xref: /netbsd-src/sys/dev/pci/if_iwi.c (revision 1921cb5602567cfc8401cc953be22fe9d74238f2)
1 /*	$NetBSD: if_iwi.c,v 1.56 2006/09/24 03:53:09 jmcneill Exp $  */
2 
3 /*-
4  * Copyright (c) 2004, 2005
5  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice unmodified, this list of conditions, and the following
12  *    disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __KERNEL_RCSID(0, "$NetBSD: if_iwi.c,v 1.56 2006/09/24 03:53:09 jmcneill Exp $");
32 
33 /*-
34  * Intel(R) PRO/Wireless 2200BG/2225BG/2915ABG driver
35  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
36  */
37 
38 #include "bpfilter.h"
39 
40 #include <sys/param.h>
41 #include <sys/sockio.h>
42 #include <sys/sysctl.h>
43 #include <sys/mbuf.h>
44 #include <sys/kernel.h>
45 #include <sys/socket.h>
46 #include <sys/systm.h>
47 #include <sys/malloc.h>
48 #include <sys/conf.h>
49 #include <sys/kauth.h>
50 
51 #include <machine/bus.h>
52 #include <machine/endian.h>
53 #include <machine/intr.h>
54 
55 #include <dev/firmload.h>
56 
57 #include <dev/pci/pcireg.h>
58 #include <dev/pci/pcivar.h>
59 #include <dev/pci/pcidevs.h>
60 
61 #if NBPFILTER > 0
62 #include <net/bpf.h>
63 #endif
64 #include <net/if.h>
65 #include <net/if_arp.h>
66 #include <net/if_dl.h>
67 #include <net/if_ether.h>
68 #include <net/if_media.h>
69 #include <net/if_types.h>
70 
71 #include <net80211/ieee80211_var.h>
72 #include <net80211/ieee80211_radiotap.h>
73 
74 #include <netinet/in.h>
75 #include <netinet/in_systm.h>
76 #include <netinet/in_var.h>
77 #include <netinet/ip.h>
78 
79 #include <crypto/arc4/arc4.h>
80 
81 #include <dev/pci/if_iwireg.h>
82 #include <dev/pci/if_iwivar.h>
83 
84 #ifdef IWI_DEBUG
85 #define DPRINTF(x)	if (iwi_debug > 0) printf x
86 #define DPRINTFN(n, x)	if (iwi_debug >= (n)) printf x
87 int iwi_debug = 4;
88 #else
89 #define DPRINTF(x)
90 #define DPRINTFN(n, x)
91 #endif
92 
93 static int	iwi_match(struct device *, struct cfdata *, void *);
94 static void	iwi_attach(struct device *, struct device *, void *);
95 static int	iwi_detach(struct device *, int);
96 
97 static void	iwi_shutdown(void *);
98 static int	iwi_suspend(struct iwi_softc *);
99 static int	iwi_resume(struct iwi_softc *);
100 static void	iwi_powerhook(int, void *);
101 
102 static int	iwi_alloc_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *,
103     int);
104 static void	iwi_reset_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
105 static void	iwi_free_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
106 static int	iwi_alloc_tx_ring(struct iwi_softc *, struct iwi_tx_ring *,
107     int, bus_addr_t, bus_addr_t);
108 static void	iwi_reset_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
109 static void	iwi_free_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
110 static struct mbuf *
111 		iwi_alloc_rx_buf(struct iwi_softc *sc);
112 static int	iwi_alloc_rx_ring(struct iwi_softc *, struct iwi_rx_ring *,
113     int);
114 static void	iwi_reset_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
115 static void	iwi_free_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
116 
117 static struct	ieee80211_node *iwi_node_alloc(struct ieee80211_node_table *);
118 static void	iwi_node_free(struct ieee80211_node *);
119 
120 static int	iwi_media_change(struct ifnet *);
121 static void	iwi_media_status(struct ifnet *, struct ifmediareq *);
122 static int	iwi_wme_update(struct ieee80211com *);
123 static uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
124 static int	iwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
125 static void	iwi_fix_channel(struct ieee80211com *, struct mbuf *);
126 static void	iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *, int,
127     struct iwi_frame *);
128 static void	iwi_notification_intr(struct iwi_softc *, struct iwi_notif *);
129 static void	iwi_cmd_intr(struct iwi_softc *);
130 static void	iwi_rx_intr(struct iwi_softc *);
131 static void	iwi_tx_intr(struct iwi_softc *, struct iwi_tx_ring *);
132 static int	iwi_intr(void *);
133 static int	iwi_cmd(struct iwi_softc *, uint8_t, void *, uint8_t, int);
134 static void	iwi_write_ibssnode(struct iwi_softc *, const struct iwi_node *);
135 static int	iwi_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *,
136     int);
137 static void	iwi_start(struct ifnet *);
138 static void	iwi_watchdog(struct ifnet *);
139 
140 static int	iwi_alloc_unr(struct iwi_softc *);
141 static void	iwi_free_unr(struct iwi_softc *, int);
142 
143 static int	iwi_get_table0(struct iwi_softc *, uint32_t *);
144 
145 static int	iwi_ioctl(struct ifnet *, u_long, caddr_t);
146 static void	iwi_stop_master(struct iwi_softc *);
147 static int	iwi_reset(struct iwi_softc *);
148 static int	iwi_load_ucode(struct iwi_softc *, void *, int);
149 static int	iwi_load_firmware(struct iwi_softc *, void *, int);
150 static int	iwi_cache_firmware(struct iwi_softc *);
151 static void	iwi_free_firmware(struct iwi_softc *);
152 static int	iwi_config(struct iwi_softc *);
153 static int	iwi_set_chan(struct iwi_softc *, struct ieee80211_channel *);
154 static int	iwi_scan(struct iwi_softc *);
155 static int	iwi_auth_and_assoc(struct iwi_softc *);
156 static int	iwi_init(struct ifnet *);
157 static void	iwi_stop(struct ifnet *, int);
158 static int	iwi_getrfkill(struct iwi_softc *);
159 static void	iwi_led_set(struct iwi_softc *, uint32_t, int);
160 static void	iwi_sysctlattach(struct iwi_softc *);
161 static void	iwi_error_log(struct iwi_softc *);
162 
163 /*
164  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
165  */
166 static const struct ieee80211_rateset iwi_rateset_11a =
167 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
168 
169 static const struct ieee80211_rateset iwi_rateset_11b =
170 	{ 4, { 2, 4, 11, 22 } };
171 
172 static const struct ieee80211_rateset iwi_rateset_11g =
173 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
174 
175 static inline uint8_t
176 MEM_READ_1(struct iwi_softc *sc, uint32_t addr)
177 {
178 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
179 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
180 }
181 
182 static inline uint32_t
183 MEM_READ_4(struct iwi_softc *sc, uint32_t addr)
184 {
185 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
186 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
187 }
188 
189 static void
190 MEM_CPY(struct iwi_softc *sc, void *dst, uint32_t base, size_t sz)
191 {
192 	KASSERT(sz % 4 == 0);
193 	int j;
194 
195 	uint32_t *p = dst;
196 
197 	for (j = 0; j < sz / 4; j++)
198 		p[j] = MEM_READ_4(sc, base + j * sizeof(uint32_t));
199 }
200 
201 CFATTACH_DECL(iwi, sizeof (struct iwi_softc), iwi_match, iwi_attach,
202     iwi_detach, NULL);
203 
204 static int
205 iwi_match(struct device *parent, struct cfdata *match, void *aux)
206 {
207 	struct pci_attach_args *pa = aux;
208 
209 	if (PCI_VENDOR(pa->pa_id) != PCI_VENDOR_INTEL)
210 		return 0;
211 
212 	if (PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2200BG ||
213 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2225BG ||
214 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1 ||
215 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2)
216 		return 1;
217 
218 	return 0;
219 }
220 
221 /* Base Address Register */
222 #define IWI_PCI_BAR0	0x10
223 
224 static void
225 iwi_attach(struct device *parent, struct device *self, void *aux)
226 {
227 	struct iwi_softc *sc = (struct iwi_softc *)self;
228 	struct ieee80211com *ic = &sc->sc_ic;
229 	struct ifnet *ifp = &sc->sc_if;
230 	struct pci_attach_args *pa = aux;
231 	const char *intrstr;
232 	char devinfo[256];
233 	bus_space_tag_t memt;
234 	bus_space_handle_t memh;
235 	bus_addr_t base;
236 	pci_intr_handle_t ih;
237 	pcireg_t data;
238 	uint16_t val;
239 	int error, revision, i;
240 
241 	sc->sc_pct = pa->pa_pc;
242 	sc->sc_pcitag = pa->pa_tag;
243 
244 	pci_devinfo(pa->pa_id, pa->pa_class, 0, devinfo, sizeof devinfo);
245 	revision = PCI_REVISION(pa->pa_class);
246 	aprint_normal(": %s (rev. 0x%02x)\n", devinfo, revision);
247 
248 	/* clear device specific PCI configuration register 0x41 */
249 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
250 	data &= ~0x0000ff00;
251 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
252 
253 	/* clear unit numbers allocated to IBSS */
254 	sc->sc_unr = 0;
255 
256 	/* power up chip */
257 	if ((error = pci_activate(pa->pa_pc, pa->pa_tag, sc,
258 	    NULL)) && error != EOPNOTSUPP) {
259 		aprint_error("%s: cannot activate %d\n", sc->sc_dev.dv_xname,
260 		    error);
261 		return;
262 	}
263 
264 	/* enable bus-mastering */
265 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG);
266 	data |= PCI_COMMAND_MASTER_ENABLE;
267 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG, data);
268 
269 	/* map the register window */
270 	error = pci_mapreg_map(pa, IWI_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
271 	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz);
272 	if (error != 0) {
273 		aprint_error("%s: could not map memory space\n",
274 		    sc->sc_dev.dv_xname);
275 		return;
276 	}
277 
278 	sc->sc_st = memt;
279 	sc->sc_sh = memh;
280 	sc->sc_dmat = pa->pa_dmat;
281 
282 	/* disable interrupts */
283 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
284 
285 	if (pci_intr_map(pa, &ih) != 0) {
286 		aprint_error("%s: could not map interrupt\n",
287 		    sc->sc_dev.dv_xname);
288 		return;
289 	}
290 
291 	intrstr = pci_intr_string(sc->sc_pct, ih);
292 	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, iwi_intr, sc);
293 	if (sc->sc_ih == NULL) {
294 		aprint_error("%s: could not establish interrupt",
295 		    sc->sc_dev.dv_xname);
296 		if (intrstr != NULL)
297 			aprint_error(" at %s", intrstr);
298 		aprint_error("\n");
299 		return;
300 	}
301 	aprint_normal("%s: interrupting at %s\n", sc->sc_dev.dv_xname, intrstr);
302 
303 	if (iwi_reset(sc) != 0) {
304 		aprint_error("%s: could not reset adapter\n",
305 		    sc->sc_dev.dv_xname);
306 		return;
307 	}
308 
309 	/*
310 	 * Allocate rings.
