if_ipw.c revision 1.60
1/*	$OpenBSD: if_ipw.c,v 1.60 2006/08/19 11:16:55 damien Exp $	*/
2
3/*-
4 * Copyright (c) 2004-2006
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*
31 * Driver for Intel PRO/Wireless 2100 802.11 network adapters.
32 */
33
34#include "bpfilter.h"
35
36#include <sys/param.h>
37#include <sys/sockio.h>
38#include <sys/sysctl.h>
39#include <sys/mbuf.h>
40#include <sys/kernel.h>
41#include <sys/socket.h>
42#include <sys/systm.h>
43#include <sys/malloc.h>
44#include <sys/conf.h>
45#include <sys/device.h>
46
47#include <machine/bus.h>
48#include <machine/endian.h>
49#include <machine/intr.h>
50
51#include <dev/pci/pcireg.h>
52#include <dev/pci/pcivar.h>
53#include <dev/pci/pcidevs.h>
54
55#if NBPFILTER > 0
56#include <net/bpf.h>
57#endif
58#include <net/if.h>
59#include <net/if_arp.h>
60#include <net/if_dl.h>
61#include <net/if_media.h>
62#include <net/if_types.h>
63
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/in_var.h>
67#include <netinet/if_ether.h>
68#include <netinet/ip.h>
69
70#include <net80211/ieee80211_var.h>
71#include <net80211/ieee80211_radiotap.h>
72
73#include <dev/pci/if_ipwreg.h>
74#include <dev/pci/if_ipwvar.h>
75
76static const struct ieee80211_rateset ipw_rateset_11b =
77	{ 4, { 2, 4, 11, 22 } };
78
79int		ipw_match(struct device *, void *, void *);
80void		ipw_attach(struct device *, struct device *, void *);
81int		ipw_detach(struct device *, int);
82void		ipw_power(int, void *);
83int		ipw_dma_alloc(struct ipw_softc *);
84void		ipw_release(struct ipw_softc *);
85int		ipw_media_change(struct ifnet *);
86void		ipw_media_status(struct ifnet *, struct ifmediareq *);
87int		ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
88uint16_t	ipw_read_prom_word(struct ipw_softc *, uint8_t);
89void		ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
90void		ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
91void		ipw_data_intr(struct ipw_softc *, struct ipw_status *,
92		    struct ipw_soft_bd *, struct ipw_soft_buf *);
93void		ipw_notification_intr(struct ipw_softc *,
94		    struct ipw_soft_buf *);
95void		ipw_rx_intr(struct ipw_softc *);
96void		ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
97void		ipw_tx_intr(struct ipw_softc *);
98int		ipw_intr(void *);
99int		ipw_cmd(struct ipw_softc *, uint32_t, void *, uint32_t);
100int		ipw_tx_start(struct ifnet *, struct mbuf *,
101		    struct ieee80211_node *);
102void		ipw_start(struct ifnet *);
103void		ipw_watchdog(struct ifnet *);
104int		ipw_ioctl(struct ifnet *, u_long, caddr_t);
105uint32_t	ipw_read_table1(struct ipw_softc *, uint32_t);
106void		ipw_write_table1(struct ipw_softc *, uint32_t, uint32_t);
107int		ipw_read_table2(struct ipw_softc *, uint32_t, void *,
108		    uint32_t *);
109void		ipw_stop_master(struct ipw_softc *);
110int		ipw_reset(struct ipw_softc *);
111int		ipw_load_ucode(struct ipw_softc *, u_char *, int);
112int		ipw_load_firmware(struct ipw_softc *, u_char *, int);
113int		ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
114int		ipw_config(struct ipw_softc *);
115int		ipw_init(struct ifnet *);
116void		ipw_stop(struct ifnet *, int);
117void		ipw_read_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
118		    bus_size_t);
119void		ipw_write_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
120		    bus_size_t);
121
122static __inline uint8_t
123MEM_READ_1(struct ipw_softc *sc, uint32_t addr)
124{
125	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
126	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
127}
128
129static __inline uint32_t
130MEM_READ_4(struct ipw_softc *sc, uint32_t addr)
131{
132	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
133	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
134}
135
136#ifdef IPW_DEBUG
137#define DPRINTF(x)	do { if (ipw_debug > 0) printf x; } while (0)
138#define DPRINTFN(n, x)	do { if (ipw_debug >= (n)) printf x; } while (0)
139int ipw_debug = 0;
140#else
141#define DPRINTF(x)
142#define DPRINTFN(n, x)
143#endif
144
145struct cfattach ipw_ca = {
146	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
147};
148
149int
150ipw_match(struct device *parent, void *match, void *aux)
151{
152	struct pci_attach_args *pa = aux;
153
154	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
155	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2100)
156		return 1;
157
158	return 0;
159}
160
161/* Base Address Register */
162#define IPW_PCI_BAR0	0x10
163
164void
165ipw_attach(struct device *parent, struct device *self, void *aux)
166{
167	struct ipw_softc *sc = (struct ipw_softc *)self;
168	struct ieee80211com *ic = &sc->sc_ic;
169	struct ifnet *ifp = &ic->ic_if;
170	struct pci_attach_args *pa = aux;
171	const char *intrstr;
172	bus_space_tag_t memt;
173	bus_space_handle_t memh;
174	bus_addr_t base;
175	pci_intr_handle_t ih;
176	pcireg_t data;
177	uint16_t val;
178	int error, i;
179
180	sc->sc_pct = pa->pa_pc;
181	sc->sc_pcitag = pa->pa_tag,
182
183	/* clear device specific PCI configuration register 0x41 */
184	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
185	data &= ~0x0000ff00;
186	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
187
188	/* map the register window */
189	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
190	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
191	if (error != 0) {
192		printf(": could not map memory space\n");
193		return;
194	}
195
196	sc->sc_st = memt;
197	sc->sc_sh = memh;
198	sc->sc_dmat = pa->pa_dmat;
199
200	/* disable interrupts */
201	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
202
203	if (pci_intr_map(pa, &ih) != 0) {
204		printf(": could not map interrupt\n");
205		return;
206	}
207
208	intrstr = pci_intr_string(sc->sc_pct, ih);
209	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
210	    sc->sc_dev.dv_xname);
211	if (sc->sc_ih == NULL) {
212		printf(": could not establish interrupt");
213		if (intrstr != NULL)
214			printf(" at %s", intrstr);
215		printf("\n");
216		return;
217	}
218	printf(": %s", intrstr);
219
220	if (ipw_reset(sc) != 0) {
221		printf(": could not reset adapter\n");
222		return;
223	}
224
225	if (ipw_dma_alloc(sc) != 0) {
226		printf(": failed to allocate DMA resources\n");
227		return;
228	}
229
230	ic->ic_phytype = IEEE80211_T_DS;
231	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
232	ic->ic_state = IEEE80211_S_INIT;
233
234	/* set device capabilities */
235	ic->ic_caps =
236	    IEEE80211_C_IBSS |		/* IBSS mode supported */
237	    IEEE80211_C_MONITOR |	/* monitor mode supported */
238	    IEEE80211_C_TXPMGT |	/* tx power management */
239	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
240	    IEEE80211_C_WEP |		/* s/w WEP */
241	    IEEE80211_C_SCANALL;	/* h/w scanning */
242
243	/* read MAC address from EEPROM */
244	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
245	ic->ic_myaddr[0] = val >> 8;
246	ic->ic_myaddr[1] = val & 0xff;
247	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
