if_ipw.c revision 1.43
1/*	$OpenBSD: if_ipw.c,v 1.43 2005/03/12 13:23:30 damien Exp $	*/
2
3/*-
4 * Copyright (c) 2004, 2005
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46#include <sys/device.h>
47
48#include <machine/bus.h>
49#include <machine/endian.h>
50#include <machine/intr.h>
51
52#include <dev/pci/pcireg.h>
53#include <dev/pci/pcivar.h>
54#include <dev/pci/pcidevs.h>
55
56#if NBPFILTER > 0
57#include <net/bpf.h>
58#endif
59#include <net/if.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_media.h>
63#include <net/if_types.h>
64
65#include <netinet/in.h>
66#include <netinet/in_systm.h>
67#include <netinet/in_var.h>
68#include <netinet/if_ether.h>
69#include <netinet/ip.h>
70
71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <dev/pci/if_ipwreg.h>
75#include <dev/pci/if_ipwvar.h>
76
77static const struct ieee80211_rateset ipw_rateset_11b =
78	{ 4, { 2, 4, 11, 22 } };
79
80int ipw_match(struct device *, void *, void *);
81void ipw_attach(struct device *, struct device *, void *);
82int ipw_detach(struct device *, int);
83void ipw_power(int, void *);
84int ipw_dma_alloc(struct ipw_softc *);
85void ipw_release(struct ipw_softc *);
86int ipw_media_change(struct ifnet *);
87void ipw_media_status(struct ifnet *, struct ifmediareq *);
88int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
89u_int16_t ipw_read_prom_word(struct ipw_softc *, u_int8_t);
90void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
91void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
92void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
93    struct ipw_soft_bd *, struct ipw_soft_buf *);
94void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
95void ipw_rx_intr(struct ipw_softc *);
96void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
97void ipw_tx_intr(struct ipw_softc *);
98int ipw_intr(void *);
99int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
100int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
101void ipw_start(struct ifnet *);
102void ipw_watchdog(struct ifnet *);
103int ipw_get_table1(struct ipw_softc *, u_int32_t *);
104int ipw_get_radio(struct ipw_softc *, int *);
105int ipw_ioctl(struct ifnet *, u_long, caddr_t);
106u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
107void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
108int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
109void ipw_stop_master(struct ipw_softc *);
110int ipw_reset(struct ipw_softc *);
111int ipw_load_ucode(struct ipw_softc *, u_char *, int);
112int ipw_load_firmware(struct ipw_softc *, u_char *, int);
113int ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
114int ipw_config(struct ipw_softc *);
115int ipw_init(struct ifnet *);
116void ipw_stop(struct ifnet *, int);
117void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
118void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
119
120static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
121{
122	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
123	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
124}
125
126static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
127{
128	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
129	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
130}
131
132#ifdef IPW_DEBUG
133#define DPRINTF(x)	if (ipw_debug > 0) printf x
134#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
135int ipw_debug = 0;
136#else
137#define DPRINTF(x)
138#define DPRINTFN(n, x)
139#endif
140
141struct cfattach ipw_ca = {
142	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
143};
144
145int
146ipw_match(struct device *parent, void *match, void *aux)
147{
148	struct pci_attach_args *pa = aux;
149
150	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
151	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
152		return 1;
153
154	return 0;
155}
156
157/* Base Address Register */
158#define IPW_PCI_BAR0	0x10
159
160void
161ipw_attach(struct device *parent, struct device *self, void *aux)
162{
163	struct ipw_softc *sc = (struct ipw_softc *)self;
164	struct ieee80211com *ic = &sc->sc_ic;
165	struct ifnet *ifp = &ic->ic_if;
166	struct pci_attach_args *pa = aux;
167	const char *intrstr;
168	bus_space_tag_t memt;
169	bus_space_handle_t memh;
170	bus_addr_t base;
171	pci_intr_handle_t ih;
172	pcireg_t data;
173	u_int16_t val;
174	int error, i;
175
176	sc->sc_pct = pa->pa_pc;
177	sc->sc_pcitag = pa->pa_tag,
178
179	/* clear device specific PCI configuration register 0x41 */
180	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
181	data &= ~0x0000ff00;
182	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
183
184	/* enable bus-mastering */
185	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG);
186	data |= PCI_COMMAND_MASTER_ENABLE;
187	pci_conf_write(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG, data);
188
189	/* map the register window */
190	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
191	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
192	if (error != 0) {
193		printf(": could not map memory space\n");
194		return;
195	}
196
197	sc->sc_st = memt;
198	sc->sc_sh = memh;
199	sc->sc_dmat = pa->pa_dmat;
200
201	/* disable interrupts */
202	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
203
204	if (pci_intr_map(pa, &ih) != 0) {
205		printf(": could not map interrupt\n");
206		return;
207	}
208
209	intrstr = pci_intr_string(sc->sc_pct, ih);
210	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
211	    sc->sc_dev.dv_xname);
212	if (sc->sc_ih == NULL) {
213		printf(": could not establish interrupt");
214		if (intrstr != NULL)
215			printf(" at %s", intrstr);
216		printf("\n");
217		return;
218	}
219	printf(": %s", intrstr);
220
221	if (ipw_reset(sc) != 0) {
222		printf(": could not reset adapter\n");
223		return;
224	}
225
226	if (ipw_dma_alloc(sc) != 0) {
227		printf(": failed to allocate DMA resources\n");
228		return;
229	}
230
231	ic->ic_phytype = IEEE80211_T_DS;
232	ic->ic_opmode = IEEE80211_M_STA;
233	ic->ic_state = IEEE80211_S_INIT;
234
235	/* set device capabilities */
236	ic->ic_caps = IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
237	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP |
238	    IEEE80211_C_SHPREAMBLE | IEEE80211_C_SCANALL;
239
240	/* read MAC address from EEPROM */
241	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
242	ic->ic_myaddr[0] = val >> 8;
243	ic->ic_myaddr[1] = val & 0xff;
244	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
245	ic->ic_myaddr[2] = val >> 8;
246	ic->ic_myaddr[3] = val & 0xff;
247	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
