xref: /netbsd-src/sys/dev/pci/if_iwi.c (revision c0179c282a5968435315a82f4128c61372c68fc3)
1 /*	$NetBSD: if_iwi.c,v 1.58 2006/11/16 01:33:08 christos Exp $  */
2 
3 /*-
4  * Copyright (c) 2004, 2005
5  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice unmodified, this list of conditions, and the following
12  *    disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __KERNEL_RCSID(0, "$NetBSD: if_iwi.c,v 1.58 2006/11/16 01:33:08 christos Exp $");
32 
33 /*-
34  * Intel(R) PRO/Wireless 2200BG/2225BG/2915ABG driver
35  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
36  */
37 
38 #include "bpfilter.h"
39 
40 #include <sys/param.h>
41 #include <sys/sockio.h>
42 #include <sys/sysctl.h>
43 #include <sys/mbuf.h>
44 #include <sys/kernel.h>
45 #include <sys/socket.h>
46 #include <sys/systm.h>
47 #include <sys/malloc.h>
48 #include <sys/conf.h>
49 #include <sys/kauth.h>
50 
51 #include <machine/bus.h>
52 #include <machine/endian.h>
53 #include <machine/intr.h>
54 
55 #include <dev/firmload.h>
56 
57 #include <dev/pci/pcireg.h>
58 #include <dev/pci/pcivar.h>
59 #include <dev/pci/pcidevs.h>
60 
61 #if NBPFILTER > 0
62 #include <net/bpf.h>
63 #endif
64 #include <net/if.h>
65 #include <net/if_arp.h>
66 #include <net/if_dl.h>
67 #include <net/if_ether.h>
68 #include <net/if_media.h>
69 #include <net/if_types.h>
70 
71 #include <net80211/ieee80211_var.h>
72 #include <net80211/ieee80211_radiotap.h>
73 
74 #include <netinet/in.h>
75 #include <netinet/in_systm.h>
76 #include <netinet/in_var.h>
77 #include <netinet/ip.h>
78 
79 #include <crypto/arc4/arc4.h>
80 
81 #include <dev/pci/if_iwireg.h>
82 #include <dev/pci/if_iwivar.h>
83 
84 #ifdef IWI_DEBUG
85 #define DPRINTF(x)	if (iwi_debug > 0) printf x
86 #define DPRINTFN(n, x)	if (iwi_debug >= (n)) printf x
87 int iwi_debug = 4;
88 #else
89 #define DPRINTF(x)
90 #define DPRINTFN(n, x)
91 #endif
92 
93 static int	iwi_match(struct device *, struct cfdata *, void *);
94 static void	iwi_attach(struct device *, struct device *, void *);
95 static int	iwi_detach(struct device *, int);
96 
97 static void	iwi_shutdown(void *);
98 static int	iwi_suspend(struct iwi_softc *);
99 static int	iwi_resume(struct iwi_softc *);
100 static void	iwi_powerhook(int, void *);
101 
102 static int	iwi_alloc_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *,
103     int);
104 static void	iwi_reset_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
105 static void	iwi_free_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
106 static int	iwi_alloc_tx_ring(struct iwi_softc *, struct iwi_tx_ring *,
107     int, bus_addr_t, bus_addr_t);
108 static void	iwi_reset_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
109 static void	iwi_free_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
110 static struct mbuf *
111 		iwi_alloc_rx_buf(struct iwi_softc *sc);
112 static int	iwi_alloc_rx_ring(struct iwi_softc *, struct iwi_rx_ring *,
113     int);
114 static void	iwi_reset_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
115 static void	iwi_free_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
116 
117 static struct	ieee80211_node *iwi_node_alloc(struct ieee80211_node_table *);
118 static void	iwi_node_free(struct ieee80211_node *);
119 
120 static int	iwi_media_change(struct ifnet *);
121 static void	iwi_media_status(struct ifnet *, struct ifmediareq *);
122 static int	iwi_wme_update(struct ieee80211com *);
123 static uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
124 static int	iwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
125 static void	iwi_fix_channel(struct ieee80211com *, struct mbuf *);
126 static void	iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *, int,
127     struct iwi_frame *);
128 static void	iwi_notification_intr(struct iwi_softc *, struct iwi_notif *);
129 static void	iwi_cmd_intr(struct iwi_softc *);
130 static void	iwi_rx_intr(struct iwi_softc *);
131 static void	iwi_tx_intr(struct iwi_softc *, struct iwi_tx_ring *);
132 static int	iwi_intr(void *);
133 static int	iwi_cmd(struct iwi_softc *, uint8_t, void *, uint8_t, int);
134 static void	iwi_write_ibssnode(struct iwi_softc *, const struct iwi_node *);
135 static int	iwi_tx_start(struct ifnet *, struct mbuf *, struct ieee80211_node *,
136     int);
137 static void	iwi_start(struct ifnet *);
138 static void	iwi_watchdog(struct ifnet *);
139 
140 static int	iwi_alloc_unr(struct iwi_softc *);
141 static void	iwi_free_unr(struct iwi_softc *, int);
142 
143 static int	iwi_get_table0(struct iwi_softc *, uint32_t *);
144 
145 static int	iwi_ioctl(struct ifnet *, u_long, caddr_t);
146 static void	iwi_stop_master(struct iwi_softc *);
147 static int	iwi_reset(struct iwi_softc *);
148 static int	iwi_load_ucode(struct iwi_softc *, void *, int);
149 static int	iwi_load_firmware(struct iwi_softc *, void *, int);
150 static int	iwi_cache_firmware(struct iwi_softc *);
151 static void	iwi_free_firmware(struct iwi_softc *);
152 static int	iwi_config(struct iwi_softc *);
153 static int	iwi_set_chan(struct iwi_softc *, struct ieee80211_channel *);
154 static int	iwi_scan(struct iwi_softc *);
155 static int	iwi_auth_and_assoc(struct iwi_softc *);
156 static int	iwi_init(struct ifnet *);
157 static void	iwi_stop(struct ifnet *, int);
158 static int	iwi_getrfkill(struct iwi_softc *);
159 static void	iwi_led_set(struct iwi_softc *, uint32_t, int);
160 static void	iwi_sysctlattach(struct iwi_softc *);
161 static void	iwi_error_log(struct iwi_softc *);
162 
163 /*
164  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
165  */
166 static const struct ieee80211_rateset iwi_rateset_11a =
167 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
168 
169 static const struct ieee80211_rateset iwi_rateset_11b =
170 	{ 4, { 2, 4, 11, 22 } };
171 
172 static const struct ieee80211_rateset iwi_rateset_11g =
173 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
174 
175 static inline uint8_t
176 MEM_READ_1(struct iwi_softc *sc, uint32_t addr)
177 {
178 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
179 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
180 }
181 
182 static inline uint32_t
183 MEM_READ_4(struct iwi_softc *sc, uint32_t addr)
184 {
185 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
186 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
187 }
188 
189 static void
190 MEM_CPY(struct iwi_softc *sc, void *dst, uint32_t base, size_t sz)
191 {
192 	KASSERT(sz % 4 == 0);
193 	int j;
194 
195 	uint32_t *p = dst;
196 
197 	for (j = 0; j < sz / 4; j++)
198 		p[j] = MEM_READ_4(sc, base + j * sizeof(uint32_t));
199 }
200 
201 CFATTACH_DECL(iwi, sizeof (struct iwi_softc), iwi_match, iwi_attach,
202     iwi_detach, NULL);
203 
204 static int
205 iwi_match(struct device *parent, struct cfdata *match,
206     void *aux)
207 {
208 	struct pci_attach_args *pa = aux;
209 
210 	if (PCI_VENDOR(pa->pa_id) != PCI_VENDOR_INTEL)
211 		return 0;
212 
213 	if (PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2200BG ||
214 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2225BG ||
215 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1 ||
216 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2)
217 		return 1;
218 
219 	return 0;
220 }
221 
222 /* Base Address Register */
223 #define IWI_PCI_BAR0	0x10
224 
225 static void
226 iwi_attach(struct device *parent, struct device *self, void *aux)
227 {
228 	struct iwi_softc *sc = (struct iwi_softc *)self;
229 	struct ieee80211com *ic = &sc->sc_ic;
230 	struct ifnet *ifp = &sc->sc_if;
231 	struct pci_attach_args *pa = aux;
232 	const char *intrstr;
233 	char devinfo[256];
234 	bus_space_tag_t memt;
235 	bus_space_handle_t memh;
236 	bus_addr_t base;
237 	pci_intr_handle_t ih;
238 	pcireg_t data;
239 	uint16_t val;
240 	int error, revision, i;
241 
242 	sc->sc_pct = pa->pa_pc;
243 	sc->sc_pcitag = pa->pa_tag;
244 
245 	pci_devinfo(pa->pa_id, pa->pa_class, 0, devinfo, sizeof devinfo);
246 	revision = PCI_REVISION(pa->pa_class);
247 	aprint_normal(": %s (rev. 0x%02x)\n", devinfo, revision);
248 
249 	/* clear device specific PCI configuration register 0x41 */
250 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
251 	data &= ~0x0000ff00;
252 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
253 
254 	/* clear unit numbers allocated to IBSS */
255 	sc->sc_unr = 0;
256 
257 	/* power up chip */
258 	if ((error = pci_activate(pa->pa_pc, pa->pa_tag, sc,
259 	    NULL)) && error != EOPNOTSUPP) {
260 		aprint_error("%s: cannot activate %d\n", sc->sc_dev.dv_xname,
261 		    error);
262 		return;
263 	}
264 
265 	/* enable bus-mastering */
266 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG);
267 	data |= PCI_COMMAND_MASTER_ENABLE;
268 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, PCI_COMMAND_STATUS_REG, data);
269 
270 	/* map the register window */
271 	error = pci_mapreg_map(pa, IWI_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
272 	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, &base, &sc->sc_sz);
273 	if (error != 0) {
274 		aprint_error("%s: could not map memory space\n",
275 		    sc->sc_dev.dv_xname);
276 		return;
277 	}
278 
279 	sc->sc_st = memt;
280 	sc->sc_sh = memh;
281 	sc->sc_dmat = pa->pa_dmat;
282 
283 	/* disable interrupts */
284 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
285 
286 	if (pci_intr_map(pa, &ih) != 0) {
287 		aprint_error("%s: could not map interrupt\n",
288 		    sc->sc_dev.dv_xname);
289 		return;
290 	}
291 
292 	intrstr = pci_intr_string(sc->sc_pct, ih);
293 	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, iwi_intr, sc);
294 	if (sc->sc_ih == NULL) {
295 		aprint_error("%s: could not establish interrupt",
296 		    sc->sc_dev.dv_xname);
297 		if (intrstr != NULL)
298 			aprint_error(" at %s", intrstr);
299 		aprint_error("\n");
300 		return;
301 	}
302 	aprint_normal("%s: interrupting at %s\n", sc->sc_dev.dv_xname, intrstr);
303 
304 	if (iwi_reset(sc) != 0) {
305 		aprint_error("%s: could not reset adapter\n",
306 		    sc->sc_dev.dv_xname);
307 		return;
308 	}
309 
310 	/*
311 	 * Allocate rings.