248	ic->ic_myaddr[2] = val >> 8;
249	ic->ic_myaddr[3] = val & 0xff;
250	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
251	ic->ic_myaddr[4] = val >> 8;
252	ic->ic_myaddr[5] = val & 0xff;
253
254	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
255
256	/* set supported .11b rates */
257	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
258
259	/* set supported .11b channels (1 through 14) */
260	for (i = 1; i <= 14; i++) {
261		ic->ic_channels[i].ic_freq =
262		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
263		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
264	}
265
266	/* default to authmode OPEN */
267	sc->authmode = IEEE80211_AUTH_OPEN;
268
269	/* IBSS channel undefined for now */
270	ic->ic_ibss_chan = &ic->ic_channels[0];
271
272	ifp->if_softc = sc;
273	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
274	ifp->if_init = ipw_init;
275	ifp->if_ioctl = ipw_ioctl;
276	ifp->if_start = ipw_start;
277	ifp->if_watchdog = ipw_watchdog;
278	IFQ_SET_READY(&ifp->if_snd);
279	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
280
281	if_attach(ifp);
282	ieee80211_ifattach(ifp);
283	/* override state transition machine */
284	sc->sc_newstate = ic->ic_newstate;
285	ic->ic_newstate = ipw_newstate;
286	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
287
288	sc->powerhook = powerhook_establish(ipw_power, sc);
289
290#if NBPFILTER > 0
291	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
292	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
293
294	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
295	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
296	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
297
298	sc->sc_txtap_len = sizeof sc->sc_txtapu;
299	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
300	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
301#endif
302}
303
304int
305ipw_detach(struct device *self, int flags)
306{
307	struct ipw_softc *sc = (struct ipw_softc *)self;
308	struct ifnet *ifp = &sc->sc_ic.ic_if;
309
310	ipw_stop(ifp, 1);
311
312	ieee80211_ifdetach(ifp);
313	if_detach(ifp);
314
315	ipw_release(sc);
316
317	if (sc->sc_ih != NULL) {
318		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
319		sc->sc_ih = NULL;
320	}
321
322	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
323
324	return 0;
325}
326
327void
328ipw_power(int why, void *arg)
329{
330	struct ipw_softc *sc = arg;
331	struct ifnet *ifp;
332	pcireg_t data;
333
334	if (why != PWR_RESUME)
335		return;
336
337	/* clear device specific PCI configuration register 0x41 */
338	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
339	data &= ~0x0000ff00;
340	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
341
342	ifp = &sc->sc_ic.ic_if;
343	if (ifp->if_flags & IFF_UP) {
344		ifp->if_init(ifp);
345		if (ifp->if_flags & IFF_RUNNING)
346			ifp->if_start(ifp);
347	}
348}
349
350int
351ipw_dma_alloc(struct ipw_softc *sc)
352{
353	struct ipw_soft_bd *sbd;
354	struct ipw_soft_hdr *shdr;
355	struct ipw_soft_buf *sbuf;
356	int i, nsegs, error;
357
358	/*
359	 * Allocate and map tx ring.
360	 */
361	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
362	    BUS_DMA_NOWAIT, &sc->tbd_map);
363	if (error != 0) {
364		printf("%s: could not create tx ring DMA map\n",
365		    sc->sc_dev.dv_xname);
366		goto fail;
367	}
368
369	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
370	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
371	if (error != 0) {
372		printf("%s: could not allocate tx ring DMA memory\n",
373		    sc->sc_dev.dv_xname);
374		goto fail;
375	}
376
377	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
378	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
379	if (error != 0) {
380		printf("%s: could not map tx ring DMA memory\n",
381		    sc->sc_dev.dv_xname);
382		goto fail;
383	}
384
385	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
386	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
387	if (error != 0) {
388		printf("%s: could not load tx ring DMA map\n",
389		    sc->sc_dev.dv_xname);
390		goto fail;
391	}
392
393	/*
394	 * Allocate and map rx ring.
395	 */
396	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
397	    BUS_DMA_NOWAIT, &sc->rbd_map);
398	if (error != 0) {
399		printf("%s: could not create rx ring DMA map\n",
400		    sc->sc_dev.dv_xname);
401		goto fail;
402	}
403
404	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
405	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
406	if (error != 0) {
407		printf("%s: could not allocate rx ring DMA memory\n",
408		    sc->sc_dev.dv_xname);
409		goto fail;
410	}
411
412	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
413	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
414	if (error != 0) {
415		printf("%s: could not map rx ring DMA memory\n",
416		    sc->sc_dev.dv_xname);
417		goto fail;
418	}
419
420	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
421	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
422	if (error != 0) {
423		printf("%s: could not load tx ring DMA map\n",
424		    sc->sc_dev.dv_xname);
425		goto fail;
426	}
427
428	/*
429	 * Allocate and map status ring.
430	 */
431	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
432	    0, BUS_DMA_NOWAIT, &sc->status_map);
433	if (error != 0) {
434		printf("%s: could not create status ring DMA map\n",
435		    sc->sc_dev.dv_xname);
436		goto fail;
437	}
438
439	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
440	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
441	if (error != 0) {
442		printf("%s: could not allocate status ring DMA memory\n",
443		    sc->sc_dev.dv_xname);
444		goto fail;
445	}
446
447	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
448	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
449	if (error != 0) {
450		printf("%s: could not map status ring DMA memory\n",
451		    sc->sc_dev.dv_xname);
452		goto fail;
453	}
454
455	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
456	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
457	if (error != 0) {
458		printf("%s: could not load status ring DMA map\n",
459		    sc->sc_dev.dv_xname);
460		goto fail;
461	}
462
463	/*
464	 * Allocate command DMA map.
465	 */
466	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
467	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
468	if (error != 0) {
469		printf("%s: could not create command DMA map\n",
470		    sc->sc_dev.dv_xname);
471		goto fail;
472	}
473
474	/*
475	 * Allocate headers DMA maps.
476	 */
477	SLIST_INIT(&sc->free_shdr);
478	for (i = 0; i < IPW_NDATA; i++) {
479		shdr = &sc->shdr_list[i];
480		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
481		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
482		if (error != 0) {
483			printf("%s: could not create header DMA map\n",
484			    sc->sc_dev.dv_xname);
485			goto fail;
486		}
487		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
488	}
489
490	/*
491	 * Allocate tx buffers DMA maps.