248	ic->ic_myaddr[4] = val >> 8;
249	ic->ic_myaddr[5] = val & 0xff;
250
251	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
252
253	/* set supported .11b rates */
254	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
255
256	/* set supported .11b channels (1 through 14) */
257	for (i = 1; i <= 14; i++) {
258		ic->ic_channels[i].ic_freq =
259		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
260		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
261	}
262
263	/* default to authmode OPEN */
264	sc->authmode = IEEE80211_AUTH_OPEN;
265
266	/* IBSS channel undefined for now */
267	ic->ic_ibss_chan = &ic->ic_channels[0];
268
269	ifp->if_softc = sc;
270	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
271	ifp->if_init = ipw_init;
272	ifp->if_ioctl = ipw_ioctl;
273	ifp->if_start = ipw_start;
274	ifp->if_watchdog = ipw_watchdog;
275	IFQ_SET_READY(&ifp->if_snd);
276	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
277
278	if_attach(ifp);
279	ieee80211_ifattach(ifp);
280	/* override state transition machine */
281	sc->sc_newstate = ic->ic_newstate;
282	ic->ic_newstate = ipw_newstate;
283	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
284
285	sc->powerhook = powerhook_establish(ipw_power, sc);
286
287#if NBPFILTER > 0
288	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
289	    sizeof (struct ieee80211_frame) + 64);
290
291	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
292	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
293	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
294
295	sc->sc_txtap_len = sizeof sc->sc_txtapu;
296	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
297	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
298#endif
299}
300
301int
302ipw_detach(struct device* self, int flags)
303{
304	struct ipw_softc *sc = (struct ipw_softc *)self;
305	struct ifnet *ifp = &sc->sc_ic.ic_if;
306
307	ipw_stop(ifp, 1);
308
309#if NBPFILTER > 0
310	bpfdetach(ifp);
311#endif
312	ieee80211_ifdetach(ifp);
313	if_detach(ifp);
314
315	ipw_release(sc);
316
317	if (sc->sc_ih != NULL) {
318		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
319		sc->sc_ih = NULL;
320	}
321
322	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
323
324	return 0;
325}
326
327void
328ipw_power(int why, void *arg)
329{
330	struct ipw_softc *sc = arg;
331	struct ifnet *ifp;
332	pcireg_t data;
333
334	if (why != PWR_RESUME)
335		return;
336
337	/* clear device specific PCI configuration register 0x41 */
338	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
339	data &= ~0x0000ff00;
340	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
341
342	ifp = &sc->sc_ic.ic_if;
343	if (ifp->if_flags & IFF_UP) {
344		ifp->if_init(ifp);
345		if (ifp->if_flags & IFF_RUNNING)
346			ifp->if_start(ifp);
347	}
348}
349
350int
351ipw_dma_alloc(struct ipw_softc *sc)
352{
353	struct ipw_soft_bd *sbd;
354	struct ipw_soft_hdr *shdr;
355	struct ipw_soft_buf *sbuf;
356	int i, nsegs, error;
357
358	/*
359	 * Allocate and map tx ring
360	 */
361	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
362	    BUS_DMA_NOWAIT, &sc->tbd_map);
363	if (error != 0) {
364		printf("%s: could not create tx ring DMA map\n",
365		    sc->sc_dev.dv_xname);
366		goto fail;
367	}
368
369	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
370	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
371	if (error != 0) {
372		printf("%s: could not allocate tx ring DMA memory\n",
373		    sc->sc_dev.dv_xname);
374		goto fail;
375	}
376
377	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
378	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
379	if (error != 0) {
380		printf("%s: could not map tx ring DMA memory\n",
381		    sc->sc_dev.dv_xname);
382		goto fail;
383	}
384
385	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
386	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
387	if (error != 0) {
388		printf("%s: could not load tx ring DMA map\n",
389		    sc->sc_dev.dv_xname);
390		goto fail;
391	}
392
393	/*
394	 * Allocate and map rx ring
395	 */
396	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
397	    BUS_DMA_NOWAIT, &sc->rbd_map);
398	if (error != 0) {
399		printf("%s: could not create rx ring DMA map\n",
400		    sc->sc_dev.dv_xname);
401		goto fail;
402	}
403
404	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
405	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
406	if (error != 0) {
407		printf("%s: could not allocate rx ring DMA memory\n",
408		    sc->sc_dev.dv_xname);
409		goto fail;
410	}
411
412	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
413	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
414	if (error != 0) {
415		printf("%s: could not map rx ring DMA memory\n",
416		    sc->sc_dev.dv_xname);
417		goto fail;
418	}
419
420	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
421	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
422	if (error != 0) {
423		printf("%s: could not load tx ring DMA map\n",
424		    sc->sc_dev.dv_xname);
425		goto fail;
426	}
427
428	/*
429	 * Allocate and map status ring
430	 */
431	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
432	    0, BUS_DMA_NOWAIT, &sc->status_map);
433	if (error != 0) {
434		printf("%s: could not create status ring DMA map\n",
435		    sc->sc_dev.dv_xname);
436		goto fail;
437	}
438
439	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
440	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
441	if (error != 0) {
442		printf("%s: could not allocate status ring DMA memory\n",
443		    sc->sc_dev.dv_xname);
444		goto fail;
445	}
446
447	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
448	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
449	if (error != 0) {
450		printf("%s: could not map status ring DMA memory\n",
451		    sc->sc_dev.dv_xname);
452		goto fail;
453	}
454
455	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
456	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
457	if (error != 0) {
458		printf("%s: could not load status ring DMA map\n",
459		    sc->sc_dev.dv_xname);
460		goto fail;
461	}
462
463	/*
464	 * Allocate command DMA map
465	 */
466	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
467	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
468	if (error != 0) {
469		printf("%s: could not create command DMA map\n",
470		    sc->sc_dev.dv_xname);
471		goto fail;
472	}
473
474	/*
475	 * Allocate headers DMA maps
476	 */
477	SLIST_INIT(&sc->free_shdr);
478	for (i = 0; i < IPW_NDATA; i++) {
479		shdr = &sc->shdr_list[i];
480		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
