xref: /freebsd/sys/dev/iwi/if_iwi.c (revision 3642298923e528d795e3a30ec165d2b469e28b40)
1 /*	$FreeBSD$	*/
2 
3 /*-
4  * Copyright (c) 2004, 2005
5  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice unmodified, this list of conditions, and the following
12  *    disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 /*-
34  * Intel(R) PRO/Wireless 2200BG/2225BG/2915ABG driver
35  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
36  */
37 
38 #include <sys/param.h>
39 #include <sys/sysctl.h>
40 #include <sys/sockio.h>
41 #include <sys/mbuf.h>
42 #include <sys/kernel.h>
43 #include <sys/socket.h>
44 #include <sys/systm.h>
45 #include <sys/malloc.h>
46 #include <sys/module.h>
47 #include <sys/bus.h>
48 #include <sys/endian.h>
49 
50 #include <machine/bus.h>
51 #include <machine/resource.h>
52 #include <machine/clock.h>
53 #include <sys/rman.h>
54 
55 #include <dev/pci/pcireg.h>
56 #include <dev/pci/pcivar.h>
57 
58 #include <net/bpf.h>
59 #include <net/if.h>
60 #include <net/if_arp.h>
61 #include <net/ethernet.h>
62 #include <net/if_dl.h>
63 #include <net/if_media.h>
64 #include <net/if_types.h>
65 
66 #include <net80211/ieee80211_var.h>
67 #include <net80211/ieee80211_radiotap.h>
68 
69 #include <netinet/in.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/in_var.h>
72 #include <netinet/ip.h>
73 #include <netinet/if_ether.h>
74 
75 #include <dev/iwi/if_iwireg.h>
76 #include <dev/iwi/if_iwivar.h>
77 
78 #ifdef IWI_DEBUG
79 #define DPRINTF(x)	do { if (iwi_debug > 0) printf x; } while (0)
80 #define DPRINTFN(n, x)	do { if (iwi_debug >= (n)) printf x; } while (0)
81 int iwi_debug = 0;
82 SYSCTL_INT(_debug, OID_AUTO, iwi, CTLFLAG_RW, &iwi_debug, 0, "iwi debug level");
83 #else
84 #define DPRINTF(x)
85 #define DPRINTFN(n, x)
86 #endif
87 
88 MODULE_DEPEND(iwi, pci,  1, 1, 1);
89 MODULE_DEPEND(iwi, wlan, 1, 1, 1);
90 
91 struct iwi_ident {
92 	uint16_t	vendor;
93 	uint16_t	device;
94 	const char	*name;
95 };
96 
97 static const struct iwi_ident iwi_ident_table[] = {
98 	{ 0x8086, 0x4220, "Intel(R) PRO/Wireless 2200BG" },
99 	{ 0x8086, 0x4221, "Intel(R) PRO/Wireless 2225BG" },
100 	{ 0x8086, 0x4223, "Intel(R) PRO/Wireless 2915ABG" },
101 	{ 0x8086, 0x4224, "Intel(R) PRO/Wireless 2915ABG" },
102 
103 	{ 0, 0, NULL }
104 };
105 
106 static void	iwi_dma_map_addr(void *, bus_dma_segment_t *, int, int);
107 static int	iwi_alloc_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *,
108 		    int);
109 static void	iwi_reset_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
110 static void	iwi_free_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
111 static int	iwi_alloc_tx_ring(struct iwi_softc *, struct iwi_tx_ring *,
112 		    int, bus_addr_t, bus_addr_t);
113 static void	iwi_reset_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
114 static void	iwi_free_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
115 static int	iwi_alloc_rx_ring(struct iwi_softc *, struct iwi_rx_ring *,
116 		    int);
117 static void	iwi_reset_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
118 static void	iwi_free_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
119 static int	iwi_media_change(struct ifnet *);
120 static void	iwi_media_status(struct ifnet *, struct ifmediareq *);
121 static int	iwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
122 static int	iwi_wme_update(struct ieee80211com *);
123 static uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
124 static int	iwi_find_txnode(struct iwi_softc *, const uint8_t *);
125 static void	iwi_fix_channel(struct ieee80211com *, struct mbuf *);
126 static void	iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *, int,
127 		    struct iwi_frame *);
128 static void	iwi_notification_intr(struct iwi_softc *, struct iwi_notif *);
129 static void	iwi_rx_intr(struct iwi_softc *);
130 static void	iwi_tx_intr(struct iwi_softc *, struct iwi_tx_ring *);
131 static void	iwi_intr(void *);
132 static int	iwi_cmd(struct iwi_softc *, uint8_t, void *, uint8_t, int);
133 static int	iwi_tx_start(struct ifnet *, struct mbuf *,
134 		    struct ieee80211_node *, int);
135 static void	iwi_start(struct ifnet *);
136 static void	iwi_watchdog(struct ifnet *);
137 static int	iwi_ioctl(struct ifnet *, u_long, caddr_t);
138 static void	iwi_stop_master(struct iwi_softc *);
139 static int	iwi_reset(struct iwi_softc *);
140 static int	iwi_load_ucode(struct iwi_softc *, void *, int);
141 static int	iwi_load_firmware(struct iwi_softc *, void *, int);
142 static int	iwi_cache_firmware(struct iwi_softc *, void *);
143 static void	iwi_free_firmware(struct iwi_softc *);
144 static int	iwi_config(struct iwi_softc *);
145 static int	iwi_set_chan(struct iwi_softc *, struct ieee80211_channel *);
146 static int	iwi_scan(struct iwi_softc *);
147 static int	iwi_auth_and_assoc(struct iwi_softc *);
148 static void	iwi_init(void *);
149 static void	iwi_stop(void *);
150 static int	iwi_sysctl_stats(SYSCTL_HANDLER_ARGS);
151 static int	iwi_sysctl_radio(SYSCTL_HANDLER_ARGS);
152 
153 static int iwi_probe(device_t);
154 static int iwi_attach(device_t);
155 static int iwi_detach(device_t);
156 static int iwi_shutdown(device_t);
157 static int iwi_suspend(device_t);
158 static int iwi_resume(device_t);
159 
160 static device_method_t iwi_methods[] = {
161 	/* Device interface */
162 	DEVMETHOD(device_probe,		iwi_probe),
163 	DEVMETHOD(device_attach,	iwi_attach),
164 	DEVMETHOD(device_detach,	iwi_detach),
165 	DEVMETHOD(device_shutdown,	iwi_shutdown),
166 	DEVMETHOD(device_suspend,	iwi_suspend),
167 	DEVMETHOD(device_resume,	iwi_resume),
168 
169 	{ 0, 0 }
170 };
171 
172 static driver_t iwi_driver = {
173 	"iwi",
174 	iwi_methods,
175 	sizeof (struct iwi_softc)
176 };
177 
178 static devclass_t iwi_devclass;
179 
180 DRIVER_MODULE(iwi, pci, iwi_driver, iwi_devclass, 0, 0);
181 
182 /*
183  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
184  */
185 static const struct ieee80211_rateset iwi_rateset_11a =
186 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
187 
188 static const struct ieee80211_rateset iwi_rateset_11b =
189 	{ 4, { 2, 4, 11, 22 } };
190 
191 static const struct ieee80211_rateset iwi_rateset_11g =
192 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
193 
194 static __inline uint8_t
195 MEM_READ_1(struct iwi_softc *sc, uint32_t addr)
196 {
197 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
198 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
199 }
200 
201 static __inline uint32_t
202 MEM_READ_4(struct iwi_softc *sc, uint32_t addr)
203 {
204 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
205 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
206 }
207 
208 static int
209 iwi_probe(device_t dev)
210 {
211 	const struct iwi_ident *ident;
212 
213 	for (ident = iwi_ident_table; ident->name != NULL; ident++) {
214 		if (pci_get_vendor(dev) == ident->vendor &&
215 		    pci_get_device(dev) == ident->device) {
216 			device_set_desc(dev, ident->name);
217 			return 0;
218 		}
219 	}
220 	return ENXIO;
221 }
222 
223 /* Base Address Register */
224 #define IWI_PCI_BAR0	0x10
225 
226 static int
227 iwi_attach(device_t dev)
228 {
229 	struct iwi_softc *sc = device_get_softc(dev);
230 	struct ifnet *ifp;
231 	struct ieee80211com *ic = &sc->sc_ic;
232 	uint16_t val;
233 	int error, i;
234 
235 	sc->sc_dev = dev;
236 
237 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
238 	    MTX_DEF | MTX_RECURSE);
239 
240 	if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
241 		device_printf(dev, "chip is in D%d power mode "
242 		    "-- setting to D0\n", pci_get_powerstate(dev));
243 		pci_set_powerstate(dev, PCI_POWERSTATE_D0);
244 	}
245 
246 	pci_write_config(dev, 0x41, 0, 1);
247 
248 	/* enable bus-mastering */
249 	pci_enable_busmaster(dev);
250 
251 	sc->mem_rid = IWI_PCI_BAR0;
252 	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
253 	    RF_ACTIVE);
254 	if (sc->mem == NULL) {
255 		device_printf(dev, "could not allocate memory resource\n");
256 		goto fail;
257 	}
258 
259 	sc->sc_st = rman_get_bustag(sc->mem);
260 	sc->sc_sh = rman_get_bushandle(sc->mem);
261 
262 	sc->irq_rid = 0;
263 	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
264 	    RF_ACTIVE | RF_SHAREABLE);
265 	if (sc->irq == NULL) {
266 		device_printf(dev, "could not allocate interrupt resource\n");
267 		goto fail;
268 	}
269 
270 	if (iwi_reset(sc) != 0) {
271 		device_printf(dev, "could not reset adapter\n");
272 		goto fail;
273 	}
274 
275 	/*
276 	 * Allocate rings.
