if_ipw.c revision 1.9
1/*	$Id: if_ipw.c,v 1.9 2004/10/27 21:19:01 damien Exp $  */
2
3/*-
4 * Copyright (c) 2004
5 *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice unmodified, this list of conditions, and the following
12 *    disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30/*-
31 * Intel(R) PRO/Wireless 2100 MiniPCI driver
32 * www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
33 */
34
35#include "bpfilter.h"
36
37#include <sys/param.h>
38#include <sys/sockio.h>
39#include <sys/sysctl.h>
40#include <sys/mbuf.h>
41#include <sys/kernel.h>
42#include <sys/socket.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/conf.h>
46
47#include <machine/bus.h>
48#include <machine/endian.h>
49#include <machine/intr.h>
50
51#include <dev/pci/pcireg.h>
52#include <dev/pci/pcivar.h>
53#include <dev/pci/pcidevs.h>
54
55#if NBPFILTER > 0
56#include <net/bpf.h>
57#endif
58#include <net/if.h>
59#include <net/if_arp.h>
60#include <net/if_dl.h>
61#include <net/if_media.h>
62#include <net/if_types.h>
63
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/in_var.h>
67#include <netinet/if_ether.h>
68#include <netinet/ip.h>
69
70#include <net80211/ieee80211_var.h>
71#include <net80211/ieee80211_radiotap.h>
72
73#include <dev/pci/if_ipwreg.h>
74#include <dev/pci/if_ipwvar.h>
75
76static const struct ieee80211_rateset ipw_rateset_11b =
77	{ 4, { 2, 4, 11, 22 } };
78
79int ipw_match(struct device *, void *, void *);
80void ipw_attach(struct device *, struct device *, void *);
81int ipw_detach(struct device *, int);
82int ipw_media_change(struct ifnet *);
83int ipw_newstate(struct ieee80211com *, enum ieee80211_state, int);
84void ipw_command_intr(struct ipw_softc *, struct ipw_soft_buf *);
85void ipw_newstate_intr(struct ipw_softc *, struct ipw_soft_buf *);
86void ipw_data_intr(struct ipw_softc *, struct ipw_status *,
87    struct ipw_soft_bd *, struct ipw_soft_buf *);
88void ipw_notification_intr(struct ipw_softc *, struct ipw_soft_buf *);
89void ipw_rx_intr(struct ipw_softc *);
90void ipw_release_sbd(struct ipw_softc *, struct ipw_soft_bd *);
91void ipw_tx_intr(struct ipw_softc *);
92int ipw_intr(void *);
93int ipw_cmd(struct ipw_softc *, u_int32_t, void *, u_int32_t);
94int ipw_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *);
95void ipw_start(struct ifnet *);
96void ipw_watchdog(struct ifnet *);
97int ipw_get_table1(struct ipw_softc *, u_int32_t *);
98int ipw_get_radio(struct ipw_softc *, int *);
99int ipw_ioctl(struct ifnet *, u_long, caddr_t);
100u_int32_t ipw_read_table1(struct ipw_softc *, u_int32_t);
101void ipw_write_table1(struct ipw_softc *, u_int32_t, u_int32_t);
102int ipw_read_table2(struct ipw_softc *, u_int32_t, void *, u_int32_t *);
103int ipw_tx_init(struct ipw_softc *);
104void ipw_tx_stop(struct ipw_softc *);
105int ipw_rx_init(struct ipw_softc *);
106void ipw_rx_stop(struct ipw_softc *);
107void ipw_reset(struct ipw_softc *);
108int ipw_clock_sync(struct ipw_softc *);
109int ipw_load_ucode(struct ipw_softc *, u_char *, int);
110int ipw_load_firmware(struct ipw_softc *, u_char *, int);
111int ipw_firmware_init(struct ipw_softc *, u_char *);
112int ipw_config(struct ipw_softc *);
113int ipw_init(struct ifnet *);
114void ipw_stop(struct ifnet *, int);
115void ipw_read_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
116void ipw_write_mem_1(struct ipw_softc *, bus_size_t, u_int8_t *, bus_size_t);
117void ipw_zero_mem_4(struct ipw_softc *, bus_size_t, bus_size_t);
118
119static __inline u_int8_t MEM_READ_1(struct ipw_softc *sc, u_int32_t addr)
120{
121	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
122	return CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA);
123}
124
125static __inline u_int32_t MEM_READ_4(struct ipw_softc *sc, u_int32_t addr)
126{
127	CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, addr);
128	return CSR_READ_4(sc, IPW_CSR_INDIRECT_DATA);
129}
130
131#ifdef IPW_DEBUG
132#define DPRINTF(x)	if (ipw_debug > 0) printf x
133#define DPRINTFN(n, x)	if (ipw_debug >= (n)) printf x
134int ipw_debug = 0;
135#else
136#define DPRINTF(x)
137#define DPRINTFN(n, x)
138#endif
139
140struct cfattach ipw_ca = {
141	sizeof (struct ipw_softc), ipw_match, ipw_attach, ipw_detach
142};
143
144int
145ipw_match(struct device *parent, void *match, void *aux)
146{
147	struct pci_attach_args *pa = aux;
148
149	if (PCI_VENDOR (pa->pa_id) == PCI_VENDOR_INTEL &&
150	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_2100_3B)
151		return 1;
152
153	return 0;
154}
155
156/* Base Address Register */
157#define IPW_PCI_BAR0	0x10
158
159void
160ipw_attach(struct device *parent, struct device *self, void *aux)
161{
162	struct ipw_softc *sc = (struct ipw_softc *)self;
163	struct ieee80211com *ic = &sc->sc_ic;
164	struct ifnet *ifp = &ic->ic_if;
165	struct pci_attach_args *pa = aux;
166	const char *intrstr;
167	bus_space_tag_t memt;
168	bus_space_handle_t memh;
169	bus_addr_t base;
170	pci_intr_handle_t ih;
171	pcireg_t data;
172	int error, i;
173
174	sc->sc_pct = pa->pa_pc;
175
176	data = pci_conf_read(sc->sc_pct, pa->pa_tag, 0x40);
177	data &= ~0x00ff0000;
178	pci_conf_write(sc->sc_pct, pa->pa_tag, 0x40, data);
179
180	/* enable bus-mastering */
181	data = pci_conf_read(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG);
182	data |= PCI_COMMAND_MASTER_ENABLE;
183	pci_conf_write(sc->sc_pct, pa->pa_tag, PCI_COMMAND_STATUS_REG, data);
184
185	/* map the register window */
186	error = pci_mapreg_map(pa, IPW_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
187	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz, 0);
188	if (error != 0) {
189		printf(": could not map memory space\n");
190		return;
191	}
192
193	sc->sc_st = memt;
194	sc->sc_sh = memh;
195	sc->sc_dmat = pa->pa_dmat;
196
197	/* disable interrupts */
198	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
199
200	if (pci_intr_map(pa, &ih) != 0) {
201		printf(": could not map interrupt\n");
202		return;
203	}
204
205	intrstr = pci_intr_string(sc->sc_pct, ih);
206	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, ipw_intr, sc,
207	    sc->sc_dev.dv_xname);
208	if (sc->sc_ih == NULL) {
209		printf(": could not establish interrupt");
210		if (intrstr != NULL)
211			printf(" at %s", intrstr);
212		printf("\n");
213		return;
214	}
215	printf(": %s\n", intrstr);
216
217	ic->ic_phytype = IEEE80211_T_DS;
218	ic->ic_opmode = IEEE80211_M_STA;
219	ic->ic_state = IEEE80211_S_INIT;
220
221	/* set device capabilities */
222	ic->ic_caps =  IEEE80211_C_IBSS | IEEE80211_C_MONITOR |
223	    IEEE80211_C_PMGT | IEEE80211_C_TXPMGT | IEEE80211_C_WEP;
224
225	/* set supported .11b rates */
226	ic->ic_sup_rates[IEEE80211_MODE_11B] = ipw_rateset_11b;
227
228	/* set supported .11b channels (1 through 14) */
229	for (i = 1; i <= 14; i++) {
230		ic->ic_channels[i].ic_freq =
231		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
232		ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
233	}
234