481		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
482		if (error != 0) {
483			printf("%s: could not create header DMA map\n",
484			    sc->sc_dev.dv_xname);
485			goto fail;
486		}
487		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
488	}
489
490	/*
491	 * Allocate tx buffers DMA maps
492	 */
493	SLIST_INIT(&sc->free_sbuf);
494	for (i = 0; i < IPW_NDATA; i++) {
495		sbuf = &sc->tx_sbuf_list[i];
496		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
497		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
498		if (error != 0) {
499			printf("%s: could not create tx DMA map\n",
500			    sc->sc_dev.dv_xname);
501			goto fail;
502		}
503		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
504	}
505
506	/*
507	 * Initialize tx ring
508	 */
509	for (i = 0; i < IPW_NTBD; i++) {
510		sbd = &sc->stbd_list[i];
511		sbd->bd = &sc->tbd_list[i];
512		sbd->type = IPW_SBD_TYPE_NOASSOC;
513	}
514
515	/*
516	 * Pre-allocate rx buffers and DMA maps
517	 */
518	for (i = 0; i < IPW_NRBD; i++) {
519		sbd = &sc->srbd_list[i];
520		sbuf = &sc->rx_sbuf_list[i];
521		sbd->bd = &sc->rbd_list[i];
522
523		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
524		if (sbuf->m == NULL) {
525			printf("%s: could not allocate rx mbuf\n",
526			    sc->sc_dev.dv_xname);
527			error = ENOMEM;
528			goto fail;
529		}
530
531		MCLGET(sbuf->m, M_DONTWAIT);
532		if (!(sbuf->m->m_flags & M_EXT)) {
533			m_freem(sbuf->m);
534			printf("%s: could not allocate rx mbuf cluster\n",
535			    sc->sc_dev.dv_xname);
536			error = ENOMEM;
537			goto fail;
538		}
539
540		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
541		    0, BUS_DMA_NOWAIT, &sbuf->map);
542		if (error != 0) {
543			printf("%s: could not create rx DMA map\n",
544			    sc->sc_dev.dv_xname);
545			goto fail;
546		}
547
548		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
549		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
550		if (error != 0) {
551			printf("%s: could not map rx DMA memory\n",
552			    sc->sc_dev.dv_xname);
553			goto fail;
554		}
555
556		sbd->type = IPW_SBD_TYPE_DATA;
557		sbd->priv = sbuf;
558		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
559		sbd->bd->len = htole32(MCLBYTES);
560	}
561
562	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
563	    BUS_DMASYNC_PREWRITE);
564
565	return 0;
566
567fail:	ipw_release(sc);
568	return error;
569}
570
571void
572ipw_release(struct ipw_softc *sc)
573{
574	struct ipw_soft_buf *sbuf;
575	int i;
576
577	if (sc->tbd_map != NULL) {
578		if (sc->tbd_list != NULL) {
579			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
580			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
581			    IPW_TBD_SZ);
582			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
583		}
584		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
585	}
586
587	if (sc->rbd_map != NULL) {
588		if (sc->rbd_list != NULL) {
589			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
590			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
591			    IPW_RBD_SZ);
592			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
593		}
594		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
595	}
596
597	if (sc->status_map != NULL) {
598		if (sc->status_list != NULL) {
599			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
600			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
601			    IPW_RBD_SZ);
602			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
603		}
604		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
605	}
606
607	if (sc->cmd_map != NULL)
608		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
609
610	for (i = 0; i < IPW_NDATA; i++)
611		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
612
613	for (i = 0; i < IPW_NDATA; i++)
614		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
615
616	for (i = 0; i < IPW_NRBD; i++) {
617		sbuf = &sc->rx_sbuf_list[i];
618		if (sbuf->map != NULL) {
619			if (sbuf->m != NULL) {
620				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
621				m_freem(sbuf->m);
622			}
623			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
624		}
625	}
626}
627
628int
629ipw_media_change(struct ifnet *ifp)
630{
631	int error;
632
633	error = ieee80211_media_change(ifp);
634	if (error != ENETRESET)
635		return error;
636
637	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
638		ipw_init(ifp);
639
640	return 0;
641}
642
643void
644ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
645{
646	struct ipw_softc *sc = ifp->if_softc;
647	struct ieee80211com *ic = &sc->sc_ic;
648#define N(a)	(sizeof (a) / sizeof (a[0]))
649	static const struct {
650		u_int32_t	val;
651		int		rate;
652	} rates[] = {
653		{ IPW_RATE_DS1,   2 },
654		{ IPW_RATE_DS2,   4 },
655		{ IPW_RATE_DS5,  11 },
656		{ IPW_RATE_DS11, 22 },
657	};
658	u_int32_t val;
659	int rate, i;
660
661	imr->ifm_status = IFM_AVALID;
662	imr->ifm_active = IFM_IEEE80211;
663	if (ic->ic_state == IEEE80211_S_RUN)
664		imr->ifm_status |= IFM_ACTIVE;
665
666	/* read current transmission rate from adapter */
667	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
668	val &= 0xf;
669
670	/* convert rate to 802.11 rate */
671	for (i = 0; i < N(rates) && rates[i].val != val; i++);
672	rate = (i < N(rates)) ? rates[i].rate : 0;
673
674	imr->ifm_active |= IFM_IEEE80211_11B;
675	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
676	switch (ic->ic_opmode) {
677	case IEEE80211_M_STA:
678		break;
679
680	case IEEE80211_M_IBSS:
681		imr->ifm_active |= IFM_IEEE80211_IBSS;
682		break;
683
684	case IEEE80211_M_MONITOR:
685		imr->ifm_active |= IFM_IEEE80211_MONITOR;
686		break;
687
688	case IEEE80211_M_AHDEMO:
689	case IEEE80211_M_HOSTAP:
690		/* should not get there */
691		break;
692	}
693#undef N
694}
695
696int
697ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
698{
699	struct ipw_softc *sc = ic->ic_softc;
700	struct ieee80211_node *ni;
701	u_int8_t macaddr[IEEE80211_ADDR_LEN];
702	u_int32_t len;
703
704	switch (nstate) {
705	case IEEE80211_S_RUN:
706		DELAY(100); /* firmware needs a short delay here */
707
708		len = IEEE80211_ADDR_LEN;
709		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, macaddr, &len);
710
711		ni = ieee80211_find_node(ic, macaddr);
712		if (ni == NULL)
713			break;
714
715		(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
716		ieee80211_node_newstate(ni, IEEE80211_STA_BSS);
717		break;
718
719	case IEEE80211_S_INIT:
720	case IEEE80211_S_SCAN:
721	case IEEE80211_S_AUTH:
722	case IEEE80211_S_ASSOC:
723		break;
724	}
725
726	ic->ic_state = nstate;
727	return 0;
728}
729
730/*
731 * Read 16 bits at address 'addr' from the Microwire EEPROM.
