if_ipw.c revision 1.5
1/*	$Id: if_ipw.c,v 1.5 2004/10/27 21:14:48 damien Exp $  */
2
3/*-
4 * Copyright (c) 2004
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46
47#include <machine/bus.h>
48#include <machine/endian.h>
49#include <machine/intr.h>
50
51#include <dev/pci/pcireg.h>
52#include <dev/pci/pcivar.h>
53#include <dev/pci/pcidevs.h>
54
55#if NBPFILTER > 0
56#include <net/bpf.h>
57#endif
58#include <net/if.h>
59#include <net/if_arp.h>
60#include <net/if_dl.h>
61#include <net/if_media.h>
62#include <net/if_types.h>
63
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/in_var.h>
67#include <netinet/if_ether.h>
68#include <netinet/ip.h>
69
70#include <net80211/ieee80211_var.h>
71#include <net80211/ieee80211_radiotap.h>
72
73#include <dev/pci/if_ipwreg.h>
74#include <dev/pci/if_ipwvar.h>
75
76static const struct ieee80211_rateset ipw_rateset_11b =
77	{ 4, { 2, 4, 11, 22 } };
78
79int ipw_match(struct device *, void *, void *);
80void ipw_attach(struct device *, struct device *, void *);
81int ipw_detach(struct device *, int);
82int ipw_media_change(struct ifnet *);
83int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
84void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
85void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
86void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
87    struct ipw_soft_bd *, struct ipw_soft_buf *);
88void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
89void ipw_rx_intr(struct ipw_softc *);
90void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
91void ipw_tx_intr(struct ipw_softc *);
92int ipw_intr(void *);
93int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
94int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
95void ipw_start(struct ifnet *);
96void ipw_watchdog(struct ifnet *);
97int ipw_get_table1(struct ipw_softc *, u_int32_t *);
98int ipw_get_radio(struct ipw_softc *, int *);
99int ipw_ioctl(struct ifnet *, u_long, caddr_t);
100u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
101void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
102int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
103int ipw_tx_init(struct ipw_softc *);
104void ipw_tx_stop(struct ipw_softc *);
105int ipw_rx_init(struct ipw_softc *);
106void ipw_rx_stop(struct ipw_softc *);
107void ipw_reset(struct ipw_softc *);
108int ipw_clock_sync(struct ipw_softc *);
109int ipw_load_ucode(struct ipw_softc *, u_char *, int);
110int ipw_load_firmware(struct ipw_softc *, u_char *, int);
111int ipw_firmware_init(struct ipw_softc *, u_char *);
112int ipw_config(struct ipw_softc *);
113int ipw_init(struct ifnet *);
114void ipw_stop(struct ifnet *, int);
115void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
116void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
117void ipw_zero_mem_4(struct ipw_softc *, bus_size_t, bus_size_t);
118
119static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
120{
121	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
122	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
123}
124
125static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
126{
127	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
128	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
129}
130
131#ifdef IPW_DEBUG
132#define DPRINTF(x)	if (ipw_debug > 0) printf x
133#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
134int ipw_debug = 0;
135#else
136#define DPRINTF(x)
137#define DPRINTFN(n, x)
138#endif
139
140struct cfattach ipw_ca = {
141	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
142};
143
144int
145ipw_match(struct device *parent, void *match, void *aux)
146{
147	struct pci_attach_args *pa = aux;
148
149	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
150	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
151		return 1;
152
153	return 0;
154}
155
156/* Base Address Register */
157#define IPW_PCI_BAR0	0x10
158
159void
160ipw_attach(struct device *parent, struct device *self, void *aux)
161{
162	struct ipw_softc *sc = (struct ipw_softc *)self;
163	struct ieee80211com *ic = &sc->sc_ic;
164	struct ifnet *ifp = &ic->ic_if;
165	struct pci_attach_args *pa = aux;
166	const char *intrstr;
167	bus_space_tag_t memt;
168	bus_space_handle_t memh;
169	bus_addr_t base;
170	pci_intr_handle_t ih;
171	u_int32_t data;
172	int error, i;
173
174	sc->sc_pct = pa->pa_pc;
175
176	/* enable bus-mastering */
177	data = pci_conf_read(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG);
178	data |= PCI_COMMAND_MASTER_ENABLE;
179	pci_conf_write(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG, data);
180
181	/* map the register window */
182	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
183	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
184	if (error != 0) {
185		printf(": could not map memory space\n");
186		return;
187	}
188
189	sc->sc_st = memt;
190	sc->sc_sh = memh;
191	sc->sc_dmat = pa->pa_dmat;
192
193	/* disable interrupts */
194	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
195
196	if (pci_intr_map(pa, &ih) != 0) {
197		printf(": could not map interrupt\n");
198		return;
199	}
200
201	intrstr = pci_intr_string(sc->sc_pct, ih);
202	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
203	    sc->sc_dev.dv_xname);
204	if (sc->sc_ih == NULL) {
205		printf(": could not establish interrupt");
206		if (intrstr != NULL)
207			printf(" at %s", intrstr);
208		printf("\n");
209		return;
210	}
211	printf(": %s\n", intrstr);
212
213	ic->ic_phytype = IEEE80211_T_DS;
214	ic->ic_opmode = IEEE80211_M_STA;
215	ic->ic_state = IEEE80211_S_INIT;
216
217	/* set device capabilities */
218	ic->ic_caps =  IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
219	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP;
220
221	/* set supported .11b rates */
222	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
223
224	/* set supported .11b channels (1 through 14) */
225	for (i = 1; i <= 14; i++) {
226		ic->ic_channels[i].ic_freq =
227		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
228		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
229	}
230
231	/* IBSS channel undefined for now */
232	ic->ic_ibss_chan = &ic->ic_channels[0];
233
234	ifp->if_softc = sc;
235	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
236	ifp->if_init = ipw_init;
237	ifp->if_ioctl = ipw_ioctl;
238	ifp->if_start = ipw_start;
239	ifp->if_watchdog = ipw_watchdog;
240	IFQ_SET_READY(&ifp->if_snd);
241	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
242
243	if_attach(ifp);
244	ieee80211_ifattach(ifp);
245	/* override state transition machine */
246	sc->sc_newstate = ic->ic_newstate;
247	ic->ic_newstate = ipw_newstate;
248	ieee80211_media_init(ifp, ipw_media_change, ieee80211_media_status);
249
250#if NBPFILTER > 0
251	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
252	    sizeof (struct ieee80211_frame) + 64);
253
254	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
255	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
256	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
257
258	sc->sc_txtap_len = sizeof sc->sc_txtapu;
259	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
260	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
261#endif
262}
263
264int
265ipw_detach(struct device* self, int flags)
266{
267	struct ipw_softc *sc = (struct ipw_softc *)self;
268	struct ifnet *ifp = &sc->sc_ic.ic_if;
269
270	ipw_reset(sc);
271
272#if NBPFILTER > 0
273	bpfdetach(ifp);
274#endif
275	ieee80211_ifdetach(ifp);
276	if_detach(ifp);
277
278	if (sc->sc_ih != NULL) {
279		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
280		sc->sc_ih = NULL;
281	}
282
283	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
284
285	return 0;
286}
287
288int
289ipw_media_change(struct ifnet *ifp)
290{
291	int error;
292
293	error = ieee80211_media_change(ifp);
294	if (error != ENETRESET)
295		return error;
296
297	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
298		ipw_init(ifp);
299
300	return 0;
301}
302
303int
304ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
305{
306	struct ipw_softc *sc = ic->ic_softc;
307	struct ieee80211_node *ni = ic->ic_bss;
308	u_int32_t val, len;
309
310	switch (nstate) {
311	case IEEE80211_S_RUN:
312		len = IEEE80211_NWID_LEN;
313		ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
314		ni->ni_esslen = len;
315
316		val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
317		ni->ni_chan = &ic->ic_channels[val];
318
319		DELAY(100); /* firmware needs a short delay here */
320
321		len = IEEE80211_ADDR_LEN;
322		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
323		break;
324
325	case IEEE80211_S_INIT:
326	case IEEE80211_S_SCAN:
327	case IEEE80211_S_AUTH:
328	case IEEE80211_S_ASSOC:
329		break;
330	}
331
332	ic->ic_state = nstate;
333	return 0;
334}
335
336void
337ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
338{
339	struct ipw_cmd *cmd;
340
341	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
342	    BUS_DMASYNC_POSTREAD);
343
344	cmd = mtod(sbuf->m, struct ipw_cmd *);
345
346	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
347	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
348	    letoh32(cmd->len), letoh32(cmd->status)));
349
350	/*
351	 * Wake up processes waiting for command ack. In the case of the
352	 * IPW_CMD_DISABLE command, wake up the process only when the adapter
353	 * enters the IPW_STATE_DISABLED state. This is notified in
354	 * ipw_newstate_intr().