277 	 */
278 	if (iwi_alloc_cmd_ring(sc, &sc->cmdq, IWI_CMD_RING_COUNT) != 0) {
279 		device_printf(dev, "could not allocate Cmd ring\n");
280 		goto fail;
281 	}
282 
283 	error = iwi_alloc_tx_ring(sc, &sc->txq[0], IWI_TX_RING_COUNT,
284 	    IWI_CSR_TX1_RIDX, IWI_CSR_TX1_WIDX);
285 	if (error != 0) {
286 		device_printf(dev, "could not allocate Tx ring 1\n");
287 		goto fail;
288 	}
289 
290 	error = iwi_alloc_tx_ring(sc, &sc->txq[1], IWI_TX_RING_COUNT,
291 	    IWI_CSR_TX2_RIDX, IWI_CSR_TX2_WIDX);
292 	if (error != 0) {
293 		device_printf(dev, "could not allocate Tx ring 2\n");
294 		goto fail;
295 	}
296 
297 	error = iwi_alloc_tx_ring(sc, &sc->txq[2], IWI_TX_RING_COUNT,
298 	    IWI_CSR_TX3_RIDX, IWI_CSR_TX3_WIDX);
299 	if (error != 0) {
300 		device_printf(dev, "could not allocate Tx ring 3\n");
301 		goto fail;
302 	}
303 
304 	error = iwi_alloc_tx_ring(sc, &sc->txq[3], IWI_TX_RING_COUNT,
305 	    IWI_CSR_TX4_RIDX, IWI_CSR_TX4_WIDX);
306 	if (error != 0) {
307 		device_printf(dev, "could not allocate Tx ring 4\n");
308 		goto fail;
309 	}
310 
311 	if (iwi_alloc_rx_ring(sc, &sc->rxq, IWI_RX_RING_COUNT) != 0) {
312 		device_printf(dev, "could not allocate Rx ring\n");
313 		goto fail;
314 	}
315 
316 	ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
317 	if (ifp == NULL) {
318 		device_printf(dev, "can not if_alloc()\n");
319 		goto fail;
320 	}
321 	ifp->if_softc = sc;
322 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
323 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
324 	ifp->if_init = iwi_init;
325 	ifp->if_ioctl = iwi_ioctl;
326 	ifp->if_start = iwi_start;
327 	ifp->if_watchdog = iwi_watchdog;
328 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
329 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
330 	IFQ_SET_READY(&ifp->if_snd);
331 
332 	ic->ic_ifp = ifp;
333 	ic->ic_wme.wme_update = iwi_wme_update;
334 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
335 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
336 	ic->ic_state = IEEE80211_S_INIT;
337 
338 	/* set device capabilities */
339 	ic->ic_caps =
340 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
341 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
342 	    IEEE80211_C_TXPMGT |	/* tx power management */
343 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
344 	    IEEE80211_C_WPA |		/* 802.11i */
345 	    IEEE80211_C_WME;		/* 802.11e */
346 
347 	/* read MAC address from EEPROM */
348 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
349 	ic->ic_myaddr[0] = val >> 8;
350 	ic->ic_myaddr[1] = val & 0xff;
351 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
352 	ic->ic_myaddr[2] = val >> 8;
353 	ic->ic_myaddr[3] = val & 0xff;
354 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
355 	ic->ic_myaddr[4] = val >> 8;
356 	ic->ic_myaddr[5] = val & 0xff;
357 
358 #if 0
359 	if (pci_get_device(dev) >= 0x4223) {
360 		/* set supported .11a rates (2915ABG only) */
361 		ic->ic_sup_rates[IEEE80211_MODE_11A] = iwi_rateset_11a;
362 
363 		/* set supported .11a channels */
364 		for (i = 36; i <= 64; i += 4) {
365 			ic->ic_channels[i].ic_freq =
366 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
367 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
368 		}
369 		for (i = 149; i <= 165; i += 4) {
370 			ic->ic_channels[i].ic_freq =
371 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
372 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
373 		}
374 	}
375 #endif
376 
377 	/* set supported .11b and .11g rates */
378 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwi_rateset_11b;
379 	ic->ic_sup_rates[IEEE80211_MODE_11G] = iwi_rateset_11g;
380 
381 	/* set supported .11b and .11g channels (1 through 14) */
382 	for (i = 1; i <= 14; i++) {
383 		ic->ic_channels[i].ic_freq =
384 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
385 		ic->ic_channels[i].ic_flags =
386 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
387 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
388 	}
389 
390 	ieee80211_ifattach(ic);
391 	/* override state transition machine */
392 	sc->sc_newstate = ic->ic_newstate;
393 	ic->ic_newstate = iwi_newstate;
394 	ieee80211_media_init(ic, iwi_media_change, iwi_media_status);
395 
396 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
397 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
398 
399 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
400 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
401 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
402 
403 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
404 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
405 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
406 
407 	/*
408 	 * Add a few sysctl knobs.
409 	 */
410 	sc->dwelltime = 100;
411 	sc->bluetooth = 1;
412 	sc->antenna = 0;
413 
414 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
415 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "radio",
416 	    CTLTYPE_INT | CTLFLAG_RD, sc, 0, iwi_sysctl_radio, "I",
417 	    "radio transmitter switch state (0=off, 1=on)");
418 
419 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
420 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "stats",
421 	    CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, iwi_sysctl_stats, "S",
422 	    "statistics");
423 
424 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
425 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "dwell",
426 	    CTLFLAG_RW, &sc->dwelltime, 0,
427 	    "channel dwell time (ms) for AP/station scanning");
428 
429 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
430 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "bluetooth",
431 	    CTLFLAG_RW, &sc->bluetooth, 0, "bluetooth coexistence");
432 
433 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
434 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "antenna",
435 	    CTLFLAG_RW, &sc->antenna, 0, "antenna (0=auto)");
436 
437 	/*
438 	 * Hook our interrupt after all initialization is complete.
439 	 */
440 	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
441 	    iwi_intr, sc, &sc->sc_ih);
442 	if (error != 0) {
443 		device_printf(dev, "could not set up interrupt\n");
444 		goto fail;
445 	}
446 
447 	if (bootverbose)
448 		ieee80211_announce(ic);
449 
450 	return 0;
451 
452 fail:	iwi_detach(dev);
453 	return ENXIO;
454 }
455 
456 static int
457 iwi_detach(device_t dev)
458 {
459 	struct iwi_softc *sc = device_get_softc(dev);
460 	struct ieee80211com *ic = &sc->sc_ic;
461 	struct ifnet *ifp = ic->ic_ifp;
462 
463 	iwi_stop(sc);
464 
465 	iwi_free_firmware(sc);
466 
467 	if (ifp != NULL) {
468 		bpfdetach(ifp);
469 		ieee80211_ifdetach(ic);
470 	}
471 
472 	iwi_free_cmd_ring(sc, &sc->cmdq);
473 	iwi_free_tx_ring(sc, &sc->txq[0]);
474 	iwi_free_tx_ring(sc, &sc->txq[1]);
475 	iwi_free_tx_ring(sc, &sc->txq[2]);
476 	iwi_free_tx_ring(sc, &sc->txq[3]);
477 	iwi_free_rx_ring(sc, &sc->rxq);
478 
479 	if (sc->irq != NULL) {
480 		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
481 		bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
482 	}
483 
484 	if (sc->mem != NULL)
485 		bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
486 
487 	if (ifp != NULL)
488 		if_free(ifp);
489 
490 	mtx_destroy(&sc->sc_mtx);
491 
492 	return 0;
493 }
494 
495 static void
496 iwi_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
497 {
498 	if (error != 0)
499 		return;
500 
501 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
502 
503 	*(bus_addr_t *)arg = segs[0].ds_addr;
504 }
505 
506 static int
507 iwi_alloc_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring, int count)
508 {
509 	int error;
510 
511 	ring->count = count;
512 	ring->queued = 0;
513 	ring->cur = ring->next = 0;
514 
515 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
516 	    BUS_SPACE_MAXADDR, NULL, NULL, count * IWI_CMD_DESC_SIZE, 1,
517 	    count * IWI_CMD_DESC_SIZE, 0, NULL, NULL, &ring->desc_dmat);
518 	if (error != 0) {
519 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
520 		goto fail;
521 	}
522 
523 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
524 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
525 	if (error != 0) {
526 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
527 		goto fail;
528 	}
529 
530 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
531 	    count * IWI_CMD_DESC_SIZE, iwi_dma_map_addr, &ring->physaddr, 0);
532 	if (error != 0) {
533 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
534 		goto fail;
535 	}
536 
537 	return 0;
538 
539 fail:	iwi_free_cmd_ring(sc, ring);
540 	return error;
541 }
542 
543 static void
544 iwi_reset_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
545 {
546 	ring->queued = 0;
547 	ring->cur = ring->next = 0;
548 }
549 
550 static void
551 iwi_free_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
552 {
553 	if (ring->desc != NULL) {
554 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
555 		    BUS_DMASYNC_POSTWRITE);
556 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
557 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
558 	}
559 
560 	if (ring->desc_dmat != NULL)
561 		bus_dma_tag_destroy(ring->desc_dmat);
562 }
563 
564 static int
565 iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring, int count,
566     bus_addr_t csr_ridx, bus_addr_t csr_widx)
567 {
568 	int i, error;
569 
570 	ring->count = count;
571 	ring->queued = 0;
572 	ring->cur = ring->next = 0;
573 	ring->csr_ridx = csr_ridx;
574 	ring->csr_widx = csr_widx;
575 
576 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
577 	    BUS_SPACE_MAXADDR, NULL, NULL, count * IWI_TX_DESC_SIZE, 1,
578 	    count * IWI_TX_DESC_SIZE, 0, NULL, NULL, &ring->desc_dmat);
579 	if (error != 0) {
580 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
581 		goto fail;
582 	}
583 
584 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
585 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
586 	if (error != 0) {
587 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
588 		goto fail;
589 	}
590 
591 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
592 	    count * IWI_TX_DESC_SIZE, iwi_dma_map_addr, &ring->physaddr, 0);
593 	if (error != 0) {
