if_ipw.c revision 1.75
1/*	$OpenBSD: if_ipw.c,v 1.75 2008/08/27 09:28:38 damien Exp $	*/
2
3/*-
4 * Copyright (c) 2004-2008
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*
31 * Driver for Intel PRO/Wireless 2100 802.11 network adapters.
32 */
33
34#include "bpfilter.h"
35
36#include <sys/param.h>
37#include <sys/sockio.h>
38#include <sys/sysctl.h>
39#include <sys/mbuf.h>
40#include <sys/kernel.h>
41#include <sys/socket.h>
42#include <sys/systm.h>
43#include <sys/conf.h>
44#include <sys/device.h>
45
46#include <machine/bus.h>
47#include <machine/endian.h>
48#include <machine/intr.h>
49
50#include <dev/pci/pcireg.h>
51#include <dev/pci/pcivar.h>
52#include <dev/pci/pcidevs.h>
53
54#if NBPFILTER > 0
55#include <net/bpf.h>
56#endif
57#include <net/if.h>
58#include <net/if_arp.h>
59#include <net/if_dl.h>
60#include <net/if_media.h>
61#include <net/if_types.h>
62
63#include <netinet/in.h>
64#include <netinet/in_systm.h>
65#include <netinet/in_var.h>
66#include <netinet/if_ether.h>
67#include <netinet/ip.h>
68
69#include <net80211/ieee80211_var.h>
70#include <net80211/ieee80211_radiotap.h>
71
72#include <dev/pci/if_ipwreg.h>
73#include <dev/pci/if_ipwvar.h>
74
75int		ipw_match(struct device *, void *, void *);
76void		ipw_attach(struct device *, struct device *, void *);
77void		ipw_power(int, void *);
78int		ipw_dma_alloc(struct ipw_softc *);
79void		ipw_release(struct ipw_softc *);
80int		ipw_media_change(struct ifnet *);
81void		ipw_media_status(struct ifnet *, struct ifmediareq *);
82int		ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
83uint16_t	ipw_read_prom_word(struct ipw_softc *, uint8_t);
84void		ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
85void		ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
86void		ipw_data_intr(struct ipw_softc *, struct ipw_status *,
87		    struct ipw_soft_bd *, struct ipw_soft_buf *);
88void		ipw_notification_intr(struct ipw_softc *,
89		    struct ipw_soft_buf *);
90void		ipw_rx_intr(struct ipw_softc *);
91void		ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
92void		ipw_tx_intr(struct ipw_softc *);
93int		ipw_intr(void *);
94int		ipw_cmd(struct ipw_softc *, uint32_t, void *, uint32_t);
95int		ipw_tx_start(struct ifnet *, struct mbuf *,
96		    struct ieee80211_node *);
97void		ipw_start(struct ifnet *);
98void		ipw_watchdog(struct ifnet *);
99int		ipw_ioctl(struct ifnet *, u_long, caddr_t);
100uint32_t	ipw_read_table1(struct ipw_softc *, uint32_t);
101void		ipw_write_table1(struct ipw_softc *, uint32_t, uint32_t);
102int		ipw_read_table2(struct ipw_softc *, uint32_t, void *,
103		    uint32_t *);
104void		ipw_stop_master(struct ipw_softc *);
105int		ipw_reset(struct ipw_softc *);
106int		ipw_load_ucode(struct ipw_softc *, u_char *, int);
107int		ipw_load_firmware(struct ipw_softc *, u_char *, int);
108int		ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
109int		ipw_config(struct ipw_softc *);
110int		ipw_init(struct ifnet *);
111void		ipw_stop(struct ifnet *, int);
112void		ipw_read_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
113		    bus_size_t);
114void		ipw_write_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
115		    bus_size_t);
116
117static __inline uint8_t
118MEM_READ_1(struct ipw_softc *sc, uint32_t addr)
119{
120	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
121	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
122}
123
124static __inline uint32_t
125MEM_READ_4(struct ipw_softc *sc, uint32_t addr)
126{
127	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
128	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
129}
130
131#ifdef IPW_DEBUG
132#define DPRINTF(x)	do { if (ipw_debug > 0) printf x; } while (0)
133#define DPRINTFN(n, x)	do { if (ipw_debug >= (n)) printf x; } while (0)
134int ipw_debug = 0;
135#else
136#define DPRINTF(x)
137#define DPRINTFN(n, x)
138#endif
139
140struct cfattach ipw_ca = {
141	sizeof (struct ipw_softc), ipw_match, ipw_attach
142};
143
144int
145ipw_match(struct device *parent, void *match, void *aux)
146{
147	struct pci_attach_args *pa = aux;
148
149	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
150	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2100)
151		return 1;
152
153	return 0;
154}
155
156/* Base Address Register */
157#define IPW_PCI_BAR0	0x10
158
159void
160ipw_attach(struct device *parent, struct device *self, void *aux)
161{
162	struct ipw_softc *sc = (struct ipw_softc *)self;
163	struct ieee80211com *ic = &sc->sc_ic;
164	struct ifnet *ifp = &ic->ic_if;
165	struct pci_attach_args *pa = aux;
166	const char *intrstr;
167	bus_space_tag_t memt;
168	bus_space_handle_t memh;
169	bus_addr_t base;
170	pci_intr_handle_t ih;
171	pcireg_t data;
172	uint16_t val;
173	int error, i;
174
175	sc->sc_pct = pa->pa_pc;
176	sc->sc_pcitag = pa->pa_tag,
177
178	/* clear device specific PCI configuration register 0x41 */
179	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
180	data &= ~0x0000ff00;
181	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
182
183	/* map the register window */
184	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
185	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
186	if (error != 0) {
187		printf(": could not map memory space\n");
188		return;
189	}
190
191	sc->sc_st = memt;
192	sc->sc_sh = memh;
193	sc->sc_dmat = pa->pa_dmat;
194
195	/* disable interrupts */
196	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
197
198	if (pci_intr_map(pa, &ih) != 0) {
199		printf(": could not map interrupt\n");
200		return;
201	}
202
203	intrstr = pci_intr_string(sc->sc_pct, ih);
204	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
205	    sc->sc_dev.dv_xname);
206	if (sc->sc_ih == NULL) {
207		printf(": could not establish interrupt");
208		if (intrstr != NULL)
209			printf(" at %s", intrstr);
210		printf("\n");
211		return;
212	}
213	printf(": %s", intrstr);
214
215	if (ipw_reset(sc) != 0) {
216		printf(": could not reset adapter\n");
217		return;
218	}
219
220	if (ipw_dma_alloc(sc) != 0) {
221		printf(": failed to allocate DMA resources\n");
222		return;
223	}
224
225	ic->ic_phytype = IEEE80211_T_DS;
226	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
227	ic->ic_state = IEEE80211_S_INIT;
228
229	/* set device capabilities */
230	ic->ic_caps =
231#ifndef IEEE80211_STA_ONLY
232	    IEEE80211_C_IBSS |		/* IBSS mode supported */
233#endif
234	    IEEE80211_C_MONITOR |	/* monitor mode supported */
235	    IEEE80211_C_TXPMGT |	/* tx power management */
236	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
237	    IEEE80211_C_WEP |		/* s/w WEP */
238	    IEEE80211_C_SCANALL;	/* h/w scanning */
239
240	/* read MAC address from EEPROM */
241	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
242	ic->ic_myaddr[0] = val >> 8;
243	ic->ic_myaddr[1] = val & 0xff;
244	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
245	ic->ic_myaddr[2] = val >> 8;
246	ic->ic_myaddr[3] = val & 0xff;
247	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