311 	 */
312 	if (iwi_alloc_cmd_ring(sc, &sc->cmdq, IWI_CMD_RING_COUNT) != 0) {
313 		aprint_error("%s: could not allocate command ring\n",
314 		    sc->sc_dev.dv_xname);
315 		goto fail;
316 	}
317 
318 	error = iwi_alloc_tx_ring(sc, &sc->txq[0], IWI_TX_RING_COUNT,
319 	    IWI_CSR_TX1_RIDX, IWI_CSR_TX1_WIDX);
320 	if (error != 0) {
321 		aprint_error("%s: could not allocate Tx ring 1\n",
322 		    sc->sc_dev.dv_xname);
323 		goto fail;
324 	}
325 
326 	error = iwi_alloc_tx_ring(sc, &sc->txq[1], IWI_TX_RING_COUNT,
327 	    IWI_CSR_TX2_RIDX, IWI_CSR_TX2_WIDX);
328 	if (error != 0) {
329 		aprint_error("%s: could not allocate Tx ring 2\n",
330 		    sc->sc_dev.dv_xname);
331 		goto fail;
332 	}
333 
334 	error = iwi_alloc_tx_ring(sc, &sc->txq[2], IWI_TX_RING_COUNT,
335 	    IWI_CSR_TX3_RIDX, IWI_CSR_TX3_WIDX);
336 	if (error != 0) {
337 		aprint_error("%s: could not allocate Tx ring 3\n",
338 		    sc->sc_dev.dv_xname);
339 		goto fail;
340 	}
341 
342 	error = iwi_alloc_tx_ring(sc, &sc->txq[3], IWI_TX_RING_COUNT,
343 	    IWI_CSR_TX4_RIDX, IWI_CSR_TX4_WIDX);
344 	if (error != 0) {
345 		aprint_error("%s: could not allocate Tx ring 4\n",
346 		    sc->sc_dev.dv_xname);
347 		goto fail;
348 	}
349 
350 	if (iwi_alloc_rx_ring(sc, &sc->rxq, IWI_RX_RING_COUNT) != 0) {
351 		aprint_error("%s: could not allocate Rx ring\n",
352 		    sc->sc_dev.dv_xname);
353 		goto fail;
354 	}
355 
356 	ic->ic_ifp = ifp;
357 	ic->ic_wme.wme_update = iwi_wme_update;
358 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
359 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
360 	ic->ic_state = IEEE80211_S_INIT;
361 
362 	sc->sc_fwname = "iwi-bss.fw";
363 	sc->sc_ucname = "iwi-ucode-bss.fw";
364 
365 	/* set device capabilities */
366 	ic->ic_caps =
367 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
368 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
369 	    IEEE80211_C_TXPMGT |	/* tx power management */
370 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
371 	    IEEE80211_C_WPA |		/* 802.11i */
372 	    IEEE80211_C_WME;		/* 802.11e */
373 
374 	/* read MAC address from EEPROM */
375 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
376 	ic->ic_myaddr[0] = val & 0xff;
377 	ic->ic_myaddr[1] = val >> 8;
378 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
379 	ic->ic_myaddr[2] = val & 0xff;
380 	ic->ic_myaddr[3] = val >> 8;
381 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
382 	ic->ic_myaddr[4] = val & 0xff;
383 	ic->ic_myaddr[5] = val >> 8;
384 
385 	aprint_normal("%s: 802.11 address %s\n", sc->sc_dev.dv_xname,
386 	    ether_sprintf(ic->ic_myaddr));
387 
388 	/* read the NIC type from EEPROM */
389 	val = iwi_read_prom_word(sc, IWI_EEPROM_NIC_TYPE);
390 	sc->nictype = val & 0xff;
391 
392 	DPRINTF(("%s: NIC type %d\n", sc->sc_dev.dv_xname, sc->nictype));
393 
394 	if (PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1 ||
395 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2) {
396 		/* set supported .11a rates (2915ABG only) */
397 		ic->ic_sup_rates[IEEE80211_MODE_11A] = iwi_rateset_11a;
398 
399 		/* set supported .11a channels */
400 		for (i = 36; i <= 64; i += 4) {
401 			ic->ic_channels[i].ic_freq =
402 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
403 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
404 		}
405 		for (i = 149; i <= 165; i += 4) {
406 			ic->ic_channels[i].ic_freq =
407 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
408 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
409 		}
410 	}
411 
412 	/* set supported .11b and .11g rates */
413 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwi_rateset_11b;
414 	ic->ic_sup_rates[IEEE80211_MODE_11G] = iwi_rateset_11g;
415 
416 	/* set supported .11b and .11g channels (1 through 14) */
417 	for (i = 1; i <= 14; i++) {
418 		ic->ic_channels[i].ic_freq =
419 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
420 		ic->ic_channels[i].ic_flags =
421 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
422 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
423 	}
424 
425 	ifp->if_softc = sc;
426 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
427 	ifp->if_init = iwi_init;
428 	ifp->if_stop = iwi_stop;
429 	ifp->if_ioctl = iwi_ioctl;
430 	ifp->if_start = iwi_start;
431 	ifp->if_watchdog = iwi_watchdog;
432 	IFQ_SET_READY(&ifp->if_snd);
433 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
434 
435 	if_attach(ifp);
436 	ieee80211_ifattach(ic);
437 	/* override default methods */
438 	ic->ic_node_alloc = iwi_node_alloc;
439 	sc->sc_node_free = ic->ic_node_free;
440 	ic->ic_node_free = iwi_node_free;
441 	/* override state transition machine */
442 	sc->sc_newstate = ic->ic_newstate;
443 	ic->ic_newstate = iwi_newstate;
444 	ieee80211_media_init(ic, iwi_media_change, iwi_media_status);
445 
446 #if NBPFILTER > 0
447 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
448 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
449 
450 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
451 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
452 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
453 
454 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
455 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
456 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
457 #endif
458 
459 	iwi_sysctlattach(sc);
460 
461 	/*
462 	 * Make sure the interface is shutdown during reboot.
463 	 */
464 	sc->sc_sdhook = shutdownhook_establish(iwi_shutdown, sc);
465 	if (sc->sc_sdhook == NULL)
466 		aprint_error("%s: WARNING: unable to establish shutdown hook\n",
467 		    sc->sc_dev.dv_xname);
468 	sc->sc_powerhook = powerhook_establish(sc->sc_dev.dv_xname,
469 	    iwi_powerhook, sc);
470 	if (sc->sc_powerhook == NULL)
471 		aprint_error("%s: WARNING: unable to establish power hook\n",
472 		    sc->sc_dev.dv_xname);
473 
474 	ieee80211_announce(ic);
475 
476 	return;
477 
478 fail:	iwi_detach(self, 0);
479 }
480 
481 static int
482 iwi_detach(struct device* self, int flags)
483 {
484 	struct iwi_softc *sc = (struct iwi_softc *)self;
485 	struct ifnet *ifp = &sc->sc_if;
486 
487 	if (ifp != NULL)
488 		iwi_stop(ifp, 1);
489 
490 	iwi_free_firmware(sc);
491 
492 #if NBPFILTER > 0
493 	if (ifp != NULL)
494 		bpfdetach(ifp);
495 #endif
496 	ieee80211_ifdetach(&sc->sc_ic);
497 	if (ifp != NULL)
498 		if_detach(ifp);
499 
500 	iwi_free_cmd_ring(sc, &sc->cmdq);
501 	iwi_free_tx_ring(sc, &sc->txq[0]);
502 	iwi_free_tx_ring(sc, &sc->txq[1]);
503 	iwi_free_tx_ring(sc, &sc->txq[2]);
504 	iwi_free_tx_ring(sc, &sc->txq[3]);
505 	iwi_free_rx_ring(sc, &sc->rxq);
506 
507 	if (sc->sc_ih != NULL) {
508 		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
509 		sc->sc_ih = NULL;
510 	}
511 
512 	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
513 
514 	powerhook_disestablish(sc->sc_powerhook);
515 	shutdownhook_disestablish(sc->sc_sdhook);
516 
517 	return 0;
518 }
519 
520 static int
521 iwi_alloc_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring,
522     int count)
523 {
524 	int error, nsegs;
525 
526 	ring->count = count;
527 	ring->queued = 0;
528 	ring->cur = ring->next = 0;
529 
530 	/*
531 	 * Allocate and map command ring
532 	 */
533 	error = bus_dmamap_create(sc->sc_dmat,
534 	    IWI_CMD_DESC_SIZE * count, 1,
535 	    IWI_CMD_DESC_SIZE * count, 0,
536 	    BUS_DMA_NOWAIT, &ring->desc_map);
537 	if (error != 0) {
538 		aprint_error("%s: could not create command ring DMA map\n",
539 		    sc->sc_dev.dv_xname);
540 		goto fail;
541 	}
542 
543 	error = bus_dmamem_alloc(sc->sc_dmat,
544 	    IWI_CMD_DESC_SIZE * count, PAGE_SIZE, 0,
545 	    &sc->cmdq.desc_seg, 1, &nsegs, BUS_DMA_NOWAIT);
546 	if (error != 0) {
547 		aprint_error("%s: could not allocate command ring DMA memory\n",
548 		    sc->sc_dev.dv_xname);
549 		goto fail;
550 	}
551 
552 	error = bus_dmamem_map(sc->sc_dmat, &sc->cmdq.desc_seg, nsegs,
553 	    IWI_CMD_DESC_SIZE * count,
554 	    (caddr_t *)&sc->cmdq.desc, BUS_DMA_NOWAIT);
555 	if (error != 0) {
556 		aprint_error("%s: could not map command ring DMA memory\n",
557 		    sc->sc_dev.dv_xname);
558 		goto fail;
559 	}
560 
561 	error = bus_dmamap_load(sc->sc_dmat, sc->cmdq.desc_map, sc->cmdq.desc,
562 	    IWI_CMD_DESC_SIZE * count, NULL,
563 	    BUS_DMA_NOWAIT);
564 	if (error != 0) {
565 		aprint_error("%s: could not load command ring DMA map\n",
566 		    sc->sc_dev.dv_xname);
567 		goto fail;
568 	}
569 
570 	memset(sc->cmdq.desc, 0,
571 	    IWI_CMD_DESC_SIZE * count);
572 
573 	return 0;
574 
575 fail:	iwi_free_cmd_ring(sc, ring);
576 	return error;
577 }
578 
579 static void
580 iwi_reset_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
581 {
582 	int i;
583 
584 	for (i = ring->next; i != ring->cur;) {
585 		bus_dmamap_sync(sc->sc_dmat, sc->cmdq.desc_map,
586 		    i * IWI_CMD_DESC_SIZE, IWI_CMD_DESC_SIZE,
587 		    BUS_DMASYNC_POSTWRITE);
588 
589 		wakeup(&ring->desc[i]);
590 		i = (i + 1) % ring->count;
591 	}
592 
593 	ring->queued = 0;
594 	ring->cur = ring->next = 0;
595 }
596 
597 static void
598 iwi_free_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
599 {
600 	if (ring->desc_map != NULL) {
601 		if (ring->desc != NULL) {
602 			bus_dmamap_unload(sc->sc_dmat, ring->desc_map);
603 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
604 			    IWI_CMD_DESC_SIZE * ring->count);
605 			bus_dmamem_free(sc->sc_dmat, &ring->desc_seg, 1);
606 		}
607 		bus_dmamap_destroy(sc->sc_dmat, ring->desc_map);
608 	}
609 }
610 
611 static int
612 iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring,
613     int count, bus_addr_t csr_ridx, bus_addr_t csr_widx)
614 {
615 	int i, error, nsegs;
616 
617 	ring->count = count;
618 	ring->queued = 0;
619 	ring->cur = ring->next = 0;
620 	ring->csr_ridx = csr_ridx;
621 	ring->csr_widx = csr_widx;
622 
623 	/*
624 	 * Allocate and map Tx ring
625 	 */
626 	error = bus_dmamap_create(sc->sc_dmat,
627 	    IWI_TX_DESC_SIZE * count, 1,
628 	    IWI_TX_DESC_SIZE * count, 0, BUS_DMA_NOWAIT,
629 	    &ring->desc_map);
630 	if (error != 0) {
631 		aprint_error("%s: could not create tx ring DMA map\n",
632 		    sc->sc_dev.dv_xname);
633 		goto fail;
634 	}
635 
636 	error = bus_dmamem_alloc(sc->sc_dmat,
637 	    IWI_TX_DESC_SIZE * count, PAGE_SIZE, 0,
638 	    &ring->desc_seg, 1, &nsegs, BUS_DMA_NOWAIT);
639 	if (error != 0) {
640 		aprint_error("%s: could not allocate tx ring DMA memory\n",
641 		    sc->sc_dev.dv_xname);
642 		goto fail;
643 	}
644 
645 	error = bus_dmamem_map(sc->sc_dmat, &ring->desc_seg, nsegs,
646 	    IWI_TX_DESC_SIZE * count,
647 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
648 	if (error != 0) {
649 		aprint_error("%s: could not map tx ring DMA memory\n",
650 		    sc->sc_dev.dv_xname);
651 		goto fail;
652 	}
653 
654 	error = bus_dmamap_load(sc->sc_dmat, ring->desc_map, ring->desc,
655 	    IWI_TX_DESC_SIZE * count, NULL,
656 	    BUS_DMA_NOWAIT);
657 	if (error != 0) {
658 		aprint_error("%s: could not load tx ring DMA map\n",
659 		    sc->sc_dev.dv_xname);
660 		goto fail;
661 	}
662 
663 	memset(ring->desc, 0, IWI_TX_DESC_SIZE * count);
664 
665 	ring->data = malloc(count * sizeof (struct iwi_tx_data), M_DEVBUF,
666 	    M_NOWAIT | M_ZERO);
667 	if (ring->data == NULL) {
668 		aprint_error("%s: could not allocate soft data\n",
669 		    sc->sc_dev.dv_xname);
670 		error = ENOMEM;
671 		goto fail;
672 	}
673 
674 	/*
675 	 * Allocate Tx buffers DMA maps
676 	 */
677 	for (i = 0; i < count; i++) {
678 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IWI_MAX_NSEG,
679 		    MCLBYTES, 0, BUS_DMA_NOWAIT, &ring->data[i].map);
680 		if (error != 0) {
681 			aprint_error("%s: could not create tx buf DMA map",
682 			    sc->sc_dev.dv_xname);
683 			goto fail;
684 		}
685 	}
686 	return 0;
687 
688 fail:	iwi_free_tx_ring(sc, ring);
689 	return error;