594 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
595 		goto fail;
596 	}
597 
598 	ring->data = malloc(count * sizeof (struct iwi_tx_data), M_DEVBUF,
599 	    M_NOWAIT | M_ZERO);
600 	if (ring->data == NULL) {
601 		device_printf(sc->sc_dev, "could not allocate soft data\n");
602 		error = ENOMEM;
603 		goto fail;
604 	}
605 
606 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
607 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0, NULL,
608 	    NULL, &ring->data_dmat);
609 	if (error != 0) {
610 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
611 		goto fail;
612 	}
613 
614 	for (i = 0; i < count; i++) {
615 		error = bus_dmamap_create(ring->data_dmat, 0,
616 		    &ring->data[i].map);
617 		if (error != 0) {
618 			device_printf(sc->sc_dev, "could not create DMA map\n");
619 			goto fail;
620 		}
621 	}
622 
623 	return 0;
624 
625 fail:	iwi_free_tx_ring(sc, ring);
626 	return error;
627 }
628 
629 static void
630 iwi_reset_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
631 {
632 	struct iwi_tx_data *data;
633 	int i;
634 
635 	for (i = 0; i < ring->count; i++) {
636 		data = &ring->data[i];
637 
638 		if (data->m != NULL) {
639 			bus_dmamap_sync(ring->data_dmat, data->map,
640 			    BUS_DMASYNC_POSTWRITE);
641 			bus_dmamap_unload(ring->data_dmat, data->map);
642 			m_freem(data->m);
643 			data->m = NULL;
644 		}
645 
646 		if (data->ni != NULL) {
647 			ieee80211_free_node(data->ni);
648 			data->ni = NULL;
649 		}
650 	}
651 
652 	ring->queued = 0;
653 	ring->cur = ring->next = 0;
654 }
655 
656 static void
657 iwi_free_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
658 {
659 	struct iwi_tx_data *data;
660 	int i;
661 
662 	if (ring->desc != NULL) {
663 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
664 		    BUS_DMASYNC_POSTWRITE);
665 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
666 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
667 	}
668 
669 	if (ring->desc_dmat != NULL)
670 		bus_dma_tag_destroy(ring->desc_dmat);
671 
672 	if (ring->data != NULL) {
673 		for (i = 0; i < ring->count; i++) {
674 			data = &ring->data[i];
675 
676 			if (data->m != NULL) {
677 				bus_dmamap_sync(ring->data_dmat, data->map,
678 				    BUS_DMASYNC_POSTWRITE);
679 				bus_dmamap_unload(ring->data_dmat, data->map);
680 				m_freem(data->m);
681 			}
682 
683 			if (data->ni != NULL)
684 				ieee80211_free_node(data->ni);
685 
686 			if (data->map != NULL)
687 				bus_dmamap_destroy(ring->data_dmat, data->map);
688 		}
689 
690 		free(ring->data, M_DEVBUF);
691 	}
692 
693 	if (ring->data_dmat != NULL)
694 		bus_dma_tag_destroy(ring->data_dmat);
695 }
696 
697 static int
698 iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring, int count)
699 {
700 	struct iwi_rx_data *data;
701 	int i, error;
702 
703 	ring->count = count;
704 	ring->cur = 0;
705 
706 	ring->data = malloc(count * sizeof (struct iwi_rx_data), M_DEVBUF,
707 	    M_NOWAIT | M_ZERO);
708 	if (ring->data == NULL) {
709 		device_printf(sc->sc_dev, "could not allocate soft data\n");
710 		error = ENOMEM;
711 		goto fail;
712 	}
713 
714 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
715 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0, NULL,
716 	    NULL, &ring->data_dmat);
717 	if (error != 0) {
718 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
719 		goto fail;
720 	}
721 
722 	for (i = 0; i < count; i++) {
723 		data = &ring->data[i];
724 
725 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
726 		if (error != 0) {
727 			device_printf(sc->sc_dev, "could not create DMA map\n");
728 			goto fail;
729 		}
730 
731 		data->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
732 		if (data->m == NULL) {
733 			device_printf(sc->sc_dev,
734 			    "could not allocate rx mbuf\n");
735 			error = ENOMEM;
736 			goto fail;
737 		}
738 
739 		error = bus_dmamap_load(ring->data_dmat, data->map,
740 		    mtod(data->m, void *), MCLBYTES, iwi_dma_map_addr,
741 		    &data->physaddr, 0);
742 		if (error != 0) {
743 			device_printf(sc->sc_dev,
744 			    "could not load rx buf DMA map");
745 			goto fail;
746 		}
747 
748 		data->reg = IWI_CSR_RX_BASE + i * 4;
749 	}
750 
751 	return 0;
752 
753 fail:	iwi_free_rx_ring(sc, ring);
754 	return error;
755 }
756 
757 static void
758 iwi_reset_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
759 {
760 	ring->cur = 0;
761 }
762 
763 static void
764 iwi_free_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
765 {
766 	struct iwi_rx_data *data;
767 	int i;
768 
769 	if (ring->data != NULL) {
770 		for (i = 0; i < ring->count; i++) {
771 			data = &ring->data[i];
772 
773 			if (data->m != NULL) {
774 				bus_dmamap_sync(ring->data_dmat, data->map,
775 				    BUS_DMASYNC_POSTREAD);
776 				bus_dmamap_unload(ring->data_dmat, data->map);
777 				m_freem(data->m);
778 			}
779 
780 			if (data->map != NULL)
781 				bus_dmamap_destroy(ring->data_dmat, data->map);
782 		}
783 
784 		free(ring->data, M_DEVBUF);
785 	}
786 
787 	if (ring->data_dmat != NULL)
788 		bus_dma_tag_destroy(ring->data_dmat);
789 }
790 
791 static int
792 iwi_shutdown(device_t dev)
793 {
794 	struct iwi_softc *sc = device_get_softc(dev);
795 
796 	iwi_stop(sc);
797 
798 	return 0;
799 }
800 
801 static int
802 iwi_suspend(device_t dev)
803 {
804 	struct iwi_softc *sc = device_get_softc(dev);
805 
806 	iwi_stop(sc);
807 
808 	return 0;
809 }
810 
811 static int
812 iwi_resume(device_t dev)
813 {
814 	struct iwi_softc *sc = device_get_softc(dev);
815 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
816 
817 	IWI_LOCK(sc);
818 
819 	pci_write_config(dev, 0x41, 0, 1);
820 
821 	if (ifp->if_flags & IFF_UP) {
822 		ifp->if_init(ifp->if_softc);
823 		if (ifp->if_drv_flags & IFF_DRV_RUNNING)
824 			ifp->if_start(ifp);
825 	}
826 
827 	IWI_UNLOCK(sc);
828 
829 	return 0;
830 }
831 
832 static int
833 iwi_media_change(struct ifnet *ifp)
834 {
835 	struct iwi_softc *sc = ifp->if_softc;
836 	int error;
837 
838 	IWI_LOCK(sc);
839 
840 	error = ieee80211_media_change(ifp);
841 	if (error != ENETRESET) {
842 		IWI_UNLOCK(sc);
843 		return error;
844 	}
845 
846 	if ((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
847 		iwi_init(sc);
848 
849 	IWI_UNLOCK(sc);
850 
851 	return 0;
852 }
853 
854 /*
855  * The firmware automaticly adapt the transmit speed. We report the current
856  * transmit speed here.
857  */
858 static void
859 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
860 {
861 	struct iwi_softc *sc = ifp->if_softc;
862 	struct ieee80211com *ic = &sc->sc_ic;
863 #define N(a)	(sizeof (a) / sizeof (a[0]))
864 	static const struct {
865 		uint32_t	val;
866 		int		rate;
867 	} rates[] = {
868 		{ IWI_RATE_DS1,      2 },
869 		{ IWI_RATE_DS2,      4 },
870 		{ IWI_RATE_DS5,     11 },
871 		{ IWI_RATE_DS11,    22 },
872 		{ IWI_RATE_OFDM6,   12 },
873 		{ IWI_RATE_OFDM9,   18 },
874 		{ IWI_RATE_OFDM12,  24 },
875 		{ IWI_RATE_OFDM18,  36 },
876 		{ IWI_RATE_OFDM24,  48 },
877 		{ IWI_RATE_OFDM36,  72 },
878 		{ IWI_RATE_OFDM48,  96 },
879 		{ IWI_RATE_OFDM54, 108 },
880 	};
881 	uint32_t val;
882 	int rate, i;
883 
884 	imr->ifm_status = IFM_AVALID;
885 	imr->ifm_active = IFM_IEEE80211;
886 	if (ic->ic_state == IEEE80211_S_RUN)
887 		imr->ifm_status |= IFM_ACTIVE;
888 
889 	/* read current transmission rate from adapter */
890 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
891 
892 	/* convert rate to 802.11 rate */
893 	for (i = 0; i < N(rates) && rates[i].val != val; i++);
894 	rate = (i < N(rates)) ? rates[i].rate : 0;
895 
896 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
897 	switch (ic->ic_opmode) {
898 	case IEEE80211_M_STA:
899 		break;
900 
901 	case IEEE80211_M_IBSS:
902 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
903 		break;
904 
905 	case IEEE80211_M_MONITOR:
906 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
907 		break;
908 
909 	case IEEE80211_M_AHDEMO:
910 	case IEEE80211_M_HOSTAP:
911 		/* should not get there */
912 		break;
913 	}
914 #undef N
915 }
916 
917 static int
918 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
919 {
920 	struct ifnet *ifp = ic->ic_ifp;
921 	struct iwi_softc *sc = ifp->if_softc;
922 
923 	switch (nstate) {
924 	case IEEE80211_S_SCAN:
925 		if (sc->flags & IWI_FLAG_SCANNING)
926 			break;
927 
928 		sc->nsta = 0;	/* flush IBSS nodes */
929 		ieee80211_node_table_reset(&ic->ic_scan);
930 		ic->ic_flags |= IEEE80211_F_SCAN | IEEE80211_F_ASCAN;
931 		sc->flags |= IWI_FLAG_SCANNING;
932 		iwi_scan(sc);
933 		break;
934 
935 	case IEEE80211_S_AUTH:
936 		iwi_auth_and_assoc(sc);
937 		break;
938 
939 	case IEEE80211_S_RUN:
940 		if (ic->ic_opmode == IEEE80211_M_IBSS)
941 			ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
942 		else if (ic->ic_opmode == IEEE80211_M_MONITOR)
943 			iwi_set_chan(sc, ic->ic_ibss_chan);
944 
945 		return sc->sc_newstate(ic, nstate,
946 		    IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
947 
948 	case IEEE80211_S_ASSOC:
949 		break;
950 
951 	case IEEE80211_S_INIT:
952 		sc->flags &= ~IWI_FLAG_SCANNING;
953 		break;
954 	}
955 
956 	ic->ic_state = nstate;
957 	return 0;
958 }
959 
960 /*
961  * WME parameters coming from IEEE 802.11e specification.  These values are
962  * already declared in ieee80211_proto.c, but they are static so they can't
963  * be reused here.
964  */
965 static const struct wmeParams iwi_wme_cck_params[WME_NUM_AC] = {
966 	{ 0, 3, 5,  7,   0 },	/* WME_AC_BE */
967 	{ 0, 3, 5, 10,   0 },	/* WME_AC_BK */
968 	{ 0, 2, 4,  5, 188 },	/* WME_AC_VI */
969 	{ 0, 2, 3,  4, 102 }	/* WME_AC_VO */
970 };
971 
972 static const struct wmeParams iwi_wme_ofdm_params[WME_NUM_AC] = {
973 	{ 0, 3, 4,  6,   0 },	/* WME_AC_BE */
974 	{ 0, 3, 4, 10,   0 },	/* WME_AC_BK */
975 	{ 0, 2, 3,  4,  94 },	/* WME_AC_VI */
976 	{ 0, 2, 2,  3,  47 }	/* WME_AC_VO */
977 };
978 
979 static int
980 iwi_wme_update(struct ieee80211com *ic)
981 {
982 #define IWI_EXP2(v)	htole16((1 << (v)) - 1)
983 #define IWI_USEC(v)	htole16(IEEE80211_TXOP_TO_US(v))
984 	struct iwi_softc *sc = ic->ic_ifp->if_softc;
985 	struct iwi_wme_params wme[3];
986 	const struct wmeParams *wmep;
987 	int ac;
988 
989 	/*
990 	 * We shall not override firmware default WME values if WME is not
991 	 * actually enabled.
