if_ipw.c revision 1.58
1/*	$OpenBSD: if_ipw.c,v 1.58 2006/06/14 18:40:23 brad Exp $	*/
2
3/*-
4 * Copyright (c) 2004-2006
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46#include <sys/device.h>
47
48#include <machine/bus.h>
49#include <machine/endian.h>
50#include <machine/intr.h>
51
52#include <dev/pci/pcireg.h>
53#include <dev/pci/pcivar.h>
54#include <dev/pci/pcidevs.h>
55
56#if NBPFILTER > 0
57#include <net/bpf.h>
58#endif
59#include <net/if.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_media.h>
63#include <net/if_types.h>
64
65#include <netinet/in.h>
66#include <netinet/in_systm.h>
67#include <netinet/in_var.h>
68#include <netinet/if_ether.h>
69#include <netinet/ip.h>
70
71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <dev/pci/if_ipwreg.h>
75#include <dev/pci/if_ipwvar.h>
76
77static const struct ieee80211_rateset ipw_rateset_11b =
78	{ 4, { 2, 4, 11, 22 } };
79
80int		ipw_match(struct device *, void *, void *);
81void		ipw_attach(struct device *, struct device *, void *);
82int		ipw_detach(struct device *, int);
83void		ipw_power(int, void *);
84int		ipw_dma_alloc(struct ipw_softc *);
85void		ipw_release(struct ipw_softc *);
86int		ipw_media_change(struct ifnet *);
87void		ipw_media_status(struct ifnet *, struct ifmediareq *);
88int		ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
89uint16_t	ipw_read_prom_word(struct ipw_softc *, uint8_t);
90void		ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
91void		ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
92void		ipw_data_intr(struct ipw_softc *, struct ipw_status *,
93		    struct ipw_soft_bd *, struct ipw_soft_buf *);
94void		ipw_notification_intr(struct ipw_softc *,
95		    struct ipw_soft_buf *);
96void		ipw_rx_intr(struct ipw_softc *);
97void		ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
98void		ipw_tx_intr(struct ipw_softc *);
99int		ipw_intr(void *);
100int		ipw_cmd(struct ipw_softc *, uint32_t, void *, uint32_t);
101int		ipw_tx_start(struct ifnet *, struct mbuf *,
102		    struct ieee80211_node *);
103void		ipw_start(struct ifnet *);
104void		ipw_watchdog(struct ifnet *);
105int		ipw_get_table1(struct ipw_softc *, uint32_t *);
106int		ipw_get_radio(struct ipw_softc *, int *);
107int		ipw_ioctl(struct ifnet *, u_long, caddr_t);
108uint32_t	ipw_read_table1(struct ipw_softc *, uint32_t);
109void		ipw_write_table1(struct ipw_softc *, uint32_t, uint32_t);
110int		ipw_read_table2(struct ipw_softc *, uint32_t, void *,
111		    uint32_t *);
112void		ipw_stop_master(struct ipw_softc *);
113int		ipw_reset(struct ipw_softc *);
114int		ipw_load_ucode(struct ipw_softc *, u_char *, int);
115int		ipw_load_firmware(struct ipw_softc *, u_char *, int);
116int		ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
117int		ipw_config(struct ipw_softc *);
118int		ipw_init(struct ifnet *);
119void		ipw_stop(struct ifnet *, int);
120void		ipw_read_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
121		    bus_size_t);
122void		ipw_write_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
123		    bus_size_t);
124
125static __inline uint8_t
126MEM_READ_1(struct ipw_softc *sc, uint32_t addr)
127{
128	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
129	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
130}
131
132static __inline uint32_t
133MEM_READ_4(struct ipw_softc *sc, uint32_t addr)
134{
135	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
136	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
137}
138
139#ifdef IPW_DEBUG
140#define DPRINTF(x)	do { if (ipw_debug > 0) printf x; } while (0)
141#define DPRINTFN(n, x)	do { if (ipw_debug >= (n)) printf x; } while (0)
142int ipw_debug = 0;
143#else
144#define DPRINTF(x)
145#define DPRINTFN(n, x)
146#endif
147
148struct cfattach ipw_ca = {
149	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
150};
151
152int
153ipw_match(struct device *parent, void *match, void *aux)
154{
155	struct pci_attach_args *pa = aux;
156
157	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
158	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2100)
159		return 1;
160
161	return 0;
162}
163
164/* Base Address Register */
165#define IPW_PCI_BAR0	0x10
166
167void
168ipw_attach(struct device *parent, struct device *self, void *aux)
169{
170	struct ipw_softc *sc = (struct ipw_softc *)self;
171	struct ieee80211com *ic = &sc->sc_ic;
172	struct ifnet *ifp = &ic->ic_if;
173	struct pci_attach_args *pa = aux;
174	const char *intrstr;
175	bus_space_tag_t memt;
176	bus_space_handle_t memh;
177	bus_addr_t base;
178	pci_intr_handle_t ih;
179	pcireg_t data;
180	uint16_t val;
181	int error, i;
182
183	sc->sc_pct = pa->pa_pc;
184	sc->sc_pcitag = pa->pa_tag,
185
186	/* clear device specific PCI configuration register 0x41 */
187	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
188	data &= ~0x0000ff00;
189	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
190
191	/* map the register window */
192	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
193	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
194	if (error != 0) {
195		printf(": could not map memory space\n");
196		return;
197	}
198
199	sc->sc_st = memt;
200	sc->sc_sh = memh;
201	sc->sc_dmat = pa->pa_dmat;
202
203	/* disable interrupts */
204	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
205
206	if (pci_intr_map(pa, &ih) != 0) {
207		printf(": could not map interrupt\n");
208		return;
209	}
210
211	intrstr = pci_intr_string(sc->sc_pct, ih);
212	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
213	    sc->sc_dev.dv_xname);
214	if (sc->sc_ih == NULL) {
215		printf(": could not establish interrupt");
216		if (intrstr != NULL)
217			printf(" at %s", intrstr);
218		printf("\n");
219		return;
220	}
221	printf(": %s", intrstr);
222
223	if (ipw_reset(sc) != 0) {
224		printf(": could not reset adapter\n");
225		return;
226	}
227
228	if (ipw_dma_alloc(sc) != 0) {
229		printf(": failed to allocate DMA resources\n");
230		return;
231	}
232
233	ic->ic_phytype = IEEE80211_T_DS;
234	ic->ic_opmode = IEEE80211_M_STA;
235	ic->ic_state = IEEE80211_S_INIT;
236
237	/* set device capabilities */
238	ic->ic_caps = IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
239	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP |
240	    IEEE80211_C_SHPREAMBLE | IEEE80211_C_SCANALL;
241
242	/* read MAC address from EEPROM */
243	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
244	ic->ic_myaddr[0] = val >> 8;
245	ic->ic_myaddr[1] = val & 0xff;
246	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
247	ic->ic_myaddr[2] = val >> 8;
248	ic->ic_myaddr[3] = val & 0xff;
249	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
250	ic->ic_myaddr[4] = val >> 8;
251	ic->ic_myaddr[5] = val & 0xff;
252
253	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
254
255	/* set supported .11b rates */
256	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
257
258	/* set supported .11b channels (1 through 14) */
259	for (i = 1; i <= 14; i++) {
