_command_intr(sc, sbuf);
1007			break;
1008
1009		case IPW_STATUS_CODE_NEWSTATE:
1010			ipw_newstate_intr(sc, sbuf);
1011			break;
1012
1013		case IPW_STATUS_CODE_DATA_802_3:
1014		case IPW_STATUS_CODE_DATA_802_11:
1015			ipw_data_intr(sc, status, sbd, sbuf);
1016			break;
1017
1018		case IPW_STATUS_CODE_NOTIFICATION:
1019			ipw_notification_intr(sc, sbuf);
1020			break;
1021
1022		default:
1023			printf("%s: unknown status code %u\n",
1024			    sc->sc_dev.dv_xname, letoh16(status->code));
1025		}
1026		sbd->bd->flags = 0;
1027
1028		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
1029		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1030		    BUS_DMASYNC_PREWRITE);
1031	}
1032
1033	/* Tell the firmware what we have processed */
1034	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
1035	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
1036}
1037
1038void
1039ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1040{
1041	struct ieee80211com *ic = &sc->sc_ic;
1042	struct ipw_soft_hdr *shdr;
1043	struct ipw_soft_buf *sbuf;
1044
1045	switch (sbd->type) {
1046	case IPW_SBD_TYPE_COMMAND:
1047		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
1048		break;
1049
1050	case IPW_SBD_TYPE_HEADER:
1051		shdr = sbd->priv;
1052		bus_dmamap_unload(sc->sc_dmat, shdr->map);
1053		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1054		break;
1055
1056	case IPW_SBD_TYPE_DATA:
1057		sbuf = sbd->priv;
1058		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1059		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1060
1061		m_freem(sbuf->m);
1062
1063		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
1064			ieee80211_free_node(ic, sbuf->ni);
1065
1066		/* kill watchdog timer */
1067		sc->sc_tx_timer = 0;
1068		break;
1069	}
1070	sbd->type = IPW_SBD_TYPE_NOASSOC;
1071}
1072
1073void
1074ipw_tx_intr(struct ipw_softc *sc)
1075{
1076	struct ifnet *ifp = &sc->sc_ic.ic_if;
1077	u_int32_t r, i;
1078
1079	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1080
1081	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1082		ipw_release_sbd(sc, &sc->stbd_list[i]);
1083		sc->txfree++;
1084	}
1085
1086	/* Remember what the firmware has processed */
1087	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1088
1089	/* Call start() since some buffer descriptors have been released */
1090	if (sc->txfree >= 1 + IPW_MAX_NSEG) {
1091		ifp->if_flags &= ~IFF_OACTIVE;
1092		(*ifp->if_start)(ifp);
1093	}
1094}
1095
1096int
1097ipw_intr(void *arg)
1098{
1099	struct ipw_softc *sc = arg;
1100	u_int32_t r;
1101
1102	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1103		return 0;
1104
1105	/* Disable interrupts */
1106	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1107
1108	DPRINTFN(8, ("INTR!0x%08x\n", r));
1109
1110	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1111		printf("%s: fatal error\n", sc->sc_dev.dv_xname);
1112		ipw_stop(&sc->sc_ic.ic_if, 1);
1113	}
1114
1115	if (r & IPW_INTR_FW_INIT_DONE) {
1116		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1117			wakeup(sc);
1118	}
1119
1120	if (r & IPW_INTR_RX_TRANSFER)
1121		ipw_rx_intr(sc);
1122
1123	if (r & IPW_INTR_TX_TRANSFER)
1124		ipw_tx_intr(sc);
1125
1126	/* Acknowledge interrupts */
1127	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1128
1129	/* Re-enable interrupts */
1130	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1131
1132	return 1;
1133}
1134
1135int
1136ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
1137{
1138	struct ipw_soft_bd *sbd;
1139	int error;
1140
1141	sbd = &sc->stbd_list[sc->txcur];
1142
1143	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1144	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1145	if (error != 0) {
1146		printf("%s: could not map command DMA memory\n",
1147		    sc->sc_dev.dv_xname);
1148		return error;
1149	}
1150
1151	sc->cmd.type = htole32(type);
1152	sc->cmd.subtype = htole32(0);
1153	sc->cmd.len = htole32(len);
1154	sc->cmd.seq = htole32(0);
1155	if (data != NULL)
1156		bcopy(data, sc->cmd.data, len);
1157
1158	sbd->type = IPW_SBD_TYPE_COMMAND;
1159	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1160	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1161	sbd->bd->nfrag = 1;
1162	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1163			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
1164