992 	 */
993 	if (!(ic->ic_flags & IEEE80211_F_WME))
994 		return 0;
995 
996 	for (ac = 0; ac < WME_NUM_AC; ac++) {
997 		/* set WME values for current operating mode */
998 		wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
999 		wme[0].aifsn[ac] = wmep->wmep_aifsn;
1000 		wme[0].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1001 		wme[0].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1002 		wme[0].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1003 		wme[0].acm[ac]   = wmep->wmep_acm;
1004 
1005 		/* set WME values for CCK modulation */
1006 		wmep = &iwi_wme_cck_params[ac];
1007 		wme[1].aifsn[ac] = wmep->wmep_aifsn;
1008 		wme[1].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1009 		wme[1].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1010 		wme[1].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1011 		wme[1].acm[ac]   = wmep->wmep_acm;
1012 
1013 		/* set WME values for OFDM modulation */
1014 		wmep = &iwi_wme_ofdm_params[ac];
1015 		wme[2].aifsn[ac] = wmep->wmep_aifsn;
1016 		wme[2].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1017 		wme[2].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1018 		wme[2].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1019 		wme[2].acm[ac]   = wmep->wmep_acm;
1020 	}
1021 
1022 	DPRINTF(("Setting WME parameters\n"));
1023 	return iwi_cmd(sc, IWI_CMD_SET_WME_PARAMS, wme, sizeof wme, 1);
1024 #undef IWI_USEC
1025 #undef IWI_EXP2
1026 }
1027 
1028 /*
1029  * Read 16 bits at address 'addr' from the serial EEPROM.
1030  */
1031 static uint16_t
1032 iwi_read_prom_word(struct iwi_softc *sc, uint8_t addr)
1033 {
1034 	uint32_t tmp;
1035 	uint16_t val;
1036 	int n;
1037 
1038 	/* clock C once before the first command */
1039 	IWI_EEPROM_CTL(sc, 0);
1040 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1041 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1042 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1043 
1044 	/* write start bit (1) */
1045 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1046 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1047 
1048 	/* write READ opcode (10) */
1049 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1050 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1051 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1052 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1053 
1054 	/* write address A7-A0 */
1055 	for (n = 7; n >= 0; n--) {
1056 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1057 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
1058 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1059 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
1060 	}
1061 
1062 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1063 
1064 	/* read data Q15-Q0 */
1065 	val = 0;
1066 	for (n = 15; n >= 0; n--) {
1067 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1068 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1069 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
1070 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
1071 	}
1072 
1073 	IWI_EEPROM_CTL(sc, 0);
1074 
1075 	/* clear Chip Select and clock C */
1076 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1077 	IWI_EEPROM_CTL(sc, 0);
1078 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
1079 
1080 	return be16toh(val);
1081 }
1082 
1083 /*
1084  * This is only used for IBSS mode where the firmware expect an index to an
1085  * internal node table instead of a destination address.
1086  */
1087 static int
1088 iwi_find_txnode(struct iwi_softc *sc, const uint8_t *macaddr)
1089 {
1090 	struct iwi_node node;
1091 	int i;
1092 
1093 	for (i = 0; i < sc->nsta; i++)
1094 		if (IEEE80211_ADDR_EQ(sc->sta[i], macaddr))
1095 			return i;	/* already existing node */
1096 
1097 	if (i == IWI_MAX_NODE)
1098 		return -1;	/* no place left in neighbor table */
1099 
1100 	/* save this new node in our softc table */
1101 	IEEE80211_ADDR_COPY(sc->sta[i], macaddr);
1102 	sc->nsta = i;
1103 
1104 	/* write node information into NIC memory */
1105 	memset(&node, 0, sizeof node);
1106 	IEEE80211_ADDR_COPY(node.bssid, macaddr);
1107 
1108 	CSR_WRITE_REGION_1(sc, IWI_CSR_NODE_BASE + i * sizeof node,
1109 	    (uint8_t *)&node, sizeof node);
1110 
1111 	return i;
1112 }
1113 
1114 /*
1115  * XXX: Hack to set the current channel to the value advertised in beacons or
1116  * probe responses. Only used during AP detection.
1117  */
1118 static void
1119 iwi_fix_channel(struct ieee80211com *ic, struct mbuf *m)
1120 {
1121 	struct ieee80211_frame *wh;
1122 	uint8_t subtype;
1123 	uint8_t *frm, *efrm;
1124 
1125 	wh = mtod(m, struct ieee80211_frame *);
1126 
1127 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
1128 		return;
1129 
1130 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1131 
1132 	if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
1133 	    subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1134 		return;
1135 
1136 	frm = (uint8_t *)(wh + 1);
1137 	efrm = mtod(m, uint8_t *) + m->m_len;
1138 
1139 	frm += 12;	/* skip tstamp, bintval and capinfo fields */
1140 	while (frm < efrm) {
1141 		if (*frm == IEEE80211_ELEMID_DSPARMS)
1142 #if IEEE80211_CHAN_MAX < 255
1143 		if (frm[2] <= IEEE80211_CHAN_MAX)
1144 #endif
1145 			ic->ic_curchan = &ic->ic_channels[frm[2]];
1146 
1147 		frm += frm[1] + 2;
1148 	}
1149 }
1150 
1151 static void
1152 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_data *data, int i,
1153     struct iwi_frame *frame)
1154 {
1155 	struct ieee80211com *ic = &sc->sc_ic;
1156 	struct ifnet *ifp = ic->ic_ifp;
1157 	struct mbuf *m;
1158 	struct ieee80211_frame *wh;
1159 	struct ieee80211_node *ni;
1160 	int error;
1161 
1162 	DPRINTFN(5, ("received frame len=%u chan=%u rssi=%u\n",
1163 	    le16toh(frame->len), frame->chan, frame->rssi_dbm));
1164 
1165 	if (le16toh(frame->len) < sizeof (struct ieee80211_frame))
1166 		return;
1167 
1168 	bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1169 
1170 	/* finalize mbuf */
1171 	m = data->m;
1172 	m->m_pkthdr.rcvif = ifp;
1173 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
1174 	    sizeof (struct iwi_frame) + le16toh(frame->len);
1175 
1176 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
1177 
1178 	if (ic->ic_state == IEEE80211_S_SCAN)
1179 		iwi_fix_channel(ic, m);
1180 
1181 	if (sc->sc_drvbpf != NULL) {
1182 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
1183 
1184 		tap->wr_flags = 0;
1185 		tap->wr_rate = frame->rate;
1186 		tap->wr_chan_freq =
1187 		    htole16(ic->ic_channels[frame->chan].ic_freq);
1188 		tap->wr_chan_flags =
1189 		    htole16(ic->ic_channels[frame->chan].ic_flags);
1190 		tap->wr_antsignal = frame->signal;
1191 		tap->wr_antenna = frame->antenna;
1192 
1193 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
1194 	}
1195 
1196 	wh = mtod(m, struct ieee80211_frame *);
1197 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
1198 
1199 	/* send the frame to the 802.11 layer */
1200 	ieee80211_input(ic, m, ni, frame->rssi_dbm, 0);
1201 
1202 	/* node is no longer needed */
1203 	ieee80211_free_node(ni);
1204 
1205 	data->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1206 	if (data->m == NULL) {
1207 		device_printf(sc->sc_dev, "could not allocate rx mbuf\n");
1208 		return;
1209 	}
1210 
1211 	error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1212 	    mtod(data->m, void *), MCLBYTES, iwi_dma_map_addr, &data->physaddr,
1213 	    0);
1214 	if (error != 0) {
1215 		device_printf(sc->sc_dev, "could not load rx buf DMA map\n");
1216 		m_freem(data->m);
1217 		data->m = NULL;
1218 		return;
1219 	}
1220 
1221 	CSR_WRITE_4(sc, data->reg, data->physaddr);
1222 }
1223 
1224 static void
1225 iwi_notification_intr(struct iwi_softc *sc, struct iwi_notif *notif)
1226 {
1227 	struct ieee80211com *ic = &sc->sc_ic;
1228 	struct iwi_notif_scan_channel *chan;
1229 	struct iwi_notif_scan_complete *scan;
1230 	struct iwi_notif_authentication *auth;
1231 	struct iwi_notif_association *assoc;
1232 
1233 	switch (notif->type) {
1234 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
1235 		chan = (struct iwi_notif_scan_channel *)(notif + 1);
1236 
1237 		DPRINTFN(2, ("Scanning channel (%u)\n", chan->nchan));
1238 		break;
1239 
1240 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
1241 		scan = (struct iwi_notif_scan_complete *)(notif + 1);
1242 
1243 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
1244 		    scan->status));
1245 
1246 		/* monitor mode uses scan to set the channel ... */
1247 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1248 			sc->flags &= ~IWI_FLAG_SCANNING;
1249 			ieee80211_end_scan(ic);
1250 		} else
1251 			iwi_set_chan(sc, ic->ic_ibss_chan);
1252 		break;
1253 
1254 	case IWI_NOTIF_TYPE_AUTHENTICATION:
1255 		auth = (struct iwi_notif_authentication *)(notif + 1);
1256 
1257 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1258 
1259 		switch (auth->state) {
1260 		case IWI_AUTHENTICATED:
1261 			ieee80211_node_authorize(ic->ic_bss);
1262 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1263 			break;
1264 
1265 		case IWI_DEAUTHENTICATED:
1266 			break;
1267 
1268 		default:
1269 			device_printf(sc->sc_dev,
1270 			    "unknown authentication state %u\n", auth->state);
1271 		}
1272 		break;
1273 
1274 	case IWI_NOTIF_TYPE_ASSOCIATION:
1275 		assoc = (struct iwi_notif_association *)(notif + 1);
1276 
1277 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1278 		    assoc->status));