260		ic->ic_channels[i].ic_freq =
261		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
262		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
263	}
264
265	/* default to authmode OPEN */
266	sc->authmode = IEEE80211_AUTH_OPEN;
267
268	/* IBSS channel undefined for now */
269	ic->ic_ibss_chan = &ic->ic_channels[0];
270
271	ifp->if_softc = sc;
272	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
273	ifp->if_init = ipw_init;
274	ifp->if_ioctl = ipw_ioctl;
275	ifp->if_start = ipw_start;
276	ifp->if_watchdog = ipw_watchdog;
277	IFQ_SET_READY(&ifp->if_snd);
278	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
279
280	if_attach(ifp);
281	ieee80211_ifattach(ifp);
282	/* override state transition machine */
283	sc->sc_newstate = ic->ic_newstate;
284	ic->ic_newstate = ipw_newstate;
285	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
286
287	sc->powerhook = powerhook_establish(ipw_power, sc);
288
289#if NBPFILTER > 0
290	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
291	    sizeof (struct ieee80211_frame) + 64);
292
293	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
294	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
295	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
296
297	sc->sc_txtap_len = sizeof sc->sc_txtapu;
298	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
299	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
300#endif
301}
302
303int
304ipw_detach(struct device *self, int flags)
305{
306	struct ipw_softc *sc = (struct ipw_softc *)self;
307	struct ifnet *ifp = &sc->sc_ic.ic_if;
308
309	ipw_stop(ifp, 1);
310
311	ieee80211_ifdetach(ifp);
312	if_detach(ifp);
313
314	ipw_release(sc);
315
316	if (sc->sc_ih != NULL) {
317		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
318		sc->sc_ih = NULL;
319	}
320
321	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
322
323	return 0;
324}
325
326void
327ipw_power(int why, void *arg)
328{
329	struct ipw_softc *sc = arg;
330	struct ifnet *ifp;
331	pcireg_t data;
332
333	if (why != PWR_RESUME)
334		return;
335
336	/* clear device specific PCI configuration register 0x41 */
337	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
338	data &= ~0x0000ff00;
339	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
340
341	ifp = &sc->sc_ic.ic_if;
342	if (ifp->if_flags & IFF_UP) {
343		ifp->if_init(ifp);
344		if (ifp->if_flags & IFF_RUNNING)
345			ifp->if_start(ifp);
346	}
347}
348
349int
350ipw_dma_alloc(struct ipw_softc *sc)
351{
352	struct ipw_soft_bd *sbd;
353	struct ipw_soft_hdr *shdr;
354	struct ipw_soft_buf *sbuf;
355	int i, nsegs, error;
356
357	/*
358	 * Allocate and map tx ring.
359	 */
360	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
361	    BUS_DMA_NOWAIT, &sc->tbd_map);
362	if (error != 0) {
363		printf("%s: could not create tx ring DMA map\n",
364		    sc->sc_dev.dv_xname);
365		goto fail;
366	}
367
368	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
369	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
370	if (error != 0) {
371		printf("%s: could not allocate tx ring DMA memory\n",
372		    sc->sc_dev.dv_xname);
373		goto fail;
374	}
375
376	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
377	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
378	if (error != 0) {
379		printf("%s: could not map tx ring DMA memory\n",
380		    sc->sc_dev.dv_xname);
381		goto fail;
382	}
383
384	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
385	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
386	if (error != 0) {
387		printf("%s: could not load tx ring DMA map\n",
388		    sc->sc_dev.dv_xname);
389		goto fail;
390	}
391
392	/*
393	 * Allocate and map rx ring.
394	 */
395	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
396	    BUS_DMA_NOWAIT, &sc->rbd_map);
397	if (error != 0) {
398		printf("%s: could not create rx ring DMA map\n",
399		    sc->sc_dev.dv_xname);
400		goto fail;
401	}
402
403	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
404	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
405	if (error != 0) {
406		printf("%s: could not allocate rx ring DMA memory\n",
407		    sc->sc_dev.dv_xname);
408		goto fail;
409	}
410
411	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
412	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
413	if (error != 0) {
414		printf("%s: could not map rx ring DMA memory\n",
415		    sc->sc_dev.dv_xname);
416		goto fail;
417	}
418
419	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
420	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
421	if (error != 0) {
422		printf("%s: could not load tx ring DMA map\n",
423		    sc->sc_dev.dv_xname);
424		goto fail;
425	}
426
427	/*
428	 * Allocate and map status ring.
429	 */
430	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
431	    0, BUS_DMA_NOWAIT, &sc->status_map);
432	if (error != 0) {
433		printf("%s: could not create status ring DMA map\n",
434		    sc->sc_dev.dv_xname);
435		goto fail;
436	}
437
438	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
439	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
440	if (error != 0) {
441		printf("%s: could not allocate status ring DMA memory\n",
442		    sc->sc_dev.dv_xname);
443		goto fail;
444	}
445
446	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
447	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
448	if (error != 0) {
449		printf("%s: could not map status ring DMA memory\n",
450		    sc->sc_dev.dv_xname);
451		goto fail;
452	}
453
454	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
455	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
456	if (error != 0) {
457		printf("%s: could not load status ring DMA map\n",
458		    sc->sc_dev.dv_xname);
459		goto fail;
460	}
461
462	/*
463	 * Allocate command DMA map.
464	 */
465	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
466	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
467	if (error != 0) {
468		printf("%s: could not create command DMA map\n",
469		    sc->sc_dev.dv_xname);
470		goto fail;
471	}
472
473	/*
474	 * Allocate headers DMA maps.
475	 */
476	SLIST_INIT(&sc->free_shdr);
477	for (i = 0; i < IPW_NDATA; i++) {
478		shdr = &sc->shdr_list[i];
479		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
480		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
481		if (error != 0) {
482			printf("%s: could not create header DMA map\n",
483			    sc->sc_dev.dv_xname);
484			goto fail;
485		}
486		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
487	}
488
489	/*
490	 * Allocate tx buffers DMA maps.
491	 */
492	SLIST_INIT(&sc->free_sbuf);
493	for (i = 0; i < IPW_NDATA; i++) {
494		sbuf = &sc->tx_sbuf_list[i];
495		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
496		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
497		if (error != 0) {
498			printf("%s: could not create tx DMA map\n",
499			    sc->sc_dev.dv_xname);
500			goto fail;
501		}
502		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
503	}
504
505	/*
506	 * Initialize tx ring.