732 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
733 */
734u_int16_t
735ipw_read_prom_word(struct ipw_softc *sc, u_int8_t addr)
736{
737	u_int32_t tmp;
738	u_int16_t val;
739	int n;
740
741	/* Clock C once before the first command */
742	IPW_EEPROM_CTL(sc, 0);
743	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
744	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
745	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
746
747	/* Write start bit (1) */
748	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
749	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
750
751	/* Write READ opcode (10) */
752	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
753	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
754	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
755	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
756
757	/* Write address A7-A0 */
758	for (n = 7; n >= 0; n--) {
759		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
760		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
761		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
762		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
763	}
764
765	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
766
767	/* Read data Q15-Q0 */
768	val = 0;
769	for (n = 15; n >= 0; n--) {
770		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
771		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
772		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
773		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
774	}
775
776	IPW_EEPROM_CTL(sc, 0);
777
778	/* Clear Chip Select and clock C */
779	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
780	IPW_EEPROM_CTL(sc, 0);
781	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
782
783	return letoh16(val);
784}
785
786void
787ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
788{
789	struct ipw_cmd *cmd;
790
791	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
792	    BUS_DMASYNC_POSTREAD);
793
794	cmd = mtod(sbuf->m, struct ipw_cmd *);
795
796	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
797	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
798	    letoh32(cmd->len), letoh32(cmd->status)));
799
800	wakeup(sc);
801}
802
803void
804ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
805{
806	struct ieee80211com *ic = &sc->sc_ic;
807	u_int32_t state;
808
809	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
810	    BUS_DMASYNC_POSTREAD);
811
812	state = letoh32(*mtod(sbuf->m, u_int32_t *));
813
814	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
815
816	switch (state) {
817	case IPW_STATE_ASSOCIATED:
818		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
819		break;
820
821	case IPW_STATE_SCANNING:
822		/* don't leave run state on background scan */
823		if (ic->ic_state != IEEE80211_S_RUN)
824			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
825
826		ic->ic_flags |= IEEE80211_F_ASCAN;
827		break;
828
829	case IPW_STATE_SCAN_COMPLETE:
830		ic->ic_flags &= ~IEEE80211_F_ASCAN;
831		break;
832
833	case IPW_STATE_ASSOCIATION_LOST:
834		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
835		break;
836
837	case IPW_STATE_RADIO_DISABLED:
838		ipw_stop(&ic->ic_if, 1);
839		break;
840	}
841}
842
843void
844ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
845    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
846{
847	struct ieee80211com *ic = &sc->sc_ic;
848	struct ifnet *ifp = &ic->ic_if;
849	struct mbuf *m;
850	struct ieee80211_frame *wh;
851	struct ieee80211_node *ni;
852	int error;
853
854	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
855
856	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
857	    BUS_DMASYNC_POSTREAD);
858
859	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
860
861	/* Finalize mbuf */
862	m = sbuf->m;
863	m->m_pkthdr.rcvif = ifp;
864	m->m_pkthdr.len = m->m_len = letoh32(status->len);
865
866#if NBPFILTER > 0
867	if (sc->sc_drvbpf != NULL) {
868		struct mbuf mb;
869		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
870
871		tap->wr_flags = 0;
872		tap->wr_antsignal = status->rssi;
873		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
874		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
875
876		M_DUP_PKTHDR(&mb, m);
877		mb.m_data = (caddr_t)tap;
878		mb.m_len = sc->sc_rxtap_len;
879		mb.m_next = m;
880		mb.m_pkthdr.len += mb.m_len;
881		bpf_mtap(sc->sc_drvbpf, &mb);
882	}
883#endif
884
885	wh = mtod(m, struct ieee80211_frame *);
886
887	ni = ieee80211_find_rxnode(ic, wh);
888
889	/* Send the frame to the upper layer */
890	ieee80211_input(ifp, m, ni, status->rssi, 0);
891
892	ieee80211_release_node(ic, ni);
893
894	MGETHDR(m, M_DONTWAIT, MT_DATA);
895	if (m == NULL) {
896		printf("%s: could not allocate rx mbuf\n",
897		    sc->sc_dev.dv_xname);
898		return;
899	}
900	MCLGET(m, M_DONTWAIT);
901	if (!(m->m_flags & M_EXT)) {
902		m_freem(m);
903		printf("%s: could not allocate rx mbuf cluster\n",
904		    sc->sc_dev.dv_xname);
905		return;
906	}
907
908	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
909	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
910	if (error != 0) {
911		printf("%s: could not map rx DMA memory\n",
912		    sc->sc_dev.dv_xname);
913		m_freem(m);
914		return;
915	}
916
917	sbuf->m = m;
918	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
919}
920
921void
922ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
923{
924	DPRINTFN(2, ("RX!NOTIFICATION\n"));
925}
926
927void
928ipw_rx_intr(struct ipw_softc *sc)
929{
930	struct ipw_status *status;
931	struct ipw_soft_bd *sbd;
932	struct ipw_soft_buf *sbuf;
933	u_int32_t r, i;
934
935	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
936
937	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
938
939		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
940		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
941		    BUS_DMASYNC_POSTREAD);
942
943		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
944		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
945		    BUS_DMASYNC_POSTREAD);
946
947		status = &sc->status_list[i];
948		sbd = &sc->srbd_list[i];
949		sbuf = sbd->priv;
950
951		switch (letoh16(status->code) & 0xf) {
952		case IPW_STATUS_CODE_COMMAND:
953			ipw_command_intr(sc, sbuf);
954			break;
955
956		case IPW_STATUS_CODE_NEWSTATE:
957			ipw_newstate_intr(sc, sbuf);
958			break;
959
960		case IPW_STATUS_CODE_DATA_802_3:
961		case IPW_STATUS_CODE_DATA_802_11:
962			ipw_data_intr(sc, status, sbd, sbuf);
963			break;
964
965		case IPW_STATUS_CODE_NOTIFICATION:
966			ipw_notification_intr(sc, sbuf);
967			break;
968
969		default:
970			printf("%s: unknown status code %u\n",
971			    sc->sc_dev.dv_xname, letoh16(status->code));
972		}
973		sbd->bd->flags = 0;
974
975		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
976		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
977		    BUS_DMASYNC_PREWRITE);
978	}
979
980	/* Tell the firmware what we have processed */
981	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
982	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
983}
984
985void
986ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
987{
988	struct ieee80211com *ic = &sc->sc_ic;
989	struct ipw_soft_hdr *shdr;
990	struct ipw_soft_buf *sbuf;
991
992	switch (sbd->type) {
993	case IPW_SBD_TYPE_COMMAND:
994		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
995		break;
996
997	case IPW_SBD_TYPE_HEADER:
998		shdr = sbd->priv;
999		bus_dmamap_unload(sc->sc_dmat, shdr->map);
1000		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1001		break;
1002
1003	case IPW_SBD_TYPE_DATA:
1004		sbuf = sbd->priv;
1005		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1006		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1007
1008		m_freem(sbuf->m);
1009
1010		if (sbuf->ni != NULL)
1011			ieee80211_release_node(ic, sbuf->ni);
1012
1013		/* kill watchdog timer */
1014		sc->sc_tx_timer = 0;
1015		break;
1016	}
1017	sbd->type = IPW_SBD_TYPE_NOASSOC;
1018}
1019
1020void
1021ipw_tx_intr(struct ipw_softc *sc)
1022{
1023	struct ifnet *ifp = &sc->sc_ic.ic_if;
1024	u_int32_t r, i;
1025
1026	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1027
1028	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1029		ipw_release_sbd(sc, &sc->stbd_list[i]);
1030		sc->txfree++;
1031	}
1032
1033	/* Remember what the firmware has processed */
1034	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1035
1036	/* Call start() since some buffer descriptors have been released */
1037	ifp->if_flags &= ~IFF_OACTIVE;
1038	(*ifp->if_start)(ifp);
1039}
1040
1041int
1042ipw_intr(void *arg)
1043{
1044	struct ipw_softc *sc = arg;
1045	u_int32_t r;
1046
1047	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1048		return 0;
1049
1050	/* Disable interrupts */
1051	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1052
1053	DPRINTFN(8, ("INTR!0x%08x\n", r));
1054
1055	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1056		printf("%s: fatal error\n", sc->sc_dev.dv_xname);
1057		ipw_stop(&sc->sc_ic.ic_if, 1);
1058	}
1059
1060	if (r & IPW_INTR_FW_INIT_DONE) {
1061		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1062			wakeup(sc);
1063	}
1064
1065	if (r & IPW_INTR_RX_TRANSFER)
1066		ipw_rx_intr(sc);
1067
1068	if (r & IPW_INTR_TX_TRANSFER)
1069		ipw_tx_intr(sc);
1070
1071	/* Acknowledge interrupts */
1072	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1073
1074	/* Re-enable interrupts */
1075	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1076
1077	return 1;
1078}
1079
1080int
1081ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
1082{
1083	struct ipw_soft_bd *sbd;
1084	int error;
1085
1086	sbd = &sc->stbd_list[sc->txcur];
1087
1088	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1089	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1090	if (error != 0) {
1091		printf("%s: could not map command DMA memory\n",
1092		    sc->sc_dev.dv_xname);
1093		return error;
1094	}
1095
1096	sc->cmd.type = htole32(type);
1097	sc->cmd.subtype = htole32(0);
1098	sc->cmd.len = htole32(len);
1099	sc->cmd.seq = htole32(0);
1100	if (data != NULL)
1101		bcopy(data, sc->cmd.data, len);
1102
1103	sbd->type = IPW_SBD_TYPE_COMMAND;
1104	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1105	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1106	sbd->bd->nfrag = 1;
1107	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1108			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
1109
1110	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1111	    BUS_DMASYNC_PREWRITE);
1112
1113	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1114	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1115	    BUS_DMASYNC_PREWRITE);
1116
1117	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1118	sc->txfree--;
1119	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1120
1121	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1122
1123	/* Wait at most one second for command to complete */
1124	return tsleep(sc, 0, "ipwcmd", hz);
1125}
1126
1127int
1128ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1129{
1130	struct ipw_softc *sc = ifp->if_softc;
1131	struct ieee80211com *ic = &sc->sc_ic;
1132	struct ieee80211_frame *wh;
1133	struct ipw_soft_bd *sbd;
1134	struct ipw_soft_hdr *shdr;
1135	struct ipw_soft_buf *sbuf;
1136	struct mbuf *mnew;
1137	int error, i;
1138
1139	if (ic->ic_flags & IEEE80211_F_WEPON) {
1140		m = ieee80211_wep_crypt(ifp, m, 1);
1141		if (m == NULL)
1142			return ENOBUFS;
1143	}
1144
1145#if NBPFILTER > 0
1146	if (sc->sc_drvbpf != NULL) {
1147		struct mbuf mb;
1148		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1149
1150		tap->wt_flags = 0;
1151		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1152		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1153
1154		M_DUP_PKTHDR(&mb, m);
1155		mb.m_data = (caddr_t)tap;
1156		mb.m_len = sc->sc_txtap_len;
1157		mb.m_next = m;
1158		mb.m_pkthdr.len += mb.m_len;
1159		bpf_mtap(sc->sc_drvbpf, &mb);
1160	}
1161#endif
1162
1163	wh = mtod(m, struct ieee80211_frame *);
1164
1165	shdr = SLIST_FIRST(&sc->free_shdr);
1166	sbuf = SLIST_FIRST(&sc->free_sbuf);
1167
1168	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1169	shdr->hdr.subtype = htole32(0);
1170	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1171	shdr->hdr.encrypt = 0;
1172	shdr->hdr.keyidx = 0;
1173	shdr->hdr.keysz = 0;
1174	shdr->hdr.fragmentsz = htole16(0);
1175	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1176	if (ic->ic_opmode == IEEE80211_M_STA)
1177		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1178	else
1179		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1180