492	 */
493	SLIST_INIT(&sc->free_sbuf);
494	for (i = 0; i < IPW_NDATA; i++) {
495		sbuf = &sc->tx_sbuf_list[i];
496		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
497		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
498		if (error != 0) {
499			printf("%s: could not create tx DMA map\n",
500			    sc->sc_dev.dv_xname);
501			goto fail;
502		}
503		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
504	}
505
506	/*
507	 * Initialize tx ring.
508	 */
509	for (i = 0; i < IPW_NTBD; i++) {
510		sbd = &sc->stbd_list[i];
511		sbd->bd = &sc->tbd_list[i];
512		sbd->type = IPW_SBD_TYPE_NOASSOC;
513	}
514
515	/*
516	 * Pre-allocate rx buffers and DMA maps.
517	 */
518	for (i = 0; i < IPW_NRBD; i++) {
519		sbd = &sc->srbd_list[i];
520		sbuf = &sc->rx_sbuf_list[i];
521		sbd->bd = &sc->rbd_list[i];
522
523		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
524		if (sbuf->m == NULL) {
525			printf("%s: could not allocate rx mbuf\n",
526			    sc->sc_dev.dv_xname);
527			error = ENOMEM;
528			goto fail;
529		}
530
531		MCLGET(sbuf->m, M_DONTWAIT);
532		if (!(sbuf->m->m_flags & M_EXT)) {
533			m_freem(sbuf->m);
534			printf("%s: could not allocate rx mbuf cluster\n",
535			    sc->sc_dev.dv_xname);
536			error = ENOMEM;
537			goto fail;
538		}
539
540		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
541		    0, BUS_DMA_NOWAIT, &sbuf->map);
542		if (error != 0) {
543			printf("%s: could not create rx DMA map\n",
544			    sc->sc_dev.dv_xname);
545			goto fail;
546		}
547
548		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
549		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
550		if (error != 0) {
551			printf("%s: could not map rx DMA memory\n",
552			    sc->sc_dev.dv_xname);
553			goto fail;
554		}
555
556		sbd->type = IPW_SBD_TYPE_DATA;
557		sbd->priv = sbuf;
558		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
559		sbd->bd->len = htole32(MCLBYTES);
560	}
561
562	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
563	    BUS_DMASYNC_PREWRITE);
564
565	return 0;
566
567fail:	ipw_release(sc);
568	return error;
569}
570
571void
572ipw_release(struct ipw_softc *sc)
573{
574	struct ipw_soft_buf *sbuf;
575	int i;
576
577	if (sc->tbd_map != NULL) {
578		if (sc->tbd_list != NULL) {
579			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
580			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
581			    IPW_TBD_SZ);
582			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
583		}
584		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
585	}
586
587	if (sc->rbd_map != NULL) {
588		if (sc->rbd_list != NULL) {
589			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
590			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
591			    IPW_RBD_SZ);
592			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
593		}
594		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
595	}
596
597	if (sc->status_map != NULL) {
598		if (sc->status_list != NULL) {
599			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
600			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
601			    IPW_RBD_SZ);
602			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
603		}
604		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
605	}
606
607	if (sc->cmd_map != NULL)
608		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
609
610	for (i = 0; i < IPW_NDATA; i++)
611		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
612
613	for (i = 0; i < IPW_NDATA; i++)
614		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
615
616	for (i = 0; i < IPW_NRBD; i++) {
617		sbuf = &sc->rx_sbuf_list[i];
618		if (sbuf->map != NULL) {
619			if (sbuf->m != NULL) {
620				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
621				m_freem(sbuf->m);
622			}
623			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
624		}
625	}
626}
627
628int
629ipw_media_change(struct ifnet *ifp)
630{
631	int error;
632
633	error = ieee80211_media_change(ifp);
634	if (error != ENETRESET)
635		return error;
636
637	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
638		ipw_init(ifp);
639
640	return 0;
641}
642
643void
644ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
645{
646#define N(a)	(sizeof (a) / sizeof (a[0]))
647	struct ipw_softc *sc = ifp->if_softc;
648	struct ieee80211com *ic = &sc->sc_ic;
649	static const struct {
650		uint32_t	val;
651		int		rate;
652	} rates[] = {
653		{ IPW_RATE_DS1,   2 },
654		{ IPW_RATE_DS2,   4 },
655		{ IPW_RATE_DS5,  11 },
656		{ IPW_RATE_DS11, 22 },
657	};
658	uint32_t val;
659	int rate, i;
660
661	imr->ifm_status = IFM_AVALID;
662	imr->ifm_active = IFM_IEEE80211;
663	if (ic->ic_state == IEEE80211_S_RUN)
664		imr->ifm_status |= IFM_ACTIVE;
665
666	/* read current transmission rate from adapter */
667	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
668	val &= 0xf;
669
670	/* convert rate to 802.11 rate */
671	for (i = 0; i < N(rates) && rates[i].val != val; i++);
672	rate = (i < N(rates)) ? rates[i].rate : 0;
673
674	imr->ifm_active |= IFM_IEEE80211_11B;
675	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
676	switch (ic->ic_opmode) {
677	case IEEE80211_M_STA:
678		break;
679
680	case IEEE80211_M_IBSS:
681		imr->ifm_active |= IFM_IEEE80211_IBSS;
682		break;
683
684	case IEEE80211_M_MONITOR:
685		imr->ifm_active |= IFM_IEEE80211_MONITOR;
686		break;
687
688	case IEEE80211_M_AHDEMO:
689	case IEEE80211_M_HOSTAP:
690		/* should not get there */
691		break;
692	}
693#undef N
694}
695
696int
697ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
698{
699	struct ipw_softc *sc = ic->ic_softc;
700	struct ieee80211_node *ni;
701	uint8_t macaddr[IEEE80211_ADDR_LEN];
702	uint32_t len;
703
704	switch (nstate) {
705	case IEEE80211_S_RUN:
706		DELAY(100);	/* firmware needs a short delay here */
707
708		len = IEEE80211_ADDR_LEN;
709		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, macaddr, &len);
710
711		ni = ieee80211_find_node(ic, macaddr);
712		if (ni == NULL)
713			break;
714
715		(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
716		ieee80211_node_newstate(ni, IEEE80211_STA_BSS);
717		break;
718
719	case IEEE80211_S_INIT:
720	case IEEE80211_S_SCAN:
721	case IEEE80211_S_AUTH:
722	case IEEE80211_S_ASSOC:
723		break;
724	}
725
726	ic->ic_state = nstate;
727	return 0;
728}
729
730/*
731 * Read 16 bits at address 'addr' from the Microwire EEPROM.