690 }
691 
692 static void
693 iwi_reset_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
694 {
695 	struct iwi_tx_data *data;
696 	int i;
697 
698 	for (i = 0; i < ring->count; i++) {
699 		data = &ring->data[i];
700 
701 		if (data->m != NULL) {
702 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
703 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
704 			bus_dmamap_unload(sc->sc_dmat, data->map);
705 			m_freem(data->m);
706 			data->m = NULL;
707 		}
708 
709 		if (data->ni != NULL) {
710 			ieee80211_free_node(data->ni);
711 			data->ni = NULL;
712 		}
713 	}
714 
715 	ring->queued = 0;
716 	ring->cur = ring->next = 0;
717 }
718 
719 static void
720 iwi_free_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
721 {
722 	int i;
723 
724 	if (ring->desc_map != NULL) {
725 		if (ring->desc != NULL) {
726 			bus_dmamap_unload(sc->sc_dmat, ring->desc_map);
727 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
728 			    IWI_TX_DESC_SIZE * ring->count);
729 			bus_dmamem_free(sc->sc_dmat, &ring->desc_seg, 1);
730 		}
731 		bus_dmamap_destroy(sc->sc_dmat, ring->desc_map);
732 	}
733 
734 	for (i = 0; i < ring->count; i++) {
735 		if (ring->data[i].m != NULL) {
736 			bus_dmamap_unload(sc->sc_dmat, ring->data[i].map);
737 			m_freem(ring->data[i].m);
738 		}
739 		bus_dmamap_destroy(sc->sc_dmat, ring->data[i].map);
740 	}
741 }
742 
743 static int
744 iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring,
745     int count)
746 {
747 	int i, error;
748 
749 	ring->count = count;
750 	ring->cur = 0;
751 
752 	ring->data = malloc(count * sizeof (struct iwi_rx_data), M_DEVBUF,
753 	    M_NOWAIT | M_ZERO);
754 	if (ring->data == NULL) {
755 		aprint_error("%s: could not allocate soft data\n",
756 		    sc->sc_dev.dv_xname);
757 		error = ENOMEM;
758 		goto fail;
759 	}
760 
761 	/*
762 	 * Allocate and map Rx buffers
763 	 */
764 	for (i = 0; i < count; i++) {
765 
766 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
767 		    0, BUS_DMA_WAITOK | BUS_DMA_ALLOCNOW, &ring->data[i].map);
768 		if (error != 0) {
769 			aprint_error("%s: could not create rx buf DMA map",
770 			    sc->sc_dev.dv_xname);
771 			goto fail;
772 		}
773 
774 		if ((ring->data[i].m = iwi_alloc_rx_buf(sc)) == NULL) {
775 			error = ENOMEM;
776 			goto fail;
777 		}
778 
779 		error = bus_dmamap_load_mbuf(sc->sc_dmat, ring->data[i].map,
780 		    ring->data[i].m, BUS_DMA_READ | BUS_DMA_NOWAIT);
781 		if (error != 0) {
782 			aprint_error("%s: could not load rx buffer DMA map\n",
783 			    sc->sc_dev.dv_xname);
784 			goto fail;
785 		}
786 
787 		bus_dmamap_sync(sc->sc_dmat, ring->data[i].map, 0,
788 		    ring->data[i].map->dm_mapsize, BUS_DMASYNC_PREREAD);
789 	}
790 
791 	return 0;
792 
793 fail:	iwi_free_rx_ring(sc, ring);
794 	return error;
795 }
796 
797 static void
798 iwi_reset_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
799 {
800 	ring->cur = 0;
801 }
802 
803 static void
804 iwi_free_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
805 {
806 	int i;
807 
808 	for (i = 0; i < ring->count; i++) {
809 		if (ring->data[i].m != NULL) {
810 			bus_dmamap_unload(sc->sc_dmat, ring->data[i].map);
811 			m_freem(ring->data[i].m);
812 		}
813 		bus_dmamap_destroy(sc->sc_dmat, ring->data[i].map);
814 	}
815 }
816 
817 static void
818 iwi_shutdown(void *arg)
819 {
820 	struct iwi_softc *sc = (struct iwi_softc *)arg;
821 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
822 
823 	iwi_stop(ifp, 1);
824 }
825 
826 static int
827 iwi_suspend(struct iwi_softc *sc)
828 {
829 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
830 
831 	iwi_stop(ifp, 1);
832 
833 	return 0;
834 }
835 
836 static int
837 iwi_resume(struct iwi_softc *sc)
838 {
839 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
840 	pcireg_t data;
841 
842 	/* clear device specific PCI configuration register 0x41 */
843 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
844 	data &= ~0x0000ff00;
845 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
846 
847 	if (ifp->if_flags & IFF_UP) {
848 		iwi_init(ifp);
849 		if (ifp->if_flags & IFF_RUNNING)
850 			iwi_start(ifp);
851 	}
852 
853 	return 0;
854 }
855 
856 static void
857 iwi_powerhook(int why, void *arg)
858 {
859         struct iwi_softc *sc = arg;
860 	pci_chipset_tag_t pc = sc->sc_pct;
861 	pcitag_t tag = sc->sc_pcitag;
862 	int s;
863 
864 	s = splnet();
865 	switch (why) {
866 	case PWR_SUSPEND:
867 	case PWR_STANDBY:
868 		pci_conf_capture(pc, tag, &sc->sc_pciconf);
869 		break;
870 	case PWR_RESUME:
871 		pci_conf_restore(pc, tag, &sc->sc_pciconf);
872 		break;
873 	case PWR_SOFTSUSPEND:
874 	case PWR_SOFTSTANDBY:
875 		iwi_suspend(sc);
876 		break;
877 	case PWR_SOFTRESUME:
878 		iwi_resume(sc);
879 		break;
880 	}
881 	splx(s);
882 }
883 
884 static struct ieee80211_node *
885 iwi_node_alloc(struct ieee80211_node_table *nt)
886 {
887 	struct iwi_node *in;
888 
889 	in = malloc(sizeof (struct iwi_node), M_80211_NODE, M_NOWAIT | M_ZERO);
890 	if (in == NULL)
891 		return NULL;
892 
893 	in->in_station = -1;
894 
895 	return &in->in_node;
896 }
897 
898 static int
899 iwi_alloc_unr(struct iwi_softc *sc)
900 {
901 	int i;
902 
903 	for (i = 0; i < IWI_MAX_IBSSNODE - 1; i++)
904 		if ((sc->sc_unr & (1 << i)) == 0) {
905 			sc->sc_unr |= 1 << i;
906 			return i;
907 		}
908 
909 	return -1;
910 }
911 
912 static void
913 iwi_free_unr(struct iwi_softc *sc, int r)
914 {
915 
916 	sc->sc_unr &= 1 << r;
917 }
918 
919 static void
920 iwi_node_free(struct ieee80211_node *ni)
921 {
922 	struct ieee80211com *ic = ni->ni_ic;
923 	struct iwi_softc *sc = ic->ic_ifp->if_softc;
924 	struct iwi_node *in = (struct iwi_node *)ni;
925 
926 	if (in->in_station != -1)
927 		iwi_free_unr(sc, in->in_station);
928 
929 	sc->sc_node_free(ni);
930 }
931 
932 static int
933 iwi_media_change(struct ifnet *ifp)
934 {
935 	int error;
936 
937 	error = ieee80211_media_change(ifp);
938 	if (error != ENETRESET)
939 		return error;
940 
941 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
942 		iwi_init(ifp);
943 
944 	return 0;
945 }
946 
947 /*
948  * The firmware automatically adapts the transmit speed.  We report its current
949  * value here.
950  */
951 static void
952 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
953 {
954 	struct iwi_softc *sc = ifp->if_softc;
955 	struct ieee80211com *ic = &sc->sc_ic;
956 #define N(a)	(sizeof (a) / sizeof (a[0]))
957 	static const struct {
958 		uint32_t	val;
959 		int		rate;
960 	} rates[] = {
961 		{ IWI_RATE_DS1,      2 },
962 		{ IWI_RATE_DS2,      4 },
963 		{ IWI_RATE_DS5,     11 },
964 		{ IWI_RATE_DS11,    22 },
965 		{ IWI_RATE_OFDM6,   12 },
966 		{ IWI_RATE_OFDM9,   18 },
967 		{ IWI_RATE_OFDM12,  24 },
968 		{ IWI_RATE_OFDM18,  36 },
969 		{ IWI_RATE_OFDM24,  48 },
970 		{ IWI_RATE_OFDM36,  72 },
971 		{ IWI_RATE_OFDM48,  96 },
972 		{ IWI_RATE_OFDM54, 108 },
973 	};
974 	uint32_t val;
975 	int rate, i;
976 
977 	imr->ifm_status = IFM_AVALID;
978 	imr->ifm_active = IFM_IEEE80211;
979 	if (ic->ic_state == IEEE80211_S_RUN)
980 		imr->ifm_status |= IFM_ACTIVE;
981 
982 	/* read current transmission rate from adapter */
983 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
984 
985 	/* convert rate to 802.11 rate */
986 	for (i = 0; i < N(rates) && rates[i].val != val; i++);
987 	rate = (i < N(rates)) ? rates[i].rate : 0;
988 
989 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
990 	switch (ic->ic_opmode) {
991 	case IEEE80211_M_STA:
992 		break;
993 
994 	case IEEE80211_M_IBSS:
995 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
996 		break;
997 
998 	case IEEE80211_M_MONITOR:
999 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
1000 		break;
1001 
1002 	case IEEE80211_M_AHDEMO:
1003 	case IEEE80211_M_HOSTAP:
1004 		/* should not get there */
1005 		break;
1006 	}
1007 #undef N
1008 }
1009 
1010 static int
1011 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1012 {
1013 	struct iwi_softc *sc = ic->ic_ifp->if_softc;
1014 
1015 	switch (nstate) {
1016 	case IEEE80211_S_SCAN:
1017 		if (sc->flags & IWI_FLAG_SCANNING)
1018 			break;
1019 
1020 		ieee80211_node_table_reset(&ic->ic_scan);
1021 		ic->ic_flags |= IEEE80211_F_SCAN | IEEE80211_F_ASCAN;
1022 		sc->flags |= IWI_FLAG_SCANNING;
1023 		/* blink the led while scanning */
1024 		iwi_led_set(sc, IWI_LED_ASSOCIATED, 1);
1025 		iwi_scan(sc);
1026 		break;
1027 
1028 	case IEEE80211_S_AUTH:
1029 		iwi_auth_and_assoc(sc);
1030 		break;
1031 
1032 	case IEEE80211_S_RUN:
1033 		if (ic->ic_opmode == IEEE80211_M_IBSS)
1034 			ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
1035 		else if (ic->ic_opmode == IEEE80211_M_MONITOR)
1036 			iwi_set_chan(sc, ic->ic_ibss_chan);
1037 
1038 		return (*sc->sc_newstate)(ic, nstate,
1039 		    IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
1040 
1041 	case IEEE80211_S_ASSOC:
1042 		iwi_led_set(sc, IWI_LED_ASSOCIATED, 0);
1043 		break;
1044 
1045 	case IEEE80211_S_INIT:
1046 		sc->flags &= ~IWI_FLAG_SCANNING;
1047 		return (*sc->sc_newstate)(ic, nstate, arg);
1048 	}
1049 
1050 	ic->ic_state = nstate;
1051 	return 0;
1052 }
1053 
1054 /*
1055  * WME parameters coming from IEEE 802.11e specification.  These values are
1056  * already declared in ieee80211_proto.c, but they are static so they can't
1057  * be reused here.
1058  */
1059 static const struct wmeParams iwi_wme_cck_params[WME_NUM_AC] = {
1060 	{ 0, 3, 5,  7,   0, 0, },	/* WME_AC_BE */
1061 	{ 0, 3, 5, 10,   0, 0, },	/* WME_AC_BK */
1062 	{ 0, 2, 4,  5, 188, 0, },	/* WME_AC_VI */
1063 	{ 0, 2, 3,  4, 102, 0, },	/* WME_AC_VO */
1064 };
1065 
1066 static const struct wmeParams iwi_wme_ofdm_params[WME_NUM_AC] = {
1067 	{ 0, 3, 4,  6,   0, 0, },	/* WME_AC_BE */
1068 	{ 0, 3, 4, 10,   0, 0, },	/* WME_AC_BK */
1069 	{ 0, 2, 3,  4,  94, 0, },	/* WME_AC_VI */
1070 	{ 0, 2, 2,  3,  47, 0, },	/* WME_AC_VO */
1071 };
1072 
1073 static int
1074 iwi_wme_update(struct ieee80211com *ic)
1075 {
1076 #define IWI_EXP2(v)	htole16((1 << (v)) - 1)
1077 #define IWI_USEC(v)	htole16(IEEE80211_TXOP_TO_US(v))
1078 	struct iwi_softc *sc = ic->ic_ifp->if_softc;
1079 	struct iwi_wme_params wme[3];
1080 	const struct wmeParams *wmep;
1081 	int ac;
1082 
1083 	/*
1084 	 * We shall not override firmware default WME values if WME is not
1085 	 * actually enabled.
1086 	 */
1087 	if (!(ic->ic_flags & IEEE80211_F_WME))
1088 		return 0;
1089 
1090 	for (ac = 0; ac < WME_NUM_AC; ac++) {
1091 		/* set WME values for current operating mode */
1092 		wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
1093 		wme[0].aifsn[ac] = wmep->wmep_aifsn;
1094 		wme[0].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1095 		wme[0].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1096 		wme[0].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1097 		wme[0].acm[ac]   = wmep->wmep_acm;
1098 
1099 		/* set WME values for CCK modulation */
1100 		wmep = &iwi_wme_cck_params[ac];
1101 		wme[1].aifsn[ac] = wmep->wmep_aifsn;
1102 		wme[1].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1103 		wme[1].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1104 		wme[1].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1105 		wme[1].acm[ac]   = wmep->wmep_acm;
1106 
1107 		/* set WME values for OFDM modulation */
1108 		wmep = &iwi_wme_ofdm_params[ac];
1109 		wme[2].aifsn[ac] = wmep->wmep_aifsn;
1110 		wme[2].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1111 		wme[2].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1112 		wme[2].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1113 		wme[2].acm[ac]   = wmep->wmep_acm;
1114 	}
1115 
1116 	DPRINTF(("Setting WME parameters\n"));
1117 	return iwi_cmd(sc, IWI_CMD_SET_WME_PARAMS, wme, sizeof wme, 1);
1118 #undef IWI_USEC
1119 #undef IWI_EXP2
1120 }
1121 
1122 /*
1123  * Read 16 bits at address 'addr' from the serial EEPROM.