1181	/* trim IEEE802.11 header */
1182	m_adj(m, sizeof (struct ieee80211_frame));
1183
1184	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1185	if (error != 0 && error != EFBIG) {
1186		printf("%s: could not map mbuf (error %d)\n",
1187		    sc->sc_dev.dv_xname, error);
1188		m_freem(m);
1189		return error;
1190	}
1191	if (error != 0) {
1192		/* too many fragments, linearize */
1193
1194		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1195		if (mnew == NULL) {
1196			m_freem(m);
1197			return ENOMEM;
1198		}
1199
1200		M_DUP_PKTHDR(mnew, m);
1201		MCLGET(mnew, M_DONTWAIT);
1202		if (!(mnew->m_flags & M_EXT)) {
1203			m_freem(m);
1204			m_freem(mnew);
1205			return ENOMEM;
1206		}
1207
1208		m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew, caddr_t));
1209		m_freem(m);
1210		mnew->m_len = mnew->m_pkthdr.len;
1211		m = mnew;
1212
1213		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1214		    BUS_DMA_NOWAIT);
1215		if (error != 0) {
1216			printf("%s: could not map mbuf (error %d)\n",
1217			    sc->sc_dev.dv_xname, error);
1218			m_freem(m);
1219			return error;
1220		}
1221	}
1222
1223	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1224	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1225	if (error != 0) {
1226		printf("%s: could not map header DMA memory (error %d)\n",
1227		    sc->sc_dev.dv_xname, error);
1228		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1229		m_freem(m);
1230		return error;
1231	}
1232
1233	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1234	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1235
1236	sbd = &sc->stbd_list[sc->txcur];
1237	sbd->type = IPW_SBD_TYPE_HEADER;
1238	sbd->priv = shdr;
1239	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1240	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1241	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1242	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1243			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1244
1245	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1246	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1247	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1248	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1249
1250	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1251	    sc->txcur * sizeof (struct ipw_bd),
1252	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1253
1254	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1255	sc->txfree--;
1256
1257	sbuf->m = m;
1258	sbuf->ni = ni;
1259
1260	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1261		sbd = &sc->stbd_list[sc->txcur];
1262		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1263		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1264		sbd->bd->nfrag = 0; /* used only in first bd */
1265		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1266		if (i == sbuf->map->dm_nsegs - 1) {
1267			sbd->type = IPW_SBD_TYPE_DATA;
1268			sbd->priv = sbuf;
1269			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1270		} else {
1271			sbd->type = IPW_SBD_TYPE_NOASSOC;
1272			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1273		}
1274
1275		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1276		    sbuf->map->dm_segs[i].ds_len));
1277
1278		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1279		    sc->txcur * sizeof (struct ipw_bd),
1280		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1281
1282		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1283		sc->txfree--;
1284	}
1285
1286	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1287	    BUS_DMASYNC_PREWRITE);
1288
1289	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
1290	    BUS_DMASYNC_PREWRITE);
1291
1292	/* Inform firmware about this new packet */
1293	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1294
1295	return 0;
1296}
1297
1298void
1299ipw_start(struct ifnet *ifp)
1300{
1301	struct ipw_softc *sc = ifp->if_softc;
1302	struct ieee80211com *ic = &sc->sc_ic;
1303	struct mbuf *m;
1304	struct ieee80211_node *ni;
1305
1306	if (ic->ic_state != IEEE80211_S_RUN)
1307		return;
1308
1309	for (;;) {
1310		IF_DEQUEUE(&ifp->if_snd, m);
1311		if (m == NULL)
1312			break;
1313
1314		if (sc->txfree < 1 + IPW_MAX_NSEG) {
1315			IF_PREPEND(&ifp->if_snd, m);
1316			ifp->if_flags |= IFF_OACTIVE;
1317			break;
1318		}
1319
1320#if NBPFILTER > 0
1321		if (ifp->if_bpf != NULL)
1322			bpf_mtap(ifp->if_bpf, m);
1323#endif
1324
1325		m = ieee80211_encap(ifp, m, &ni);
1326		if (m == NULL)
1327			continue;
1328
1329#if NBPFILTER > 0
1330		if (ic->ic_rawbpf != NULL)
1331			bpf_mtap(ic->ic_rawbpf, m);
1332#endif
1333
1334		if (ipw_tx_start(ifp, m, ni) != 0) {
1335			if (ni != NULL)
1336				ieee80211_release_node(ic, ni);
1337			break;
1338		}
1339
1340		/* start watchdog timer */
1341		sc->sc_tx_timer = 5;
1342		ifp->if_timer = 1;
1343	}
1344}
1345
1346void
1347ipw_watchdog(struct ifnet *ifp)
1348{
1349	struct ipw_softc *sc = ifp->if_softc;
1350
1351	ifp->if_timer = 0;
1352
1353	if (sc->sc_tx_timer > 0) {
1354		if (--sc->sc_tx_timer == 0) {
1355			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1356			ipw_stop(ifp, 1);
1357			return;
1358		}
1359		ifp->if_timer = 1;
1360	}
1361
1362	ieee80211_watchdog(ifp);
1363}
1364
1365int
1366ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1367{
1368	struct ipw_softc *sc = ifp->if_softc;
1369	struct ifaddr *ifa;
1370	int s, error = 0;
1371
1372	s = splnet();
1373
1374	switch (cmd) {
1375	case SIOCSIFADDR:
1376		ifa = (struct ifaddr *) data;
1377		ifp->if_flags |= IFF_UP;
1378		switch (ifa->ifa_addr->sa_family) {
1379#ifdef INET
1380		case AF_INET:
1381			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
1382			ipw_init(ifp);
1383			break;
1384#endif
1385		default:
1386			ipw_init(ifp);
1387		}
1388		break;
1389
1390	case SIOCSIFFLAGS:
1391		if (ifp->if_flags & IFF_UP) {
1392			if (!(ifp->if_flags & IFF_RUNNING))
1393				ipw_init(ifp);
1394		} else {
1395			if (ifp->if_flags & IFF_RUNNING)
1396				ipw_stop(ifp, 1);
1397		}
1398		break;
1399
1400	case SIOCG80211TXPOWER:
1401		/*
1402		 * If the hardware radio transmitter switch is off, report a
1403		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1404		 * transmitter is killed.
1405		 */
1406		((struct ieee80211_txpower *)data)->i_val =
1407		    (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ?