732 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
733 */
734uint16_t
735ipw_read_prom_word(struct ipw_softc *sc, uint8_t addr)
736{
737	uint32_t tmp;
738	uint16_t val;
739	int n;
740
741	/* clock C once before the first command */
742	IPW_EEPROM_CTL(sc, 0);
743	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
744	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
745	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
746
747	/* write start bit (1) */
748	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
749	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
750
751	/* write READ opcode (10) */
752	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
753	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
754	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
755	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
756
757	/* write address A7-A0 */
758	for (n = 7; n >= 0; n--) {
759		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
760		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
761		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
762		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
763	}
764
765	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
766
767	/* read data Q15-Q0 */
768	val = 0;
769	for (n = 15; n >= 0; n--) {
770		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
771		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
772		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
773		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
774	}
775
776	IPW_EEPROM_CTL(sc, 0);
777
778	/* clear Chip Select and clock C */
779	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
780	IPW_EEPROM_CTL(sc, 0);
781	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
782
783	return val;
784}
785
786void
787ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
788{
789	struct ipw_cmd *cmd;
790
791	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
792	    BUS_DMASYNC_POSTREAD);
793
794	cmd = mtod(sbuf->m, struct ipw_cmd *);
795
796	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
797	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
798	    letoh32(cmd->len), letoh32(cmd->status)));
799
800	wakeup(sc);
801}
802
803void
804ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
805{
806	struct ieee80211com *ic = &sc->sc_ic;
807	struct ifnet *ifp = &ic->ic_if;
808	uint32_t state;
809
810	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
811	    BUS_DMASYNC_POSTREAD);
812
813	state = letoh32(*mtod(sbuf->m, uint32_t *));
814
815	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
816
817	switch (state) {
818	case IPW_STATE_ASSOCIATED:
819		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
820		break;
821
822	case IPW_STATE_SCANNING:
823		/* don't leave run state on background scan */
824		if (ic->ic_state != IEEE80211_S_RUN)
825			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
826
827		ic->ic_flags |= IEEE80211_F_ASCAN;
828		break;
829
830	case IPW_STATE_SCAN_COMPLETE:
831		ic->ic_flags &= ~IEEE80211_F_ASCAN;
832		break;
833
834	case IPW_STATE_ASSOCIATION_LOST:
835		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
836		break;
837
838	case IPW_STATE_RADIO_DISABLED:
839		ifp->if_flags &= ~IFF_UP;
840		ipw_stop(&ic->ic_if, 1);
841		break;
842	}
843}
844
845void
846ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
847    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
848{
849	struct ieee80211com *ic = &sc->sc_ic;
850	struct ifnet *ifp = &ic->ic_if;
851	struct mbuf *mnew, *m;
852	struct ieee80211_frame *wh;
853	struct ieee80211_node *ni;
854	int error;
855
856	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
857
858	/*
859	 * Try to allocate a new mbuf for this ring element and load it before
860	 * processing the current mbuf.  If the ring element cannot be loaded,
861	 * drop the received packet and reuse the old mbuf.  In the unlikely
862	 * case that the old mbuf can't be reloaded either, explicitly panic.
863	 */
864	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
865	if (mnew == NULL) {
866		ifp->if_ierrors++;
867		return;
868	}
869
870	MCLGET(mnew, M_DONTWAIT);
871	if (!(mnew->m_flags & M_EXT)) {
872		m_freem(mnew);
873		ifp->if_ierrors++;
874		return;
875	}
876
877	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
878	    BUS_DMASYNC_POSTREAD);
879	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
880
881	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(mnew, void *),
882	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
883	if (error != 0) {
884		m_freem(mnew);
885
886		/* try to reload the old mbuf */
887		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
888		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
889		if (error != 0) {
890			/* very unlikely that it will fail... */
891			panic("%s: could not load old rx mbuf",
892			    sc->sc_dev.dv_xname);
893		}
894		ifp->if_ierrors++;
895		return;
896	}
897
898	m = sbuf->m;
899	sbuf->m = mnew;
900	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
901
902	/* finalize mbuf */
903	m->m_pkthdr.rcvif = ifp;
904	m->m_pkthdr.len = m->m_len = letoh32(status->len);
905
906#if NBPFILTER > 0
907	if (sc->sc_drvbpf != NULL) {
908		struct mbuf mb;
909		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
910
911		tap->wr_flags = 0;
912		tap->wr_antsignal = status->rssi;
913		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
914		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
915
916		M_DUP_PKTHDR(&mb, m);
917		mb.m_data = (caddr_t)tap;
918		mb.m_len = sc->sc_rxtap_len;
919		mb.m_next = m;
920		mb.m_pkthdr.len += mb.m_len;
921		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
922	}
923#endif
924
925	wh = mtod(m, struct ieee80211_frame *);
926
927	ni = ieee80211_find_rxnode(ic, wh);
928
929	/* send the frame to the upper layer */
930	ieee80211_input(ifp, m, ni, status->rssi, 0);
931
932	ieee80211_release_node(ic, ni);
933}
934
935void
936ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
937{
938	DPRINTFN(2, ("RX!NOTIFICATION\n"));
939}
940
941void
942ipw_rx_intr(struct ipw_softc *sc)
943{
944	struct ipw_status *status;
945	struct ipw_soft_bd *sbd;
946	struct ipw_soft_buf *sbuf;
947	uint32_t r, i;
948
949	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
950
951	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
952
953		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
954		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
955		    BUS_DMASYNC_POSTREAD);
956
957		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
958		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
959		    BUS_DMASYNC_POSTREAD);
960
961		status = &sc->status_list[i];
962		sbd = &sc->srbd_list[i];
963		sbuf = sbd->priv;
964