1124  */
1125 static uint16_t
1126 iwi_read_prom_word(struct iwi_softc *sc, uint8_t addr)
1127 {
1128 	uint32_t tmp;
1129 	uint16_t val;
1130 	int n;
1131 
1132 	/* Clock C once before the first command */
1133 	IWI_EEPROM_CTL(sc, 0);
1134 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1135 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1136 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1137 
1138 	/* Write start bit (1) */
1139 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1140 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1141 
1142 	/* Write READ opcode (10) */
1143 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1144 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1145 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1146 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1147 
1148 	/* Write address A7-A0 */
1149 	for (n = 7; n >= 0; n--) {
1150 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1151 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
1152 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1153 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
1154 	}
1155 
1156 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1157 
1158 	/* Read data Q15-Q0 */
1159 	val = 0;
1160 	for (n = 15; n >= 0; n--) {
1161 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1162 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1163 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
1164 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
1165 	}
1166 
1167 	IWI_EEPROM_CTL(sc, 0);
1168 
1169 	/* Clear Chip Select and clock C */
1170 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1171 	IWI_EEPROM_CTL(sc, 0);
1172 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
1173 
1174 	return val;
1175 }
1176 
1177 /*
1178  * XXX: Hack to set the current channel to the value advertised in beacons or
1179  * probe responses. Only used during AP detection.
1180  */
1181 static void
1182 iwi_fix_channel(struct ieee80211com *ic, struct mbuf *m)
1183 {
1184 	struct ieee80211_frame *wh;
1185 	uint8_t subtype;
1186 	uint8_t *frm, *efrm;
1187 
1188 	wh = mtod(m, struct ieee80211_frame *);
1189 
1190 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
1191 		return;
1192 
1193 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1194 
1195 	if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
1196 	    subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1197 		return;
1198 
1199 	frm = (uint8_t *)(wh + 1);
1200 	efrm = mtod(m, uint8_t *) + m->m_len;
1201 
1202 	frm += 12;	/* skip tstamp, bintval and capinfo fields */
1203 	while (frm < efrm) {
1204 		if (*frm == IEEE80211_ELEMID_DSPARMS)
1205 #if IEEE80211_CHAN_MAX < 255
1206 		if (frm[2] <= IEEE80211_CHAN_MAX)
1207 #endif
1208 			ic->ic_curchan = &ic->ic_channels[frm[2]];
1209 
1210 		frm += frm[1] + 2;
1211 	}
1212 }
1213 
1214 static struct mbuf *
1215 iwi_alloc_rx_buf(struct iwi_softc *sc)
1216 {
1217 	struct mbuf *m;
1218 
1219 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1220 	if (m == NULL) {
1221 		aprint_error("%s: could not allocate rx mbuf\n",
1222 		    sc->sc_dev.dv_xname);
1223 		return NULL;
1224 	}
1225 
1226 	MCLGET(m, M_DONTWAIT);
1227 	if (!(m->m_flags & M_EXT)) {
1228 		aprint_error("%s: could not allocate rx mbuf cluster\n",
1229 		    sc->sc_dev.dv_xname);
1230 		m_freem(m);
1231 		return NULL;
1232 	}
1233 
1234 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1235 	return m;
1236 }
1237 
1238 static void
1239 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_data *data, int i,
1240     struct iwi_frame *frame)
1241 {
1242 	struct ieee80211com *ic = &sc->sc_ic;
1243 	struct ifnet *ifp = ic->ic_ifp;
1244 	struct mbuf *m, *m_new;
1245 	struct ieee80211_frame *wh;
1246 	struct ieee80211_node *ni;
1247 	int error;
1248 
1249 	DPRINTFN(5, ("received frame len=%u chan=%u rssi=%u\n",
1250 	    le16toh(frame->len), frame->chan, frame->rssi_dbm));
1251 
1252 	if (le16toh(frame->len) < sizeof (struct ieee80211_frame) ||
1253 	    le16toh(frame->len) > MCLBYTES) {
1254 		DPRINTF(("%s: bad frame length\n", sc->sc_dev.dv_xname));
1255 		ifp->if_ierrors++;
1256 		return;
1257 	}
1258 
1259 	/*
1260 	 * Try to allocate a new mbuf for this ring element and
1261 	 * load it before processing the current mbuf. If the ring
1262 	 * element cannot be reloaded, drop the received packet
1263 	 * and reuse the old mbuf. In the unlikely case that
1264 	 * the old mbuf can't be reloaded either, explicitly panic.
1265 	 *
1266 	 * XXX Reorganize buffer by moving elements from the logical
1267 	 * end of the ring to the front instead of dropping.
1268 	 */
1269 	if ((m_new = iwi_alloc_rx_buf(sc)) == NULL) {
1270 		ifp->if_ierrors++;
1271 		return;
1272 	}
1273 
1274 	bus_dmamap_unload(sc->sc_dmat, data->map);
1275 
1276 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m_new,
1277 	    BUS_DMA_READ | BUS_DMA_NOWAIT);
1278 	if (error != 0) {
1279 		aprint_error("%s: could not load rx buf DMA map\n",
1280 		    sc->sc_dev.dv_xname);
1281 		m_freem(m_new);
1282 		ifp->if_ierrors++;
1283 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map,
1284 		    data->m, BUS_DMA_READ | BUS_DMA_NOWAIT);
1285 		if (error)
1286 			panic("%s: unable to remap rx buf",
1287 			    sc->sc_dev.dv_xname);
1288 		return;
1289 	}
1290 
1291 	/*
1292 	 * New mbuf successfully loaded, update RX ring and continue
1293 	 * processing.
1294 	 */
1295 	m = data->m;
1296 	data->m = m_new;
1297 	CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4, data->map->dm_segs[0].ds_addr);
1298 
1299 	/* Finalize mbuf */
1300 	m->m_pkthdr.rcvif = ifp;
1301 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
1302 	    sizeof (struct iwi_frame) + le16toh(frame->len);
1303 
1304 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
1305 
1306 	if (ic->ic_state == IEEE80211_S_SCAN)
1307 		iwi_fix_channel(ic, m);
1308 
1309 #if NBPFILTER > 0
1310 	if (sc->sc_drvbpf != NULL) {
1311 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
1312 
1313 		tap->wr_flags = 0;
1314 		tap->wr_rate = frame->rate;
1315 		tap->wr_chan_freq =
1316 		    htole16(ic->ic_channels[frame->chan].ic_freq);
1317 		tap->wr_chan_flags =
1318 		    htole16(ic->ic_channels[frame->chan].ic_flags);
1319 		tap->wr_antsignal = frame->signal;
1320 		tap->wr_antenna = frame->antenna;
1321 
1322 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
1323 	}
1324 #endif
1325 
1326 	wh = mtod(m, struct ieee80211_frame *);
1327 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
1328 
1329 	/* Send the frame to the upper layer */
1330 	ieee80211_input(ic, m, ni, frame->rssi_dbm, 0);
1331 
1332 	/* node is no longer needed */
1333 	ieee80211_free_node(ni);
1334 }
1335 
1336 static void
1337 iwi_notification_intr(struct iwi_softc *sc, struct iwi_notif *notif)
1338 {
1339 	struct ieee80211com *ic = &sc->sc_ic;
1340 	struct iwi_notif_scan_channel *chan;
1341 	struct iwi_notif_scan_complete *scan;
1342 	struct iwi_notif_authentication *auth;
1343 	struct iwi_notif_association *assoc;
1344 
1345 	switch (notif->type) {
1346 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
1347 		chan = (struct iwi_notif_scan_channel *)(notif + 1);
1348 
1349 		DPRINTFN(2, ("Finished scanning channel (%u)\n", chan->nchan));
1350 		break;
1351 
1352 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
1353 		scan = (struct iwi_notif_scan_complete *)(notif + 1);
1354 
1355 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
1356 		    scan->status));
1357 
1358 		/* monitor mode uses scan to set the channel ... */
1359 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1360 			sc->flags &= ~IWI_FLAG_SCANNING;
1361 			ieee80211_end_scan(ic);
1362 		} else
1363 			iwi_set_chan(sc, ic->ic_ibss_chan);
1364 		break;
1365 
1366 	case IWI_NOTIF_TYPE_AUTHENTICATION:
1367 		auth = (struct iwi_notif_authentication *)(notif + 1);
1368 
1369 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1370 
1371 		switch (auth->state) {
1372 		case IWI_AUTHENTICATED:
1373 			ieee80211_node_authorize(ic->ic_bss);
1374 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1375 			break;
1376 
1377 		case IWI_DEAUTHENTICATED:
1378 			break;
1379 
1380 		default:
1381 			aprint_error("%s: unknown authentication state %u\n",
1382 			    sc->sc_dev.dv_xname, auth->state);
1383 		}
1384 		break;
1385 
1386 	case IWI_NOTIF_TYPE_ASSOCIATION:
1387 		assoc = (struct iwi_notif_association *)(notif + 1);
1388 
1389 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1390 		    assoc->status));
1391 
1392 		switch (assoc->state) {
1393 		case IWI_AUTHENTICATED:
1394 			/* re-association, do nothing */
1395 			break;
1396 
1397 		case IWI_ASSOCIATED:
1398 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1399 			break;
1400 
1401 		case IWI_DEASSOCIATED:
1402 			ieee80211_begin_scan(ic, 1);
1403 			break;
1404 
1405 		default:
1406 			aprint_error("%s: unknown association state %u\n",
1407 			    sc->sc_dev.dv_xname, assoc->state);
1408 		}
1409 		break;
1410 
1411 	case IWI_NOTIF_TYPE_CALIBRATION:
1412 	case IWI_NOTIF_TYPE_BEACON:
1413 	case IWI_NOTIF_TYPE_NOISE:
1414 		DPRINTFN(5, ("Notification (%u)\n", notif->type));
1415 		break;
1416 
1417 	default:
1418 		aprint_error("%s: unknown notification type %u\n",
1419 		    sc->sc_dev.dv_xname, notif->type);
1420 	}
1421 }
1422 
1423 static void
1424 iwi_cmd_intr(struct iwi_softc *sc)
1425 {
1426 	uint32_t hw;
1427 
1428 	hw = CSR_READ_4(sc, IWI_CSR_CMD_RIDX);
1429 
1430 	for (; sc->cmdq.next != hw;) {
1431 		bus_dmamap_sync(sc->sc_dmat, sc->cmdq.desc_map,
1432 		    sc->cmdq.next * IWI_CMD_DESC_SIZE, IWI_CMD_DESC_SIZE,
1433 		    BUS_DMASYNC_POSTWRITE);
1434 
1435 		wakeup(&sc->cmdq.desc[sc->cmdq.next]);
1436 		sc->cmdq.next = (sc->cmdq.next + 1) % sc->cmdq.count;
1437 	}
1438 }
1439 
1440 static void
1441 iwi_rx_intr(struct iwi_softc *sc)
1442 {
1443 	struct iwi_rx_data *data;
1444 	struct iwi_hdr *hdr;
1445 	uint32_t hw;
1446 
1447 	hw = CSR_READ_4(sc, IWI_CSR_RX_RIDX);
1448 
1449 	for (; sc->rxq.cur != hw;) {
1450 		data = &sc->rxq.data[sc->rxq.cur];
1451 
1452 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1453 		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1454 
1455 		hdr = mtod(data->m, struct iwi_hdr *);
1456 
1457 		switch (hdr->type) {
1458 		case IWI_HDR_TYPE_FRAME:
1459 			iwi_frame_intr(sc, data, sc->rxq.cur,
1460 			    (struct iwi_frame *)(hdr + 1));
1461 			break;
1462 
1463 		case IWI_HDR_TYPE_NOTIF:
1464 			iwi_notification_intr(sc,
1465 			    (struct iwi_notif *)(hdr + 1));
1466 			break;
1467 
1468 		default:
1469 			aprint_error("%s: unknown hdr type %u\n",
1470 			    sc->sc_dev.dv_xname, hdr->type);
1471 		}
1472 
1473 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1474 		    data->map->dm_mapsize, BUS_DMASYNC_PREREAD);
1475 
1476 		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1477 
1478 		sc->rxq.cur = (sc->rxq.cur + 1) % sc->rxq.count;
1479 	}
1480 
1481 
1482 	/* Tell the firmware what we have processed */
1483 	hw = (hw == 0) ? sc->rxq.count - 1 : hw - 1;
1484 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, hw);
1485 }
1486 
1487 static void
1488 iwi_tx_intr(struct iwi_softc *sc, struct iwi_tx_ring *txq)
1489 {
1490 	struct ifnet *ifp = &sc->sc_if;
1491 	struct iwi_tx_data *data;
1492 	uint32_t hw;
1493 
1494 	hw = CSR_READ_4(sc, txq->csr_ridx);
1495 
1496 	for (; txq->next != hw;) {
1497 		data = &txq->data[txq->next];
1498 
1499 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1500 		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1501 		bus_dmamap_unload(sc->sc_dmat, data->map);
1502 		m_freem(data->m);
1503 		data->m = NULL;
1504 		ieee80211_free_node(data->ni);
1505 		data->ni = NULL;
1506 
1507 		DPRINTFN(15, ("tx done idx=%u\n", txq->next));
1508 
1509 		ifp->if_opackets++;
1510 
1511 		txq->queued--;
1512 		txq->next = (txq->next + 1) % txq->count;
1513 	}
1514 
1515 	sc->sc_tx_timer = 0;
1516 	ifp->if_flags &= ~IFF_OACTIVE;