507	 */
508	for (i = 0; i < IPW_NTBD; i++) {
509		sbd = &sc->stbd_list[i];
510		sbd->bd = &sc->tbd_list[i];
511		sbd->type = IPW_SBD_TYPE_NOASSOC;
512	}
513
514	/*
515	 * Pre-allocate rx buffers and DMA maps.
516	 */
517	for (i = 0; i < IPW_NRBD; i++) {
518		sbd = &sc->srbd_list[i];
519		sbuf = &sc->rx_sbuf_list[i];
520		sbd->bd = &sc->rbd_list[i];
521
522		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
523		if (sbuf->m == NULL) {
524			printf("%s: could not allocate rx mbuf\n",
525			    sc->sc_dev.dv_xname);
526			error = ENOMEM;
527			goto fail;
528		}
529
530		MCLGET(sbuf->m, M_DONTWAIT);
531		if (!(sbuf->m->m_flags & M_EXT)) {
532			m_freem(sbuf->m);
533			printf("%s: could not allocate rx mbuf cluster\n",
534			    sc->sc_dev.dv_xname);
535			error = ENOMEM;
536			goto fail;
537		}
538
539		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
540		    0, BUS_DMA_NOWAIT, &sbuf->map);
541		if (error != 0) {
542			printf("%s: could not create rx DMA map\n",
543			    sc->sc_dev.dv_xname);
544			goto fail;
545		}
546
547		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
548		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
549		if (error != 0) {
550			printf("%s: could not map rx DMA memory\n",
551			    sc->sc_dev.dv_xname);
552			goto fail;
553		}
554
555		sbd->type = IPW_SBD_TYPE_DATA;
556		sbd->priv = sbuf;
557		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
558		sbd->bd->len = htole32(MCLBYTES);
559	}
560
561	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
562	    BUS_DMASYNC_PREWRITE);
563
564	return 0;
565
566fail:	ipw_release(sc);
567	return error;
568}
569
570void
571ipw_release(struct ipw_softc *sc)
572{
573	struct ipw_soft_buf *sbuf;
574	int i;
575
576	if (sc->tbd_map != NULL) {
577		if (sc->tbd_list != NULL) {
578			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
579			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
580			    IPW_TBD_SZ);
581			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
582		}
583		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
584	}
585
586	if (sc->rbd_map != NULL) {
587		if (sc->rbd_list != NULL) {
588			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
589			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
590			    IPW_RBD_SZ);
591			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
592		}
593		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
594	}
595
596	if (sc->status_map != NULL) {
597		if (sc->status_list != NULL) {
598			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
599			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
600			    IPW_RBD_SZ);
601			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
602		}
603		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
604	}
605
606	if (sc->cmd_map != NULL)
607		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
608
609	for (i = 0; i < IPW_NDATA; i++)
610		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
611
612	for (i = 0; i < IPW_NDATA; i++)
613		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
614
615	for (i = 0; i < IPW_NRBD; i++) {
616		sbuf = &sc->rx_sbuf_list[i];
617		if (sbuf->map != NULL) {
618			if (sbuf->m != NULL) {
619				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
620				m_freem(sbuf->m);
621			}
622			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
623		}
624	}
625}
626
627int
628ipw_media_change(struct ifnet *ifp)
629{
630	int error;
631
632	error = ieee80211_media_change(ifp);
633	if (error != ENETRESET)
634		return error;
635
636	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
637		ipw_init(ifp);
638
639	return 0;
640}
641
642void
643ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
644{
645#define N(a)	(sizeof (a) / sizeof (a[0]))
646	struct ipw_softc *sc = ifp->if_softc;
647	struct ieee80211com *ic = &sc->sc_ic;
648	static const struct {
649		uint32_t	val;
650		int		rate;
651	} rates[] = {
652		{ IPW_RATE_DS1,   2 },
653		{ IPW_RATE_DS2,   4 },
654		{ IPW_RATE_DS5,  11 },
655		{ IPW_RATE_DS11, 22 },
656	};
657	uint32_t val;
658	int rate, i;
659
660	imr->ifm_status = IFM_AVALID;
661	imr->ifm_active = IFM_IEEE80211;
662	if (ic->ic_state == IEEE80211_S_RUN)
663		imr->ifm_status |= IFM_ACTIVE;
664
665	/* read current transmission rate from adapter */
666	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
667	val &= 0xf;
668
669	/* convert rate to 802.11 rate */
670	for (i = 0; i < N(rates) && rates[i].val != val; i++);
671	rate = (i < N(rates)) ? rates[i].rate : 0;
672
673	imr->ifm_active |= IFM_IEEE80211_11B;
674	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
675	switch (ic->ic_opmode) {
676	case IEEE80211_M_STA:
677		break;
678
679	case IEEE80211_M_IBSS:
680		imr->ifm_active |= IFM_IEEE80211_IBSS;
681		break;
682
683	case IEEE80211_M_MONITOR:
684		imr->ifm_active |= IFM_IEEE80211_MONITOR;
685		break;
686
687	case IEEE80211_M_AHDEMO:
688	case IEEE80211_M_HOSTAP:
689		/* should not get there */
690		break;
691	}
692#undef N
693}
694
695int
696ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
697{
698	struct ipw_softc *sc = ic->ic_softc;
699	struct ieee80211_node *ni;
700	uint8_t macaddr[IEEE80211_ADDR_LEN];
701	uint32_t len;
702
703	switch (nstate) {
704	case IEEE80211_S_RUN:
705		DELAY(100);	/* firmware needs a short delay here */
706
707		len = IEEE80211_ADDR_LEN;
708		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, macaddr, &len);
709
710		ni = ieee80211_find_node(ic, macaddr);
711		if (ni == NULL)
712			break;
713
714		(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
715		ieee80211_node_newstate(ni, IEEE80211_STA_BSS);
716		break;
717
718	case IEEE80211_S_INIT:
719	case IEEE80211_S_SCAN:
720	case IEEE80211_S_AUTH:
721	case IEEE80211_S_ASSOC:
722		break;
723	}
724
725	ic->ic_state = nstate;
726	return 0;
727}
728
729/*
730 * Read 16 bits at address 'addr' from the Microwire EEPROM.