1279 
1280 		switch (assoc->state) {
1281 		case IWI_AUTHENTICATED:
1282 			/* re-association, do nothing */
1283 			break;
1284 
1285 		case IWI_ASSOCIATED:
1286 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1287 			break;
1288 
1289 		case IWI_DEASSOCIATED:
1290 			ieee80211_begin_scan(ic, 1);
1291 			break;
1292 
1293 		default:
1294 			device_printf(sc->sc_dev,
1295 			    "unknown association state %u\n", assoc->state);
1296 		}
1297 		break;
1298 
1299 	case IWI_NOTIF_TYPE_CALIBRATION:
1300 	case IWI_NOTIF_TYPE_BEACON:
1301 	case IWI_NOTIF_TYPE_NOISE:
1302 		DPRINTFN(5, ("Notification (%u)\n", notif->type));
1303 		break;
1304 
1305 	default:
1306 		device_printf(sc->sc_dev, "unknown notification type %u\n",
1307 		    notif->type);
1308 	}
1309 }
1310 
1311 static void
1312 iwi_rx_intr(struct iwi_softc *sc)
1313 {
1314 	struct iwi_rx_data *data;
1315 	struct iwi_hdr *hdr;
1316 	uint32_t hw;
1317 
1318 	hw = CSR_READ_4(sc, IWI_CSR_RX_RIDX);
1319 
1320 	for (; sc->rxq.cur != hw;) {
1321 		data = &sc->rxq.data[sc->rxq.cur];
1322 
1323 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1324 		    BUS_DMASYNC_POSTREAD);
1325 
1326 		hdr = mtod(data->m, struct iwi_hdr *);
1327 
1328 		switch (hdr->type) {
1329 		case IWI_HDR_TYPE_FRAME:
1330 			iwi_frame_intr(sc, data, sc->rxq.cur,
1331 			    (struct iwi_frame *)(hdr + 1));
1332 			break;
1333 
1334 		case IWI_HDR_TYPE_NOTIF:
1335 			iwi_notification_intr(sc,
1336 			    (struct iwi_notif *)(hdr + 1));
1337 			break;
1338 
1339 		default:
1340 			device_printf(sc->sc_dev, "unknown hdr type %u\n",
1341 			    hdr->type);
1342 		}
1343 
1344 		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1345 
1346 		sc->rxq.cur = (sc->rxq.cur + 1) % IWI_RX_RING_COUNT;
1347 	}
1348 
1349 	/* tell the firmware what we have processed */
1350 	hw = (hw == 0) ? IWI_RX_RING_COUNT - 1 : hw - 1;
1351 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, hw);
1352 }
1353 
1354 static void
1355 iwi_tx_intr(struct iwi_softc *sc, struct iwi_tx_ring *txq)
1356 {
1357 	struct ieee80211com *ic = &sc->sc_ic;
1358 	struct ifnet *ifp = ic->ic_ifp;
1359 	struct iwi_tx_data *data;
1360 	uint32_t hw;
1361 
1362 	hw = CSR_READ_4(sc, txq->csr_ridx);
1363 
1364 	for (; txq->next != hw;) {
1365 		data = &txq->data[txq->next];
1366 
1367 		bus_dmamap_sync(txq->data_dmat, data->map,
1368 		    BUS_DMASYNC_POSTWRITE);
1369 		bus_dmamap_unload(txq->data_dmat, data->map);
1370 		m_freem(data->m);
1371 		data->m = NULL;
1372 		ieee80211_free_node(data->ni);
1373 		data->ni = NULL;
1374 
1375 		DPRINTFN(15, ("tx done idx=%u\n", txq->next));
1376 
1377 		ifp->if_opackets++;
1378 
1379 		txq->queued--;
1380 		txq->next = (txq->next + 1) % IWI_TX_RING_COUNT;
1381 	}
1382 
1383 	sc->sc_tx_timer = 0;
1384 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1385 	iwi_start(ifp);
1386 }
1387 
1388 static void
1389 iwi_intr(void *arg)
1390 {
1391 	struct iwi_softc *sc = arg;
1392 	uint32_t r;
1393 
1394 	IWI_LOCK(sc);
1395 
1396 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff) {
1397 		IWI_UNLOCK(sc);
1398 		return;
1399 	}
1400 
1401 	/* disable interrupts */
1402 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1403 
1404 	if (r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)) {
1405 		device_printf(sc->sc_dev, "fatal error\n");
1406 		sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1407 		iwi_stop(sc);
1408 	}
1409 
1410 	if (r & IWI_INTR_FW_INITED) {
1411 		if (!(r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)))
1412 			wakeup(sc);
1413 	}
1414 
1415 	if (r & IWI_INTR_RADIO_OFF) {
1416 		DPRINTF(("radio transmitter turned off\n"));
1417 		sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1418 		iwi_stop(sc);
1419 	}
1420 
1421 	if (r & IWI_INTR_CMD_DONE)
1422 		wakeup(sc);
1423 
1424 	if (r & IWI_INTR_TX1_DONE)
1425 		iwi_tx_intr(sc, &sc->txq[0]);
1426 
1427 	if (r & IWI_INTR_TX2_DONE)
1428 		iwi_tx_intr(sc, &sc->txq[1]);
1429 
1430 	if (r & IWI_INTR_TX3_DONE)
1431 		iwi_tx_intr(sc, &sc->txq[2]);
1432 
1433 	if (r & IWI_INTR_TX4_DONE)
1434 		iwi_tx_intr(sc, &sc->txq[3]);
1435 
1436 	if (r & IWI_INTR_RX_DONE)
1437 		iwi_rx_intr(sc);
1438 
1439 	/* acknowledge interrupts */
1440 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1441 
1442 	/* re-enable interrupts */
1443 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1444 
1445 	IWI_UNLOCK(sc);
1446 }
1447 
1448 static int
1449 iwi_cmd(struct iwi_softc *sc, uint8_t type, void *data, uint8_t len, int async)
1450 {
1451 	struct iwi_cmd_desc *desc;
1452 
1453 	desc = &sc->cmdq.desc[sc->cmdq.cur];
1454 
1455 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1456 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1457 	desc->type = type;
1458 	desc->len = len;
1459 	memcpy(desc->data, data, len);
1460 
1461 	bus_dmamap_sync(sc->cmdq.desc_dmat, sc->cmdq.desc_map,
1462 	    BUS_DMASYNC_PREWRITE);
1463 
1464 	DPRINTFN(2, ("sending command idx=%u type=%u len=%u\n", sc->cmdq.cur,
1465 	    type, len));
1466 
1467 	sc->cmdq.cur = (sc->cmdq.cur + 1) % IWI_CMD_RING_COUNT;
1468 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
1469 
1470 	return async ? 0 : msleep(sc, &sc->sc_mtx, 0, "iwicmd", hz);
1471 }
1472 
1473 static int
1474 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni,
1475     int ac)
1476 {
1477 	struct iwi_softc *sc = ifp->if_softc;
1478 	struct ieee80211com *ic = &sc->sc_ic;
1479 	struct ieee80211_frame *wh;
1480 	struct ieee80211_key *k;
1481 	const struct chanAccParams *cap;
1482 	struct iwi_tx_ring *txq = &sc->txq[ac];
1483 	struct iwi_tx_data *data;
1484 	struct iwi_tx_desc *desc;
1485 	struct mbuf *mnew;
1486 	bus_dma_segment_t segs[IWI_MAX_NSEG];
1487 	int error, nsegs, hdrlen, i, station = 0, noack = 0;
1488 
1489 	wh = mtod(m0, struct ieee80211_frame *);
1490 
1491 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1492 		hdrlen = sizeof (struct ieee80211_qosframe);
1493 		cap = &ic->ic_wme.wme_chanParams;
1494 		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1495 	} else
1496 		hdrlen = sizeof (struct ieee80211_frame);
1497 
1498 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1499 		station = iwi_find_txnode(sc, wh->i_addr1);
1500 		if (station == -1) {
1501 			m_freem(m0);
1502 			ieee80211_free_node(ni);
1503 			ifp->if_oerrors++;
1504 			return 0;
1505 		}
1506 	}
1507 
1508 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1509 		k = ieee80211_crypto_encap(ic, ni, m0);
1510 		if (k == NULL) {
1511 			m_freem(m0);
1512 			return ENOBUFS;
1513 		}
1514 
1515 		/* packet header may have moved, reset our local pointer */
1516 		wh = mtod(m0, struct ieee80211_frame *);
1517 	}
1518 
1519 	if (sc->sc_drvbpf != NULL) {
1520 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1521 
1522 		tap->wt_flags = 0;
1523 		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1524 		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1525 
1526 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1527 	}
1528 
1529 	data = &txq->data[txq->cur];
1530 	desc = &txq->desc[txq->cur];
1531 
1532 	/* save and trim IEEE802.11 header */
1533 	m_copydata(m0, 0, hdrlen, (caddr_t)&desc->wh);
1534 	m_adj(m0, hdrlen);
1535 
1536 	error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map, m0, segs,
1537 	    &nsegs, 0);
1538 	if (error != 0 && error != EFBIG) {
1539 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1540 		    error);
1541 		m_freem(m0);
1542 		return error;
1543 	}
1544 	if (error != 0) {
1545 		mnew = m_defrag(m0, M_DONTWAIT);
1546 		if (mnew == NULL) {
1547 			device_printf(sc->sc_dev,
1548 			    "could not defragment mbuf\n");
1549 			m_freem(m0);
1550 			return ENOBUFS;
1551 		}
1552 		m0 = mnew;
1553 
1554 		error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map,
1555 		    m0, segs, &nsegs, 0);
1556 		if (error != 0) {
1557 			device_printf(sc->sc_dev,
1558 			    "could not map mbuf (error %d)\n", error);
1559 			m_freem(m0);
1560 			return error;
1561 		}
1562 	}
1563 
1564 	data->m = m0;
1565 	data->ni = ni;
1566 
1567 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1568 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1569 	desc->station = station;
1570 	desc->cmd = IWI_DATA_CMD_TX;
1571 	desc->len = htole16(m0->m_pkthdr.len);
1572 	desc->flags = 0;
1573 	desc->xflags = 0;
1574 
1575 	if (!noack && !IEEE80211_IS_MULTICAST(desc->wh.i_addr1))
1576 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1577 
1578 #if 0
1579 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
1580 		desc->wh.i_fc[1] |= IEEE80211_FC1_WEP;
1581 		desc->wep_txkey = ic->ic_crypto.cs_def_txkey;
1582 	} else
1583 #endif
1584 		desc->flags |= IWI_DATA_FLAG_NO_WEP;
1585 
1586 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1587 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1588 
1589 	if (desc->wh.i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS)
1590 		desc->xflags |= IWI_DATA_XFLAG_QOS;
1591 
1592 	desc->nseg = htole32(nsegs);
1593 	for (i = 0; i < nsegs; i++) {
1594 		desc->seg_addr[i] = htole32(segs[i].ds_addr);
1595 		desc->seg_len[i]  = htole32(segs[i].ds_len);
1596 	}
1597 
1598 	bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1599 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1600 
1601 	DPRINTFN(5, ("sending data frame txq=%u idx=%u len=%u nseg=%u\n",
1602 	    ac, txq->cur, desc->len, desc->nseg));
1603 
1604 	txq->queued++;
1605 	txq->cur = (txq->cur + 1) % IWI_TX_RING_COUNT;
1606 	CSR_WRITE_4(sc, txq->csr_widx, txq->cur);