1408		    IEEE80211_TXPOWER_MIN : sc->sc_ic.ic_txpower;
1409		break;
1410
1411	case SIOCG80211AUTH:
1412		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1413		break;
1414
1415	case SIOCS80211AUTH:
1416		/* only super-user can do that! */
1417		if ((error = suser(curproc, 0)) != 0)
1418			break;
1419
1420		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1421		break;
1422
1423	default:
1424		error = ieee80211_ioctl(ifp, cmd, data);
1425	}
1426
1427	if (error == ENETRESET && cmd != SIOCADDMULTI) {
1428		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1429		    (IFF_UP | IFF_RUNNING))
1430			ipw_init(ifp);
1431		error = 0;
1432	}
1433
1434	splx(s);
1435	return error;
1436}
1437
1438u_int32_t
1439ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1440{
1441	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1442}
1443
1444void
1445ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1446{
1447	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1448}
1449
1450int
1451ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1452{
1453	u_int32_t addr, info;
1454	u_int16_t count, size;
1455	u_int32_t total;
1456
1457	/* addr[4] + count[2] + size[2] */
1458	addr = MEM_READ_4(sc, sc->table2_base + off);
1459	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1460
1461	count = info >> 16;
1462	size = info & 0xffff;
1463	total = count * size;
1464
1465	if (total > *len) {
1466		*len = total;
1467		return EINVAL;
1468	}
1469
1470	*len = total;
1471	ipw_read_mem_1(sc, addr, buf, total);
1472
1473	return 0;
1474}
1475
1476void
1477ipw_stop_master(struct ipw_softc *sc)
1478{
1479	int ntries;
1480
1481	/* Disable interrupts */
1482	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1483
1484	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1485	for (ntries = 0; ntries < 50; ntries++) {
1486		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1487			break;
1488		DELAY(10);
1489	}
1490	if (ntries == 50)
1491		printf("%s: timeout waiting for master\n",
1492		    sc->sc_dev.dv_xname);
1493
1494	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1495	    IPW_RST_PRINCETON_RESET);
1496
1497	sc->flags &= ~IPW_FLAG_FW_INITED;
1498}
1499
1500int
1501ipw_reset(struct ipw_softc *sc)
1502{
1503	int ntries;
1504
1505	ipw_stop_master(sc);
1506
1507	/* Move adapter to D0 state */
1508	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1509	    IPW_CTL_INIT);
1510
1511	/* Wait for clock stabilization */
1512	for (ntries = 0; ntries < 1000; ntries++) {
1513		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1514			break;
1515		DELAY(200);
1516	}
1517	if (ntries == 1000)
1518		return EIO;
1519
1520	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1521	    IPW_RST_SW_RESET);
1522
1523	DELAY(10);
1524
1525	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1526	    IPW_CTL_INIT);
1527
1528	return 0;
1529}
1530
1531int
1532ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1533{
1534	int ntries;
1535
1536	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1537	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1538
1539	MEM_WRITE_2(sc, 0x220000, 0x0703);
1540	MEM_WRITE_2(sc, 0x220000, 0x0707);
1541
1542	MEM_WRITE_1(sc, 0x210014, 0x72);
1543	MEM_WRITE_1(sc, 0x210014, 0x72);
1544
1545	MEM_WRITE_1(sc, 0x210000, 0x40);
1546	MEM_WRITE_1(sc, 0x210000, 0x00);
1547	MEM_WRITE_1(sc, 0x210000, 0x40);
1548
1549	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1550
1551	MEM_WRITE_1(sc, 0x210000, 0x00);
1552	MEM_WRITE_1(sc, 0x210000, 0x00);
1553	MEM_WRITE_1(sc, 0x210000, 0x80);
1554
1555	MEM_WRITE_2(sc, 0x220000, 0x0703);
1556	MEM_WRITE_2(sc, 0x220000, 0x0707);
1557
1558	MEM_WRITE_1(sc, 0x210014, 0x72);
1559	MEM_WRITE_1(sc, 0x210014, 0x72);
1560
1561	MEM_WRITE_1(sc, 0x210000, 0x00);
1562	MEM_WRITE_1(sc, 0x210000, 0x80);
1563
1564	for (ntries = 0; ntries < 100; ntries++) {
1565		if (MEM_READ_1(sc, 0x210000) & 1)
1566			break;
1567		DELAY(1000);
1568	}
1569	if (ntries == 100) {
1570		printf("%s: timeout waiting for ucode to initialize\n",
1571		    sc->sc_dev.dv_xname);
1572		return EIO;
1573	}
1574
1575	MEM_WRITE_4(sc, 0x3000e0, 0);
1576
1577	return 0;
1578}
1579
1580/* set of macros to handle unaligned little endian data in firmware image */
1581#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1582#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1583int
1584ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1585{
1586	u_char *p, *end;
1587	u_int32_t dst;
1588	u_int16_t len;
1589	int error;
1590
1591	p = fw;
1592	end = fw + size;
1593	while (p < end) {
1594		if (p + 6 > end)
1595			return EINVAL;
1596
1597		dst = GETLE32(p); p += 4;
1598		len = GETLE16(p); p += 2;
1599
1600		if (p + len > end)
1601			return EINVAL;
1602
1603		ipw_write_mem_1(sc, dst, p, len);
1604		p += len;
1605	}
1606
1607	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1608	    IPW_IO_LED_OFF);
1609
1610	/* Allow interrupts so we know when the firmware is inited */
1611	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1612
1613	/* Tell the adapter to initialize the firmware */
1614	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1615	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1616	    IPW_CTL_ALLOW_STANDBY);
1617
1618	/* Wait at most one second for firmware initialization to complete */
1619	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1620		printf("%s: timeout waiting for firmware initialization to "
1621		    "complete\n", sc->sc_dev.dv_xname);
1622		return error;
1623	}
1624
1625	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1626	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1627
1628	return 0;
1629}
1630
1631int
1632ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1633{
1634	struct ipw_firmware_hdr *hdr;
1635	const char *name;
1636	u_char *p;
1637	size_t size;
1638	int error;
1639
1640	switch (sc->sc_ic.ic_opmode) {
1641	case IEEE80211_M_STA:
1642	case IEEE80211_M_HOSTAP:
1643		name = "ipw-bss";
1644		break;
1645
1646	case IEEE80211_M_IBSS:
1647	case IEEE80211_M_AHDEMO:
1648		name = "ipw-ibss";
1649		break;
1650
1651	case IEEE80211_M_MONITOR:
1652		name = "ipw-monitor";
1653		break;
1654	}
1655
1656	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1657		return error;
1658
1659	if (size < sizeof (struct ipw_firmware_hdr)) {
1660		error = EINVAL;
1661		goto fail;
1662	}
1663
1664	p = fw->data;
1665	hdr = (struct ipw_firmware_hdr *)p;
1666	fw->main_size = letoh32(hdr->main_size);
1667	fw->ucode_size = letoh32(hdr->ucode_size);
1668
1669	p += sizeof (struct ipw_firmware_hdr);
1670	size -= sizeof (struct ipw_firmware_hdr);
1671
1672	if (size < fw->main_size + fw->ucode_size) {
1673		error = EINVAL;
1674		goto fail;
1675	}
1676
1677	fw->main = p;
1678	fw->ucode = p + fw->main_size;
1679
1680	return 0;
1681
1682fail:	free(fw->data, M_DEVBUF);
1683	return error;
1684}
1685
1686int
1687ipw_config(struct ipw_softc *sc)
1688{
1689	struct ieee80211com *ic = &sc->sc_ic;
1690	struct ifnet *ifp = &ic->ic_if;
1691	struct ipw_security security;
1692	struct ieee80211_wepkey *k;
1693	struct ipw_wep_key wepkey;
1694	struct ipw_scan_options options;
1695	struct ipw_configuration config;
1696	u_int32_t data;
1697	int error, i;
1698
1699	switch (ic->ic_opmode) {
1700	case IEEE80211_M_STA:
1701	case IEEE80211_M_HOSTAP:
1702		data = htole32(IPW_MODE_BSS);
1703		break;
1704
1705	case IEEE80211_M_IBSS:
1706	case IEEE80211_M_AHDEMO:
1707		data = htole32(IPW_MODE_IBSS);
1708		break;
1709
1710	case IEEE80211_M_MONITOR:
1711		data = htole32(IPW_MODE_MONITOR);
1712		break;
1713	}
1714	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1715	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1716	if (error != 0)
1717		return error;
1718
1719	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1720	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1721		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1722		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1723		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1724		if (error != 0)
1725			return error;
1726	}
1727
1728	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1729		DPRINTF(("Enabling adapter\n"));
1730		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1731	}
1732
1733	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1734	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1735	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1736	    IEEE80211_ADDR_LEN);