731 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
732 */
733uint16_t
734ipw_read_prom_word(struct ipw_softc *sc, uint8_t addr)
735{
736	uint32_t tmp;
737	uint16_t val;
738	int n;
739
740	/* clock C once before the first command */
741	IPW_EEPROM_CTL(sc, 0);
742	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
743	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
744	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
745
746	/* write start bit (1) */
747	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
748	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
749
750	/* write READ opcode (10) */
751	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
752	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
753	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
754	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
755
756	/* write address A7-A0 */
757	for (n = 7; n >= 0; n--) {
758		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
759		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
760		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
761		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
762	}
763
764	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
765
766	/* read data Q15-Q0 */
767	val = 0;
768	for (n = 15; n >= 0; n--) {
769		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
770		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
771		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
772		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
773	}
774
775	IPW_EEPROM_CTL(sc, 0);
776
777	/* clear Chip Select and clock C */
778	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
779	IPW_EEPROM_CTL(sc, 0);
780	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
781
782	return val;
783}
784
785void
786ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
787{
788	struct ipw_cmd *cmd;
789
790	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
791	    BUS_DMASYNC_POSTREAD);
792
793	cmd = mtod(sbuf->m, struct ipw_cmd *);
794
795	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
796	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
797	    letoh32(cmd->len), letoh32(cmd->status)));
798
799	wakeup(sc);
800}
801
802void
803ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
804{
805	struct ieee80211com *ic = &sc->sc_ic;
806	struct ifnet *ifp = &ic->ic_if;
807	uint32_t state;
808
809	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
810	    BUS_DMASYNC_POSTREAD);
811
812	state = letoh32(*mtod(sbuf->m, uint32_t *));
813
814	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
815
816	switch (state) {
817	case IPW_STATE_ASSOCIATED:
818		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
819		break;
820
821	case IPW_STATE_SCANNING:
822		/* don't leave run state on background scan */
823		if (ic->ic_state != IEEE80211_S_RUN)
824			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
825
826		ic->ic_flags |= IEEE80211_F_ASCAN;
827		break;
828
829	case IPW_STATE_SCAN_COMPLETE:
830		ic->ic_flags &= ~IEEE80211_F_ASCAN;
831		break;
832
833	case IPW_STATE_ASSOCIATION_LOST:
834		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
835		break;
836
837	case IPW_STATE_RADIO_DISABLED:
838		ifp->if_flags &= ~IFF_UP;
839		ipw_stop(&ic->ic_if, 1);
840		break;
841	}
842}
843
844void
845ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
846    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
847{
848	struct ieee80211com *ic = &sc->sc_ic;
849	struct ifnet *ifp = &ic->ic_if;
850	struct mbuf *mnew, *m;
851	struct ieee80211_frame *wh;
852	struct ieee80211_node *ni;
853	int error;
854
855	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
856
857	/*
858	 * Try to allocate a new mbuf for this ring element and load it before
859	 * processing the current mbuf.  If the ring element cannot be loaded,
860	 * drop the received packet and reuse the old mbuf.  In the unlikely
861	 * case that the old mbuf can't be reloaded either, explicitly panic.
862	 */
863	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
864	if (mnew == NULL) {
865		ifp->if_ierrors++;
866		return;
867	}
868
869	MCLGET(mnew, M_DONTWAIT);
870	if (!(mnew->m_flags & M_EXT)) {
871		m_freem(mnew);
872		ifp->if_ierrors++;
873		return;
874	}
875
876	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
877	    BUS_DMASYNC_POSTREAD);
878	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
879
880	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(mnew, void *),
881	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
882	if (error != 0) {
883		m_freem(mnew);
884
885		/* try to reload the old mbuf */
886		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
887		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
888		if (error != 0) {
889			/* very unlikely that it will fail... */
890			panic("%s: could not load old rx mbuf",
891			    sc->sc_dev.dv_xname);
892		}
893		ifp->if_ierrors++;
894		return;
895	}
896
897	m = sbuf->m;
898	sbuf->m = mnew;
899	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
900
901	/* finalize mbuf */
902	m->m_pkthdr.rcvif = ifp;
903	m->m_pkthdr.len = m->m_len = letoh32(status->len);
904
905#if NBPFILTER > 0
906	if (sc->sc_drvbpf != NULL) {
907		struct mbuf mb;
908		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
909
910		tap->wr_flags = 0;
911		tap->wr_antsignal = status->rssi;
912		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
913		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
914
915		M_DUP_PKTHDR(&mb, m);
916		mb.m_data = (caddr_t)tap;
917		mb.m_len = sc->sc_rxtap_len;
918		mb.m_next = m;
919		mb.m_pkthdr.len += mb.m_len;
920		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
921	}
922#endif
923
924	wh = mtod(m, struct ieee80211_frame *);
925
926	ni = ieee80211_find_rxnode(ic, wh);
927
928	/* send the frame to the upper layer */
929	ieee80211_input(ifp, m, ni, status->rssi, 0);
930
931	ieee80211_release_node(ic, ni);
932}
933
934void
935ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
936{
937	DPRINTFN(2, ("RX!NOTIFICATION\n"));
938}
939
940void
941ipw_rx_intr(struct ipw_softc *sc)
942{
943	struct ipw_status *status;
944	struct ipw_soft_bd *sbd;
945	struct ipw_soft_buf *sbuf;
946	uint32_t r, i;
947
948	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
949
950	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
951
952		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
953		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
954		    BUS_DMASYNC_POSTREAD);
955
956		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
957		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
958		    BUS_DMASYNC_POSTREAD);
959
960		status = &sc->status_list[i];
961		sbd = &sc->srbd_list[i];
962		sbuf = sbd->priv;
963