1165	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1166	    BUS_DMASYNC_PREWRITE);
1167
1168	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1169	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1170	    BUS_DMASYNC_PREWRITE);
1171
1172	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1173	sc->txfree--;
1174	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1175
1176	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1177
1178	/* Wait at most one second for command to complete */
1179	return tsleep(sc, 0, "ipwcmd", hz);
1180}
1181
1182int
1183ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1184{
1185	struct ipw_softc *sc = ifp->if_softc;
1186	struct ieee80211com *ic = &sc->sc_ic;
1187	struct ieee80211_frame *wh;
1188	struct ipw_soft_bd *sbd;
1189	struct ipw_soft_hdr *shdr;
1190	struct ipw_soft_buf *sbuf;
1191	struct mbuf *mnew;
1192	int error, i;
1193
1194	if (ic->ic_flags & IEEE80211_F_WEPON) {
1195		m = ieee80211_wep_crypt(ifp, m, 1);
1196		if (m == NULL)
1197			return ENOBUFS;
1198	}
1199
1200#if NBPFILTER > 0
1201	if (sc->sc_drvbpf != NULL) {
1202		struct mbuf mb;
1203		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1204
1205		tap->wt_flags = 0;
1206		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1207		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1208
1209		M_DUP_PKTHDR(&mb, m);
1210		mb.m_data = (caddr_t)tap;
1211		mb.m_len = sc->sc_txtap_len;
1212		mb.m_next = m;
1213		mb.m_pkthdr.len += mb.m_len;
1214		bpf_mtap(sc->sc_drvbpf, &mb);
1215	}
1216#endif
1217
1218	wh = mtod(m, struct ieee80211_frame *);
1219
1220	shdr = SLIST_FIRST(&sc->free_shdr);
1221	sbuf = SLIST_FIRST(&sc->free_sbuf);
1222
1223	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1224	shdr->hdr.subtype = htole32(0);
1225	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1226	shdr->hdr.encrypt = 0;
1227	shdr->hdr.keyidx = 0;
1228	shdr->hdr.keysz = 0;
1229	shdr->hdr.fragmentsz = htole16(0);
1230	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1231	if (ic->ic_opmode == IEEE80211_M_STA)
1232		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1233	else
1234		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1235
1236	/* trim IEEE802.11 header */
1237	m_adj(m, sizeof (struct ieee80211_frame));
1238
1239	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1240	if (error != 0 && error != EFBIG) {
1241		printf("%s: could not map mbuf (error %d)\n",
1242		    sc->sc_dev.dv_xname, error);
1243		m_freem(m);
1244		return error;
1245	}
1246	if (error != 0) {
1247		/* too many fragments, linearize */
1248
1249		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1250		if (mnew == NULL) {
1251			m_freem(m);
1252			return ENOMEM;
1253		}
1254
1255		M_DUP_PKTHDR(mnew, m);
1256		MCLGET(mnew, M_DONTWAIT);
1257		if (!(mnew->m_flags & M_EXT)) {
1258			m_freem(m);
1259			m_freem(mnew);
1260			return ENOMEM;
1261		}
1262
1263		m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew, caddr_t));
1264		m_freem(m);
1265		mnew->m_len = mnew->m_pkthdr.len;
1266		m = mnew;
1267
1268		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1269		    BUS_DMA_NOWAIT);
1270		if (error != 0) {
1271			printf("%s: could not map mbuf (error %d)\n",
1272			    sc->sc_dev.dv_xname, error);
1273			m_freem(m);
1274			return error;
1275		}
1276	}
1277
1278	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1279	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1280	if (error != 0) {
1281		printf("%s: could not map header DMA memory (error %d)\n",
1282		    sc->sc_dev.dv_xname, error);
1283		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1284		m_freem(m);
1285		return error;
1286	}
1287
1288	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1289	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1290
1291	sbd = &sc->stbd_list[sc->txcur];
1292	sbd->type = IPW_SBD_TYPE_HEADER;
1293	sbd->priv = shdr;
1294	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1295	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1296	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1297	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1298			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1299
1300	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1301	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1302	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1303	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1304