965		switch (letoh16(status->code) & 0xf) {
966		case IPW_STATUS_CODE_COMMAND:
967			ipw_command_intr(sc, sbuf);
968			break;
969
970		case IPW_STATUS_CODE_NEWSTATE:
971			ipw_newstate_intr(sc, sbuf);
972			break;
973
974		case IPW_STATUS_CODE_DATA_802_3:
975		case IPW_STATUS_CODE_DATA_802_11:
976			ipw_data_intr(sc, status, sbd, sbuf);
977			break;
978
979		case IPW_STATUS_CODE_NOTIFICATION:
980			ipw_notification_intr(sc, sbuf);
981			break;
982
983		default:
984			printf("%s: unknown status code %u\n",
985			    sc->sc_dev.dv_xname, letoh16(status->code));
986		}
987		sbd->bd->flags = 0;
988
989		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
990		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
991		    BUS_DMASYNC_PREWRITE);
992	}
993
994	/* tell the firmware what we have processed */
995	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
996	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
997}
998
999void
1000ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
1001{
1002	struct ieee80211com *ic = &sc->sc_ic;
1003	struct ipw_soft_hdr *shdr;
1004	struct ipw_soft_buf *sbuf;
1005
1006	switch (sbd->type) {
1007	case IPW_SBD_TYPE_COMMAND:
1008		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
1009		break;
1010
1011	case IPW_SBD_TYPE_HEADER:
1012		shdr = sbd->priv;
1013		bus_dmamap_unload(sc->sc_dmat, shdr->map);
1014		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1015		break;
1016
1017	case IPW_SBD_TYPE_DATA:
1018		sbuf = sbd->priv;
1019		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1020		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1021
1022		m_freem(sbuf->m);
1023
1024		if (sbuf->ni != NULL)
1025			ieee80211_release_node(ic, sbuf->ni);
1026
1027		/* kill watchdog timer */
1028		sc->sc_tx_timer = 0;
1029		break;
1030	}
1031	sbd->type = IPW_SBD_TYPE_NOASSOC;
1032}
1033
1034void
1035ipw_tx_intr(struct ipw_softc *sc)
1036{
1037	struct ifnet *ifp = &sc->sc_ic.ic_if;
1038	struct ipw_soft_bd *sbd;
1039	uint32_t r, i;
1040
1041	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1042
1043	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1044		sbd = &sc->stbd_list[i];
1045
1046		if (sbd->type == IPW_SBD_TYPE_DATA)
1047			ifp->if_opackets++;
1048
1049		ipw_release_sbd(sc, sbd);
1050		sc->txfree++;
1051	}
1052
1053	/* remember what the firmware has processed */
1054	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1055
1056	/* call start() since some buffer descriptors have been released */
1057	ifp->if_flags &= ~IFF_OACTIVE;
1058	(*ifp->if_start)(ifp);
1059}
1060
1061int
1062ipw_intr(void *arg)
1063{
1064	struct ipw_softc *sc = arg;
1065	struct ifnet *ifp = &sc->sc_ic.ic_if;
1066	uint32_t r;
1067
1068	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1069		return 0;
1070
1071	/* disable interrupts */
1072	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1073
1074	DPRINTFN(8, ("INTR!0x%08x\n", r));
1075
1076	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1077		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1078		ifp->if_flags &= ~IFF_UP;
1079		ipw_stop(ifp, 1);
1080		return 1;
1081	}
1082
1083	if (r & IPW_INTR_FW_INIT_DONE)
1084		wakeup(sc);
1085
1086	if (r & IPW_INTR_RX_TRANSFER)
1087		ipw_rx_intr(sc);
1088
1089	if (r & IPW_INTR_TX_TRANSFER)
1090		ipw_tx_intr(sc);
1091
1092	/* acknowledge interrupts */
1093	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1094
1095	/* re-enable interrupts */
1096	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1097
1098	return 1;
1099}
1100
1101int
1102ipw_cmd(struct ipw_softc *sc, uint32_t type, void *data, uint32_t len)
1103{
1104	struct ipw_soft_bd *sbd;
1105	int error;
1106
1107	sbd = &sc->stbd_list[sc->txcur];
1108
1109	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1110	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1111	if (error != 0) {
1112		printf("%s: could not map command DMA memory\n",
1113		    sc->sc_dev.dv_xname);
1114		return error;
1115	}
1116
1117	sc->cmd.type = htole32(type);
1118	sc->cmd.subtype = htole32(0);
1119	sc->cmd.len = htole32(len);
1120	sc->cmd.seq = htole32(0);
1121	if (data != NULL)
1122		bcopy(data, sc->cmd.data, len);
1123
1124	sbd->type = IPW_SBD_TYPE_COMMAND;
1125	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1126	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1127	sbd->bd->nfrag = 1;
1128	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1129			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
1130
1131	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1132	    BUS_DMASYNC_PREWRITE);
1133
1134	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1135	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1136	    BUS_DMASYNC_PREWRITE);
1137
1138	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1139	sc->txfree--;
1140	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1141
1142	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1143
1144	/* wait at most one second for command to complete */
1145	return tsleep(sc, 0, "ipwcmd", hz);
1146}
1147
1148int
1149ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1150{
1151	struct ipw_softc *sc = ifp->if_softc;
1152	struct ieee80211com *ic = &sc->sc_ic;
1153	struct ieee80211_frame *wh;
1154	struct ipw_soft_bd *sbd;
1155	struct ipw_soft_hdr *shdr;
1156	struct ipw_soft_buf *sbuf;
1157	struct mbuf *mnew;
1158	int error, i;
1159
1160	wh = mtod(m, struct ieee80211_frame *);
1161
1162	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1163		m = ieee80211_wep_crypt(ifp, m, 1);
1164		if (m == NULL)
1165			return ENOBUFS;
1166
1167		/* packet header may have moved, reset our local pointer */
1168		wh = mtod(m, struct ieee80211_frame *);
1169	}
1170
1171#if NBPFILTER > 0
1172	if (sc->sc_drvbpf != NULL) {
1173		struct mbuf mb;
1174		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1175
1176		tap->wt_flags = 0;
1177		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1178		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1179
1180		M_DUP_PKTHDR(&mb, m);
1181		mb.m_data = (caddr_t)tap;
1182		mb.m_len = sc->sc_txtap_len;
1183		mb.m_next = m;
1184		mb.m_pkthdr.len += mb.m_len;
1185		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1186	}
1187#endif
1188
1189	shdr = SLIST_FIRST(&sc->free_shdr);
1190	sbuf = SLIST_FIRST(&sc->free_sbuf);
1191
1192	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1193	shdr->hdr.subtype = htole32(0);
1194	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1195	shdr->hdr.encrypt = 0;
1196	shdr->hdr.keyidx = 0;
1197	shdr->hdr.keysz = 0;
1198	shdr->hdr.fragmentsz = htole16(0);
1199	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1200	if (ic->ic_opmode == IEEE80211_M_STA)
1201		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1202	else
1203		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1204