964		switch (letoh16(status->code) & 0xf) {
965		case IPW_STATUS_CODE_COMMAND:
966			ipw_command_intr(sc, sbuf);
967			break;
968
969		case IPW_STATUS_CODE_NEWSTATE:
970			ipw_newstate_intr(sc, sbuf);
971			break;
972
973		case IPW_STATUS_CODE_DATA_802_3:
974		case IPW_STATUS_CODE_DATA_802_11:
975			ipw_data_intr(sc, status, sbd, sbuf);
976			break;
977
978		case IPW_STATUS_CODE_NOTIFICATION:
979			ipw_notification_intr(sc, sbuf);
980			break;
981
982		default:
983			printf("%s: unknown status code %u\n",
984			    sc->sc_dev.dv_xname, letoh16(status->code));
985		}
986		sbd->bd->flags = 0;
987
988		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
989		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
990		    BUS_DMASYNC_PREWRITE);
991	}
992
993	/* tell the firmware what we have processed */
994	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
995	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
996}
997
998void
999ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1000{
1001	struct ieee80211com *ic = &sc->sc_ic;
1002	struct ipw_soft_hdr *shdr;
1003	struct ipw_soft_buf *sbuf;
1004
1005	switch (sbd->type) {
1006	case IPW_SBD_TYPE_COMMAND:
1007		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
1008		break;
1009
1010	case IPW_SBD_TYPE_HEADER:
1011		shdr = sbd->priv;
1012		bus_dmamap_unload(sc->sc_dmat, shdr->map);
1013		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1014		break;
1015
1016	case IPW_SBD_TYPE_DATA:
1017		sbuf = sbd->priv;
1018		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1019		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1020
1021		m_freem(sbuf->m);
1022
1023		if (sbuf->ni != NULL)
1024			ieee80211_release_node(ic, sbuf->ni);
1025
1026		/* kill watchdog timer */
1027		sc->sc_tx_timer = 0;
1028		break;
1029	}
1030	sbd->type = IPW_SBD_TYPE_NOASSOC;
1031}
1032
1033void
1034ipw_tx_intr(struct ipw_softc *sc)
1035{
1036	struct ifnet *ifp = &sc->sc_ic.ic_if;
1037	struct ipw_soft_bd *sbd;
1038	uint32_t r, i;
1039
1040	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1041
1042	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1043		sbd = &sc->stbd_list[i];
1044
1045		if (sbd->type == IPW_SBD_TYPE_DATA)
1046			ifp->if_opackets++;
1047
1048		ipw_release_sbd(sc, sbd);
1049		sc->txfree++;
1050	}
1051
1052	/* remember what the firmware has processed */
1053	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1054
1055	/* call start() since some buffer descriptors have been released */
1056	ifp->if_flags &= ~IFF_OACTIVE;
1057	(*ifp->if_start)(ifp);
1058}
1059
1060int
1061ipw_intr(void *arg)
1062{
1063	struct ipw_softc *sc = arg;
1064	struct ifnet *ifp = &sc->sc_ic.ic_if;
1065	uint32_t r;
1066
1067	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1068		return 0;
1069
1070	/* disable interrupts */
1071	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1072
1073	DPRINTFN(8, ("INTR!0x%08x\n", r));
1074
1075	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1076		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1077		ifp->if_flags &= ~IFF_UP;
1078		ipw_stop(&sc->sc_ic.ic_if, 1);
1079		return 1;
1080	}
1081
1082	if (r & IPW_INTR_FW_INIT_DONE) {
1083		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
1084			wakeup(sc);
1085	}
1086
1087	if (r & IPW_INTR_RX_TRANSFER)
1088		ipw_rx_intr(sc);
1089
1090	if (r & IPW_INTR_TX_TRANSFER)
1091		ipw_tx_intr(sc);
1092
1093	/* acknowledge interrupts */
1094	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1095
1096	/* re-enable interrupts */
1097	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1098
1099	return 1;
1100}
1101
1102int
1103ipw_cmd(struct ipw_softc *sc, uint32_t type, void *data, uint32_t len)
1104{
1105	struct ipw_soft_bd *sbd;
1106	int error;
1107
1108	sbd = &sc->stbd_list[sc->txcur];
1109
1110	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1111	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1112	if (error != 0) {
1113		printf("%s: could not map command DMA memory\n",
1114		    sc->sc_dev.dv_xname);
1115		return error;
1116	}
1117
1118	sc->cmd.type = htole32(type);
1119	sc->cmd.subtype = htole32(0);
1120	sc->cmd.len = htole32(len);
1121	sc->cmd.seq = htole32(0);
1122	if (data != NULL)
1123		bcopy(data, sc->cmd.data, len);
1124
1125	sbd->type = IPW_SBD_TYPE_COMMAND;
1126	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1127	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1128	sbd->bd->nfrag = 1;
1129	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1130			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
1131
1132	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1133	    BUS_DMASYNC_PREWRITE);
1134
1135	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1136	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1137	    BUS_DMASYNC_PREWRITE);
1138
1139	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1140	sc->txfree--;
1141	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1142
1143	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1144
1145	/* wait at most one second for command to complete */
1146	return tsleep(sc, 0, "ipwcmd", hz);
1147}
1148
1149int
1150ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1151{
1152	struct ipw_softc *sc = ifp->if_softc;
1153	struct ieee80211com *ic = &sc->sc_ic;
1154	struct ieee80211_frame *wh;
1155	struct ipw_soft_bd *sbd;
1156	struct ipw_soft_hdr *shdr;
1157	struct ipw_soft_buf *sbuf;
1158	struct mbuf *mnew;
1159	int error, i;
1160
1161	if (ic->ic_flags & IEEE80211_F_WEPON) {
1162		m = ieee80211_wep_crypt(ifp, m, 1);
1163		if (m == NULL)
1164			return ENOBUFS;
1165	}
1166
1167#if NBPFILTER > 0
1168	if (sc->sc_drvbpf != NULL) {
1169		struct mbuf mb;
1170		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1171
1172		tap->wt_flags = 0;
1173		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1174		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1175
1176		M_DUP_PKTHDR(&mb, m);
1177		mb.m_data = (caddr_t)tap;
1178		mb.m_len = sc->sc_txtap_len;
1179		mb.m_next = m;
1180		mb.m_pkthdr.len += mb.m_len;
1181		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1182	}
1183#endif
1184
1185	wh = mtod(m, struct ieee80211_frame *);
1186
1187	shdr = SLIST_FIRST(&sc->free_shdr);
1188	sbuf = SLIST_FIRST(&sc->free_sbuf);
1189
1190	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1191	shdr->hdr.subtype = htole32(0);
1192	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1193	shdr->hdr.encrypt = 0;
1194	shdr->hdr.keyidx = 0;
1195	shdr->hdr.keysz = 0;
1196	shdr->hdr.fragmentsz = htole16(0);
1197	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1198	if (ic->ic_opmode == IEEE80211_M_STA)
1199		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1200	else
1201		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1202
