if_ipw.c revision 1.84
1/*	$OpenBSD: if_ipw.c,v 1.84 2009/01/26 19:09:41 damien Exp $	*/
2
3/*-
4 * Copyright (c) 2004-2008
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20/*
21 * Driver for Intel PRO/Wireless 2100 802.11 network adapters.
22 */
23
24#include "bpfilter.h"
25
26#include <sys/param.h>
27#include <sys/sockio.h>
28#include <sys/sysctl.h>
29#include <sys/workq.h>
30#include <sys/mbuf.h>
31#include <sys/kernel.h>
32#include <sys/socket.h>
33#include <sys/systm.h>
34#include <sys/conf.h>
35#include <sys/device.h>
36
37#include <machine/bus.h>
38#include <machine/endian.h>
39#include <machine/intr.h>
40
41#include <dev/pci/pcireg.h>
42#include <dev/pci/pcivar.h>
43#include <dev/pci/pcidevs.h>
44
45#if NBPFILTER > 0
46#include <net/bpf.h>
47#endif
48#include <net/if.h>
49#include <net/if_arp.h>
50#include <net/if_dl.h>
51#include <net/if_media.h>
52#include <net/if_types.h>
53
54#include <netinet/in.h>
55#include <netinet/in_systm.h>
56#include <netinet/in_var.h>
57#include <netinet/if_ether.h>
58#include <netinet/ip.h>
59
60#include <net80211/ieee80211_var.h>
61#include <net80211/ieee80211_radiotap.h>
62
63#include <dev/pci/if_ipwreg.h>
64#include <dev/pci/if_ipwvar.h>
65
66int		ipw_match(struct device *, void *, void *);
67void		ipw_attach(struct device *, struct device *, void *);
68void		ipw_power(int, void *);
69int		ipw_dma_alloc(struct ipw_softc *);
70void		ipw_release(struct ipw_softc *);
71int		ipw_media_change(struct ifnet *);
72void		ipw_media_status(struct ifnet *, struct ifmediareq *);
73int		ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
74uint16_t	ipw_read_prom_word(struct ipw_softc *, uint8_t);
75void		ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
76void		ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
77void		ipw_data_intr(struct ipw_softc *, struct ipw_status *,
78		    struct ipw_soft_bd *, struct ipw_soft_buf *);
79void		ipw_notification_intr(struct ipw_softc *,
80		    struct ipw_soft_buf *);
81void		ipw_rx_intr(struct ipw_softc *);
82void		ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
83void		ipw_tx_intr(struct ipw_softc *);
84int		ipw_intr(void *);
85int		ipw_cmd(struct ipw_softc *, uint32_t, void *, uint32_t);
86int		ipw_send_mgmt(struct ieee80211com *, struct ieee80211_node *,
87		    int, int, int);
88int		ipw_tx_start(struct ifnet *, struct mbuf *,
89		    struct ieee80211_node *);
90void		ipw_start(struct ifnet *);
91void		ipw_watchdog(struct ifnet *);
92int		ipw_ioctl(struct ifnet *, u_long, caddr_t);
93uint32_t	ipw_read_table1(struct ipw_softc *, uint32_t);
94void		ipw_write_table1(struct ipw_softc *, uint32_t, uint32_t);
95int		ipw_read_table2(struct ipw_softc *, uint32_t, void *,
96		    uint32_t *);
97void		ipw_stop_master(struct ipw_softc *);
98int		ipw_reset(struct ipw_softc *);
99int		ipw_load_ucode(struct ipw_softc *, u_char *, int);
100int		ipw_load_firmware(struct ipw_softc *, u_char *, int);
101int		ipw_read_firmware(struct ipw_softc *, struct ipw_firmware *);
102void		ipw_scan(void *, void *);
103void		ipw_auth_and_assoc(void *, void *);
104int		ipw_config(struct ipw_softc *);
105int		ipw_init(struct ifnet *);
106void		ipw_stop(struct ifnet *, int);
107void		ipw_read_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
108		    bus_size_t);
109void		ipw_write_mem_1(struct ipw_softc *, bus_size_t, uint8_t *,
110		    bus_size_t);
111
112static __inline uint8_t
113MEM_READ_1(struct ipw_softc *sc, uint32_t addr)
114{
115	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
116	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
117}
118
119static __inline uint32_t
120MEM_READ_4(struct ipw_softc *sc, uint32_t addr)
121{
122	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
123	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
124}
125
126#ifdef IPW_DEBUG
127#define DPRINTF(x)	do { if (ipw_debug > 0) printf x; } while (0)
128#define DPRINTFN(n, x)	do { if (ipw_debug >= (n)) printf x; } while (0)
129int ipw_debug = 0;
130#else
131#define DPRINTF(x)
132#define DPRINTFN(n, x)
133#endif
134
135struct cfattach ipw_ca = {
136	sizeof (struct ipw_softc), ipw_match, ipw_attach
137};
138
139int
140ipw_match(struct device *parent, void *match, void *aux)
141{
142	struct pci_attach_args *pa = aux;
143
144	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
145	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2100)
146		return 1;
147
148	return 0;
149}
150
151/* Base Address Register */
152#define IPW_PCI_BAR0	0x10
153
154void
155ipw_attach(struct device *parent, struct device *self, void *aux)
156{
157	struct ipw_softc *sc = (struct ipw_softc *)self;
158	struct ieee80211com *ic = &sc->sc_ic;
159	struct ifnet *ifp = &ic->ic_if;
160	struct pci_attach_args *pa = aux;
161	const char *intrstr;
162	bus_space_tag_t memt;
163	bus_space_handle_t memh;
164	bus_addr_t base;
165	pci_intr_handle_t ih;
166	pcireg_t data;
167	uint16_t val;
168	int error, i;
169
170	sc->sc_pct = pa->pa_pc;
171	sc->sc_pcitag = pa->pa_tag,
172
173	/* clear device specific PCI configuration register 0x41 */
174	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
175	data &= ~0x0000ff00;
176	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
177
178	/* map the register window */
179	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
180	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
181	if (error != 0) {
182		printf(": could not map memory space\n");
183		return;
184	}
185
186	sc->sc_st = memt;
187	sc->sc_sh = memh;
188	sc->sc_dmat = pa->pa_dmat;
189
190	/* disable interrupts */
191	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
192
193	if (pci_intr_map(pa, &ih) != 0) {
194		printf(": could not map interrupt\n");
195		return;
196	}
197
198	intrstr = pci_intr_string(sc->sc_pct, ih);
199	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
200	    sc->sc_dev.dv_xname);
201	if (sc->sc_ih == NULL) {
202		printf(": could not establish interrupt");
203		if (intrstr != NULL)
204			printf(" at %s", intrstr);
205		printf("\n");
206		return;
207	}
208	printf(": %s", intrstr);
209
210	if (ipw_reset(sc) != 0) {
211		printf(": could not reset adapter\n");
212		return;
213	}
214
215	if (ipw_dma_alloc(sc) != 0) {
216		printf(": failed to allocate DMA resources\n");
217		return;
218	}
219
220	ic->ic_phytype = IEEE80211_T_DS;
221	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
222	ic->ic_state = IEEE80211_S_INIT;
223
224	/* set device capabilities */
225	ic->ic_caps =
226#ifndef IEEE80211_STA_ONLY
227	    IEEE80211_C_IBSS |		/* IBSS mode supported */
228#endif
229	    IEEE80211_C_MONITOR |	/* monitor mode supported */
230	    IEEE80211_C_TXPMGT |	/* tx power management */
231	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
232	    IEEE80211_C_WEP |		/* s/w WEP */
233	    IEEE80211_C_RSN |		/* WPA/RSN */
234	    IEEE80211_C_SCANALL;	/* h/w scanning */
235
236	/* read MAC address from EEPROM */
237	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 0);
238	ic->ic_myaddr[0] = val >> 8;
239	ic->ic_myaddr[1] = val & 0xff;
240	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 1);
241	ic->ic_myaddr[2] = val >> 8;