235	/* default to authmode OPEN */
236	sc->authmode = IEEE80211_AUTH_OPEN;
237
238	/* IBSS channel undefined for now */
239	ic->ic_ibss_chan = &ic->ic_channels[0];
240
241	ifp->if_softc = sc;
242	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
243	ifp->if_init = ipw_init;
244	ifp->if_ioctl = ipw_ioctl;
245	ifp->if_start = ipw_start;
246	ifp->if_watchdog = ipw_watchdog;
247	IFQ_SET_READY(&ifp->if_snd);
248	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
249
250	if_attach(ifp);
251	ieee80211_ifattach(ifp);
252	/* override state transition machine */
253	sc->sc_newstate = ic->ic_newstate;
254	ic->ic_newstate = ipw_newstate;
255	ieee80211_media_init(ifp, ipw_media_change, ieee80211_media_status);
256
257#if NBPFILTER > 0
258	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
259	    sizeof (struct ieee80211_frame) + 64);
260
261	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
262	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
263	sc->sc_rxtap.wr_ihdr.it_present = htole32(IPW_RX_RADIOTAP_PRESENT);
264
265	sc->sc_txtap_len = sizeof sc->sc_txtapu;
266	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
267	sc->sc_txtap.wt_ihdr.it_present = htole32(IPW_TX_RADIOTAP_PRESENT);
268#endif
269}
270
271int
272ipw_detach(struct device* self, int flags)
273{
274	struct ipw_softc *sc = (struct ipw_softc *)self;
275	struct ifnet *ifp = &sc->sc_ic.ic_if;
276
277	ipw_reset(sc);
278
279#if NBPFILTER > 0
280	bpfdetach(ifp);
281#endif
282	ieee80211_ifdetach(ifp);
283	if_detach(ifp);
284
285	if (sc->sc_ih != NULL) {
286		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
287		sc->sc_ih = NULL;
288	}
289
290	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
291
292	return 0;
293}
294
295int
296ipw_media_change(struct ifnet *ifp)
297{
298	int error;
299
300	error = ieee80211_media_change(ifp);
301	if (error != ENETRESET)
302		return error;
303
304	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
305		ipw_init(ifp);
306
307	return 0;
308}
309
310int
311ipw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
312{
313	struct ipw_softc *sc = ic->ic_softc;
314	struct ieee80211_node *ni = ic->ic_bss;
315	u_int32_t val, len;
316
317	switch (nstate) {
318	case IEEE80211_S_RUN:
319		len = IEEE80211_NWID_LEN;
320		ipw_read_table2(sc, IPW_INFO_CURRENT_SSID, ni->ni_essid, &len);
321		ni->ni_esslen = len;
322
323		val = ipw_read_table1(sc, IPW_INFO_CURRENT_CHANNEL);
324		ni->ni_chan = &ic->ic_channels[val];
325
326		DELAY(100); /* firmware needs a short delay here */
327
328		len = IEEE80211_ADDR_LEN;
329		ipw_read_table2(sc, IPW_INFO_CURRENT_BSSID, ni->ni_bssid, &len);
330		break;
331
332	case IEEE80211_S_INIT:
333	case IEEE80211_S_SCAN:
334	case IEEE80211_S_AUTH:
335	case IEEE80211_S_ASSOC:
336		break;
337	}
338
339	ic->ic_state = nstate;
340	return 0;
341}
342
343void
344ipw_command_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
345{
346	struct ipw_cmd *cmd;
347
348	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof (struct ipw_cmd),
349	    BUS_DMASYNC_POSTREAD);
350
351	cmd = mtod(sbuf->m, struct ipw_cmd *);
352
353	DPRINTFN(2, ("RX!CMD!%u!%u!%u!%u!%u\n",
354	    letoh32(cmd->type), letoh32(cmd->subtype), letoh32(cmd->seq),
355	    letoh32(cmd->len), letoh32(cmd->status)));
356
357	/*
358	 * Wake up processes waiting for command ack. In the case of the
359	 * IPW_CMD_DISABLE command, wake up the process only when the adapter
360	 * enters the IPW_STATE_DISABLED state. This is notified in
361	 * ipw_newstate_intr().
362	 */
363	if (letoh32(cmd->type) != IPW_CMD_DISABLE)
364		wakeup(sc->cmd);
365}
366
367void
368ipw_newstate_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
369{
370	struct ieee80211com *ic = &sc->sc_ic;
371	u_int32_t state;
372
373	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, sizeof state,
374	    BUS_DMASYNC_POSTREAD);
375
376	state = letoh32(*mtod(sbuf->m, u_int32_t *));
377
378	DPRINTFN(2, ("RX!NEWSTATE!%u\n", state));
379
380	switch (state) {
381	case IPW_STATE_ASSOCIATED:
382		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
383		break;
384
385	case IPW_STATE_SCANNING:
386		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
387		break;
388
389	case IPW_STATE_ASSOCIATION_LOST:
390		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
391		break;
392
393	case IPW_STATE_DISABLED:
394		wakeup(sc->cmd);
395		break;
396
397	case IPW_STATE_RADIO_DISABLED:
398		/* XXX should turn the interface down */
399		break;
400	}
401}
402
403void
404ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
405    struct ipw_soft_bd *sbd, struct ipw_soft_buf *sbuf)
406{
407	struct ieee80211com *ic = &sc->sc_ic;
408	struct ifnet *ifp = &ic->ic_if;
409	struct mbuf *m;
410	struct ieee80211_frame *wh;
411	struct ieee80211_node *ni;
412	int error;
413
414	DPRINTFN(5, ("RX!DATA!%u!%u\n", letoh32(status->len), status->rssi));
415
416	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, letoh32(status->len),
417	    BUS_DMASYNC_POSTREAD);
418
419	bus_dmamap_unload(sc->sc_dmat, sbuf->map);
420
421	/* Finalize mbuf */
422	m = sbuf->m;
423	m->m_pkthdr.rcvif = ifp;
424	m->m_pkthdr.len = m->m_len = letoh32(status->len);
425
426#if NBPFILTER > 0
427	if (sc->sc_drvbpf != NULL) {
428		struct mbuf mb;
429		struct ipw_rx_radiotap_header *tap = &sc->sc_rxtap;
430
431		tap->wr_flags = 0;
432		tap->wr_antsignal = status->rssi;
433		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
434		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
435
436		M_DUP_PKTHDR(&mb, m);
437		mb.m_data = (caddr_t)tap;
438		mb.m_len = sc->sc_rxtap_len;
439		mb.m_next = m;
440		mb.m_pkthdr.len += mb.m_len;
441		bpf_mtap(sc->sc_drvbpf, &mb);
442	}
443#endif
444
445	wh = mtod(m, struct ieee80211_frame *);
446
447	ni = ieee80211_find_rxnode(ic, wh);
448
449	/* Send it up to the upper layer */
450	ieee80211_input(ifp, m, ni, status->rssi, 0);
451
452	if (ni == ic->ic_bss)
453		ieee80211_unref_node(&ni);
454	else
455		ieee80211_free_node(ic, ni);
456
457	MGETHDR(m, M_DONTWAIT, MT_DATA);
458	if (m == NULL) {
459		printf("%s: could not allocate rx mbuf\n",
460		    sc->sc_dev.dv_xname);
461		return;
462	}
463	MCLGET(m, M_DONTWAIT);
464	if (!(m->m_flags & M_EXT)) {
465		m_freem(m);
466		printf("%s: could not allocate rx mbuf cluster\n",
467		    sc->sc_dev.dv_xname);
468		return;
469	}
470
471	error = bus_dmamap_load(sc->sc_dmat, sbuf->map, mtod(m, void *),
472	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
473	if (error != 0) {
474		printf("%s: could not map rxbuf dma memory\n",
475		    sc->sc_dev.dv_xname);
476		m_freem(m);
477		return;
478	}
479
480	sbuf->m = m;
481	sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
482}
483
484void
485ipw_notification_intr(struct ipw_softc *sc, struct ipw_soft_buf *sbuf)
486{
487	DPRINTFN(2, ("RX!NOTIFICATION\n"));
488}
489
490void
491ipw_rx_intr(struct ipw_softc *sc)
492{
493	struct ipw_status *status;
494	struct ipw_soft_bd *sbd;
495	struct ipw_soft_buf *sbuf;