1305	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1306	    sc->txcur * sizeof (struct ipw_bd),
1307	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1308
1309	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1310	sc->txfree--;
1311
1312	sbuf->m = m;
1313	sbuf->ni = ni;
1314
1315	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1316		sbd = &sc->stbd_list[sc->txcur];
1317		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1318		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1319		sbd->bd->nfrag = 0; /* used only in first bd */
1320		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1321		if (i == sbuf->map->dm_nsegs - 1) {
1322			sbd->type = IPW_SBD_TYPE_DATA;
1323			sbd->priv = sbuf;
1324			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1325		} else {
1326			sbd->type = IPW_SBD_TYPE_NOASSOC;
1327			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1328		}
1329
1330		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1331		    sbuf->map->dm_segs[i].ds_len));
1332
1333		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1334		    sc->txcur * sizeof (struct ipw_bd),
1335		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1336
1337		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1338		sc->txfree--;
1339	}
1340
1341	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1342	    BUS_DMASYNC_PREWRITE);
1343
1344	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
1345	    BUS_DMASYNC_PREWRITE);
1346
1347	/* Inform firmware about this new packet */
1348	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1349
1350	if (sc->txfree < 1 + IPW_MAX_NSEG)
1351		ifp->if_flags |= IFF_OACTIVE;
1352
1353	return 0;
1354}
1355
1356void
1357ipw_start(struct ifnet *ifp)
1358{
1359	struct ipw_softc *sc = ifp->if_softc;
1360	struct ieee80211com *ic = &sc->sc_ic;
1361	struct mbuf *m;
1362	struct ieee80211_node *ni;
1363
1364	if (ic->ic_state != IEEE80211_S_RUN)
1365		return;
1366
1367	for (;;) {
1368		IF_DEQUEUE(&ifp->if_snd, m);
1369		if (m == NULL)
1370			break;
1371
1372#if NBPFILTER > 0
1373		if (ifp->if_bpf != NULL)
1374			bpf_mtap(ifp->if_bpf, m);
1375#endif
1376
1377		m = ieee80211_encap(ifp, m, &ni);
1378		if (m == NULL)
1379			continue;
1380
1381#if NBPFILTER > 0
1382		if (ic->ic_rawbpf != NULL)
1383			bpf_mtap(ic->ic_rawbpf, m);
1384#endif
1385
1386		if (ipw_tx_start(ifp, m, ni) != 0) {
1387			if (ni != NULL && ni != ic->ic_bss)
1388				ieee80211_free_node(ic, ni);
1389			break;
1390		}
1391
1392		/* start watchdog timer */
1393		sc->sc_tx_timer = 5;
1394		ifp->if_timer = 1;
1395	}
1396}
1397
1398void
1399ipw_watchdog(struct ifnet *ifp)
1400{
1401	struct ipw_softc *sc = ifp->if_softc;
1402
1403	ifp->if_timer = 0;
1404
1405	if (sc->sc_tx_timer > 0) {
1406		if (--sc->sc_tx_timer == 0) {
1407			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1408			ipw_stop(ifp, 1);
1409			return;
1410		}
1411		ifp->if_timer = 1;
1412	}
1413
1414	ieee80211_watchdog(ifp);
1415}
1416
1417int
1418ipw_get_table1(struct ipw_softc *sc, u_int32_t *tbl)
1419{
1420	u_int32_t i, size, buf[256];
1421
1422	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
1423		bzero(buf, sizeof buf);
1424		return copyout(buf, tbl, sizeof buf);
1425	}
1426
1427	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
1428
1429	size = min(CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA), 256);
1430	for (i = 1; i < size; i++)
1431		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
1432
1433	return copyout(buf, tbl, sizeof buf);
1434}
1435
1436int
1437ipw_get_radio(struct ipw_softc *sc, int *ret)
1438{
1439	int val;
1440
1441	val = (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ? 0 : 1;
1442	return copyout(&val, ret, sizeof val);
1443}
1444
1445int
1446ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1447{
1448	struct ipw_softc *sc = ifp->if_softc;
1449	struct ifreq *ifr;
1450	struct ifaddr *ifa;
1451	int s, error = 0;
1452
1453	s = splnet();
1454
1455	switch (cmd) {
1456	case SIOCSIFADDR:
1457		ifa = (struct ifaddr *) data;
1458		ifp->if_flags |= IFF_UP;
1459		switch (ifa->ifa_addr->sa_family) {
1460#ifdef INET
1461		case AF_INET:
1462			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
1463			ipw_init(ifp);
1464			break;
1465#endif
1466		default:
1467			ipw_init(ifp);