242	ic->ic_myaddr[3] = val & 0xff;
243	val = ipw_read_prom_word(sc, IPW_EEPROM_MAC + 2);
244	ic->ic_myaddr[4] = val >> 8;
245	ic->ic_myaddr[5] = val & 0xff;
246
247	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
248
249	/* set supported .11b rates */
250	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
251
252	/* set supported .11b channels (1 through 14) */
253	for (i = 1; i <= 14; i++) {
254		ic->ic_channels[i].ic_freq =
255		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
256		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
257	}
258
259	/* IBSS channel undefined for now */
260	ic->ic_ibss_chan = &ic->ic_channels[0];
261
262	ifp->if_softc = sc;
263	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
264	ifp->if_init = ipw_init;
265	ifp->if_ioctl = ipw_ioctl;
266	ifp->if_start = ipw_start;
267	ifp->if_watchdog = ipw_watchdog;
268	IFQ_SET_READY(&ifp->if_snd);
269	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
270
271	if_attach(ifp);
272	ieee80211_ifattach(ifp);
273	/* override state transition machine */
274	sc->sc_newstate = ic->ic_newstate;
275	ic->ic_newstate = ipw_newstate;
276	ic->ic_send_mgmt = ipw_send_mgmt;
277	ieee80211_media_init(ifp, ipw_media_change, ipw_media_status);
278
279	sc->powerhook = powerhook_establish(ipw_power, sc);
280
281#if NBPFILTER > 0
282	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
283	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
284
285	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
286	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
287	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
288
289	sc->sc_txtap_len = sizeof sc->sc_txtapu;
290	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
291	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
292#endif
293}
294
295void
296ipw_power(int why, void *arg)
297{
298	struct ipw_softc *sc = arg;
299	struct ifnet *ifp;
300	pcireg_t data;
301
302	if (why != PWR_RESUME)
303		return;
304
305	/* clear device specific PCI configuration register 0x41 */
306	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
307	data &= ~0x0000ff00;
308	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
309
310	ifp = &sc->sc_ic.ic_if;
311	if (ifp->if_flags & IFF_UP) {
312		ifp->if_init(ifp);
313		if (ifp->if_flags & IFF_RUNNING)
314			ifp->if_start(ifp);
315	}
316}
317
318int
319ipw_dma_alloc(struct ipw_softc *sc)
320{
321	struct ipw_soft_bd *sbd;
322	struct ipw_soft_hdr *shdr;
323	struct ipw_soft_buf *sbuf;
324	int i, nsegs, error;
325
326	/*
327	 * Allocate and map tx ring.
328	 */
329	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
330	    BUS_DMA_NOWAIT, &sc->tbd_map);
331	if (error != 0) {
332		printf("%s: could not create tx ring DMA map\n",
333		    sc->sc_dev.dv_xname);
334		goto fail;
335	}
336
337	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
338	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
339	if (error != 0) {
340		printf("%s: could not allocate tx ring DMA memory\n",
341		    sc->sc_dev.dv_xname);
342		goto fail;
343	}
344
345	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
346	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
347	if (error != 0) {
348		printf("%s: could not map tx ring DMA memory\n",
349		    sc->sc_dev.dv_xname);
350		goto fail;
351	}
352
353	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
354	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
355	if (error != 0) {
356		printf("%s: could not load tx ring DMA map\n",
357		    sc->sc_dev.dv_xname);
358		goto fail;
359	}
360
361	/*
362	 * Allocate and map rx ring.
363	 */
364	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
365	    BUS_DMA_NOWAIT, &sc->rbd_map);
366	if (error != 0) {
367		printf("%s: could not create rx ring DMA map\n",
368		    sc->sc_dev.dv_xname);
369		goto fail;
370	}
371
372	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
373	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
374	if (error != 0) {
375		printf("%s: could not allocate rx ring DMA memory\n",
376		    sc->sc_dev.dv_xname);
377		goto fail;
378	}
379
380	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
381	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
382	if (error != 0) {
383		printf("%s: could not map rx ring DMA memory\n",
384		    sc->sc_dev.dv_xname);
385		goto fail;
386	}
387
388	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
389	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
390	if (error != 0) {
391		printf("%s: could not load tx ring DMA map\n",
392		    sc->sc_dev.dv_xname);
393		goto fail;
394	}
395
396	/*
397	 * Allocate and map status ring.
398	 */
399	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
400	    0, BUS_DMA_NOWAIT, &sc->status_map);
401	if (error != 0) {
402		printf("%s: could not create status ring DMA map\n",
403		    sc->sc_dev.dv_xname);
404		goto fail;
405	}
406
407	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
408	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
409	if (error != 0) {
410		printf("%s: could not allocate status ring DMA memory\n",
411		    sc->sc_dev.dv_xname);
412		goto fail;
413	}
414
415	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
416	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
417	if (error != 0) {
418		printf("%s: could not map status ring DMA memory\n",
419		    sc->sc_dev.dv_xname);
420		goto fail;
421	}
422
423	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
424	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
425	if (error != 0) {
426		printf("%s: could not load status ring DMA map\n",
427		    sc->sc_dev.dv_xname);
428		goto fail;
429	}
430
431	/*
432	 * Allocate command DMA map.
433	 */
434	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
435	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
436	if (error != 0) {
437		printf("%s: could not create command DMA map\n",
438		    sc->sc_dev.dv_xname);
439		goto fail;
440	}
441
442	/*
443	 * Allocate headers DMA maps.
444	 */
445	SLIST_INIT(&sc->free_shdr);
446	for (i = 0; i < IPW_NDATA; i++) {
447		shdr = &sc->shdr_list[i];
448		error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_hdr),
449		    1, sizeof (struct ipw_hdr), 0, BUS_DMA_NOWAIT, &shdr->map);
450		if (error != 0) {
451			printf("%s: could not create header DMA map\n",
452			    sc->sc_dev.dv_xname);
453			goto fail;
454		}
455		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
456	}
457
458	/*
459	 * Allocate tx buffers DMA maps.
460	 */
461	SLIST_INIT(&sc->free_sbuf);
462	for (i = 0; i < IPW_NDATA; i++) {
463		sbuf = &sc->tx_sbuf_list[i];
464		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IPW_MAX_NSEG,
465		    MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
466		if (error != 0) {
467			printf("%s: could not create tx DMA map\n",
468			    sc->sc_dev.dv_xname);
469			goto fail;
470		}
471		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
472	}
473
474	/*
475	 * Initialize tx ring.
476	 */
477	for (i = 0; i < IPW_NTBD; i++) {
478		sbd = &sc->stbd_list[i];
479		sbd->bd = &sc->tbd_list[i];
480		sbd->type = IPW_SBD_TYPE_NOASSOC;
481	}
482
483	/*
484	 * Pre-allocate rx buffers and DMA maps.