1517 
1518 	/* Call start() since some buffer descriptors have been released */
1519 	(*ifp->if_start)(ifp);
1520 }
1521 
1522 static int
1523 iwi_intr(void *arg)
1524 {
1525 	struct iwi_softc *sc = arg;
1526 	uint32_t r;
1527 
1528 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff)
1529 		return 0;
1530 
1531 	/* Acknowledge interrupts */
1532 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1533 
1534 	if (r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)) {
1535 		aprint_error("%s: fatal error\n", sc->sc_dev.dv_xname);
1536 		if (r & IWI_INTR_FATAL_ERROR)
1537 			iwi_error_log(sc);
1538 		sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1539 		iwi_stop(&sc->sc_if, 1);
1540 		return (1);
1541 	}
1542 
1543 	if (r & IWI_INTR_FW_INITED) {
1544 		if (!(r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)))
1545 			wakeup(sc);
1546 	}
1547 
1548 	if (r & IWI_INTR_RADIO_OFF) {
1549 		DPRINTF(("radio transmitter off\n"));
1550 		sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1551 		iwi_stop(&sc->sc_if, 1);
1552 		return (1);
1553 	}
1554 
1555 	if (r & IWI_INTR_CMD_DONE)
1556 		iwi_cmd_intr(sc);
1557 
1558 	if (r & IWI_INTR_TX1_DONE)
1559 		iwi_tx_intr(sc, &sc->txq[0]);
1560 
1561 	if (r & IWI_INTR_TX2_DONE)
1562 		iwi_tx_intr(sc, &sc->txq[1]);
1563 
1564 	if (r & IWI_INTR_TX3_DONE)
1565 		iwi_tx_intr(sc, &sc->txq[2]);
1566 
1567 	if (r & IWI_INTR_TX4_DONE)
1568 		iwi_tx_intr(sc, &sc->txq[3]);
1569 
1570 	if (r & IWI_INTR_RX_DONE)
1571 		iwi_rx_intr(sc);
1572 
1573 	return 1;
1574 }
1575 
1576 static int
1577 iwi_cmd(struct iwi_softc *sc, uint8_t type, void *data, uint8_t len,
1578     int async)
1579 {
1580 	struct iwi_cmd_desc *desc;
1581 
1582 	desc = &sc->cmdq.desc[sc->cmdq.cur];
1583 
1584 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1585 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1586 	desc->type = type;
1587 	desc->len = len;
1588 	memcpy(desc->data, data, len);
1589 
1590 	bus_dmamap_sync(sc->sc_dmat, sc->cmdq.desc_map,
1591 	    sc->cmdq.cur * IWI_CMD_DESC_SIZE,
1592 	    IWI_CMD_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1593 
1594 	DPRINTFN(2, ("sending command idx=%u type=%u len=%u\n", sc->cmdq.cur,
1595 	    type, len));
1596 
1597 	sc->cmdq.cur = (sc->cmdq.cur + 1) % sc->cmdq.count;
1598 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
1599 
1600 	return async ? 0 : tsleep(desc, 0, "iwicmd", hz);
1601 }
1602 
1603 static void
1604 iwi_write_ibssnode(struct iwi_softc *sc, const struct iwi_node *in)
1605 {
1606 	struct iwi_ibssnode node;
1607 
1608 	/* write node information into NIC memory */
1609 	memset(&node, 0, sizeof node);
1610 	IEEE80211_ADDR_COPY(node.bssid, in->in_node.ni_macaddr);
1611 
1612 	CSR_WRITE_REGION_1(sc,
1613 	    IWI_CSR_NODE_BASE + in->in_station * sizeof node,
1614 	    (uint8_t *)&node, sizeof node);
1615 }
1616 
1617 static int
1618 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni,
1619     int ac)
1620 {
1621 	struct iwi_softc *sc = ifp->if_softc;
1622 	struct ieee80211com *ic = &sc->sc_ic;
1623 	struct iwi_node *in = (struct iwi_node *)ni;
1624 	struct ieee80211_frame *wh;
1625 	struct ieee80211_key *k;
1626 	const struct chanAccParams *cap;
1627 	struct iwi_tx_ring *txq = &sc->txq[ac];
1628 	struct iwi_tx_data *data;
1629 	struct iwi_tx_desc *desc;
1630 	struct mbuf *mnew;
1631 	int error, hdrlen, i, noack = 0;
1632 
1633 	wh = mtod(m0, struct ieee80211_frame *);
1634 
1635 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1636 		hdrlen = sizeof (struct ieee80211_qosframe);
1637 		cap = &ic->ic_wme.wme_chanParams;
1638 		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1639 	} else
1640 		hdrlen = sizeof (struct ieee80211_frame);
1641 
1642 	/*
1643 	 * This is only used in IBSS mode where the firmware expect an index
1644 	 * in a h/w table instead of a destination address.
1645 	 */
1646 	if (ic->ic_opmode == IEEE80211_M_IBSS && in->in_station == -1) {
1647 		in->in_station = iwi_alloc_unr(sc);
1648 
1649 		if (in->in_station == -1) {	/* h/w table is full */
1650 			m_freem(m0);
1651 			ieee80211_free_node(ni);
1652 			ifp->if_oerrors++;
1653 			return 0;
1654 		}
1655 		iwi_write_ibssnode(sc, in);
1656 	}
1657 
1658 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1659 		k = ieee80211_crypto_encap(ic, ni, m0);
1660 		if (k == NULL) {
1661 			m_freem(m0);
1662 			return ENOBUFS;
1663 		}
1664 
1665 		/* packet header may have moved, reset our local pointer */
1666 		wh = mtod(m0, struct ieee80211_frame *);
1667 	}
1668 
1669 #if NBPFILTER > 0
1670 	if (sc->sc_drvbpf != NULL) {
1671 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1672 
1673 		tap->wt_flags = 0;
1674 		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1675 		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1676 
1677 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1678 	}
1679 #endif
1680 
1681 	data = &txq->data[txq->cur];
1682 	desc = &txq->desc[txq->cur];
1683 
1684 	/* save and trim IEEE802.11 header */
1685 	m_copydata(m0, 0, hdrlen, (caddr_t)&desc->wh);
1686 	m_adj(m0, hdrlen);
1687 
1688 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1689 	    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
1690 	if (error != 0 && error != EFBIG) {
1691 		aprint_error("%s: could not map mbuf (error %d)\n",
1692 		    sc->sc_dev.dv_xname, error);
1693 		m_freem(m0);
1694 		return error;
1695 	}
1696 	if (error != 0) {
1697 		/* too many fragments, linearize */
1698 
1699 		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1700 		if (mnew == NULL) {
1701 			m_freem(m0);
1702 			return ENOMEM;
1703 		}
1704 
1705 		M_COPY_PKTHDR(mnew, m0);
1706 
1707 		/* If the data won't fit in the header, get a cluster */
1708 		if (m0->m_pkthdr.len > MHLEN) {
1709 			MCLGET(mnew, M_DONTWAIT);
1710 			if (!(mnew->m_flags & M_EXT)) {
1711 				m_freem(m0);
1712 				m_freem(mnew);
1713 				return ENOMEM;
1714 			}
1715 		}
1716 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(mnew, caddr_t));
1717 		m_freem(m0);
1718 		mnew->m_len = mnew->m_pkthdr.len;
1719 		m0 = mnew;
1720 
1721 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1722 		    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
1723 		if (error != 0) {
1724 			aprint_error("%s: could not map mbuf (error %d)\n",
1725 			    sc->sc_dev.dv_xname, error);
1726 			m_freem(m0);
1727 			return error;
1728 		}
1729 	}
1730 
1731 	data->m = m0;
1732 	data->ni = ni;
1733 
1734 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1735 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1736 	desc->station =
1737 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? in->in_station : 0;
1738 	desc->cmd = IWI_DATA_CMD_TX;
1739 	desc->len = htole16(m0->m_pkthdr.len);
1740 	desc->flags = 0;
1741 	desc->xflags = 0;
1742 
1743 	if (!noack && !IEEE80211_IS_MULTICAST(desc->wh.i_addr1))
1744 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1745 
1746 #if 0
1747 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
1748 		desc->wh.i_fc[1] |= IEEE80211_FC1_WEP;
1749 		desc->wep_txkey = ic->ic_crypto.cs_def_txkey;
1750 	} else
1751 #endif
1752 		desc->flags |= IWI_DATA_FLAG_NO_WEP;
1753 
1754 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1755 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1756 
1757 	if (desc->wh.i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS)
1758 		desc->xflags |= IWI_DATA_XFLAG_QOS;
1759 
1760 	desc->nseg = htole32(data->map->dm_nsegs);
1761 	for (i = 0; i < data->map->dm_nsegs; i++) {
1762 		desc->seg_addr[i] = htole32(data->map->dm_segs[i].ds_addr);
1763 		desc->seg_len[i]  = htole16(data->map->dm_segs[i].ds_len);
1764 	}
1765 
1766 	bus_dmamap_sync(sc->sc_dmat, txq->desc_map,
1767 	    txq->cur * IWI_TX_DESC_SIZE,
1768 	    IWI_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1769 
1770 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1771 	    BUS_DMASYNC_PREWRITE);
1772 
1773 	DPRINTFN(5, ("sending data frame txq=%u idx=%u len=%u nseg=%u\n",
1774 	    ac, txq->cur, le16toh(desc->len), le32toh(desc->nseg)));
1775 
1776 	/* Inform firmware about this new packet */
1777 	txq->queued++;
1778 	txq->cur = (txq->cur + 1) % txq->count;
1779 	CSR_WRITE_4(sc, txq->csr_widx, txq->cur);
1780 
1781 	return 0;
1782 }
1783 
1784 static void
1785 iwi_start(struct ifnet *ifp)
1786 {
1787 	struct iwi_softc *sc = ifp->if_softc;
1788 	struct ieee80211com *ic = &sc->sc_ic;
1789 	struct mbuf *m0;
1790 	struct ether_header *eh;
1791 	struct ieee80211_node *ni;
1792 	int ac;
1793 
1794 	if (ic->ic_state != IEEE80211_S_RUN)
1795 		return;
1796 
1797 	for (;;) {
1798 		IF_DEQUEUE(&ifp->if_snd, m0);
1799 		if (m0 == NULL)
1800 			break;
1801 
1802 		if (m0->m_len < sizeof (struct ether_header) &&
1803 		    (m0 = m_pullup(m0, sizeof (struct ether_header))) == NULL) {
1804 			ifp->if_oerrors++;
1805 			continue;
1806 		}
1807 
1808 		eh = mtod(m0, struct ether_header *);
1809 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1810 		if (ni == NULL) {
1811 			m_freem(m0);
1812 			ifp->if_oerrors++;
1813 			continue;
1814 		}
1815 
1816 		/* classify mbuf so we can find which tx ring to use */
1817 		if (ieee80211_classify(ic, m0, ni) != 0) {
1818 			m_freem(m0);
1819 			ieee80211_free_node(ni);
1820 			ifp->if_oerrors++;
1821 			continue;
1822 		}
1823 
1824 		/* no QoS encapsulation for EAPOL frames */
1825 		ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
1826 		    M_WME_GETAC(m0) : WME_AC_BE;
1827 
1828 		if (sc->txq[ac].queued > sc->txq[ac].count - 8) {
1829 			/* there is no place left in this ring */
1830 			IF_PREPEND(&ifp->if_snd, m0);
1831 			ifp->if_flags |= IFF_OACTIVE;
1832 			break;
1833 		}
1834 
1835 #if NBPFILTER > 0
1836 		if (ifp->if_bpf != NULL)
1837 			bpf_mtap(ifp->if_bpf, m0);
1838 #endif
1839 
1840 		m0 = ieee80211_encap(ic, m0, ni);
1841 		if (m0 == NULL) {
1842 			ieee80211_free_node(ni);
1843 			ifp->if_oerrors++;
1844 			continue;
1845 		}
1846 
1847 #if NBPFILTER > 0
1848 		if (ic->ic_rawbpf != NULL)
1849 			bpf_mtap(ic->ic_rawbpf, m0);
1850 #endif
1851 
1852 		if (iwi_tx_start(ifp, m0, ni, ac) != 0) {
1853 			ieee80211_free_node(ni);
1854 			ifp->if_oerrors++;
1855 			break;
1856 		}
1857 
1858 		/* start watchdog timer */
1859 		sc->sc_tx_timer = 5;
1860 		ifp->if_timer = 1;
1861 	}
1862 }
1863 
1864 static void
1865 iwi_watchdog(struct ifnet *ifp)
1866 {
1867 	struct iwi_softc *sc = ifp->if_softc;
1868 
1869 	ifp->if_timer = 0;
1870 
1871 	if (sc->sc_tx_timer > 0) {
1872 		if (--sc->sc_tx_timer == 0) {
1873 			aprint_error("%s: device timeout\n",
1874 			    sc->sc_dev.dv_xname);
1875 			ifp->if_oerrors++;
1876 			ifp->if_flags &= ~IFF_UP;
1877 			iwi_stop(ifp, 1);
1878 			return;
1879 		}
1880 		ifp->if_timer = 1;
1881 	}
1882 
1883 	ieee80211_watchdog(&sc->sc_ic);
1884 }
1885 
1886 static int
1887 iwi_get_table0(struct iwi_softc *sc, uint32_t *tbl)
1888 {
1889 	uint32_t size, buf[128];
1890 
1891 	if (!(sc->flags & IWI_FLAG_FW_INITED)) {
1892 		memset(buf, 0, sizeof buf);
1893 		return copyout(buf, tbl, sizeof buf);
1894 	}
1895 
1896 	size = min(CSR_READ_4(sc, IWI_CSR_TABLE0_SIZE), 128 - 1);
1897 	CSR_READ_REGION_4(sc, IWI_CSR_TABLE0_BASE, &buf[1], size);
1898 
1899 	return copyout(buf, tbl, sizeof buf);
1900 }
1901 
1902 static int
1903 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1904 {
1905 #define	IS_RUNNING(ifp) \
1906 	((ifp->if_flags & IFF_UP) && (ifp->if_flags & IFF_RUNNING))
1907 
1908 	struct iwi_softc *sc = ifp->if_softc;
1909 	struct ieee80211com *ic = &sc->sc_ic;
1910 	struct ifreq *ifr = (struct ifreq *)data;
1911 	int s, error = 0;
1912 	int val;
1913 
1914 	s = splnet();
1915 
1916 	switch (cmd) {
1917 	case SIOCSIFFLAGS:
1918 		if (ifp->if_flags & IFF_UP) {
1919 			if (!(ifp->if_flags & IFF_RUNNING))
1920 				iwi_init(ifp);
1921 		} else {
1922 			if (ifp->if_flags & IFF_RUNNING)
1923 				iwi_stop(ifp, 1);
1924 		}
1925 		break;
1926 
1927 	case SIOCADDMULTI:
1928 	case SIOCDELMULTI:
1929 		error = (cmd == SIOCADDMULTI) ?