248	ic->ic_myaddr[4] = val >> 8;
249	ic->ic_myaddr[5] = val & 0xff;
250
251	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
252
253	/* set supported .11b rates */
254	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
255
256	/* set supported .11b channels (1 through 14) */
257	for (i = 1; i <= 14; i++) {
258		ic->ic_channels[i].ic_freq =
259		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
260		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
261	}
262
263	/* IBSS channel undefined for now */
264	ic->ic_ibss_chan = &ic->ic_channels[0];
265
266	ifp->if_softc = sc;
267	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
268	ifp->if_init = ipw_init;
269	ifp->if_ioctl = ipw_ioctl;
270	ifp->if_start = ipw_start;
271	ifp->if_watchdog = ipw_watchdog;
272	IFQ_SET_READY(&ifp->if_snd);
273	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
274
275	if_attach(ifp);
276	ieee80211_ifattach(ifp);
277	/* override state transition machine */
278	sc->sc_newstate = ic->ic_newstate;
279	ic->ic_newstate = ipw_newstate;
280	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
281
282	sc->powerhook = powerhook_establish(ipw_power, sc);
283
284#if NBPFILTER > 0
285	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
286	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
287
288	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
289	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
290	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
291
292	sc->sc_txtap_len = sizeof sc->sc_txtapu;
293	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
294	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
295#endif
296}
297
298void
299ipw_power(int why, void *arg)
300{
301	struct ipw_softc *sc = arg;
302	struct ifnet *ifp;
303	pcireg_t data;
304
305	if (why != PWR_RESUME)
306		return;
307
308	/* clear device specific PCI configuration register 0x41 */
309	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
310	data &= ~0x0000ff00;
311	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
312
313	ifp = &sc->sc_ic.ic_if;
314	if (ifp->if_flags & IFF_UP) {
315		ifp->if_init(ifp);
316		if (ifp->if_flags & IFF_RUNNING)
317			ifp->if_start(ifp);
318	}
319}
320
321int
322ipw_dma_alloc(struct ipw_softc *sc)
323{
324	struct ipw_soft_bd *sbd;
325	struct ipw_soft_hdr *shdr;
326	struct ipw_soft_buf *sbuf;
327	int i, nsegs, error;
328
329	/*
330	 * Allocate and map tx ring.
331	 */
332	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
333	    BUS_DMA_NOWAIT, &sc->tbd_map);
334	if (error != 0) {
335		printf("%s: could not create tx ring DMA map\n",
336		    sc->sc_dev.dv_xname);
337		goto fail;
338	}
339
340	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
341	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
342	if (error != 0) {
343		printf("%s: could not allocate tx ring DMA memory\n",
344		    sc->sc_dev.dv_xname);
345		goto fail;
346	}
347
348	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
349	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
350	if (error != 0) {
351		printf("%s: could not map tx ring DMA memory\n",
352		    sc->sc_dev.dv_xname);
353		goto fail;
354	}
355
356	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
357	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
358	if (error != 0) {
359		printf("%s: could not load tx ring DMA map\n",
360		    sc->sc_dev.dv_xname);
361		goto fail;
362	}
363
364	/*
365	 * Allocate and map rx ring.
366	 */
367	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
368	    BUS_DMA_NOWAIT, &sc->rbd_map);
369	if (error != 0) {
370		printf("%s: could not create rx ring DMA map\n",
371		    sc->sc_dev.dv_xname);
372		goto fail;
373	}
374
375	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
376	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
377	if (error != 0) {
378		printf("%s: could not allocate rx ring DMA memory\n",
379		    sc->sc_dev.dv_xname);
380		goto fail;
381	}
382
383	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
384	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
385	if (error != 0) {
386		printf("%s: could not map rx ring DMA memory\n",
387		    sc->sc_dev.dv_xname);
388		goto fail;
389	}
390
391	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
392	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
393	if (error != 0) {
394		printf("%s: could not load tx ring DMA map\n",
395		    sc->sc_dev.dv_xname);
396		goto fail;
397	}
398
399	/*
400	 * Allocate and map status ring.
401	 */
402	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
403	    0, BUS_DMA_NOWAIT, &sc->status_map);
404	if (error != 0) {
405		printf("%s: could not create status ring DMA map\n",
406		    sc->sc_dev.dv_xname);
407		goto fail;
408	}
409
410	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
411	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
412	if (error != 0) {
413		printf("%s: could not allocate status ring DMA memory\n",
414		    sc->sc_dev.dv_xname);
415		goto fail;
416	}
417
418	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
419	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
420	if (error != 0) {
421		printf("%s: could not map status ring DMA memory\n",
422		    sc->sc_dev.dv_xname);
423		goto fail;
424	}
425
426	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
427	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
428	if (error != 0) {
429		printf("%s: could not load status ring DMA map\n",
430		    sc->sc_dev.dv_xname);
431		goto fail;
432	}
433
434	/*
435	 * Allocate command DMA map.
436	 */
437	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
438	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
439	if (error != 0) {
440		printf("%s: could not create command DMA map\n",
441		    sc->sc_dev.dv_xname);
442		goto fail;
443	}
444
445	/*
446	 * Allocate headers DMA maps.
447	 */
448	SLIST_INIT(&sc->free_shdr);
449	for (i = 0; i < IPW_NDATA; i++) {
450		shdr = &sc->shdr_list[i];
451		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
452		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
453		if (error != 0) {
454			printf("%s: could not create header DMA map\n",
455			    sc->sc_dev.dv_xname);
456			goto fail;
457		}
458		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
459	}
460
461	/*
462	 * Allocate tx buffers DMA maps.
463	 */
464	SLIST_INIT(&sc->free_sbuf);
465	for (i = 0; i < IPW_NDATA; i++) {
466		sbuf = &sc->tx_sbuf_list[i];
467		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
468		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
469		if (error != 0) {
470			printf("%s: could not create tx DMA map\n",
471			    sc->sc_dev.dv_xname);
472			goto fail;
473		}
474		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
475	}
476
477	/*
478	 * Initialize tx ring.
479	 */
480	for (i = 0; i < IPW_NTBD; i++) {
481		sbd = &sc->stbd_list[i];
482		sbd->bd = &sc->tbd_list[i];
483		sbd->type = IPW_SBD_TYPE_NOASSOC;
484	}
485
486	/*
487	 * Pre-allocate rx buffers and DMA maps.