1203	/* trim IEEE802.11 header */
1204	m_adj(m, sizeof (struct ieee80211_frame));
1205
1206	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1207	if (error != 0 && error != EFBIG) {
1208		printf("%s: could not map mbuf (error %d)\n",
1209		    sc->sc_dev.dv_xname, error);
1210		m_freem(m);
1211		return error;
1212	}
1213	if (error != 0) {
1214		/* too many fragments, linearize */
1215
1216		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1217		if (mnew == NULL) {
1218			m_freem(m);
1219			return ENOMEM;
1220		}
1221
1222		M_DUP_PKTHDR(mnew, m);
1223		if (m->m_pkthdr.len > MHLEN) {
1224			MCLGET(mnew, M_DONTWAIT);
1225			if (!(mnew->m_flags & M_EXT)) {
1226				m_freem(m);
1227				m_freem(mnew);
1228				return ENOMEM;
1229			}
1230		}
1231
1232		m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew, caddr_t));
1233		m_freem(m);
1234		mnew->m_len = mnew->m_pkthdr.len;
1235		m = mnew;
1236
1237		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1238		    BUS_DMA_NOWAIT);
1239		if (error != 0) {
1240			printf("%s: could not map mbuf (error %d)\n",
1241			    sc->sc_dev.dv_xname, error);
1242			m_freem(m);
1243			return error;
1244		}
1245	}
1246
1247	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1248	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1249	if (error != 0) {
1250		printf("%s: could not map header DMA memory (error %d)\n",
1251		    sc->sc_dev.dv_xname, error);
1252		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1253		m_freem(m);
1254		return error;
1255	}
1256
1257	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1258	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1259
1260	sbd = &sc->stbd_list[sc->txcur];
1261	sbd->type = IPW_SBD_TYPE_HEADER;
1262	sbd->priv = shdr;
1263	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1264	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1265	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1266	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1267			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1268
1269	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1270	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1271	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1272	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1273
1274	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1275	    sc->txcur * sizeof (struct ipw_bd),
1276	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1277
1278	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1279	sc->txfree--;
1280
1281	sbuf->m = m;
1282	sbuf->ni = ni;
1283
1284	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1285		sbd = &sc->stbd_list[sc->txcur];
1286		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1287		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1288		sbd->bd->nfrag = 0;	/* used only in first bd */
1289		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1290		if (i == sbuf->map->dm_nsegs - 1) {
1291			sbd->type = IPW_SBD_TYPE_DATA;
1292			sbd->priv = sbuf;
1293			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1294		} else {
1295			sbd->type = IPW_SBD_TYPE_NOASSOC;
1296			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1297		}
1298
1299		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1300		    sbuf->map->dm_segs[i].ds_len));
1301
1302		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1303		    sc->txcur * sizeof (struct ipw_bd),
1304		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1305
1306		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1307		sc->txfree--;
1308	}
1309
1310	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1311	    BUS_DMASYNC_PREWRITE);
1312
1313	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
1314	    BUS_DMASYNC_PREWRITE);
1315
1316	/* inform firmware about this new packet */
1317	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1318
1319	return 0;
1320}
1321
1322void
1323ipw_start(struct ifnet *ifp)
1324{
1325	struct ipw_softc *sc = ifp->if_softc;
1326	struct ieee80211com *ic = &sc->sc_ic;
1327	struct mbuf *m;
1328	struct ieee80211_node *ni;
1329
1330	if (ic->ic_state != IEEE80211_S_RUN)
1331		return;
1332
1333	for (;;) {
1334		IF_DEQUEUE(&ifp->if_snd, m);
1335		if (m == NULL)
1336			break;
1337
1338		if (sc->txfree < 1 + IPW_MAX_NSEG) {
1339			IF_PREPEND(&ifp->if_snd, m);
1340			ifp->if_flags |= IFF_OACTIVE;
1341			break;
1342		}
1343
1344#if NBPFILTER > 0
1345		if (ifp->if_bpf != NULL)
1346			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1347#endif
1348
1349		m = ieee80211_encap(ifp, m, &ni);
1350		if (m == NULL)
1351			continue;
1352
1353#if NBPFILTER > 0
1354		if (ic->ic_rawbpf != NULL)
1355			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1356#endif
1357
1358		if (ipw_tx_start(ifp, m, ni) != 0) {
1359			if (ni != NULL)
1360				ieee80211_release_node(ic, ni);
1361			ifp->if_oerrors++;
1362			break;
1363		}
1364
1365		/* start watchdog timer */
1366		sc->sc_tx_timer = 5;
1367		ifp->if_timer = 1;
1368	}
1369}
1370
1371void
1372ipw_watchdog(struct ifnet *ifp)
1373{
1374	struct ipw_softc *sc = ifp->if_softc;
1375
1376	ifp->if_timer = 0;
1377
1378	if (sc->sc_tx_timer > 0) {
1379		if (--sc->sc_tx_timer == 0) {
1380			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1381			ifp->if_flags &= ~IFF_UP;
1382			ipw_stop(ifp, 1);
1383			ifp->if_oerrors++;
1384			return;
1385		}
1386		ifp->if_timer = 1;
1387	}
1388
1389	ieee80211_watchdog(ifp);
1390}
1391
1392int
1393ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1394{
1395	struct ipw_softc *sc = ifp->if_softc;
1396	struct ieee80211com *ic = &sc->sc_ic;
1397	struct ifaddr *ifa;
1398	struct ifreq *ifr;
1399	int s, error = 0;
1400
1401	s = splnet();
1402
1403	switch (cmd) {
1404	case SIOCSIFADDR:
1405		ifa = (struct ifaddr *)data;
1406		ifp->if_flags |= IFF_UP;
1407#ifdef INET
1408		if (ifa->ifa_addr->sa_family == AF_INET)
1409			arp_ifinit(&ic->ic_ac, ifa);
1410#endif
1411		/* FALLTHROUGH */
1412	case SIOCSIFFLAGS:
1413		if (ifp->if_flags & IFF_UP) {
1414			if (!(ifp->if_flags & IFF_RUNNING))
1415				ipw_init(ifp);
1416		} else {
1417			if (ifp->if_flags & IFF_RUNNING)
1418				ipw_stop(ifp, 1);
1419		}
1420		break;
1421
1422	case SIOCADDMULTI:
1423	case SIOCDELMULTI:
1424		ifr = (struct ifreq *)data;
1425		error = (cmd == SIOCADDMULTI) ?
1426		    ether_addmulti(ifr, &ic->ic_ac) :
1427		    ether_delmulti(ifr, &ic->ic_ac);
1428
1429		if (error == ENETRESET)
1430			error = 0;
1431		break;
1432
1433	case SIOCG80211TXPOWER:
1434		/*
1435		 * If the hardware radio transmitter switch is off, report a
1436		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1437		 * transmitter is killed.
1438		 */
1439		((struct ieee80211_txpower *)data)->i_val =
1440		    (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ?