496	u_int32_t r, i;
497
498	r = CSR_READ_4(sc, IPW_CSR_RX_READ_INDEX);
499
500	for (i = (sc->rxcur + 1) % IPW_NRBD; i != r; i = (i + 1) % IPW_NRBD) {
501
502		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
503		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
504		    BUS_DMASYNC_POSTREAD);
505
506		bus_dmamap_sync(sc->sc_dmat, sc->status_map,
507		    i * sizeof (struct ipw_status), sizeof (struct ipw_status),
508		    BUS_DMASYNC_POSTREAD);
509
510		status = &sc->status_list[i];
511		sbd = &sc->srbd_list[i];
512		sbuf = sbd->priv;
513
514		switch (letoh16(status->code) & 0xf) {
515		case IPW_STATUS_CODE_COMMAND:
516			ipw_command_intr(sc, sbuf);
517			break;
518
519		case IPW_STATUS_CODE_NEWSTATE:
520			ipw_newstate_intr(sc, sbuf);
521			break;
522
523		case IPW_STATUS_CODE_DATA_802_3:
524		case IPW_STATUS_CODE_DATA_802_11:
525			ipw_data_intr(sc, status, sbd, sbuf);
526			break;
527
528		case IPW_STATUS_CODE_NOTIFICATION:
529			ipw_notification_intr(sc, sbuf);
530			break;
531
532		default:
533			printf("%s: unknown status code %u\n",
534			    sc->sc_dev.dv_xname, letoh16(status->code));
535		}
536		sbd->bd->flags = 0;
537
538		bus_dmamap_sync(sc->sc_dmat, sc->rbd_map,
539		    i * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
540		    BUS_DMASYNC_PREWRITE);
541	}
542
543	/* Tell the firmware what we have processed */
544	sc->rxcur = (r == 0) ? IPW_NRBD - 1 : r - 1;
545	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, sc->rxcur);
546}
547
548void
549ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
550{
551	struct ieee80211com *ic;
552	struct ipw_soft_hdr *shdr;
553	struct ipw_soft_buf *sbuf;
554
555	switch (sbd->type) {
556	case IPW_SBD_TYPE_COMMAND:
557		bus_dmamap_unload(sc->sc_dmat, sc->cmd_map);
558		break;
559
560	case IPW_SBD_TYPE_HEADER:
561		shdr = sbd->priv;
562		bus_dmamap_unload(sc->sc_dmat, shdr->map);
563		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
564		break;
565
566	case IPW_SBD_TYPE_DATA:
567		ic = &sc->sc_ic;
568		sbuf = sbd->priv;
569		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
570		m_freem(sbuf->m);
571		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
572			ieee80211_free_node(ic, sbuf->ni);
573		/* kill watchdog timer */
574		sc->sc_tx_timer = 0;
575		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
576		break;
577	}
578	sbd->type = IPW_SBD_TYPE_NOASSOC;
579}
580
581void
582ipw_tx_intr(struct ipw_softc *sc)
583{
584	struct ifnet *ifp = &sc->sc_ic.ic_if;
585	u_int32_t r, i;
586
587	r = CSR_READ_4(sc, IPW_CSR_TX_READ_INDEX);
588
589	for (i = (sc->txold + 1) % IPW_NTBD; i != r; i = (i + 1) % IPW_NTBD)
590		ipw_release_sbd(sc, &sc->stbd_list[i]);
591
592	/* Remember what the firmware has processed */
593	sc->txold = (r == 0) ? IPW_NTBD - 1 : r - 1;
594
595	/* Call start() since some buffer descriptors have been released */
596	ifp->if_flags &= ~IFF_OACTIVE;
597	(*ifp->if_start)(ifp);
598}
599
600int
601ipw_intr(void *arg)
602{
603	struct ipw_softc *sc = arg;
604	u_int32_t r;
605
606	if ((r = CSR_READ_4(sc, IPW_CSR_INTR)) == 0)
607		return 0;
608
609	/* Disable interrupts */
610	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
611
612	DPRINTFN(8, ("INTR!0x%08x\n", r));
613
614	if (r & IPW_INTR_RX_TRANSFER)
615		ipw_rx_intr(sc);
616
617	if (r & IPW_INTR_TX_TRANSFER)
618		ipw_tx_intr(sc);
619
620	if (r & IPW_INTR_FW_INIT_DONE) {
621		if (!(r & (IPW_INTR_FATAL_ERROR | IPW_INTR_PARITY_ERROR)))
622			wakeup(sc);
623	}
624
625	/* Acknowledge interrupts */
626	CSR_WRITE_4(sc, IPW_CSR_INTR, r);
627
628	/* Re-enable interrupts */
629	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
630
631	return 0;
632}
633
634int
635ipw_cmd(struct ipw_softc *sc, u_int32_t type, void *data, u_int32_t len)
636{
637	struct ipw_soft_bd *sbd;
638	int error;
639
640	sbd = &sc->stbd_list[sc->txcur];
641
642	error = bus_dmamap_load(sc->sc_dmat, sc->cmd_map, sc->cmd,
643	    sizeof (struct ipw_cmd), NULL, BUS_DMA_NOWAIT);
644	if (error != 0) {
645		printf("%s: could not map cmd dma memory\n",
646		    sc->sc_dev.dv_xname);
647		return error;
648	}
649
650	sc->cmd->type = htole32(type);
651	sc->cmd->subtype = htole32(0);
652	sc->cmd->len = htole32(len);
653	sc->cmd->seq = htole32(0);
654	if (data != NULL)
655		bcopy(data, sc->cmd->data, len);
656
657	sbd->type = IPW_SBD_TYPE_COMMAND;
658	sbd->bd->physaddr = htole32(sc->cmd_map->dm_segs[0].ds_addr);
659	sbd->bd->len = htole32(sizeof (struct ipw_cmd));
660	sbd->bd->nfrag = 1;
661	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_COMMAND |
662			 IPW_BD_FLAG_TX_LAST_FRAGMENT;
663
664	bus_dmamap_sync(sc->sc_dmat, sc->cmd_map, 0, sizeof (struct ipw_cmd),
665	    BUS_DMASYNC_PREWRITE);
666
667	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
668	    sc->txcur * sizeof (struct ipw_bd), sizeof (struct ipw_bd),
669	    BUS_DMASYNC_PREWRITE);
670
671	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
672	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
673
674	DPRINTFN(2, ("TX!CMD!%u!%u!%u!%u\n", type, 0, 0, len));
675
676	/* Wait at most one second for command to complete */
677	return tsleep(sc->cmd, 0, "ipwcmd", hz);
678}
679
680int
681ipw_tx_start(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni)
682{
683	struct ipw_softc *sc = ifp->if_softc;
684	struct ieee80211com *ic = &sc->sc_ic;
685	struct ieee80211_frame *wh;
686	struct ipw_soft_bd *sbd;
687	struct ipw_soft_hdr *shdr;
688	struct ipw_soft_buf *sbuf;
689	int error, i;
690
691	if (ic->ic_flags & IEEE80211_F_WEPON) {
692		m = ieee80211_wep_crypt(ifp, m, 1);
693		if (m == NULL)
694			return ENOBUFS;
695	}
696
697#if NBPFILTER > 0
698	if (sc->sc_drvbpf != NULL) {
699		struct mbuf mb;
700		struct ipw_tx_radiotap_header *tap = &sc->sc_txtap;
701
702		tap->wt_flags = 0;
703		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
704		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
705
706		M_DUP_PKTHDR(&mb, m);
707		mb.m_data = (caddr_t)tap;
708		mb.m_len = sc->sc_txtap_len;
709		mb.m_next = m;
710		mb.m_pkthdr.len += mb.m_len;
711		bpf_mtap(sc->sc_drvbpf, &mb);
712	}
713#endif
714
715	wh = mtod(m, struct ieee80211_frame *);
716
717	shdr = TAILQ_FIRST(&sc->sc_free_shdr);
718	sbuf = TAILQ_FIRST(&sc->sc_free_sbuf);
719
720	shdr->hdr.type = htole32(IPW_HDR_TYPE_SEND);
721	shdr->hdr.subtype = htole32(0);
722	shdr->hdr.encrypted = (wh->i_fc[1] & IEEE80211_FC1_WEP) ? 1 : 0;
723	shdr->hdr.encrypt = 0;
724	shdr->hdr.keyidx = 0;
725	shdr->hdr.keysz = 0;
726	shdr->hdr.fragmentsz = htole16(0);
727	IEEE80211_ADDR_COPY(shdr->hdr.src_addr, wh->i_addr2);
728	if (ic->ic_opmode == IEEE80211_M_STA)
729		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr3);
730	else
731		IEEE80211_ADDR_COPY(shdr->hdr.dst_addr, wh->i_addr1);
732
733	/* trim IEEE802.11 header */
734	m_adj(m, sizeof (struct ieee80211_frame));
735
736	/*
737	 * We need to map the mbuf first to know how many buffer descriptors
738	 * are needed for this transfer.
