if_ipw.c revision 1.61
1/*	$OpenBSD: if_ipw.c,v 1.61 2006/08/19 12:03:05 damien Exp $	*/
2
3/*-
4 * Copyright (c) 2004-2006
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*
31 * Driver for Intel PRO/Wireless 2100 802.11 network adapters.
32 */
33
34#include "bpfilter.h"
35
36#include <sys/param.h>
37#include <sys/sockio.h>
38#include <sys/sysctl.h>
39#include <sys/mbuf.h>
40#include <sys/kernel.h>
41#include <sys/socket.h>
42#include <sys/systm.h>
43#include <sys/malloc.h>
44#include <sys/conf.h>
45#include <sys/device.h>
46
47#include <machine/bus.h>
48#include <machine/endian.h>
49#include <machine/intr.h>
50
51#include <dev/pci/pcireg.h>
52#include <dev/pci/pcivar.h>
53#include <dev/pci/pcidevs.h>
54
55#if NBPFILTER > 0
56#include <net/bpf.h>
57#endif
58#include <net/if.h>
59#include <net/if_arp.h>
60#include <net/if_dl.h>
61#include <net/if_media.h>
62#include <net/if_types.h>
63
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/in_var.h>
67#include <netinet/if_ether.h>
68#include <netinet/ip.h>
69
70#include <net80211/ieee80211_var.h>
71#include <net80211/ieee80211_radiotap.h>
72
73#include <dev/pci/if_ipwreg.h>
74#include <dev/pci/if_ipwvar.h>
75
76static const struct ieee80211_rateset ipw_rateset_11b =
77	{ 4, { 2, 4, 11, 22 } };
78
79int		ipw_match(struct device *, void *, void *);
80void		ipw_attach(struct device *, struct device *, void *);
81int		ipw_detach(struct device *, int);
82void		ipw_power(int, void *);
83int		ipw_dma_alloc(struct ipw_softc *);
84void		ipw_release(struct ipw_softc *);
85int		ipw_media_change(struct ifnet *);
86void		ipw_media_status(struct ifnet *, struct ifmediareq *);
87int		ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
88uint16_t	ipw_read_prom_word(struct ipw_softc *, uint8_t);
89void		ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
90void		ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
91void		ipw_data_intr(struct ipw_softc *, struct ipw_status *,
92		    struct ipw_soft_bd *, struct ipw_soft_buf *);
93void		ipw_notification_intr(struct ipw_softc *,
94		    struct ipw_soft_buf *);
95void		ipw_rx_intr(struct ipw_softc *);
96void		ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
97void		ipw_tx_intr(struct ipw_softc *);
98int		ipw_intr(void *);
99int		ipw_cmd(struct ipw_softc *, uint32_t, void *, uint32_t);
100int		ipw_tx_start(struct ifnet *, struct mbuf *,
101		    struct ieee80211_node *);
102void		ipw_start(struct ifnet *);
103void		ipw_watchdog(struct ifnet *);
104int		ipw_ioctl(struct ifnet *, u_long, caddr_t);
105uint32_t	ipw_read_table1(struct ipw_softc *, uint32_t);
106void		ipw_write_table1(struct ipw_softc *, uint32_t, uint32_t);
107int		ipw_read_table2(struct ipw_softc *, uint32_t, void *,
108		    uint32_t *);
109void		ipw_stop_master(struct ipw_softc *);
110int		ipw_reset(struct ipw_softc *);
111int		ipw_load_ucode(struct ipw_softc *, u_char *, int);
112int		ipw_load_firmware(struct ipw_softc *, u_char *, int);
113int		ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
114int		ipw_config(struct ipw_softc *);
115int		ipw_init(struct ifnet *);
116void		ipw_stop(struct ifnet *, int);
117void		ipw_read_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
118		    bus_size_t);
119void		ipw_write_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
120		    bus_size_t);
121
122static __inline uint8_t
123MEM_READ_1(struct ipw_softc *sc, uint32_t addr)
124{
125	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
126	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
127}
128
129static __inline uint32_t
130MEM_READ_4(struct ipw_softc *sc, uint32_t addr)
131{
132	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
133	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
134}
135
136#ifdef IPW_DEBUG
137#define DPRINTF(x)	do { if (ipw_debug > 0) printf x; } while (0)
138#define DPRINTFN(n, x)	do { if (ipw_debug >= (n)) printf x; } while (0)
139int ipw_debug = 0;
140#else
141#define DPRINTF(x)
142#define DPRINTFN(n, x)
143#endif
144
145struct cfattach ipw_ca = {
146	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
147};
148
149int
150ipw_match(struct device *parent, void *match, void *aux)
151{
152	struct pci_attach_args *pa = aux;
153
154	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
155	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2100)
156		return 1;
157
158	return 0;
159}
160
161/* Base Address Register */
162#define IPW_PCI_BAR0	0x10
163
164void
165ipw_attach(struct device *parent, struct device *self, void *aux)
166{
167	struct ipw_softc *sc = (struct ipw_softc *)self;
168	struct ieee80211com *ic = &sc->sc_ic;
169	struct ifnet *ifp = &ic->ic_if;
170	struct pci_attach_args *pa = aux;
171	const char *intrstr;
172	bus_space_tag_t memt;
173	bus_space_handle_t memh;
174	bus_addr_t base;
175	pci_intr_handle_t ih;
176	pcireg_t data;
177	uint16_t val;
178	int error, i;
179
180	sc->sc_pct = pa->pa_pc;
181	sc->sc_pcitag = pa->pa_tag,
182
183	/* clear device specific PCI configuration register 0x41 */
184	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
185	data &= ~0x0000ff00;
186	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
187
188	/* map the register window */
189	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
190	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
191	if (error != 0) {
192		printf(": could not map memory space\n");
193		return;
194	}
195
196	sc->sc_st = memt;
197	sc->sc_sh = memh;
198	sc->sc_dmat = pa->pa_dmat;
199
200	/* disable interrupts */
201	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
202
203	if (pci_intr_map(pa, &ih) != 0) {
204		printf(": could not map interrupt\n");
205		return;
206	}
207
208	intrstr = pci_intr_string(sc->sc_pct, ih);
209	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
210	    sc->sc_dev.dv_xname);
211	if (sc->sc_ih == NULL) {
212		printf(": could not establish interrupt");
213		if (intrstr != NULL)
214			printf(" at %s", intrstr);
215		printf("\n");
216		return;
217	}
218	printf(": %s", intrstr);
219
220	if (ipw_reset(sc) != 0) {
221		printf(": could not reset adapter\n");
222		return;
223	}
224
225	if (ipw_dma_alloc(sc) != 0) {
226		printf(": failed to allocate DMA resources\n");
227		return;
228	}
229
230	ic->ic_phytype = IEEE80211_T_DS;
231	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
232	ic->ic_state = IEEE80211_S_INIT;
233
234	/* set device capabilities */
235	ic->ic_caps =
236	    IEEE80211_C_IBSS |		/* IBSS mode supported */
237	    IEEE80211_C_MONITOR |	/* monitor mode supported */
238	    IEEE80211_C_TXPMGT |	/* tx power management */
239	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
240	    IEEE80211_C_WEP |		/* s/w WEP */
241	    IEEE80211_C_SCANALL;	/* h/w scanning */
242
243	/* read MAC address from EEPROM */
244	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
245	ic->ic_myaddr[0] = val >> 8;
246	ic->ic_myaddr[1] = val & 0xff;
247	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
248	ic->ic_myaddr[2] = val >> 8;
249	ic->ic_myaddr[3] = val & 0xff;
250	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
251	ic->ic_myaddr[4] = val >> 8;
252	ic->ic_myaddr[5] = val & 0xff;
253