485	 */
486	for (i = 0; i < IPW_NRBD; i++) {
487		sbd = &sc->srbd_list[i];
488		sbuf = &sc->rx_sbuf_list[i];
489		sbd->bd = &sc->rbd_list[i];
490
491		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
492		if (sbuf->m == NULL) {
493			printf("%s: could not allocate rx mbuf\n",
494			    sc->sc_dev.dv_xname);
495			error = ENOMEM;
496			goto fail;
497		}
498		MCLGET(sbuf->m, M_DONTWAIT);
499		if (!(sbuf->m->m_flags & M_EXT)) {
500			m_freem(sbuf->m);
501			printf("%s: could not allocate rx mbuf cluster\n",
502			    sc->sc_dev.dv_xname);
503			error = ENOMEM;
504			goto fail;
505		}
506
507		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
508		    0, BUS_DMA_NOWAIT, &sbuf->map);
509		if (error != 0) {
510			printf("%s: could not create rx DMA map\n",
511			    sc->sc_dev.dv_xname);
512			goto fail;
513		}
514
515		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
516		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
517		if (error != 0) {
518			printf("%s: could not map rx DMA memory\n",
519			    sc->sc_dev.dv_xname);
520			goto fail;
521		}
522
523		sbd->type = IPW_SBD_TYPE_DATA;
524		sbd->priv = sbuf;
525		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
526		sbd->bd->len = htole32(MCLBYTES);
527	}
528
529	bus_dmamap_sync(sc->sc_dmat, sc->rbd_map, 0, IPW_RBD_SZ,
530	    BUS_DMASYNC_PREWRITE);
531
532	return 0;
533
534fail:	ipw_release(sc);
535	return error;
536}
537
538void
539ipw_release(struct ipw_softc *sc)
540{
541	struct ipw_soft_buf *sbuf;
542	int i;
543
544	if (sc->tbd_map != NULL) {
545		if (sc->tbd_list != NULL) {
546			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
547			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
548			    IPW_TBD_SZ);
549			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
550		}
551		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
552	}
553
554	if (sc->rbd_map != NULL) {
555		if (sc->rbd_list != NULL) {
556			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
557			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
558			    IPW_RBD_SZ);
559			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
560		}
561		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
562	}
563
564	if (sc->status_map != NULL) {
565		if (sc->status_list != NULL) {
566			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
567			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
568			    IPW_RBD_SZ);
569			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
570		}
571		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
572	}
573
574	if (sc->cmd_map != NULL)
575		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
576
577	for (i = 0; i < IPW_NDATA; i++)
578		bus_dmamap_destroy(sc->sc_dmat, sc->shdr_list[i].map);
579
580	for (i = 0; i < IPW_NDATA; i++)
581		bus_dmamap_destroy(sc->sc_dmat, sc->tx_sbuf_list[i].map);
582
583	for (i = 0; i < IPW_NRBD; i++) {
584		sbuf = &sc->rx_sbuf_list[i];
585		if (sbuf->map != NULL) {
586			if (sbuf->m != NULL) {
587				bus_dmamap_unload(sc->sc_dmat, sbuf->map);
588				m_freem(sbuf->m);
589			}
590			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
591		}
592	}
593}
594
595int
596ipw_media_change(struct ifnet *ifp)
597{
598	int error;
599
600	error = ieee80211_media_change(ifp);
601	if (error != ENETRESET)
602		return error;
603
604	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
605		ipw_init(ifp);
606
607	return 0;
608}
609
610void
611ipw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
612{
613	struct ipw_softc *sc = ifp->if_softc;
614	struct ieee80211com *ic = &sc->sc_ic;
615	static const struct {
616		uint32_t	val;
617		int		rate;
618	} rates[] = {
619		{ IPW_RATE_DS1,   2 },
620		{ IPW_RATE_DS2,   4 },
621		{ IPW_RATE_DS5,  11 },
622		{ IPW_RATE_DS11, 22 },
623	};
624	uint32_t val;
625	int rate, i;
626
627	imr->ifm_status = IFM_AVALID;
628	imr->ifm_active = IFM_IEEE80211;
629	if (ic->ic_state == IEEE80211_S_RUN)
630		imr->ifm_status |= IFM_ACTIVE;
631
632	/* read current transmission rate from adapter */
633	val = ipw_read_table1(sc, IPW_INFO_CURRENT_TX_RATE);
634	val &= 0xf;
635
636	/* convert rate to 802.11 rate */
637	for (i = 0; i < nitems(rates) && rates[i].val != val; i++);
638	rate = (i < nitems(rates)) ? rates[i].rate : 0;
639
640	imr->ifm_active |= IFM_IEEE80211_11B;
641	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
642	switch (ic->ic_opmode) {
643	case IEEE80211_M_STA:
644		break;
645#ifndef IEEE80211_STA_ONLY
646	case IEEE80211_M_IBSS:
647		imr->ifm_active |= IFM_IEEE80211_IBSS;
648		break;
649#endif
650	case IEEE80211_M_MONITOR:
651		imr->ifm_active |= IFM_IEEE80211_MONITOR;
652		break;
653	default:
654		/* should not get there */
655		break;
656	}
657}
658
659int
660ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
661{
662	struct ipw_softc *sc = ic->ic_softc;
663	int error;
664
665	switch (nstate) {
666	case IEEE80211_S_SCAN:
667		error = workq_add_task(NULL, 0, ipw_scan, sc, NULL);
668		if (error != 0)
669			return error;
670		break;
671
672	case IEEE80211_S_AUTH:
673		error = workq_add_task(NULL, 0, ipw_auth_and_assoc, sc, NULL);
674		if (error != 0)
675			return error;
676		break;
677
678	case IEEE80211_S_RUN:
679	case IEEE80211_S_INIT:
680	case IEEE80211_S_ASSOC:
681		/* nothing to do */
682		break;
683	}
684
685	ic->ic_state = nstate;
686	return 0;
687}
688
689/*
690 * Read 16 bits at address 'addr' from the Microwire EEPROM.
691 * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
692 */
693uint16_t
694ipw_read_prom_word(struct ipw_softc *sc, uint8_t addr)
695{
696	uint32_t tmp;
697	uint16_t val;
698	int n;
699
700	/* clock C once before the first command */
701	IPW_EEPROM_CTL(sc, 0);
702	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
703	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
704	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
705
706	/* write start bit (1) */
707	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
708	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
709
710	/* write READ opcode (10) */
711	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D);
712	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_D | IPW_EEPROM_C);
713	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
714	IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
715
716	/* write address A7-A0 */
717	for (n = 7; n >= 0; n--) {
718		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
719		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D));
720		IPW_EEPROM_CTL(sc, IPW_EEPROM_S |
721		    (((addr >> n) & 1) << IPW_EEPROM_SHIFT_D) | IPW_EEPROM_C);
722	}
723
724	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
725
726	/* read data Q15-Q0 */
727	val = 0;
728	for (n = 15; n >= 0; n--) {
729		IPW_EEPROM_CTL(sc, IPW_EEPROM_S | IPW_EEPROM_C);
730		IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
731		tmp = MEM_READ_4(sc, IPW_MEM_EEPROM_CTL);
732		val |= ((tmp & IPW_EEPROM_Q) >> IPW_EEPROM_SHIFT_Q) << n;
733	}
734
735	IPW_EEPROM_CTL(sc, 0);
736
737	/* clear Chip Select and clock C */
738	IPW_EEPROM_CTL(sc, IPW_EEPROM_S);
739	IPW_EEPROM_CTL(sc, 0);
740	IPW_EEPROM_CTL(sc, IPW_EEPROM_C);
741
742	return val;
743}
744
745void
746ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
747{
748	struct ipw_cmd *cmd;
749
750	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
751	    BUS_DMASYNC_POSTREAD);
752
753	cmd = mtod(sbuf->m, struct ipw_cmd *);
754
755	DPRINTFN(2, ("received command ack type=%u,status=%u\n",
756	    letoh32(cmd->type), letoh32(cmd->status)));
757
758	wakeup(&sc->cmd);
759}
760
761void
762ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
763{
764	struct ieee80211com *ic = &sc->sc_ic;
765	struct ifnet *ifp = &ic->ic_if;
766	uint32_t state;
767
768	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
769	    BUS_DMASYNC_POSTREAD);
770
771	state = letoh32(*mtod(sbuf->m, uint32_t *));
772
773	DPRINTFN(2, ("firmware state changed to 0x%x\n", state));
774
775	switch (state) {
776	case IPW_STATE_ASSOCIATED:
777		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
778		break;
779
780	case IPW_STATE_SCANNING:
781		if (ic->ic_state == IEEE80211_S_RUN)
782			ieee80211_begin_scan(ifp);
783		break;
784
785	case IPW_STATE_SCAN_COMPLETE:
786		if (ic->ic_state == IEEE80211_S_SCAN)
787			ieee80211_end_scan(ifp);
788		break;
789
790	case IPW_STATE_ASSOCIATION_LOST:
791		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
792		break;
793
794	case IPW_STATE_DISABLED:
795		wakeup(sc);
796		break;
797
798	case IPW_STATE_RADIO_DISABLED:
799		ifp->if_flags &= ~IFF_UP;
800		ipw_stop(&ic->ic_if, 1);
801		break;
802	}
803}
804
805void
806ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
807    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
808{
809	struct ieee80211com *ic = &sc->sc_ic;
810	struct ifnet *ifp = &ic->ic_if;
811	struct mbuf *mnew, *m;
812	struct ieee80211_frame *wh;
813	struct ieee80211_rxinfo rxi;
814	struct ieee80211_node *ni;
815	int error;
816
817	DPRINTFN(5, ("received data frame len=%u,rssi=%u\n",
818	    letoh32(status->len), status->rssi));
819
820	/*
821	 * Try to allocate a new mbuf for this ring element and load it before
822	 * processing the current mbuf.  If the ring element cannot be loaded,
823	 * drop the received packet and reuse the old mbuf.  In the unlikely
824	 * case that the old mbuf can't be reloaded either, explicitly panic.