1468		}
1469		break;
1470
1471	case SIOCSIFFLAGS:
1472		if (ifp->if_flags & IFF_UP) {
1473			if (!(ifp->if_flags & IFF_RUNNING))
1474				ipw_init(ifp);
1475		} else {
1476			if (ifp->if_flags & IFF_RUNNING)
1477				ipw_stop(ifp, 1);
1478		}
1479		break;
1480
1481	case SIOCGTABLE1:
1482		ifr = (struct ifreq *)data;
1483		error = ipw_get_table1(sc, (u_int32_t *)ifr->ifr_data);
1484		break;
1485
1486	case SIOCGRADIO:
1487		ifr = (struct ifreq *)data;
1488		error = ipw_get_radio(sc, (int *)ifr->ifr_data);
1489		break;
1490
1491	case SIOCG80211AUTH:
1492		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1493		break;
1494
1495	case SIOCS80211AUTH:
1496		/* only super-user can do that! */
1497		if ((error = suser(curproc, 0)) != 0)
1498			break;
1499
1500		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1501		break;
1502
1503	default:
1504		error = ieee80211_ioctl(ifp, cmd, data);
1505	}
1506
1507	if (error == ENETRESET && cmd != SIOCADDMULTI) {
1508		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1509		    (IFF_UP | IFF_RUNNING))
1510			ipw_init(ifp);
1511		error = 0;
1512	}
1513
1514	splx(s);
1515	return error;
1516}
1517
1518u_int32_t
1519ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1520{
1521	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1522}
1523
1524void
1525ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1526{
1527	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1528}
1529
1530int
1531ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1532{
1533	u_int32_t addr, info;
1534	u_int16_t count, size;
1535	u_int32_t total;
1536
1537	/* addr[4] + count[2] + size[2] */
1538	addr = MEM_READ_4(sc, sc->table2_base + off);
1539	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1540
1541	count = info >> 16;
1542	size = info & 0xffff;
1543	total = count * size;
1544
1545	if (total > *len) {
1546		*len = total;
1547		return EINVAL;
1548	}
1549
1550	*len = total;
1551	ipw_read_mem_1(sc, addr, buf, total);
1552
1553	return 0;
1554}
1555
1556void
1557ipw_stop_master(struct ipw_softc *sc)
1558{
1559	int ntries;
1560
1561	/* Disable interrupts */
1562	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1563
1564	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1565	for (ntries = 0; ntries < 50; ntries++) {
1566		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1567			break;
1568		DELAY(10);
1569	}
1570	if (ntries == 50)
1571		printf("%s: timeout waiting for master\n",
1572		    sc->sc_dev.dv_xname);
1573
1574	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1575	    IPW_RST_PRINCETON_RESET);
1576
1577	sc->flags &= ~IPW_FLAG_FW_INITED;
1578}
1579
1580int
1581ipw_reset(struct ipw_softc *sc)
1582{
1583	int ntries;
1584
1585	ipw_stop_master(sc);
1586
1587	/* Move adapter to D0 state */
1588	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1589	    IPW_CTL_INIT);
1590
1591	/* Wait for clock stabilization */
1592	for (ntries = 0; ntries < 1000; ntries++) {
1593		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1594			break;
1595		DELAY(200);
1596	}
1597	if (ntries == 1000)
1598		return EIO;
1599
1600	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1601	    IPW_RST_SW_RESET);
1602
1603	DELAY(10);
1604
1605	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1606	    IPW_CTL_INIT);
1607
1608	return 0;
1609}
1610
1611int
1612ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1613{
1614	int ntries;
1615
1616	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1617	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1618
1619	MEM_WRITE_2(sc, 0x220000, 0x0703);
1620	MEM_WRITE_2(sc, 0x220000, 0x0707);
1621
1622	MEM_WRITE_1(sc, 0x210014, 0x72);
1623	MEM_WRITE_1(sc, 0x210014, 0x72);
1624
1625	MEM_WRITE_1(sc, 0x210000, 0x40);
1626	MEM_WRITE_1(sc, 0x210000, 0x00);
1627	MEM_WRITE_1(sc, 0x210000, 0x40);
1628
1629	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1630
1631	MEM_WRITE_1(sc, 0x210000, 0x00);
1632	MEM_WRITE_1(sc, 0x210000, 0x00);
1633	MEM_WRITE_1(sc, 0x210000, 0x80);
1634
1635	MEM_WRITE_2(sc, 0x220000, 0x0703);
1636	MEM_WRITE_2(sc, 0x220000, 0x0707);
1637
1638	MEM_WRITE_1(sc, 0x210014, 0x72);
1639	MEM_WRITE_1(sc, 0x210014, 0x72);
1640
1641	MEM_WRITE_1(sc, 0x210000, 0x00);
1642	MEM_WRITE_1(sc, 0x210000, 0x80);
1643
1644	for (ntries = 0; ntries < 100; ntries++) {
1645		if (MEM_READ_1(sc, 0x210000) & 1)