488	 */
489	for (i = 0; i < IPW_NRBD; i++) {
490		sbd = &sc->srbd_list[i];
491		sbuf = &sc->rx_sbuf_list[i];
492		sbd->bd = &sc->rbd_list[i];
493
494		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
495		if (sbuf->m == NULL) {
496			printf("%s: could not allocate rx mbuf\n",
497			    sc->sc_dev.dv_xname);
498			error = ENOMEM;
499			goto fail;
500		}
501		MCLGET(sbuf->m, M_DONTWAIT);
502		if (!(sbuf->m->m_flags & M_EXT)) {
503			m_freem(sbuf->m);
504			printf("%s: could not allocate rx mbuf cluster\n",
505			    sc->sc_dev.dv_xname);
506			error = ENOMEM;
507			goto fail;
508		}
509
510		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
511		    0, BUS_DMA_NOWAIT, &sbuf->map);
512		if (error != 0) {
513			printf("%s: could not create rx DMA map\n",
514			    sc->sc_dev.dv_xname);
515			goto fail;
516		}
517
518		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
519		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
520		if (error != 0) {
521			printf("%s: could not map rx DMA memory\n",
522			    sc->sc_dev.dv_xname);
523			goto fail;
524		}
525
526		sbd->type = IPW_SBD_TYPE_DATA;
527		sbd->priv = sbuf;
528		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
529		sbd->bd->len = htole32(MCLBYTES);
530	}
531
532	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
533	    BUS_DMASYNC_PREWRITE);
534
535	return 0;
536
537fail:	ipw_release(sc);
538	return error;
539}
540
541void
542ipw_release(struct ipw_softc *sc)
543{
544	struct ipw_soft_buf *sbuf;
545	int i;
546
547	if (sc->tbd_map != NULL) {
548		if (sc->tbd_list != NULL) {
549			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
550			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
551			    IPW_TBD_SZ);
552			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
553		}
554		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
555	}
556
557	if (sc->rbd_map != NULL) {
558		if (sc->rbd_list != NULL) {
559			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
560			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
561			    IPW_RBD_SZ);
562			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
563		}
564		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
565	}
566
567	if (sc->status_map != NULL) {
568		if (sc->status_list != NULL) {
569			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
570			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
571			    IPW_RBD_SZ);
572			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
573		}
574		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
575	}
576
577	if (sc->cmd_map != NULL)
578		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
579
580	for (i = 0; i < IPW_NDATA; i++)
581		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
582
583	for (i = 0; i < IPW_NDATA; i++)
584		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
585
586	for (i = 0; i < IPW_NRBD; i++) {
587		sbuf = &sc->rx_sbuf_list[i];
588		if (sbuf->map != NULL) {
589			if (sbuf->m != NULL) {
590				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
591				m_freem(sbuf->m);
592			}
593			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
594		}
595	}
596}
597
598int
599ipw_media_change(struct ifnet *ifp)
600{
601	int error;
602
603	error = ieee80211_media_change(ifp);
604	if (error != ENETRESET)
605		return error;
606
607	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
608		ipw_init(ifp);
609
610	return 0;
611}
612
613void
614ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
615{
616#define N(a)	(sizeof (a) / sizeof (a[0]))
617	struct ipw_softc *sc = ifp->if_softc;
618	struct ieee80211com *ic = &sc->sc_ic;
619	static const struct {
620		uint32_t	val;
621		int		rate;
622	} rates[] = {
623		{ IPW_RATE_DS1,   2 },
624		{ IPW_RATE_DS2,   4 },
625		{ IPW_RATE_DS5,  11 },
626		{ IPW_RATE_DS11, 22 },
627	};
628	uint32_t val;
629	int rate, i;
630
631	imr->ifm_status = IFM_AVALID;
632	imr->ifm_active = IFM_IEEE80211;
633	if (ic->ic_state == IEEE80211_S_RUN)
634		imr->ifm_status |= IFM_ACTIVE;
635
636	/* read current transmission rate from adapter */
637	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
638	val &= 0xf;
639
640	/* convert rate to 802.11 rate */
641	for (i = 0; i < N(rates) && rates[i].val != val; i++);
642	rate = (i < N(rates)) ? rates[i].rate : 0;
643
644	imr->ifm_active |= IFM_IEEE80211_11B;
645	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
646	switch (ic->ic_opmode) {
647	case IEEE80211_M_STA:
648		break;
649#ifndef IEEE80211_STA_ONLY
650	case IEEE80211_M_IBSS:
651		imr->ifm_active |= IFM_IEEE80211_IBSS;
652		break;
653#endif
654	case IEEE80211_M_MONITOR:
655		imr->ifm_active |= IFM_IEEE80211_MONITOR;
656		break;
657	default:
658		/* should not get there */
659		break;
660	}
661#undef N
662}
663
664int
665ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
666{
667	struct ipw_softc *sc = ic->ic_softc;
668	struct ieee80211_node *ni;
669	uint8_t macaddr[IEEE80211_ADDR_LEN];
670	uint32_t len;
671
672	switch (nstate) {
673	case IEEE80211_S_RUN:
674		DELAY(100);	/* firmware needs a short delay here */
675
676		len = IEEE80211_ADDR_LEN;
677		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, macaddr, &len);
678
679		ni = ieee80211_find_node(ic, macaddr);
680		if (ni == NULL)
681			break;
682
683		(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
684		ieee80211_node_newstate(ni, IEEE80211_STA_BSS);
685		break;
686
687	case IEEE80211_S_INIT:
688	case IEEE80211_S_SCAN:
689	case IEEE80211_S_AUTH:
690	case IEEE80211_S_ASSOC:
691		break;
692	}
693
694	ic->ic_state = nstate;
695	return 0;
696}
697
698/*
699 * Read 16 bits at address 'addr' from the Microwire EEPROM.