825	 */
826	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
827	if (mnew == NULL) {
828		ifp->if_ierrors++;
829		return;
830	}
831	MCLGET(mnew, M_DONTWAIT);
832	if (!(mnew->m_flags & M_EXT)) {
833		m_freem(mnew);
834		ifp->if_ierrors++;
835		return;
836	}
837
838	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
839	    BUS_DMASYNC_POSTREAD);
840	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
841
842	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(mnew, void *),
843	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
844	if (error != 0) {
845		m_freem(mnew);
846
847		/* try to reload the old mbuf */
848		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
849		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
850		if (error != 0) {
851			/* very unlikely that it will fail... */
852			panic("%s: could not load old rx mbuf",
853			    sc->sc_dev.dv_xname);
854		}
855		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
856		ifp->if_ierrors++;
857		return;
858	}
859
860	m = sbuf->m;
861	sbuf->m = mnew;
862	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
863
864	/* finalize mbuf */
865	m->m_pkthdr.rcvif = ifp;
866	m->m_pkthdr.len = m->m_len = letoh32(status->len);
867
868#if NBPFILTER > 0
869	if (sc->sc_drvbpf != NULL) {
870		struct mbuf mb;
871		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
872
873		tap->wr_flags = 0;
874		tap->wr_antsignal = status->rssi;
875		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
876		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
877
878		mb.m_data = (caddr_t)tap;
879		mb.m_len = sc->sc_rxtap_len;
880		mb.m_next = m;
881		mb.m_nextpkt = NULL;
882		mb.m_type = 0;
883		mb.m_flags = 0;
884		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
885	}
886#endif
887
888	wh = mtod(m, struct ieee80211_frame *);
889	ni = ieee80211_find_rxnode(ic, wh);
890
891	/* send the frame to the upper layer */
892	rxi.rxi_flags = 0;
893	rxi.rxi_rssi = status->rssi;
894	rxi.rxi_tstamp = 0;	/* unused */
895	ieee80211_input(ifp, m, ni, &rxi);
896
897	ieee80211_release_node(ic, ni);
898}
899
900void
901ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
902{
903	DPRINTFN(2, ("received notification\n"));
904}
905
906void
907ipw_rx_intr(struct ipw_softc *sc)
908{
909	struct ipw_status *status;
910	struct ipw_soft_bd *sbd;
911	struct ipw_soft_buf *sbuf;
912	uint32_t r, i;
913
914	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
915
916	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
917
918		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
919		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
920		    BUS_DMASYNC_POSTREAD);
921
922		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
923		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
924		    BUS_DMASYNC_POSTREAD);
925
926		status = &sc->status_list[i];
927		sbd = &sc->srbd_list[i];
928		sbuf = sbd->priv;
929
930		switch (letoh16(status->code) & 0xf) {
931		case IPW_STATUS_CODE_COMMAND:
932			ipw_command_intr(sc, sbuf);
933			break;
934
935		case IPW_STATUS_CODE_NEWSTATE:
936			ipw_newstate_intr(sc, sbuf);
937			break;
938
939		case IPW_STATUS_CODE_DATA_802_3:
940		case IPW_STATUS_CODE_DATA_802_11:
941			ipw_data_intr(sc, status, sbd, sbuf);
942			break;
943
944		case IPW_STATUS_CODE_NOTIFICATION:
945			ipw_notification_intr(sc, sbuf);
946			break;
947
948		default:
949			printf("%s: unknown status code %u\n",
950			    sc->sc_dev.dv_xname, letoh16(status->code));
951		}
952		sbd->bd->flags = 0;
953
954		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
955		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
956		    BUS_DMASYNC_PREWRITE);
957	}
958
959	/* tell the firmware what we have processed */
960	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
961	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
962}
963
964void
965ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
966{
967	struct ieee80211com *ic = &sc->sc_ic;
968	struct ipw_soft_hdr *shdr;
969	struct ipw_soft_buf *sbuf;
970
971	switch (sbd->type) {
972	case IPW_SBD_TYPE_COMMAND:
973		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
974		break;
975
976	case IPW_SBD_TYPE_HEADER:
977		shdr = sbd->priv;
978		bus_dmamap_unload(sc->sc_dmat, shdr->map);
979		SLIST_INSERT_HEAD(&sc->free_shdr, shdr, next);
980		break;
981
982	case IPW_SBD_TYPE_DATA:
983		sbuf = sbd->priv;
984		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
985		SLIST_INSERT_HEAD(&sc->free_sbuf, sbuf, next);
986
987		m_freem(sbuf->m);
988
989		if (sbuf->ni != NULL)
990			ieee80211_release_node(ic, sbuf->ni);
991
992		/* kill watchdog timer */
993		sc->sc_tx_timer = 0;
994		break;
995	}
996	sbd->type = IPW_SBD_TYPE_NOASSOC;
997}
998
999void
1000ipw_tx_intr(struct ipw_softc *sc)
1001{
1002	struct ifnet *ifp = &sc->sc_ic.ic_if;
1003	struct ipw_soft_bd *sbd;
1004	uint32_t r, i;
1005
1006	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
1007
1008	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD) {
1009		sbd = &sc->stbd_list[i];
1010
1011		if (sbd->type == IPW_SBD_TYPE_DATA)
1012			ifp->if_opackets++;
1013
1014		ipw_release_sbd(sc, sbd);
1015		sc->txfree++;
1016	}
1017
1018	/* remember what the firmware has processed */
1019	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
1020
1021	/* call start() since some buffer descriptors have been released */
1022	ifp->if_flags &= ~IFF_OACTIVE;
1023	(*ifp->if_start)(ifp);
1024}
1025
1026int
1027ipw_intr(void *arg)
1028{
1029	struct ipw_softc *sc = arg;
1030	struct ifnet *ifp = &sc->sc_ic.ic_if;
1031	uint32_t r;
1032
1033	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0 || r == 0xffffffff)
1034		return 0;
1035
1036	/* disable interrupts */
1037	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1038
1039	if (r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)) {
1040		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1041		ifp->if_flags &= ~IFF_UP;
1042		ipw_stop(ifp, 1);
1043		return 1;
1044	}
1045
1046	if (r & IPW_INTR_FW_INIT_DONE)
1047		wakeup(sc);
1048
1049	if (r & IPW_INTR_RX_TRANSFER)
1050		ipw_rx_intr(sc);
1051
1052	if (r & IPW_INTR_TX_TRANSFER)
1053		ipw_tx_intr(sc);
1054
1055	/* acknowledge interrupts */
1056	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
1057
1058	/* re-enable interrupts */
1059	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1060
1061	return 1;
1062}
1063
1064int
1065ipw_cmd(struct ipw_softc *sc, uint32_t type, void *data, uint32_t len)
1066{
1067	struct ipw_soft_bd *sbd;
1068	int s, error;
1069
1070	s = splnet();
1071
1072	sc->cmd.type = htole32(type);
1073	sc->cmd.subtype = htole32(0);
1074	sc->cmd.len = htole32(len);
1075	sc->cmd.seq = htole32(0);
1076	if (data != NULL)
1077		bcopy(data, sc->cmd.data, len);
1078
1079	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, &sc->cmd,
1080	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
1081	if (error != 0) {
1082		printf("%s: could not map command DMA memory\n",
1083		    sc->sc_dev.dv_xname);
1084		splx(s);
1085		return error;
1086	}
1087
1088	sbd = &sc->stbd_list[sc->txcur];
1089	sbd->type = IPW_SBD_TYPE_COMMAND;
1090	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
1091	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
1092	sbd->bd->nfrag = 1;
1093	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
1094	    IPW_BD_FLAG_TX_LAST_FRAGMENT;
1095
1096	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
1097	    BUS_DMASYNC_PREWRITE);
1098	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1099	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
1100	    BUS_DMASYNC_PREWRITE);
1101
1102	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1103	sc->txfree--;
1104	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1105
1106	DPRINTFN(2, ("sending command type=%u,len=%u\n", type, len));
1107
1108	/* wait at most one second for command to complete */
1109	error = tsleep(&sc->cmd, 0, "ipwcmd", hz);
1110	splx(s);
1111
1112	return error;