312 	 */
313 	if (iwi_alloc_cmd_ring(sc, &sc->cmdq, IWI_CMD_RING_COUNT) != 0) {
314 		aprint_error("%s: could not allocate command ring\n",
315 		    sc->sc_dev.dv_xname);
316 		goto fail;
317 	}
318 
319 	error = iwi_alloc_tx_ring(sc, &sc->txq[0], IWI_TX_RING_COUNT,
320 	    IWI_CSR_TX1_RIDX, IWI_CSR_TX1_WIDX);
321 	if (error != 0) {
322 		aprint_error("%s: could not allocate Tx ring 1\n",
323 		    sc->sc_dev.dv_xname);
324 		goto fail;
325 	}
326 
327 	error = iwi_alloc_tx_ring(sc, &sc->txq[1], IWI_TX_RING_COUNT,
328 	    IWI_CSR_TX2_RIDX, IWI_CSR_TX2_WIDX);
329 	if (error != 0) {
330 		aprint_error("%s: could not allocate Tx ring 2\n",
331 		    sc->sc_dev.dv_xname);
332 		goto fail;
333 	}
334 
335 	error = iwi_alloc_tx_ring(sc, &sc->txq[2], IWI_TX_RING_COUNT,
336 	    IWI_CSR_TX3_RIDX, IWI_CSR_TX3_WIDX);
337 	if (error != 0) {
338 		aprint_error("%s: could not allocate Tx ring 3\n",
339 		    sc->sc_dev.dv_xname);
340 		goto fail;
341 	}
342 
343 	error = iwi_alloc_tx_ring(sc, &sc->txq[3], IWI_TX_RING_COUNT,
344 	    IWI_CSR_TX4_RIDX, IWI_CSR_TX4_WIDX);
345 	if (error != 0) {
346 		aprint_error("%s: could not allocate Tx ring 4\n",
347 		    sc->sc_dev.dv_xname);
348 		goto fail;
349 	}
350 
351 	if (iwi_alloc_rx_ring(sc, &sc->rxq, IWI_RX_RING_COUNT) != 0) {
352 		aprint_error("%s: could not allocate Rx ring\n",
353 		    sc->sc_dev.dv_xname);
354 		goto fail;
355 	}
356 
357 	ic->ic_ifp = ifp;
358 	ic->ic_wme.wme_update = iwi_wme_update;
359 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
360 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
361 	ic->ic_state = IEEE80211_S_INIT;
362 
363 	sc->sc_fwname = "iwi-bss.fw";
364 	sc->sc_ucname = "iwi-ucode-bss.fw";
365 
366 	/* set device capabilities */
367 	ic->ic_caps =
368 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
369 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
370 	    IEEE80211_C_TXPMGT |	/* tx power management */
371 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
372 	    IEEE80211_C_WPA |		/* 802.11i */
373 	    IEEE80211_C_WME;		/* 802.11e */
374 
375 	/* read MAC address from EEPROM */
376 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
377 	ic->ic_myaddr[0] = val & 0xff;
378 	ic->ic_myaddr[1] = val >> 8;
379 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
380 	ic->ic_myaddr[2] = val & 0xff;
381 	ic->ic_myaddr[3] = val >> 8;
382 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
383 	ic->ic_myaddr[4] = val & 0xff;
384 	ic->ic_myaddr[5] = val >> 8;
385 
386 	aprint_normal("%s: 802.11 address %s\n", sc->sc_dev.dv_xname,
387 	    ether_sprintf(ic->ic_myaddr));
388 
389 	/* read the NIC type from EEPROM */
390 	val = iwi_read_prom_word(sc, IWI_EEPROM_NIC_TYPE);
391 	sc->nictype = val & 0xff;
392 
393 	DPRINTF(("%s: NIC type %d\n", sc->sc_dev.dv_xname, sc->nictype));
394 
395 	if (PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1 ||
396 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2) {
397 		/* set supported .11a rates (2915ABG only) */
398 		ic->ic_sup_rates[IEEE80211_MODE_11A] = iwi_rateset_11a;
399 
400 		/* set supported .11a channels */
401 		for (i = 36; i <= 64; i += 4) {
402 			ic->ic_channels[i].ic_freq =
403 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
404 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
405 		}
406 		for (i = 149; i <= 165; i += 4) {
407 			ic->ic_channels[i].ic_freq =
408 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
409 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
410 		}
411 	}
412 
413 	/* set supported .11b and .11g rates */
414 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwi_rateset_11b;
415 	ic->ic_sup_rates[IEEE80211_MODE_11G] = iwi_rateset_11g;
416 
417 	/* set supported .11b and .11g channels (1 through 14) */
418 	for (i = 1; i <= 14; i++) {
419 		ic->ic_channels[i].ic_freq =
420 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
421 		ic->ic_channels[i].ic_flags =
422 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
423 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
424 	}
425 
426 	ifp->if_softc = sc;
427 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
428 	ifp->if_init = iwi_init;
429 	ifp->if_stop = iwi_stop;
430 	ifp->if_ioctl = iwi_ioctl;
431 	ifp->if_start = iwi_start;
432 	ifp->if_watchdog = iwi_watchdog;
433 	IFQ_SET_READY(&ifp->if_snd);
434 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
435 
436 	if_attach(ifp);
437 	ieee80211_ifattach(ic);
438 	/* override default methods */
439 	ic->ic_node_alloc = iwi_node_alloc;
440 	sc->sc_node_free = ic->ic_node_free;
441 	ic->ic_node_free = iwi_node_free;
442 	/* override state transition machine */
443 	sc->sc_newstate = ic->ic_newstate;
444 	ic->ic_newstate = iwi_newstate;
445 	ieee80211_media_init(ic, iwi_media_change, iwi_media_status);
446 
447 #if NBPFILTER > 0
448 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
449 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
450 
451 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
452 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
453 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
454 
455 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
456 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
457 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
458 #endif
459 
460 	iwi_sysctlattach(sc);
461 
462 	/*
463 	 * Make sure the interface is shutdown during reboot.
464 	 */
465 	sc->sc_sdhook = shutdownhook_establish(iwi_shutdown, sc);
466 	if (sc->sc_sdhook == NULL)
467 		aprint_error("%s: WARNING: unable to establish shutdown hook\n",
468 		    sc->sc_dev.dv_xname);
469 	sc->sc_powerhook = powerhook_establish(sc->sc_dev.dv_xname,
470 	    iwi_powerhook, sc);
471 	if (sc->sc_powerhook == NULL)
472 		aprint_error("%s: WARNING: unable to establish power hook\n",
473 		    sc->sc_dev.dv_xname);
474 
475 	ieee80211_announce(ic);
476 
477 	return;
478 
479 fail:	iwi_detach(self, 0);
480 }
481 
482 static int
483 iwi_detach(struct device* self, int flags)
484 {
485 	struct iwi_softc *sc = (struct iwi_softc *)self;
486 	struct ifnet *ifp = &sc->sc_if;
487 
488 	if (ifp != NULL)
489 		iwi_stop(ifp, 1);
490 
491 	iwi_free_firmware(sc);
492 
493 #if NBPFILTER > 0
494 	if (ifp != NULL)
495 		bpfdetach(ifp);
496 #endif
497 	ieee80211_ifdetach(&sc->sc_ic);
498 	if (ifp != NULL)
499 		if_detach(ifp);
500 
501 	iwi_free_cmd_ring(sc, &sc->cmdq);
502 	iwi_free_tx_ring(sc, &sc->txq[0]);
503 	iwi_free_tx_ring(sc, &sc->txq[1]);
504 	iwi_free_tx_ring(sc, &sc->txq[2]);
505 	iwi_free_tx_ring(sc, &sc->txq[3]);
506 	iwi_free_rx_ring(sc, &sc->rxq);
507 
508 	if (sc->sc_ih != NULL) {
509 		pci_intr_disestablish(sc->sc_pct, sc->sc_ih);
510 		sc->sc_ih = NULL;
511 	}
512 
513 	bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
514 
515 	powerhook_disestablish(sc->sc_powerhook);
516 	shutdownhook_disestablish(sc->sc_sdhook);
517 
518 	return 0;
519 }
520 
521 static int
522 iwi_alloc_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring,
523     int count)
524 {
525 	int error, nsegs;
526 
527 	ring->count = count;
528 	ring->queued = 0;
529 	ring->cur = ring->next = 0;
530 
531 	/*
532 	 * Allocate and map command ring
533 	 */
534 	error = bus_dmamap_create(sc->sc_dmat,
535 	    IWI_CMD_DESC_SIZE * count, 1,
536 	    IWI_CMD_DESC_SIZE * count, 0,
537 	    BUS_DMA_NOWAIT, &ring->desc_map);
538 	if (error != 0) {
539 		aprint_error("%s: could not create command ring DMA map\n",
540 		    sc->sc_dev.dv_xname);
541 		goto fail;
542 	}
543 
544 	error = bus_dmamem_alloc(sc->sc_dmat,
545 	    IWI_CMD_DESC_SIZE * count, PAGE_SIZE, 0,
546 	    &sc->cmdq.desc_seg, 1, &nsegs, BUS_DMA_NOWAIT);
547 	if (error != 0) {
548 		aprint_error("%s: could not allocate command ring DMA memory\n",
549 		    sc->sc_dev.dv_xname);
550 		goto fail;
551 	}
552 
553 	error = bus_dmamem_map(sc->sc_dmat, &sc->cmdq.desc_seg, nsegs,
554 	    IWI_CMD_DESC_SIZE * count,
555 	    (caddr_t *)&sc->cmdq.desc, BUS_DMA_NOWAIT);
556 	if (error != 0) {
557 		aprint_error("%s: could not map command ring DMA memory\n",
558 		    sc->sc_dev.dv_xname);
559 		goto fail;
560 	}
561 
562 	error = bus_dmamap_load(sc->sc_dmat, sc->cmdq.desc_map, sc->cmdq.desc,
563 	    IWI_CMD_DESC_SIZE * count, NULL,
564 	    BUS_DMA_NOWAIT);
565 	if (error != 0) {
566 		aprint_error("%s: could not load command ring DMA map\n",
567 		    sc->sc_dev.dv_xname);
568 		goto fail;
569 	}
570 
571 	memset(sc->cmdq.desc, 0,
572 	    IWI_CMD_DESC_SIZE * count);
573 
574 	return 0;
575 
576 fail:	iwi_free_cmd_ring(sc, ring);
577 	return error;
578 }
579 
580 static void
581 iwi_reset_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
582 {
583 	int i;
584 
585 	for (i = ring->next; i != ring->cur;) {
586 		bus_dmamap_sync(sc->sc_dmat, sc->cmdq.desc_map,
587 		    i * IWI_CMD_DESC_SIZE, IWI_CMD_DESC_SIZE,
588 		    BUS_DMASYNC_POSTWRITE);
589 
590 		wakeup(&ring->desc[i]);
591 		i = (i + 1) % ring->count;
592 	}
593 
594 	ring->queued = 0;
595 	ring->cur = ring->next = 0;
596 }
597 
598 static void
599 iwi_free_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
600 {
601 	if (ring->desc_map != NULL) {
602 		if (ring->desc != NULL) {
603 			bus_dmamap_unload(sc->sc_dmat, ring->desc_map);
604 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
605 			    IWI_CMD_DESC_SIZE * ring->count);
606 			bus_dmamem_free(sc->sc_dmat, &ring->desc_seg, 1);
607 		}
608 		bus_dmamap_destroy(sc->sc_dmat, ring->desc_map);
609 	}
610 }
611 
612 static int
613 iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring,
614     int count, bus_addr_t csr_ridx, bus_addr_t csr_widx)
615 {
616 	int i, error, nsegs;
617 
618 	ring->count = count;
619 	ring->queued = 0;
620 	ring->cur = ring->next = 0;
621 	ring->csr_ridx = csr_ridx;
622 	ring->csr_widx = csr_widx;
623 
624 	/*
625 	 * Allocate and map Tx ring
626 	 */
627 	error = bus_dmamap_create(sc->sc_dmat,
628 	    IWI_TX_DESC_SIZE * count, 1,
629 	    IWI_TX_DESC_SIZE * count, 0, BUS_DMA_NOWAIT,
630 	    &ring->desc_map);
631 	if (error != 0) {
632 		aprint_error("%s: could not create tx ring DMA map\n",
633 		    sc->sc_dev.dv_xname);
634 		goto fail;
635 	}
636 
637 	error = bus_dmamem_alloc(sc->sc_dmat,
638 	    IWI_TX_DESC_SIZE * count, PAGE_SIZE, 0,
639 	    &ring->desc_seg, 1, &nsegs, BUS_DMA_NOWAIT);
640 	if (error != 0) {
641 		aprint_error("%s: could not allocate tx ring DMA memory\n",
642 		    sc->sc_dev.dv_xname);
643 		goto fail;
644 	}
645 
646 	error = bus_dmamem_map(sc->sc_dmat, &ring->desc_seg, nsegs,
647 	    IWI_TX_DESC_SIZE * count,