1441		    IEEE80211_TXPOWER_MIN : sc->sc_ic.ic_txpower;
1442		break;
1443
1444	case SIOCG80211AUTH:
1445		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1446		break;
1447
1448	case SIOCS80211AUTH:
1449		/* only super-user can do that! */
1450		if ((error = suser(curproc, 0)) != 0)
1451			break;
1452
1453		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1454		break;
1455
1456	default:
1457		error = ieee80211_ioctl(ifp, cmd, data);
1458	}
1459
1460	if (error == ENETRESET) {
1461		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1462		    (IFF_UP | IFF_RUNNING))
1463			ipw_init(ifp);
1464		error = 0;
1465	}
1466
1467	splx(s);
1468	return error;
1469}
1470
1471uint32_t
1472ipw_read_table1(struct ipw_softc *sc, uint32_t off)
1473{
1474	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1475}
1476
1477void
1478ipw_write_table1(struct ipw_softc *sc, uint32_t off, uint32_t info)
1479{
1480	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1481}
1482
1483int
1484ipw_read_table2(struct ipw_softc *sc, uint32_t off, void *buf, uint32_t *len)
1485{
1486	uint32_t addr, info;
1487	uint16_t count, size;
1488	uint32_t total;
1489
1490	/* addr[4] + count[2] + size[2] */
1491	addr = MEM_READ_4(sc, sc->table2_base + off);
1492	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1493
1494	count = info >> 16;
1495	size = info & 0xffff;
1496	total = count * size;
1497
1498	if (total > *len) {
1499		*len = total;
1500		return EINVAL;
1501	}
1502
1503	*len = total;
1504	ipw_read_mem_1(sc, addr, buf, total);
1505
1506	return 0;
1507}
1508
1509void
1510ipw_stop_master(struct ipw_softc *sc)
1511{
1512	int ntries;
1513
1514	/* disable interrupts */
1515	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1516
1517	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1518	for (ntries = 0; ntries < 50; ntries++) {
1519		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1520			break;
1521		DELAY(10);
1522	}
1523	if (ntries == 50)
1524		printf("%s: timeout waiting for master\n",
1525		    sc->sc_dev.dv_xname);
1526
1527	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1528	    IPW_RST_PRINCETON_RESET);
1529
1530	sc->flags &= ~IPW_FLAG_FW_INITED;
1531}
1532
1533int
1534ipw_reset(struct ipw_softc *sc)
1535{
1536	int ntries;
1537
1538	ipw_stop_master(sc);
1539
1540	/* move adapter to D0 state */
1541	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1542	    IPW_CTL_INIT);
1543
1544	/* wait for clock stabilization */
1545	for (ntries = 0; ntries < 1000; ntries++) {
1546		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1547			break;
1548		DELAY(200);
1549	}
1550	if (ntries == 1000)
1551		return EIO;
1552
1553	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1554	    IPW_RST_SW_RESET);
1555
1556	DELAY(10);
1557
1558	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1559	    IPW_CTL_INIT);
1560
1561	return 0;
1562}
1563
1564int
1565ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1566{
1567	int ntries;
1568
1569	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1570	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1571
1572	MEM_WRITE_2(sc, 0x220000, 0x0703);
1573	MEM_WRITE_2(sc, 0x220000, 0x0707);
1574
1575	MEM_WRITE_1(sc, 0x210014, 0x72);
1576	MEM_WRITE_1(sc, 0x210014, 0x72);
1577
1578	MEM_WRITE_1(sc, 0x210000, 0x40);
1579	MEM_WRITE_1(sc, 0x210000, 0x00);
1580	MEM_WRITE_1(sc, 0x210000, 0x40);
1581
1582	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1583
1584	MEM_WRITE_1(sc, 0x210000, 0x00);
1585	MEM_WRITE_1(sc, 0x210000, 0x00);
1586	MEM_WRITE_1(sc, 0x210000, 0x80);
1587
1588	MEM_WRITE_2(sc, 0x220000, 0x0703);
1589	MEM_WRITE_2(sc, 0x220000, 0x0707);
1590
1591	MEM_WRITE_1(sc, 0x210014, 0x72);
1592	MEM_WRITE_1(sc, 0x210014, 0x72);
1593
1594	MEM_WRITE_1(sc, 0x210000, 0x00);
1595	MEM_WRITE_1(sc, 0x210000, 0x80);
1596
1597	for (ntries = 0; ntries < 100; ntries++) {
1598		if (MEM_READ_1(sc, 0x210000) & 1)
1599			break;
1600		DELAY(1000);
1601	}
1602	if (ntries == 100) {
1603		printf("%s: timeout waiting for ucode to initialize\n",
1604		    sc->sc_dev.dv_xname);
1605		return EIO;
1606	}
1607
1608	MEM_WRITE_4(sc, 0x3000e0, 0);
1609
1610	return 0;
1611}
1612
1613/* set of macros to handle unaligned little endian data in firmware image */
1614#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1615#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1616int
1617ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1618{
1619	u_char *p, *end;
1620	uint32_t dst;
1621	uint16_t len;
1622	int error;
1623
1624	p = fw;
1625	end = fw + size;
1626	while (p < end) {
1627		if (p + 6 > end)
1628			return EINVAL;
1629
1630		dst = GETLE32(p); p += 4;
1631		len = GETLE16(p); p += 2;
1632
1633		if (p + len > end)
1634			return EINVAL;
1635
1636		ipw_write_mem_1(sc, dst, p, len);
1637		p += len;
1638	}
1639
1640	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1641	    IPW_IO_LED_OFF);
1642
1643	/* allow interrupts so we know when the firmware is inited */
1644	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1645
1646	/* tell the adapter to initialize the firmware */
1647	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1648	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1649	    IPW_CTL_ALLOW_STANDBY);
1650
1651	/* wait at most one second for firmware initialization to complete */
1652	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1653		printf("%s: timeout waiting for firmware initialization to "
1654		    "complete\n", sc->sc_dev.dv_xname);
1655		return error;
1656	}
1657
1658	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1659	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1660
1661	return 0;
1662}
1663
1664int
1665ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1666{
1667	struct ipw_firmware_hdr *hdr;
1668	const char *name;
1669	u_char *p;
1670	size_t size;
1671	int error;
1672
1673	switch (sc->sc_ic.ic_opmode) {
1674	case IEEE80211_M_STA:
1675	case IEEE80211_M_HOSTAP:
1676		name = "ipw-bss";
1677		break;
1678
1679	case IEEE80211_M_IBSS:
1680	case IEEE80211_M_AHDEMO:
1681		name = "ipw-ibss";
1682		break;
1683
1684	case IEEE80211_M_MONITOR:
1685		name = "ipw-monitor";
1686		break;
1687	}
1688
1689	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1690		return error;
1691
1692	if (size < sizeof (struct ipw_firmware_hdr)) {
1693		error = EINVAL;
1694		goto fail;
1695	}
1696
1697	p = fw->data;
1698	hdr = (struct ipw_firmware_hdr *)p;
1699	fw->main_size = letoh32(hdr->main_size);
1700	fw->ucode_size = letoh32(hdr->ucode_size);
1701
1702	p += sizeof (struct ipw_firmware_hdr);
1703	size -= sizeof (struct ipw_firmware_hdr);
1704
1705	if (size < fw->main_size + fw->ucode_size) {
1706		error = EINVAL;
1707		goto fail;
1708	}
1709
1710	fw->main = p;
1711	fw->ucode = p + fw->main_size;
1712
1713	return 0;
1714
1715fail:	free(fw->data, M_DEVBUF);
1716	return error;
1717}
1718
1719int
1720ipw_config(struct ipw_softc *sc)
1721{
1722	struct ieee80211com *ic = &sc->sc_ic;
1723	struct ifnet *ifp = &ic->ic_if;
1724	struct ipw_security security;
1725	struct ieee80211_wepkey *k;
1726	struct ipw_wep_key wepkey;
1727	struct ipw_scan_options options;
1728	struct ipw_configuration config;
1729	uint32_t data;
1730	int error, i;
1731
1732	switch (ic->ic_opmode) {
1733	case IEEE80211_M_STA:
1734	case IEEE80211_M_HOSTAP:
1735		data = htole32(IPW_MODE_BSS);
1736		break;
1737
1738	case IEEE80211_M_IBSS:
1739	case IEEE80211_M_AHDEMO:
1740		data = htole32(IPW_MODE_IBSS);
1741		break;
1742
1743	case IEEE80211_M_MONITOR:
1744		data = htole32(IPW_MODE_MONITOR);
1745		break;
1746	}
1747	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1748	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1749	if (error != 0)
1750		return error;
1751
1752	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1753	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1754		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1755		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1756		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1757		if (error != 0)
1758			return error;
1759	}
1760
1761	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1762		DPRINTF(("Enabling adapter\n"));
1763		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1764	}
1765
1766	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1767	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1768	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1769	    IEEE80211_ADDR_LEN);