254	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
255
256	/* set supported .11b rates */
257	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
258
259	/* set supported .11b channels (1 through 14) */
260	for (i = 1; i <= 14; i++) {
261		ic->ic_channels[i].ic_freq =
262		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
263		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
264	}
265
266	/* IBSS channel undefined for now */
267	ic->ic_ibss_chan = &ic->ic_channels[0];
268
269	ifp->if_softc = sc;
270	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
271	ifp->if_init = ipw_init;
272	ifp->if_ioctl = ipw_ioctl;
273	ifp->if_start = ipw_start;
274	ifp->if_watchdog = ipw_watchdog;
275	IFQ_SET_READY(&ifp->if_snd);
276	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
277
278	if_attach(ifp);
279	ieee80211_ifattach(ifp);
280	/* override state transition machine */
281	sc->sc_newstate = ic->ic_newstate;
282	ic->ic_newstate = ipw_newstate;
283	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
284
285	sc->powerhook = powerhook_establish(ipw_power, sc);
286
287#if NBPFILTER > 0
288	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
289	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
290
291	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
292	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
293	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
294
295	sc->sc_txtap_len = sizeof sc->sc_txtapu;
296	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
297	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
298#endif
299}
300
301int
302ipw_detach(struct device *self, int flags)
303{
304	struct ipw_softc *sc = (struct ipw_softc *)self;
305	struct ifnet *ifp = &sc->sc_ic.ic_if;
306
307	ipw_stop(ifp, 1);
308
309	ieee80211_ifdetach(ifp);
310	if_detach(ifp);
311
312	ipw_release(sc);
313
314	if (sc->sc_ih != NULL) {
315		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
316		sc->sc_ih = NULL;
317	}
318
319	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
320
321	return 0;
322}
323
324void
325ipw_power(int why, void *arg)
326{
327	struct ipw_softc *sc = arg;
328	struct ifnet *ifp;
329	pcireg_t data;
330
331	if (why != PWR_RESUME)
332		return;
333
334	/* clear device specific PCI configuration register 0x41 */
335	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
336	data &= ~0x0000ff00;
337	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
338
339	ifp = &sc->sc_ic.ic_if;
340	if (ifp->if_flags & IFF_UP) {
341		ifp->if_init(ifp);
342		if (ifp->if_flags & IFF_RUNNING)
343			ifp->if_start(ifp);
344	}
345}
346
347int
348ipw_dma_alloc(struct ipw_softc *sc)
349{
350	struct ipw_soft_bd *sbd;
351	struct ipw_soft_hdr *shdr;
352	struct ipw_soft_buf *sbuf;
353	int i, nsegs, error;
354
355	/*
356	 * Allocate and map tx ring.
357	 */
358	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
359	    BUS_DMA_NOWAIT, &sc->tbd_map);
360	if (error != 0) {
361		printf("%s: could not create tx ring DMA map\n",
362		    sc->sc_dev.dv_xname);
363		goto fail;
364	}
365
366	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
367	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
368	if (error != 0) {
369		printf("%s: could not allocate tx ring DMA memory\n",
370		    sc->sc_dev.dv_xname);
371		goto fail;
372	}
373
374	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
375	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
376	if (error != 0) {
377		printf("%s: could not map tx ring DMA memory\n",
378		    sc->sc_dev.dv_xname);
379		goto fail;
380	}
381
382	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
383	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
384	if (error != 0) {
385		printf("%s: could not load tx ring DMA map\n",
386		    sc->sc_dev.dv_xname);
387		goto fail;
388	}
389
390	/*
391	 * Allocate and map rx ring.
392	 */
393	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
394	    BUS_DMA_NOWAIT, &sc->rbd_map);
395	if (error != 0) {
396		printf("%s: could not create rx ring DMA map\n",
397		    sc->sc_dev.dv_xname);
398		goto fail;
399	}
400
401	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
402	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
403	if (error != 0) {
404		printf("%s: could not allocate rx ring DMA memory\n",
405		    sc->sc_dev.dv_xname);
406		goto fail;
407	}
408
409	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
410	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
411	if (error != 0) {
412		printf("%s: could not map rx ring DMA memory\n",
413		    sc->sc_dev.dv_xname);
414		goto fail;
415	}
416
417	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
418	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
419	if (error != 0) {
420		printf("%s: could not load tx ring DMA map\n",
421		    sc->sc_dev.dv_xname);
422		goto fail;
423	}
424
425	/*
426	 * Allocate and map status ring.
427	 */
428	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
429	    0, BUS_DMA_NOWAIT, &sc->status_map);
430	if (error != 0) {
431		printf("%s: could not create status ring DMA map\n",
432		    sc->sc_dev.dv_xname);
433		goto fail;
434	}
435
436	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
437	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
438	if (error != 0) {
439		printf("%s: could not allocate status ring DMA memory\n",
440		    sc->sc_dev.dv_xname);
441		goto fail;
442	}
443
444	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
445	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
446	if (error != 0) {
447		printf("%s: could not map status ring DMA memory\n",
448		    sc->sc_dev.dv_xname);
449		goto fail;
450	}
451
452	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
453	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
454	if (error != 0) {
455		printf("%s: could not load status ring DMA map\n",
456		    sc->sc_dev.dv_xname);
457		goto fail;
458	}
459
460	/*
461	 * Allocate command DMA map.
462	 */
463	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
464	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
465	if (error != 0) {
466		printf("%s: could not create command DMA map\n",
467		    sc->sc_dev.dv_xname);
468		goto fail;
469	}
470
471	/*
472	 * Allocate headers DMA maps.
473	 */
474	SLIST_INIT(&sc->free_shdr);
475	for (i = 0; i < IPW_NDATA; i++) {
476		shdr = &sc->shdr_list[i];
477		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
478		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
479		if (error != 0) {
480			printf("%s: could not create header DMA map\n",
481			    sc->sc_dev.dv_xname);
482			goto fail;
483		}
484		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
485	}
486
487	/*
488	 * Allocate tx buffers DMA maps.
489	 */
490	SLIST_INIT(&sc->free_sbuf);
491	for (i = 0; i < IPW_NDATA; i++) {
492		sbuf = &sc->tx_sbuf_list[i];
493		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
494		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
495		if (error != 0) {
496			printf("%s: could not create tx DMA map\n",
497			    sc->sc_dev.dv_xname);
498			goto fail;
499		}
500		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
501	}
502
503	/*
504	 * Initialize tx ring.