648 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
649 	if (error != 0) {
650 		aprint_error("%s: could not map tx ring DMA memory\n",
651 		    sc->sc_dev.dv_xname);
652 		goto fail;
653 	}
654 
655 	error = bus_dmamap_load(sc->sc_dmat, ring->desc_map, ring->desc,
656 	    IWI_TX_DESC_SIZE * count, NULL,
657 	    BUS_DMA_NOWAIT);
658 	if (error != 0) {
659 		aprint_error("%s: could not load tx ring DMA map\n",
660 		    sc->sc_dev.dv_xname);
661 		goto fail;
662 	}
663 
664 	memset(ring->desc, 0, IWI_TX_DESC_SIZE * count);
665 
666 	ring->data = malloc(count * sizeof (struct iwi_tx_data), M_DEVBUF,
667 	    M_NOWAIT | M_ZERO);
668 	if (ring->data == NULL) {
669 		aprint_error("%s: could not allocate soft data\n",
670 		    sc->sc_dev.dv_xname);
671 		error = ENOMEM;
672 		goto fail;
673 	}
674 
675 	/*
676 	 * Allocate Tx buffers DMA maps
677 	 */
678 	for (i = 0; i < count; i++) {
679 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, IWI_MAX_NSEG,
680 		    MCLBYTES, 0, BUS_DMA_NOWAIT, &ring->data[i].map);
681 		if (error != 0) {
682 			aprint_error("%s: could not create tx buf DMA map",
683 			    sc->sc_dev.dv_xname);
684 			goto fail;
685 		}
686 	}
687 	return 0;
688 
689 fail:	iwi_free_tx_ring(sc, ring);
690 	return error;
691 }
692 
693 static void
694 iwi_reset_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
695 {
696 	struct iwi_tx_data *data;
697 	int i;
698 
699 	for (i = 0; i < ring->count; i++) {
700 		data = &ring->data[i];
701 
702 		if (data->m != NULL) {
703 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
704 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
705 			bus_dmamap_unload(sc->sc_dmat, data->map);
706 			m_freem(data->m);
707 			data->m = NULL;
708 		}
709 
710 		if (data->ni != NULL) {
711 			ieee80211_free_node(data->ni);
712 			data->ni = NULL;
713 		}
714 	}
715 
716 	ring->queued = 0;
717 	ring->cur = ring->next = 0;
718 }
719 
720 static void
721 iwi_free_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
722 {
723 	int i;
724 
725 	if (ring->desc_map != NULL) {
726 		if (ring->desc != NULL) {
727 			bus_dmamap_unload(sc->sc_dmat, ring->desc_map);
728 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
729 			    IWI_TX_DESC_SIZE * ring->count);
730 			bus_dmamem_free(sc->sc_dmat, &ring->desc_seg, 1);
731 		}
732 		bus_dmamap_destroy(sc->sc_dmat, ring->desc_map);
733 	}
734 
735 	for (i = 0; i < ring->count; i++) {
736 		if (ring->data[i].m != NULL) {
737 			bus_dmamap_unload(sc->sc_dmat, ring->data[i].map);
738 			m_freem(ring->data[i].m);
739 		}
740 		bus_dmamap_destroy(sc->sc_dmat, ring->data[i].map);
741 	}
742 }
743 
744 static int
745 iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring,
746     int count)
747 {
748 	int i, error;
749 
750 	ring->count = count;
751 	ring->cur = 0;
752 
753 	ring->data = malloc(count * sizeof (struct iwi_rx_data), M_DEVBUF,
754 	    M_NOWAIT | M_ZERO);
755 	if (ring->data == NULL) {
756 		aprint_error("%s: could not allocate soft data\n",
757 		    sc->sc_dev.dv_xname);
758 		error = ENOMEM;
759 		goto fail;
760 	}
761 
762 	/*
763 	 * Allocate and map Rx buffers
764 	 */
765 	for (i = 0; i < count; i++) {
766 
767 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
768 		    0, BUS_DMA_WAITOK | BUS_DMA_ALLOCNOW, &ring->data[i].map);
769 		if (error != 0) {
770 			aprint_error("%s: could not create rx buf DMA map",
771 			    sc->sc_dev.dv_xname);
772 			goto fail;
773 		}
774 
775 		if ((ring->data[i].m = iwi_alloc_rx_buf(sc)) == NULL) {
776 			error = ENOMEM;
777 			goto fail;
778 		}
779 
780 		error = bus_dmamap_load_mbuf(sc->sc_dmat, ring->data[i].map,
781 		    ring->data[i].m, BUS_DMA_READ | BUS_DMA_NOWAIT);
782 		if (error != 0) {
783 			aprint_error("%s: could not load rx buffer DMA map\n",
784 			    sc->sc_dev.dv_xname);
785 			goto fail;
786 		}
787 
788 		bus_dmamap_sync(sc->sc_dmat, ring->data[i].map, 0,
789 		    ring->data[i].map->dm_mapsize, BUS_DMASYNC_PREREAD);
790 	}
791 
792 	return 0;
793 
794 fail:	iwi_free_rx_ring(sc, ring);
795 	return error;
796 }
797 
798 static void
799 iwi_reset_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
800 {
801 	ring->cur = 0;
802 }
803 
804 static void
805 iwi_free_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
806 {
807 	int i;
808 
809 	for (i = 0; i < ring->count; i++) {
810 		if (ring->data[i].m != NULL) {
811 			bus_dmamap_unload(sc->sc_dmat, ring->data[i].map);
812 			m_freem(ring->data[i].m);
813 		}
814 		bus_dmamap_destroy(sc->sc_dmat, ring->data[i].map);
815 	}
816 }
817 
818 static void
819 iwi_shutdown(void *arg)
820 {
821 	struct iwi_softc *sc = (struct iwi_softc *)arg;
822 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
823 
824 	iwi_stop(ifp, 1);
825 }
826 
827 static int
828 iwi_suspend(struct iwi_softc *sc)
829 {
830 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
831 
832 	iwi_stop(ifp, 1);
833 
834 	return 0;
835 }
836 
837 static int
838 iwi_resume(struct iwi_softc *sc)
839 {
840 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
841 	pcireg_t data;
842 
843 	/* clear device specific PCI configuration register 0x41 */
844 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
845 	data &= ~0x0000ff00;
846 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
847 
848 	if (ifp->if_flags & IFF_UP) {
849 		iwi_init(ifp);
850 		if (ifp->if_flags & IFF_RUNNING)
851 			iwi_start(ifp);
852 	}
853 
854 	return 0;
855 }
856 
857 static void
858 iwi_powerhook(int why, void *arg)
859 {
860         struct iwi_softc *sc = arg;
861 	pci_chipset_tag_t pc = sc->sc_pct;
862 	pcitag_t tag = sc->sc_pcitag;
863 	int s;
864 
865 	s = splnet();
866 	switch (why) {
867 	case PWR_SUSPEND:
868 	case PWR_STANDBY:
869 		pci_conf_capture(pc, tag, &sc->sc_pciconf);
870 		break;
871 	case PWR_RESUME:
872 		pci_conf_restore(pc, tag, &sc->sc_pciconf);
873 		break;
874 	case PWR_SOFTSUSPEND:
875 	case PWR_SOFTSTANDBY:
876 		iwi_suspend(sc);
877 		break;
878 	case PWR_SOFTRESUME:
879 		iwi_resume(sc);
880 		break;
881 	}
882 	splx(s);
883 }
884 
885 static struct ieee80211_node *
886 iwi_node_alloc(struct ieee80211_node_table *nt)
887 {
888 	struct iwi_node *in;
889 
890 	in = malloc(sizeof (struct iwi_node), M_80211_NODE, M_NOWAIT | M_ZERO);
891 	if (in == NULL)
892 		return NULL;
893 
894 	in->in_station = -1;
895 
896 	return &in->in_node;
897 }
898 
899 static int
900 iwi_alloc_unr(struct iwi_softc *sc)
901 {
902 	int i;
903 
904 	for (i = 0; i < IWI_MAX_IBSSNODE - 1; i++)
905 		if ((sc->sc_unr & (1 << i)) == 0) {
906 			sc->sc_unr |= 1 << i;
907 			return i;
908 		}
909 
910 	return -1;
911 }
912 
913 static void
914 iwi_free_unr(struct iwi_softc *sc, int r)
915 {
916 
917 	sc->sc_unr &= 1 << r;
918 }
919 
920 static void
921 iwi_node_free(struct ieee80211_node *ni)
922 {
923 	struct ieee80211com *ic = ni->ni_ic;
924 	struct iwi_softc *sc = ic->ic_ifp->if_softc;
925 	struct iwi_node *in = (struct iwi_node *)ni;
926 
927 	if (in->in_station != -1)
928 		iwi_free_unr(sc, in->in_station);
929 
930 	sc->sc_node_free(ni);
931 }
932 
933 static int
934 iwi_media_change(struct ifnet *ifp)
935 {
936 	int error;
937 
938 	error = ieee80211_media_change(ifp);
939 	if (error != ENETRESET)
940 		return error;
941 
942 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
943 		iwi_init(ifp);
944 
945 	return 0;
946 }
947 
948 /*
949  * The firmware automatically adapts the transmit speed.  We report its current
950  * value here.
951  */
952 static void
953 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
954 {
955 	struct iwi_softc *sc = ifp->if_softc;
956 	struct ieee80211com *ic = &sc->sc_ic;
957 #define N(a)	(sizeof (a) / sizeof (a[0]))
958 	static const struct {
959 		uint32_t	val;
960 		int		rate;
961 	} rates[] = {
962 		{ IWI_RATE_DS1,      2 },
963 		{ IWI_RATE_DS2,      4 },
964 		{ IWI_RATE_DS5,     11 },
965 		{ IWI_RATE_DS11,    22 },
966 		{ IWI_RATE_OFDM6,   12 },
967 		{ IWI_RATE_OFDM9,   18 },
968 		{ IWI_RATE_OFDM12,  24 },
969 		{ IWI_RATE_OFDM18,  36 },
970 		{ IWI_RATE_OFDM24,  48 },
971 		{ IWI_RATE_OFDM36,  72 },
972 		{ IWI_RATE_OFDM48,  96 },
973 		{ IWI_RATE_OFDM54, 108 },
974 	};
975 	uint32_t val;
976 	int rate, i;
977 
978 	imr->ifm_status = IFM_AVALID;
979 	imr->ifm_active = IFM_IEEE80211;
980 	if (ic->ic_state == IEEE80211_S_RUN)
981 		imr->ifm_status |= IFM_ACTIVE;
982 
983 	/* read current transmission rate from adapter */
984 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
985 
986 	/* convert rate to 802.11 rate */
987 	for (i = 0; i < N(rates) && rates[i].val != val; i++);
988 	rate = (i < N(rates)) ? rates[i].rate : 0;
989 
990 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
991 	switch (ic->ic_opmode) {
992 	case IEEE80211_M_STA:
993 		break;
994 
995 	case IEEE80211_M_IBSS:
996 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
997 		break;
998 
999 	case IEEE80211_M_MONITOR:
1000 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
1001 		break;
1002 
1003 	case IEEE80211_M_AHDEMO:
1004 	case IEEE80211_M_HOSTAP:
1005 		/* should not get there */
1006 		break;
1007 	}
1008 #undef N
1009 }
1010 
1011 static int
1012 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1013 {
1014 	struct iwi_softc *sc = ic->ic_ifp->if_softc;
1015 
1016 	switch (nstate) {
1017 	case IEEE80211_S_SCAN:
1018 		if (sc->flags & IWI_FLAG_SCANNING)
1019 			break;
1020 
1021 		ieee80211_node_table_reset(&ic->ic_scan);
1022 		ic->ic_flags |= IEEE80211_F_SCAN | IEEE80211_F_ASCAN;
1023 		sc->flags |= IWI_FLAG_SCANNING;
1024 		/* blink the led while scanning */
1025 		iwi_led_set(sc, IWI_LED_ASSOCIATED, 1);
1026 		iwi_scan(sc);
1027 		break;
1028 
1029 	case IEEE80211_S_AUTH:
1030 		iwi_auth_and_assoc(sc);
1031 		break;
1032 
1033 	case IEEE80211_S_RUN:
1034 		if (ic->ic_opmode == IEEE80211_M_IBSS)
1035 			ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
1036 		else if (ic->ic_opmode == IEEE80211_M_MONITOR)
1037 			iwi_set_chan(sc, ic->ic_ibss_chan);
1038 
1039 		return (*sc->sc_newstate)(ic, nstate,
1040 		    IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
1041 
1042 	case IEEE80211_S_ASSOC:
1043 		iwi_led_set(sc, IWI_LED_ASSOCIATED, 0);
1044 		break;
1045 
1046 	case IEEE80211_S_INIT:
1047 		sc->flags &= ~IWI_FLAG_SCANNING;
1048 		return (*sc->sc_newstate)(ic, nstate, arg);
1049 	}
1050 
1051 	ic->ic_state = nstate;
1052 	return 0;
1053 }
1054 
1055 /*
1056  * WME parameters coming from IEEE 802.11e specification.  These values are
1057  * already declared in ieee80211_proto.c, but they are static so they can't
1058  * be reused here.