1205	/* trim IEEE802.11 header */
1206	m_adj(m, sizeof (struct ieee80211_frame));
1207
1208	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1209	if (error != 0 && error != EFBIG) {
1210		printf("%s: could not map mbuf (error %d)\n",
1211		    sc->sc_dev.dv_xname, error);
1212		m_freem(m);
1213		return error;
1214	}
1215	if (error != 0) {
1216		/* too many fragments, linearize */
1217
1218		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1219		if (mnew == NULL) {
1220			m_freem(m);
1221			return ENOMEM;
1222		}
1223
1224		M_DUP_PKTHDR(mnew, m);
1225		if (m->m_pkthdr.len > MHLEN) {
1226			MCLGET(mnew, M_DONTWAIT);
1227			if (!(mnew->m_flags & M_EXT)) {
1228				m_freem(m);
1229				m_freem(mnew);
1230				return ENOMEM;
1231			}
1232		}
1233
1234		m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew, caddr_t));
1235		m_freem(m);
1236		mnew->m_len = mnew->m_pkthdr.len;
1237		m = mnew;
1238
1239		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1240		    BUS_DMA_NOWAIT);
1241		if (error != 0) {
1242			printf("%s: could not map mbuf (error %d)\n",
1243			    sc->sc_dev.dv_xname, error);
1244			m_freem(m);
1245			return error;
1246		}
1247	}
1248
1249	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1250	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1251	if (error != 0) {
1252		printf("%s: could not map header DMA memory (error %d)\n",
1253		    sc->sc_dev.dv_xname, error);
1254		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1255		m_freem(m);
1256		return error;
1257	}
1258
1259	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1260	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1261
1262	sbd = &sc->stbd_list[sc->txcur];
1263	sbd->type = IPW_SBD_TYPE_HEADER;
1264	sbd->priv = shdr;
1265	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1266	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1267	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1268	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1269			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1270
1271	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1272	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1273	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1274	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1275
1276	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1277	    sc->txcur * sizeof (struct ipw_bd),
1278	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1279
1280	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1281	sc->txfree--;
1282
1283	sbuf->m = m;
1284	sbuf->ni = ni;
1285
1286	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1287		sbd = &sc->stbd_list[sc->txcur];
1288		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1289		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1290		sbd->bd->nfrag = 0;	/* used only in first bd */
1291		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1292		if (i == sbuf->map->dm_nsegs - 1) {
1293			sbd->type = IPW_SBD_TYPE_DATA;
1294			sbd->priv = sbuf;
1295			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1296		} else {
1297			sbd->type = IPW_SBD_TYPE_NOASSOC;
1298			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1299		}
1300
1301		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1302		    sbuf->map->dm_segs[i].ds_len));
1303
1304		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1305		    sc->txcur * sizeof (struct ipw_bd),
1306		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1307
1308		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1309		sc->txfree--;
1310	}
1311
1312	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1313	    BUS_DMASYNC_PREWRITE);
1314
1315	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
1316	    BUS_DMASYNC_PREWRITE);
1317
1318	/* inform firmware about this new packet */
1319	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1320
1321	return 0;
1322}
1323
1324void
1325ipw_start(struct ifnet *ifp)
1326{
1327	struct ipw_softc *sc = ifp->if_softc;
1328	struct ieee80211com *ic = &sc->sc_ic;
1329	struct mbuf *m;
1330	struct ieee80211_node *ni;
1331
1332	if (ic->ic_state != IEEE80211_S_RUN)
1333		return;
1334
1335	for (;;) {
1336		IF_DEQUEUE(&ifp->if_snd, m);
1337		if (m == NULL)
1338			break;
1339
1340		if (sc->txfree < 1 + IPW_MAX_NSEG) {
1341			IF_PREPEND(&ifp->if_snd, m);
1342			ifp->if_flags |= IFF_OACTIVE;
1343			break;
1344		}
1345
1346#if NBPFILTER > 0
1347		if (ifp->if_bpf != NULL)
1348			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1349#endif
1350
1351		m = ieee80211_encap(ifp, m, &ni);
1352		if (m == NULL)
1353			continue;
1354
1355#if NBPFILTER > 0
1356		if (ic->ic_rawbpf != NULL)
1357			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1358#endif
1359
1360		if (ipw_tx_start(ifp, m, ni) != 0) {
1361			if (ni != NULL)
1362				ieee80211_release_node(ic, ni);
1363			ifp->if_oerrors++;
1364			break;
1365		}
1366
1367		/* start watchdog timer */
1368		sc->sc_tx_timer = 5;
1369		ifp->if_timer = 1;
1370	}
1371}
1372
1373void
1374ipw_watchdog(struct ifnet *ifp)
1375{
1376	struct ipw_softc *sc = ifp->if_softc;
1377
1378	ifp->if_timer = 0;
1379
1380	if (sc->sc_tx_timer > 0) {
1381		if (--sc->sc_tx_timer == 0) {
1382			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1383			ifp->if_flags &= ~IFF_UP;
1384			ipw_stop(ifp, 1);
1385			ifp->if_oerrors++;
1386			return;
1387		}
1388		ifp->if_timer = 1;
1389	}
1390
1391	ieee80211_watchdog(ifp);
1392}
1393
1394int
1395ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1396{
1397	struct ipw_softc *sc = ifp->if_softc;
1398	struct ieee80211com *ic = &sc->sc_ic;
1399	struct ifaddr *ifa;
1400	struct ifreq *ifr;
1401	int s, error = 0;
1402
1403	s = splnet();
1404
1405	switch (cmd) {
1406	case SIOCSIFADDR:
1407		ifa = (struct ifaddr *)data;
1408		ifp->if_flags |= IFF_UP;
1409#ifdef INET
1410		if (ifa->ifa_addr->sa_family == AF_INET)
1411			arp_ifinit(&ic->ic_ac, ifa);
1412#endif
1413		/* FALLTHROUGH */
1414	case SIOCSIFFLAGS:
1415		if (ifp->if_flags & IFF_UP) {
1416			if (!(ifp->if_flags & IFF_RUNNING))
1417				ipw_init(ifp);
1418		} else {
1419			if (ifp->if_flags & IFF_RUNNING)
1420				ipw_stop(ifp, 1);
1421		}
1422		break;
1423
1424	case SIOCADDMULTI:
1425	case SIOCDELMULTI:
1426		ifr = (struct ifreq *)data;
1427		error = (cmd == SIOCADDMULTI) ?
1428		    ether_addmulti(ifr, &ic->ic_ac) :
1429		    ether_delmulti(ifr, &ic->ic_ac);
1430
1431		if (error == ENETRESET)
1432			error = 0;
1433		break;
1434
1435	case SIOCG80211TXPOWER:
1436		/*
1437		 * If the hardware radio transmitter switch is off, report a
1438		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1439		 * transmitter is killed.
1440		 */
1441		((struct ieee80211_txpower *)data)->i_val =
1442		    (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ?