505	 */
506	for (i = 0; i < IPW_NTBD; i++) {
507		sbd = &sc->stbd_list[i];
508		sbd->bd = &sc->tbd_list[i];
509		sbd->type = IPW_SBD_TYPE_NOASSOC;
510	}
511
512	/*
513	 * Pre-allocate rx buffers and DMA maps.
514	 */
515	for (i = 0; i < IPW_NRBD; i++) {
516		sbd = &sc->srbd_list[i];
517		sbuf = &sc->rx_sbuf_list[i];
518		sbd->bd = &sc->rbd_list[i];
519
520		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
521		if (sbuf->m == NULL) {
522			printf("%s: could not allocate rx mbuf\n",
523			    sc->sc_dev.dv_xname);
524			error = ENOMEM;
525			goto fail;
526		}
527
528		MCLGET(sbuf->m, M_DONTWAIT);
529		if (!(sbuf->m->m_flags & M_EXT)) {
530			m_freem(sbuf->m);
531			printf("%s: could not allocate rx mbuf cluster\n",
532			    sc->sc_dev.dv_xname);
533			error = ENOMEM;
534			goto fail;
535		}
536
537		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
538		    0, BUS_DMA_NOWAIT, &sbuf->map);
539		if (error != 0) {
540			printf("%s: could not create rx DMA map\n",
541			    sc->sc_dev.dv_xname);
542			goto fail;
543		}
544
545		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
546		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
547		if (error != 0) {
548			printf("%s: could not map rx DMA memory\n",
549			    sc->sc_dev.dv_xname);
550			goto fail;
551		}
552
553		sbd->type = IPW_SBD_TYPE_DATA;
554		sbd->priv = sbuf;
555		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
556		sbd->bd->len = htole32(MCLBYTES);
557	}
558
559	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
560	    BUS_DMASYNC_PREWRITE);
561
562	return 0;
563
564fail:	ipw_release(sc);
565	return error;
566}
567
568void
569ipw_release(struct ipw_softc *sc)
570{
571	struct ipw_soft_buf *sbuf;
572	int i;
573
574	if (sc->tbd_map != NULL) {
575		if (sc->tbd_list != NULL) {
576			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
577			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
578			    IPW_TBD_SZ);
579			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
580		}
581		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
582	}
583
584	if (sc->rbd_map != NULL) {
585		if (sc->rbd_list != NULL) {
586			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
587			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
588			    IPW_RBD_SZ);
589			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
590		}
591		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
592	}
593
594	if (sc->status_map != NULL) {
595		if (sc->status_list != NULL) {
596			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
597			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
598			    IPW_RBD_SZ);
599			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
600		}
601		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
602	}
603
604	if (sc->cmd_map != NULL)
605		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
606
607	for (i = 0; i < IPW_NDATA; i++)
608		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
609
610	for (i = 0; i < IPW_NDATA; i++)
611		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
612
613	for (i = 0; i < IPW_NRBD; i++) {
614		sbuf = &sc->rx_sbuf_list[i];
615		if (sbuf->map != NULL) {
616			if (sbuf->m != NULL) {
617				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
618				m_freem(sbuf->m);
619			}
620			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
621		}
622	}
623}
624
625int
626ipw_media_change(struct ifnet *ifp)
627{
628	int error;
629
630	error = ieee80211_media_change(ifp);
631	if (error != ENETRESET)
632		return error;
633
634	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
635		ipw_init(ifp);
636
637	return 0;
638}
639
640void
641ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
642{
643#define N(a)	(sizeof (a) / sizeof (a[0]))
644	struct ipw_softc *sc = ifp->if_softc;
645	struct ieee80211com *ic = &sc->sc_ic;
646	static const struct {
647		uint32_t	val;
648		int		rate;
649	} rates[] = {
650		{ IPW_RATE_DS1,   2 },
651		{ IPW_RATE_DS2,   4 },
652		{ IPW_RATE_DS5,  11 },
653		{ IPW_RATE_DS11, 22 },
654	};
655	uint32_t val;
656	int rate, i;
657
658	imr->ifm_status = IFM_AVALID;
659	imr->ifm_active = IFM_IEEE80211;
660	if (ic->ic_state == IEEE80211_S_RUN)
661		imr->ifm_status |= IFM_ACTIVE;
662
663	/* read current transmission rate from adapter */
664	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
665	val &= 0xf;
666
667	/* convert rate to 802.11 rate */
668	for (i = 0; i < N(rates) && rates[i].val != val; i++);
669	rate = (i < N(rates)) ? rates[i].rate : 0;
670
671	imr->ifm_active |= IFM_IEEE80211_11B;
672	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
673	switch (ic->ic_opmode) {
674	case IEEE80211_M_STA:
675		break;
676
677	case IEEE80211_M_IBSS:
678		imr->ifm_active |= IFM_IEEE80211_IBSS;
679		break;
680
681	case IEEE80211_M_MONITOR:
682		imr->ifm_active |= IFM_IEEE80211_MONITOR;
683		break;
684
685	case IEEE80211_M_AHDEMO:
686	case IEEE80211_M_HOSTAP:
687		/* should not get there */
688		break;
689	}
690#undef N
691}
692
693int
694ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
695{
696	struct ipw_softc *sc = ic->ic_softc;
697	struct ieee80211_node *ni;
698	uint8_t macaddr[IEEE80211_ADDR_LEN];
699	uint32_t len;
700
701	switch (nstate) {
702	case IEEE80211_S_RUN:
703		DELAY(100);	/* firmware needs a short delay here */
704
705		len = IEEE80211_ADDR_LEN;
706		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, macaddr, &len);
707
708		ni = ieee80211_find_node(ic, macaddr);
709		if (ni == NULL)
710			break;
711
712		(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
713		ieee80211_node_newstate(ni, IEEE80211_STA_BSS);
714		break;
715
716	case IEEE80211_S_INIT:
717	case IEEE80211_S_SCAN:
718	case IEEE80211_S_AUTH:
719	case IEEE80211_S_ASSOC:
720		break;
721	}
722
723	ic->ic_state = nstate;
724	return 0;
725}
726
727/*
728 * Read 16 bits at address 'addr' from the Microwire EEPROM.