1059  */
1060 static const struct wmeParams iwi_wme_cck_params[WME_NUM_AC] = {
1061 	{ 0, 3, 5,  7,   0, 0, },	/* WME_AC_BE */
1062 	{ 0, 3, 5, 10,   0, 0, },	/* WME_AC_BK */
1063 	{ 0, 2, 4,  5, 188, 0, },	/* WME_AC_VI */
1064 	{ 0, 2, 3,  4, 102, 0, },	/* WME_AC_VO */
1065 };
1066 
1067 static const struct wmeParams iwi_wme_ofdm_params[WME_NUM_AC] = {
1068 	{ 0, 3, 4,  6,   0, 0, },	/* WME_AC_BE */
1069 	{ 0, 3, 4, 10,   0, 0, },	/* WME_AC_BK */
1070 	{ 0, 2, 3,  4,  94, 0, },	/* WME_AC_VI */
1071 	{ 0, 2, 2,  3,  47, 0, },	/* WME_AC_VO */
1072 };
1073 
1074 static int
1075 iwi_wme_update(struct ieee80211com *ic)
1076 {
1077 #define IWI_EXP2(v)	htole16((1 << (v)) - 1)
1078 #define IWI_USEC(v)	htole16(IEEE80211_TXOP_TO_US(v))
1079 	struct iwi_softc *sc = ic->ic_ifp->if_softc;
1080 	struct iwi_wme_params wme[3];
1081 	const struct wmeParams *wmep;
1082 	int ac;
1083 
1084 	/*
1085 	 * We shall not override firmware default WME values if WME is not
1086 	 * actually enabled.
1087 	 */
1088 	if (!(ic->ic_flags & IEEE80211_F_WME))
1089 		return 0;
1090 
1091 	for (ac = 0; ac < WME_NUM_AC; ac++) {
1092 		/* set WME values for current operating mode */
1093 		wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
1094 		wme[0].aifsn[ac] = wmep->wmep_aifsn;
1095 		wme[0].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1096 		wme[0].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1097 		wme[0].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1098 		wme[0].acm[ac]   = wmep->wmep_acm;
1099 
1100 		/* set WME values for CCK modulation */
1101 		wmep = &iwi_wme_cck_params[ac];
1102 		wme[1].aifsn[ac] = wmep->wmep_aifsn;
1103 		wme[1].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1104 		wme[1].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1105 		wme[1].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1106 		wme[1].acm[ac]   = wmep->wmep_acm;
1107 
1108 		/* set WME values for OFDM modulation */
1109 		wmep = &iwi_wme_ofdm_params[ac];
1110 		wme[2].aifsn[ac] = wmep->wmep_aifsn;
1111 		wme[2].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1112 		wme[2].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1113 		wme[2].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1114 		wme[2].acm[ac]   = wmep->wmep_acm;
1115 	}
1116 
1117 	DPRINTF(("Setting WME parameters\n"));
1118 	return iwi_cmd(sc, IWI_CMD_SET_WME_PARAMS, wme, sizeof wme, 1);
1119 #undef IWI_USEC
1120 #undef IWI_EXP2
1121 }
1122 
1123 /*
1124  * Read 16 bits at address 'addr' from the serial EEPROM.
1125  */
1126 static uint16_t
1127 iwi_read_prom_word(struct iwi_softc *sc, uint8_t addr)
1128 {
1129 	uint32_t tmp;
1130 	uint16_t val;
1131 	int n;
1132 
1133 	/* Clock C once before the first command */
1134 	IWI_EEPROM_CTL(sc, 0);
1135 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1136 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1137 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1138 
1139 	/* Write start bit (1) */
1140 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1141 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1142 
1143 	/* Write READ opcode (10) */
1144 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1145 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1146 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1147 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1148 
1149 	/* Write address A7-A0 */
1150 	for (n = 7; n >= 0; n--) {
1151 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1152 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
1153 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1154 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
1155 	}
1156 
1157 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1158 
1159 	/* Read data Q15-Q0 */
1160 	val = 0;
1161 	for (n = 15; n >= 0; n--) {
1162 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1163 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1164 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
1165 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
1166 	}
1167 
1168 	IWI_EEPROM_CTL(sc, 0);
1169 
1170 	/* Clear Chip Select and clock C */
1171 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1172 	IWI_EEPROM_CTL(sc, 0);
1173 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
1174 
1175 	return val;
1176 }
1177 
1178 /*
1179  * XXX: Hack to set the current channel to the value advertised in beacons or
1180  * probe responses. Only used during AP detection.
1181  */
1182 static void
1183 iwi_fix_channel(struct ieee80211com *ic, struct mbuf *m)
1184 {
1185 	struct ieee80211_frame *wh;
1186 	uint8_t subtype;
1187 	uint8_t *frm, *efrm;
1188 
1189 	wh = mtod(m, struct ieee80211_frame *);
1190 
1191 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
1192 		return;
1193 
1194 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1195 
1196 	if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
1197 	    subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1198 		return;
1199 
1200 	frm = (uint8_t *)(wh + 1);
1201 	efrm = mtod(m, uint8_t *) + m->m_len;
1202 
1203 	frm += 12;	/* skip tstamp, bintval and capinfo fields */
1204 	while (frm < efrm) {
1205 		if (*frm == IEEE80211_ELEMID_DSPARMS)
1206 #if IEEE80211_CHAN_MAX < 255
1207 		if (frm[2] <= IEEE80211_CHAN_MAX)
1208 #endif
1209 			ic->ic_curchan = &ic->ic_channels[frm[2]];
1210 
1211 		frm += frm[1] + 2;
1212 	}
1213 }
1214 
1215 static struct mbuf *
1216 iwi_alloc_rx_buf(struct iwi_softc *sc)
1217 {
1218 	struct mbuf *m;
1219 
1220 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1221 	if (m == NULL) {
1222 		aprint_error("%s: could not allocate rx mbuf\n",
1223 		    sc->sc_dev.dv_xname);
1224 		return NULL;
1225 	}
1226 
1227 	MCLGET(m, M_DONTWAIT);
1228 	if (!(m->m_flags & M_EXT)) {
1229 		aprint_error("%s: could not allocate rx mbuf cluster\n",
1230 		    sc->sc_dev.dv_xname);
1231 		m_freem(m);
1232 		return NULL;
1233 	}
1234 
1235 	m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1236 	return m;
1237 }
1238 
1239 static void
1240 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_data *data, int i,
1241     struct iwi_frame *frame)
1242 {
1243 	struct ieee80211com *ic = &sc->sc_ic;
1244 	struct ifnet *ifp = ic->ic_ifp;
1245 	struct mbuf *m, *m_new;
1246 	struct ieee80211_frame *wh;
1247 	struct ieee80211_node *ni;
1248 	int error;
1249 
1250 	DPRINTFN(5, ("received frame len=%u chan=%u rssi=%u\n",
1251 	    le16toh(frame->len), frame->chan, frame->rssi_dbm));
1252 
1253 	if (le16toh(frame->len) < sizeof (struct ieee80211_frame) ||
1254 	    le16toh(frame->len) > MCLBYTES) {
1255 		DPRINTF(("%s: bad frame length\n", sc->sc_dev.dv_xname));
1256 		ifp->if_ierrors++;
1257 		return;
1258 	}
1259 
1260 	/*
1261 	 * Try to allocate a new mbuf for this ring element and
1262 	 * load it before processing the current mbuf. If the ring
1263 	 * element cannot be reloaded, drop the received packet
1264 	 * and reuse the old mbuf. In the unlikely case that
1265 	 * the old mbuf can't be reloaded either, explicitly panic.
1266 	 *
1267 	 * XXX Reorganize buffer by moving elements from the logical
1268 	 * end of the ring to the front instead of dropping.
1269 	 */
1270 	if ((m_new = iwi_alloc_rx_buf(sc)) == NULL) {
1271 		ifp->if_ierrors++;
1272 		return;
1273 	}
1274 
1275 	bus_dmamap_unload(sc->sc_dmat, data->map);
1276 
1277 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m_new,
1278 	    BUS_DMA_READ | BUS_DMA_NOWAIT);
1279 	if (error != 0) {
1280 		aprint_error("%s: could not load rx buf DMA map\n",
1281 		    sc->sc_dev.dv_xname);
1282 		m_freem(m_new);
1283 		ifp->if_ierrors++;
1284 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map,
1285 		    data->m, BUS_DMA_READ | BUS_DMA_NOWAIT);
1286 		if (error)
1287 			panic("%s: unable to remap rx buf",
1288 			    sc->sc_dev.dv_xname);
1289 		return;
1290 	}
1291 
1292 	/*
1293 	 * New mbuf successfully loaded, update RX ring and continue
1294 	 * processing.
1295 	 */
1296 	m = data->m;
1297 	data->m = m_new;
1298 	CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4, data->map->dm_segs[0].ds_addr);
1299 
1300 	/* Finalize mbuf */
1301 	m->m_pkthdr.rcvif = ifp;
1302 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
1303 	    sizeof (struct iwi_frame) + le16toh(frame->len);
1304 
1305 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
1306 
1307 	if (ic->ic_state == IEEE80211_S_SCAN)
1308 		iwi_fix_channel(ic, m);
1309 
1310 #if NBPFILTER > 0
1311 	if (sc->sc_drvbpf != NULL) {
1312 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
1313 
1314 		tap->wr_flags = 0;
1315 		tap->wr_rate = frame->rate;
1316 		tap->wr_chan_freq =
1317 		    htole16(ic->ic_channels[frame->chan].ic_freq);
1318 		tap->wr_chan_flags =
1319 		    htole16(ic->ic_channels[frame->chan].ic_flags);
1320 		tap->wr_antsignal = frame->signal;
1321 		tap->wr_antenna = frame->antenna;
1322 
1323 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
1324 	}
1325 #endif
1326 
1327 	wh = mtod(m, struct ieee80211_frame *);
1328 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
1329 
1330 	/* Send the frame to the upper layer */
1331 	ieee80211_input(ic, m, ni, frame->rssi_dbm, 0);