1113}
1114
1115/* ARGSUSED */
1116int
1117ipw_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, int type,
1118    int arg1, int arg2)
1119{
1120	return EOPNOTSUPP;
1121}
1122
1123int
1124ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
1125{
1126	struct ipw_softc *sc = ifp->if_softc;
1127	struct ieee80211com *ic = &sc->sc_ic;
1128	struct ieee80211_frame *wh;
1129	struct ieee80211_key *k;
1130	struct mbuf *m1;
1131	struct ipw_soft_bd *sbd;
1132	struct ipw_soft_hdr *shdr;
1133	struct ipw_soft_buf *sbuf;
1134	int error, i;
1135
1136	wh = mtod(m, struct ieee80211_frame *);
1137
1138	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1139		k = ieee80211_get_txkey(ic, wh, ni);
1140
1141		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1142			return ENOBUFS;
1143
1144		/* packet header may have moved, reset our local pointer */
1145		wh = mtod(m, struct ieee80211_frame *);
1146	}
1147
1148#if NBPFILTER > 0
1149	if (sc->sc_drvbpf != NULL) {
1150		struct mbuf mb;
1151		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
1152
1153		tap->wt_flags = 0;
1154		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1155		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1156
1157		mb.m_data = (caddr_t)tap;
1158		mb.m_len = sc->sc_txtap_len;
1159		mb.m_next = m;
1160		mb.m_nextpkt = NULL;
1161		mb.m_type = 0;
1162		mb.m_flags = 0;
1163		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1164	}
1165#endif
1166
1167	shdr = SLIST_FIRST(&sc->free_shdr);
1168	sbuf = SLIST_FIRST(&sc->free_sbuf);
1169
1170	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
1171	shdr->hdr.subtype = htole32(0);
1172	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) ? 1 : 0;
1173	shdr->hdr.encrypt = 0;
1174	shdr->hdr.keyidx = 0;
1175	shdr->hdr.keysz = 0;
1176	shdr->hdr.fragmentsz = htole16(0);
1177	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
1178	if (ic->ic_opmode == IEEE80211_M_STA)
1179		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
1180	else
1181		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
1182
1183	/* trim IEEE802.11 header */
1184	m_adj(m, sizeof (struct ieee80211_frame));
1185
1186	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
1187	if (error != 0 && error != EFBIG) {
1188		printf("%s: could not map mbuf (error %d)\n",
1189		    sc->sc_dev.dv_xname, error);
1190		m_freem(m);
1191		return error;
1192	}
1193	if (error != 0) {
1194		/* too many fragments, linearize */
1195		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1196		if (m1 == NULL) {
1197			m_freem(m);
1198			return ENOBUFS;
1199		}
1200		if (m->m_pkthdr.len > MHLEN) {
1201			MCLGET(m1, M_DONTWAIT);
1202			if (!(m1->m_flags & M_EXT)) {
1203				m_freem(m);
1204				m_freem(m1);
1205				return ENOBUFS;
1206			}
1207		}
1208		m_copydata(m, 0, m->m_pkthdr.len, mtod(m1, caddr_t));
1209		m1->m_pkthdr.len = m1->m_len = m->m_pkthdr.len;
1210		m_freem(m);
1211		m = m1;
1212
1213		error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m,
1214		    BUS_DMA_NOWAIT);
1215		if (error != 0) {
1216			printf("%s: could not map mbuf (error %d)\n",
1217			    sc->sc_dev.dv_xname, error);
1218			m_freem(m);
1219			return error;
1220		}
1221	}
1222
1223	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
1224	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
1225	if (error != 0) {
1226		printf("%s: could not map header DMA memory (error %d)\n",
1227		    sc->sc_dev.dv_xname, error);
1228		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1229		m_freem(m);
1230		return error;
1231	}
1232
1233	SLIST_REMOVE_HEAD(&sc->free_sbuf, next);
1234	SLIST_REMOVE_HEAD(&sc->free_shdr, next);
1235
1236	sbd = &sc->stbd_list[sc->txcur];
1237	sbd->type = IPW_SBD_TYPE_HEADER;
1238	sbd->priv = shdr;
1239	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
1240	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
1241	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
1242	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
1243	    IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1244
1245	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1246	    sc->txcur * sizeof (struct ipw_bd),
1247	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1248
1249	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1250	sc->txfree--;
1251
1252	sbuf->m = m;
1253	sbuf->ni = ni;
1254
1255	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
1256		sbd = &sc->stbd_list[sc->txcur];
1257		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
1258		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
1259		sbd->bd->nfrag = 0;	/* used only in first bd */
1260		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
1261		if (i == sbuf->map->dm_nsegs - 1) {
1262			sbd->type = IPW_SBD_TYPE_DATA;
1263			sbd->priv = sbuf;
1264			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
1265		} else {
1266			sbd->type = IPW_SBD_TYPE_NOASSOC;
1267			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
1268		}
1269
1270		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
1271		    sc->txcur * sizeof (struct ipw_bd),
1272		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
1273
1274		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
1275		sc->txfree--;
1276	}
1277
1278	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sbuf->map->dm_mapsize,
1279	    BUS_DMASYNC_PREWRITE);
1280	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
1281	    BUS_DMASYNC_PREWRITE);
1282
1283	/* inform firmware about this new packet */
1284	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
1285
1286	return 0;
1287}
1288
1289void
1290ipw_start(struct ifnet *ifp)
1291{
1292	struct ipw_softc *sc = ifp->if_softc;
1293	struct ieee80211com *ic = &sc->sc_ic;
1294	struct ieee80211_node *ni;
1295	struct mbuf *m;
1296
1297	if (ic->ic_state != IEEE80211_S_RUN)
1298		return;
1299
1300	for (;;) {
1301		IFQ_POLL(&ifp->if_snd, m);
1302		if (m == NULL)
1303			break;
1304
1305		if (sc->txfree < 1 + IPW_MAX_NSEG) {
1306			ifp->if_flags |= IFF_OACTIVE;
1307			break;
1308		}
1309		IFQ_DEQUEUE(&ifp->if_snd, m);
1310#if NBPFILTER > 0
1311		if (ifp->if_bpf != NULL)
1312			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1313#endif
1314		m = ieee80211_encap(ifp, m, &ni);
1315		if (m == NULL)
1316			continue;
1317#if NBPFILTER > 0
1318		if (ic->ic_rawbpf != NULL)
1319			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1320#endif
1321		if (ipw_tx_start(ifp, m, ni) != 0) {
1322			if (ni != NULL)
1323				ieee80211_release_node(ic, ni);
1324			ifp->if_oerrors++;
1325			break;
1326		}
1327
1328		/* start watchdog timer */
1329		sc->sc_tx_timer = 5;
1330		ifp->if_timer = 1;
1331	}
1332}
1333
1334void
1335ipw_watchdog(struct ifnet *ifp)
1336{
1337	struct ipw_softc *sc = ifp->if_softc;
1338
1339	ifp->if_timer = 0;
1340
1341	if (sc->sc_tx_timer > 0) {
1342		if (--sc->sc_tx_timer == 0) {
1343			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1344			ifp->if_flags &= ~IFF_UP;
1345			ipw_stop(ifp, 1);
1346			ifp->if_oerrors++;
1347			return;
1348		}
1349		ifp->if_timer = 1;
1350	}
1351
1352	ieee80211_watchdog(ifp);
1353}
1354
1355int
1356ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1357{
1358	struct ipw_softc *sc = ifp->if_softc;
1359	struct ieee80211com *ic = &sc->sc_ic;
1360	struct ifaddr *ifa;
1361	struct ifreq *ifr;
1362	int s, error = 0;
1363
1364	s = splnet();
1365
1366	switch (cmd) {
1367	case SIOCSIFADDR:
1368		ifa = (struct ifaddr *)data;
1369		ifp->if_flags |= IFF_UP;
1370#ifdef INET
1371		if (ifa->ifa_addr->sa_family == AF_INET)
1372			arp_ifinit(&ic->ic_ac, ifa);
1373#endif
1374		/* FALLTHROUGH */
1375	case SIOCSIFFLAGS:
1376		if (ifp->if_flags & IFF_UP) {
1377			if (!(ifp->if_flags & IFF_RUNNING))
1378				ipw_init(ifp);
1379		} else {
1380			if (ifp->if_flags & IFF_RUNNING)
1381				ipw_stop(ifp, 1);
1382		}
1383		break;
1384
1385	case SIOCADDMULTI:
1386	case SIOCDELMULTI:
1387		ifr = (struct ifreq *)data;
1388		error = (cmd == SIOCADDMULTI) ?