729 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
730 */
731uint16_t
732ipw_read_prom_word(struct ipw_softc *sc, uint8_t addr)
733{
734	uint32_t tmp;
735	uint16_t val;
736	int n;
737
738	/* clock C once before the first command */
739	IPW_EEPROM_CTL(sc, 0);
740	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
741	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
742	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
743
744	/* write start bit (1) */
745	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
746	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
747
748	/* write READ opcode (10) */
749	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
750	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
751	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
752	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
753
754	/* write address A7-A0 */
755	for (n = 7; n >= 0; n--) {
756		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
757		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
758		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
759		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
760	}
761
762	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
763
764	/* read data Q15-Q0 */
765	val = 0;
766	for (n = 15; n >= 0; n--) {
767		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
768		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
769		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
770		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
771	}
772
773	IPW_EEPROM_CTL(sc, 0);
774
775	/* clear Chip Select and clock C */
776	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
777	IPW_EEPROM_CTL(sc, 0);
778	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
779
780	return val;
781}
782
783void
784ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
785{
786	struct ipw_cmd *cmd;
787
788	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
789	    BUS_DMASYNC_POSTREAD);
790
791	cmd = mtod(sbuf->m, struct ipw_cmd *);
792
793	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
794	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
795	    letoh32(cmd->len), letoh32(cmd->status)));
796
797	wakeup(sc);
798}
799
800void
801ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
802{
803	struct ieee80211com *ic = &sc->sc_ic;
804	struct ifnet *ifp = &ic->ic_if;
805	uint32_t state;
806
807	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
808	    BUS_DMASYNC_POSTREAD);
809
810	state = letoh32(*mtod(sbuf->m, uint32_t *));
811
812	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
813
814	switch (state) {
815	case IPW_STATE_ASSOCIATED:
816		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
817		break;
818
819	case IPW_STATE_SCANNING:
820		/* don't leave run state on background scan */
821		if (ic->ic_state != IEEE80211_S_RUN)
822			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
823
824		ic->ic_flags |= IEEE80211_F_ASCAN;
825		break;
826
827	case IPW_STATE_SCAN_COMPLETE:
828		ic->ic_flags &= ~IEEE80211_F_ASCAN;
829		break;
830
831	case IPW_STATE_ASSOCIATION_LOST:
832		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
833		break;
834
835	case IPW_STATE_RADIO_DISABLED:
836		ifp->if_flags &= ~IFF_UP;
837		ipw_stop(&ic->ic_if, 1);
838		break;
839	}
840}
841
842void
843ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
844    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
845{
846	struct ieee80211com *ic = &sc->sc_ic;
847	struct ifnet *ifp = &ic->ic_if;
848	struct mbuf *mnew, *m;
849	struct ieee80211_frame *wh;
850	struct ieee80211_node *ni;
851	int error;
852
853	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
854
855	/*
856	 * Try to allocate a new mbuf for this ring element and load it before
857	 * processing the current mbuf.  If the ring element cannot be loaded,
858	 * drop the received packet and reuse the old mbuf.  In the unlikely
859	 * case that the old mbuf can't be reloaded either, explicitly panic.
860	 */
861	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
862	if (mnew == NULL) {
863		ifp->if_ierrors++;
864		return;
865	}
866
867	MCLGET(mnew, M_DONTWAIT);
868	if (!(mnew->m_flags & M_EXT)) {
869		m_freem(mnew);
870		ifp->if_ierrors++;
871		return;
872	}
873
874	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
875	    BUS_DMASYNC_POSTREAD);
876	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
877
878	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(mnew, void *),
879	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
880	if (error != 0) {
881		m_freem(mnew);
882
883		/* try to reload the old mbuf */
884		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
885		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
886		if (error != 0) {
887			/* very unlikely that it will fail... */
888			panic("%s: could not load old rx mbuf",
889			    sc->sc_dev.dv_xname);
890		}
891		ifp->if_ierrors++;
892		return;
893	}
894
895	m = sbuf->m;
896	sbuf->m = mnew;
897	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
898
899	/* finalize mbuf */
900	m->m_pkthdr.rcvif = ifp;
901	m->m_pkthdr.len = m->m_len = letoh32(status->len);
902
903#if NBPFILTER > 0
904	if (sc->sc_drvbpf != NULL) {
905		struct mbuf mb;
906		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
907
908		tap->wr_flags = 0;
909		tap->wr_antsignal = status->rssi;
910		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
911		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
912
913		M_DUP_PKTHDR(&mb, m);
914		mb.m_data = (caddr_t)tap;
915		mb.m_len = sc->sc_rxtap_len;
916		mb.m_next = m;
917		mb.m_pkthdr.len += mb.m_len;
918		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
919	}
920#endif
921
922	wh = mtod(m, struct ieee80211_frame *);
923
924	ni = ieee80211_find_rxnode(ic, wh);
925
926	/* send the frame to the upper layer */
927	ieee80211_input(ifp, m, ni, status->rssi, 0);
928
929	ieee80211_release_node(ic, ni);
930}
931
932void
933ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
934{
935	DPRINTFN(2, ("RX!NOTIFICATION\n"));
936}
937
938void
939ipw_rx_intr(struct ipw_softc *sc)
940{
941	struct ipw_status *status;
942	struct ipw_soft_bd *sbd;
943	struct ipw_soft_buf *sbuf;
944	uint32_t r, i;
945
946	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
947
948	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
949
950		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
951		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
952		    BUS_DMASYNC_POSTREAD);
953
954		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
955		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
956		    BUS_DMASYNC_POSTREAD);
957
958		status = &sc->status_list[i];
959		sbd = &sc->srbd_list[i];
960		sbuf = sbd->priv;
961