355	 */
356	if (letoh32(cmd->type) != IPW_CMD_DISABLE)
357		wakeup(sc->cmd);
358}
359
360void
361ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
362{
363	struct ieee80211com *ic = &sc->sc_ic;
364	u_int32_t state;
365
366	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
367	    BUS_DMASYNC_POSTREAD);
368
369	state = letoh32(*mtod(sbuf->m, u_int32_t *));
370
371	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
372
373	switch (state) {
374	case IPW_STATE_ASSOCIATED:
375		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
376		break;
377
378	case IPW_STATE_SCANNING:
379		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
380		break;
381
382	case IPW_STATE_ASSOCIATION_LOST:
383		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
384		break;
385
386	case IPW_STATE_DISABLED:
387		wakeup(sc->cmd);
388		break;
389
390	case IPW_STATE_RADIO_DISABLED:
391		/* XXX should turn the interface down */
392		break;
393	}
394}
395
396void
397ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
398    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
399{
400	struct ieee80211com *ic = &sc->sc_ic;
401	struct ifnet *ifp = &ic->ic_if;
402	struct mbuf *m;
403	struct ieee80211_frame *wh;
404	struct ieee80211_node *ni;
405	int error;
406
407	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
408
409	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
410	    BUS_DMASYNC_POSTREAD);
411
412	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
413
414	/* Finalize mbuf */
415	m = sbuf->m;
416	m->m_pkthdr.rcvif = ifp;
417	m->m_pkthdr.len = m->m_len = letoh32(status->len);
418
419#if NBPFILTER > 0
420	if (sc->sc_drvbpf != NULL) {
421		struct mbuf mb;
422		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
423
424		tap->wr_flags = 0;
425		tap->wr_antsignal = status->rssi;
426		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
427		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
428
429		M_DUP_PKTHDR(&mb, m);
430		mb.m_data = (caddr_t)tap;
431		mb.m_len = sc->sc_rxtap_len;
432		mb.m_next = m;
433		mb.m_pkthdr.len += mb.m_len;
434		bpf_mtap(sc->sc_drvbpf, &mb);
435	}
436#endif
437
438	wh = mtod(m, struct ieee80211_frame *);
439
440	ni = ieee80211_find_rxnode(ic, wh);
441
442	/* Send it up to the upper layer */
443	ieee80211_input(ifp, m, ni, status->rssi, 0);
444
445	if (ni == ic->ic_bss)
446		ieee80211_unref_node(&ni);
447	else
448		ieee80211_free_node(ic, ni);
449
450	MGETHDR(m, M_DONTWAIT, MT_DATA);
451	if (m == NULL) {
452		printf("%s: could not allocate rx mbuf\n",
453		    sc->sc_dev.dv_xname);
454		return;
455	}
456	MCLGET(m, M_DONTWAIT);
457	if (!(m->m_flags & M_EXT)) {
458		m_freem(m);
459		printf("%s: could not allocate rx mbuf cluster\n",
460		    sc->sc_dev.dv_xname);
461		return;
462	}
463
464	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
465	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
466	if (error != 0) {
467		printf("%s: could not map rxbuf dma memory\n",
468		    sc->sc_dev.dv_xname);
469		m_freem(m);
470		return;
471	}
472
473	sbuf->m = m;
474	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
475}
476
477void
478ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
479{
480	DPRINTFN(2, ("RX!NOTIFICATION\n"));
481}
482
483void
484ipw_rx_intr(struct ipw_softc *sc)
485{
486	struct ipw_status *status;
487	struct ipw_soft_bd *sbd;
488	struct ipw_soft_buf *sbuf;
489	u_int32_t r, i;
490
491	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
492
493	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
494
495		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
496		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
497		    BUS_DMASYNC_POSTREAD);
498
499		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
500		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
501		    BUS_DMASYNC_POSTREAD);
502
503		status = &sc->status_list[i];
504		sbd = &sc->srbd_list[i];
505		sbuf = sbd->priv;
506
507		switch (letoh16(status->code) & 0xf) {
508		case IPW_STATUS_CODE_COMMAND:
509			ipw_command_intr(sc, sbuf);
510			break;
511
512		case IPW_STATUS_CODE_NEWSTATE:
513			ipw_newstate_intr(sc, sbuf);
514			break;
515
516		case IPW_STATUS_CODE_DATA_802_3:
517		case IPW_STATUS_CODE_DATA_802_11:
518			ipw_data_intr(sc, status, sbd, sbuf);
519			break;
520
521		case IPW_STATUS_CODE_NOTIFICATION:
522			ipw_notification_intr(sc, sbuf);
523			break;
524
525		default:
526			printf("%s: unknown status code %u\n",
527			    sc->sc_dev.dv_xname, letoh16(status->code));
528		}
529		sbd->bd->flags = 0;
530
531		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
532		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
533		    BUS_DMASYNC_PREWRITE);
534	}
535
536	/* Tell the firmware what we have processed */
537	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
538	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
539}
540
541void
542ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
543{
544	struct ieee80211com *ic;
545	struct ipw_soft_hdr *shdr;
546	struct ipw_soft_buf *sbuf;
547
548	switch (sbd->type) {
549	case IPW_SBD_TYPE_COMMAND:
550		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