1646			break;
1647		DELAY(1000);
1648	}
1649	if (ntries == 100) {
1650		printf("%s: timeout waiting for ucode to initialize\n",
1651		    sc->sc_dev.dv_xname);
1652		return EIO;
1653	}
1654
1655	MEM_WRITE_4(sc, 0x3000e0, 0);
1656
1657	return 0;
1658}
1659
1660/* set of macros to handle unaligned little endian data in firmware image */
1661#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1662#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1663int
1664ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1665{
1666	u_char *p, *end;
1667	u_int32_t dst;
1668	u_int16_t len;
1669	int error;
1670
1671	p = fw;
1672	end = fw + size;
1673	while (p < end) {
1674		if (p + 6 > end)
1675			return EINVAL;
1676
1677		dst = GETLE32(p); p += 4;
1678		len = GETLE16(p); p += 2;
1679
1680		if (p + len > end)
1681			return EINVAL;
1682
1683		ipw_write_mem_1(sc, dst, p, len);
1684		p += len;
1685	}
1686
1687	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1688	    IPW_IO_LED_OFF);
1689
1690	/* Allow interrupts so we know when the firmware is inited */
1691	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1692
1693	/* Tell the adapter to initialize the firmware */
1694	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1695	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1696	    IPW_CTL_ALLOW_STANDBY);
1697
1698	/* Wait at most one second for firmware initialization to complete */
1699	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1700		printf("%s: timeout waiting for firmware initialization to "
1701		    "complete\n", sc->sc_dev.dv_xname);
1702		return error;
1703	}
1704
1705	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1706	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1707
1708	return 0;
1709}
1710
1711int
1712ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1713{
1714	struct ipw_firmware_hdr *hdr;
1715	const char *name;
1716	u_char *p;
1717	size_t size;
1718	int error;
1719
1720	switch (sc->sc_ic.ic_opmode) {
1721	case IEEE80211_M_STA:
1722	case IEEE80211_M_HOSTAP:
1723		name = "ipw-bss";
1724		break;
1725
1726	case IEEE80211_M_IBSS:
1727	case IEEE80211_M_AHDEMO:
1728		name = "ipw-ibss";
1729		break;
1730
1731	case IEEE80211_M_MONITOR:
1732		name = "ipw-monitor";
1733		break;
1734	}
1735
1736	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1737		return error;
1738
1739	if (size < sizeof (struct ipw_firmware_hdr)) {
1740		error = EINVAL;
1741		goto fail;
1742	}
1743
1744	p = fw->data;
1745	hdr = (struct ipw_firmware_hdr *)p;
1746	fw->main_size = letoh32(hdr->main_size);
1747	fw->ucode_size = letoh32(hdr->ucode_size);
1748
1749	p += sizeof (struct ipw_firmware_hdr);
1750	size -= sizeof (struct ipw_firmware_hdr);
1751
1752	if (size < fw->main_size + fw->ucode_size) {
1753		error = EINVAL;
1754		goto fail;
1755	}
1756
1757	fw->main = p;
1758	fw->ucode = p + fw->main_size;
1759
1760	return 0;
1761
1762fail:	free(fw->data, M_DEVBUF);
1763	return error;
1764}
1765
1766int
1767ipw_config(struct ipw_softc *sc)
1768{
1769	struct ieee80211com *ic = &sc->sc_ic;
1770	struct ifnet *ifp = &ic->ic_if;
1771	struct ipw_security security;
1772	struct ieee80211_wepkey *k;
1773	struct ipw_wep_key wepkey;
1774	struct ipw_scan_options options;
1775	struct ipw_configuration config;
1776	u_int32_t data;
1777	int error, i;
1778
1779	switch (ic->ic_opmode) {
1780	case IEEE80211_M_STA:
1781	case IEEE80211_M_HOSTAP:
1782		data = htole32(IPW_MODE_BSS);
1783		break;
1784
1785	case IEEE80211_M_IBSS:
1786	case IEEE80211_M_AHDEMO:
1787		data = htole32(IPW_MODE_IBSS);
1788		break;
1789
1790	case IEEE80211_M_MONITOR:
1791		data = htole32(IPW_MODE_MONITOR);
1792		break;
1793	}
1794	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1795	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1796	if (error != 0)
1797		return error;
1798
1799	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1800	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1801		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1802		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1803		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1804		if (error != 0)
1805			return error;
1806	}
1807
1808	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1809		DPRINTF(("Enabling adapter\n"));
1810		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1811	}
1812