962		switch (letoh16(status->code) & 0xf) {
963		case IPW_STATUS_CODE_COMMAND:
964			ipw_command_intr(sc, sbuf);
965			break;
966
967		case IPW_STATUS_CODE_NEWSTATE:
968			ipw_newstate_intr(sc, sbuf);
969			break;
970
971		case IPW_STATUS_CODE_DATA_802_3:
972		case IPW_STATUS_CODE_DATA_802_11:
973			ipw_data_intr(sc, status, sbd, sbuf);
974			break;
975
976		case IPW_STATUS_CODE_NOTIFICATION:
977			ipw_notification_intr(sc, sbuf);
978			break;
979
980		default:
981			printf("%s: unknown status code %u\n",
982			    sc->sc_dev.dv_xname, letoh16(status->code));
983		}
984		sbd->bd->flags = 0;
985
986		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
987		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
988		    BUS_DMASYNC_PREWRITE);
989	}
990
991	/* tell the firmware what we have processed */
992	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
993	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
994}
995
996void
997ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
998{
999	struct ieee80211com *ic = &sc->sc_ic;
1000	struct ipw_soft_hdr *shdr;
1001	struct ipw_soft_buf *sbuf;
1002
1003	switch (sbd->type) {
1004	case IPW_SBD_TYPE_COMMAND:
1005		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
1006		break;
1007
1008	case IPW_SBD_TYPE_HEADER:
1009		shdr = sbd->priv;
1010		bus_dmamap_unload(sc->sc_dmat, shdr->map);
1011		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
1012		break;
1013
1014	case IPW_SBD_TYPE_DATA:
1015		sbuf = sbd->priv;
1016		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1017		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
1018
1019		m_freem(sbuf->m);
1020
1021		if (sbuf->ni != NULL)
1022			ieee80211_release_node(ic, sbuf->ni);
1023
1024		/* kill watchdog timer */
1025		sc->sc_tx_timer = 0;
1026		break;
1027	}
1028	sbd->type = IPW_SBD_TYPE_NOASSOC;
1029}
1030
1031void
1032ipw_tx_intr(struct ipw_softc *sc)
1033{
1034	struct ifnet *ifp = &sc->sc_ic.ic_if;
1035	struct ipw_soft_bd *sbd;
1036	uint32_t r, i;
1037
1038	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1039
1040	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1041		sbd = &sc->stbd_list[i];
1042
1043		if (sbd->type == IPW_SBD_TYPE_DATA)
1044			ifp->if_opackets++;
1045
1046		ipw_release_sbd(sc, sbd);
1047		sc->txfree++;
1048	}
1049
1050	/* remember what the firmware has processed */
1051	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1052
1053	/* call start() since some buffer descriptors have been released */
1054	ifp->if_flags &= ~IFF_OACTIVE;
1055	(*ifp->if_start)(ifp);
1056}
1057
1058int
1059ipw_intr(void *arg)
1060{
1061	struct ipw_softc *sc = arg;
1062	struct ifnet *ifp = &sc->sc_ic.ic_if;
1063	uint32_t r;
1064
1065	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1066		return 0;
1067
1068	/* disable interrupts */
1069	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1070
1071	DPRINTFN(8, ("INTR!0x%08x\n", r));
1072
1073	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1074		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1075		ifp->if_flags &= ~IFF_UP;
1076		ipw_stop(ifp, 1);
1077		return 1;
1078	}
1079
1080	if (r & IPW_INTR_FW_INIT_DONE)
1081		wakeup(sc);
1082
1083	if (r & IPW_INTR_RX_TRANSFER)
1084		ipw_rx_intr(sc);
1085
1086	if (r & IPW_INTR_TX_TRANSFER)
1087		ipw_tx_intr(sc);
1088
1089	/* acknowledge interrupts */
1090	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1091
1092	/* re-enable interrupts */
1093	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1094
1095	return 1;
1096}
1097
1098int
1099ipw_cmd(struct ipw_softc *sc, uint32_t type, void *data, uint32_t len)
1100{
1101	struct ipw_soft_bd *sbd;
1102	int error;
1103
1104	sbd = &sc->stbd_list[sc->txcur];
1105
1106	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1107	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1108	if (error != 0) {
1109		printf("%s: could not map command DMA memory\n",
1110		    sc->sc_dev.dv_xname);
1111		return error;
1112	}
1113
1114	sc->cmd.type = htole32(type);
1115	sc->cmd.subtype = htole32(0);
1116	sc->cmd.len = htole32(len);
1117	sc->cmd.seq = htole32(0);
1118	if (data != NULL)
1119		bcopy(data, sc->cmd.data, len);
1120
1121	sbd->type = IPW_SBD_TYPE_COMMAND;
1122	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1123	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1124	sbd->bd->nfrag = 1;
1125	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1126	    IPW_BD_FLAG_TX_LAST_FRAGMENT;
1127
1128	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1129	    BUS_DMASYNC_PREWRITE);
1130
1131	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1132	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1133	    BUS_DMASYNC_PREWRITE);
1134
1135	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1136	sc->txfree--;
1137	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1138
1139	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1140
1141	/* wait at most one second for command to complete */
1142	return tsleep(sc, 0, "ipwcmd", hz);
1143}
1144
1145int
1146ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1147{
1148	struct ipw_softc *sc = ifp->if_softc;
1149	struct ieee80211com *ic = &sc->sc_ic;
1150	struct ieee80211_frame *wh;
1151	struct ipw_soft_bd *sbd;
1152	struct ipw_soft_hdr *shdr;
1153	struct ipw_soft_buf *sbuf;
1154	struct mbuf *mnew;
1155	int error, i;
1156
1157	wh = mtod(m, struct ieee80211_frame *);
1158
1159	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1160		m = ieee80211_wep_crypt(ifp, m, 1);
1161		if (m == NULL)
1162			return ENOBUFS;
1163
1164		/* packet header may have moved, reset our local pointer */
1165		wh = mtod(m, struct ieee80211_frame *);
1166	}
1167
1168#if NBPFILTER > 0
1169	if (sc->sc_drvbpf != NULL) {
1170		struct mbuf mb;
1171		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1172
1173		tap->wt_flags = 0;
1174		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1175		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1176
1177		M_DUP_PKTHDR(&mb, m);
1178		mb.m_data = (caddr_t)tap;
1179		mb.m_len = sc->sc_txtap_len;
1180		mb.m_next = m;
1181		mb.m_pkthdr.len += mb.m_len;
1182		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1183	}
1184#endif
1185
1186	shdr = SLIST_FIRST(&sc->free_shdr);
1187	sbuf = SLIST_FIRST(&sc->free_sbuf);
1188
1189	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1190	shdr->hdr.subtype = htole32(0);
1191	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
1192	shdr->hdr.encrypt = 0;
1193	shdr->hdr.keyidx = 0;
1194	shdr->hdr.keysz = 0;
1195	shdr->hdr.fragmentsz = htole16(0);
1196	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1197	if (ic->ic_opmode == IEEE80211_M_STA)
1198		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1199	else
1200		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1201