551		break;
552
553	case IPW_SBD_TYPE_HEADER:
554		shdr = sbd->priv;
555		bus_dmamap_unload(sc->sc_dmat, shdr->map);
556		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
557		break;
558
559	case IPW_SBD_TYPE_DATA:
560		ic = &sc->sc_ic;
561		sbuf = sbd->priv;
562		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
563		m_freem(sbuf->m);
564		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
565			ieee80211_free_node(ic, sbuf->ni);
566		/* kill watchdog timer */
567		sc->sc_tx_timer = 0;
568		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
569		break;
570	}
571	sbd->type = IPW_SBD_TYPE_NOASSOC;
572}
573
574void
575ipw_tx_intr(struct ipw_softc *sc)
576{
577	struct ifnet *ifp = &sc->sc_ic.ic_if;
578	u_int32_t r, i;
579
580	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
581
582	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD)
583		ipw_release_sbd(sc, &sc->stbd_list[i]);
584
585	/* Remember what the firmware has processed */
586	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
587
588	/* Call start() since some buffer descriptors have been released */
589	ifp->if_flags &= ~IFF_OACTIVE;
590	(*ifp->if_start)(ifp);
591}
592
593int
594ipw_intr(void *arg)
595{
596	struct ipw_softc *sc = arg;
597	u_int32_t r;
598
599	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0)
600		return 0;
601
602	/* Disable interrupts */
603	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
604
605	DPRINTFN(8, ("INTR!0x%08x\n", r));
606
607	if (r & IPW_INTR_RX_TRANSFER)
608		ipw_rx_intr(sc);
609
610	if (r & IPW_INTR_TX_TRANSFER)
611		ipw_tx_intr(sc);
612
613	if (r & IPW_INTR_FW_INIT_DONE) {
614		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
615			wakeup(sc);
616	}
617
618	/* Acknowledge interrupts */
619	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
620
621	/* Re-enable interrupts */
622	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
623
624	return 0;
625}
626
627int
628ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
629{
630	struct ipw_soft_bd *sbd;
631	int error;
632
633	sbd = &sc->stbd_list[sc->txcur];
634
635	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, sc->cmd,
636	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
637	if (error != 0) {
638		printf("%s: could not map cmd dma memory\n",
639		    sc->sc_dev.dv_xname);
640		return error;
641	}
642
643	sc->cmd->type = htole32(type);
644	sc->cmd->subtype = htole32(0);
645	sc->cmd->len = htole32(len);
646	sc->cmd->seq = htole32(0);
647	if (data != NULL)
648		bcopy(data, sc->cmd->data, len);
649
650	sbd->type = IPW_SBD_TYPE_COMMAND;
651	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
652	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
653	sbd->bd->nfrag = 1;
654	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
655			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
656
657	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
658	    BUS_DMASYNC_PREWRITE);
659
660	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
661	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
662	    BUS_DMASYNC_PREWRITE);
663
664	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
665	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
666
667	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
668
669	/* Wait at most one second for command to complete */
670	return tsleep(sc->cmd, 0, "ipwcmd", hz);
671}
672
673int
674ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
675{
676	struct ipw_softc *sc = ifp->if_softc;
677	struct ieee80211com *ic = &sc->sc_ic;
678	struct ieee80211_frame *wh;
679	struct ipw_soft_bd *sbd;
680	struct ipw_soft_hdr *shdr;
681	struct ipw_soft_buf *sbuf;
682	int error, i;
683
684	if (ic->ic_flags & IEEE80211_F_WEPON) {
685		m = ieee80211_wep_crypt(ifp, m, 1);
686		if (m == NULL)
687			return ENOBUFS;
688	}
689
690#if NBPFILTER > 0
691	if (sc->sc_drvbpf != NULL) {
692		struct mbuf mb;
693		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
694
695		tap->wt_flags = 0;
696		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
697		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
698
699		M_DUP_PKTHDR(&mb, m);
700		mb.m_data = (caddr_t)tap;
701		mb.m_len = sc->sc_txtap_len;
702		mb.m_next = m;
703		mb.m_pkthdr.len += mb.m_len;
704		bpf_mtap(sc->sc_drvbpf, &mb);
705	}
706#endif
707
708	wh = mtod(m, struct ieee80211_frame *);
709
710	shdr = TAILQ_FIRST(&sc->sc_free_shdr);
711	sbuf = TAILQ_FIRST(&sc->sc_free_sbuf);
712
713	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
714	shdr->hdr.subtype = htole32(0);
715	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
716	shdr->hdr.encrypt = 0;
717	shdr->hdr.keyidx = 0;
718	shdr->hdr.keysz = 0;
719	shdr->hdr.fragmentsz = htole16(0);
720	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
721	if (ic->ic_opmode == IEEE80211_M_STA)
722		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
723	else
724		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
725
726	/* trim IEEE802.11 header */
727	m_adj(m, sizeof (struct ieee80211_frame));
728
729	/*
730	 * We need to map the mbuf first to know how many buffer descriptors
731	 * are needed for this transfer.