739	 */
740	error = bus_dmamap_load_mbuf(sc->sc_dmat, sbuf->map, m, BUS_DMA_NOWAIT);
741	if (error != 0) {
742		printf("%s: could not map mbuf (error %d)\n",
743		    sc->sc_dev.dv_xname, error);
744		m_freem(m);
745		return error;
746	}
747
748	error = bus_dmamap_load(sc->sc_dmat, shdr->map, &shdr->hdr,
749	    sizeof (struct ipw_hdr), NULL, BUS_DMA_NOWAIT);
750	if (error != 0) {
751		printf("%s: could not map header (error %d)\n",
752		    sc->sc_dev.dv_xname, error);
753		bus_dmamap_unload(sc->sc_dmat, sbuf->map);
754		m_freem(m);
755		return error;
756	}
757
758	TAILQ_REMOVE(&sc->sc_free_sbuf, sbuf, next);
759	TAILQ_REMOVE(&sc->sc_free_shdr, shdr, next);
760
761	sbd = &sc->stbd_list[sc->txcur];
762	sbd->type = IPW_SBD_TYPE_HEADER;
763	sbd->priv = shdr;
764	sbd->bd->physaddr = htole32(shdr->map->dm_segs[0].ds_addr);
765	sbd->bd->len = htole32(sizeof (struct ipw_hdr));
766	sbd->bd->nfrag = 1 + sbuf->map->dm_nsegs;
767	sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3 |
768			 IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
769
770	DPRINTFN(5, ("TX!HDR!%u!%u!%u!%u", shdr->hdr.type, shdr->hdr.subtype,
771	    shdr->hdr.encrypted, shdr->hdr.encrypt));
772	DPRINTFN(5, ("!%s", ether_sprintf(shdr->hdr.src_addr)));
773	DPRINTFN(5, ("!%s\n", ether_sprintf(shdr->hdr.dst_addr)));
774
775	bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
776	    sc->txcur * sizeof (struct ipw_bd),
777	    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
778
779	sc->txcur = (sc->txcur + 1) % IPW_NTBD;
780
781	sbuf->m = m;
782	sbuf->ni = ni;
783
784	for (i = 0; i < sbuf->map->dm_nsegs; i++) {
785		sbd = &sc->stbd_list[sc->txcur];
786		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[i].ds_addr);
787		sbd->bd->len = htole32(sbuf->map->dm_segs[i].ds_len);
788		sbd->bd->nfrag = 0; /* used only in first bd */
789		sbd->bd->flags = IPW_BD_FLAG_TX_FRAME_802_3;
790		if (i == sbuf->map->dm_nsegs - 1) {
791			sbd->type = IPW_SBD_TYPE_DATA;
792			sbd->priv = sbuf;
793			sbd->bd->flags |= IPW_BD_FLAG_TX_LAST_FRAGMENT;
794		} else {
795			sbd->type = IPW_SBD_TYPE_NOASSOC;
796			sbd->bd->flags |= IPW_BD_FLAG_TX_NOT_LAST_FRAGMENT;
797		}
798
799		DPRINTFN(5, ("TX!FRAG!%d!%d\n", i,
800		    sbuf->map->dm_segs[i].ds_len));
801
802		bus_dmamap_sync(sc->sc_dmat, sc->tbd_map,
803		    sc->txcur * sizeof (struct ipw_bd),
804		    sizeof (struct ipw_bd), BUS_DMASYNC_PREWRITE);
805
806		sc->txcur = (sc->txcur + 1) % IPW_NTBD;
807	}
808
809	bus_dmamap_sync(sc->sc_dmat, shdr->map, 0, sizeof (struct ipw_hdr),
810	    BUS_DMASYNC_PREWRITE);
811
812	bus_dmamap_sync(sc->sc_dmat, sbuf->map, 0, MCLBYTES,
813	    BUS_DMASYNC_PREWRITE);
814
815	/* Inform firmware about this new packet */
816	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, sc->txcur);
817
818	return 0;
819}
820
821void
822ipw_start(struct ifnet *ifp)
823{
824	struct ipw_softc *sc = ifp->if_softc;
825	struct ieee80211com *ic = &sc->sc_ic;
826	struct mbuf *m;
827	struct ieee80211_node *ni;
828
829	for (;;) {
830		IF_DEQUEUE(&ifp->if_snd, m);
831		if (m == NULL)
832			break;
833
834#if NBPFILTER > 0
835		if (ifp->if_bpf != NULL)
836			bpf_mtap(ifp->if_bpf, m);
837#endif
838
839		m = ieee80211_encap(ifp, m, &ni);
840		if (m == NULL)
841			continue;
842
843#if NBPFILTER > 0
844		if (ic->ic_rawbpf != NULL)
845			bpf_mtap(ic->ic_rawbpf, m);
846#endif
847
848		if (ipw_tx_start(ifp, m, ni) != 0) {
849			if (ni != NULL && ni != ic->ic_bss)
850				ieee80211_free_node(ic, ni);
851			break;
852		}
853
854		/* start watchdog timer */
855		sc->sc_tx_timer = 5;
856		ifp->if_timer = 1;
857	}
858}
859
860void
861ipw_watchdog(struct ifnet *ifp)
862{
863	struct ipw_softc *sc = ifp->if_softc;
864
865	ifp->if_timer = 0;
866
867	if (sc->sc_tx_timer > 0) {
868		if (--sc->sc_tx_timer == 0) {
869			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
870#ifdef notyet
871			ipw_init(ifp);
872#endif
873			return;
874		}
875		ifp->if_timer = 1;
876	}
877
878	ieee80211_watchdog(ifp);
879}
880
881int
882ipw_get_table1(struct ipw_softc *sc, u_int32_t *tbl)
883{
884	u_int32_t i, size, buf[256];
885
886	if (!(sc->flags & IPW_FLAG_FW_INITED))
887		return ENOTTY;
888
889	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
890
891	size = CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA);
892	for (i = 1; i < size; i++)
893		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
894
895	return copyout(buf, tbl, size * sizeof (u_int32_t));
896}
897
898int
899ipw_get_radio(struct ipw_softc *sc, int *ret)
900{
901	int val;
902
903	if (!(sc->flags & IPW_FLAG_FW_INITED))
904		return ENOTTY;
905
906	val = (CSR_READ_4(sc, IPW_CSR_IO) & IPW_IO_RADIO_DISABLED) ? 0 : 1;
907	return copyout(&val, ret, sizeof val);
908}
909
910int
911ipw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
912{
913	struct ipw_softc *sc = ifp->if_softc;
914	struct ifreq *ifr;
915	struct ifaddr *ifa;
916	int s, error = 0;
917
918	s = splnet();
919
920	switch (cmd) {
921	case SIOCSIFADDR:
922		ifa = (struct ifaddr *) data;
923		ifp->if_flags |= IFF_UP;
924		switch (ifa->ifa_addr->sa_family) {
925#ifdef INET
926		case AF_INET:
927			arp_ifinit(&sc->sc_ic.ic_ac, ifa);
928			ipw_init(ifp);
929			break;
930#endif
931		default:
932			ipw_init(ifp);
933		}
934		break;
935
936	case SIOCSIFFLAGS:
937		if (ifp->if_flags & IFF_UP) {
938			if (!(ifp->if_flags & IFF_RUNNING))
939				ipw_init(ifp);
940		} else {
941			if (ifp->if_flags & IFF_RUNNING)
942				ipw_stop(ifp, 1);
943		}
944		break;
945
946	case SIOCGTABLE1:
947		ifr = (struct ifreq *)data;
948		error = ipw_get_table1(sc, (u_int32_t *)ifr->ifr_data);
949		break;
950
951	case SIOCGRADIO:
952		ifr = (struct ifreq *)data;
953		error = ipw_get_radio(sc, (int *)ifr->ifr_data);
954		break;
955
956	case SIOCSLOADFW:
957		/* only super-user can do that! */
958		if ((error = suser(curproc, 0)) != 0)
959			break;
960
961		ifr = (struct ifreq *)data;
962		error = ipw_firmware_init(sc, (u_char *)ifr->ifr_data);
963		break;
964
965	case SIOCSKILLFW:
966		/* only super-user can do that! */
967		if ((error = suser(curproc, 0)) != 0)
968			break;
969
970		ipw_reset(sc);
971		break;
972
973	case SIOCG80211AUTH:
974		((struct ieee80211_auth *)data)->i_authtype = sc->authmode;
975		break;
976
977	case SIOCS80211AUTH:
978		/* only super-user can do that! */
979		if ((error = suser(curproc, 0)) != 0)
980			break;
981
982		sc->authmode = ((struct ieee80211_auth *)data)->i_authtype;
983		break;
984
985	default:
986		error = ieee80211_ioctl(ifp, cmd, data);
987	}
988
989	if (error == ENETRESET && cmd != SIOCADDMULTI) {
990		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
991		    (IFF_UP | IFF_RUNNING))
992			ipw_init(ifp);
993		error = 0;
994	}
995
996	splx(s);
997	return error;
998}
999
1000u_int32_t
1001ipw_read_table1(struct ipw_softc *sc, u_int32_t off)
1002{
1003	return MEM_READ_4(sc, MEM_READ_4(sc, sc->table1_base + off));
1004}
1005
1006void
1007ipw_write_table1(struct ipw_softc *sc, u_int32_t off, u_int32_t info)
1008{
1009	MEM_WRITE_4(sc, MEM_READ_4(sc, sc->table1_base + off), info);