1770	if (error != 0)
1771		return error;
1772
1773	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1774	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1775	if (ic->ic_opmode == IEEE80211_M_IBSS)
1776		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1777	if (ifp->if_flags & IFF_PROMISC)
1778		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1779	config.bss_chan = htole32(0x3fff);	/* channels 1-14 */
1780	config.ibss_chan = htole32(0x7ff);	/* channels 1-11 */
1781	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1782	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1783	if (error != 0)
1784		return error;
1785
1786	data = htole32(0x3);	/* 1, 2 */
1787	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1788	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1789	if (error != 0)
1790		return error;
1791
1792	data = htole32(0xf);	/* 1, 2, 5.5, 11 */
1793	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1794	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1795	if (error != 0)
1796		return error;
1797
1798	data = htole32(IPW_POWER_MODE_CAM);
1799	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1800	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1801	if (error != 0)
1802		return error;
1803
1804	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1805		data = htole32(32);	/* default value */
1806		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1807		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1808		    sizeof data);
1809		if (error != 0)
1810			return error;
1811	}
1812
1813	data = htole32(ic->ic_rtsthreshold);
1814	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1815	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1816	if (error != 0)
1817		return error;
1818
1819	data = htole32(ic->ic_fragthreshold);
1820	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1821	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1822	if (error != 0)
1823		return error;
1824
1825#ifdef IPW_DEBUG
1826	if (ipw_debug > 0) {
1827		printf("Setting ESSID to ");
1828		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1829		printf("\n");
1830	}
1831#endif
1832	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1833	    ic->ic_des_esslen);
1834	if (error != 0)
1835		return error;
1836
1837	/* no mandatory BSSID */
1838	DPRINTF(("Setting mandatory BSSID to null\n"));
1839	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1840	if (error != 0)
1841		return error;
1842
1843	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1844		DPRINTF(("Setting adapter BSSID to %s\n",
1845		    ether_sprintf(ic->ic_des_bssid)));
1846		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1847		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1848		if (error != 0)
1849			return error;
1850	}
1851
1852	bzero(&security, sizeof security);
1853	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1854	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1855	security.ciphers = htole32(IPW_CIPHER_NONE);
1856	DPRINTF(("Setting authmode to %u\n", security.authmode));
1857	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1858	    sizeof security);
1859	if (error != 0)
1860		return error;
1861
1862	if (ic->ic_flags & IEEE80211_F_WEPON) {
1863		k = ic->ic_nw_keys;
1864		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1865			if (k->wk_len == 0)
1866				continue;
1867
1868			wepkey.idx = i;
1869			wepkey.len = k->wk_len;
1870			bzero(wepkey.key, sizeof wepkey.key);
1871			bcopy(k->wk_key, wepkey.key, k->wk_len);
1872			DPRINTF(("Setting wep key index %u len %u\n",
1873			    wepkey.idx, wepkey.len));
1874			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1875			    sizeof wepkey);
1876			if (error != 0)
1877				return error;
1878		}
1879
1880		data = htole32(ic->ic_wep_txkey);
1881		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1882		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1883		    sizeof data);
1884		if (error != 0)
1885			return error;
1886	}
1887
1888	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1889	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1890	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1891	if (error != 0)
1892		return error;
1893
1894	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1895	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1896		data = htole32(ic->ic_lintval);
1897		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1898		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1899		    sizeof data);
1900		if (error != 0)
1901			return error;
1902	}
1903
1904	options.flags = htole32(0);
1905	options.channels = htole32(0x3fff);	/* scan channels 1-14 */
1906	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1907	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1908	if (error != 0)
1909		return error;
1910
1911	/* finally, enable adapter (start scanning for an access point) */
1912	DPRINTF(("Enabling adapter\n"));
1913	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1914}
1915
1916int
1917ipw_init(struct ifnet *ifp)
1918{
1919	struct ipw_softc *sc = ifp->if_softc;
1920	struct ipw_firmware fw;
1921	int error;
1922
1923	ipw_stop(ifp, 0);
1924
1925	if ((error = ipw_reset(sc)) != 0) {
1926		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1927		goto fail1;
1928	}
1929
1930	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1931		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1932		goto fail1;
1933	}
1934
1935	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1936		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1937		goto fail2;
1938	}
1939
1940	ipw_stop_master(sc);
1941
1942	/*
1943	 * Setup tx, rx and status rings.
1944	 */
1945	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1946	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1947	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1948	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1949	sc->txold = IPW_NTBD - 1;	/* latest bd index ack by firmware */
1950	sc->txcur = 0; /* bd index to write to */
1951	sc->txfree = IPW_NTBD - 2;
1952
1953	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1954	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1955	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1956	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1957	sc->rxcur = IPW_NRBD - 1;	/* latest bd index I've read */
1958
1959	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1960	    sc->status_map->dm_segs[0].ds_addr);
1961
1962	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1963		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1964		goto fail2;
1965	}
1966
1967	sc->flags |= IPW_FLAG_FW_INITED;
1968
1969	/* retrieve information tables base addresses */
1970	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1971	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1972
1973	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1974
1975	if ((error = ipw_config(sc)) != 0) {
1976		printf("%s: device configuration failed\n",
1977		    sc->sc_dev.dv_xname);
1978		goto fail2;
1979	}
1980
1981	ifp->if_flags &= ~IFF_OACTIVE;
1982	ifp->if_flags |= IFF_RUNNING;
1983
1984	return 0;
1985
1986fail2:	free(fw.data, M_DEVBUF);
1987fail1:	ipw_stop(ifp, 0);
1988
1989	return error;
1990}
1991
1992void
1993ipw_stop(struct ifnet *ifp, int disable)
1994{
1995	struct ipw_softc *sc = ifp->if_softc;
1996	struct ieee80211com *ic = &sc->sc_ic;
1997	int i;
1998
1999	ipw_stop_master(sc);
2000	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2001
2002	ifp->if_timer = 0;
2003	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2004
2005	/*
2006	 * Release tx buffers.
2007	 */
2008	for (i = 0; i < IPW_NTBD; i++)
2009		ipw_release_sbd(sc, &sc->stbd_list[i]);
2010
2011	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2012}
2013
2014void
2015ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2016    bus_size_t count)
2017{
2018	for (; count > 0; offset++, datap++, count--) {
2019		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2020		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2021	}
2022}
2023
2024void
2025ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2026    bus_size_t count)
2027{
2028	for (; count > 0; offset++, datap++, count--) {
2029		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2030		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2031	}
2032}
2033
2034struct cfdriver ipw_cd = {
2035	0, "ipw", DV_IFNET
2036};
2037