1389		    ether_addmulti(ifr, &ic->ic_ac) :
1390		    ether_delmulti(ifr, &ic->ic_ac);
1391
1392		if (error == ENETRESET)
1393			error = 0;
1394		break;
1395
1396	case SIOCG80211TXPOWER:
1397		/*
1398		 * If the hardware radio transmitter switch is off, report a
1399		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1400		 * transmitter is killed.
1401		 */
1402		((struct ieee80211_txpower *)data)->i_val =
1403		    (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ?
1404		    IEEE80211_TXPOWER_MIN : sc->sc_ic.ic_txpower;
1405		break;
1406
1407	default:
1408		error = ieee80211_ioctl(ifp, cmd, data);
1409	}
1410
1411	if (error == ENETRESET) {
1412		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1413		    (IFF_UP | IFF_RUNNING))
1414			ipw_init(ifp);
1415		error = 0;
1416	}
1417
1418	splx(s);
1419	return error;
1420}
1421
1422uint32_t
1423ipw_read_table1(struct ipw_softc *sc, uint32_t off)
1424{
1425	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1426}
1427
1428void
1429ipw_write_table1(struct ipw_softc *sc, uint32_t off, uint32_t info)
1430{
1431	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1432}
1433
1434int
1435ipw_read_table2(struct ipw_softc *sc, uint32_t off, void *buf, uint32_t *len)
1436{
1437	uint32_t addr, info;
1438	uint16_t count, size;
1439	uint32_t total;
1440
1441	/* addr[4] + count[2] + size[2] */
1442	addr = MEM_READ_4(sc, sc->table2_base + off);
1443	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1444
1445	count = info >> 16;
1446	size  = info & 0xffff;
1447	total = count * size;
1448
1449	if (total > *len) {
1450		*len = total;
1451		return EINVAL;
1452	}
1453	*len = total;
1454	ipw_read_mem_1(sc, addr, buf, total);
1455
1456	return 0;
1457}
1458
1459void
1460ipw_stop_master(struct ipw_softc *sc)
1461{
1462	uint32_t tmp;
1463	int ntries;
1464
1465	/* disable interrupts */
1466	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1467
1468	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1469	for (ntries = 0; ntries < 50; ntries++) {
1470		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1471			break;
1472		DELAY(10);
1473	}
1474	if (ntries == 50)
1475		printf("%s: timeout waiting for master\n",
1476		    sc->sc_dev.dv_xname);
1477
1478	tmp = CSR_READ_4(sc, IPW_CSR_RST);
1479	CSR_WRITE_4(sc, IPW_CSR_RST, tmp | IPW_RST_PRINCETON_RESET);
1480
1481	sc->flags &= ~IPW_FLAG_FW_INITED;
1482}
1483
1484int
1485ipw_reset(struct ipw_softc *sc)
1486{
1487	uint32_t tmp;
1488	int ntries;
1489
1490	ipw_stop_master(sc);
1491
1492	/* move adapter to D0 state */
1493	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1494	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_INIT);
1495
1496	/* wait for clock stabilization */
1497	for (ntries = 0; ntries < 1000; ntries++) {
1498		if (CSR_READ_4(sc, IPW_CSR_CTL) & IPW_CTL_CLOCK_READY)
1499			break;
1500		DELAY(200);
1501	}
1502	if (ntries == 1000)
1503		return EIO;
1504
1505	tmp = CSR_READ_4(sc, IPW_CSR_RST);
1506	CSR_WRITE_4(sc, IPW_CSR_RST, tmp | IPW_RST_SW_RESET);
1507
1508	DELAY(10);
1509
1510	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1511	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_INIT);
1512
1513	return 0;
1514}
1515
1516int
1517ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1518{
1519	int ntries;
1520
1521	/* voodoo from the Intel Linux driver */
1522	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1523	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1524
1525	MEM_WRITE_2(sc, 0x220000, 0x0703);
1526	MEM_WRITE_2(sc, 0x220000, 0x0707);
1527
1528	MEM_WRITE_1(sc, 0x210014, 0x72);
1529	MEM_WRITE_1(sc, 0x210014, 0x72);
1530
1531	MEM_WRITE_1(sc, 0x210000, 0x40);
1532	MEM_WRITE_1(sc, 0x210000, 0x00);
1533	MEM_WRITE_1(sc, 0x210000, 0x40);
1534
1535	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1536
1537	MEM_WRITE_1(sc, 0x210000, 0x00);
1538	MEM_WRITE_1(sc, 0x210000, 0x00);
1539	MEM_WRITE_1(sc, 0x210000, 0x80);
1540
1541	MEM_WRITE_2(sc, 0x220000, 0x0703);
1542	MEM_WRITE_2(sc, 0x220000, 0x0707);
1543
1544	MEM_WRITE_1(sc, 0x210014, 0x72);
1545	MEM_WRITE_1(sc, 0x210014, 0x72);
1546
1547	MEM_WRITE_1(sc, 0x210000, 0x00);
1548	MEM_WRITE_1(sc, 0x210000, 0x80);
1549
1550	for (ntries = 0; ntries < 100; ntries++) {
1551		if (MEM_READ_1(sc, 0x210000) & 1)
1552			break;
1553		DELAY(1000);
1554	}
1555	if (ntries == 100) {
1556		printf("%s: timeout waiting for ucode to initialize\n",
1557		    sc->sc_dev.dv_xname);
1558		return EIO;
1559	}
1560
1561	MEM_WRITE_4(sc, 0x3000e0, 0);
1562
1563	return 0;
1564}
1565
1566/* set of macros to handle unaligned little endian data in firmware image */
1567#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1568#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1569int
1570ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1571{
1572	u_char *p, *end;
1573	uint32_t tmp, dst;
1574	uint16_t len;
1575	int error;
1576
1577	p = fw;
1578	end = fw + size;
1579	while (p < end) {
1580		if (p + 6 > end)
1581			return EINVAL;
1582
1583		dst = GETLE32(p); p += 4;
1584		len = GETLE16(p); p += 2;
1585
1586		if (p + len > end)
1587			return EINVAL;
1588
1589		ipw_write_mem_1(sc, dst, p, len);
1590		p += len;
1591	}
1592
1593	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1594	    IPW_IO_LED_OFF);
1595
1596	/* allow interrupts so we know when the firmware is inited */
1597	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1598
1599	/* tell the adapter to initialize the firmware */
1600	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1601	tmp = CSR_READ_4(sc, IPW_CSR_CTL);
1602	CSR_WRITE_4(sc, IPW_CSR_CTL, tmp | IPW_CTL_ALLOW_STANDBY);
1603
1604	/* wait at most one second for firmware initialization to complete */
1605	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1606		printf("%s: timeout waiting for firmware initialization to "
1607		    "complete\n", sc->sc_dev.dv_xname);
1608		return error;
1609	}
1610
1611	tmp = CSR_READ_4(sc, IPW_CSR_IO);
1612	CSR_WRITE_4(sc, IPW_CSR_IO, tmp | IPW_IO_GPIO1_MASK |
1613	    IPW_IO_GPIO3_MASK);
1614
1615	return 0;
1616}
1617
1618int
1619ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
1620{
1621	const struct ipw_firmware_hdr *hdr;
1622	const char *name;
1623	size_t size;
1624	int error;
1625
1626	switch (sc->sc_ic.ic_opmode) {
1627	case IEEE80211_M_STA:
1628		name = "ipw-bss";
1629		break;
1630#ifndef IEEE80211_STA_ONLY
1631	case IEEE80211_M_IBSS:
1632		name = "ipw-ibss";
1633		break;
1634#endif
1635	case IEEE80211_M_MONITOR:
1636		name = "ipw-monitor";
1637		break;
1638	default:
1639		/* should not get there */
1640		return ENODEV;
1641	}
1642	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
1643		return error;
1644
1645	if (size < sizeof (*hdr)) {
1646		error = EINVAL;
1647		goto fail;
1648	}