732	 */
733	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
734	if (error != 0) {
735		printf("%s: could not map mbuf (error %d)\n",
736		    sc->sc_dev.dv_xname, error);
737		m_freem(m);
738		return error;
739	}
740
741	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
742	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
743	if (error != 0) {
744		printf("%s: could not map header (error %d)\n",
745		    sc->sc_dev.dv_xname, error);
746		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
747		m_freem(m);
748		return error;
749	}
750
751	TAILQ_REMOVE(&sc->sc_free_sbuf, sbuf, next);
752	TAILQ_REMOVE(&sc->sc_free_shdr, shdr, next);
753
754	sbd = &sc->stbd_list[sc->txcur];
755	sbd->type = IPW_SBD_TYPE_HEADER;
756	sbd->priv = shdr;
757	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
758	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
759	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
760	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
761			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
762
763	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
764	    shdr->hdr.encrypted, shdr->hdr.encrypt));
765	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
766	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
767
768	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
769	    sc->txcur * sizeof (struct ipw_bd),
770	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
771
772	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
773
774	sbuf->m = m;
775	sbuf->ni = ni;
776
777	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
778		sbd = &sc->stbd_list[sc->txcur];
779		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
780		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
781		sbd->bd->nfrag = 0; /* used only in first bd */
782		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
783		if (i == sbuf->map->dm_nsegs - 1) {
784			sbd->type = IPW_SBD_TYPE_DATA;
785			sbd->priv = sbuf;
786			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
787		} else {
788			sbd->type = IPW_SBD_TYPE_NOASSOC;
789			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
790		}
791
792		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
793		    sbuf->map->dm_segs[i].ds_len));
794
795		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
796		    sc->txcur * sizeof (struct ipw_bd),
797		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
798
799		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
800	}
801
802	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
803	    BUS_DMASYNC_PREWRITE);
804
805	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
806	    BUS_DMASYNC_PREWRITE);
807
808	/* Inform firmware about this new packet */
809	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
810
811	return 0;
812}
813
814void
815ipw_start(struct ifnet *ifp)
816{
817	struct ipw_softc *sc = ifp->if_softc;
818	struct ieee80211com *ic = &sc->sc_ic;
819	struct mbuf *m;
820	struct ieee80211_node *ni;
821
822	for (;;) {
823		IF_DEQUEUE(&ifp->if_snd, m);
824		if (m == NULL)
825			break;
826
827#if NBPFILTER > 0
828		if (ifp->if_bpf != NULL)
829			bpf_mtap(ifp->if_bpf, m);
830#endif
831
832		m = ieee80211_encap(ifp, m, &ni);
833		if (m == NULL)
834			continue;
835
836#if NBPFILTER > 0
837		if (ic->ic_rawbpf != NULL)
838			bpf_mtap(ic->ic_rawbpf, m);
839#endif
840
841		if (ipw_tx_start(ifp, m, ni) != 0) {
842			if (ni != NULL && ni != ic->ic_bss)
843				ieee80211_free_node(ic, ni);
844			break;
845		}
846
847		/* start watchdog timer */
848		sc->sc_tx_timer = 5;
849		ifp->if_timer = 1;
850	}
851}
852
853void
854ipw_watchdog(struct ifnet *ifp)
855{
856	struct ipw_softc *sc = ifp->if_softc;
857
858	ifp->if_timer = 0;
859
860	if (sc->sc_tx_timer > 0) {
861		if (--sc->sc_tx_timer == 0) {
862			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
863#ifdef notyet
864			ipw_init(ifp);
865#endif
866			return;
867		}
868		ifp->if_timer = 1;
869	}
870
871	ieee80211_watchdog(ifp);
872}
873
874int
875ipw_get_table1(struct ipw_softc *sc, u_int32_t *tbl)
876{
877	u_int32_t addr, data, size, i;
878
879	if (!(sc->flags & IPW_FLAG_FW_INITED))
880		return ENOTTY;
881
882	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
883
884	size = CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA);
885	if (copyout(&size, tbl, sizeof size) != 0)
886		return EFAULT;
887
888	for (i = 1, ++tbl; i < size; i++, tbl++) {
889		addr = CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA);
890		data = MEM_READ_4(sc, addr);
891		if (copyout(&data, tbl, sizeof data) != 0)
892			return EFAULT;
893	}
894	return 0;
895}
896
897int
898ipw_get_radio(struct ipw_softc *sc, int *ret)
899{
900	u_int32_t addr;
901	int val;
902
903	if (!(sc->flags & IPW_FLAG_FW_INITED))
904		return ENOTTY;
905
906	addr = ipw_read_table1(sc, IPW_INFO_EEPROM_ADDRESS);
907	if ((MEM_READ_4(sc, addr + 32) >> 24) & 1) {
908		val = -1;
909		copyout(&val, ret, sizeof val);
910		return 0;
911	}
912
913	if (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED)
914		val = 0;
915	else
916		val = 1;
917
918	copyout(&val, ret, sizeof val);
919
920	return 0;
921}
922
923int
924ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
925{
926	struct ipw_softc *sc = ifp->if_softc;
927	struct ifreq *ifr;
928	struct ifaddr *ifa;
929	int s, error = 0;
930
931	s = splnet();
932
933	switch (cmd) {
934	case SIOCSIFADDR:
935		ifa = (struct ifaddr *) data;
936		ifp->if_flags |= IFF_UP;
937		switch (ifa->ifa_addr->sa_family) {
938#ifdef INET
939		case AF_INET:
940			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
941			ipw_init(ifp);
942			break;
943#endif
944		default:
945			ipw_init(ifp);
946		}
947		break;
948
949	case SIOCSIFFLAGS:
950		if (ifp->if_flags & IFF_UP) {
951			if (!(ifp->if_flags & IFF_RUNNING))
952				ipw_init(ifp);
953		} else {
954			if (ifp->if_flags & IFF_RUNNING)
955				ipw_stop(ifp, 1);
956		}
957		break;
958
959	case SIOCGTABLE1:
960		ifr = (struct ifreq *)data;
961		error = ipw_get_table1(sc, (u_int32_t *)ifr->ifr_data);
962		break;
963
964	case SIOCGRADIO:
965		ifr = (struct ifreq *)data;
966		error = ipw_get_radio(sc, (int *)ifr->ifr_data);
967		break;
968
969	case SIOCSLOADFW:
970		/* only super-user can do that! */
971		if ((error = suser(curproc, 0)) != 0)
972			break;
973
974		ifr = (struct ifreq *)data;
975		error = ipw_firmware_init(sc, (u_char *)ifr->ifr_data);
976		break;
977
978	case SIOCSKILLFW:
979		/* only super-user can do that! */
980		if ((error = suser(curproc, 0)) != 0)
981			break;
982
983		ipw_reset(sc);
984		break;
985
986	default:
987		error = ieee80211_ioctl(ifp, cmd, data);
988		if (error != ENETRESET)
989			break;
990
991		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
992		    (IFF_UP | IFF_RUNNING))
993			ipw_init(ifp);
994		error = 0;
995	}
996
997	splx(s);
998	return error;
999}
1000
1001u_int32_t
1002ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1003{
1004	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1005}