700 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
701 */
702uint16_t
703ipw_read_prom_word(struct ipw_softc *sc, uint8_t addr)
704{
705	uint32_t tmp;
706	uint16_t val;
707	int n;
708
709	/* clock C once before the first command */
710	IPW_EEPROM_CTL(sc, 0);
711	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
712	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
713	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
714
715	/* write start bit (1) */
716	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
717	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
718
719	/* write READ opcode (10) */
720	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
721	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
722	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
723	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
724
725	/* write address A7-A0 */
726	for (n = 7; n >= 0; n--) {
727		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
728		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
729		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
730		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
731	}
732
733	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
734
735	/* read data Q15-Q0 */
736	val = 0;
737	for (n = 15; n >= 0; n--) {
738		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
739		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
740		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
741		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
742	}
743
744	IPW_EEPROM_CTL(sc, 0);
745
746	/* clear Chip Select and clock C */
747	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
748	IPW_EEPROM_CTL(sc, 0);
749	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
750
751	return val;
752}
753
754void
755ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
756{
757	struct ipw_cmd *cmd;
758
759	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
760	    BUS_DMASYNC_POSTREAD);
761
762	cmd = mtod(sbuf->m, struct ipw_cmd *);
763
764	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
765	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
766	    letoh32(cmd->len), letoh32(cmd->status)));
767
768	wakeup(sc);
769}
770
771void
772ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
773{
774	struct ieee80211com *ic = &sc->sc_ic;
775	struct ifnet *ifp = &ic->ic_if;
776	uint32_t state;
777
778	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
779	    BUS_DMASYNC_POSTREAD);
780
781	state = letoh32(*mtod(sbuf->m, uint32_t *));
782
783	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
784
785	switch (state) {
786	case IPW_STATE_ASSOCIATED:
787		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
788		break;
789
790	case IPW_STATE_SCANNING:
791		/* don't leave run state on background scan */
792		if (ic->ic_state != IEEE80211_S_RUN)
793			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
794
795		ic->ic_flags |= IEEE80211_F_ASCAN;
796		break;
797
798	case IPW_STATE_SCAN_COMPLETE:
799		ic->ic_flags &= ~IEEE80211_F_ASCAN;
800		break;
801
802	case IPW_STATE_ASSOCIATION_LOST:
803		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
804		break;
805
806	case IPW_STATE_RADIO_DISABLED:
807		ifp->if_flags &= ~IFF_UP;
808		ipw_stop(&ic->ic_if, 1);
809		break;
810	}
811}
812
813void
814ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
815    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
816{
817	struct ieee80211com *ic = &sc->sc_ic;
818	struct ifnet *ifp = &ic->ic_if;
819	struct mbuf *mnew, *m;
820	struct ieee80211_frame *wh;
821	struct ieee80211_rxinfo rxi;
822	struct ieee80211_node *ni;
823	int error;
824
825	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
826
827	/*
828	 * Try to allocate a new mbuf for this ring element and load it before
829	 * processing the current mbuf.  If the ring element cannot be loaded,
830	 * drop the received packet and reuse the old mbuf.  In the unlikely
831	 * case that the old mbuf can't be reloaded either, explicitly panic.
832	 */
833	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
834	if (mnew == NULL) {
835		ifp->if_ierrors++;
836		return;
837	}
838	MCLGET(mnew, M_DONTWAIT);
839	if (!(mnew->m_flags & M_EXT)) {
840		m_freem(mnew);
841		ifp->if_ierrors++;
842		return;
843	}
844
845	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
846	    BUS_DMASYNC_POSTREAD);
847	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
848
849	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(mnew, void *),
850	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
851	if (error != 0) {
852		m_freem(mnew);
853
854		/* try to reload the old mbuf */
855		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
856		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
857		if (error != 0) {
858			/* very unlikely that it will fail... */
859			panic("%s: could not load old rx mbuf",
860			    sc->sc_dev.dv_xname);
861		}
862		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
863		ifp->if_ierrors++;
864		return;
865	}
866
867	m = sbuf->m;
868	sbuf->m = mnew;
869	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
870
871	/* finalize mbuf */
872	m->m_pkthdr.rcvif = ifp;
873	m->m_pkthdr.len = m->m_len = letoh32(status->len);
874
875#if NBPFILTER > 0
876	if (sc->sc_drvbpf != NULL) {
877		struct mbuf mb;
878		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
879
880		tap->wr_flags = 0;
881		tap->wr_antsignal = status->rssi;
882		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
883		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
884
885		mb.m_data = (caddr_t)tap;
886		mb.m_len = sc->sc_rxtap_len;
887		mb.m_next = m;
888		mb.m_nextpkt = NULL;
889		mb.m_type = 0;
890		mb.m_flags = 0;
891		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
892	}
893#endif
894
895	wh = mtod(m, struct ieee80211_frame *);
896	ni = ieee80211_find_rxnode(ic, wh);
897
898	/* send the frame to the upper layer */
899	rxi.rxi_flags = 0;
900	rxi.rxi_rssi = status->rssi;
901	rxi.rxi_tstamp = 0;	/* unused */
902	ieee80211_input(ifp, m, ni, &rxi);
903
904	ieee80211_release_node(ic, ni);
905}
906
907void
908ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
909{
910	DPRINTFN(2, ("RX!NOTIFICATION\n"));
911}
912
913void
914ipw_rx_intr(struct ipw_softc *sc)
915{
916	struct ipw_status *status;
917	struct ipw_soft_bd *sbd;
918	struct ipw_soft_buf *sbuf;
919	uint32_t r, i;
920
921	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
922
923	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
924
925		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
926		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
927		    BUS_DMASYNC_POSTREAD);
928
929		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
930		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
931		    BUS_DMASYNC_POSTREAD);
932
933		status = &sc->status_list[i];
934		sbd = &sc->srbd_list[i];
935		sbuf = sbd->priv;
936
937		switch (letoh16(status->code) & 0xf) {
938		case IPW_STATUS_CODE_COMMAND:
939			ipw_command_intr(sc, sbuf);
940			break;
941
942		case IPW_STATUS_CODE_NEWSTATE:
943			ipw_newstate_intr(sc, sbuf);
944			break;
945
946		case IPW_STATUS_CODE_DATA_802_3:
947		case IPW_STATUS_CODE_DATA_802_11:
948			ipw_data_intr(sc, status, sbd, sbuf);
949			break;
950
951		case IPW_STATUS_CODE_NOTIFICATION:
952			ipw_notification_intr(sc, sbuf);
953			break;
954
955		default:
956			printf("%s: unknown status code %u\n",
957			    sc->sc_dev.dv_xname, letoh16(status->code));
958		}
959		sbd->bd->flags = 0;