1443		    IEEE80211_TXPOWER_MIN : sc->sc_ic.ic_txpower;
1444		break;
1445
1446	case SIOCG80211AUTH:
1447		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
1448		break;
1449
1450	case SIOCS80211AUTH:
1451		/* only super-user can do that! */
1452		if ((error = suser(curproc, 0)) != 0)
1453			break;
1454
1455		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
1456		break;
1457
1458	default:
1459		error = ieee80211_ioctl(ifp, cmd, data);
1460	}
1461
1462	if (error == ENETRESET) {
1463		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1464		    (IFF_UP | IFF_RUNNING))
1465			ipw_init(ifp);
1466		error = 0;
1467	}
1468
1469	splx(s);
1470	return error;
1471}
1472
1473uint32_t
1474ipw_read_table1(struct ipw_softc *sc, uint32_t off)
1475{
1476	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1477}
1478
1479void
1480ipw_write_table1(struct ipw_softc *sc, uint32_t off, uint32_t info)
1481{
1482	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1483}
1484
1485int
1486ipw_read_table2(struct ipw_softc *sc, uint32_t off, void *buf, uint32_t *len)
1487{
1488	uint32_t addr, info;
1489	uint16_t count, size;
1490	uint32_t total;
1491
1492	/* addr[4] + count[2] + size[2] */
1493	addr = MEM_READ_4(sc, sc->table2_base + off);
1494	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1495
1496	count = info >> 16;
1497	size = info & 0xffff;
1498	total = count * size;
1499
1500	if (total > *len) {
1501		*len = total;
1502		return EINVAL;
1503	}
1504
1505	*len = total;
1506	ipw_read_mem_1(sc, addr, buf, total);
1507
1508	return 0;
1509}
1510
1511void
1512ipw_stop_master(struct ipw_softc *sc)
1513{
1514	int ntries;
1515
1516	/* disable interrupts */
1517	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1518
1519	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1520	for (ntries = 0; ntries < 50; ntries++) {
1521		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1522			break;
1523		DELAY(10);
1524	}
1525	if (ntries == 50)
1526		printf("%s: timeout waiting for master\n",
1527		    sc->sc_dev.dv_xname);
1528
1529	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1530	    IPW_RST_PRINCETON_RESET);
1531
1532	sc->flags &= ~IPW_FLAG_FW_INITED;
1533}
1534
1535int
1536ipw_reset(struct ipw_softc *sc)
1537{
1538	int ntries;
1539
1540	ipw_stop_master(sc);
1541
1542	/* move adapter to D0 state */
1543	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1544	    IPW_CTL_INIT);
1545
1546	/* wait for clock stabilization */
1547	for (ntries = 0; ntries < 1000; ntries++) {
1548		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1549			break;
1550		DELAY(200);
1551	}
1552	if (ntries == 1000)
1553		return EIO;
1554
1555	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1556	    IPW_RST_SW_RESET);
1557
1558	DELAY(10);
1559
1560	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1561	    IPW_CTL_INIT);
1562
1563	return 0;
1564}
1565
1566int
1567ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1568{
1569	int ntries;
1570
1571	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1572	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1573
1574	MEM_WRITE_2(sc, 0x220000, 0x0703);
1575	MEM_WRITE_2(sc, 0x220000, 0x0707);
1576
1577	MEM_WRITE_1(sc, 0x210014, 0x72);
1578	MEM_WRITE_1(sc, 0x210014, 0x72);
1579
1580	MEM_WRITE_1(sc, 0x210000, 0x40);
1581	MEM_WRITE_1(sc, 0x210000, 0x00);
1582	MEM_WRITE_1(sc, 0x210000, 0x40);
1583
1584	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1585
1586	MEM_WRITE_1(sc, 0x210000, 0x00);
1587	MEM_WRITE_1(sc, 0x210000, 0x00);
1588	MEM_WRITE_1(sc, 0x210000, 0x80);
1589
1590	MEM_WRITE_2(sc, 0x220000, 0x0703);
1591	MEM_WRITE_2(sc, 0x220000, 0x0707);
1592
1593	MEM_WRITE_1(sc, 0x210014, 0x72);
1594	MEM_WRITE_1(sc, 0x210014, 0x72);
1595
1596	MEM_WRITE_1(sc, 0x210000, 0x00);
1597	MEM_WRITE_1(sc, 0x210000, 0x80);
1598
1599	for (ntries = 0; ntries < 100; ntries++) {
1600		if (MEM_READ_1(sc, 0x210000) & 1)
1601			break;
1602		DELAY(1000);
1603	}
1604	if (ntries == 100) {
1605		printf("%s: timeout waiting for ucode to initialize\n",
1606		    sc->sc_dev.dv_xname);
1607		return EIO;
1608	}
1609
1610	MEM_WRITE_4(sc, 0x3000e0, 0);
1611
1612	return 0;
1613}
1614
1615/* set of macros to handle unaligned little endian data in firmware image */
1616#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1617#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1618int
1619ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1620{
1621	u_char *p, *end;
1622	uint32_t dst;
1623	uint16_t len;
1624	int error;
1625
1626	p = fw;
1627	end = fw + size;
1628	while (p < end) {
1629		if (p + 6 > end)
1630			return EINVAL;
1631
1632		dst = GETLE32(p); p += 4;
1633		len = GETLE16(p); p += 2;
1634
1635		if (p + len > end)
1636			return EINVAL;
1637
1638		ipw_write_mem_1(sc, dst, p, len);
1639		p += len;
1640	}
1641
1642	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1643	    IPW_IO_LED_OFF);
1644
1645	/* allow interrupts so we know when the firmware is inited */
1646	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1647
1648	/* tell the adapter to initialize the firmware */
1649	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1650	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1651	    IPW_CTL_ALLOW_STANDBY);
1652
1653	/* wait at most one second for firmware initialization to complete */
1654	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1655		printf("%s: timeout waiting for firmware initialization to "
1656		    "complete\n", sc->sc_dev.dv_xname);
1657		return error;
1658	}
1659
1660	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1661	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1662
1663	return 0;
1664}
1665
1666int
1667ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1668{
1669	struct ipw_firmware_hdr *hdr;
1670	const char *name;
1671	u_char *p;
1672	size_t size;
1673	int error;
1674
1675	switch (sc->sc_ic.ic_opmode) {
1676	case IEEE80211_M_STA:
1677	case IEEE80211_M_HOSTAP:
1678		name = "ipw-bss";
1679		break;
1680
1681	case IEEE80211_M_IBSS:
1682	case IEEE80211_M_AHDEMO:
1683		name = "ipw-ibss";
1684		break;
1685
1686	case IEEE80211_M_MONITOR:
1687		name = "ipw-monitor";
1688		break;
1689	}
1690
1691	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1692		return error;
1693
1694	if (size < sizeof (struct ipw_firmware_hdr)) {
1695		error = EINVAL;
1696		goto fail;
1697	}
1698
1699	p = fw->data;
1700	hdr = (struct ipw_firmware_hdr *)p;
1701	fw->main_size = letoh32(hdr->main_size);
1702	fw->ucode_size = letoh32(hdr->ucode_size);
1703
1704	p += sizeof (struct ipw_firmware_hdr);
1705	size -= sizeof (struct ipw_firmware_hdr);
1706
1707	if (size < fw->main_size + fw->ucode_size) {
1708		error = EINVAL;
1709		goto fail;
1710	}
1711
1712	fw->main = p;
1713	fw->ucode = p + fw->main_size;
1714
1715	return 0;
1716
1717fail:	free(fw->data, M_DEVBUF);
1718	return error;
1719}
1720
1721int
1722ipw_config(struct ipw_softc *sc)
1723{
1724	struct ieee80211com *ic = &sc->sc_ic;
1725	struct ifnet *ifp = &ic->ic_if;
1726	struct ipw_security security;
1727	struct ieee80211_wepkey *k;
1728	struct ipw_wep_key wepkey;
1729	struct ipw_scan_options options;
1730	struct ipw_configuration config;
1731	uint32_t data;
1732	int error, i;
1733
1734	switch (ic->ic_opmode) {
1735	case IEEE80211_M_STA:
1736	case IEEE80211_M_HOSTAP:
1737		data = htole32(IPW_MODE_BSS);
1738		break;
1739
1740	case IEEE80211_M_IBSS:
1741	case IEEE80211_M_AHDEMO:
1742		data = htole32(IPW_MODE_IBSS);
1743		break;
1744
1745	case IEEE80211_M_MONITOR:
1746		data = htole32(IPW_MODE_MONITOR);
1747		break;
1748	}
1749	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1750	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1751	if (error != 0)
1752		return error;
1753
1754	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1755	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1756		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1757		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1758		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1759		if (error != 0)
1760			return error;
1761	}
1762
1763	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1764		DPRINTF(("Enabling adapter\n"));
1765		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1766	}
1767
1768	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1769	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1770	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1771	    IEEE80211_ADDR_LEN);