1006
1007void
1008ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1009{
1010	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1011}
1012
1013int
1014ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1015{
1016	u_int32_t addr, info;
1017	u_int16_t count, size;
1018	u_int32_t total;
1019
1020	/* addr[4] + count[2] + size[2] */
1021	addr = MEM_READ_4(sc, sc->table2_base + off);
1022	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1023
1024	count = info >> 16;
1025	size = info & 0xffff;
1026	total = count * size;
1027
1028	if (total > *len) {
1029		*len = total;
1030		return EINVAL;
1031	}
1032
1033	*len = total;
1034	ipw_read_mem_1(sc, addr, buf, total);
1035
1036	return 0;
1037}
1038
1039int
1040ipw_tx_init(struct ipw_softc *sc)
1041{
1042	char *errmsg;
1043	struct ipw_bd *bd;
1044	struct ipw_soft_bd *sbd;
1045	struct ipw_soft_hdr *shdr;
1046	struct ipw_soft_buf *sbuf;
1047	int error, i, nsegs;
1048
1049	/* Allocate transmission buffer descriptors */
1050	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
1051	    BUS_DMA_NOWAIT, &sc->tbd_map);
1052	if (error != 0) {
1053		errmsg = "could not create tbd dma map";
1054		goto fail;
1055	}
1056
1057	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
1058	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1059	if (error != 0) {
1060		errmsg = "could not allocate tbd dma memory";
1061		goto fail;
1062	}
1063
1064	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
1065	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
1066	if (error != 0) {
1067		errmsg = "could not map tbd dma memory";
1068		goto fail;
1069	}
1070
1071	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
1072	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
1073	if (error != 0) {
1074		errmsg = "could not load tbd dma memory";
1075		goto fail;
1076	}
1077
1078	sc->stbd_list = malloc(IPW_NTBD * sizeof (struct ipw_soft_bd),
1079	    M_DEVBUF, M_NOWAIT);
1080	if (sc->stbd_list == NULL) {
1081		errmsg = "could not allocate soft tbd";
1082		error = ENOMEM;
1083		goto fail;
1084	}
1085	sbd = sc->stbd_list;
1086	bd = sc->tbd_list;
1087	for (i = 0; i < IPW_NTBD; i++, sbd++, bd++) {
1088		sbd->type = IPW_SBD_TYPE_NOASSOC;
1089		sbd->bd = bd;
1090	}
1091
1092	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1093	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1094	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1095	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1096	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1097	sc->txcur = 0; /* bd index to write to */
1098
1099	/* Allocate a DMA-able command */
1100	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
1101	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
1102	if (error != 0) {
1103		errmsg = "could not create cmd dma map";
1104		goto fail;
1105	}
1106
1107	error = bus_dmamem_alloc(sc->sc_dmat, sizeof (struct ipw_cmd),
1108	    PAGE_SIZE, 0, &sc->cmd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1109	if (error != 0) {
1110		errmsg = "could not allocate cmd dma memory";
1111		goto fail;
1112	}
1113
1114	error = bus_dmamem_map(sc->sc_dmat, &sc->cmd_seg, nsegs,
1115	    sizeof (struct ipw_cmd), (caddr_t *)&sc->cmd, BUS_DMA_NOWAIT);
1116	if (error != 0) {
1117		errmsg = "could not map cmd dma memory";
1118		goto fail;
1119	}
1120
1121	/* Allocate a pool of DMA-able headers */
1122	sc->shdr_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_hdr),
1123	    M_DEVBUF, M_NOWAIT);
1124	if (sc->shdr_list == NULL) {
1125		errmsg = "could not allocate soft hdr";
1126		error = ENOMEM;
1127		goto fail;
1128	}
1129	TAILQ_INIT(&sc->sc_free_shdr);
1130	for (i = 0, shdr = sc->shdr_list; i < IPW_NDATA; i++, shdr++) {
1131		error = bus_dmamap_create(sc->sc_dmat,
1132		    sizeof (struct ipw_soft_hdr), 1,
1133	 	    sizeof (struct ipw_soft_hdr), 0, BUS_DMA_NOWAIT,
1134		    &shdr->map);
1135		if (error != 0) {
1136			errmsg = "could not create hdr dma map";
1137			goto fail;
1138		}
1139		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
1140	}
1141
1142	/* Allocate a pool of DMA-able buffers */
1143	sc->tx_sbuf_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_buf),
1144	    M_DEVBUF, M_NOWAIT);
1145	if (sc->tx_sbuf_list == NULL) {
1146		errmsg = "could not allocate soft txbuf";
1147		error = ENOMEM;
1148		goto fail;
1149	}
1150	TAILQ_INIT(&sc->sc_free_sbuf);
1151	for (i = 0, sbuf = sc->tx_sbuf_list; i < IPW_NDATA; i++, sbuf++) {
1152		error = bus_dmamap_create(sc->sc_dmat, IPW_NDATA * MCLBYTES,
1153		    IPW_NDATA, MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
1154		if (error != 0) {
1155			errmsg = "could not create txbuf dma map";
1156			goto fail;
1157		}
1158		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
1159	}
1160
1161	return 0;
1162
1163fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1164	ipw_tx_stop(sc);
1165
1166	return error;
1167}
1168
1169void
1170ipw_tx_stop(struct ipw_softc *sc)
1171{
1172	struct ipw_soft_hdr *shdr;
1173	struct ipw_soft_buf *sbuf;
1174	int i;
1175
1176	if (sc->tbd_map != NULL) {
1177		if (sc->tbd_list != NULL) {
1178			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
1179			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
1180			    IPW_TBD_SZ);
1181			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
1182			sc->tbd_list = NULL;
1183		}
1184		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
1185		sc->tbd_map = NULL;
1186	}
1187
1188	if (sc->stbd_list != NULL) {
1189		for (i = 0; i < IPW_NTBD; i++)
1190			ipw_release_sbd(sc, &sc->stbd_list[i]);
1191		free(sc->stbd_list, M_DEVBUF);
1192		sc->stbd_list = NULL;
1193	}
1194
1195	if (sc->cmd_map != NULL) {
1196		if (sc->cmd != NULL) {
1197			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->cmd,
1198			    sizeof (struct ipw_cmd));
1199			bus_dmamem_free(sc->sc_dmat, &sc->cmd_seg, 1);
1200			sc->cmd = NULL;
1201		}
1202		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
1203		sc->cmd_map = NULL;
1204	}
1205
1206	if (sc->shdr_list != NULL) {
1207		TAILQ_FOREACH(shdr, &sc->sc_free_shdr, next)
1208			bus_dmamap_destroy(sc->sc_dmat, shdr->map);
1209		free(sc->shdr_list, M_DEVBUF);
1210		sc->shdr_list = NULL;
1211	}
1212
1213
1214	if (sc->tx_sbuf_list != NULL) {
1215		TAILQ_FOREACH(sbuf, &sc->sc_free_sbuf, next)
1216			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1217		free(sc->tx_sbuf_list, M_DEVBUF);
1218		sc->tx_sbuf_list = NULL;
1219	}
1220}
1221
1222int
1223ipw_rx_init(struct ipw_softc *sc)
1224{
1225	char *errmsg;
1226	struct ipw_bd *bd;
1227	struct ipw_soft_bd *sbd;
1228	struct ipw_soft_buf *sbuf;
1229	int error, i, nsegs;
1230
1231	/* Allocate reception buffer descriptors */
1232	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
1233	    BUS_DMA_NOWAIT, &sc->rbd_map);
1234	if (error != 0) {
1235		errmsg = "could not create rbd dma map";
1236		goto fail;
1237	}
1238
1239	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