1813	IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1814	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1815	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1816	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1817	    IEEE80211_ADDR_LEN);
1818	if (error != 0)
1819		return error;
1820
1821	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1822	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1823	if (ic->ic_opmode == IEEE80211_M_IBSS)
1824		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1825	if (ifp->if_flags & IFF_PROMISC)
1826		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1827	config.bss_chan = htole32(0x3fff); /* channels 1-14 */
1828	config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
1829	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1830	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1831	if (error != 0)
1832		return error;
1833
1834	data = htole32(0x3); /* 1, 2 */
1835	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1836	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1837	if (error != 0)
1838		return error;
1839
1840	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1841	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1842	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1843	if (error != 0)
1844		return error;
1845
1846	data = htole32(IPW_POWER_MODE_CAM);
1847	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1848	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1849	if (error != 0)
1850		return error;
1851
1852	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1853		data = htole32(32); /* default value */
1854		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1855		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1856		    sizeof data);
1857		if (error != 0)
1858			return error;
1859	}
1860
1861	data = htole32(ic->ic_rtsthreshold);
1862	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1863	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1864	if (error != 0)
1865		return error;
1866
1867	data = htole32(ic->ic_fragthreshold);
1868	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1869	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1870	if (error != 0)
1871		return error;
1872
1873#ifdef IPW_DEBUG
1874	if (ipw_debug > 0) {
1875		printf("Setting ESSID to ");
1876		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1877		printf("\n");
1878	}
1879#endif
1880	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1881	    ic->ic_des_esslen);
1882	if (error != 0)
1883		return error;
1884
1885	/* no mandatory BSSID */
1886	DPRINTF(("Setting mandatory BSSID to null\n"));
1887	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1888	if (error != 0)
1889		return error;
1890
1891	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1892		DPRINTF(("Setting adapter BSSID to %s\n",
1893		    ether_sprintf(ic->ic_des_bssid)));
1894		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1895		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1896		if (error != 0)
1897			return error;
1898	}
1899
1900	bzero(&security, sizeof security);
1901	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1902	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1903	security.ciphers = htole32(IPW_CIPHER_NONE);
1904	DPRINTF(("Setting authmode to %u\n", security.authmode));
1905	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1906	    sizeof security);
1907	if (error != 0)
1908		return error;
1909
1910	if (ic->ic_flags & IEEE80211_F_WEPON) {
1911		k = ic->ic_nw_keys;
1912		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1913			if (k->wk_len == 0)
1914				continue;
1915
1916			wepkey.idx = i;
1917			wepkey.len = k->wk_len;
1918			bzero(wepkey.key, sizeof wepkey.key);
1919			bcopy(k->wk_key, wepkey.key, k->wk_len);
1920			DPRINTF(("Setting wep key index %u len %u\n",
1921			    wepkey.idx, wepkey.len));
1922			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1923			    sizeof wepkey);
1924			if (error != 0)
1925				return error;
1926		}
1927
1928		data = htole32(ic->ic_wep_txkey);
1929		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1930		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1931		    sizeof data);
1932		if (error != 0)
1933			return error;
1934	}
1935