1607 
1608 	return 0;
1609 }
1610 
1611 static void
1612 iwi_start(struct ifnet *ifp)
1613 {
1614 	struct iwi_softc *sc = ifp->if_softc;
1615 	struct ieee80211com *ic = &sc->sc_ic;
1616 	struct mbuf *m0;
1617 	struct ether_header *eh;
1618 	struct ieee80211_node *ni;
1619 	int ac;
1620 
1621 	IWI_LOCK(sc);
1622 
1623 	if (ic->ic_state != IEEE80211_S_RUN) {
1624 		IWI_UNLOCK(sc);
1625 		return;
1626 	}
1627 
1628 	for (;;) {
1629 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m0);
1630 		if (m0 == NULL)
1631 			break;
1632 
1633 		if (m0->m_len < sizeof (struct ether_header) &&
1634 		    (m0 = m_pullup(m0, sizeof (struct ether_header))) == NULL) {
1635 			ifp->if_oerrors++;
1636 			continue;
1637 		}
1638 		eh = mtod(m0, struct ether_header *);
1639 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1640 		if (ni == NULL) {
1641 			m_freem(m0);
1642 			ifp->if_oerrors++;
1643 			continue;
1644 		}
1645 
1646 		/* classify mbuf so we can find which tx ring to use */
1647 		if (ieee80211_classify(ic, m0, ni) != 0) {
1648 			m_freem(m0);
1649 			ieee80211_free_node(ni);
1650 			ifp->if_oerrors++;
1651 			continue;
1652 		}
1653 
1654 		/* no QoS encapsulation for EAPOL frames */
1655 		ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
1656 		    M_WME_GETAC(m0) : WME_AC_BE;
1657 
1658 		if (sc->txq[ac].queued > IWI_TX_RING_COUNT - 8) {
1659 			/* there is no place left in this ring */
1660 			IFQ_DRV_PREPEND(&ifp->if_snd, m0);
1661 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1662 			break;
1663 		}
1664 
1665 		BPF_MTAP(ifp, m0);
1666 
1667 		m0 = ieee80211_encap(ic, m0, ni);
1668 		if (m0 == NULL) {
1669 			ieee80211_free_node(ni);
1670 			ifp->if_oerrors++;
1671 			continue;
1672 		}
1673 
1674 		if (ic->ic_rawbpf != NULL)
1675 			bpf_mtap(ic->ic_rawbpf, m0);
1676 
1677 		if (iwi_tx_start(ifp, m0, ni, ac) != 0) {
1678 			ieee80211_free_node(ni);
1679 			ifp->if_oerrors++;
1680 			break;
1681 		}
1682 
1683 		sc->sc_tx_timer = 5;
1684 		ifp->if_timer = 1;
1685 	}
1686 
1687 	IWI_UNLOCK(sc);
1688 }
1689 
1690 static void
1691 iwi_watchdog(struct ifnet *ifp)
1692 {
1693 	struct iwi_softc *sc = ifp->if_softc;
1694 	struct ieee80211com *ic = &sc->sc_ic;
1695 
1696 	IWI_LOCK(sc);
1697 
1698 	ifp->if_timer = 0;
1699 
1700 	if (sc->sc_tx_timer > 0) {
1701 		if (--sc->sc_tx_timer == 0) {
1702 			if_printf(ifp, "device timeout\n");
1703 			ifp->if_oerrors++;
1704 			ifp->if_flags &= ~IFF_UP;
1705 			iwi_stop(sc);
1706 			IWI_UNLOCK(sc);
1707 			return;
1708 		}
1709 		ifp->if_timer = 1;
1710 	}
1711 
1712 	ieee80211_watchdog(ic);
1713 
1714 	IWI_UNLOCK(sc);
1715 }
1716 
1717 static int
1718 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1719 {
1720 	struct iwi_softc *sc = ifp->if_softc;
1721 	struct ieee80211com *ic = &sc->sc_ic;
1722 	struct ifreq *ifr;
1723 	int error = 0;
1724 
1725 	IWI_LOCK(sc);
1726 
1727 	switch (cmd) {
1728 	case SIOCSIFFLAGS:
1729 		if (ifp->if_flags & IFF_UP) {
1730 			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1731 				iwi_init(sc);
1732 		} else {
1733 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1734 				iwi_stop(sc);
1735 		}
1736 		break;
1737 
1738 	case SIOCSLOADFW:
1739 		/* only super-user can do that! */
1740 		if ((error = suser(curthread)) != 0)
1741 			break;
1742 
1743 		ifr = (struct ifreq *)data;
1744 		error = iwi_cache_firmware(sc, ifr->ifr_data);
1745 		break;
1746 
1747 	case SIOCSKILLFW:
1748 		/* only super-user can do that! */
1749 		if ((error = suser(curthread)) != 0)
1750 			break;
1751 
1752 		ifp->if_flags &= ~IFF_UP;
1753 		iwi_stop(sc);
1754 		iwi_free_firmware(sc);
1755 		break;
1756 
1757 	default:
1758 		error = ieee80211_ioctl(ic, cmd, data);
1759 	}
1760 
1761 	if (error == ENETRESET) {
1762 		if ((ifp->if_flags & IFF_UP) &&
1763 		    (ifp->if_drv_flags & IFF_DRV_RUNNING) &&
1764 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
1765 			iwi_init(sc);
1766 		error = 0;
1767 	}
1768 
1769 	IWI_UNLOCK(sc);
1770 
1771 	return error;
1772 }
1773 
1774 static void
1775 iwi_stop_master(struct iwi_softc *sc)
1776 {
1777 	uint32_t tmp;
1778 	int ntries;
1779 
1780 	/* disable interrupts */
1781 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1782 
1783 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1784 	for (ntries = 0; ntries < 5; ntries++) {
1785 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1786 			break;
1787 		DELAY(10);
1788 	}
1789 	if (ntries == 5)
1790 		device_printf(sc->sc_dev, "timeout waiting for master\n");
1791 
1792 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1793 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_PRINCETON_RESET);
1794 
1795 	sc->flags &= ~IWI_FLAG_FW_INITED;
1796 }
1797 
1798 static int
1799 iwi_reset(struct iwi_softc *sc)
1800 {
1801 	uint32_t tmp;
1802 	int i, ntries;
1803 
1804 	iwi_stop_master(sc);
1805 
1806 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1807 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1808 
1809 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
1810 
1811 	/* wait for clock stabilization */
1812 	for (ntries = 0; ntries < 1000; ntries++) {
1813 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
1814 			break;
1815 		DELAY(200);
1816 	}
1817 	if (ntries == 1000) {
1818 		device_printf(sc->sc_dev,
1819 		    "timeout waiting for clock stabilization\n");
1820 		return EIO;
1821 	}
1822 
1823 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1824 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_SOFT_RESET);
1825 
1826 	DELAY(10);
1827 
1828 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1829 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1830 
1831 	/* clear NIC memory */
1832 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
1833 	for (i = 0; i < 0xc000; i++)
1834 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1835 
1836 	return 0;
1837 }
1838 
1839 static int
1840 iwi_load_ucode(struct iwi_softc *sc, void *uc, int size)
1841 {
1842 	uint32_t tmp;
1843 	uint16_t *w;
1844 	int ntries, i;
1845 
1846 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1847 	    IWI_RST_STOP_MASTER);
1848 	for (ntries = 0; ntries < 5; ntries++) {
1849 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1850 			break;
1851 		DELAY(10);
1852 	}
1853 	if (ntries == 5) {
1854 		device_printf(sc->sc_dev, "timeout waiting for master\n");
1855 		return EIO;
1856 	}
1857 
1858 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1859 	DELAY(5000);
1860 
1861 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1862 	tmp &= ~IWI_RST_PRINCETON_RESET;
1863 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp);
1864 
1865 	DELAY(5000);
1866 	MEM_WRITE_4(sc, 0x3000e0, 0);
1867 	DELAY(1000);
1868 	MEM_WRITE_4(sc, 0x300004, 1);
1869 	DELAY(1000);
1870 	MEM_WRITE_4(sc, 0x300004, 0);
1871 	DELAY(1000);
1872 	MEM_WRITE_1(sc, 0x200000, 0x00);
1873 	MEM_WRITE_1(sc, 0x200000, 0x40);
1874 	DELAY(1000);
1875 
1876 	/* write microcode into adapter memory */
1877 	for (w = uc; size > 0; w++, size -= 2)
1878 		MEM_WRITE_2(sc, 0x200010, *w);
1879 
1880 	MEM_WRITE_1(sc, 0x200000, 0x00);
1881 	MEM_WRITE_1(sc, 0x200000, 0x80);
1882 
1883 	/* wait until we get an answer */
1884 	for (ntries = 0; ntries < 100; ntries++) {
1885 		if (MEM_READ_1(sc, 0x200000) & 1)
1886 			break;
1887 		DELAY(100);
1888 	}
1889 	if (ntries == 100) {
1890 		device_printf(sc->sc_dev,
1891 		    "timeout waiting for ucode to initialize\n");
1892 		return EIO;
1893 	}
1894 
1895 	/* read the answer or the firmware will not initialize properly */
1896 	for (i = 0; i < 7; i++)
1897 		MEM_READ_4(sc, 0x200004);
1898 
1899 	MEM_WRITE_1(sc, 0x200000, 0x00);
1900 
1901 	return 0;
1902 }
1903 
1904 /* macro to handle unaligned little endian data in firmware image */
1905 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1906 
1907 static int
1908 iwi_load_firmware(struct iwi_softc *sc, void *fw, int size)
1909 {
1910 	bus_dma_tag_t dmat;
1911 	bus_dmamap_t map;
1912 	bus_addr_t physaddr;
1913 	void *virtaddr;
1914 	u_char *p, *end;
1915 	uint32_t sentinel, ctl, src, dst, sum, len, mlen, tmp;
1916 	int ntries, error = 0;
1917 
1918 	/* allocate DMA memory for mapping firmware image */
1919 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
1920 	    BUS_SPACE_MAXADDR, NULL, NULL, size, 1, size, 0, NULL, NULL, &dmat);
1921 	if (error != 0) {
1922 		device_printf(sc->sc_dev,
1923 		    "could not create firmware DMA tag\n");
1924 		goto fail1;
1925 	}
1926 
1927 	error = bus_dmamem_alloc(dmat, &virtaddr, BUS_DMA_NOWAIT, &map);
1928 	if (error != 0) {
1929 		device_printf(sc->sc_dev,
1930 		    "could not allocate firmware DMA memory\n");
1931 		goto fail2;
1932 	}
1933 
1934 	error = bus_dmamap_load(dmat, map, virtaddr, size, iwi_dma_map_addr,
1935 	    &physaddr, 0);
1936 	if (error != 0) {
1937 		device_printf(sc->sc_dev, "could not load firmware DMA map\n");
1938 		goto fail3;
1939 	}
1940 
1941 	/* copy firmware image to DMA memory */
1942 	memcpy(virtaddr, fw, size);
1943 
1944 	/* make sure the adapter will get up-to-date values */
1945 	bus_dmamap_sync(dmat, map, BUS_DMASYNC_PREWRITE);
1946 
1947 	/* tell the adapter where the command blocks are stored */
1948 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
1949 
1950 	/*
1951 	 * Store command blocks into adapter's internal memory using register
1952 	 * indirections. The adapter will read the firmware image through DMA
1953 	 * using information stored in command blocks.