1649	hdr = (const struct ipw_firmware_hdr *)fw->data;
1650	fw->main_size  = letoh32(hdr->main_size);
1651	fw->ucode_size = letoh32(hdr->ucode_size);
1652
1653	if (size < sizeof (*hdr) + fw->main_size + fw->ucode_size) {
1654		error = EINVAL;
1655		goto fail;
1656	}
1657	fw->main  = fw->data + sizeof (*hdr);
1658	fw->ucode = fw->main + fw->main_size;
1659
1660	return 0;
1661
1662fail:	free(fw->data, M_DEVBUF);
1663	return error;
1664}
1665
1666void
1667ipw_scan(void *arg1, void *arg2)
1668{
1669	struct ipw_softc *sc = arg1;
1670	struct ifnet *ifp = &sc->sc_ic.ic_if;
1671	struct ipw_scan_options scan;
1672	uint8_t ssid[IEEE80211_NWID_LEN];
1673	int error;
1674
1675	/*
1676	 * Firmware has a bug and does not honour the ``do not associate
1677	 * after scan'' bit in the scan command.  To prevent the firmware
1678	 * from associating after the scan, we set the ESSID to something
1679	 * unlikely to be used by a real AP.
1680	 * XXX would setting the desired BSSID to a multicast address work?
1681	 */
1682	memset(ssid, '\r', sizeof ssid);
1683	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ssid, sizeof ssid);
1684	if (error != 0)
1685		goto fail;
1686
1687	/* no mandatory BSSID */
1688	DPRINTF(("Setting mandatory BSSID to null\n"));
1689	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1690	if (error != 0)
1691		goto fail;
1692
1693	scan.flags = htole32(IPW_SCAN_DO_NOT_ASSOCIATE | IPW_SCAN_MIXED_CELL);
1694	scan.channels = htole32(0x3fff);	/* scan channels 1-14 */
1695	DPRINTF(("Setting scan options to 0x%x\n", letoh32(scan.flags)));
1696	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &scan, sizeof scan);
1697	if (error != 0)
1698		goto fail;
1699
1700	/* start scanning */
1701	DPRINTF(("Enabling adapter\n"));
1702	error = ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1703	if (error != 0)
1704		goto fail;
1705
1706	return;
1707fail:
1708	printf("%s: scan request failed (error=%d)\n", sc->sc_dev.dv_xname,
1709	    error);
1710	ieee80211_end_scan(ifp);
1711}
1712
1713void
1714ipw_auth_and_assoc(void *arg1, void *arg2)
1715{
1716	struct ipw_softc *sc = arg1;
1717	struct ieee80211com *ic = &sc->sc_ic;
1718	struct ieee80211_node *ni = ic->ic_bss;
1719	struct ipw_scan_options scan;
1720	struct ipw_security security;
1721	struct ipw_assoc_req assoc;
1722	uint32_t data;
1723	uint8_t chan;
1724	int s, error;
1725
1726	DPRINTF(("Disabling adapter\n"));
1727	error = ipw_cmd(sc, IPW_CMD_DISABLE, NULL, 0);
1728	if (error != 0)
1729		goto fail;
1730#if 1
1731	/* wait at most one second for card to be disabled */
1732	s = splnet();
1733	error = tsleep(sc, 0, "ipwdis", hz);
1734	splx(s);
1735	if (error != 0) {
1736		printf("%s: timeout waiting for disabled state\n",
1737		    sc->sc_dev.dv_xname);
1738		goto fail;
1739	}
1740#else
1741	/* Intel's Linux driver polls for the DISABLED state instead.. */
1742	for (ntries = 0; ntries < 1000; ntries++) {
1743		if (ipw_read_table1(sc, IPW_INFO_CARD_DISABLED) == 1)
1744			break;
1745		DELAY(10);
1746	}
1747	if (ntries == 1000) {
1748		printf("%s: timeout waiting for disabled state\n",
1749		    sc->sc_dev.dv_xname);
1750		goto fail;
1751	}
1752#endif
1753
1754	bzero(&security, sizeof security);
1755	security.authmode = IPW_AUTH_OPEN;
1756	security.ciphers = htole32(IPW_CIPHER_NONE);
1757	DPRINTF(("Setting authmode to %u\n", security.authmode));
1758	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1759	    sizeof security);
1760	if (error != 0)
1761		goto fail;
1762
1763#ifdef IPW_DEBUG
1764	if (ipw_debug > 0) {
1765		printf("Setting ESSID to ");
1766		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
1767		printf("\n");
1768	}
1769#endif
1770	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen);
1771	if (error != 0)
1772		goto fail;
1773
1774	DPRINTF(("Setting BSSID to %s\n", ether_sprintf(ni->ni_bssid)));
1775	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, ni->ni_bssid,
1776	    IEEE80211_ADDR_LEN);
1777	if (error != 0)
1778		goto fail;
1779
1780	data = htole32((ic->ic_flags & (IEEE80211_F_WEPON |
1781	    IEEE80211_F_RSNON)) ? IPW_PRIVACYON : 0);
1782	DPRINTF(("Setting privacy flags to 0x%x\n", letoh32(data)));
1783	error = ipw_cmd(sc, IPW_CMD_SET_PRIVACY_FLAGS, &data, sizeof data);
1784	if (error != 0)
1785		goto fail;
1786
1787	/* let firmware set the capinfo, lintval, and bssid fixed fields */
1788	bzero(&assoc, sizeof assoc);
1789	if (ic->ic_flags & IEEE80211_F_RSNON) {
1790		uint8_t *frm = assoc.optie;
1791
1792		/* tell firmware to add a WPA or RSN IE in (Re)Assoc req */
1793		if (ni->ni_rsnprotos & IEEE80211_PROTO_RSN)
1794			frm = ieee80211_add_rsn(frm, ic, ni);
1795		else if (ni->ni_rsnprotos & IEEE80211_PROTO_WPA)
1796			frm = ieee80211_add_wpa(frm, ic, ni);
1797		assoc.optie_len = htole32(frm - assoc.optie);
1798	}
1799	DPRINTF(("Preparing assocation request (optional IE length=%d)\n",
1800	    letoh32(assoc.optie_len)));
1801	error = ipw_cmd(sc, IPW_CMD_SET_ASSOC_REQ, &assoc, sizeof assoc);
1802	if (error != 0)
1803		goto fail;
1804
1805	scan.flags = htole32(IPW_SCAN_MIXED_CELL);
1806	chan = ieee80211_chan2ieee(ic, ni->ni_chan);
1807	scan.channels = htole32(1 << (chan - 1));
1808	DPRINTF(("Setting scan options to 0x%x\n", letoh32(scan.flags)));
1809	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &scan, sizeof scan);
1810	if (error != 0)
1811		goto fail;
1812
1813	/* trigger scan+association */
1814	DPRINTF(("Enabling adapter\n"));
1815	error = ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1816	if (error != 0)
1817		goto fail;
1818
1819	return;
1820fail:
1821	printf("%s: association failed (error=%d)\n", sc->sc_dev.dv_xname,
1822	    error);
1823	ieee80211_begin_scan(&ic->ic_if);
1824}
1825
1826int
1827ipw_config(struct ipw_softc *sc)
1828{
1829	struct ieee80211com *ic = &sc->sc_ic;
1830	struct ifnet *ifp = &ic->ic_if;
1831	struct ipw_configuration config;
1832	uint32_t data;
1833	int error;
1834
1835	switch (ic->ic_opmode) {
1836	case IEEE80211_M_STA:
1837		data = htole32(IPW_MODE_BSS);
1838		break;
1839#ifndef IEEE80211_STA_ONLY
1840	case IEEE80211_M_IBSS:
1841		data = htole32(IPW_MODE_IBSS);
1842		break;
1843#endif
1844	case IEEE80211_M_MONITOR:
1845		data = htole32(IPW_MODE_MONITOR);
1846		break;
1847	default:
1848		/* should not get there */
1849		return ENODEV;
1850	}
1851	DPRINTF(("Setting mode to %u\n", letoh32(data)));
1852	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1853	if (error != 0)
1854		return error;
1855
1856	if (
1857#ifndef IEEE80211_STA_ONLY
1858	    ic->ic_opmode == IEEE80211_M_IBSS ||
1859#endif
1860	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1861		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1862		DPRINTF(("Setting channel to %u\n", letoh32(data)));
1863		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1864		if (error != 0)