1332 
1333 	/* node is no longer needed */
1334 	ieee80211_free_node(ni);
1335 }
1336 
1337 static void
1338 iwi_notification_intr(struct iwi_softc *sc, struct iwi_notif *notif)
1339 {
1340 	struct ieee80211com *ic = &sc->sc_ic;
1341 	struct iwi_notif_scan_channel *chan;
1342 	struct iwi_notif_scan_complete *scan;
1343 	struct iwi_notif_authentication *auth;
1344 	struct iwi_notif_association *assoc;
1345 
1346 	switch (notif->type) {
1347 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
1348 		chan = (struct iwi_notif_scan_channel *)(notif + 1);
1349 
1350 		DPRINTFN(2, ("Finished scanning channel (%u)\n", chan->nchan));
1351 		break;
1352 
1353 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
1354 		scan = (struct iwi_notif_scan_complete *)(notif + 1);
1355 
1356 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
1357 		    scan->status));
1358 
1359 		/* monitor mode uses scan to set the channel ... */
1360 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1361 			sc->flags &= ~IWI_FLAG_SCANNING;
1362 			ieee80211_end_scan(ic);
1363 		} else
1364 			iwi_set_chan(sc, ic->ic_ibss_chan);
1365 		break;
1366 
1367 	case IWI_NOTIF_TYPE_AUTHENTICATION:
1368 		auth = (struct iwi_notif_authentication *)(notif + 1);
1369 
1370 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1371 
1372 		switch (auth->state) {
1373 		case IWI_AUTHENTICATED:
1374 			ieee80211_node_authorize(ic->ic_bss);
1375 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1376 			break;
1377 
1378 		case IWI_DEAUTHENTICATED:
1379 			break;
1380 
1381 		default:
1382 			aprint_error("%s: unknown authentication state %u\n",
1383 			    sc->sc_dev.dv_xname, auth->state);
1384 		}
1385 		break;
1386 
1387 	case IWI_NOTIF_TYPE_ASSOCIATION:
1388 		assoc = (struct iwi_notif_association *)(notif + 1);
1389 
1390 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1391 		    assoc->status));
1392 
1393 		switch (assoc->state) {
1394 		case IWI_AUTHENTICATED:
1395 			/* re-association, do nothing */
1396 			break;
1397 
1398 		case IWI_ASSOCIATED:
1399 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1400 			break;
1401 
1402 		case IWI_DEASSOCIATED:
1403 			ieee80211_begin_scan(ic, 1);
1404 			break;
1405 
1406 		default:
1407 			aprint_error("%s: unknown association state %u\n",
1408 			    sc->sc_dev.dv_xname, assoc->state);
1409 		}
1410 		break;
1411 
1412 	case IWI_NOTIF_TYPE_CALIBRATION:
1413 	case IWI_NOTIF_TYPE_BEACON:
1414 	case IWI_NOTIF_TYPE_NOISE:
1415 		DPRINTFN(5, ("Notification (%u)\n", notif->type));
1416 		break;
1417 
1418 	default:
1419 		aprint_error("%s: unknown notification type %u\n",
1420 		    sc->sc_dev.dv_xname, notif->type);
1421 	}
1422 }
1423 
1424 static void
1425 iwi_cmd_intr(struct iwi_softc *sc)
1426 {
1427 	uint32_t hw;
1428 
1429 	hw = CSR_READ_4(sc, IWI_CSR_CMD_RIDX);
1430 
1431 	for (; sc->cmdq.next != hw;) {
1432 		bus_dmamap_sync(sc->sc_dmat, sc->cmdq.desc_map,
1433 		    sc->cmdq.next * IWI_CMD_DESC_SIZE, IWI_CMD_DESC_SIZE,
1434 		    BUS_DMASYNC_POSTWRITE);
1435 
1436 		wakeup(&sc->cmdq.desc[sc->cmdq.next]);
1437 		sc->cmdq.next = (sc->cmdq.next + 1) % sc->cmdq.count;
1438 	}
1439 }
1440 
1441 static void
1442 iwi_rx_intr(struct iwi_softc *sc)
1443 {
1444 	struct iwi_rx_data *data;
1445 	struct iwi_hdr *hdr;
1446 	uint32_t hw;
1447 
1448 	hw = CSR_READ_4(sc, IWI_CSR_RX_RIDX);
1449 
1450 	for (; sc->rxq.cur != hw;) {
1451 		data = &sc->rxq.data[sc->rxq.cur];
1452 
1453 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1454 		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1455 
1456 		hdr = mtod(data->m, struct iwi_hdr *);
1457 
1458 		switch (hdr->type) {
1459 		case IWI_HDR_TYPE_FRAME:
1460 			iwi_frame_intr(sc, data, sc->rxq.cur,
1461 			    (struct iwi_frame *)(hdr + 1));
1462 			break;
1463 
1464 		case IWI_HDR_TYPE_NOTIF:
1465 			iwi_notification_intr(sc,
1466 			    (struct iwi_notif *)(hdr + 1));
1467 			break;
1468 
1469 		default:
1470 			aprint_error("%s: unknown hdr type %u\n",
1471 			    sc->sc_dev.dv_xname, hdr->type);
1472 		}
1473 
1474 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1475 		    data->map->dm_mapsize, BUS_DMASYNC_PREREAD);
1476 
1477 		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1478 
1479 		sc->rxq.cur = (sc->rxq.cur + 1) % sc->rxq.count;
1480 	}
1481 
1482 
1483 	/* Tell the firmware what we have processed */
1484 	hw = (hw == 0) ? sc->rxq.count - 1 : hw - 1;
1485 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, hw);
1486 }
1487 
1488 static void
1489 iwi_tx_intr(struct iwi_softc *sc, struct iwi_tx_ring *txq)
1490 {
1491 	struct ifnet *ifp = &sc->sc_if;
1492 	struct iwi_tx_data *data;
1493 	uint32_t hw;
1494 
1495 	hw = CSR_READ_4(sc, txq->csr_ridx);
1496 
1497 	for (; txq->next != hw;) {
1498 		data = &txq->data[txq->next];
1499 
1500 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1501 		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1502 		bus_dmamap_unload(sc->sc_dmat, data->map);
1503 		m_freem(data->m);
1504 		data->m = NULL;
1505 		ieee80211_free_node(data->ni);
1506 		data->ni = NULL;
1507 
1508 		DPRINTFN(15, ("tx done idx=%u\n", txq->next));
1509 
1510 		ifp->if_opackets++;
1511 
1512 		txq->queued--;
1513 		txq->next = (txq->next + 1) % txq->count;
1514 	}
1515 
1516 	sc->sc_tx_timer = 0;
1517 	ifp->if_flags &= ~IFF_OACTIVE;
1518 
1519 	/* Call start() since some buffer descriptors have been released */
1520 	(*ifp->if_start)(ifp);
1521 }
1522 
1523 static int
1524 iwi_intr(void *arg)
1525 {
1526 	struct iwi_softc *sc = arg;
1527 	uint32_t r;
1528 
1529 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff)
1530 		return 0;
1531 
1532 	/* Acknowledge interrupts */
1533 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1534 
1535 	if (r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)) {
1536 		aprint_error("%s: fatal error\n", sc->sc_dev.dv_xname);
1537 		if (r & IWI_INTR_FATAL_ERROR)
1538 			iwi_error_log(sc);
1539 		sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1540 		iwi_stop(&sc->sc_if, 1);
1541 		return (1);
1542 	}
1543 
1544 	if (r & IWI_INTR_FW_INITED) {
1545 		if (!(r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)))
1546 			wakeup(sc);
1547 	}
1548 
1549 	if (r & IWI_INTR_RADIO_OFF) {
1550 		DPRINTF(("radio transmitter off\n"));
1551 		sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1552 		iwi_stop(&sc->sc_if, 1);
1553 		return (1);
1554 	}
1555 
1556 	if (r & IWI_INTR_CMD_DONE)
1557 		iwi_cmd_intr(sc);
1558 
1559 	if (r & IWI_INTR_TX1_DONE)
1560 		iwi_tx_intr(sc, &sc->txq[0]);
1561 
1562 	if (r & IWI_INTR_TX2_DONE)
1563 		iwi_tx_intr(sc, &sc->txq[1]);
1564 
1565 	if (r & IWI_INTR_TX3_DONE)
1566 		iwi_tx_intr(sc, &sc->txq[2]);
1567 
1568 	if (r & IWI_INTR_TX4_DONE)
1569 		iwi_tx_intr(sc, &sc->txq[3]);
1570 
1571 	if (r & IWI_INTR_RX_DONE)
1572 		iwi_rx_intr(sc);
1573 
1574 	return 1;
1575 }
1576 
1577 static int
1578 iwi_cmd(struct iwi_softc *sc, uint8_t type, void *data, uint8_t len,
1579     int async)
1580 {
1581 	struct iwi_cmd_desc *desc;
1582 
1583 	desc = &sc->cmdq.desc[sc->cmdq.cur];
1584 
1585 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1586 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1587 	desc->type = type;
1588 	desc->len = len;
1589 	memcpy(desc->data, data, len);
1590 
1591 	bus_dmamap_sync(sc->sc_dmat, sc->cmdq.desc_map,
1592 	    sc->cmdq.cur * IWI_CMD_DESC_SIZE,
1593 	    IWI_CMD_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1594 
1595 	DPRINTFN(2, ("sending command idx=%u type=%u len=%u\n", sc->cmdq.cur,
1596 	    type, len));
1597 
1598 	sc->cmdq.cur = (sc->cmdq.cur + 1) % sc->cmdq.count;
1599 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
1600 
1601 	return async ? 0 : tsleep(desc, 0, "iwicmd", hz);
1602 }
1603 
1604 static void
1605 iwi_write_ibssnode(struct iwi_softc *sc, const struct iwi_node *in)
1606 {
1607 	struct iwi_ibssnode node;
1608 
1609 	/* write node information into NIC memory */
1610 	memset(&node, 0, sizeof node);
1611 	IEEE80211_ADDR_COPY(node.bssid, in->in_node.ni_macaddr);
1612 
1613 	CSR_WRITE_REGION_1(sc,
1614 	    IWI_CSR_NODE_BASE + in->in_station * sizeof node,
1615 	    (uint8_t *)&node, sizeof node);
1616 }
1617 
1618 static int
1619 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni,
1620     int ac)
1621 {
1622 	struct iwi_softc *sc = ifp->if_softc;
1623 	struct ieee80211com *ic = &sc->sc_ic;
1624 	struct iwi_node *in = (struct iwi_node *)ni;
1625 	struct ieee80211_frame *wh;
1626 	struct ieee80211_key *k;
1627 	const struct chanAccParams *cap;
1628 	struct iwi_tx_ring *txq = &sc->txq[ac];
1629 	struct iwi_tx_data *data;
1630 	struct iwi_tx_desc *desc;
1631 	struct mbuf *mnew;
1632 	int error, hdrlen, i, noack = 0;
1633 
1634 	wh = mtod(m0, struct ieee80211_frame *);
1635 
1636 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1637 		hdrlen = sizeof (struct ieee80211_qosframe);
1638 		cap = &ic->ic_wme.wme_chanParams;
1639 		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1640 	} else
1641 		hdrlen = sizeof (struct ieee80211_frame);
1642 
1643 	/*
1644 	 * This is only used in IBSS mode where the firmware expect an index
1645 	 * in a h/w table instead of a destination address.