1954 	 */
1955 	src = physaddr;
1956 	p = virtaddr;
1957 	end = p + size;
1958 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
1959 
1960 	while (p < end) {
1961 		dst = GETLE32(p); p += 4; src += 4;
1962 		len = GETLE32(p); p += 4; src += 4;
1963 		p += len;
1964 
1965 		while (len > 0) {
1966 			mlen = min(len, IWI_CB_MAXDATALEN);
1967 
1968 			ctl = IWI_CB_DEFAULT_CTL | mlen;
1969 			sum = ctl ^ src ^ dst;
1970 
1971 			/* write a command block */
1972 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
1973 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, src);
1974 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, dst);
1975 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
1976 
1977 			src += mlen;
1978 			dst += mlen;
1979 			len -= mlen;
1980 		}
1981 	}
1982 
1983 	/* write a fictive final command block (sentinel) */
1984 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
1985 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1986 
1987 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1988 	tmp &= ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER);
1989 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp);
1990 
1991 	/* tell the adapter to start processing command blocks */
1992 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
1993 
1994 	/* wait until the adapter reach the sentinel */
1995 	for (ntries = 0; ntries < 400; ntries++) {
1996 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
1997 			break;
1998 		DELAY(100);
1999 	}
2000 	if (ntries == 400) {
2001 		device_printf(sc->sc_dev,
2002 		    "timeout processing command blocks\n");
2003 		error = EIO;
2004 		goto fail4;
2005 	}
2006 
2007 	/* we're done with command blocks processing */
2008 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
2009 
2010 	/* allow interrupts so we know when the firmware is inited */
2011 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
2012 
2013 	/* tell the adapter to initialize the firmware */
2014 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
2015 
2016 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
2017 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_ALLOW_STANDBY);
2018 
2019 	/* wait at most one second for firmware initialization to complete */
2020 	if ((error = msleep(sc, &sc->sc_mtx, 0, "iwiinit", hz)) != 0) {
2021 		device_printf(sc->sc_dev, "timeout waiting for firmware "
2022 		    "initialization to complete\n");
2023 		goto fail4;
2024 	}
2025 
2026 fail4:	bus_dmamap_sync(dmat, map, BUS_DMASYNC_POSTWRITE);
2027 	bus_dmamap_unload(dmat, map);
2028 fail3:	bus_dmamem_free(dmat, virtaddr, map);
2029 fail2:	bus_dma_tag_destroy(dmat);
2030 fail1:
2031 	return error;
2032 }
2033 
2034 /*
2035  * Store firmware into kernel memory so we can download it when we need to,
2036  * e.g when the adapter wakes up from suspend mode.
2037  */
2038 static int
2039 iwi_cache_firmware(struct iwi_softc *sc, void *data)
2040 {
2041 	struct iwi_firmware *kfw = &sc->fw;
2042 	struct iwi_firmware ufw;
2043 	int error;
2044 
2045 	iwi_free_firmware(sc);
2046 
2047 	IWI_UNLOCK(sc);
2048 
2049 	if ((error = copyin(data, &ufw, sizeof ufw)) != 0)
2050 		goto fail1;
2051 
2052 	kfw->boot_size  = ufw.boot_size;
2053 	kfw->ucode_size = ufw.ucode_size;
2054 	kfw->main_size  = ufw.main_size;
2055 
2056 	kfw->boot = malloc(kfw->boot_size, M_DEVBUF, M_NOWAIT);
2057 	if (kfw->boot == NULL) {
2058 		error = ENOMEM;
2059 		goto fail1;
2060 	}
2061 
2062 	kfw->ucode = malloc(kfw->ucode_size, M_DEVBUF, M_NOWAIT);
2063 	if (kfw->ucode == NULL) {
2064 		error = ENOMEM;
2065 		goto fail2;
2066 	}
2067 
2068 	kfw->main = malloc(kfw->main_size, M_DEVBUF, M_NOWAIT);
2069 	if (kfw->main == NULL) {
2070 		error = ENOMEM;
2071 		goto fail3;
2072 	}
2073 
2074 	if ((error = copyin(ufw.boot, kfw->boot, kfw->boot_size)) != 0)
2075 		goto fail4;
2076 
2077 	if ((error = copyin(ufw.ucode, kfw->ucode, kfw->ucode_size)) != 0)
2078 		goto fail4;
2079 
2080 	if ((error = copyin(ufw.main, kfw->main, kfw->main_size)) != 0)
2081 		goto fail4;
2082 
2083 	DPRINTF(("Firmware cached: boot %u, ucode %u, main %u\n",
2084 	    kfw->boot_size, kfw->ucode_size, kfw->main_size));
2085 
2086 	IWI_LOCK(sc);
2087 
2088 	sc->flags |= IWI_FLAG_FW_CACHED;
2089 
2090 	return 0;
2091 
2092 fail4:	free(kfw->boot, M_DEVBUF);
2093 fail3:	free(kfw->ucode, M_DEVBUF);
2094 fail2:	free(kfw->main, M_DEVBUF);
2095 fail1:	IWI_LOCK(sc);
2096 
2097 	return error;
2098 }
2099 
2100 static void
2101 iwi_free_firmware(struct iwi_softc *sc)
2102 {
2103 	if (!(sc->flags & IWI_FLAG_FW_CACHED))
2104 		return;
2105 
2106 	free(sc->fw.boot, M_DEVBUF);
2107 	free(sc->fw.ucode, M_DEVBUF);
2108 	free(sc->fw.main, M_DEVBUF);
2109 
2110 	sc->flags &= ~IWI_FLAG_FW_CACHED;
2111 }
2112 
2113 static int
2114 iwi_config(struct iwi_softc *sc)
2115 {
2116 	struct ieee80211com *ic = &sc->sc_ic;
2117 	struct ifnet *ifp = ic->ic_ifp;
2118 	struct iwi_configuration config;
2119 	struct iwi_rateset rs;
2120 	struct iwi_txpower power;
2121 	struct ieee80211_key *wk;
2122 	struct iwi_wep_key wepkey;
2123 	uint32_t data;
2124 	int error, i;
2125 
2126 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2127 	DPRINTF(("Setting MAC address to %6D\n", ic->ic_myaddr, ":"));
2128 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
2129 	    IEEE80211_ADDR_LEN, 0);
2130 	if (error != 0)
2131 		return error;
2132 
2133 	memset(&config, 0, sizeof config);
2134 	config.bluetooth_coexistence = sc->bluetooth;
2135 	config.antenna = sc->antenna;
2136 	config.multicast_enabled = 1;
2137 	config.answer_pbreq = (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2138 	config.disable_unicast_decryption = 1;
2139 	config.disable_multicast_decryption = 1;
2140 	DPRINTF(("Configuring adapter\n"));
2141 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 0);
2142 	if (error != 0)
2143 		return error;
2144 
2145 	data = htole32(IWI_POWER_MODE_CAM);
2146 	DPRINTF(("Setting power mode to %u\n", le32toh(data)));
2147 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
2148 	if (error != 0)
2149 		return error;
2150 
2151 	data = htole32(ic->ic_rtsthreshold);
2152 	DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
2153 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
2154 	if (error != 0)
2155 		return error;
2156 
2157 	data = htole32(ic->ic_fragthreshold);
2158 	DPRINTF(("Setting fragmentation threshold to %u\n", le32toh(data)));
2159 	error = iwi_cmd(sc, IWI_CMD_SET_FRAG_THRESHOLD, &data, sizeof data, 0);
2160 	if (error != 0)
2161 		return error;
2162 
2163 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
2164 		power.mode = IWI_MODE_11B;
2165 		power.nchan = 11;
2166 		for (i = 0; i < 11; i++) {
2167 			power.chan[i].chan = i + 1;
2168 			power.chan[i].power = IWI_TXPOWER_MAX;
2169 		}
2170 		DPRINTF(("Setting .11b channels tx power\n"));
2171 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2172 		    0);
2173 		if (error != 0)
2174 			return error;
2175 
2176 		power.mode = IWI_MODE_11G;
2177 		DPRINTF(("Setting .11g channels tx power\n"));
2178 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2179 		    0);
2180 		if (error != 0)
2181 			return error;
2182 	}
2183 
2184 	rs.mode = IWI_MODE_11G;
2185 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2186 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
2187 	memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates,
2188 	    rs.nrates);
2189 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
2190 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2191 	if (error != 0)
2192 		return error;
2193 
2194 	rs.mode = IWI_MODE_11A;
2195 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2196 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
2197 	memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates,
2198 	    rs.nrates);
2199 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
2200 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2201 	if (error != 0)
2202 		return error;
2203 
2204 	/* if we have a desired ESSID, set it now */
2205 	if (ic->ic_des_esslen != 0) {
2206 #ifdef IWI_DEBUG
2207 		if (iwi_debug > 0) {
2208 			printf("Setting desired ESSID to ");
2209 			ieee80211_print_essid(ic->ic_des_essid,
2210 			    ic->ic_des_esslen);
2211 			printf("\n");
2212 		}
2213 #endif
2214 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ic->ic_des_essid,
2215 		    ic->ic_des_esslen, 0);
2216 		if (error != 0)
2217 			return error;
2218 	}
2219 
2220 	data = htole32(arc4random());
2221 	DPRINTF(("Setting initialization vector to %u\n", le32toh(data)));
2222 	error = iwi_cmd(sc, IWI_CMD_SET_IV, &data, sizeof data, 0);
2223 	if (error != 0)
2224 		return error;
2225 
2226 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2227 		wk = &ic->ic_crypto.cs_nw_keys[i];
2228 
2229 		wepkey.cmd = IWI_WEP_KEY_CMD_SETKEY;
2230 		wepkey.idx = i;
2231 		wepkey.len = wk->wk_keylen;
2232 		memset(wepkey.key, 0, sizeof wepkey.key);
2233 		memcpy(wepkey.key, wk->wk_key, wk->wk_keylen);
2234 		DPRINTF(("Setting wep key index %u len %u\n", wepkey.idx,
2235 		    wepkey.len));
2236 		error = iwi_cmd(sc, IWI_CMD_SET_WEP_KEY, &wepkey,
2237 		    sizeof wepkey, 0);
2238 		if (error != 0)
2239 			return error;
2240 	}
2241 
2242 	/* enable adapter */
2243 	DPRINTF(("Enabling adapter\n"));
2244 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
2245 }
2246 
2247 static int
2248 iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
2249 {
2250 	struct ieee80211com *ic = &sc->sc_ic;
2251 	struct iwi_scan scan;
2252 
2253 	memset(&scan, 0, sizeof scan);
2254 	scan.type = IWI_SCAN_TYPE_PASSIVE;
2255 	scan.dwelltime = htole16(2000);
2256 	scan.channels[0] = 1 | (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ :
2257 	    IWI_CHAN_2GHZ);
2258 	scan.channels[1] = ieee80211_chan2ieee(ic, chan);
2259 
2260 	DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
2261 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2262 }
2263 
2264 static int
2265 iwi_scan(struct iwi_softc *sc)
2266 {
2267 	struct ieee80211com *ic = &sc->sc_ic;
2268 	struct iwi_scan scan;