1737	if (error != 0)
1738		return error;
1739
1740	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1741	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1742	if (ic->ic_opmode == IEEE80211_M_IBSS)
1743		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1744	if (ifp->if_flags & IFF_PROMISC)
1745		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1746	config.bss_chan = htole32(0x3fff); /* channels 1-14 */
1747	config.ibss_chan = htole32(0x7ff); /* channels 1-11 */
1748	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1749	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1750	if (error != 0)
1751		return error;
1752
1753	data = htole32(0x3); /* 1, 2 */
1754	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1755	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1756	if (error != 0)
1757		return error;
1758
1759	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1760	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1761	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1762	if (error != 0)
1763		return error;
1764
1765	data = htole32(IPW_POWER_MODE_CAM);
1766	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1767	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1768	if (error != 0)
1769		return error;
1770
1771	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1772		data = htole32(32); /* default value */
1773		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1774		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1775		    sizeof data);
1776		if (error != 0)
1777			return error;
1778	}
1779
1780	data = htole32(ic->ic_rtsthreshold);
1781	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1782	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1783	if (error != 0)
1784		return error;
1785
1786	data = htole32(ic->ic_fragthreshold);
1787	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1788	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1789	if (error != 0)
1790		return error;
1791
1792#ifdef IPW_DEBUG
1793	if (ipw_debug > 0) {
1794		printf("Setting ESSID to ");
1795		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1796		printf("\n");
1797	}
1798#endif
1799	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1800	    ic->ic_des_esslen);
1801	if (error != 0)
1802		return error;
1803
1804	/* no mandatory BSSID */
1805	DPRINTF(("Setting mandatory BSSID to null\n"));
1806	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1807	if (error != 0)
1808		return error;
1809
1810	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1811		DPRINTF(("Setting adapter BSSID to %s\n",
1812		    ether_sprintf(ic->ic_des_bssid)));
1813		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1814		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1815		if (error != 0)
1816			return error;
1817	}
1818
1819	bzero(&security, sizeof security);
1820	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1821	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1822	security.ciphers = htole32(IPW_CIPHER_NONE);
1823	DPRINTF(("Setting authmode to %u\n", security.authmode));
1824	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1825	    sizeof security);
1826	if (error != 0)
1827		return error;
1828
1829	if (ic->ic_flags & IEEE80211_F_WEPON) {
1830		k = ic->ic_nw_keys;
1831		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1832			if (k->wk_len == 0)
1833				continue;
1834
1835			wepkey.idx = i;
1836			wepkey.len = k->wk_len;
1837			bzero(wepkey.key, sizeof wepkey.key);
1838			bcopy(k->wk_key, wepkey.key, k->wk_len);
1839			DPRINTF(("Setting wep key index %u len %u\n",
1840			    wepkey.idx, wepkey.len));
1841			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1842			    sizeof wepkey);
1843			if (error != 0)
1844				return error;
1845		}
1846
1847		data = htole32(ic->ic_wep_txkey);
1848		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1849		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1850		    sizeof data);
1851		if (error != 0)
1852			return error;
1853	}
1854
1855	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1856	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1857	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1858	if (error != 0)
1859		return error;
1860
1861	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1862	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1863		data = htole32(ic->ic_lintval);
1864		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1865		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1866		    sizeof data);
1867		if (error != 0)
1868			return error;
1869	}
1870
1871	options.flags = htole32(0);
1872	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1873	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1874	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1875	if (error != 0)
1876		return error;
1877
1878	/* finally, enable adapter (start scanning for an access point) */
1879	DPRINTF(("Enabling adapter\n"));
1880	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1881}
1882
1883int
1884ipw_init(struct ifnet *ifp)
1885{
1886	struct ipw_softc *sc = ifp->if_softc;
1887	struct ipw_firmware fw;
1888	int error;
1889
1890	ipw_stop(ifp, 0);
1891
1892	if ((error = ipw_reset(sc)) != 0) {
1893		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1894		goto fail1;
1895	}
1896
1897	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1898		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1899		goto fail1;
1900	}
1901
1902	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1903		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1904		goto fail2;
1905	}
1906
1907	ipw_stop_master(sc);
1908
1909	/*
1910	 * Setup tx, rx and status rings
1911	 */
1912	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1913	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1914	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1915	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1916	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1917	sc->txcur = 0; /* bd index to write to */
1918	sc->txfree = IPW_NTBD - 2;
1919
1920	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1921	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1922	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1923	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1924	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
1925
1926	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1927	    sc->status_map->dm_segs[0].ds_addr);
1928
1929	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1930		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1931		goto fail2;
1932	}
1933
1934	sc->flags |= IPW_FLAG_FW_INITED;
1935
1936	/* Retrieve information tables base addresses */
1937	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1938	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1939
1940	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1941
1942	if ((error = ipw_config(sc)) != 0) {
1943		printf("%s: device configuration failed\n",
1944		    sc->sc_dev.dv_xname);
1945		goto fail2;
1946	}
1947
1948	ifp->if_flags &= ~IFF_OACTIVE;
1949	ifp->if_flags |= IFF_RUNNING;
1950
1951	return 0;
1952
1953fail2:	free(fw.data, M_DEVBUF);
1954fail1:	ipw_stop(ifp, 0);
1955
1956	return error;
1957}
1958
1959void
1960ipw_stop(struct ifnet *ifp, int disable)
1961{
1962	struct ipw_softc *sc = ifp->if_softc;
1963	struct ieee80211com *ic = &sc->sc_ic;
1964	int i;
1965
1966	ipw_stop_master(sc);
1967	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1968
1969	/*
1970	 * Release tx buffers
1971	 */
1972	for (i = 0; i < IPW_NTBD; i++)
1973		ipw_release_sbd(sc, &sc->stbd_list[i]);
1974
1975	ifp->if_timer = 0;
1976	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1977
1978	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1979}
1980
1981void
1982ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1983    bus_size_t count)
1984{
1985	for (; count > 0; offset++, datap++, count--) {
1986		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1987		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
1988	}
1989}
1990
1991void
1992ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1993    bus_size_t count)
1994{
1995	for (; count > 0; offset++, datap++, count--) {
1996		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1997		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
1998	}
1999}
2000
2001struct cfdriver ipw_cd = {
2002	0, "ipw", DV_IFNET
2003};
2004