1240	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1241	if (error != 0) {
1242		errmsg = "could not allocate rbd dma memory";
1243		goto fail;
1244	}
1245
1246	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
1247	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
1248	if (error != 0) {
1249		errmsg = "could not map rbd dma memory";
1250		goto fail;
1251	}
1252
1253	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
1254	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
1255	if (error != 0) {
1256		errmsg = "could not load rbd dma memory";
1257		goto fail;
1258	}
1259
1260	sc->srbd_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_bd),
1261	    M_DEVBUF, M_NOWAIT);
1262	if (sc->srbd_list == NULL) {
1263		errmsg = "could not allocate soft rbd";
1264		error = ENOMEM;
1265		goto fail;
1266	}
1267	sbd = sc->srbd_list;
1268	bd = sc->rbd_list;
1269	for (i = 0; i < IPW_NRBD; i++, sbd++, bd++) {
1270		sbd->type = IPW_SBD_TYPE_NOASSOC;
1271		sbd->bd = bd;
1272	}
1273
1274	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1275	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1276	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1277	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1278	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
1279
1280	/* Allocate status descriptors */
1281	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
1282	    0, BUS_DMA_NOWAIT, &sc->status_map);
1283	if (error != 0) {
1284		errmsg = "could not create status dma map";
1285		goto fail;
1286	}
1287
1288	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
1289	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1290	if (error != 0) {
1291		errmsg = "could not allocate status dma memory";
1292		goto fail;
1293	}
1294
1295	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
1296	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
1297	if (error != 0) {
1298		errmsg = "could not map status dma memory";
1299		goto fail;
1300	}
1301
1302	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
1303	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
1304	if (error != 0) {
1305		errmsg = "could not load status dma memory";
1306		goto fail;
1307	}
1308
1309	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1310	    sc->status_map->dm_segs[0].ds_addr);
1311
1312	sc->rx_sbuf_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_buf),
1313	    M_DEVBUF, M_NOWAIT);
1314	if (sc->rx_sbuf_list == NULL) {
1315		errmsg = "could not allocate soft rxbuf";
1316		error = ENOMEM;
1317		goto fail;
1318	}
1319
1320	sbuf = sc->rx_sbuf_list;
1321	sbd = sc->srbd_list;
1322	for (i = 0; i < IPW_NRBD; i++, sbuf++, sbd++) {
1323
1324		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
1325		if (sbuf->m == NULL) {
1326			errmsg = "could not allocate rx mbuf";
1327			error = ENOMEM;
1328			goto fail;
1329		}
1330		MCLGET(sbuf->m, M_DONTWAIT);
1331		if (!(sbuf->m->m_flags & M_EXT)) {
1332			m_freem(sbuf->m);
1333			errmsg = "could not allocate rx mbuf cluster";
1334			error = ENOMEM;
1335			goto fail;
1336		}
1337
1338		error = bus_dmamap_create(sc->sc_dmat, IPW_NRBD * MCLBYTES,
1339		    IPW_NRBD, MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
1340		if (error != 0) {
1341			m_freem(sbuf->m);
1342			errmsg = "could not create rxbuf dma map";
1343			goto fail;
1344		}
1345		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
1346		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1347		if (error != 0) {
1348			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1349			m_freem(sbuf->m);
1350			errmsg = "could not map rxbuf dma memory";
1351			goto fail;
1352		}
1353		sbd->type = IPW_SBD_TYPE_DATA;
1354		sbd->priv = sbuf;
1355		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
1356		sbd->bd->len = htole32(MCLBYTES);
1357	}
1358
1359	return 0;
1360
1361fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1362	ipw_rx_stop(sc);
1363
1364	return error;
1365}
1366
1367void
1368ipw_rx_stop(struct ipw_softc *sc)
1369{
1370	struct ipw_soft_bd *sbd;
1371	struct ipw_soft_buf *sbuf;
1372	int i;
1373
1374	if (sc->rbd_map != NULL) {
1375		if (sc->rbd_list != NULL) {
1376			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
1377			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
1378			    IPW_RBD_SZ);
1379			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
1380			sc->rbd_list = NULL;
1381		}
1382		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
1383		sc->rbd_map = NULL;
1384	}
1385
1386	if (sc->status_map != NULL) {
1387		if (sc->status_list != NULL) {
1388			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
1389			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
1390			    IPW_STATUS_SZ);
1391			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
1392			sc->status_list = NULL;
1393		}
1394		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
1395		sc->status_map = NULL;
1396	}
1397
1398	if (sc->srbd_list != NULL) {
1399		for (i = 0, sbd = sc->srbd_list; i < IPW_NRBD; i++, sbd++) {
1400			if (sbd->type == IPW_SBD_TYPE_NOASSOC)
1401				continue;
1402
1403			sbuf = sbd->priv;
1404			bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1405			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1406			m_freem(sbuf->m);
1407		}
1408		free(sc->srbd_list, M_DEVBUF);
1409		sc->srbd_list = NULL;
1410	}
1411
1412	if (sc->rx_sbuf_list != NULL) {
1413		free(sc->rx_sbuf_list, M_DEVBUF);
1414		sc->rx_sbuf_list = NULL;
1415	}
1416}
1417
1418void
1419ipw_reset(struct ipw_softc *sc)
1420{
1421	struct ifnet *ifp = &sc->sc_ic.ic_if;
1422	int ntries;
1423
1424	ipw_stop(ifp, 1);
1425
1426	if (sc->flags & IPW_FLAG_FW_INITED) {
1427		ipw_cmd(sc, IPW_CMD_DISABLE_PHY, NULL, 0);
1428		ipw_cmd(sc, IPW_CMD_PREPARE_POWER_DOWN, NULL, 0);
1429
1430		sc->flags &= ~IPW_FLAG_FW_INITED;
1431	}
1432
1433	/* Disable interrupts */
1434	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1435
1436	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1437	for (ntries = 0; ntries < 5; ntries++) {
1438		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1439			break;
1440		DELAY(10);
1441	}
1442
1443	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1444
1445	ipw_rx_stop(sc);
1446	ipw_tx_stop(sc);
1447
1448	ifp->if_flags &= ~IFF_UP;
1449}
1450
1451int
1452ipw_clock_sync(struct ipw_softc *sc)
1453{
1454	int ntries;
1455	u_int32_t r;
1456
1457	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1458	for (ntries = 0; ntries < 1000; ntries++) {
1459		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_PRINCETON_RESET)
1460			break;
1461		DELAY(10);
1462	}
1463	if (ntries == 1000)
1464		return EIO;
1465
1466	CSR_WRITE_4(sc, IPW_CSR_CTL, IPW_CTL_INIT);
1467	for (ntries = 0; ntries < 1000; ntries++) {
1468		if ((r = CSR_READ_4(sc, IPW_CSR_CTL)) & IPW_CTL_CLOCK_READY)
1469			break;
1470		DELAY(200);
1471	}
1472	if (ntries == 1000)
1473		return EIO;
1474
1475	CSR_WRITE_4(sc, IPW_CSR_CTL, r | IPW_CTL_ALLOW_STANDBY);
1476
1477	return 0;
1478}
1479
1480int