1646 	 */
1647 	if (ic->ic_opmode == IEEE80211_M_IBSS && in->in_station == -1) {
1648 		in->in_station = iwi_alloc_unr(sc);
1649 
1650 		if (in->in_station == -1) {	/* h/w table is full */
1651 			m_freem(m0);
1652 			ieee80211_free_node(ni);
1653 			ifp->if_oerrors++;
1654 			return 0;
1655 		}
1656 		iwi_write_ibssnode(sc, in);
1657 	}
1658 
1659 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1660 		k = ieee80211_crypto_encap(ic, ni, m0);
1661 		if (k == NULL) {
1662 			m_freem(m0);
1663 			return ENOBUFS;
1664 		}
1665 
1666 		/* packet header may have moved, reset our local pointer */
1667 		wh = mtod(m0, struct ieee80211_frame *);
1668 	}
1669 
1670 #if NBPFILTER > 0
1671 	if (sc->sc_drvbpf != NULL) {
1672 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1673 
1674 		tap->wt_flags = 0;
1675 		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1676 		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1677 
1678 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1679 	}
1680 #endif
1681 
1682 	data = &txq->data[txq->cur];
1683 	desc = &txq->desc[txq->cur];
1684 
1685 	/* save and trim IEEE802.11 header */
1686 	m_copydata(m0, 0, hdrlen, (caddr_t)&desc->wh);
1687 	m_adj(m0, hdrlen);
1688 
1689 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1690 	    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
1691 	if (error != 0 && error != EFBIG) {
1692 		aprint_error("%s: could not map mbuf (error %d)\n",
1693 		    sc->sc_dev.dv_xname, error);
1694 		m_freem(m0);
1695 		return error;
1696 	}
1697 	if (error != 0) {
1698 		/* too many fragments, linearize */
1699 
1700 		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1701 		if (mnew == NULL) {
1702 			m_freem(m0);
1703 			return ENOMEM;
1704 		}
1705 
1706 		M_COPY_PKTHDR(mnew, m0);
1707 
1708 		/* If the data won't fit in the header, get a cluster */
1709 		if (m0->m_pkthdr.len > MHLEN) {
1710 			MCLGET(mnew, M_DONTWAIT);
1711 			if (!(mnew->m_flags & M_EXT)) {
1712 				m_freem(m0);
1713 				m_freem(mnew);
1714 				return ENOMEM;
1715 			}
1716 		}
1717 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(mnew, caddr_t));
1718 		m_freem(m0);
1719 		mnew->m_len = mnew->m_pkthdr.len;
1720 		m0 = mnew;
1721 
1722 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1723 		    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
1724 		if (error != 0) {
1725 			aprint_error("%s: could not map mbuf (error %d)\n",
1726 			    sc->sc_dev.dv_xname, error);
1727 			m_freem(m0);
1728 			return error;
1729 		}
1730 	}
1731 
1732 	data->m = m0;
1733 	data->ni = ni;
1734 
1735 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1736 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1737 	desc->station =
1738 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? in->in_station : 0;
1739 	desc->cmd = IWI_DATA_CMD_TX;
1740 	desc->len = htole16(m0->m_pkthdr.len);
1741 	desc->flags = 0;
1742 	desc->xflags = 0;
1743 
1744 	if (!noack && !IEEE80211_IS_MULTICAST(desc->wh.i_addr1))
1745 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1746 
1747 #if 0
1748 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
1749 		desc->wh.i_fc[1] |= IEEE80211_FC1_WEP;
1750 		desc->wep_txkey = ic->ic_crypto.cs_def_txkey;
1751 	} else
1752 #endif
1753 		desc->flags |= IWI_DATA_FLAG_NO_WEP;
1754 
1755 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1756 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1757 
1758 	if (desc->wh.i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS)
1759 		desc->xflags |= IWI_DATA_XFLAG_QOS;
1760 
1761 	desc->nseg = htole32(data->map->dm_nsegs);
1762 	for (i = 0; i < data->map->dm_nsegs; i++) {
1763 		desc->seg_addr[i] = htole32(data->map->dm_segs[i].ds_addr);
1764 		desc->seg_len[i]  = htole16(data->map->dm_segs[i].ds_len);
1765 	}
1766 
1767 	bus_dmamap_sync(sc->sc_dmat, txq->desc_map,
1768 	    txq->cur * IWI_TX_DESC_SIZE,
1769 	    IWI_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1770 
1771 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1772 	    BUS_DMASYNC_PREWRITE);
1773 
1774 	DPRINTFN(5, ("sending data frame txq=%u idx=%u len=%u nseg=%u\n",
1775 	    ac, txq->cur, le16toh(desc->len), le32toh(desc->nseg)));
1776 
1777 	/* Inform firmware about this new packet */
1778 	txq->queued++;
1779 	txq->cur = (txq->cur + 1) % txq->count;
1780 	CSR_WRITE_4(sc, txq->csr_widx, txq->cur);
1781 
1782 	return 0;
1783 }
1784 
1785 static void
1786 iwi_start(struct ifnet *ifp)
1787 {
1788 	struct iwi_softc *sc = ifp->if_softc;
1789 	struct ieee80211com *ic = &sc->sc_ic;
1790 	struct mbuf *m0;
1791 	struct ether_header *eh;
1792 	struct ieee80211_node *ni;
1793 	int ac;
1794 
1795 	if (ic->ic_state != IEEE80211_S_RUN)
1796 		return;
1797 
1798 	for (;;) {
1799 		IF_DEQUEUE(&ifp->if_snd, m0);
1800 		if (m0 == NULL)
1801 			break;
1802 
1803 		if (m0->m_len < sizeof (struct ether_header) &&
1804 		    (m0 = m_pullup(m0, sizeof (struct ether_header))) == NULL) {
1805 			ifp->if_oerrors++;
1806 			continue;
1807 		}
1808 
1809 		eh = mtod(m0, struct ether_header *);
1810 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1811 		if (ni == NULL) {
1812 			m_freem(m0);
1813 			ifp->if_oerrors++;
1814 			continue;
1815 		}
1816 
1817 		/* classify mbuf so we can find which tx ring to use */
1818 		if (ieee80211_classify(ic, m0, ni) != 0) {
1819 			m_freem(m0);
1820 			ieee80211_free_node(ni);
1821 			ifp->if_oerrors++;
1822 			continue;
1823 		}
1824 
1825 		/* no QoS encapsulation for EAPOL frames */
1826 		ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
1827 		    M_WME_GETAC(m0) : WME_AC_BE;
1828 
1829 		if (sc->txq[ac].queued > sc->txq[ac].count - 8) {
1830 			/* there is no place left in this ring */
1831 			IF_PREPEND(&ifp->if_snd, m0);
1832 			ifp->if_flags |= IFF_OACTIVE;
1833 			break;
1834 		}
1835 
1836 #if NBPFILTER > 0
1837 		if (ifp->if_bpf != NULL)
1838 			bpf_mtap(ifp->if_bpf, m0);
1839 #endif
1840 
1841 		m0 = ieee80211_encap(ic, m0, ni);
1842 		if (m0 == NULL) {
1843 			ieee80211_free_node(ni);
1844 			ifp->if_oerrors++;
1845 			continue;
1846 		}
1847 
1848 #if NBPFILTER > 0
1849 		if (ic->ic_rawbpf != NULL)
1850 			bpf_mtap(ic->ic_rawbpf, m0);
1851 #endif
1852 
1853 		if (iwi_tx_start(ifp, m0, ni, ac) != 0) {
1854 			ieee80211_free_node(ni);
1855 			ifp->if_oerrors++;
1856 			break;
1857 		}
1858 
1859 		/* start watchdog timer */
1860 		sc->sc_tx_timer = 5;
1861 		ifp->if_timer = 1;
1862 	}
1863 }
1864 
1865 static void
1866 iwi_watchdog(struct ifnet *ifp)
1867 {
1868 	struct iwi_softc *sc = ifp->if_softc;
1869 
1870 	ifp->if_timer = 0;
1871 
1872 	if (sc->sc_tx_timer > 0) {
1873 		if (--sc->sc_tx_timer == 0) {
1874 			aprint_error("%s: device timeout\n",
1875 			    sc->sc_dev.dv_xname);
1876 			ifp->if_oerrors++;
1877 			ifp->if_flags &= ~IFF_UP;
1878 			iwi_stop(ifp, 1);
1879 			return;
1880 		}
1881 		ifp->if_timer = 1;
1882 	}
1883 
1884 	ieee80211_watchdog(&sc->sc_ic);
1885 }
1886 
1887 static int
1888 iwi_get_table0(struct iwi_softc *sc, uint32_t *tbl)
1889 {
1890 	uint32_t size, buf[128];
1891 
1892 	if (!(sc->flags & IWI_FLAG_FW_INITED)) {
1893 		memset(buf, 0, sizeof buf);
1894 		return copyout(buf, tbl, sizeof buf);
1895 	}
1896 
1897 	size = min(CSR_READ_4(sc, IWI_CSR_TABLE0_SIZE), 128 - 1);
1898 	CSR_READ_REGION_4(sc, IWI_CSR_TABLE0_BASE, &buf[1], size);
1899 
1900 	return copyout(buf, tbl, sizeof buf);
1901 }
1902 
1903 static int
1904 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1905 {
1906 #define	IS_RUNNING(ifp) \
1907 	((ifp->if_flags & IFF_UP) && (ifp->if_flags & IFF_RUNNING))
1908 
1909 	struct iwi_softc *sc = ifp->if_softc;
1910 	struct ieee80211com *ic = &sc->sc_ic;
1911 	struct ifreq *ifr = (struct ifreq *)data;
1912 	int s, error = 0;
1913 	int val;
1914 
1915 	s = splnet();
1916 
1917 	switch (cmd) {
1918 	case SIOCSIFFLAGS:
1919 		if (ifp->if_flags & IFF_UP) {
1920 			if (!(ifp->if_flags & IFF_RUNNING))
1921 				iwi_init(ifp);
1922 		} else {
1923 			if (ifp->if_flags & IFF_RUNNING)
1924 				iwi_stop(ifp, 1);
1925 		}
1926 		break;
1927 
1928 	case SIOCADDMULTI:
1929 	case SIOCDELMULTI:
1930 		error = (cmd == SIOCADDMULTI) ?
1931 		    ether_addmulti(ifr, &sc->sc_ec) :
1932 		    ether_delmulti(ifr, &sc->sc_ec);
1933 		if (error == ENETRESET) {
1934 			/* setup multicast filter, etc */
1935 			error = 0;
1936 		}
1937 		break;
1938 
1939 	case SIOCGTABLE0:
1940 		error = iwi_get_table0(sc, (uint32_t *)ifr->ifr_data);
1941 		break;
1942 
1943 	case SIOCGRADIO:
1944 		val = !iwi_getrfkill(sc);
1945 		error = copyout(&val, (int *)ifr->ifr_data, sizeof val);
1946 		break;
1947 
1948 	case SIOCSIFMEDIA:
1949 		if (ifr->ifr_media & IFM_IEEE80211_ADHOC) {
1950 			sc->sc_fwname = "iwi-ibss.fw";
1951 			sc->sc_ucname = "iwi-ucode-ibss.fw";
1952 		} else if (ifr->ifr_media & IFM_IEEE80211_MONITOR) {
1953 			sc->sc_fwname = "iwi-sniffer.fw";
1954 			sc->sc_ucname = "iwi-ucode-sniffer.fw";
1955 		} else {
1956 			sc->sc_fwname = "iwi-bss.fw";
1957 			sc->sc_ucname = "iwi-ucode-bss.fw";
1958 		}
1959 		error = iwi_cache_firmware(sc);
1960 		if (error)
1961  			break;
1962  		/* FALLTRHOUGH */
1963 
1964 	default:
1965 		error = ieee80211_ioctl(&sc->sc_ic, cmd, data);
1966 
1967 		if (error == ENETRESET) {
1968 			if (IS_RUNNING(ifp) &&
1969 			    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
1970 				iwi_init(ifp);
1971 			error = 0;
1972 		}
1973 	}
1974 
1975 	splx(s);
1976 	return error;
1977 #undef IS_RUNNING
1978 }
1979 
1980 static void
1981 iwi_stop_master(struct iwi_softc *sc)
1982 {
1983 	int ntries;
1984 
1985 	/* Disable interrupts */
1986 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1987 
1988 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1989 	for (ntries = 0; ntries < 5; ntries++) {
1990 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1991 			break;
1992 		DELAY(10);
1993 	}
1994 	if (ntries == 5)
1995 		aprint_error("%s: timeout waiting for master\n",
1996 		    sc->sc_dev.dv_xname);
1997 
1998 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1999 	    IWI_RST_PRINCETON_RESET);
2000 
2001 	sc->flags &= ~IWI_FLAG_FW_INITED;
2002 }
2003 
2004 static int
2005 iwi_reset(struct iwi_softc *sc)
2006 {
2007 	int i, ntries;
2008 
2009 	iwi_stop_master(sc);
2010 
2011 	/* Move adapter to D0 state */
2012 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
2013 	    IWI_CTL_INIT);
2014 
2015 	/* Initialize Phase-Locked Level  (PLL) */
2016 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
2017 
2018 	/* Wait for clock stabilization */
2019 	for (ntries = 0; ntries < 1000; ntries++) {
2020 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
2021 			break;
2022 		DELAY(200);
2023 	}
2024 	if (ntries == 1000) {
2025 		aprint_error("%s: timeout waiting for clock stabilization\n",
2026 		    sc->sc_dev.dv_xname);
2027 		return EIO;
2028 	}
2029 
2030 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
2031 	    IWI_RST_SW_RESET);
2032 
2033 	DELAY(10);
2034 
2035 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
2036 	    IWI_CTL_INIT);
2037 
2038 	/* Clear NIC memory */
2039 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
2040 	for (i = 0; i < 0xc000; i++)
2041 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2042 
2043 	return 0;
2044 }
2045 
2046 static int
2047 iwi_load_ucode(struct iwi_softc *sc, void *uc, int size)
2048 {
2049 	uint16_t *w;
2050 	int ntries, i;
2051 
2052 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
2053 	    IWI_RST_STOP_MASTER);
2054 	for (ntries = 0; ntries < 5; ntries++) {
2055 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
2056 			break;
2057 		DELAY(10);
2058 	}
2059 	if (ntries == 5) {
2060 		aprint_error("%s: timeout waiting for master\n",
2061 		    sc->sc_dev.dv_xname);
2062 		return EIO;
2063 	}
2064 
2065 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
2066 	DELAY(5000);
2067 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2068 	    ~IWI_RST_PRINCETON_RESET);
2069 	DELAY(5000);
2070 	MEM_WRITE_4(sc, 0x3000e0, 0);
2071 	DELAY(1000);
2072 	MEM_WRITE_4(sc, 0x300004, 1);
2073 	DELAY(1000);
2074 	MEM_WRITE_4(sc, 0x300004, 0);
2075 	DELAY(1000);
2076 	MEM_WRITE_1(sc, 0x200000, 0x00);
2077 	MEM_WRITE_1(sc, 0x200000, 0x40);
2078 	DELAY(1000);
2079 
2080 	/* Adapter is buggy, we must set the address for each word */
2081 	for (w = uc; size > 0; w++, size -= 2)
2082 		MEM_WRITE_2(sc, 0x200010, htole16(*w));
2083 
2084 	MEM_WRITE_1(sc, 0x200000, 0x00);
2085 	MEM_WRITE_1(sc, 0x200000, 0x80);
2086 
2087 	/* Wait until we get a response in the uc queue */
2088 	for (ntries = 0; ntries < 100; ntries++) {
2089 		if (MEM_READ_1(sc, 0x200000) & 1)
2090 			break;
2091 		DELAY(100);
2092 	}
2093 	if (ntries == 100) {
2094 		aprint_error("%s: timeout waiting for ucode to initialize\n",
2095 		    sc->sc_dev.dv_xname);
2096 		return EIO;
2097 	}
2098 
2099 	/* Empty the uc queue or the firmware will not initialize properly */
2100 	for (i = 0; i < 7; i++)
2101 		MEM_READ_4(sc, 0x200004);
2102 
2103 	MEM_WRITE_1(sc, 0x200000, 0x00);
2104 
2105 	return 0;
2106 }
2107 
2108 /* macro to handle unaligned little endian data in firmware image */
2109 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
2110 static int
2111 iwi_load_firmware(struct iwi_softc *sc, void *fw, int size)
2112 {
2113 	bus_dmamap_t map;
2114 	u_char *p, *end;
2115 	uint32_t sentinel, ctl, sum;
2116 	uint32_t cs, sl, cd, cl;
2117 	int ntries, nsegs, error;
2118 	int sn;
2119 
2120 	nsegs = (size + PAGE_SIZE - 1) / PAGE_SIZE;
2121 
2122 	/* Create a DMA map for the firmware image */
2123 	error = bus_dmamap_create(sc->sc_dmat, size, nsegs, size, 0,
2124 	    BUS_DMA_NOWAIT, &map);
2125 	if (error != 0) {
2126 		aprint_error("%s: could not create firmware DMA map\n",
2127 		    sc->sc_dev.dv_xname);
2128 		goto fail1;
2129 	}
2130 
2131 	error = bus_dmamap_load(sc->sc_dmat, map, fw, size, NULL,
2132 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2133 	if (error != 0) {
2134 		aprint_error("%s: could not load fw dma map(%d)\n",
2135 		    sc->sc_dev.dv_xname, error);
2136 		goto fail2;
2137 	}
2138 
2139 	/* Make sure the adapter will get up-to-date values */
2140 	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_PREWRITE);
2141 
2142 	/* Tell the adapter where the command blocks are stored */
2143 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
2144 
2145 	/*
2146 	 * Store command blocks into adapter's internal memory using register
2147 	 * indirections. The adapter will read the firmware image through DMA
2148 	 * using information stored in command blocks.