1865			return error;
1866	}
1867
1868	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1869		DPRINTF(("Enabling adapter\n"));
1870		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1871	}
1872
1873	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1874	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1875	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1876	    IEEE80211_ADDR_LEN);
1877	if (error != 0)
1878		return error;
1879
1880	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1881	    IPW_CFG_PREAMBLE_AUTO | IPW_CFG_802_1X_ENABLE);
1882#ifndef IEEE80211_STA_ONLY
1883	if (ic->ic_opmode == IEEE80211_M_IBSS)
1884		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1885#endif
1886	if (ifp->if_flags & IFF_PROMISC)
1887		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1888	config.bss_chan = htole32(0x3fff);	/* channels 1-14 */
1889	config.ibss_chan = htole32(0x7ff);	/* channels 1-11 */
1890	DPRINTF(("Setting configuration 0x%x\n", config.flags));
1891	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1892	if (error != 0)
1893		return error;
1894
1895	data = htole32(ic->ic_rtsthreshold);
1896	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1897	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1898	if (error != 0)
1899		return error;
1900
1901	data = htole32(ic->ic_fragthreshold);
1902	DPRINTF(("Setting frag threshold to %u\n", letoh32(data)));
1903	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1904	if (error != 0)
1905		return error;
1906
1907	data = htole32(0x3);	/* 1, 2 */
1908	DPRINTF(("Setting basic tx rates to 0x%x\n", letoh32(data)));
1909	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1910	if (error != 0)
1911		return error;
1912
1913	data = htole32(0xf);	/* 1, 2, 5.5, 11 */
1914	DPRINTF(("Setting tx rates to 0x%x\n", letoh32(data)));
1915	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1916	if (error != 0)
1917		return error;
1918
1919	data = htole32(0xf);	/* 1, 2, 5.5, 11 */
1920	DPRINTF(("Setting MSDU tx rates to 0x%x\n", letoh32(data)));
1921	error = ipw_cmd(sc, IPW_CMD_SET_MSDU_TX_RATES, &data, sizeof data);
1922	if (error != 0)
1923		return error;
1924
1925	data = htole32(IPW_POWER_MODE_CAM);
1926	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1927	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1928	if (error != 0)
1929		return error;
1930
1931#ifndef IEEE80211_STA_ONLY
1932	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1933		data = htole32(32);	/* default value */
1934		DPRINTF(("Setting tx power index to %u\n", letoh32(data)));
1935		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1936		    sizeof data);
1937		if (error != 0)
1938			return error;
1939
1940		data = htole32(ic->ic_lintval);
1941		DPRINTF(("Setting beacon interval to %u\n", letoh32(data)));
1942		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1943		    sizeof data);
1944		if (error != 0)
1945			return error;
1946	}
1947#endif
1948	return 0;
1949}
1950
1951int
1952ipw_init(struct ifnet *ifp)
1953{
1954	struct ipw_softc *sc = ifp->if_softc;
1955	struct ieee80211com *ic = &sc->sc_ic;
1956	struct ipw_firmware fw;
1957	int error;
1958
1959	ipw_stop(ifp, 0);
1960
1961	if ((error = ipw_reset(sc)) != 0) {
1962		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
1963		goto fail1;
1964	}
1965
1966	if ((error = ipw_read_firmware(sc, &fw)) != NULL) {
1967		printf("%s: error %d, could not read firmware\n",
1968		    sc->sc_dev.dv_xname, error);
1969		goto fail1;
1970	}
1971	if ((error = ipw_load_ucode(sc, fw.ucode, fw.ucode_size)) != 0) {
1972		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1973		goto fail2;
1974	}
1975
1976	ipw_stop_master(sc);
1977
1978	/*
1979	 * Setup tx, rx and status rings.
1980	 */
1981	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1982	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1983	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1984	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1985	sc->txold = IPW_NTBD - 1;	/* latest bd index ack by firmware */
1986	sc->txcur = 0; /* bd index to write to */
1987	sc->txfree = IPW_NTBD - 2;
1988
1989	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1990	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1991	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1992	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1993	sc->rxcur = IPW_NRBD - 1;	/* latest bd index I've read */
1994
1995	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1996	    sc->status_map->dm_segs[0].ds_addr);
1997
1998	if ((error = ipw_load_firmware(sc, fw.main, fw.main_size)) != 0) {
1999		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
2000		goto fail2;
2001	}
2002	sc->flags |= IPW_FLAG_FW_INITED;
2003	free(fw.data, M_DEVBUF);
2004
2005	/* retrieve information tables base addresses */
2006	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
2007	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
2008
2009	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
2010
2011	if ((error = ipw_config(sc)) != 0) {
2012		printf("%s: device configuration failed\n",
2013		    sc->sc_dev.dv_xname);
2014		goto fail2;
2015	}
2016
2017	ifp->if_flags &= ~IFF_OACTIVE;
2018	ifp->if_flags |= IFF_RUNNING;
2019
2020	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2021		ieee80211_begin_scan(ifp);
2022	else
2023		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2024
2025	return 0;
2026
2027fail2:	free(fw.data, M_DEVBUF);
2028fail1:	ipw_stop(ifp, 0);
2029	return error;
2030}
2031
2032void
2033ipw_stop(struct ifnet *ifp, int disable)
2034{
2035	struct ipw_softc *sc = ifp->if_softc;
2036	struct ieee80211com *ic = &sc->sc_ic;
2037	int i;
2038
2039	ipw_stop_master(sc);
2040	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
2041
2042	ifp->if_timer = 0;
2043	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2044
2045	/*
2046	 * Release tx buffers.
2047	 */
2048	for (i = 0; i < IPW_NTBD; i++)
2049		ipw_release_sbd(sc, &sc->stbd_list[i]);
2050
2051	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2052}
2053
2054void
2055ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2056    bus_size_t count)
2057{
2058	for (; count > 0; offset++, datap++, count--) {
2059		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2060		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
2061	}
2062}
2063
2064void
2065ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, uint8_t *datap,
2066    bus_size_t count)
2067{
2068	for (; count > 0; offset++, datap++, count--) {
2069		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
2070		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
2071	}
2072}
2073
2074struct cfdriver ipw_cd = {
2075	NULL, "ipw", DV_IFNET
2076};
2077