1481ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1482{
1483	int ntries;
1484
1485	MEM_WRITE_2(sc, 0x220000, 0x0703);
1486	MEM_WRITE_2(sc, 0x220000, 0x0707);
1487
1488	MEM_WRITE_1(sc, 0x210014, 0x72);
1489	MEM_WRITE_1(sc, 0x210014, 0x72);
1490
1491	MEM_WRITE_1(sc, 0x210000, 0x40);
1492	MEM_WRITE_1(sc, 0x210000, 0x00);
1493	MEM_WRITE_1(sc, 0x210000, 0x40);
1494
1495	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1496
1497	MEM_WRITE_1(sc, 0x210000, 0x00);
1498	MEM_WRITE_1(sc, 0x210000, 0x00);
1499	MEM_WRITE_1(sc, 0x210000, 0x80);
1500
1501	MEM_WRITE_2(sc, 0x220000, 0x0703);
1502	MEM_WRITE_2(sc, 0x220000, 0x0707);
1503
1504	MEM_WRITE_1(sc, 0x210014, 0x72);
1505	MEM_WRITE_1(sc, 0x210014, 0x72);
1506
1507	MEM_WRITE_1(sc, 0x210000, 0x00);
1508	MEM_WRITE_1(sc, 0x210000, 0x80);
1509
1510	for (ntries = 0; ntries < 10; ntries++) {
1511		if (MEM_READ_1(sc, 0x210000) & 1)
1512			break;
1513		DELAY(10);
1514	}
1515	if (ntries == 10)
1516		return EIO;
1517
1518	return 0;
1519}
1520
1521/* set of macros to handle unaligned little endian data in firmware image */
1522#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1523#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1524int
1525ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1526{
1527	u_char *p, *end;
1528	u_int32_t dst;
1529	u_int16_t len;
1530
1531	p = fw;
1532	end = fw + size;
1533	while (p < end) {
1534		if (p + 6 > end)
1535			return EINVAL;
1536
1537		dst = GETLE32(p); p += 4;
1538		len = GETLE16(p); p += 2;
1539
1540		if (p + len > end)
1541			return EINVAL;
1542
1543		ipw_write_mem_1(sc, dst, p, len);
1544		p += len;
1545	}
1546	return 0;
1547}
1548
1549int
1550ipw_firmware_init(struct ipw_softc *sc, u_char *data)
1551{
1552	struct ieee80211com *ic = &sc->sc_ic;
1553	struct ifnet *ifp = &ic->ic_if;
1554	struct ipw_fw_hdr hdr;
1555	u_int32_t r, len, fw_size, uc_size;
1556	u_char *fw, *uc;
1557	int error;
1558
1559	ipw_reset(sc);
1560
1561	if ((error = copyin(data, &hdr, sizeof hdr)) != 0)
1562		goto fail1;
1563
1564	fw_size = letoh32(hdr.fw_size);
1565	uc_size = letoh32(hdr.uc_size);
1566	data += sizeof hdr;
1567
1568	if ((fw = malloc(fw_size, M_DEVBUF, M_NOWAIT)) == NULL) {
1569		error = ENOMEM;
1570		goto fail1;
1571	}
1572
1573	if ((error = copyin(data, fw, fw_size)) != 0)
1574		goto fail2;
1575
1576	data += fw_size;
1577
1578	if ((uc = malloc(uc_size, M_DEVBUF, M_NOWAIT)) == NULL) {
1579		error = ENOMEM;
1580		goto fail2;
1581	}
1582
1583	if ((error = copyin(data, uc, uc_size)) != 0)
1584		goto fail3;
1585
1586	if ((error = ipw_clock_sync(sc)) != 0) {
1587		printf("%s: clock synchronization failed\n",
1588		    sc->sc_dev.dv_xname);
1589		goto fail3;
1590	}
1591
1592	MEM_WRITE_4(sc, 0x003000e0, 0x80000000);
1593
1594	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1595
1596	if ((error = ipw_load_ucode(sc, uc, uc_size)) != 0) {
1597		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1598		goto fail3;
1599	}
1600
1601	MEM_WRITE_4(sc, 0x003000e0, 0);
1602
1603	if ((error = ipw_clock_sync(sc)) != 0) {
1604		printf("%s: clock synchronization failed\n",
1605		    sc->sc_dev.dv_xname);
1606		goto fail3;
1607	}
1608
1609	if ((error = ipw_load_firmware(sc, fw, fw_size))) {
1610		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1611		goto fail3;
1612	}
1613
1614	ipw_zero_mem_4(sc, 0x0002f200, 196);
1615	ipw_zero_mem_4(sc, 0x0002f610, 8);
1616	ipw_zero_mem_4(sc, 0x0002fa00, 8);
1617	ipw_zero_mem_4(sc, 0x0002fc00, 4);
1618	ipw_zero_mem_4(sc, 0x0002ff80, 32);
1619
1620	if ((error = ipw_rx_init(sc)) != 0) {
1621		printf("%s: could not initialize rx queue\n",
1622		    sc->sc_dev.dv_xname);
1623		goto fail3;
1624	}
1625
1626	if ((error = ipw_tx_init(sc)) != 0) {
1627		printf("%s: could not initialize tx queue\n",
1628		    sc->sc_dev.dv_xname);
1629		goto fail3;
1630	}
1631
1632	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1633	    IPW_IO_LED_OFF);
1634
1635	/* Allow interrupts so we know when the firmware is inited */
1636	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1637
1638	/* Tell the adapter to initialize the firmware */
1639	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1640
1641	/* Wait at most one second for firmware initialization to complete */
1642	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1643		printf("%s: timeout waiting for firmware initialization to "
1644		    "complete\n", sc->sc_dev.dv_xname);
1645		goto fail3;
1646	}
1647
1648	/* Firmware initialization completed */
1649	sc->flags |= IPW_FLAG_FW_INITED;
1650
1651	free(uc, M_DEVBUF);
1652	free(fw, M_DEVBUF);
1653
1654	r = CSR_READ_4(sc, IPW_CSR_IO);
1655	CSR_WRITE_4(sc, IPW_CSR_IO, r | IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1656
1657	/* Retrieve information tables base addresses */
1658	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1659	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1660
1661	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1662
1663	/* Retrieve adapter MAC address */
1664	len = IEEE80211_ADDR_LEN;
1665	ipw_read_table2(sc, IPW_INFO_ADAPTER_MAC, ic->ic_myaddr, &len);
1666
1667	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1668
1669	return 0;
1670
1671fail3:	free(uc, M_DEVBUF);
1672fail2:	free(fw, M_DEVBUF);
1673fail1:	ipw_reset(sc);
1674
1675	return error;
1676}
1677
1678int
1679ipw_config(struct ipw_softc *sc)
1680{
1681	struct ieee80211com *ic = &sc->sc_ic;
1682	struct ifnet *ifp = &ic->ic_if;
1683	struct ipw_security security;
1684	struct ieee80211_wepkey *k;
1685	struct ipw_wep_key wepkey;
1686	struct ipw_scan_options options;
1687	struct ipw_configuration config;
1688	u_int32_t data;
1689	int error, i;
1690
1691	switch (ic->ic_opmode) {
1692	case IEEE80211_M_STA:
1693	case IEEE80211_M_HOSTAP:
1694		data = htole32(IPW_MODE_BSS);
1695		break;
1696
1697	case IEEE80211_M_IBSS:
1698	case IEEE80211_M_AHDEMO:
1699		data = htole32(IPW_MODE_IBSS);
1700		break;
1701
1702	case IEEE80211_M_MONITOR:
1703		data = htole32(IPW_MODE_MONITOR);
1704		break;
1705	}
1706	DPRINTF(("Setting adapter mode to %u\n", data));
1707	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1708	if (error != 0)
1709		return error;
1710
1711	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1712	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1713		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1714		DPRINTF(("Setting adapter channel to %u\n", data));
1715		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1716		if (error != 0)
1717			return error;
1718	}
1719
1720	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1721		DPRINTF(("Enabling adapter\n"));
1722		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1723	}
1724
1725	DPRINTF(("Setting adapter MAC to %s\n", ether_sprintf(ic->ic_myaddr)));
1726	IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1727	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1728	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1729	    IEEE80211_ADDR_LEN);
1730	if (error != 0)
1731		return error;