2149 	 */
2150 	p = fw;
2151 	end = p + size;
2152 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
2153 
2154 	sn = 0;
2155 	sl = cl = 0;
2156 	cs = cd = 0;
2157 	while (p < end) {
2158 		if (sl == 0) {
2159 			cs = map->dm_segs[sn].ds_addr;
2160 			sl = map->dm_segs[sn].ds_len;
2161 			sn++;
2162 		}
2163 		if (cl == 0) {
2164 			cd = GETLE32(p); p += 4; cs += 4; sl -= 4;
2165 			cl = GETLE32(p); p += 4; cs += 4; sl -= 4;
2166 		}
2167 		while (sl > 0 && cl > 0) {
2168 			int len = min(cl, sl);
2169 
2170 			sl -= len;
2171 			cl -= len;
2172 			p += len;
2173 
2174 			while (len > 0) {
2175 				int mlen = min(len, IWI_CB_MAXDATALEN);
2176 
2177 				ctl = IWI_CB_DEFAULT_CTL | mlen;
2178 				sum = ctl ^ cs ^ cd;
2179 
2180 				/* Write a command block */
2181 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
2182 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, cs);
2183 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, cd);
2184 				CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
2185 
2186 				cs += mlen;
2187 				cd += mlen;
2188 				len -= mlen;
2189 			}
2190 		}
2191 	}
2192 
2193 	/* Write a fictive final command block (sentinel) */
2194 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
2195 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2196 
2197 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2198 	    ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER));
2199 
2200 	/* Tell the adapter to start processing command blocks */
2201 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
2202 
2203 	/* Wait until the adapter has processed all command blocks */
2204 	for (ntries = 0; ntries < 400; ntries++) {
2205 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
2206 			break;
2207 		DELAY(100);
2208 	}
2209 	if (ntries == 400) {
2210 		aprint_error("%s: timeout processing cb\n",
2211 		    sc->sc_dev.dv_xname);
2212 		error = EIO;
2213 		goto fail3;
2214 	}
2215 
2216 	/* We're done with command blocks processing */
2217 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
2218 
2219 	/* Allow interrupts so we know when the firmware is inited */
2220 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
2221 
2222 	/* Tell the adapter to initialize the firmware */
2223 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
2224 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
2225 	    IWI_CTL_ALLOW_STANDBY);
2226 
2227 	/* Wait at most one second for firmware initialization to complete */
2228 	if ((error = tsleep(sc, 0, "iwiinit", hz)) != 0) {
2229 		aprint_error("%s: timeout waiting for firmware initialization "
2230 		    "to complete\n", sc->sc_dev.dv_xname);
2231 		goto fail3;
2232 	}
2233 
2234 fail3:
2235 	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_POSTWRITE);
2236 	bus_dmamap_unload(sc->sc_dmat, map);
2237 fail2:
2238 	bus_dmamap_destroy(sc->sc_dmat, map);
2239 
2240 fail1:
2241 	return error;
2242 }
2243 
2244 /*
2245  * Store firmware into kernel memory so we can download it when we need to,
2246  * e.g when the adapter wakes up from suspend mode.
2247  */
2248 static int
2249 iwi_cache_firmware(struct iwi_softc *sc)
2250 {
2251 	struct iwi_firmware *kfw = &sc->fw;
2252 	firmware_handle_t fwh;
2253 	int error;
2254 
2255 	iwi_free_firmware(sc);
2256 	error = firmware_open("if_iwi", "iwi-boot.fw", &fwh);
2257 	if (error != 0)
2258 		goto fail1;
2259 
2260 	kfw->boot_size = firmware_get_size(fwh);
2261 	kfw->boot = firmware_malloc(kfw->boot_size);
2262 	if (kfw->boot == NULL) {
2263 		error = ENOMEM;
2264 		firmware_close(fwh);
2265 		goto fail1;
2266 	}
2267 
2268 	error = firmware_read(fwh, sizeof(struct iwi_firmware_hdr),
2269 	    kfw->boot, kfw->boot_size - sizeof(struct iwi_firmware_hdr));
2270 	firmware_close(fwh);
2271 	if (error != 0)
2272 		goto fail2;
2273 
2274 	error = firmware_open("if_iwi", sc->sc_ucname, &fwh);
2275 	if (error != 0)
2276 		goto fail2;
2277 
2278 	kfw->ucode_size = firmware_get_size(fwh);
2279 	kfw->ucode = firmware_malloc(kfw->ucode_size);
2280 	if (kfw->ucode == NULL) {
2281 		error = ENOMEM;
2282 		firmware_close(fwh);
2283 		goto fail2;
2284 	}
2285 
2286 	error = firmware_read(fwh, sizeof(struct iwi_firmware_hdr),
2287 	    kfw->ucode, kfw->ucode_size - sizeof(struct iwi_firmware_hdr));
2288 	firmware_close(fwh);
2289 	if (error != 0)
2290 		goto fail3;
2291 
2292 	error = firmware_open("if_iwi", sc->sc_fwname, &fwh);
2293 	if (error != 0)
2294 		goto fail3;
2295 
2296 	kfw->main_size = firmware_get_size(fwh);
2297 	kfw->main = firmware_malloc(kfw->main_size);
2298 	if (kfw->main == NULL) {
2299 		error = ENOMEM;
2300 		goto fail3;
2301 	}
2302 
2303 	error = firmware_read(fwh, sizeof(struct iwi_firmware_hdr),
2304 	     kfw->main, kfw->main_size - sizeof(struct iwi_firmware_hdr));
2305 	firmware_close(fwh);
2306 	if (error != 0)
2307 		goto fail4;
2308 
2309 	DPRINTF(("Firmware cached: boot %u, ucode %u, main %u\n",
2310 	    kfw->boot_size, kfw->ucode_size, kfw->main_size));
2311 
2312 	sc->flags |= IWI_FLAG_FW_CACHED;
2313 
2314 	return 0;
2315 
2316 fail4:	firmware_free(kfw->main, 0);
2317 fail3:	firmware_free(kfw->ucode, 0);
2318 fail2:	firmware_free(kfw->boot, 0);
2319 fail1:
2320 	return error;
2321 }
2322 
2323 static void
2324 iwi_free_firmware(struct iwi_softc *sc)
2325 {
2326 	struct iwi_firmware *kfw = &sc->fw;
2327 
2328 	if (!(sc->flags & IWI_FLAG_FW_CACHED))
2329 		return;
2330 
2331 	firmware_free(kfw->main, 0);
2332 	firmware_free(kfw->ucode, 0);
2333 	firmware_free(kfw->boot, 0);
2334 
2335 	sc->flags &= ~IWI_FLAG_FW_CACHED;
2336 }
2337 
2338 static int
2339 iwi_config(struct iwi_softc *sc)
2340 {
2341 	struct ieee80211com *ic = &sc->sc_ic;
2342 	struct ifnet *ifp = &sc->sc_if;
2343 	struct iwi_configuration config;
2344 	struct iwi_rateset rs;
2345 	struct iwi_txpower power;
2346 	struct ieee80211_key *wk;
2347 	struct iwi_wep_key wepkey;
2348 	uint32_t data;
2349 	int error, i;
2350 
2351 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2352 	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
2353 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
2354 	    IEEE80211_ADDR_LEN, 0);
2355 	if (error != 0)
2356 		return error;
2357 
2358 	memset(&config, 0, sizeof config);
2359 	config.bluetooth_coexistence = sc->bluetooth;
2360 	config.antenna = sc->antenna;
2361 	config.multicast_enabled = 1;
2362 	config.answer_pbreq = (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2363 	config.disable_unicast_decryption = 1;
2364 	config.disable_multicast_decryption = 1;
2365 	DPRINTF(("Configuring adapter\n"));
2366 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIGURATION, &config, sizeof config,
2367 	    0);
2368 	if (error != 0)
2369 		return error;
2370 
2371 	data = htole32(IWI_POWER_MODE_CAM);
2372 	DPRINTF(("Setting power mode to %u\n", le32toh(data)));
2373 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
2374 	if (error != 0)
2375 		return error;
2376 
2377 	data = htole32(ic->ic_rtsthreshold);
2378 	DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
2379 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
2380 	if (error != 0)
2381 		return error;
2382 
2383 	data = htole32(ic->ic_fragthreshold);
2384 	DPRINTF(("Setting fragmentation threshold to %u\n", le32toh(data)));
2385 	error = iwi_cmd(sc, IWI_CMD_SET_FRAG_THRESHOLD, &data, sizeof data, 0);
2386 	if (error != 0)
2387 		return error;
2388 
2389 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
2390 		power.mode = IWI_MODE_11B;
2391 		power.nchan = 11;
2392 		for (i = 0; i < 11; i++) {
2393 			power.chan[i].chan = i + 1;
2394 			power.chan[i].power = IWI_TXPOWER_MAX;
2395 		}
2396 		DPRINTF(("Setting .11b channels tx power\n"));
2397 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2398 		    0);
2399 		if (error != 0)
2400 			return error;
2401 
2402 		power.mode = IWI_MODE_11G;
2403 		DPRINTF(("Setting .11g channels tx power\n"));
2404 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2405 		    0);
2406 		if (error != 0)
2407 			return error;
2408 	}
2409 
2410 	rs.mode = IWI_MODE_11G;
2411 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2412 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
2413 	memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates,
2414 	    rs.nrates);
2415 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
2416 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2417 	if (error != 0)
2418 		return error;
2419 
2420 	rs.mode = IWI_MODE_11A;
2421 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2422 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
2423 	memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates,
2424 	    rs.nrates);
2425 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
2426 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2427 	if (error != 0)
2428 		return error;
2429 
2430 	/* if we have a desired ESSID, set it now */
2431 	if (ic->ic_des_esslen != 0) {
2432 #ifdef IWI_DEBUG
2433 		if (iwi_debug > 0) {
2434 			printf("Setting desired ESSID to ");
2435 			ieee80211_print_essid(ic->ic_des_essid,
2436 			    ic->ic_des_esslen);
2437 			printf("\n");
2438 		}
2439 #endif
2440 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ic->ic_des_essid,
2441 		    ic->ic_des_esslen, 0);
2442 		if (error != 0)
2443 			return error;
2444 	}
2445 
2446 	data = htole32(arc4random());
2447 	DPRINTF(("Setting initialization vector to %u\n", le32toh(data)));
2448 	error = iwi_cmd(sc, IWI_CMD_SET_IV, &data, sizeof data, 0);
2449 	if (error != 0)
2450 		return error;
2451 
2452 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2453 		wk = &ic->ic_crypto.cs_nw_keys[i];
2454 
2455 		wepkey.cmd = IWI_WEP_KEY_CMD_SETKEY;
2456 		wepkey.idx = i;
2457 		wepkey.len = wk->wk_keylen;
2458 		memset(wepkey.key, 0, sizeof wepkey.key);
2459 		memcpy(wepkey.key, wk->wk_key, wk->wk_keylen);