960
961		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
962		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
963		    BUS_DMASYNC_PREWRITE);
964	}
965
966	/* tell the firmware what we have processed */
967	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
968	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
969}
970
971void
972ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
973{
974	struct ieee80211com *ic = &sc->sc_ic;
975	struct ipw_soft_hdr *shdr;
976	struct ipw_soft_buf *sbuf;
977
978	switch (sbd->type) {
979	case IPW_SBD_TYPE_COMMAND:
980		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
981		break;
982
983	case IPW_SBD_TYPE_HEADER:
984		shdr = sbd->priv;
985		bus_dmamap_unload(sc->sc_dmat, shdr->map);
986		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
987		break;
988
989	case IPW_SBD_TYPE_DATA:
990		sbuf = sbd->priv;
991		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
992		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
993
994		m_freem(sbuf->m);
995
996		if (sbuf->ni != NULL)
997			ieee80211_release_node(ic, sbuf->ni);
998
999		/* kill watchdog timer */
1000		sc->sc_tx_timer = 0;
1001		break;
1002	}
1003	sbd->type = IPW_SBD_TYPE_NOASSOC;
1004}
1005
1006void
1007ipw_tx_intr(struct ipw_softc *sc)
1008{
1009	struct ifnet *ifp = &sc->sc_ic.ic_if;
1010	struct ipw_soft_bd *sbd;
1011	uint32_t r, i;
1012
1013	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1014
1015	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1016		sbd = &sc->stbd_list[i];
1017
1018		if (sbd->type == IPW_SBD_TYPE_DATA)
1019			ifp->if_opackets++;
1020
1021		ipw_release_sbd(sc, sbd);
1022		sc->txfree++;
1023	}
1024
1025	/* remember what the firmware has processed */
1026	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1027
1028	/* call start() since some buffer descriptors have been released */
1029	ifp->if_flags &= ~IFF_OACTIVE;
1030	(*ifp->if_start)(ifp);
1031}
1032
1033int
1034ipw_intr(void *arg)
1035{
1036	struct ipw_softc *sc = arg;
1037	struct ifnet *ifp = &sc->sc_ic.ic_if;
1038	uint32_t r;
1039
1040	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1041		return 0;
1042
1043	/* disable interrupts */
1044	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1045
1046	DPRINTFN(8, ("INTR!0x%08x\n", r));
1047
1048	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1049		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1050		ifp->if_flags &= ~IFF_UP;
1051		ipw_stop(ifp, 1);
1052		return 1;
1053	}
1054
1055	if (r & IPW_INTR_FW_INIT_DONE)
1056		wakeup(sc);
1057
1058	if (r & IPW_INTR_RX_TRANSFER)
1059		ipw_rx_intr(sc);
1060
1061	if (r & IPW_INTR_TX_TRANSFER)
1062		ipw_tx_intr(sc);
1063
1064	/* acknowledge interrupts */
1065	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1066
1067	/* re-enable interrupts */
1068	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1069
1070	return 1;
1071}
1072
1073int
1074ipw_cmd(struct ipw_softc *sc, uint32_t type, void *data, uint32_t len)
1075{
1076	struct ipw_soft_bd *sbd;
1077	int error;
1078
1079	sbd = &sc->stbd_list[sc->txcur];
1080
1081	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1082	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1083	if (error != 0) {
1084		printf("%s: could not map command DMA memory\n",
1085		    sc->sc_dev.dv_xname);
1086		return error;
1087	}
1088
1089	sc->cmd.type = htole32(type);
1090	sc->cmd.subtype = htole32(0);
1091	sc->cmd.len = htole32(len);
1092	sc->cmd.seq = htole32(0);
1093	if (data != NULL)
1094		bcopy(data, sc->cmd.data, len);
1095
1096	sbd->type = IPW_SBD_TYPE_COMMAND;
1097	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1098	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1099	sbd->bd->nfrag = 1;
1100	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1101	    IPW_BD_FLAG_TX_LAST_FRAGMENT;
1102
1103	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1104	    BUS_DMASYNC_PREWRITE);
1105
1106	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1107	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1108	    BUS_DMASYNC_PREWRITE);
1109
1110	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1111	sc->txfree--;
1112	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1113
1114	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
1115
1116	/* wait at most one second for command to complete */
1117	return tsleep(sc, 0, "ipwcmd", hz);
1118}
1119
1120int
1121ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1122{
1123	struct ipw_softc *sc = ifp->if_softc;
1124	struct ieee80211com *ic = &sc->sc_ic;
1125	struct ieee80211_frame *wh;
1126	struct ieee80211_key *k;
1127	struct ipw_soft_bd *sbd;
1128	struct ipw_soft_hdr *shdr;
1129	struct ipw_soft_buf *sbuf;
1130	struct mbuf *mnew;
1131	int error, i;
1132
1133	wh = mtod(m, struct ieee80211_frame *);
1134
1135	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1136		k = ieee80211_get_txkey(ic, wh, ni);
1137
1138		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1139			return ENOBUFS;
1140
1141		/* packet header may have moved, reset our local pointer */
1142		wh = mtod(m, struct ieee80211_frame *);
1143	}
1144
1145#if NBPFILTER > 0
1146	if (sc->sc_drvbpf != NULL) {
1147		struct mbuf mb;
1148		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1149
1150		tap->wt_flags = 0;
1151		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1152		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1153
1154		mb.m_data = (caddr_t)tap;
1155		mb.m_len = sc->sc_txtap_len;
1156		mb.m_next = m;
1157		mb.m_nextpkt = NULL;
1158		mb.m_type = 0;
1159		mb.m_flags = 0;
1160		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1161	}
1162#endif
1163
1164	shdr = SLIST_FIRST(&sc->free_shdr);
1165	sbuf = SLIST_FIRST(&sc->free_sbuf);
1166
1167	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1168	shdr->hdr.subtype = htole32(0);
1169	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) ? 1 : 0;
1170	shdr->hdr.encrypt = 0;
1171	shdr->hdr.keyidx = 0;
1172	shdr->hdr.keysz = 0;
1173	shdr->hdr.fragmentsz = htole16(0);
1174	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1175	if (ic->ic_opmode == IEEE80211_M_STA)
1176		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1177	else
1178		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1179
1180	/* trim IEEE802.11 header */
1181	m_adj(m, sizeof (struct ieee80211_frame));
1182
1183	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1184	if (error != 0 && error != EFBIG) {
1185		printf("%s: could not map mbuf (error %d)\n",
1186		    sc->sc_dev.dv_xname, error);
1187		m_freem(m);
1188		return error;
1189	}
1190	if (error != 0) {
1191		/* too many fragments, linearize */
1192
1193		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1194		if (mnew == NULL) {
1195			m_freem(m);
1196			return ENOMEM;
1197		}
1198		M_DUP_PKTHDR(mnew, m);
1199		if (m->m_pkthdr.len > MHLEN) {
1200			MCLGET(mnew, M_DONTWAIT);
1201			if (!(mnew->m_flags & M_EXT)) {
1202				m_freem(m);
1203				m_freem(mnew);
1204				return ENOMEM;
1205			}
1206		}
1207		m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew, caddr_t));
1208		m_freem(m);
1209		mnew->m_len = mnew->m_pkthdr.len;
1210		m = mnew;
1211
1212		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1213		    BUS_DMA_NOWAIT);
1214		if (error != 0) {
1215			printf("%s: could not map mbuf (error %d)\n",
1216			    sc->sc_dev.dv_xname, error);
1217			m_freem(m);
1218			return error;
1219		}
1220	}
1221
1222	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1223	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1224	if (error != 0) {