1010}
1011
1012int
1013ipw_read_table2(struct ipw_softc *sc, u_int32_t off, void *buf, u_int32_t *len)
1014{
1015	u_int32_t addr, info;
1016	u_int16_t count, size;
1017	u_int32_t total;
1018
1019	/* addr[4] + count[2] + size[2] */
1020	addr = MEM_READ_4(sc, sc->table2_base + off);
1021	info = MEM_READ_4(sc, sc->table2_base + off + 4);
1022
1023	count = info >> 16;
1024	size = info & 0xffff;
1025	total = count * size;
1026
1027	if (total > *len) {
1028		*len = total;
1029		return EINVAL;
1030	}
1031
1032	*len = total;
1033	ipw_read_mem_1(sc, addr, buf, total);
1034
1035	return 0;
1036}
1037
1038int
1039ipw_tx_init(struct ipw_softc *sc)
1040{
1041	char *errmsg;
1042	struct ipw_bd *bd;
1043	struct ipw_soft_bd *sbd;
1044	struct ipw_soft_hdr *shdr;
1045	struct ipw_soft_buf *sbuf;
1046	int error, i, nsegs;
1047
1048	/* Allocate transmission buffer descriptors */
1049	error = bus_dmamap_create(sc->sc_dmat, IPW_TBD_SZ, 1, IPW_TBD_SZ, 0,
1050	    BUS_DMA_NOWAIT, &sc->tbd_map);
1051	if (error != 0) {
1052		errmsg = "could not create tbd dma map";
1053		goto fail;
1054	}
1055
1056	error = bus_dmamem_alloc(sc->sc_dmat, IPW_TBD_SZ, PAGE_SIZE, 0,
1057	    &sc->tbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1058	if (error != 0) {
1059		errmsg = "could not allocate tbd dma memory";
1060		goto fail;
1061	}
1062
1063	error = bus_dmamem_map(sc->sc_dmat, &sc->tbd_seg, nsegs, IPW_TBD_SZ,
1064	    (caddr_t *)&sc->tbd_list, BUS_DMA_NOWAIT);
1065	if (error != 0) {
1066		errmsg = "could not map tbd dma memory";
1067		goto fail;
1068	}
1069
1070	error = bus_dmamap_load(sc->sc_dmat, sc->tbd_map, sc->tbd_list,
1071	    IPW_TBD_SZ, NULL, BUS_DMA_NOWAIT);
1072	if (error != 0) {
1073		errmsg = "could not load tbd dma memory";
1074		goto fail;
1075	}
1076
1077	sc->stbd_list = malloc(IPW_NTBD * sizeof (struct ipw_soft_bd),
1078	    M_DEVBUF, M_NOWAIT);
1079	if (sc->stbd_list == NULL) {
1080		errmsg = "could not allocate soft tbd";
1081		error = ENOMEM;
1082		goto fail;
1083	}
1084	sbd = sc->stbd_list;
1085	bd = sc->tbd_list;
1086	for (i = 0; i < IPW_NTBD; i++, sbd++, bd++) {
1087		sbd->type = IPW_SBD_TYPE_NOASSOC;
1088		sbd->bd = bd;
1089	}
1090
1091	CSR_WRITE_4(sc, IPW_CSR_TX_BD_BASE, sc->tbd_map->dm_segs[0].ds_addr);
1092	CSR_WRITE_4(sc, IPW_CSR_TX_BD_SIZE, IPW_NTBD);
1093	CSR_WRITE_4(sc, IPW_CSR_TX_READ_INDEX, 0);
1094	CSR_WRITE_4(sc, IPW_CSR_TX_WRITE_INDEX, 0);
1095	sc->txold = IPW_NTBD - 1; /* latest bd index ack'ed by firmware */
1096	sc->txcur = 0; /* bd index to write to */
1097
1098	/* Allocate a DMA-able command */
1099	error = bus_dmamap_create(sc->sc_dmat, sizeof (struct ipw_cmd), 1,
1100	    sizeof (struct ipw_cmd), 0, BUS_DMA_NOWAIT, &sc->cmd_map);
1101	if (error != 0) {
1102		errmsg = "could not create cmd dma map";
1103		goto fail;
1104	}
1105
1106	error = bus_dmamem_alloc(sc->sc_dmat, sizeof (struct ipw_cmd),
1107	    PAGE_SIZE, 0, &sc->cmd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1108	if (error != 0) {
1109		errmsg = "could not allocate cmd dma memory";
1110		goto fail;
1111	}
1112
1113	error = bus_dmamem_map(sc->sc_dmat, &sc->cmd_seg, nsegs,
1114	    sizeof (struct ipw_cmd), (caddr_t *)&sc->cmd, BUS_DMA_NOWAIT);
1115	if (error != 0) {
1116		errmsg = "could not map cmd dma memory";
1117		goto fail;
1118	}
1119
1120	/* Allocate a pool of DMA-able headers */
1121	sc->shdr_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_hdr),
1122	    M_DEVBUF, M_NOWAIT);
1123	if (sc->shdr_list == NULL) {
1124		errmsg = "could not allocate soft hdr";
1125		error = ENOMEM;
1126		goto fail;
1127	}
1128	TAILQ_INIT(&sc->sc_free_shdr);
1129	for (i = 0, shdr = sc->shdr_list; i < IPW_NDATA; i++, shdr++) {
1130		error = bus_dmamap_create(sc->sc_dmat,
1131		    sizeof (struct ipw_soft_hdr), 1,
1132	 	    sizeof (struct ipw_soft_hdr), 0, BUS_DMA_NOWAIT,
1133		    &shdr->map);
1134		if (error != 0) {
1135			errmsg = "could not create hdr dma map";
1136			goto fail;
1137		}
1138		TAILQ_INSERT_TAIL(&sc->sc_free_shdr, shdr, next);
1139	}
1140
1141	/* Allocate a pool of DMA-able buffers */
1142	sc->tx_sbuf_list = malloc(IPW_NDATA * sizeof (struct ipw_soft_buf),
1143	    M_DEVBUF, M_NOWAIT);
1144	if (sc->tx_sbuf_list == NULL) {
1145		errmsg = "could not allocate soft txbuf";
1146		error = ENOMEM;
1147		goto fail;
1148	}
1149	TAILQ_INIT(&sc->sc_free_sbuf);
1150	for (i = 0, sbuf = sc->tx_sbuf_list; i < IPW_NDATA; i++, sbuf++) {
1151		error = bus_dmamap_create(sc->sc_dmat, IPW_NDATA * MCLBYTES,
1152		    IPW_NDATA, MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
1153		if (error != 0) {
1154			errmsg = "could not create txbuf dma map";
1155			goto fail;
1156		}
1157		TAILQ_INSERT_TAIL(&sc->sc_free_sbuf, sbuf, next);
1158	}
1159
1160	return 0;
1161
1162fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1163	ipw_tx_stop(sc);
1164
1165	return error;
1166}
1167
1168void
1169ipw_tx_stop(struct ipw_softc *sc)
1170{
1171	struct ipw_soft_hdr *shdr;
1172	struct ipw_soft_buf *sbuf;
1173	int i;
1174
1175	if (sc->tbd_map != NULL) {
1176		if (sc->tbd_list != NULL) {
1177			bus_dmamap_unload(sc->sc_dmat, sc->tbd_map);
1178			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->tbd_list,
1179			    IPW_TBD_SZ);
1180			bus_dmamem_free(sc->sc_dmat, &sc->tbd_seg, 1);
1181			sc->tbd_list = NULL;
1182		}
1183		bus_dmamap_destroy(sc->sc_dmat, sc->tbd_map);
1184		sc->tbd_map = NULL;
1185	}
1186
1187	if (sc->stbd_list != NULL) {
1188		for (i = 0; i < IPW_NTBD; i++)
1189			ipw_release_sbd(sc, &sc->stbd_list[i]);
1190		free(sc->stbd_list, M_DEVBUF);
1191		sc->stbd_list = NULL;
1192	}
1193
1194	if (sc->cmd_map != NULL) {
1195		if (sc->cmd != NULL) {
1196			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->cmd,
1197			    sizeof (struct ipw_cmd));
1198			bus_dmamem_free(sc->sc_dmat, &sc->cmd_seg, 1);
1199			sc->cmd = NULL;
1200		}
1201		bus_dmamap_destroy(sc->sc_dmat, sc->cmd_map);
1202		sc->cmd_map = NULL;
1203	}
1204
1205	if (sc->shdr_list != NULL) {
1206		TAILQ_FOREACH(shdr, &sc->sc_free_shdr, next)
1207			bus_dmamap_destroy(sc->sc_dmat, shdr->map);
1208		free(sc->shdr_list, M_DEVBUF);
1209		sc->shdr_list = NULL;
1210	}
1211
1212
1213	if (sc->tx_sbuf_list != NULL) {
1214		TAILQ_FOREACH(sbuf, &sc->sc_free_sbuf, next)
1215			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1216		free(sc->tx_sbuf_list, M_DEVBUF);
1217		sc->tx_sbuf_list = NULL;
1218	}
1219}
1220
1221int
1222ipw_rx_init(struct ipw_softc *sc)
1223{
1224	char *errmsg;
1225	struct ipw_bd *bd;
1226	struct ipw_soft_bd *sbd;
1227	struct ipw_soft_buf *sbuf;
1228	int error, i, nsegs;
1229
1230	/* Allocate reception buffer descriptors */
1231	error = bus_dmamap_create(sc->sc_dmat, IPW_RBD_SZ, 1, IPW_RBD_SZ, 0,
1232	    BUS_DMA_NOWAIT, &sc->rbd_map);
1233	if (error != 0) {
1234		errmsg = "could not create rbd dma map";
1235		goto fail;
1236	}
1237
1238	error = bus_dmamem_alloc(sc->sc_dmat, IPW_RBD_SZ, PAGE_SIZE, 0,
1239	    &sc->rbd_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1240	if (error != 0) {
1241		errmsg = "could not allocate rbd dma memory";