1202	/* trim IEEE802.11 header */
1203	m_adj(m, sizeof (struct ieee80211_frame));
1204
1205	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1206	if (error != 0 && error != EFBIG) {
1207		printf("%s: could not map mbuf (error %d)\n",
1208		    sc->sc_dev.dv_xname, error);
1209		m_freem(m);
1210		return error;
1211	}
1212	if (error != 0) {
1213		/* too many fragments, linearize */
1214
1215		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1216		if (mnew == NULL) {
1217			m_freem(m);
1218			return ENOMEM;
1219		}
1220
1221		M_DUP_PKTHDR(mnew, m);
1222		if (m->m_pkthdr.len > MHLEN) {
1223			MCLGET(mnew, M_DONTWAIT);
1224			if (!(mnew->m_flags & M_EXT)) {
1225				m_freem(m);
1226				m_freem(mnew);
1227				return ENOMEM;
1228			}
1229		}
1230
1231		m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew, caddr_t));
1232		m_freem(m);
1233		mnew->m_len = mnew->m_pkthdr.len;
1234		m = mnew;
1235
1236		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1237		    BUS_DMA_NOWAIT);
1238		if (error != 0) {
1239			printf("%s: could not map mbuf (error %d)\n",
1240			    sc->sc_dev.dv_xname, error);
1241			m_freem(m);
1242			return error;
1243		}
1244	}
1245
1246	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1247	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1248	if (error != 0) {
1249		printf("%s: could not map header DMA memory (error %d)\n",
1250		    sc->sc_dev.dv_xname, error);
1251		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1252		m_freem(m);
1253		return error;
1254	}
1255
1256	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1257	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1258
1259	sbd = &sc->stbd_list[sc->txcur];
1260	sbd->type = IPW_SBD_TYPE_HEADER;
1261	sbd->priv = shdr;
1262	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1263	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1264	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1265	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1266			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1267
1268	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1269	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1270	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1271	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1272
1273	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1274	    sc->txcur * sizeof (struct ipw_bd),
1275	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1276
1277	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1278	sc->txfree--;
1279
1280	sbuf->m = m;
1281	sbuf->ni = ni;
1282
1283	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1284		sbd = &sc->stbd_list[sc->txcur];
1285		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1286		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1287		sbd->bd->nfrag = 0;	/* used only in first bd */
1288		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1289		if (i == sbuf->map->dm_nsegs - 1) {
1290			sbd->type = IPW_SBD_TYPE_DATA;
1291			sbd->priv = sbuf;
1292			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1293		} else {
1294			sbd->type = IPW_SBD_TYPE_NOASSOC;
1295			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1296		}
1297
1298		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1299		    sbuf->map->dm_segs[i].ds_len));
1300
1301		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1302		    sc->txcur * sizeof (struct ipw_bd),
1303		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1304
1305		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1306		sc->txfree--;
1307	}
1308
1309	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1310	    BUS_DMASYNC_PREWRITE);
1311
1312	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
1313	    BUS_DMASYNC_PREWRITE);
1314
1315	/* inform firmware about this new packet */
1316	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1317
1318	return 0;
1319}
1320
1321void
1322ipw_start(struct ifnet *ifp)
1323{
1324	struct ipw_softc *sc = ifp->if_softc;
1325	struct ieee80211com *ic = &sc->sc_ic;
1326	struct mbuf *m;
1327	struct ieee80211_node *ni;
1328
1329	if (ic->ic_state != IEEE80211_S_RUN)
1330		return;
1331
1332	for (;;) {
1333		IF_DEQUEUE(&ifp->if_snd, m);
1334		if (m == NULL)
1335			break;
1336
1337		if (sc->txfree < 1 + IPW_MAX_NSEG) {
1338			IF_PREPEND(&ifp->if_snd, m);
1339			ifp->if_flags |= IFF_OACTIVE;
1340			break;
1341		}
1342
1343#if NBPFILTER > 0
1344		if (ifp->if_bpf != NULL)
1345			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1346#endif
1347
1348		m = ieee80211_encap(ifp, m, &ni);
1349		if (m == NULL)
1350			continue;
1351
1352#if NBPFILTER > 0
1353		if (ic->ic_rawbpf != NULL)
1354			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1355#endif
1356
1357		if (ipw_tx_start(ifp, m, ni) != 0) {
1358			if (ni != NULL)
1359				ieee80211_release_node(ic, ni);
1360			ifp->if_oerrors++;
1361			break;
1362		}
1363
1364		/* start watchdog timer */
1365		sc->sc_tx_timer = 5;
1366		ifp->if_timer = 1;
1367	}
1368}
1369
1370void
1371ipw_watchdog(struct ifnet *ifp)
1372{
1373	struct ipw_softc *sc = ifp->if_softc;
1374
1375	ifp->if_timer = 0;
1376
1377	if (sc->sc_tx_timer > 0) {
1378		if (--sc->sc_tx_timer == 0) {
1379			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1380			ifp->if_flags &= ~IFF_UP;
1381			ipw_stop(ifp, 1);
1382			ifp->if_oerrors++;
1383			return;
1384		}
1385		ifp->if_timer = 1;
1386	}
1387
1388	ieee80211_watchdog(ifp);
1389}
1390
1391int
1392ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1393{
1394	struct ipw_softc *sc = ifp->if_softc;
1395	struct ieee80211com *ic = &sc->sc_ic;
1396	struct ifaddr *ifa;
1397	struct ifreq *ifr;
1398	int s, error = 0;
1399
1400	s = splnet();
1401
1402	switch (cmd) {
1403	case SIOCSIFADDR:
1404		ifa = (struct ifaddr *)data;
1405		ifp->if_flags |= IFF_UP;
1406#ifdef INET
1407		if (ifa->ifa_addr->sa_family == AF_INET)
1408			arp_ifinit(&ic->ic_ac, ifa);
1409#endif
1410		/* FALLTHROUGH */
1411	case SIOCSIFFLAGS:
1412		if (ifp->if_flags & IFF_UP) {
1413			if (!(ifp->if_flags & IFF_RUNNING))
1414				ipw_init(ifp);
1415		} else {
1416			if (ifp->if_flags & IFF_RUNNING)
1417				ipw_stop(ifp, 1);
1418		}
1419		break;
1420
1421	case SIOCADDMULTI:
1422	case SIOCDELMULTI:
1423		ifr = (struct ifreq *)data;
1424		error = (cmd == SIOCADDMULTI) ?
1425		    ether_addmulti(ifr, &ic->ic_ac) :
1426		    ether_delmulti(ifr, &ic->ic_ac);
1427
1428		if (error == ENETRESET)
1429			error = 0;
1430		break;
1431
1432	case SIOCG80211TXPOWER:
1433		/*
1434		 * If the hardware radio transmitter switch is off, report a
1435		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1436		 * transmitter is killed.
1437		 */
1438		((struct ieee80211_txpower *)data)->i_val =
1439		    (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ?