1772	if (error != 0)
1773		return error;
1774
1775	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1776	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1777	if (ic->ic_opmode == IEEE80211_M_IBSS)
1778		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1779	if (ifp->if_flags & IFF_PROMISC)
1780		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1781	config.bss_chan = htole32(0x3fff);	/* channels 1-14 */
1782	config.ibss_chan = htole32(0x7ff);	/* channels 1-11 */
1783	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1784	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1785	if (error != 0)
1786		return error;
1787
1788	data = htole32(0x3);	/* 1, 2 */
1789	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1790	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1791	if (error != 0)
1792		return error;
1793
1794	data = htole32(0xf);	/* 1, 2, 5.5, 11 */
1795	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1796	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1797	if (error != 0)
1798		return error;
1799
1800	data = htole32(IPW_POWER_MODE_CAM);
1801	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1802	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1803	if (error != 0)
1804		return error;
1805
1806	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1807		data = htole32(32);	/* default value */
1808		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1809		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1810		    sizeof data);
1811		if (error != 0)
1812			return error;
1813	}
1814
1815	data = htole32(ic->ic_rtsthreshold);
1816	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1817	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1818	if (error != 0)
1819		return error;
1820
1821	data = htole32(ic->ic_fragthreshold);
1822	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1823	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1824	if (error != 0)
1825		return error;
1826
1827#ifdef IPW_DEBUG
1828	if (ipw_debug > 0) {
1829		printf("Setting ESSID to ");
1830		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1831		printf("\n");
1832	}
1833#endif
1834	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1835	    ic->ic_des_esslen);
1836	if (error != 0)
1837		return error;
1838
1839	/* no mandatory BSSID */
1840	DPRINTF(("Setting mandatory BSSID to null\n"));
1841	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1842	if (error != 0)
1843		return error;
1844
1845	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1846		DPRINTF(("Setting adapter BSSID to %s\n",
1847		    ether_sprintf(ic->ic_des_bssid)));
1848		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1849		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1850		if (error != 0)
1851			return error;
1852	}
1853
1854	bzero(&security, sizeof security);
1855	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1856	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1857	security.ciphers = htole32(IPW_CIPHER_NONE);
1858	DPRINTF(("Setting authmode to %u\n", security.authmode));
1859	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1860	    sizeof security);
1861	if (error != 0)
1862		return error;
1863
1864	if (ic->ic_flags & IEEE80211_F_WEPON) {
1865		k = ic->ic_nw_keys;
1866		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1867			if (k->wk_len == 0)
1868				continue;
1869
1870			wepkey.idx = i;
1871			wepkey.len = k->wk_len;
1872			bzero(wepkey.key, sizeof wepkey.key);
1873			bcopy(k->wk_key, wepkey.key, k->wk_len);
1874			DPRINTF(("Setting wep key index %u len %u\n",
1875			    wepkey.idx, wepkey.len));
1876			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1877			    sizeof wepkey);
1878			if (error != 0)
1879				return error;
1880		}
1881
1882		data = htole32(ic->ic_wep_txkey);
1883		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1884		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1885		    sizeof data);
1886		if (error != 0)
1887			return error;
1888	}
1889
1890	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1891	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1892	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1893	if (error != 0)
1894		return error;
1895
1896	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1897	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1898		data = htole32(ic->ic_lintval);
1899		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1900		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1901		    sizeof data);
1902		if (error != 0)
1903			return error;
1904	}
1905
1906	options.flags = htole32(0);
1907	options.channels = htole32(0x3fff);	/* scan channels 1-14 */
1908	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1909	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1910	if (error != 0)
1911		return error;
1912
1913	/* finally, enable adapter (start scanning for an access point) */
1914	DPRINTF(("Enabling adapter\n"));
1915	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1916}
1917
1918int
1919ipw_init(struct ifnet *ifp)
1920{
1921	struct ipw_softc *sc = ifp->if_softc;
1922	struct ipw_firmware fw;
1923	int error;
1924
1925	ipw_stop(ifp, 0);
1926
1927	if ((error = ipw_reset(sc)) != 0) {
1928		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1929		goto fail1;
1930	}
1931
1932	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1933		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1934		goto fail1;
1935	}
1936
1937	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1938		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1939		goto fail2;
1940	}
1941
1942	ipw_stop_master(sc);
1943
1944	/*
1945	 * Setup tx, rx and status rings.
1946	 */
1947	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1948	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1949	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1950	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1951	sc->txold = IPW_NTBD - 1;	/* latest bd index ack by firmware */
1952	sc->txcur = 0; /* bd index to write to */
1953	sc->txfree = IPW_NTBD - 2;
1954
1955	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1956	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1957	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1958	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1959	sc->rxcur = IPW_NRBD - 1;	/* latest bd index I've read */
1960
1961	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1962	    sc->status_map->dm_segs[0].ds_addr);
1963
1964	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1965		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1966		goto fail2;
1967	}
1968
1969	sc->flags |= IPW_FLAG_FW_INITED;
1970
1971	/* retrieve information tables base addresses */
1972	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1973	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1974
1975	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1976
1977	if ((error = ipw_config(sc)) != 0) {
1978		printf("%s: device configuration failed\n",
1979		    sc->sc_dev.dv_xname);
1980		goto fail2;
1981	}
1982
1983	ifp->if_flags &= ~IFF_OACTIVE;
1984	ifp->if_flags |= IFF_RUNNING;
1985
1986	return 0;
1987
1988fail2:	free(fw.data, M_DEVBUF);
1989fail1:	ipw_stop(ifp, 0);
1990
1991	return error;
1992}
1993
1994void
1995ipw_stop(struct ifnet *ifp, int disable)
1996{
1997	struct ipw_softc *sc = ifp->if_softc;
1998	struct ieee80211com *ic = &sc->sc_ic;
1999	int i;
2000
2001	ipw_stop_master(sc);
2002	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2003
2004	ifp->if_timer = 0;
2005	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2006
2007	/*
2008	 * Release tx buffers.
2009	 */
2010	for (i = 0; i < IPW_NTBD; i++)
2011		ipw_release_sbd(sc, &sc->stbd_list[i]);
2012
2013	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2014}
2015
2016void
2017ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2018    bus_size_t count)
2019{
2020	for (; count > 0; offset++, datap++, count--) {
2021		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2022		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2023	}
2024}
2025
2026void
2027ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2028    bus_size_t count)
2029{
2030	for (; count > 0; offset++, datap++, count--) {
2031		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2032		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2033	}
2034}
2035
2036struct cfdriver ipw_cd = {
2037	NULL, "ipw", DV_IFNET
2038};
2039