1242		goto fail;
1243	}
1244
1245	error = bus_dmamem_map(sc->sc_dmat, &sc->rbd_seg, nsegs, IPW_RBD_SZ,
1246	    (caddr_t *)&sc->rbd_list, BUS_DMA_NOWAIT);
1247	if (error != 0) {
1248		errmsg = "could not map rbd dma memory";
1249		goto fail;
1250	}
1251
1252	error = bus_dmamap_load(sc->sc_dmat, sc->rbd_map, sc->rbd_list,
1253	    IPW_RBD_SZ, NULL, BUS_DMA_NOWAIT);
1254	if (error != 0) {
1255		errmsg = "could not load rbd dma memory";
1256		goto fail;
1257	}
1258
1259	sc->srbd_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_bd),
1260	    M_DEVBUF, M_NOWAIT);
1261	if (sc->srbd_list == NULL) {
1262		errmsg = "could not allocate soft rbd";
1263		error = ENOMEM;
1264		goto fail;
1265	}
1266	sbd = sc->srbd_list;
1267	bd = sc->rbd_list;
1268	for (i = 0; i < IPW_NRBD; i++, sbd++, bd++) {
1269		sbd->type = IPW_SBD_TYPE_NOASSOC;
1270		sbd->bd = bd;
1271	}
1272
1273	CSR_WRITE_4(sc, IPW_CSR_RX_BD_BASE, sc->rbd_map->dm_segs[0].ds_addr);
1274	CSR_WRITE_4(sc, IPW_CSR_RX_BD_SIZE, IPW_NRBD);
1275	CSR_WRITE_4(sc, IPW_CSR_RX_READ_INDEX, 0);
1276	CSR_WRITE_4(sc, IPW_CSR_RX_WRITE_INDEX, IPW_NRBD - 1);
1277	sc->rxcur = IPW_NRBD - 1; /* latest bd index I've read */
1278
1279	/* Allocate status descriptors */
1280	error = bus_dmamap_create(sc->sc_dmat, IPW_STATUS_SZ, 1, IPW_STATUS_SZ,
1281	    0, BUS_DMA_NOWAIT, &sc->status_map);
1282	if (error != 0) {
1283		errmsg = "could not create status dma map";
1284		goto fail;
1285	}
1286
1287	error = bus_dmamem_alloc(sc->sc_dmat, IPW_STATUS_SZ, PAGE_SIZE, 0,
1288	    &sc->status_seg, 1, &nsegs, BUS_DMA_NOWAIT);
1289	if (error != 0) {
1290		errmsg = "could not allocate status dma memory";
1291		goto fail;
1292	}
1293
1294	error = bus_dmamem_map(sc->sc_dmat, &sc->status_seg, nsegs,
1295	    IPW_STATUS_SZ, (caddr_t *)&sc->status_list, BUS_DMA_NOWAIT);
1296	if (error != 0) {
1297		errmsg = "could not map status dma memory";
1298		goto fail;
1299	}
1300
1301	error = bus_dmamap_load(sc->sc_dmat, sc->status_map, sc->status_list,
1302	    IPW_STATUS_SZ, NULL, BUS_DMA_NOWAIT);
1303	if (error != 0) {
1304		errmsg = "could not load status dma memory";
1305		goto fail;
1306	}
1307
1308	CSR_WRITE_4(sc, IPW_CSR_RX_STATUS_BASE,
1309	    sc->status_map->dm_segs[0].ds_addr);
1310
1311	sc->rx_sbuf_list = malloc(IPW_NRBD * sizeof (struct ipw_soft_buf),
1312	    M_DEVBUF, M_NOWAIT);
1313	if (sc->rx_sbuf_list == NULL) {
1314		errmsg = "could not allocate soft rxbuf";
1315		error = ENOMEM;
1316		goto fail;
1317	}
1318
1319	sbuf = sc->rx_sbuf_list;
1320	sbd = sc->srbd_list;
1321	for (i = 0; i < IPW_NRBD; i++, sbuf++, sbd++) {
1322
1323		MGETHDR(sbuf->m, M_DONTWAIT, MT_DATA);
1324		if (sbuf->m == NULL) {
1325			errmsg = "could not allocate rx mbuf";
1326			error = ENOMEM;
1327			goto fail;
1328		}
1329		MCLGET(sbuf->m, M_DONTWAIT);
1330		if (!(sbuf->m->m_flags & M_EXT)) {
1331			m_freem(sbuf->m);
1332			errmsg = "could not allocate rx mbuf cluster";
1333			error = ENOMEM;
1334			goto fail;
1335		}
1336
1337		error = bus_dmamap_create(sc->sc_dmat, IPW_NRBD * MCLBYTES,
1338		    IPW_NRBD, MCLBYTES, 0, BUS_DMA_NOWAIT, &sbuf->map);
1339		if (error != 0) {
1340			m_freem(sbuf->m);
1341			errmsg = "could not create rxbuf dma map";
1342			goto fail;
1343		}
1344		error = bus_dmamap_load(sc->sc_dmat, sbuf->map,
1345		    mtod(sbuf->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1346		if (error != 0) {
1347			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1348			m_freem(sbuf->m);
1349			errmsg = "could not map rxbuf dma memory";
1350			goto fail;
1351		}
1352		sbd->type = IPW_SBD_TYPE_DATA;
1353		sbd->priv = sbuf;
1354		sbd->bd->physaddr = htole32(sbuf->map->dm_segs[0].ds_addr);
1355		sbd->bd->len = htole32(MCLBYTES);
1356	}
1357
1358	return 0;
1359
1360fail:	printf("%s: %s\n", sc->sc_dev.dv_xname, errmsg);
1361	ipw_rx_stop(sc);
1362
1363	return error;
1364}
1365
1366void
1367ipw_rx_stop(struct ipw_softc *sc)
1368{
1369	struct ipw_soft_bd *sbd;
1370	struct ipw_soft_buf *sbuf;
1371	int i;
1372
1373	if (sc->rbd_map != NULL) {
1374		if (sc->rbd_list != NULL) {
1375			bus_dmamap_unload(sc->sc_dmat, sc->rbd_map);
1376			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->rbd_list,
1377			    IPW_RBD_SZ);
1378			bus_dmamem_free(sc->sc_dmat, &sc->rbd_seg, 1);
1379			sc->rbd_list = NULL;
1380		}
1381		bus_dmamap_destroy(sc->sc_dmat, sc->rbd_map);
1382		sc->rbd_map = NULL;
1383	}
1384
1385	if (sc->status_map != NULL) {
1386		if (sc->status_list != NULL) {
1387			bus_dmamap_unload(sc->sc_dmat, sc->status_map);
1388			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->status_list,
1389			    IPW_STATUS_SZ);
1390			bus_dmamem_free(sc->sc_dmat, &sc->status_seg, 1);
1391			sc->status_list = NULL;
1392		}
1393		bus_dmamap_destroy(sc->sc_dmat, sc->status_map);
1394		sc->status_map = NULL;
1395	}
1396
1397	if (sc->srbd_list != NULL) {
1398		for (i = 0, sbd = sc->srbd_list; i < IPW_NRBD; i++, sbd++) {
1399			if (sbd->type == IPW_SBD_TYPE_NOASSOC)
1400				continue;
1401
1402			sbuf = sbd->priv;
1403			bus_dmamap_unload(sc->sc_dmat, sbuf->map);
1404			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
1405			m_freem(sbuf->m);
1406		}
1407		free(sc->srbd_list, M_DEVBUF);
1408		sc->srbd_list = NULL;
1409	}
1410
1411	if (sc->rx_sbuf_list != NULL) {
1412		free(sc->rx_sbuf_list, M_DEVBUF);
1413		sc->rx_sbuf_list = NULL;
1414	}
1415}
1416
1417void
1418ipw_reset(struct ipw_softc *sc)
1419{
1420	struct ifnet *ifp = &sc->sc_ic.ic_if;
1421	int ntries;
1422
1423	ipw_stop(ifp, 1);
1424
1425	if (sc->flags & IPW_FLAG_FW_INITED) {
1426		ipw_cmd(sc, IPW_CMD_DISABLE_PHY, NULL, 0);
1427		ipw_cmd(sc, IPW_CMD_PREPARE_POWER_DOWN, NULL, 0);
1428
1429		sc->flags &= ~IPW_FLAG_FW_INITED;
1430	}
1431
1432	/* Disable interrupts */
1433	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, 0);
1434
1435	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_STOP_MASTER);
1436	for (ntries = 0; ntries < 5; ntries++) {
1437		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_MASTER_DISABLED)
1438			break;
1439		DELAY(10);
1440	}
1441
1442	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1443
1444	ipw_rx_stop(sc);
1445	ipw_tx_stop(sc);
1446
1447	ifp->if_flags &= ~IFF_UP;
1448}
1449
1450int
1451ipw_clock_sync(struct ipw_softc *sc)
1452{
1453	int ntries;
1454	u_int32_t r;
1455
1456	CSR_WRITE_4(sc, IPW_CSR_RST, IPW_RST_SW_RESET);
1457	for (ntries = 0; ntries < 1000; ntries++) {
1458		if (CSR_READ_4(sc, IPW_CSR_RST) & IPW_RST_PRINCETON_RESET)
1459			break;
1460		DELAY(10);
1461	}
1462	if (ntries == 1000)
1463		return EIO;
1464
1465	CSR_WRITE_4(sc, IPW_CSR_CTL, IPW_CTL_INIT);
1466	for (ntries = 0; ntries < 1000; ntries++) {
1467		if ((r = CSR_READ_4(sc, IPW_CSR_CTL)) & IPW_CTL_CLOCK_READY)
1468			break;
1469		DELAY(200);
1470	}
1471	if (ntries == 1000)
1472		return EIO;
1473
1474	CSR_WRITE_4(sc, IPW_CSR_CTL, r | IPW_CTL_ALLOW_STANDBY);
1475
1476	return 0;
1477}
1478
1479int
1480ipw_load_ucode(struct ipw_softc *sc, u_char *uc, int size)
1481{
1482	int ntries;
1483
1484	MEM_WRITE_2(sc, 0x220000, 0x0703);