1440		    IEEE80211_TXPOWER_MIN : sc->sc_ic.ic_txpower;
1441		break;
1442
1443	default:
1444		error = ieee80211_ioctl(ifp, cmd, data);
1445	}
1446
1447	if (error == ENETRESET) {
1448		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1449		    (IFF_UP | IFF_RUNNING))
1450			ipw_init(ifp);
1451		error = 0;
1452	}
1453
1454	splx(s);
1455	return error;
1456}
1457
1458uint32_t
1459ipw_read_table1(struct ipw_softc *sc, uint32_t off)
1460{
1461	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1462}
1463
1464void
1465ipw_write_table1(struct ipw_softc *sc, uint32_t off, uint32_t info)
1466{
1467	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1468}
1469
1470int
1471ipw_read_table2(struct ipw_softc *sc, uint32_t off, void *buf, uint32_t *len)
1472{
1473	uint32_t addr, info;
1474	uint16_t count, size;
1475	uint32_t total;
1476
1477	/* addr[4] + count[2] + size[2] */
1478	addr = MEM_READ_4(sc, sc->table2_base + off);
1479	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1480
1481	count = info >> 16;
1482	size = info & 0xffff;
1483	total = count * size;
1484
1485	if (total > *len) {
1486		*len = total;
1487		return EINVAL;
1488	}
1489
1490	*len = total;
1491	ipw_read_mem_1(sc, addr, buf, total);
1492
1493	return 0;
1494}
1495
1496void
1497ipw_stop_master(struct ipw_softc *sc)
1498{
1499	int ntries;
1500
1501	/* disable interrupts */
1502	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1503
1504	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1505	for (ntries = 0; ntries < 50; ntries++) {
1506		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1507			break;
1508		DELAY(10);
1509	}
1510	if (ntries == 50)
1511		printf("%s: timeout waiting for master\n",
1512		    sc->sc_dev.dv_xname);
1513
1514	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1515	    IPW_RST_PRINCETON_RESET);
1516
1517	sc->flags &= ~IPW_FLAG_FW_INITED;
1518}
1519
1520int
1521ipw_reset(struct ipw_softc *sc)
1522{
1523	int ntries;
1524
1525	ipw_stop_master(sc);
1526
1527	/* move adapter to D0 state */
1528	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1529	    IPW_CTL_INIT);
1530
1531	/* wait for clock stabilization */
1532	for (ntries = 0; ntries < 1000; ntries++) {
1533		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1534			break;
1535		DELAY(200);
1536	}
1537	if (ntries == 1000)
1538		return EIO;
1539
1540	CSR_WRITE_4(sc, IPW_CSR_RST, CSR_READ_4(sc, IPW_CSR_RST) |
1541	    IPW_RST_SW_RESET);
1542
1543	DELAY(10);
1544
1545	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1546	    IPW_CTL_INIT);
1547
1548	return 0;
1549}
1550
1551int
1552ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1553{
1554	int ntries;
1555
1556	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1557	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1558
1559	MEM_WRITE_2(sc, 0x220000, 0x0703);
1560	MEM_WRITE_2(sc, 0x220000, 0x0707);
1561
1562	MEM_WRITE_1(sc, 0x210014, 0x72);
1563	MEM_WRITE_1(sc, 0x210014, 0x72);
1564
1565	MEM_WRITE_1(sc, 0x210000, 0x40);
1566	MEM_WRITE_1(sc, 0x210000, 0x00);
1567	MEM_WRITE_1(sc, 0x210000, 0x40);
1568
1569	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1570
1571	MEM_WRITE_1(sc, 0x210000, 0x00);
1572	MEM_WRITE_1(sc, 0x210000, 0x00);
1573	MEM_WRITE_1(sc, 0x210000, 0x80);
1574
1575	MEM_WRITE_2(sc, 0x220000, 0x0703);
1576	MEM_WRITE_2(sc, 0x220000, 0x0707);
1577
1578	MEM_WRITE_1(sc, 0x210014, 0x72);
1579	MEM_WRITE_1(sc, 0x210014, 0x72);
1580
1581	MEM_WRITE_1(sc, 0x210000, 0x00);
1582	MEM_WRITE_1(sc, 0x210000, 0x80);
1583
1584	for (ntries = 0; ntries < 100; ntries++) {
1585		if (MEM_READ_1(sc, 0x210000) & 1)
1586			break;
1587		DELAY(1000);
1588	}
1589	if (ntries == 100) {
1590		printf("%s: timeout waiting for ucode to initialize\n",
1591		    sc->sc_dev.dv_xname);
1592		return EIO;
1593	}
1594
1595	MEM_WRITE_4(sc, 0x3000e0, 0);
1596
1597	return 0;
1598}
1599
1600/* set of macros to handle unaligned little endian data in firmware image */
1601#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1602#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1603int
1604ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1605{
1606	u_char *p, *end;
1607	uint32_t dst;
1608	uint16_t len;
1609	int error;
1610
1611	p = fw;
1612	end = fw + size;
1613	while (p < end) {
1614		if (p + 6 > end)
1615			return EINVAL;
1616
1617		dst = GETLE32(p); p += 4;
1618		len = GETLE16(p); p += 2;
1619
1620		if (p + len > end)
1621			return EINVAL;
1622
1623		ipw_write_mem_1(sc, dst, p, len);
1624		p += len;
1625	}
1626
1627	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1628	    IPW_IO_LED_OFF);
1629
1630	/* allow interrupts so we know when the firmware is inited */
1631	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1632
1633	/* tell the adapter to initialize the firmware */
1634	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1635	CSR_WRITE_4(sc, IPW_CSR_CTL, CSR_READ_4(sc, IPW_CSR_CTL) |
1636	    IPW_CTL_ALLOW_STANDBY);
1637
1638	/* wait at most one second for firmware initialization to complete */
1639	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1640		printf("%s: timeout waiting for firmware initialization to "
1641		    "complete\n", sc->sc_dev.dv_xname);
1642		return error;
1643	}
1644
1645	CSR_WRITE_4(sc, IPW_CSR_IO, CSR_READ_4(sc, IPW_CSR_IO) |
1646	    IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1647
1648	return 0;
1649}
1650
1651int
1652ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1653{
1654	struct ipw_firmware_hdr *hdr;
1655	const char *name;
1656	u_char *p;
1657	size_t size;
1658	int error;
1659
1660	switch (sc->sc_ic.ic_opmode) {
1661	case IEEE80211_M_STA:
1662	case IEEE80211_M_HOSTAP:
1663		name = "ipw-bss";
1664		break;
1665
1666	case IEEE80211_M_IBSS:
1667	case IEEE80211_M_AHDEMO:
1668		name = "ipw-ibss";
1669		break;
1670
1671	case IEEE80211_M_MONITOR:
1672		name = "ipw-monitor";
1673		break;
1674	}
1675
1676	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1677		return error;
1678
1679	if (size < sizeof (struct ipw_firmware_hdr)) {
1680		error = EINVAL;
1681		goto fail;
1682	}
1683
1684	p = fw->data;
1685	hdr = (struct ipw_firmware_hdr *)p;
1686	fw->main_size = letoh32(hdr->main_size);
1687	fw->ucode_size = letoh32(hdr->ucode_size);
1688
1689	p += sizeof (struct ipw_firmware_hdr);
1690	size -= sizeof (struct ipw_firmware_hdr);
1691
1692	if (size < fw->main_size + fw->ucode_size) {
1693		error = EINVAL;
1694		goto fail;
1695	}
1696
1697	fw->main = p;
1698	fw->ucode = p + fw->main_size;
1699
1700	return 0;
1701
1702fail:	free(fw->data, M_DEVBUF);
1703	return error;
1704}
1705
1706int
1707ipw_config(struct ipw_softc *sc)
1708{
1709	struct ieee80211com *ic = &sc->sc_ic;
1710	struct ifnet *ifp = &ic->ic_if;
1711	struct ipw_security security;
1712	struct ieee80211_wepkey *k;
1713	struct ipw_wep_key wepkey;
1714	struct ipw_scan_options options;
1715	struct ipw_configuration config;
1716	uint32_t data;
1717	int error, i;
1718
1719	switch (ic->ic_opmode) {
1720	case IEEE80211_M_STA:
1721	case IEEE80211_M_HOSTAP:
1722		data = htole32(IPW_MODE_BSS);
1723		break;
1724
1725	case IEEE80211_M_IBSS:
1726	case IEEE80211_M_AHDEMO:
1727		data = htole32(IPW_MODE_IBSS);
1728		break;
1729
1730	case IEEE80211_M_MONITOR:
1731		data = htole32(IPW_MODE_MONITOR);
1732		break;
1733	}
1734	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1735	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1736	if (error != 0)
1737		return error;
1738
1739	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1740	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1741		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1742		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1743		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1744		if (error != 0)
1745			return error;
1746	}
1747
1748	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1749		DPRINTF(("Enabling adapter\n"));
1750		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1751	}
1752
1753	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1754	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1755	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1756	    IEEE80211_ADDR_LEN);
1757	if (error != 0)
1758		return error;
1759
1760	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1761	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1762	if (ic->ic_opmode == IEEE80211_M_IBSS)