1225		printf("%s: could not map header DMA memory (error %d)\n",
1226		    sc->sc_dev.dv_xname, error);
1227		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1228		m_freem(m);
1229		return error;
1230	}
1231
1232	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1233	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1234
1235	sbd = &sc->stbd_list[sc->txcur];
1236	sbd->type = IPW_SBD_TYPE_HEADER;
1237	sbd->priv = shdr;
1238	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1239	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1240	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1241	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1242	    IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1243
1244	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
1245	    shdr->hdr.encrypted, shdr->hdr.encrypt));
1246	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
1247	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
1248
1249	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1250	    sc->txcur * sizeof (struct ipw_bd),
1251	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1252
1253	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1254	sc->txfree--;
1255
1256	sbuf->m = m;
1257	sbuf->ni = ni;
1258
1259	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1260		sbd = &sc->stbd_list[sc->txcur];
1261		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1262		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1263		sbd->bd->nfrag = 0;	/* used only in first bd */
1264		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1265		if (i == sbuf->map->dm_nsegs - 1) {
1266			sbd->type = IPW_SBD_TYPE_DATA;
1267			sbd->priv = sbuf;
1268			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1269		} else {
1270			sbd->type = IPW_SBD_TYPE_NOASSOC;
1271			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1272		}
1273
1274		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
1275		    sbuf->map->dm_segs[i].ds_len));
1276
1277		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1278		    sc->txcur * sizeof (struct ipw_bd),
1279		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1280
1281		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1282		sc->txfree--;
1283	}
1284
1285	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sbuf->map->dm_mapsize,
1286	    BUS_DMASYNC_PREWRITE);
1287	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1288	    BUS_DMASYNC_PREWRITE);
1289
1290	/* inform firmware about this new packet */
1291	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1292
1293	return 0;
1294}
1295
1296void
1297ipw_start(struct ifnet *ifp)
1298{
1299	struct ipw_softc *sc = ifp->if_softc;
1300	struct ieee80211com *ic = &sc->sc_ic;
1301	struct ieee80211_node *ni;
1302	struct mbuf *m;
1303
1304	for (;;) {
1305		IF_PURGE(&ic->ic_mgtq);
1306
1307		if (ic->ic_state != IEEE80211_S_RUN)
1308			return;
1309		IFQ_POLL(&ifp->if_snd, m);
1310		if (m == NULL)
1311			break;
1312
1313		if (sc->txfree < 1 + IPW_MAX_NSEG) {
1314			ifp->if_flags |= IFF_OACTIVE;
1315			break;
1316		}
1317		IFQ_DEQUEUE(&ifp->if_snd, m);
1318#if NBPFILTER > 0
1319		if (ifp->if_bpf != NULL)
1320			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1321#endif
1322		m = ieee80211_encap(ifp, m, &ni);
1323		if (m == NULL)
1324			continue;
1325#if NBPFILTER > 0
1326		if (ic->ic_rawbpf != NULL)
1327			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1328#endif
1329		if (ipw_tx_start(ifp, m, ni) != 0) {
1330			if (ni != NULL)
1331				ieee80211_release_node(ic, ni);
1332			ifp->if_oerrors++;
1333			break;
1334		}
1335
1336		/* start watchdog timer */
1337		sc->sc_tx_timer = 5;
1338		ifp->if_timer = 1;
1339	}
1340}
1341
1342void
1343ipw_watchdog(struct ifnet *ifp)
1344{
1345	struct ipw_softc *sc = ifp->if_softc;
1346
1347	ifp->if_timer = 0;
1348
1349	if (sc->sc_tx_timer > 0) {
1350		if (--sc->sc_tx_timer == 0) {
1351			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1352			ifp->if_flags &= ~IFF_UP;
1353			ipw_stop(ifp, 1);
1354			ifp->if_oerrors++;
1355			return;
1356		}
1357		ifp->if_timer = 1;
1358	}
1359
1360	ieee80211_watchdog(ifp);
1361}
1362
1363int
1364ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1365{
1366	struct ipw_softc *sc = ifp->if_softc;
1367	struct ieee80211com *ic = &sc->sc_ic;
1368	struct ifaddr *ifa;
1369	struct ifreq *ifr;
1370	int s, error = 0;
1371
1372	s = splnet();
1373
1374	switch (cmd) {
1375	case SIOCSIFADDR:
1376		ifa = (struct ifaddr *)data;
1377		ifp->if_flags |= IFF_UP;
1378#ifdef INET
1379		if (ifa->ifa_addr->sa_family == AF_INET)
1380			arp_ifinit(&ic->ic_ac, ifa);
1381#endif
1382		/* FALLTHROUGH */
1383	case SIOCSIFFLAGS:
1384		if (ifp->if_flags & IFF_UP) {
1385			if (!(ifp->if_flags & IFF_RUNNING))
1386				ipw_init(ifp);
1387		} else {
1388			if (ifp->if_flags & IFF_RUNNING)
1389				ipw_stop(ifp, 1);
1390		}
1391		break;
1392
1393	case SIOCADDMULTI:
1394	case SIOCDELMULTI:
1395		ifr = (struct ifreq *)data;
1396		error = (cmd == SIOCADDMULTI) ?
1397		    ether_addmulti(ifr, &ic->ic_ac) :
1398		    ether_delmulti(ifr, &ic->ic_ac);
1399
1400		if (error == ENETRESET)
1401			error = 0;
1402		break;
1403
1404	case SIOCG80211TXPOWER:
1405		/*
1406		 * If the hardware radio transmitter switch is off, report a
1407		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1408		 * transmitter is killed.
1409		 */
1410		((struct ieee80211_txpower *)data)->i_val =
1411		    (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ?
1412		    IEEE80211_TXPOWER_MIN : sc->sc_ic.ic_txpower;
1413		break;
1414
1415	default:
1416		error = ieee80211_ioctl(ifp, cmd, data);
1417	}
1418
1419	if (error == ENETRESET) {
1420		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1421		    (IFF_UP | IFF_RUNNING))
1422			ipw_init(ifp);
1423		error = 0;
1424	}
1425
1426	splx(s);
1427	return error;
1428}
1429
1430uint32_t
1431ipw_read_table1(struct ipw_softc *sc, uint32_t off)
1432{
1433	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1434}
1435
1436void
1437ipw_write_table1(struct ipw_softc *sc, uint32_t off, uint32_t info)
1438{
1439	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1440}
1441
1442int
1443ipw_read_table2(struct ipw_softc *sc, uint32_t off, void *buf, uint32_t *len)
1444{
1445	uint32_t addr, info;
1446	uint16_t count, size;
1447	uint32_t total;
1448
1449	/* addr[4] + count[2] + size[2] */
1450	addr = MEM_READ_4(sc, sc->table2_base + off);
1451	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1452
1453	count = info >> 16;
1454	size  = info & 0xffff;
1455	total = count * size;
1456
1457	if (total > *len) {
1458		*len = total;
1459		return EINVAL;
1460	}
1461	*len = total;
1462	ipw_read_mem_1(sc, addr, buf, total);
1463
1464	return 0;
1465}
1466
1467void
1468ipw_stop_master(struct ipw_softc *sc)
1469{
1470	uint32_t tmp;
1471	int ntries;
1472
1473	/* disable interrupts */
1474	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1475
1476	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1477	for (ntries = 0; ntries < 50; ntries++) {
1478		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1479			break;
1480		DELAY(10);
1481	}
1482	if (ntries == 50)
1483		printf("%s: timeout waiting for master\n",
1484		    sc->sc_dev.dv_xname);
1485
1486	tmp = CSR_READ_4(sc, IPW_CSR_RST);
1487	CSR_WRITE_4(sc, IPW_CSR_RST, tmp | IPW_RST_PRINCETON_RESET);
1488
1489	sc->flags &= ~IPW_FLAG_FW_INITED;
1490}
1491
1492int
1493ipw_reset(struct ipw_softc *sc)
1494{
1495	uint32_t tmp;