1485	MEM_WRITE_2(sc, 0x220000, 0x0707);
1486
1487	MEM_WRITE_1(sc, 0x210014, 0x72);
1488	MEM_WRITE_1(sc, 0x210014, 0x72);
1489
1490	MEM_WRITE_1(sc, 0x210000, 0x40);
1491	MEM_WRITE_1(sc, 0x210000, 0x00);
1492	MEM_WRITE_1(sc, 0x210000, 0x40);
1493
1494	MEM_WRITE_MULTI_1(sc, 0x210010, uc, size);
1495
1496	MEM_WRITE_1(sc, 0x210000, 0x00);
1497	MEM_WRITE_1(sc, 0x210000, 0x00);
1498	MEM_WRITE_1(sc, 0x210000, 0x80);
1499
1500	MEM_WRITE_2(sc, 0x220000, 0x0703);
1501	MEM_WRITE_2(sc, 0x220000, 0x0707);
1502
1503	MEM_WRITE_1(sc, 0x210014, 0x72);
1504	MEM_WRITE_1(sc, 0x210014, 0x72);
1505
1506	MEM_WRITE_1(sc, 0x210000, 0x00);
1507	MEM_WRITE_1(sc, 0x210000, 0x80);
1508
1509	for (ntries = 0; ntries < 10; ntries++) {
1510		if (MEM_READ_1(sc, 0x210000) & 1)
1511			break;
1512		DELAY(10);
1513	}
1514	if (ntries == 10)
1515		return EIO;
1516
1517	return 0;
1518}
1519
1520/* set of macros to handle unaligned little endian data in firmware image */
1521#define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1522#define GETLE16(p) ((p)[0] | (p)[1] << 8)
1523int
1524ipw_load_firmware(struct ipw_softc *sc, u_char *fw, int size)
1525{
1526	u_char *p, *end;
1527	u_int32_t dst;
1528	u_int16_t len;
1529
1530	p = fw;
1531	end = fw + size;
1532	while (p < end) {
1533		if (p + 6 > end)
1534			return EINVAL;
1535
1536		dst = GETLE32(p); p += 4;
1537		len = GETLE16(p); p += 2;
1538
1539		if (p + len > end)
1540			return EINVAL;
1541
1542		ipw_write_mem_1(sc, dst, p, len);
1543		p += len;
1544	}
1545	return 0;
1546}
1547
1548int
1549ipw_firmware_init(struct ipw_softc *sc, u_char *data)
1550{
1551	struct ieee80211com *ic = &sc->sc_ic;
1552	struct ifnet *ifp = &ic->ic_if;
1553	struct ipw_fw_hdr hdr;
1554	u_int32_t r, len, fw_size, uc_size;
1555	u_char *fw, *uc;
1556	int error;
1557
1558	ipw_reset(sc);
1559
1560	if ((error = copyin(data, &hdr, sizeof hdr)) != 0)
1561		goto fail1;
1562
1563	fw_size = letoh32(hdr.fw_size);
1564	uc_size = letoh32(hdr.uc_size);
1565	data += sizeof hdr;
1566
1567	if ((fw = malloc(fw_size, M_DEVBUF, M_NOWAIT)) == NULL) {
1568		error = ENOMEM;
1569		goto fail1;
1570	}
1571
1572	if ((error = copyin(data, fw, fw_size)) != 0)
1573		goto fail2;
1574
1575	data += fw_size;
1576
1577	if ((uc = malloc(uc_size, M_DEVBUF, M_NOWAIT)) == NULL) {
1578		error = ENOMEM;
1579		goto fail2;
1580	}
1581
1582	if ((error = copyin(data, uc, uc_size)) != 0)
1583		goto fail3;
1584
1585	if ((error = ipw_clock_sync(sc)) != 0) {
1586		printf("%s: clock synchronization failed\n",
1587		    sc->sc_dev.dv_xname);
1588		goto fail3;
1589	}
1590
1591	MEM_WRITE_4(sc, 0x003000e0, 0x80000000);
1592
1593	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1594
1595	if ((error = ipw_load_ucode(sc, uc, uc_size)) != 0) {
1596		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
1597		goto fail3;
1598	}
1599
1600	MEM_WRITE_4(sc, 0x003000e0, 0);
1601
1602	if ((error = ipw_clock_sync(sc)) != 0) {
1603		printf("%s: clock synchronization failed\n",
1604		    sc->sc_dev.dv_xname);
1605		goto fail3;
1606	}
1607
1608	if ((error = ipw_load_firmware(sc, fw, fw_size))) {
1609		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
1610		goto fail3;
1611	}
1612
1613	ipw_zero_mem_4(sc, 0x0002f200, 196);
1614	ipw_zero_mem_4(sc, 0x0002f610, 8);
1615	ipw_zero_mem_4(sc, 0x0002fa00, 8);
1616	ipw_zero_mem_4(sc, 0x0002fc00, 4);
1617	ipw_zero_mem_4(sc, 0x0002ff80, 32);
1618
1619	if ((error = ipw_rx_init(sc)) != 0) {
1620		printf("%s: could not initialize rx queue\n",
1621		    sc->sc_dev.dv_xname);
1622		goto fail3;
1623	}
1624
1625	if ((error = ipw_tx_init(sc)) != 0) {
1626		printf("%s: could not initialize tx queue\n",
1627		    sc->sc_dev.dv_xname);
1628		goto fail3;
1629	}
1630
1631	CSR_WRITE_4(sc, IPW_CSR_IO, IPW_IO_GPIO1_ENABLE | IPW_IO_GPIO3_MASK |
1632	    IPW_IO_LED_OFF);
1633
1634	/* Allow interrupts so we know when the firmware is inited */
1635	CSR_WRITE_4(sc, IPW_CSR_INTR_MASK, IPW_INTR_MASK);
1636
1637	/* Tell the adapter to initialize the firmware */
1638	CSR_WRITE_4(sc, IPW_CSR_RST, 0);
1639
1640	/* Wait at most one second for firmware initialization to complete */
1641	if ((error = tsleep(sc, 0, "ipwinit", hz)) != 0) {
1642		printf("%s: timeout waiting for firmware initialization to "
1643		    "complete\n", sc->sc_dev.dv_xname);
1644		goto fail3;
1645	}
1646
1647	/* Firmware initialization completed */
1648	sc->flags |= IPW_FLAG_FW_INITED;
1649
1650	free(uc, M_DEVBUF);
1651	free(fw, M_DEVBUF);
1652
1653	r = CSR_READ_4(sc, IPW_CSR_IO);
1654	CSR_WRITE_4(sc, IPW_CSR_IO, r | IPW_IO_GPIO1_MASK | IPW_IO_GPIO3_MASK);
1655
1656	/* Retrieve information tables base addresses */
1657	sc->table1_base = CSR_READ_4(sc, IPW_CSR_TABLE1_BASE);
1658	sc->table2_base = CSR_READ_4(sc, IPW_CSR_TABLE2_BASE);
1659
1660	ipw_write_table1(sc, IPW_INFO_LOCK, 0);
1661
1662	/* Retrieve adapter MAC address */
1663	len = IEEE80211_ADDR_LEN;
1664	ipw_read_table2(sc, IPW_INFO_ADAPTER_MAC, ic->ic_myaddr, &len);
1665
1666	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1667
1668	return 0;
1669
1670fail3:	free(uc, M_DEVBUF);
1671fail2:	free(fw, M_DEVBUF);
1672fail1:	ipw_reset(sc);
1673
1674	return error;
1675}
1676
1677int
1678ipw_config(struct ipw_softc *sc)
1679{
1680	struct ieee80211com *ic = &sc->sc_ic;
1681	struct ifnet *ifp = &ic->ic_if;
1682	struct ipw_security security;
1683	struct ieee80211_wepkey *k;
1684	struct ipw_wep_key wepkey;
1685	struct ipw_scan_options options;
1686	struct ipw_configuration config;
1687	u_int32_t data;
1688	int error, i;
1689
1690	switch (ic->ic_opmode) {
1691	case IEEE80211_M_STA:
1692	case IEEE80211_M_HOSTAP:
1693		data = htole32(IPW_MODE_BSS);
1694		break;
1695
1696	case IEEE80211_M_IBSS:
1697	case IEEE80211_M_AHDEMO:
1698		data = htole32(IPW_MODE_IBSS);
1699		break;
1700
1701	case IEEE80211_M_MONITOR:
1702		data = htole32(IPW_MODE_MONITOR);
1703		break;
1704	}
1705	DPRINTF(("Setting adapter mode to %u\n", data));
1706	error = ipw_cmd(sc, IPW_CMD_SET_MODE, &data, sizeof data);
1707	if (error != 0)
1708		return error;
1709
1710	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1711	    ic->ic_opmode == IEEE80211_M_MONITOR) {
1712		data = htole32(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1713		DPRINTF(("Setting adapter channel to %u\n", data));
1714		error = ipw_cmd(sc, IPW_CMD_SET_CHANNEL, &data, sizeof data);
1715		if (error != 0)
1716			return error;
1717	}
1718
1719	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1720		DPRINTF(("Enabling adapter\n"));
1721		return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1722	}
1723
1724	DPRINTF(("Setting adapter MAC to %s\n", ether_sprintf(ic->ic_myaddr)));
1725	IEEE80211_ADDR_COPY(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr);
1726	IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), ic->ic_myaddr);
1727	error = ipw_cmd(sc, IPW_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1728	    IEEE80211_ADDR_LEN);
1729	if (error != 0)
1730		return error;
1731
1732	config.flags = htole32(IPW_CFG_BSS_MASK | IPW_CFG_IBSS_MASK |