1763		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1764	if (ifp->if_flags & IFF_PROMISC)
1765		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1766	config.bss_chan = htole32(0x3fff);	/* channels 1-14 */
1767	config.ibss_chan = htole32(0x7ff);	/* channels 1-11 */
1768	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1769	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1770	if (error != 0)
1771		return error;
1772
1773	data = htole32(0x3);	/* 1, 2 */
1774	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1775	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1776	if (error != 0)
1777		return error;
1778
1779	data = htole32(0xf);	/* 1, 2, 5.5, 11 */
1780	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1781	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1782	if (error != 0)
1783		return error;
1784
1785	data = htole32(IPW_POWER_MODE_CAM);
1786	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1787	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1788	if (error != 0)
1789		return error;
1790
1791	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1792		data = htole32(32);	/* default value */
1793		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1794		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1795		    sizeof data);
1796		if (error != 0)
1797			return error;
1798	}
1799
1800	data = htole32(ic->ic_rtsthreshold);
1801	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1802	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1803	if (error != 0)
1804		return error;
1805
1806	data = htole32(ic->ic_fragthreshold);
1807	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1808	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1809	if (error != 0)
1810		return error;
1811
1812#ifdef IPW_DEBUG
1813	if (ipw_debug > 0) {
1814		printf("Setting ESSID to ");
1815		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1816		printf("\n");
1817	}
1818#endif
1819	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1820	    ic->ic_des_esslen);
1821	if (error != 0)
1822		return error;
1823
1824	/* no mandatory BSSID */
1825	DPRINTF(("Setting mandatory BSSID to null\n"));
1826	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1827	if (error != 0)
1828		return error;
1829
1830	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1831		DPRINTF(("Setting adapter BSSID to %s\n",
1832		    ether_sprintf(ic->ic_des_bssid)));
1833		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1834		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1835		if (error != 0)
1836			return error;
1837	}
1838
1839	bzero(&security, sizeof security);
1840	security.authmode = IPW_AUTH_OPEN;	/* XXX shared mode */
1841	security.ciphers = htole32(IPW_CIPHER_NONE);
1842	DPRINTF(("Setting authmode to %u\n", security.authmode));
1843	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1844	    sizeof security);
1845	if (error != 0)
1846		return error;
1847
1848	if (ic->ic_flags & IEEE80211_F_WEPON) {
1849		k = ic->ic_nw_keys;
1850		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1851			if (k->wk_len == 0)
1852				continue;
1853
1854			wepkey.idx = i;
1855			wepkey.len = k->wk_len;
1856			bzero(wepkey.key, sizeof wepkey.key);
1857			bcopy(k->wk_key, wepkey.key, k->wk_len);
1858			DPRINTF(("Setting wep key index %u len %u\n",
1859			    wepkey.idx, wepkey.len));
1860			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1861			    sizeof wepkey);
1862			if (error != 0)
1863				return error;
1864		}
1865
1866		data = htole32(ic->ic_wep_txkey);
1867		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1868		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1869		    sizeof data);
1870		if (error != 0)
1871			return error;
1872	}
1873
1874	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1875	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1876	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1877	if (error != 0)
1878		return error;
1879
1880	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1881	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1882		data = htole32(ic->ic_lintval);
1883		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1884		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1885		    sizeof data);
1886		if (error != 0)
1887			return error;
1888	}
1889
1890	options.flags = htole32(0);
1891	options.channels = htole32(0x3fff);	/* scan channels 1-14 */
1892	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1893	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1894	if (error != 0)
1895		return error;
1896
1897	/* finally, enable adapter (start scanning for an access point) */
1898	DPRINTF(("Enabling adapter\n"));
1899	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1900}
1901
1902int
1903ipw_init(struct ifnet *ifp)
1904{
1905	struct ipw_softc *sc = ifp->if_softc;
1906	struct ipw_firmware fw;
1907	int error;
1908
1909	ipw_stop(ifp, 0);
1910
1911	if ((error = ipw_reset(sc)) != 0) {
1912		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1913		goto fail1;
1914	}
1915
1916	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1917		printf("%s: could not read firmware\n", sc->sc_dev.dv_xname);
1918		goto fail1;
1919	}
1920
1921	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1922		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1923		goto fail2;
1924	}
1925
1926	ipw_stop_master(sc);
1927
1928	/*
1929	 * Setup tx, rx and status rings.
1930	 */
1931	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1932	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1933	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1934	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1935	sc->txold = IPW_NTBD - 1;	/* latest bd index ack by firmware */
1936	sc->txcur = 0; /* bd index to write to */
1937	sc->txfree = IPW_NTBD - 2;
1938
1939	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1940	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1941	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1942	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1943	sc->rxcur = IPW_NRBD - 1;	/* latest bd index I've read */
1944
1945	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1946	    sc->status_map->dm_segs[0].ds_addr);
1947
1948	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1949		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1950		goto fail2;
1951	}
1952
1953	sc->flags |= IPW_FLAG_FW_INITED;
1954
1955	/* retrieve information tables base addresses */
1956	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1957	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1958
1959	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1960
1961	if ((error = ipw_config(sc)) != 0) {
1962		printf("%s: device configuration failed\n",
1963		    sc->sc_dev.dv_xname);
1964		goto fail2;
1965	}
1966
1967	ifp->if_flags &= ~IFF_OACTIVE;
1968	ifp->if_flags |= IFF_RUNNING;
1969
1970	return 0;
1971
1972fail2:	free(fw.data, M_DEVBUF);
1973fail1:	ipw_stop(ifp, 0);
1974
1975	return error;
1976}
1977
1978void
1979ipw_stop(struct ifnet *ifp, int disable)
1980{
1981	struct ipw_softc *sc = ifp->if_softc;
1982	struct ieee80211com *ic = &sc->sc_ic;
1983	int i;
1984
1985	ipw_stop_master(sc);
1986	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1987
1988	ifp->if_timer = 0;
1989	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1990
1991	/*
1992	 * Release tx buffers.
1993	 */
1994	for (i = 0; i < IPW_NTBD; i++)
1995		ipw_release_sbd(sc, &sc->stbd_list[i]);
1996
1997	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1998}
1999
2000void
2001ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2002    bus_size_t count)
2003{
2004	for (; count > 0; offset++, datap++, count--) {
2005		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2006		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2007	}
2008}
2009
2010void
2011ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2012    bus_size_t count)
2013{
2014	for (; count > 0; offset++, datap++, count--) {
2015		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2016		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2017	}
2018}
2019
2020struct cfdriver ipw_cd = {
2021	NULL, "ipw", DV_IFNET
2022};
2023