1732
1733	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1734			       IPW_CFG_PREAMBLE_LEN | IPW_CFG_802_1x_ENABLE);
1735	if (ic->ic_opmode == IEEE80211_M_IBSS)
1736		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1737	if (ifp->if_flags & IFF_PROMISC)
1738		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1739	config.channels = htole32(0x3fff); /* channels 1-14 */
1740	config.ibss_chan = htole32(0x7ff);
1741	DPRINTF(("Setting adapter configuration 0x%08x\n", config.flags));
1742	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1743	if (error != 0)
1744		return error;
1745
1746	data = htole32(0x3); /* 1, 2 */
1747	DPRINTF(("Setting adapter basic tx rates to 0x%x\n", data));
1748	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1749	if (error != 0)
1750		return error;
1751
1752	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1753	DPRINTF(("Setting adapter tx rates to 0x%x\n", data));
1754	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1755	if (error != 0)
1756		return error;
1757
1758	data = htole32(IPW_POWER_MODE_CAM);
1759	DPRINTF(("Setting adapter power mode to %u\n", data));
1760	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1761	if (error != 0)
1762		return error;
1763
1764	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1765		data = htole32(ic->ic_txpower);
1766		DPRINTF(("Setting adapter tx power index to %u\n", data));
1767		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1768		    sizeof data);
1769		if (error != 0)
1770			return error;
1771	}
1772
1773	data = htole32(ic->ic_rtsthreshold);
1774	DPRINTF(("Setting adapter RTS threshold to %u\n", data));
1775	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1776	if (error != 0)
1777		return error;
1778
1779	data = htole32(ic->ic_fragthreshold);
1780	DPRINTF(("Setting adapter frag threshold to %u\n", data));
1781	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1782	if (error != 0)
1783		return error;
1784
1785#ifdef IPW_DEBUG
1786	if (ipw_debug > 0) {
1787		printf("Setting adapter ESSID to ");
1788		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1789		printf("\n");
1790	}
1791#endif
1792	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1793	    ic->ic_des_esslen);
1794	if (error != 0)
1795		return error;
1796
1797	/* no mandatory BSSID */
1798	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1799	if (error != 0)
1800		return error;
1801
1802	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1803		DPRINTF(("Setting adapter desired BSSID to %s\n",
1804		    ether_sprintf(ic->ic_des_bssid)));
1805		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1806		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1807		if (error != 0)
1808			return error;
1809	}
1810
1811	security.authmode = IPW_AUTH_OPEN;
1812	security.ciphers = htole32(IPW_CIPHER_NONE);
1813	security.version = htole16(0);
1814	security.replay_counters_number = 0;
1815	security.unicast_using_group = 0;
1816	DPRINTF(("Setting adapter authmode to %u\n", security.authmode));
1817	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1818	    sizeof security);
1819	if (error != 0)
1820		return error;
1821
1822	if (ic->ic_flags & IEEE80211_F_WEPON) {
1823		k = ic->ic_nw_keys;
1824		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1825			if (k->wk_len == 0)
1826				continue;
1827
1828			wepkey.idx = i;
1829			wepkey.len = k->wk_len;
1830			bzero(wepkey.key, sizeof wepkey.key);
1831			bcopy(k->wk_key, wepkey.key, k->wk_len);
1832			DPRINTF(("Setting wep key index %d len %d\n",
1833			    wepkey.idx, wepkey.len));
1834			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1835			    sizeof wepkey);
1836			if (error != 0)
1837				return error;
1838		}
1839
1840		data = htole32(ic->ic_wep_txkey);
1841		DPRINTF(("Setting adapter tx key index to %u\n", data));
1842		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1843		    sizeof data);
1844		if (error != 0)
1845			return error;
1846	}
1847
1848	data = htole32((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) ? 0x8 : 0);
1849	DPRINTF(("Setting adapter wep flags to 0x%x\n", data));
1850	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1851	if (error != 0)
1852		return error;
1853
1854	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1855	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1856		data = htole32(ic->ic_lintval);
1857		DPRINTF(("Setting adapter beacon interval to %u\n", data));
1858		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1859		    sizeof data);
1860		if (error != 0)
1861			return error;
1862	}
1863
1864	options.flags = htole32(0);
1865	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1866	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1867	if (error != 0)
1868		return error;
1869
1870	/* finally, enable adapter (start scanning for an access point) */
1871	DPRINTF(("Enabling adapter\n"));
1872	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1873}
1874
1875int
1876ipw_init(struct ifnet *ifp)
1877{
1878	struct ipw_softc *sc = ifp->if_softc;
1879	struct ieee80211com *ic = &sc->sc_ic;
1880
1881	/* exit immediately if firmware has not been ioctl'd */
1882	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
1883		ifp->if_flags &= ~IFF_UP;
1884		return EIO;
1885	}
1886
1887	ipw_stop(ifp, 0);
1888
1889	if (ipw_config(sc) != 0) {
1890		printf("%s: device configuration failed\n",
1891		    sc->sc_dev.dv_xname);
1892		goto fail;
1893	}
1894
1895	ifp->if_flags &= ~IFF_OACTIVE;
1896	ifp->if_flags |= IFF_RUNNING;
1897
1898	ic->ic_bss->ni_chan = ic->ic_channels;
1899
1900	return 0;
1901
1902fail:	ipw_stop(ifp, 0);
1903
1904	return EIO;
1905}
1906
1907void
1908ipw_stop(struct ifnet *ifp, int disable)
1909{
1910	struct ipw_softc *sc = ifp->if_softc;
1911	struct ieee80211com *ic = &sc->sc_ic;
1912
1913	if (ifp->if_flags & IFF_RUNNING) {
1914		DPRINTF(("Disabling adapter\n"));
1915		ipw_cmd(sc, IPW_CMD_DISABLE, NULL, 0);
1916	}
1917
1918	ifp->if_timer = 0;
1919	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1920
1921	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1922}
1923
1924void
1925ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1926    bus_size_t count)
1927{
1928	for (; count > 0; offset++, datap++, count--) {
1929		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1930		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
1931	}
1932}
1933
1934void
1935ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1936    bus_size_t count)
1937{
1938	for (; count > 0; offset++, datap++, count--) {
1939		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1940		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
1941	}
1942}
1943
1944void
1945ipw_zero_mem_4(struct ipw_softc *sc, bus_size_t offset, bus_size_t count)
1946{
1947	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, offset);
1948	while (count-- > 0)
1949		CSR_WRITE_4(sc, IPW_CSR_AUTOINC_DATA, 0);
1950}
1951
1952struct cfdriver ipw_cd = {
1953	0, "ipw", DV_IFNET
1954};
1955