1930 		    ether_addmulti(ifr, &sc->sc_ec) :
1931 		    ether_delmulti(ifr, &sc->sc_ec);
1932 		if (error == ENETRESET) {
1933 			/* setup multicast filter, etc */
1934 			error = 0;
1935 		}
1936 		break;
1937 
1938 	case SIOCGTABLE0:
1939 		error = iwi_get_table0(sc, (uint32_t *)ifr->ifr_data);
1940 		break;
1941 
1942 	case SIOCGRADIO:
1943 		val = !iwi_getrfkill(sc);
1944 		error = copyout(&val, (int *)ifr->ifr_data, sizeof val);
1945 		break;
1946 
1947 	case SIOCSIFMEDIA:
1948 		if (ifr->ifr_media & IFM_IEEE80211_ADHOC) {
1949 			sc->sc_fwname = "iwi-ibss.fw";
1950 			sc->sc_ucname = "iwi-ucode-ibss.fw";
1951 		} else if (ifr->ifr_media & IFM_IEEE80211_MONITOR) {
1952 			sc->sc_fwname = "iwi-sniffer.fw";
1953 			sc->sc_ucname = "iwi-ucode-sniffer.fw";
1954 		} else {
1955 			sc->sc_fwname = "iwi-bss.fw";
1956 			sc->sc_ucname = "iwi-ucode-bss.fw";
1957 		}
1958 		error = iwi_cache_firmware(sc);
1959 		if (error)
1960  			break;
1961  		/* FALLTRHOUGH */
1962 
1963 	default:
1964 		error = ieee80211_ioctl(&sc->sc_ic, cmd, data);
1965 
1966 		if (error == ENETRESET) {
1967 			if (IS_RUNNING(ifp) &&
1968 			    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
1969 				iwi_init(ifp);
1970 			error = 0;
1971 		}
1972 	}
1973 
1974 	splx(s);
1975 	return error;
1976 #undef IS_RUNNING
1977 }
1978 
1979 static void
1980 iwi_stop_master(struct iwi_softc *sc)
1981 {
1982 	int ntries;
1983 
1984 	/* Disable interrupts */
1985 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1986 
1987 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1988 	for (ntries = 0; ntries < 5; ntries++) {
1989 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1990 			break;
1991 		DELAY(10);
1992 	}
1993 	if (ntries == 5)
1994 		aprint_error("%s: timeout waiting for master\n",
1995 		    sc->sc_dev.dv_xname);
1996 
1997 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1998 	    IWI_RST_PRINCETON_RESET);
1999 
2000 	sc->flags &= ~IWI_FLAG_FW_INITED;
2001 }
2002 
2003 static int
2004 iwi_reset(struct iwi_softc *sc)
2005 {
2006 	int i, ntries;
2007 
2008 	iwi_stop_master(sc);
2009 
2010 	/* Move adapter to D0 state */
2011 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
2012 	    IWI_CTL_INIT);
2013 
2014 	/* Initialize Phase-Locked Level  (PLL) */
2015 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
2016 
2017 	/* Wait for clock stabilization */
2018 	for (ntries = 0; ntries < 1000; ntries++) {
2019 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
2020 			break;
2021 		DELAY(200);
2022 	}
2023 	if (ntries == 1000) {
2024 		aprint_error("%s: timeout waiting for clock stabilization\n",
2025 		    sc->sc_dev.dv_xname);
2026 		return EIO;
2027 	}
2028 
2029 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
2030 	    IWI_RST_SW_RESET);
2031 
2032 	DELAY(10);
2033 
2034 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
2035 	    IWI_CTL_INIT);
2036 
2037 	/* Clear NIC memory */
2038 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
2039 	for (i = 0; i < 0xc000; i++)
2040 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2041 
2042 	return 0;
2043 }
2044 
2045 static int
2046 iwi_load_ucode(struct iwi_softc *sc, void *uc, int size)
2047 {
2048 	uint16_t *w;
2049 	int ntries, i;
2050 
2051 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
2052 	    IWI_RST_STOP_MASTER);
2053 	for (ntries = 0; ntries < 5; ntries++) {
2054 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
2055 			break;
2056 		DELAY(10);
2057 	}
2058 	if (ntries == 5) {
2059 		aprint_error("%s: timeout waiting for master\n",
2060 		    sc->sc_dev.dv_xname);
2061 		return EIO;
2062 	}
2063 
2064 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
2065 	DELAY(5000);
2066 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2067 	    ~IWI_RST_PRINCETON_RESET);
2068 	DELAY(5000);
2069 	MEM_WRITE_4(sc, 0x3000e0, 0);
2070 	DELAY(1000);
2071 	MEM_WRITE_4(sc, 0x300004, 1);
2072 	DELAY(1000);
2073 	MEM_WRITE_4(sc, 0x300004, 0);
2074 	DELAY(1000);
2075 	MEM_WRITE_1(sc, 0x200000, 0x00);
2076 	MEM_WRITE_1(sc, 0x200000, 0x40);
2077 	DELAY(1000);
2078 
2079 	/* Adapter is buggy, we must set the address for each word */
2080 	for (w = uc; size > 0; w++, size -= 2)
2081 		MEM_WRITE_2(sc, 0x200010, htole16(*w));
2082 
2083 	MEM_WRITE_1(sc, 0x200000, 0x00);
2084 	MEM_WRITE_1(sc, 0x200000, 0x80);
2085 
2086 	/* Wait until we get a response in the uc queue */
2087 	for (ntries = 0; ntries < 100; ntries++) {
2088 		if (MEM_READ_1(sc, 0x200000) & 1)
2089 			break;
2090 		DELAY(100);
2091 	}
2092 	if (ntries == 100) {
2093 		aprint_error("%s: timeout waiting for ucode to initialize\n",
2094 		    sc->sc_dev.dv_xname);
2095 		return EIO;
2096 	}
2097 
2098 	/* Empty the uc queue or the firmware will not initialize properly */
2099 	for (i = 0; i < 7; i++)
2100 		MEM_READ_4(sc, 0x200004);
2101 
2102 	MEM_WRITE_1(sc, 0x200000, 0x00);
2103 
2104 	return 0;
2105 }
2106 
2107 /* macro to handle unaligned little endian data in firmware image */
2108 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
2109 static int
2110 iwi_load_firmware(struct iwi_softc *sc, void *fw, int size)
2111 {
2112 	bus_dmamap_t map;
2113 	u_char *p, *end;
2114 	uint32_t sentinel, ctl, sum;
2115 	uint32_t cs, sl, cd, cl;
2116 	int ntries, nsegs, error;
2117 	int sn;
2118 
2119 	nsegs = (size + PAGE_SIZE - 1) / PAGE_SIZE;
2120 
2121 	/* Create a DMA map for the firmware image */
2122 	error = bus_dmamap_create(sc->sc_dmat, size, nsegs, size, 0,
2123 	    BUS_DMA_NOWAIT, &map);
2124 	if (error != 0) {
2125 		aprint_error("%s: could not create firmware DMA map\n",
2126 		    sc->sc_dev.dv_xname);
2127 		goto fail1;
2128 	}
2129 
2130 	error = bus_dmamap_load(sc->sc_dmat, map, fw, size, NULL,
2131 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2132 	if (error != 0) {
2133 		aprint_error("%s: could not load fw dma map(%d)\n",
2134 		    sc->sc_dev.dv_xname, error);
2135 		goto fail2;
2136 	}
2137 
2138 	/* Make sure the adapter will get up-to-date values */
2139 	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_PREWRITE);
2140 
2141 	/* Tell the adapter where the command blocks are stored */
2142 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
2143 
2144 	/*
2145 	 * Store command blocks into adapter's internal memory using register
2146 	 * indirections. The adapter will read the firmware image through DMA
2147 	 * using information stored in command blocks.
2148 	 */
2149 	p = fw;
2150 	end = p + size;
2151 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
2152 
2153 	sn = 0;
2154 	sl = cl = 0;
2155 	cs = cd = 0;
2156 	while (p < end) {
2157 		if (sl == 0) {
2158 			cs = map->dm_segs[sn].ds_addr;
2159 			sl = map->dm_segs[sn].ds_len;
2160 			sn++;
2161 		}
2162 		if (cl == 0) {
2163 			cd = GETLE32(p); p += 4; cs += 4; sl -= 4;
2164 			cl = GETLE32(p); p += 4; cs += 4; sl -= 4;
2165 		}
2166 		while (sl > 0 && cl > 0) {
2167 			int len = min(cl, sl);
2168 
2169 			sl -= len;
2170 			cl -= len;
2171 			p += len;
2172 
2173 			while (len > 0) {
2174 				int mlen = min(len, IWI_CB_MAXDATALEN);
2175 
2176 				ctl = IWI_CB_DEFAULT_CTL | mlen;
2177 				sum = ctl ^ cs ^ cd;
2178 
2179 				/* Write a command block */
2180 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
2181 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, cs);
2182 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, cd);
2183 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
2184 
2185 				cs += mlen;
2186 				cd += mlen;
2187 				len -= mlen;
2188 			}
2189 		}
2190 	}
2191 
2192 	/* Write a fictive final command block (sentinel) */
2193 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
2194 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2195 
2196 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2197 	    ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER));
2198 
2199 	/* Tell the adapter to start processing command blocks */
2200 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
2201 
2202 	/* Wait until the adapter has processed all command blocks */
2203 	for (ntries = 0; ntries < 400; ntries++) {
2204 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
2205 			break;
2206 		DELAY(100);
2207 	}
2208 	if (ntries == 400) {
2209 		aprint_error("%s: timeout processing cb\n",
2210 		    sc->sc_dev.dv_xname);
2211 		error = EIO;
2212 		goto fail3;
2213 	}
2214 
2215 	/* We're done with command blocks processing */
2216 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
2217 
2218 	/* Allow interrupts so we know when the firmware is inited */
2219 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
2220 
2221 	/* Tell the adapter to initialize the firmware */
2222 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
2223 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
2224 	    IWI_CTL_ALLOW_STANDBY);
2225 
2226 	/* Wait at most one second for firmware initialization to complete */
2227 	if ((error = tsleep(sc, 0, "iwiinit", hz)) != 0) {
2228 		aprint_error("%s: timeout waiting for firmware initialization "
2229 		    "to complete\n", sc->sc_dev.dv_xname);
2230 		goto fail3;
2231 	}
2232 
2233 fail3:
2234 	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_POSTWRITE);
2235 	bus_dmamap_unload(sc->sc_dmat, map);
2236 fail2:
2237 	bus_dmamap_destroy(sc->sc_dmat, map);
2238 
2239 fail1:
2240 	return error;
2241 }
2242 
2243 /*
2244  * Store firmware into kernel memory so we can download it when we need to,
2245  * e.g when the adapter wakes up from suspend mode.