1496	int ntries;
1497
1498	ipw_stop_master(sc);
1499
1500	/* move adapter to D0 state */
1501	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1502	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_INIT);
1503
1504	/* wait for clock stabilization */
1505	for (ntries = 0; ntries < 1000; ntries++) {
1506		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1507			break;
1508		DELAY(200);
1509	}
1510	if (ntries == 1000)
1511		return EIO;
1512
1513	tmp = CSR_READ_4(sc, IPW_CSR_RST);
1514	CSR_WRITE_4(sc, IPW_CSR_RST, tmp | IPW_RST_SW_RESET);
1515
1516	DELAY(10);
1517
1518	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1519	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_INIT);
1520
1521	return 0;
1522}
1523
1524int
1525ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1526{
1527	int ntries;
1528
1529	/* voodoo from the Intel Linux driver */
1530	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1531	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1532
1533	MEM_WRITE_2(sc, 0x220000, 0x0703);
1534	MEM_WRITE_2(sc, 0x220000, 0x0707);
1535
1536	MEM_WRITE_1(sc, 0x210014, 0x72);
1537	MEM_WRITE_1(sc, 0x210014, 0x72);
1538
1539	MEM_WRITE_1(sc, 0x210000, 0x40);
1540	MEM_WRITE_1(sc, 0x210000, 0x00);
1541	MEM_WRITE_1(sc, 0x210000, 0x40);
1542
1543	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1544
1545	MEM_WRITE_1(sc, 0x210000, 0x00);
1546	MEM_WRITE_1(sc, 0x210000, 0x00);
1547	MEM_WRITE_1(sc, 0x210000, 0x80);
1548
1549	MEM_WRITE_2(sc, 0x220000, 0x0703);
1550	MEM_WRITE_2(sc, 0x220000, 0x0707);
1551
1552	MEM_WRITE_1(sc, 0x210014, 0x72);
1553	MEM_WRITE_1(sc, 0x210014, 0x72);
1554
1555	MEM_WRITE_1(sc, 0x210000, 0x00);
1556	MEM_WRITE_1(sc, 0x210000, 0x80);
1557
1558	for (ntries = 0; ntries < 100; ntries++) {
1559		if (MEM_READ_1(sc, 0x210000) & 1)
1560			break;
1561		DELAY(1000);
1562	}
1563	if (ntries == 100) {
1564		printf("%s: timeout waiting for ucode to initialize\n",
1565		    sc->sc_dev.dv_xname);
1566		return EIO;
1567	}
1568
1569	MEM_WRITE_4(sc, 0x3000e0, 0);
1570
1571	return 0;
1572}
1573
1574/* set of macros to handle unaligned little endian data in firmware image */
1575#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1576#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1577int
1578ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1579{
1580	u_char *p, *end;
1581	uint32_t tmp, dst;
1582	uint16_t len;
1583	int error;
1584
1585	p = fw;
1586	end = fw + size;
1587	while (p < end) {
1588		if (p + 6 > end)
1589			return EINVAL;
1590
1591		dst = GETLE32(p); p += 4;
1592		len = GETLE16(p); p += 2;
1593
1594		if (p + len > end)
1595			return EINVAL;
1596
1597		ipw_write_mem_1(sc, dst, p, len);
1598		p += len;
1599	}
1600
1601	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1602	    IPW_IO_LED_OFF);
1603
1604	/* allow interrupts so we know when the firmware is inited */
1605	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1606
1607	/* tell the adapter to initialize the firmware */
1608	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1609	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1610	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_ALLOW_STANDBY);
1611
1612	/* wait at most one second for firmware initialization to complete */
1613	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1614		printf("%s: timeout waiting for firmware initialization to "
1615		    "complete\n", sc->sc_dev.dv_xname);
1616		return error;
1617	}
1618
1619	tmp = CSR_READ_4(sc, IPW_CSR_IO);
1620	CSR_WRITE_4(sc, IPW_CSR_IO, tmp | IPW_IO_GPIO1_MASK |
1621	    IPW_IO_GPIO3_MASK);
1622
1623	return 0;
1624}
1625
1626int
1627ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1628{
1629	const struct ipw_firmware_hdr *hdr;
1630	const char *name;
1631	size_t size;
1632	int error;
1633
1634	switch (sc->sc_ic.ic_opmode) {
1635	case IEEE80211_M_STA:
1636		name = "ipw-bss";
1637		break;
1638#ifndef IEEE80211_STA_ONLY
1639	case IEEE80211_M_IBSS:
1640		name = "ipw-ibss";
1641		break;
1642#endif
1643	case IEEE80211_M_MONITOR:
1644		name = "ipw-monitor";
1645		break;
1646	default:
1647		/* should not get there */
1648		return ENODEV;
1649	}
1650	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1651		return error;
1652
1653	if (size < sizeof (*hdr)) {
1654		error = EINVAL;
1655		goto fail;
1656	}
1657	hdr = (const struct ipw_firmware_hdr *)fw->data;
1658	fw->main_size  = letoh32(hdr->main_size);
1659	fw->ucode_size = letoh32(hdr->ucode_size);
1660
1661	if (size < sizeof (*hdr) + fw->main_size + fw->ucode_size) {
1662		error = EINVAL;
1663		goto fail;
1664	}
1665	fw->main  = fw->data + sizeof (*hdr);
1666	fw->ucode = fw->main + fw->main_size;
1667
1668	return 0;
1669
1670fail:	free(fw->data, M_DEVBUF);
1671	return error;
1672}
1673
1674int
1675ipw_config(struct ipw_softc *sc)
1676{
1677	struct ieee80211com *ic = &sc->sc_ic;
1678	struct ifnet *ifp = &ic->ic_if;
1679	struct ipw_security security;
1680	struct ieee80211_key *k;
1681	struct ipw_wep_key wepkey;
1682	struct ipw_scan_options options;
1683	struct ipw_configuration config;
1684	uint32_t data;
1685	int error, i;
1686
1687	switch (ic->ic_opmode) {
1688	case IEEE80211_M_STA:
1689		data = htole32(IPW_MODE_BSS);
1690		break;
1691#ifndef IEEE80211_STA_ONLY
1692	case IEEE80211_M_IBSS:
1693		data = htole32(IPW_MODE_IBSS);
1694		break;
1695#endif
1696	case IEEE80211_M_MONITOR:
1697		data = htole32(IPW_MODE_MONITOR);
1698		break;
1699	default:
1700		/* should not get there */
1701		return ENODEV;
1702	}
1703	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1704	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1705	if (error != 0)
1706		return error;
1707
1708	if (
1709#ifndef IEEE80211_STA_ONLY
1710	    ic->ic_opmode == IEEE80211_M_IBSS ||
1711#endif
1712	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1713		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1714		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1715		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1716		if (error != 0)
1717			return error;
1718	}
1719
1720	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1721		DPRINTF(("Enabling adapter\n"));
1722		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1723	}
1724
1725	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1726	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1727	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1728	    IEEE80211_ADDR_LEN);
1729	if (error != 0)
1730		return error;
1731
1732	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1733	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1x_ENABLE);
1734#ifndef IEEE80211_STA_ONLY
1735	if (ic->ic_opmode == IEEE80211_M_IBSS)
1736		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1737#endif
1738	if (ifp->if_flags & IFF_PROMISC)
1739		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1740	config.bss_chan = htole32(0x3fff);	/* channels 1-14 */
1741	config.ibss_chan = htole32(0x7ff);	/* channels 1-11 */
1742	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1743	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1744	if (error != 0)
1745		return error;
1746
1747	data = htole32(0x3);	/* 1, 2 */
1748	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1749	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1750	if (error != 0)
1751		return error;
1752
1753	data = htole32(0xf);	/* 1, 2, 5.5, 11 */
1754	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1755	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1756	if (error != 0)
1757		return error;
1758