1936	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1937	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1938	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1939	if (error != 0)
1940		return error;
1941
1942	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1943	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1944		data = htole32(ic->ic_lintval);
1945		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1946		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1947		    sizeof data);
1948		if (error != 0)
1949			return error;
1950	}
1951
1952	options.flags = htole32(0);
1953	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1954	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1955	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1956	if (error != 0)
1957		return error;
1958
1959	/* finally, enable adapter (start scanning for an access point) */
1960	DPRINTF(("Enabling adapter\n"));
1961	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1962}
1963
1964int
1965ipw_init(struct ifnet *ifp)
1966{
1967	struct ipw_softc *sc = ifp->if_softc;
1968	struct ipw_firmware fw;
1969	int error;
1970
1971	ipw_stop(ifp, 0);
1972
1973	if ((error = ipw_reset(sc)) != 0) {
1974		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1975		goto fail1;
1976	}
1977
1978	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1979		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1980		goto fail1;
1981	}
1982
1983	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1984		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1985		goto fail2;
1986	}
1987
1988	ipw_stop_master(sc);
1989
1990	/*
1991	 * Setup tx, rx and status rings
1992	 */
1993	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1994	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1995	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1996	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1997	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1998	sc->txcur = 0; /* bd index to write to */
1999	sc->txfree = IPW_NTBD - 2;
2000
2001	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
2002	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
2003	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
2004	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
2005	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
2006
2007	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
2008	    sc->status_map->dm_segs[0].ds_addr);
2009
2010	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
2011		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
2012		goto fail2;
2013	}
2014
2015	sc->flags |= IPW_FLAG_FW_INITED;
2016
2017	/* Retrieve information tables base addresses */
2018	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2019	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2020
2021	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2022
2023	if ((error = ipw_config(sc)) != 0) {
2024		printf("%s: device configuration failed\n",
2025		    sc->sc_dev.dv_xname);
2026		goto fail2;
2027	}
2028
2029	ifp->if_flags &= ~IFF_OACTIVE;
2030	ifp->if_flags |= IFF_RUNNING;
2031
2032	return 0;
2033
2034fail2:	free(fw.data, M_DEVBUF);
2035fail1:	ipw_stop(ifp, 0);
2036
2037	return error;
2038}
2039
2040void
2041ipw_stop(struct ifnet *ifp, int disable)
2042{
2043	struct ipw_softc *sc = ifp->if_softc;
2044	struct ieee80211com *ic = &sc->sc_ic;
2045	int i;
2046
2047	ipw_stop_master(sc);
2048	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2049
2050	/*
2051	 * Release tx buffers
2052	 */
2053	for (i = 0; i < IPW_NTBD; i++)
2054		ipw_release_sbd(sc, &sc->stbd_list[i]);
2055
2056	ifp->if_timer = 0;
2057	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2058
2059	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2060}
2061
2062void
2063ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2064    bus_size_t count)
2065{
2066	for (; count > 0; offset++, datap++, count--) {
2067		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2068		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2069	}
2070}
2071
2072void
2073ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
2074    bus_size_t count)
2075{
2076	for (; count > 0; offset++, datap++, count--) {
2077		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2078		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2079	}
2080}
2081
2082struct cfdriver ipw_cd = {
2083	0, "ipw", DV_IFNET
2084};
2085