2246  */
2247 static int
2248 iwi_cache_firmware(struct iwi_softc *sc)
2249 {
2250 	struct iwi_firmware *kfw = &sc->fw;
2251 	firmware_handle_t fwh;
2252 	int error;
2253 
2254 	iwi_free_firmware(sc);
2255 	error = firmware_open("if_iwi", "iwi-boot.fw", &fwh);
2256 	if (error != 0)
2257 		goto fail1;
2258 
2259 	kfw->boot_size = firmware_get_size(fwh);
2260 	kfw->boot = firmware_malloc(kfw->boot_size);
2261 	if (kfw->boot == NULL) {
2262 		error = ENOMEM;
2263 		firmware_close(fwh);
2264 		goto fail1;
2265 	}
2266 
2267 	error = firmware_read(fwh, sizeof(struct iwi_firmware_hdr),
2268 	    kfw->boot, kfw->boot_size - sizeof(struct iwi_firmware_hdr));
2269 	firmware_close(fwh);
2270 	if (error != 0)
2271 		goto fail2;
2272 
2273 	error = firmware_open("if_iwi", sc->sc_ucname, &fwh);
2274 	if (error != 0)
2275 		goto fail2;
2276 
2277 	kfw->ucode_size = firmware_get_size(fwh);
2278 	kfw->ucode = firmware_malloc(kfw->ucode_size);
2279 	if (kfw->ucode == NULL) {
2280 		error = ENOMEM;
2281 		firmware_close(fwh);
2282 		goto fail2;
2283 	}
2284 
2285 	error = firmware_read(fwh, sizeof(struct iwi_firmware_hdr),
2286 	    kfw->ucode, kfw->ucode_size - sizeof(struct iwi_firmware_hdr));
2287 	firmware_close(fwh);
2288 	if (error != 0)
2289 		goto fail3;
2290 
2291 	error = firmware_open("if_iwi", sc->sc_fwname, &fwh);
2292 	if (error != 0)
2293 		goto fail3;
2294 
2295 	kfw->main_size = firmware_get_size(fwh);
2296 	kfw->main = firmware_malloc(kfw->main_size);
2297 	if (kfw->main == NULL) {
2298 		error = ENOMEM;
2299 		goto fail3;
2300 	}
2301 
2302 	error = firmware_read(fwh, sizeof(struct iwi_firmware_hdr),
2303 	     kfw->main, kfw->main_size - sizeof(struct iwi_firmware_hdr));
2304 	firmware_close(fwh);
2305 	if (error != 0)
2306 		goto fail4;
2307 
2308 	DPRINTF(("Firmware cached: boot %u, ucode %u, main %u\n",
2309 	    kfw->boot_size, kfw->ucode_size, kfw->main_size));
2310 
2311 	sc->flags |= IWI_FLAG_FW_CACHED;
2312 
2313 	return 0;
2314 
2315 fail4:	firmware_free(kfw->main, 0);
2316 fail3:	firmware_free(kfw->ucode, 0);
2317 fail2:	firmware_free(kfw->boot, 0);
2318 fail1:
2319 	return error;
2320 }
2321 
2322 static void
2323 iwi_free_firmware(struct iwi_softc *sc)
2324 {
2325 	struct iwi_firmware *kfw = &sc->fw;
2326 
2327 	if (!(sc->flags & IWI_FLAG_FW_CACHED))
2328 		return;
2329 
2330 	firmware_free(kfw->main, 0);
2331 	firmware_free(kfw->ucode, 0);
2332 	firmware_free(kfw->boot, 0);
2333 
2334 	sc->flags &= ~IWI_FLAG_FW_CACHED;
2335 }
2336 
2337 static int
2338 iwi_config(struct iwi_softc *sc)
2339 {
2340 	struct ieee80211com *ic = &sc->sc_ic;
2341 	struct ifnet *ifp = &sc->sc_if;
2342 	struct iwi_configuration config;
2343 	struct iwi_rateset rs;
2344 	struct iwi_txpower power;
2345 	struct ieee80211_key *wk;
2346 	struct iwi_wep_key wepkey;
2347 	uint32_t data;
2348 	int error, i;
2349 
2350 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2351 	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
2352 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
2353 	    IEEE80211_ADDR_LEN, 0);
2354 	if (error != 0)
2355 		return error;
2356 
2357 	memset(&config, 0, sizeof config);
2358 	config.bluetooth_coexistence = sc->bluetooth;
2359 	config.antenna = sc->antenna;
2360 	config.multicast_enabled = 1;
2361 	config.answer_pbreq = (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2362 	config.disable_unicast_decryption = 1;
2363 	config.disable_multicast_decryption = 1;
2364 	DPRINTF(("Configuring adapter\n"));
2365 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIGURATION, &config, sizeof config,
2366 	    0);
2367 	if (error != 0)
2368 		return error;
2369 
2370 	data = htole32(IWI_POWER_MODE_CAM);
2371 	DPRINTF(("Setting power mode to %u\n", le32toh(data)));
2372 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
2373 	if (error != 0)
2374 		return error;
2375 
2376 	data = htole32(ic->ic_rtsthreshold);
2377 	DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
2378 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
2379 	if (error != 0)
2380 		return error;
2381 
2382 	data = htole32(ic->ic_fragthreshold);
2383 	DPRINTF(("Setting fragmentation threshold to %u\n", le32toh(data)));
2384 	error = iwi_cmd(sc, IWI_CMD_SET_FRAG_THRESHOLD, &data, sizeof data, 0);
2385 	if (error != 0)
2386 		return error;
2387 
2388 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
2389 		power.mode = IWI_MODE_11B;
2390 		power.nchan = 11;
2391 		for (i = 0; i < 11; i++) {
2392 			power.chan[i].chan = i + 1;
2393 			power.chan[i].power = IWI_TXPOWER_MAX;
2394 		}
2395 		DPRINTF(("Setting .11b channels tx power\n"));
2396 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2397 		    0);
2398 		if (error != 0)
2399 			return error;
2400 
2401 		power.mode = IWI_MODE_11G;
2402 		DPRINTF(("Setting .11g channels tx power\n"));
2403 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2404 		    0);
2405 		if (error != 0)
2406 			return error;
2407 	}
2408 
2409 	rs.mode = IWI_MODE_11G;
2410 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2411 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
2412 	memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates,
2413 	    rs.nrates);
2414 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
2415 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2416 	if (error != 0)
2417 		return error;
2418 
2419 	rs.mode = IWI_MODE_11A;
2420 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2421 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
2422 	memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates,
2423 	    rs.nrates);
2424 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
2425 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2426 	if (error != 0)
2427 		return error;
2428 
2429 	/* if we have a desired ESSID, set it now */
2430 	if (ic->ic_des_esslen != 0) {
2431 #ifdef IWI_DEBUG
2432 		if (iwi_debug > 0) {
2433 			printf("Setting desired ESSID to ");
2434 			ieee80211_print_essid(ic->ic_des_essid,
2435 			    ic->ic_des_esslen);
2436 			printf("\n");
2437 		}
2438 #endif
2439 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ic->ic_des_essid,
2440 		    ic->ic_des_esslen, 0);
2441 		if (error != 0)
2442 			return error;
2443 	}
2444 
2445 	data = htole32(arc4random());
2446 	DPRINTF(("Setting initialization vector to %u\n", le32toh(data)));
2447 	error = iwi_cmd(sc, IWI_CMD_SET_IV, &data, sizeof data, 0);
2448 	if (error != 0)
2449 		return error;
2450 
2451 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2452 		wk = &ic->ic_crypto.cs_nw_keys[i];
2453 
2454 		wepkey.cmd = IWI_WEP_KEY_CMD_SETKEY;
2455 		wepkey.idx = i;
2456 		wepkey.len = wk->wk_keylen;
2457 		memset(wepkey.key, 0, sizeof wepkey.key);
2458 		memcpy(wepkey.key, wk->wk_key, wk->wk_keylen);
2459 		DPRINTF(("Setting wep key index %u len %u\n",
2460 		    wepkey.idx, wepkey.len));
2461 		error = iwi_cmd(sc, IWI_CMD_SET_WEP_KEY, &wepkey,
2462 		    sizeof wepkey, 0);
2463 		if (error != 0)
2464 			return error;
2465 	}
2466 
2467 	/* Enable adapter */
2468 	DPRINTF(("Enabling adapter\n"));
2469 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
2470 }
2471 
2472 static int
2473 iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
2474 {
2475 	struct ieee80211com *ic = &sc->sc_ic;
2476 	struct iwi_scan_v2 scan;
2477 
2478 	(void)memset(&scan, 0, sizeof scan);
2479 
2480 	scan.dwelltime[IWI_SCAN_TYPE_PASSIVE] = htole16(2000);
2481 	scan.channels[0] = 1 |
2482 	    (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
2483 	scan.channels[1] = ieee80211_chan2ieee(ic, chan);
2484 	iwi_scan_type_set(scan, 1, IWI_SCAN_TYPE_PASSIVE);
2485 
2486 	DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
2487 	return iwi_cmd(sc, IWI_CMD_SCAN_V2, &scan, sizeof scan, 1);
2488 }
2489 
2490 static int
2491 iwi_scan(struct iwi_softc *sc)
2492 {
2493 	struct ieee80211com *ic = &sc->sc_ic;
2494 	struct iwi_scan_v2 scan;
2495 	uint32_t type;
2496 	uint8_t *p;
2497 	int i, count, idx;
2498 
2499 	(void)memset(&scan, 0, sizeof scan);
2500 	scan.dwelltime[IWI_SCAN_TYPE_ACTIVE_BROADCAST] =
2501 	    htole16(sc->dwelltime);
2502 	scan.dwelltime[IWI_SCAN_TYPE_ACTIVE_BDIRECT] =
2503 	    htole16(sc->dwelltime);
2504 
2505 	/* tell the firmware about the desired essid */
2506 	if (ic->ic_des_esslen) {
2507 		int error;
2508 
2509 		DPRINTF(("%s: Setting adapter desired ESSID to %s\n",
2510 		    __func__, ic->ic_des_essid));
2511 
2512 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID,
2513 		    ic->ic_des_essid, ic->ic_des_esslen, 1);
2514 		if (error)
2515 			return error;
2516 
2517 		type = IWI_SCAN_TYPE_ACTIVE_BDIRECT;
2518 	} else {
2519 		type = IWI_SCAN_TYPE_ACTIVE_BROADCAST;
2520 	}
2521 
2522 	p = &scan.channels[0];
2523 	count = idx = 0;
2524 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2525 		if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]) &&
2526 		    isset(ic->ic_chan_active, i)) {
2527 			*++p = i;
2528 			count++;
2529 			idx++;
2530  			iwi_scan_type_set(scan, idx, type);
2531 		}
2532 	}
2533 	if (count) {
2534 		*(p - count) = IWI_CHAN_5GHZ | count;
2535 		p++;
2536 	}
2537 
2538 	count = 0;
2539 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2540 		if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]) &&
2541 		    isset(ic->ic_chan_active, i)) {
2542 			*++p = i;
2543 			count++;
2544 			idx++;
2545 			iwi_scan_type_set(scan, idx, type);
2546 		}
2547 	}
2548 	*(p - count) = IWI_CHAN_2GHZ | count;
2549 
2550 	DPRINTF(("Start scanning\n"));
2551 	return iwi_cmd(sc, IWI_CMD_SCAN_V2, &scan, sizeof scan, 1);
2552 }
2553 
2554 static int
2555 iwi_auth_and_assoc(struct iwi_softc *sc)
2556 {
2557 	struct ieee80211com *ic = &sc->sc_ic;
2558 	struct ieee80211_node *ni = ic->ic_bss;
2559 	struct ifnet *ifp = &sc->sc_if;
2560 	struct ieee80211_wme_info wme;
2561 	struct iwi_configuration config;
2562 	struct iwi_associate assoc;
2563 	struct iwi_rateset rs;
2564 	uint16_t capinfo;
2565 	uint32_t data;
2566 	int error;
2567 
2568 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
2569 		memset(&config, 0, sizeof config);
2570 		config.bluetooth_coexistence = sc->bluetooth;
2571 		config.antenna = sc->antenna;
2572 		config.multicast_enabled = 1;
2573 		config.use_protection = 1;
2574 		config.answer_pbreq =
2575 		    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2576 		config.disable_unicast_decryption = 1;
2577 		config.disable_multicast_decryption = 1;
2578 		DPRINTF(("Configuring adapter\n"));
2579 		error = iwi_cmd(sc, IWI_CMD_SET_CONFIGURATION, &config,
2580 		    sizeof config, 1);
2581 		if (error != 0)
2582 			return error;
2583 	}
2584 
2585 #ifdef IWI_DEBUG
2586 	if (iwi_debug > 0) {
2587 		printf("Setting ESSID to ");
2588 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2589 		printf("\n");
2590 	}
2591 #endif
2592 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2593 	if (error != 0)
2594 		return error;
2595 
2596 	/* the rate set has already been "negotiated" */
2597 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2598 	    IWI_MODE_11G;
2599 	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2600 	rs.nrates = ni->ni_rates.rs_nrates;
2601 	memcpy(rs.rates, ni->ni_rates.rs_rates, rs.nrates);
2602 	DPRINTF(("Setting negotiated rates (%u)\n", rs.nrates));
2603 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2604 	if (error != 0)
2605 		return error;
2606 
2607 	if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL) {
2608 		wme.wme_id = IEEE80211_ELEMID_VENDOR;
2609 		wme.wme_len = sizeof (struct ieee80211_wme_info) - 2;
2610 		wme.wme_oui[0] = 0x00;
2611 		wme.wme_oui[1] = 0x50;
2612 		wme.wme_oui[2] = 0xf2;
2613 		wme.wme_type = WME_OUI_TYPE;
2614 		wme.wme_subtype = WME_INFO_OUI_SUBTYPE;
2615 		wme.wme_version = WME_VERSION;
2616 		wme.wme_info = 0;
2617 
2618 		DPRINTF(("Setting WME IE (len=%u)\n", wme.wme_len));
2619 		error = iwi_cmd(sc, IWI_CMD_SET_WMEIE, &wme, sizeof wme, 1);