1733			       IPW_CFG_PREAMBLE_LEN | IPW_CFG_802_1x_ENABLE);
1734	if (ic->ic_opmode == IEEE80211_M_IBSS)
1735		config.flags |= htole32(IPW_CFG_IBSS_AUTO_START);
1736	if (ifp->if_flags & IFF_PROMISC)
1737		config.flags |= htole32(IPW_CFG_PROMISCUOUS);
1738	config.channels = htole32(0x3fff); /* channels 1-14 */
1739	config.ibss_chan = htole32(0x7ff);
1740	DPRINTF(("Setting adapter configuration 0x%08x\n", config.flags));
1741	error = ipw_cmd(sc, IPW_CMD_SET_CONFIGURATION, &config, sizeof config);
1742	if (error != 0)
1743		return error;
1744
1745	data = htole32(0x3); /* 1, 2 */
1746	DPRINTF(("Setting adapter basic tx rates to 0x%x\n", data));
1747	error = ipw_cmd(sc, IPW_CMD_SET_BASIC_TX_RATES, &data, sizeof data);
1748	if (error != 0)
1749		return error;
1750
1751	data = htole32(0xf); /* 1, 2, 5.5, 11 */
1752	DPRINTF(("Setting adapter tx rates to 0x%x\n", data));
1753	error = ipw_cmd(sc, IPW_CMD_SET_TX_RATES, &data, sizeof data);
1754	if (error != 0)
1755		return error;
1756
1757	data = htole32(IPW_POWER_MODE_CAM);
1758	DPRINTF(("Setting adapter power mode to %u\n", data));
1759	error = ipw_cmd(sc, IPW_CMD_SET_POWER_MODE, &data, sizeof data);
1760	if (error != 0)
1761		return error;
1762
1763	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1764		data = htole32(ic->ic_txpower);
1765		DPRINTF(("Setting adapter tx power index to %u\n", data));
1766		error = ipw_cmd(sc, IPW_CMD_SET_TX_POWER_INDEX, &data,
1767		    sizeof data);
1768		if (error != 0)
1769			return error;
1770	}
1771
1772	data = htole32(ic->ic_rtsthreshold);
1773	DPRINTF(("Setting adapter RTS threshold to %u\n", data));
1774	error = ipw_cmd(sc, IPW_CMD_SET_RTS_THRESHOLD, &data, sizeof data);
1775	if (error != 0)
1776		return error;
1777
1778	data = htole32(ic->ic_fragthreshold);
1779	DPRINTF(("Setting adapter frag threshold to %u\n", data));
1780	error = ipw_cmd(sc, IPW_CMD_SET_FRAG_THRESHOLD, &data, sizeof data);
1781	if (error != 0)
1782		return error;
1783
1784#ifdef IPW_DEBUG
1785	if (ipw_debug > 0) {
1786		printf("Setting adapter ESSID to ");
1787		ieee80211_print_essid(ic->ic_des_essid, ic->ic_des_esslen);
1788		printf("\n");
1789	}
1790#endif
1791	error = ipw_cmd(sc, IPW_CMD_SET_ESSID, ic->ic_des_essid,
1792	    ic->ic_des_esslen);
1793	if (error != 0)
1794		return error;
1795
1796	/* no mandatory BSSID */
1797	error = ipw_cmd(sc, IPW_CMD_SET_MANDATORY_BSSID, NULL, 0);
1798	if (error != 0)
1799		return error;
1800
1801	if (ic->ic_flags & IEEE80211_F_DESBSSID) {
1802		DPRINTF(("Setting adapter desired BSSID to %s\n",
1803		    ether_sprintf(ic->ic_des_bssid)));
1804		error = ipw_cmd(sc, IPW_CMD_SET_DESIRED_BSSID,
1805		    ic->ic_des_bssid, IEEE80211_ADDR_LEN);
1806		if (error != 0)
1807			return error;
1808	}
1809
1810	security.authmode = (sc->authmode == IEEE80211_AUTH_SHARED) ?
1811	    IPW_AUTH_SHARED : IPW_AUTH_OPEN;
1812	security.ciphers = htole32(IPW_CIPHER_NONE);
1813	security.version = htole16(0);
1814	security.replay_counters_number = 0;
1815	security.unicast_using_group = 0;
1816	DPRINTF(("Setting adapter authmode to %u\n", security.authmode));
1817	error = ipw_cmd(sc, IPW_CMD_SET_SECURITY_INFORMATION, &security,
1818	    sizeof security);
1819	if (error != 0)
1820		return error;
1821
1822	if (ic->ic_flags & IEEE80211_F_WEPON) {
1823		k = ic->ic_nw_keys;
1824		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
1825			if (k->wk_len == 0)
1826				continue;
1827
1828			wepkey.idx = i;
1829			wepkey.len = k->wk_len;
1830			bzero(wepkey.key, sizeof wepkey.key);
1831			bcopy(k->wk_key, wepkey.key, k->wk_len);
1832			DPRINTF(("Setting wep key index %d len %d\n",
1833			    wepkey.idx, wepkey.len));
1834			error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY, &wepkey,
1835			    sizeof wepkey);
1836			if (error != 0)
1837				return error;
1838		}
1839
1840		data = htole32(ic->ic_wep_txkey);
1841		DPRINTF(("Setting adapter tx key index to %u\n", data));
1842		error = ipw_cmd(sc, IPW_CMD_SET_WEP_KEY_INDEX, &data,
1843		    sizeof data);
1844		if (error != 0)
1845			return error;
1846	}
1847
1848	data = htole32((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) ? 0x8 : 0);
1849	DPRINTF(("Setting adapter wep flags to 0x%x\n", data));
1850	error = ipw_cmd(sc, IPW_CMD_SET_WEP_FLAGS, &data, sizeof data);
1851	if (error != 0)
1852		return error;
1853
1854	if (ic->ic_opmode == IEEE80211_M_IBSS ||
1855	    ic->ic_opmode == IEEE80211_M_HOSTAP) {
1856		data = htole32(ic->ic_lintval);
1857		DPRINTF(("Setting adapter beacon interval to %u\n", data));
1858		error = ipw_cmd(sc, IPW_CMD_SET_BEACON_INTERVAL, &data,
1859		    sizeof data);
1860		if (error != 0)
1861			return error;
1862	}
1863
1864	options.flags = htole32(0);
1865	options.channels = htole32(0x3fff); /* scan channels 1-14 */
1866	error = ipw_cmd(sc, IPW_CMD_SET_SCAN_OPTIONS, &options, sizeof options);
1867	if (error != 0)
1868		return error;
1869
1870	/* finally, enable adapter (start scanning for an access point) */
1871	DPRINTF(("Enabling adapter\n"));
1872	return ipw_cmd(sc, IPW_CMD_ENABLE, NULL, 0);
1873}
1874
1875int
1876ipw_init(struct ifnet *ifp)
1877{
1878	struct ipw_softc *sc = ifp->if_softc;
1879
1880	/* exit immediately if firmware has not been ioctl'd */
1881	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
1882		ifp->if_flags &= ~IFF_UP;
1883		return EIO;
1884	}
1885
1886	ipw_stop(ifp, 0);
1887
1888	if (ipw_config(sc) != 0) {
1889		printf("%s: device configuration failed\n",
1890		    sc->sc_dev.dv_xname);
1891		goto fail;
1892	}
1893
1894	ifp->if_flags &= ~IFF_OACTIVE;
1895	ifp->if_flags |= IFF_RUNNING;
1896
1897	return 0;
1898
1899fail:	ipw_stop(ifp, 0);
1900
1901	return EIO;
1902}
1903
1904void
1905ipw_stop(struct ifnet *ifp, int disable)
1906{
1907	struct ipw_softc *sc = ifp->if_softc;
1908	struct ieee80211com *ic = &sc->sc_ic;
1909
1910	if (ifp->if_flags & IFF_RUNNING) {
1911		DPRINTF(("Disabling adapter\n"));
1912		ipw_cmd(sc, IPW_CMD_DISABLE, NULL, 0);
1913	}
1914
1915	ifp->if_timer = 0;
1916	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1917
1918	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1919}
1920
1921void
1922ipw_read_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1923    bus_size_t count)
1924{
1925	for (; count > 0; offset++, datap++, count--) {
1926		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1927		*datap = CSR_READ_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3));
1928	}
1929}
1930
1931void
1932ipw_write_mem_1(struct ipw_softc *sc, bus_size_t offset, u_int8_t *datap,
1933    bus_size_t count)
1934{
1935	for (; count > 0; offset++, datap++, count--) {
1936		CSR_WRITE_4(sc, IPW_CSR_INDIRECT_ADDR, offset & ~3);
1937		CSR_WRITE_1(sc, IPW_CSR_INDIRECT_DATA + (offset & 3), *datap);
1938	}
1939}
1940
1941void
1942ipw_zero_mem_4(struct ipw_softc *sc, bus_size_t offset, bus_size_t count)
1943{
1944	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, offset);
1945	while (count-- > 0)
1946		CSR_WRITE_4(sc, IPW_CSR_AUTOINC_DATA, 0);
1947}
1948
1949struct cfdriver ipw_cd = {
1950	0, "ipw", DV_IFNET
1951};
1952