2269 	uint8_t *p;
2270 	int i, count;
2271 
2272 	memset(&scan, 0, sizeof scan);
2273 	scan.type = (ic->ic_des_esslen != 0) ? IWI_SCAN_TYPE_BDIRECTED :
2274 	    IWI_SCAN_TYPE_BROADCAST;
2275 	scan.dwelltime = htole16(sc->dwelltime);
2276 
2277 	p = scan.channels;
2278 	count = 0;
2279 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2280 		if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]) &&
2281 		    isset(ic->ic_chan_active, i)) {
2282 			*++p = i;
2283 			count++;
2284 		}
2285 	}
2286 	*(p - count) = IWI_CHAN_5GHZ | count;
2287 
2288 	count = 0;
2289 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2290 		if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]) &&
2291 		    isset(ic->ic_chan_active, i)) {
2292 			*++p = i;
2293 			count++;
2294 		}
2295 	}
2296 	*(p - count) = IWI_CHAN_2GHZ | count;
2297 
2298 	DPRINTF(("Start scanning\n"));
2299 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2300 }
2301 
2302 static int
2303 iwi_auth_and_assoc(struct iwi_softc *sc)
2304 {
2305 	struct ieee80211com *ic = &sc->sc_ic;
2306 	struct ifnet *ifp = ic->ic_ifp;
2307 	struct ieee80211_node *ni = ic->ic_bss;
2308 	struct ieee80211_wme_info wme;
2309 	struct iwi_configuration config;
2310 	struct iwi_associate assoc;
2311 	struct iwi_rateset rs;
2312 	uint16_t capinfo;
2313 	uint32_t data;
2314 	int error;
2315 
2316 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
2317 		memset(&config, 0, sizeof config);
2318 		config.bluetooth_coexistence = sc->bluetooth;
2319 		config.antenna = sc->antenna;
2320 		config.multicast_enabled = 1;
2321 		config.use_protection = 1;
2322 		config.answer_pbreq =
2323 		    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2324 		config.disable_unicast_decryption = 1;
2325 		config.disable_multicast_decryption = 1;
2326 		DPRINTF(("Configuring adapter\n"));
2327 		error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config,
2328 		    1);
2329 		if (error != 0)
2330 			return error;
2331 	}
2332 
2333 #ifdef IWI_DEBUG
2334 	if (iwi_debug > 0) {
2335 		printf("Setting ESSID to ");
2336 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2337 		printf("\n");
2338 	}
2339 #endif
2340 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2341 	if (error != 0)
2342 		return error;
2343 
2344 	/* the rate set has already been "negociated" */
2345 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2346 	    IWI_MODE_11G;
2347 	rs.type = IWI_RATESET_TYPE_NEGOCIATED;
2348 	rs.nrates = ni->ni_rates.rs_nrates;
2349 	memcpy(rs.rates, ni->ni_rates.rs_rates, rs.nrates);
2350 	DPRINTF(("Setting negociated rates (%u)\n", rs.nrates));
2351 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2352 	if (error != 0)
2353 		return error;
2354 
2355 	if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL) {
2356 		wme.wme_id = IEEE80211_ELEMID_VENDOR;
2357 		wme.wme_len = sizeof (struct ieee80211_wme_info) - 2;
2358 		wme.wme_oui[0] = 0x00;
2359 		wme.wme_oui[1] = 0x50;
2360 		wme.wme_oui[2] = 0xf2;
2361 		wme.wme_type = WME_OUI_TYPE;
2362 		wme.wme_subtype = WME_INFO_OUI_SUBTYPE;
2363 		wme.wme_version = WME_VERSION;
2364 		wme.wme_info = 0;
2365 
2366 		DPRINTF(("Setting WME IE (len=%u)\n", wme.wme_len));
2367 		error = iwi_cmd(sc, IWI_CMD_SET_WMEIE, &wme, sizeof wme, 1);
2368 		if (error != 0)
2369 			return error;
2370 	}
2371 
2372 	if (ic->ic_opt_ie != NULL) {
2373 		DPRINTF(("Setting optional IE (len=%u)\n", ic->ic_opt_ie_len));
2374 		error = iwi_cmd(sc, IWI_CMD_SET_OPTIE, ic->ic_opt_ie,
2375 		    ic->ic_opt_ie_len, 1);
2376 		if (error != 0)
2377 			return error;
2378 	}
2379 
2380 	data = htole32(ni->ni_rssi);
2381 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2382 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2383 	if (error != 0)
2384 		return error;
2385 
2386 	memset(&assoc, 0, sizeof assoc);
2387 	assoc.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2388 	    IWI_MODE_11G;
2389 	assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2390 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED)
2391 		assoc.auth = ic->ic_crypto.cs_def_txkey << 4 | IWI_AUTH_SHARED;
2392 	if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
2393 		assoc.policy |= htole16(IWI_POLICY_WME);
2394 	if (ic->ic_opt_ie != NULL)
2395 		assoc.policy |= htole16(IWI_POLICY_WPA);
2396 	memcpy(assoc.tstamp, ni->ni_tstamp.data, 8);
2397 
2398 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2399 		capinfo = IEEE80211_CAPINFO_IBSS;
2400 	else
2401 		capinfo = IEEE80211_CAPINFO_ESS;
2402 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
2403 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2404 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2405 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2406 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2407 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
2408 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2409 	assoc.capinfo = htole16(capinfo);
2410 
2411 	assoc.lintval = htole16(ic->ic_lintval);
2412 	assoc.intval = htole16(ni->ni_intval);
2413 	IEEE80211_ADDR_COPY(assoc.bssid, ni->ni_bssid);
2414 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2415 		IEEE80211_ADDR_COPY(assoc.dst, ifp->if_broadcastaddr);
2416 	else
2417 		IEEE80211_ADDR_COPY(assoc.dst, ni->ni_bssid);
2418 
2419 	DPRINTF(("Trying to associate to %6D channel %u auth %u\n",
2420 	    assoc.bssid, ":", assoc.chan, assoc.auth));
2421 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &assoc, sizeof assoc, 1);
2422 }
2423 
2424 static void
2425 iwi_init(void *priv)
2426 {
2427 	struct iwi_softc *sc = priv;
2428 	struct ieee80211com *ic = &sc->sc_ic;
2429 	struct ifnet *ifp = ic->ic_ifp;
2430 	struct iwi_firmware *fw = &sc->fw;
2431 	struct iwi_rx_data *data;
2432 	int i;
2433 
2434 	/* exit immediately if firmware has not been ioctl'd */
2435 	if (!(sc->flags & IWI_FLAG_FW_CACHED)) {
2436 		if (!(sc->flags & IWI_FLAG_FW_WARNED))
2437 			device_printf(sc->sc_dev, "Please load firmware\n");
2438 		sc->flags |= IWI_FLAG_FW_WARNED;
2439 		ifp->if_flags &= ~IFF_UP;
2440 		return;
2441 	}
2442 
2443 	iwi_stop(sc);
2444 
2445 	if (iwi_reset(sc) != 0) {
2446 		device_printf(sc->sc_dev, "could not reset adapter\n");
2447 		goto fail;
2448 	}
2449 
2450 	if (iwi_load_firmware(sc, fw->boot, fw->boot_size) != 0) {
2451 		device_printf(sc->sc_dev, "could not load boot firmware\n");
2452 		goto fail;
2453 	}
2454 
2455 	if (iwi_load_ucode(sc, fw->ucode, fw->ucode_size) != 0) {
2456 		device_printf(sc->sc_dev, "could not load microcode\n");
2457 		goto fail;
2458 	}
2459 
2460 	iwi_stop_master(sc);
2461 
2462 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmdq.physaddr);
2463 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, sc->cmdq.count);
2464 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
2465 
2466 	CSR_WRITE_4(sc, IWI_CSR_TX1_BASE, sc->txq[0].physaddr);
2467 	CSR_WRITE_4(sc, IWI_CSR_TX1_SIZE, sc->txq[0].count);
2468 	CSR_WRITE_4(sc, IWI_CSR_TX1_WIDX, sc->txq[0].cur);
2469 
2470 	CSR_WRITE_4(sc, IWI_CSR_TX2_BASE, sc->txq[1].physaddr);
2471 	CSR_WRITE_4(sc, IWI_CSR_TX2_SIZE, sc->txq[1].count);
2472 	CSR_WRITE_4(sc, IWI_CSR_TX2_WIDX, sc->txq[1].cur);
2473 
2474 	CSR_WRITE_4(sc, IWI_CSR_TX3_BASE, sc->txq[2].physaddr);
2475 	CSR_WRITE_4(sc, IWI_CSR_TX3_SIZE, sc->txq[2].count);
2476 	CSR_WRITE_4(sc, IWI_CSR_TX3_WIDX, sc->txq[2].cur);
2477 
2478 	CSR_WRITE_4(sc, IWI_CSR_TX4_BASE, sc->txq[3].physaddr);
2479 	CSR_WRITE_4(sc, IWI_CSR_TX4_SIZE, sc->txq[3].count);
2480 	CSR_WRITE_4(sc, IWI_CSR_TX4_WIDX, sc->txq[3].cur);
2481 
2482 	for (i = 0; i < sc->rxq.count; i++) {
2483 		data = &sc->rxq.data[i];
2484 		CSR_WRITE_4(sc, data->reg, data->physaddr);
2485 	}
2486 
2487 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, sc->rxq.count - 1);
2488 
2489 	if (iwi_load_firmware(sc, fw->main, fw->main_size) != 0) {
2490 		device_printf(sc->sc_dev, "could not load main firmware\n");
2491 		goto fail;
2492 	}
2493 
2494 	sc->flags |= IWI_FLAG_FW_INITED;
2495 
2496 	if (iwi_config(sc) != 0) {
2497 		device_printf(sc->sc_dev, "device configuration failed\n");
2498 		goto fail;
2499 	}
2500 
2501 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2502 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2503 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2504 	} else
2505 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2506 
2507 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2508 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2509 
2510 	return;
2511 
2512 fail:	ifp->if_flags &= ~IFF_UP;
2513 	iwi_stop(sc);
2514 }
2515 
2516 static void
2517 iwi_stop(void *priv)
2518 {
2519 	struct iwi_softc *sc = priv;
2520 	struct ieee80211com *ic = &sc->sc_ic;
2521 	struct ifnet *ifp = ic->ic_ifp;
2522 
2523 	iwi_stop_master(sc);
2524 
2525 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SOFT_RESET);
2526 
2527 	/* reset rings */
2528 	iwi_reset_cmd_ring(sc, &sc->cmdq);
2529 	iwi_reset_tx_ring(sc, &sc->txq[0]);
2530 	iwi_reset_tx_ring(sc, &sc->txq[1]);
2531 	iwi_reset_tx_ring(sc, &sc->txq[2]);
2532 	iwi_reset_tx_ring(sc, &sc->txq[3]);
2533 	iwi_reset_rx_ring(sc, &sc->rxq);
2534 
2535 	sc->sc_tx_timer = 0;
2536 	ifp->if_timer = 0;
2537 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2538 
2539 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2540 }
2541 
2542 static int
2543 iwi_sysctl_stats(SYSCTL_HANDLER_ARGS)
2544 {
2545 	struct iwi_softc *sc = arg1;
2546 	uint32_t size, buf[128];
2547 
2548 	if (!(sc->flags & IWI_FLAG_FW_INITED)) {
2549 		memset(buf, 0, sizeof buf);
2550 		return SYSCTL_OUT(req, buf, sizeof buf);
2551 	}
2552 
2553 	size = min(CSR_READ_4(sc, IWI_CSR_TABLE0_SIZE), 128 - 1);
2554 	CSR_READ_REGION_4(sc, IWI_CSR_TABLE0_BASE, &buf[1], size);
2555 
2556 	return SYSCTL_OUT(req, buf, sizeof buf);
2557 }
2558 
2559 static int
2560 iwi_sysctl_radio(SYSCTL_HANDLER_ARGS)
2561 {
2562 	struct iwi_softc *sc = arg1;
2563 	int val;
2564 
2565 	val = (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) ? 1 : 0;
2566 
2567 	return SYSCTL_OUT(req, &val, sizeof val);
2568 }
2569