1759	data = htole32(IPW_POWER_MODE_CAM);
1760	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1761	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1762	if (error != 0)
1763		return error;
1764
1765#ifndef IEEE80211_STA_ONLY
1766	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1767		data = htole32(32);	/* default value */
1768		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1769		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1770		    sizeof data);
1771		if (error != 0)
1772			return error;
1773	}
1774#endif
1775
1776	data = htole32(ic->ic_rtsthreshold);
1777	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1778	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1779	if (error != 0)
1780		return error;
1781
1782	data = htole32(ic->ic_fragthreshold);
1783	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1784	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1785	if (error != 0)
1786		return error;
1787
1788#ifdef IPW_DEBUG
1789	if (ipw_debug > 0) {
1790		printf("Setting ESSID to ");
1791		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1792		printf("\n");
1793	}
1794#endif
1795	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1796	    ic->ic_des_esslen);
1797	if (error != 0)
1798		return error;
1799
1800	/* no mandatory BSSID */
1801	DPRINTF(("Setting mandatory BSSID to null\n"));
1802	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1803	if (error != 0)
1804		return error;
1805
1806	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1807		DPRINTF(("Setting adapter BSSID to %s\n",
1808		    ether_sprintf(ic->ic_des_bssid)));
1809		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1810		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1811		if (error != 0)
1812			return error;
1813	}
1814
1815	bzero(&security, sizeof security);
1816	security.authmode = IPW_AUTH_OPEN;	/* XXX shared mode */
1817	security.ciphers = htole32(IPW_CIPHER_NONE);
1818	DPRINTF(("Setting authmode to %u\n", security.authmode));
1819	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1820	    sizeof security);
1821	if (error != 0)
1822		return error;
1823
1824	if (ic->ic_flags & IEEE80211_F_WEPON) {
1825		k = ic->ic_nw_keys;
1826		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1827			if (k->k_len == 0)
1828				continue;
1829
1830			wepkey.idx = i;
1831			wepkey.len = k->k_len;
1832			bzero(wepkey.key, sizeof wepkey.key);
1833			bcopy(k->k_key, wepkey.key, k->k_len);
1834			DPRINTF(("Setting wep key index %u len %u\n",
1835			    wepkey.idx, wepkey.len));
1836			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1837			    sizeof wepkey);
1838			if (error != 0)
1839				return error;
1840		}
1841
1842		data = htole32(ic->ic_wep_txkey);
1843		DPRINTF(("Setting wep tx key index to %u\n", letoh32(data)));
1844		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1845		    sizeof data);
1846		if (error != 0)
1847			return error;
1848	}
1849
1850	data = htole32((ic->ic_flags & IEEE80211_F_WEPON) ? IPW_WEPON : 0);
1851	DPRINTF(("Setting wep flags to 0x%x\n", letoh32(data)));
1852	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1853	if (error != 0)
1854		return error;
1855
1856#ifndef IEEE80211_STA_ONLY
1857	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1858	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1859		data = htole32(ic->ic_lintval);
1860		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1861		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1862		    sizeof data);
1863		if (error != 0)
1864			return error;
1865	}
1866#endif
1867
1868	options.flags = htole32(0);
1869	options.channels = htole32(0x3fff);	/* scan channels 1-14 */
1870	DPRINTF(("Setting scan options to 0x%x\n", letoh32(options.flags)));
1871	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1872	if (error != 0)
1873		return error;
1874
1875	/* finally, enable adapter (start scanning for an access point) */
1876	DPRINTF(("Enabling adapter\n"));
1877	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1878}
1879
1880int
1881ipw_init(struct ifnet *ifp)
1882{
1883	struct ipw_softc *sc = ifp->if_softc;
1884	struct ipw_firmware fw;
1885	int error;
1886
1887	ipw_stop(ifp, 0);
1888
1889	if ((error = ipw_reset(sc)) != 0) {
1890		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1891		goto fail1;
1892	}
1893
1894	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1895		printf("%s: error %d, could not read firmware\n",
1896		    sc->sc_dev.dv_xname, error);
1897		goto fail1;
1898	}
1899	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1900		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1901		goto fail2;
1902	}
1903
1904	ipw_stop_master(sc);
1905
1906	/*
1907	 * Setup tx, rx and status rings.
1908	 */
1909	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1910	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1911	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1912	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1913	sc->txold = IPW_NTBD - 1;	/* latest bd index ack by firmware */
1914	sc->txcur = 0; /* bd index to write to */
1915	sc->txfree = IPW_NTBD - 2;
1916
1917	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1918	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1919	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1920	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1921	sc->rxcur = IPW_NRBD - 1;	/* latest bd index I've read */
1922
1923	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1924	    sc->status_map->dm_segs[0].ds_addr);
1925
1926	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1927		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1928		goto fail2;
1929	}
1930	sc->flags |= IPW_FLAG_FW_INITED;
1931	free(fw.data, M_DEVBUF);
1932
1933	/* retrieve information tables base addresses */
1934	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1935	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1936
1937	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1938
1939	if ((error = ipw_config(sc)) != 0) {
1940		printf("%s: device configuration failed\n",
1941		    sc->sc_dev.dv_xname);
1942		goto fail2;
1943	}
1944	ifp->if_flags &= ~IFF_OACTIVE;
1945	ifp->if_flags |= IFF_RUNNING;
1946
1947	return 0;
1948
1949fail2:	free(fw.data, M_DEVBUF);
1950fail1:	ipw_stop(ifp, 0);
1951
1952	return error;
1953}
1954
1955void
1956ipw_stop(struct ifnet *ifp, int disable)
1957{
1958	struct ipw_softc *sc = ifp->if_softc;
1959	struct ieee80211com *ic = &sc->sc_ic;
1960	int i;
1961
1962	ipw_stop_master(sc);
1963	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1964
1965	ifp->if_timer = 0;
1966	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1967
1968	/*
1969	 * Release tx buffers.
1970	 */
1971	for (i = 0; i < IPW_NTBD; i++)
1972		ipw_release_sbd(sc, &sc->stbd_list[i]);
1973
1974	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1975}
1976
1977void
1978ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
1979    bus_size_t count)
1980{
1981	for (; count > 0; offset++, datap++, count--) {
1982		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1983		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
1984	}
1985}
1986
1987void
1988ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
1989    bus_size_t count)
1990{
1991	for (; count > 0; offset++, datap++, count--) {
1992		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1993		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
1994	}
1995}
1996
1997struct cfdriver ipw_cd = {
1998	NULL, "ipw", DV_IFNET
1999};
2000