2620 		if (error != 0)
2621 			return error;
2622 	}
2623 
2624 	if (ic->ic_opt_ie != NULL) {
2625 		DPRINTF(("Setting optional IE (len=%u)\n", ic->ic_opt_ie_len));
2626 		error = iwi_cmd(sc, IWI_CMD_SET_OPTIE, ic->ic_opt_ie,
2627 		    ic->ic_opt_ie_len, 1);
2628 		if (error != 0)
2629 			return error;
2630 	}
2631 	data = htole32(ni->ni_rssi);
2632 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2633 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2634 	if (error != 0)
2635 		return error;
2636 
2637 	memset(&assoc, 0, sizeof assoc);
2638 	assoc.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2639 	    IWI_MODE_11G;
2640 	assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2641 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED)
2642 		assoc.auth = (ic->ic_crypto.cs_def_txkey << 4) | IWI_AUTH_SHARED;
2643 	if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
2644 		assoc.policy |= htole16(IWI_POLICY_WME);
2645 	if (ic->ic_flags & IEEE80211_F_WPA)
2646 		assoc.policy |= htole16(IWI_POLICY_WPA);
2647 	memcpy(assoc.tstamp, ni->ni_tstamp.data, 8);
2648 
2649 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2650 		capinfo = IEEE80211_CAPINFO_IBSS;
2651 	else
2652 		capinfo = IEEE80211_CAPINFO_ESS;
2653 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
2654 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2655 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2656 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2657 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2658 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
2659 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2660 	assoc.capinfo = htole16(capinfo);
2661 
2662 	assoc.lintval = htole16(ic->ic_lintval);
2663 	assoc.intval = htole16(ni->ni_intval);
2664 	IEEE80211_ADDR_COPY(assoc.bssid, ni->ni_bssid);
2665 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2666 		IEEE80211_ADDR_COPY(assoc.dst, ifp->if_broadcastaddr);
2667 	else
2668 		IEEE80211_ADDR_COPY(assoc.dst, ni->ni_bssid);
2669 	DPRINTF(("Trying to associate to %s channel %u auth %u\n",
2670 	    ether_sprintf(assoc.bssid), assoc.chan, assoc.auth));
2671 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &assoc, sizeof assoc, 1);
2672 }
2673 
2674 static int
2675 iwi_init(struct ifnet *ifp)
2676 {
2677 	struct iwi_softc *sc = ifp->if_softc;
2678 	struct ieee80211com *ic = &sc->sc_ic;
2679 	struct iwi_firmware *fw = &sc->fw;
2680 	int i, error;
2681 
2682 	/* exit immediately if firmware has not been ioctl'd */
2683 	if (!(sc->flags & IWI_FLAG_FW_CACHED)) {
2684 		if ((error = iwi_cache_firmware(sc)) != 0) {
2685 			aprint_error("%s: could not cache the firmware\n",
2686 			    sc->sc_dev.dv_xname);
2687 			goto fail;
2688 		}
2689 	}
2690 
2691 	iwi_stop(ifp, 0);
2692 
2693 	if ((error = iwi_reset(sc)) != 0) {
2694 		aprint_error("%s: could not reset adapter\n",
2695 		    sc->sc_dev.dv_xname);
2696 		goto fail;
2697 	}
2698 
2699 	if ((error = iwi_load_firmware(sc, fw->boot, fw->boot_size)) != 0) {
2700 		aprint_error("%s: could not load boot firmware\n",
2701 		    sc->sc_dev.dv_xname);
2702 		goto fail;
2703 	}
2704 
2705 	if ((error = iwi_load_ucode(sc, fw->ucode, fw->ucode_size)) != 0) {
2706 		aprint_error("%s: could not load microcode\n",
2707 		    sc->sc_dev.dv_xname);
2708 		goto fail;
2709 	}
2710 
2711 	iwi_stop_master(sc);
2712 
2713 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmdq.desc_map->dm_segs[0].ds_addr);
2714 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, sc->cmdq.count);
2715 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
2716 
2717 	CSR_WRITE_4(sc, IWI_CSR_TX1_BASE, sc->txq[0].desc_map->dm_segs[0].ds_addr);
2718 	CSR_WRITE_4(sc, IWI_CSR_TX1_SIZE, sc->txq[0].count);
2719 	CSR_WRITE_4(sc, IWI_CSR_TX1_WIDX, sc->txq[0].cur);
2720 
2721 	CSR_WRITE_4(sc, IWI_CSR_TX2_BASE, sc->txq[1].desc_map->dm_segs[0].ds_addr);
2722 	CSR_WRITE_4(sc, IWI_CSR_TX2_SIZE, sc->txq[1].count);
2723 	CSR_WRITE_4(sc, IWI_CSR_TX2_WIDX, sc->txq[1].cur);
2724 
2725 	CSR_WRITE_4(sc, IWI_CSR_TX3_BASE, sc->txq[2].desc_map->dm_segs[0].ds_addr);
2726 	CSR_WRITE_4(sc, IWI_CSR_TX3_SIZE, sc->txq[2].count);
2727 	CSR_WRITE_4(sc, IWI_CSR_TX3_WIDX, sc->txq[2].cur);
2728 
2729 	CSR_WRITE_4(sc, IWI_CSR_TX4_BASE, sc->txq[3].desc_map->dm_segs[0].ds_addr);
2730 	CSR_WRITE_4(sc, IWI_CSR_TX4_SIZE, sc->txq[3].count);
2731 	CSR_WRITE_4(sc, IWI_CSR_TX4_WIDX, sc->txq[3].cur);
2732 
2733 	for (i = 0; i < sc->rxq.count; i++)
2734 		CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4,
2735 		    sc->rxq.data[i].map->dm_segs[0].ds_addr);
2736 
2737 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, sc->rxq.count -1);
2738 
2739 	if ((error = iwi_load_firmware(sc, fw->main, fw->main_size)) != 0) {
2740 		aprint_error("%s: could not load main firmware\n",
2741 		    sc->sc_dev.dv_xname);
2742 		goto fail;
2743 	}
2744 
2745 	sc->flags |= IWI_FLAG_FW_INITED;
2746 
2747 	if ((error = iwi_config(sc)) != 0) {
2748 		aprint_error("%s: device configuration failed\n",
2749 		    sc->sc_dev.dv_xname);
2750 		goto fail;
2751 	}
2752 
2753 	ic->ic_state = IEEE80211_S_INIT;
2754 
2755 	ifp->if_flags &= ~IFF_OACTIVE;
2756 	ifp->if_flags |= IFF_RUNNING;
2757 
2758 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2759 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2760 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2761 	} else
2762 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2763 
2764 	return 0;
2765 
2766 fail:	ifp->if_flags &= ~IFF_UP;
2767 	iwi_stop(ifp, 0);
2768 
2769 	return error;
2770 }
2771 
2772 
2773 /*
2774  * Return whether or not the radio is enabled in hardware
2775  * (i.e. the rfkill switch is "off").
2776  */
2777 static int
2778 iwi_getrfkill(struct iwi_softc *sc)
2779 {
2780 	return (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) == 0;
2781 }
2782 
2783 static int
2784 iwi_sysctl_radio(SYSCTLFN_ARGS)
2785 {
2786 	struct sysctlnode node;
2787 	struct iwi_softc *sc;
2788 	int val, error;
2789 
2790 	node = *rnode;
2791 	sc = (struct iwi_softc *)node.sysctl_data;
2792 
2793 	val = !iwi_getrfkill(sc);
2794 
2795 	node.sysctl_data = &val;
2796 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
2797 
2798 	if (error || newp == NULL)
2799 		return error;
2800 
2801 	return 0;
2802 }
2803 
2804 #ifdef IWI_DEBUG
2805 SYSCTL_SETUP(sysctl_iwi, "sysctl iwi(4) subtree setup")
2806 {
2807 	int rc;
2808 	const struct sysctlnode *rnode;
2809 	const struct sysctlnode *cnode;
2810 
2811 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
2812 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
2813 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
2814 		goto err;
2815 
2816 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
2817 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "iwi",
2818 	    SYSCTL_DESCR("iwi global controls"),
2819 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
2820 		goto err;
2821 
2822 	/* control debugging printfs */
2823 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2824 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2825 	    "debug", SYSCTL_DESCR("Enable debugging output"),
2826 	    NULL, 0, &iwi_debug, 0, CTL_CREATE, CTL_EOL)) != 0)
2827 		goto err;
2828 
2829 	return;
2830 err:
2831 	aprint_error("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
2832 }
2833 
2834 #endif /* IWI_DEBUG */
2835 
2836 /*
2837  * Add sysctl knobs.
2838  */
2839 static void
2840 iwi_sysctlattach(struct iwi_softc *sc)
2841 {
2842 	int rc;
2843 	const struct sysctlnode *rnode;
2844 	const struct sysctlnode *cnode;
2845 
2846 	struct sysctllog **clog = &sc->sc_sysctllog;
2847 
2848 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
2849 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
2850 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
2851 		goto err;
2852 
2853 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
2854 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, sc->sc_dev.dv_xname,
2855 	    SYSCTL_DESCR("iwi controls and statistics"),
2856 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
2857 		goto err;
2858 
2859 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2860 	    CTLFLAG_PERMANENT, CTLTYPE_INT, "radio",
2861 	    SYSCTL_DESCR("radio transmitter switch state (0=off, 1=on)"),
2862 	    iwi_sysctl_radio, 0, sc, 0, CTL_CREATE, CTL_EOL)) != 0)
2863 		goto err;
2864 
2865 	sc->dwelltime = 100;
2866 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2867 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2868 	    "dwell", SYSCTL_DESCR("channel dwell time (ms) for AP/station scanning"),
2869 	    NULL, 0, &sc->dwelltime, 0, CTL_CREATE, CTL_EOL)) != 0)
2870 		goto err;
2871 
2872 	sc->bluetooth = 1;
2873 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2874 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2875 	    "bluetooth", SYSCTL_DESCR("bluetooth coexistence"),
2876 	    NULL, 0, &sc->bluetooth, 0, CTL_CREATE, CTL_EOL)) != 0)
2877 		goto err;
2878 
2879 	sc->antenna = 0;
2880 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2881 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2882 	    "antenna", SYSCTL_DESCR("antenna (0=auto)"),
2883 	    NULL, 0, &sc->antenna, 0, CTL_CREATE, CTL_EOL)) != 0)
2884 		goto err;
2885 
2886 	return;
2887 err:
2888 	aprint_error("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
2889 }
2890 
2891 static void
2892 iwi_stop(struct ifnet *ifp, int disable)
2893 {
2894 	struct iwi_softc *sc = ifp->if_softc;
2895 	struct ieee80211com *ic = &sc->sc_ic;
2896 
2897 	IWI_LED_OFF(sc);
2898 
2899 	iwi_stop_master(sc);
2900 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SW_RESET);
2901 
2902 	/* reset rings */
2903 	iwi_reset_cmd_ring(sc, &sc->cmdq);
2904 	iwi_reset_tx_ring(sc, &sc->txq[0]);
2905 	iwi_reset_tx_ring(sc, &sc->txq[1]);
2906 	iwi_reset_tx_ring(sc, &sc->txq[2]);
2907 	iwi_reset_tx_ring(sc, &sc->txq[3]);
2908 	iwi_reset_rx_ring(sc, &sc->rxq);
2909 
2910 	ifp->if_timer = 0;
2911 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2912 
2913 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2914 }
2915 
2916 static void
2917 iwi_led_set(struct iwi_softc *sc, uint32_t state, int toggle)
2918 {
2919 	uint32_t val;
2920 
2921 	val = MEM_READ_4(sc, IWI_MEM_EVENT_CTL);
2922 
2923 	switch (sc->nictype) {
2924 	case 1:
2925 		/* special NIC type: reversed leds */
2926 		if (state == IWI_LED_ACTIVITY) {
2927 			state &= ~IWI_LED_ACTIVITY;
2928 			state |= IWI_LED_ASSOCIATED;
2929 		} else if (state == IWI_LED_ASSOCIATED) {
2930 			state &= ~IWI_LED_ASSOCIATED;
2931 			state |= IWI_LED_ACTIVITY;
2932 		}
2933 		/* and ignore toggle effect */
2934 		val |= state;
2935 		break;
2936 	case 0:
2937 	case 2:
2938 	case 3:
2939 	case 4:
2940 		val = (toggle && (val & state)) ? val & ~state : val | state;
2941 		break;
2942 	default:
2943 		aprint_normal("%s: unknown NIC type %d\n",
2944 		    sc->sc_dev.dv_xname, sc->nictype);
2945 		return;
2946 		break;
2947 	}
2948 
2949 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, val);
2950 
2951 	return;
2952 }
2953 
2954 static void
2955 iwi_error_log(struct iwi_softc *sc)
2956 {
2957 	uint32_t b, n;
2958 	int i;
2959 
2960 	static const char *const msg[] = {
2961 		"no error",
2962 		"failed",
2963 		"memory range low",
2964 		"memory range high",
2965 		"bad parameter",
2966 		"checksum",
2967 		"NMI",
2968 		"bad database",
2969 		"allocation failed",
2970 		"DMA underrun",
2971 		"DMA status",
2972 		"DINO",
2973 		"EEPROM",
2974 		"device assert",
2975 		"fatal"
2976 	};
2977 
2978 	b = CSR_READ_4(sc, IWI_CSR_ERRORLOG);
2979 	n = MEM_READ_4(sc, b);
2980 
2981 	b += 4;
2982 
2983 	for (i = 0; i < n ; i++) {
2984 		struct iwi_error fw_error;
2985 
2986 		MEM_CPY(sc, &fw_error, b, sizeof(fw_error));
2987 
2988 		printf("%s: %s\n", sc->sc_dev.dv_xname,
2989 		    msg[fw_error.type]);
2990 
2991 		b += sizeof(fw_error);
2992 	}
2993 }
2994