2460 		DPRINTF(("Setting wep key index %u len %u\n",
2461 		    wepkey.idx, wepkey.len));
2462 		error = iwi_cmd(sc, IWI_CMD_SET_WEP_KEY, &wepkey,
2463 		    sizeof wepkey, 0);
2464 		if (error != 0)
2465 			return error;
2466 	}
2467 
2468 	/* Enable adapter */
2469 	DPRINTF(("Enabling adapter\n"));
2470 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
2471 }
2472 
2473 static int
2474 iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
2475 {
2476 	struct ieee80211com *ic = &sc->sc_ic;
2477 	struct iwi_scan_v2 scan;
2478 
2479 	(void)memset(&scan, 0, sizeof scan);
2480 
2481 	scan.dwelltime[IWI_SCAN_TYPE_PASSIVE] = htole16(2000);
2482 	scan.channels[0] = 1 |
2483 	    (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
2484 	scan.channels[1] = ieee80211_chan2ieee(ic, chan);
2485 	iwi_scan_type_set(scan, 1, IWI_SCAN_TYPE_PASSIVE);
2486 
2487 	DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
2488 	return iwi_cmd(sc, IWI_CMD_SCAN_V2, &scan, sizeof scan, 1);
2489 }
2490 
2491 static int
2492 iwi_scan(struct iwi_softc *sc)
2493 {
2494 	struct ieee80211com *ic = &sc->sc_ic;
2495 	struct iwi_scan_v2 scan;
2496 	uint32_t type;
2497 	uint8_t *p;
2498 	int i, count, idx;
2499 
2500 	(void)memset(&scan, 0, sizeof scan);
2501 	scan.dwelltime[IWI_SCAN_TYPE_ACTIVE_BROADCAST] =
2502 	    htole16(sc->dwelltime);
2503 	scan.dwelltime[IWI_SCAN_TYPE_ACTIVE_BDIRECT] =
2504 	    htole16(sc->dwelltime);
2505 
2506 	/* tell the firmware about the desired essid */
2507 	if (ic->ic_des_esslen) {
2508 		int error;
2509 
2510 		DPRINTF(("%s: Setting adapter desired ESSID to %s\n",
2511 		    __func__, ic->ic_des_essid));
2512 
2513 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID,
2514 		    ic->ic_des_essid, ic->ic_des_esslen, 1);
2515 		if (error)
2516 			return error;
2517 
2518 		type = IWI_SCAN_TYPE_ACTIVE_BDIRECT;
2519 	} else {
2520 		type = IWI_SCAN_TYPE_ACTIVE_BROADCAST;
2521 	}
2522 
2523 	p = &scan.channels[0];
2524 	count = idx = 0;
2525 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2526 		if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]) &&
2527 		    isset(ic->ic_chan_active, i)) {
2528 			*++p = i;
2529 			count++;
2530 			idx++;
2531  			iwi_scan_type_set(scan, idx, type);
2532 		}
2533 	}
2534 	if (count) {
2535 		*(p - count) = IWI_CHAN_5GHZ | count;
2536 		p++;
2537 	}
2538 
2539 	count = 0;
2540 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2541 		if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]) &&
2542 		    isset(ic->ic_chan_active, i)) {
2543 			*++p = i;
2544 			count++;
2545 			idx++;
2546 			iwi_scan_type_set(scan, idx, type);
2547 		}
2548 	}
2549 	*(p - count) = IWI_CHAN_2GHZ | count;
2550 
2551 	DPRINTF(("Start scanning\n"));
2552 	return iwi_cmd(sc, IWI_CMD_SCAN_V2, &scan, sizeof scan, 1);
2553 }
2554 
2555 static int
2556 iwi_auth_and_assoc(struct iwi_softc *sc)
2557 {
2558 	struct ieee80211com *ic = &sc->sc_ic;
2559 	struct ieee80211_node *ni = ic->ic_bss;
2560 	struct ifnet *ifp = &sc->sc_if;
2561 	struct ieee80211_wme_info wme;
2562 	struct iwi_configuration config;
2563 	struct iwi_associate assoc;
2564 	struct iwi_rateset rs;
2565 	uint16_t capinfo;
2566 	uint32_t data;
2567 	int error;
2568 
2569 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
2570 		memset(&config, 0, sizeof config);
2571 		config.bluetooth_coexistence = sc->bluetooth;
2572 		config.antenna = sc->antenna;
2573 		config.multicast_enabled = 1;
2574 		config.use_protection = 1;
2575 		config.answer_pbreq =
2576 		    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2577 		config.disable_unicast_decryption = 1;
2578 		config.disable_multicast_decryption = 1;
2579 		DPRINTF(("Configuring adapter\n"));
2580 		error = iwi_cmd(sc, IWI_CMD_SET_CONFIGURATION, &config,
2581 		    sizeof config, 1);
2582 		if (error != 0)
2583 			return error;
2584 	}
2585 
2586 #ifdef IWI_DEBUG
2587 	if (iwi_debug > 0) {
2588 		printf("Setting ESSID to ");
2589 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2590 		printf("\n");
2591 	}
2592 #endif
2593 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2594 	if (error != 0)
2595 		return error;
2596 
2597 	/* the rate set has already been "negotiated" */
2598 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2599 	    IWI_MODE_11G;
2600 	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2601 	rs.nrates = ni->ni_rates.rs_nrates;
2602 	memcpy(rs.rates, ni->ni_rates.rs_rates, rs.nrates);
2603 	DPRINTF(("Setting negotiated rates (%u)\n", rs.nrates));
2604 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2605 	if (error != 0)
2606 		return error;
2607 
2608 	if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL) {
2609 		wme.wme_id = IEEE80211_ELEMID_VENDOR;
2610 		wme.wme_len = sizeof (struct ieee80211_wme_info) - 2;
2611 		wme.wme_oui[0] = 0x00;
2612 		wme.wme_oui[1] = 0x50;
2613 		wme.wme_oui[2] = 0xf2;
2614 		wme.wme_type = WME_OUI_TYPE;
2615 		wme.wme_subtype = WME_INFO_OUI_SUBTYPE;
2616 		wme.wme_version = WME_VERSION;
2617 		wme.wme_info = 0;
2618 
2619 		DPRINTF(("Setting WME IE (len=%u)\n", wme.wme_len));
2620 		error = iwi_cmd(sc, IWI_CMD_SET_WMEIE, &wme, sizeof wme, 1);
2621 		if (error != 0)
2622 			return error;
2623 	}
2624 
2625 	if (ic->ic_opt_ie != NULL) {
2626 		DPRINTF(("Setting optional IE (len=%u)\n", ic->ic_opt_ie_len));
2627 		error = iwi_cmd(sc, IWI_CMD_SET_OPTIE, ic->ic_opt_ie,
2628 		    ic->ic_opt_ie_len, 1);
2629 		if (error != 0)
2630 			return error;
2631 	}
2632 	data = htole32(ni->ni_rssi);
2633 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2634 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2635 	if (error != 0)
2636 		return error;
2637 
2638 	memset(&assoc, 0, sizeof assoc);
2639 	assoc.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2640 	    IWI_MODE_11G;
2641 	assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2642 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED)
2643 		assoc.auth = (ic->ic_crypto.cs_def_txkey << 4) | IWI_AUTH_SHARED;
2644 	if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
2645 		assoc.policy |= htole16(IWI_POLICY_WME);
2646 	if (ic->ic_flags & IEEE80211_F_WPA)
2647 		assoc.policy |= htole16(IWI_POLICY_WPA);
2648 	memcpy(assoc.tstamp, ni->ni_tstamp.data, 8);
2649 
2650 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2651 		capinfo = IEEE80211_CAPINFO_IBSS;
2652 	else
2653 		capinfo = IEEE80211_CAPINFO_ESS;
2654 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
2655 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2656 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2657 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2658 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2659 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
2660 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2661 	assoc.capinfo = htole16(capinfo);
2662 
2663 	assoc.lintval = htole16(ic->ic_lintval);
2664 	assoc.intval = htole16(ni->ni_intval);
2665 	IEEE80211_ADDR_COPY(assoc.bssid, ni->ni_bssid);
2666 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2667 		IEEE80211_ADDR_COPY(assoc.dst, ifp->if_broadcastaddr);
2668 	else
2669 		IEEE80211_ADDR_COPY(assoc.dst, ni->ni_bssid);
2670 	DPRINTF(("Trying to associate to %s channel %u auth %u\n",
2671 	    ether_sprintf(assoc.bssid), assoc.chan, assoc.auth));
2672 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &assoc, sizeof assoc, 1);
2673 }
2674 
2675 static int
2676 iwi_init(struct ifnet *ifp)
2677 {
2678 	struct iwi_softc *sc = ifp->if_softc;
2679 	struct ieee80211com *ic = &sc->sc_ic;
2680 	struct iwi_firmware *fw = &sc->fw;
2681 	int i, error;
2682 
2683 	/* exit immediately if firmware has not been ioctl'd */
2684 	if (!(sc->flags & IWI_FLAG_FW_CACHED)) {
2685 		if ((error = iwi_cache_firmware(sc)) != 0) {
2686 			aprint_error("%s: could not cache the firmware\n",
2687 			    sc->sc_dev.dv_xname);
2688 			goto fail;
2689 		}
2690 	}
2691 
2692 	iwi_stop(ifp, 0);
2693 
2694 	if ((error = iwi_reset(sc)) != 0) {
2695 		aprint_error("%s: could not reset adapter\n",
2696 		    sc->sc_dev.dv_xname);
2697 		goto fail;
2698 	}
2699 
2700 	if ((error = iwi_load_firmware(sc, fw->boot, fw->boot_size)) != 0) {
2701 		aprint_error("%s: could not load boot firmware\n",
2702 		    sc->sc_dev.dv_xname);
2703 		goto fail;
2704 	}
2705 
2706 	if ((error = iwi_load_ucode(sc, fw->ucode, fw->ucode_size)) != 0) {
2707 		aprint_error("%s: could not load microcode\n",
2708 		    sc->sc_dev.dv_xname);
2709 		goto fail;
2710 	}
2711 
2712 	iwi_stop_master(sc);
2713 
2714 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmdq.desc_map->dm_segs[0].ds_addr);
2715 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, sc->cmdq.count);
2716 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
2717 
2718 	CSR_WRITE_4(sc, IWI_CSR_TX1_BASE, sc->txq[0].desc_map->dm_segs[0].ds_addr);
2719 	CSR_WRITE_4(sc, IWI_CSR_TX1_SIZE, sc->txq[0].count);
2720 	CSR_WRITE_4(sc, IWI_CSR_TX1_WIDX, sc->txq[0].cur);
2721 
2722 	CSR_WRITE_4(sc, IWI_CSR_TX2_BASE, sc->txq[1].desc_map->dm_segs[0].ds_addr);
2723 	CSR_WRITE_4(sc, IWI_CSR_TX2_SIZE, sc->txq[1].count);
2724 	CSR_WRITE_4(sc, IWI_CSR_TX2_WIDX, sc->txq[1].cur);
2725 
2726 	CSR_WRITE_4(sc, IWI_CSR_TX3_BASE, sc->txq[2].desc_map->dm_segs[0].ds_addr);
2727 	CSR_WRITE_4(sc, IWI_CSR_TX3_SIZE, sc->txq[2].count);
2728 	CSR_WRITE_4(sc, IWI_CSR_TX3_WIDX, sc->txq[2].cur);
2729 
2730 	CSR_WRITE_4(sc, IWI_CSR_TX4_BASE, sc->txq[3].desc_map->dm_segs[0].ds_addr);
2731 	CSR_WRITE_4(sc, IWI_CSR_TX4_SIZE, sc->txq[3].count);
2732 	CSR_WRITE_4(sc, IWI_CSR_TX4_WIDX, sc->txq[3].cur);
2733 
2734 	for (i = 0; i < sc->rxq.count; i++)
2735 		CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4,
2736 		    sc->rxq.data[i].map->dm_segs[0].ds_addr);
2737 
2738 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, sc->rxq.count -1);
2739 
2740 	if ((error = iwi_load_firmware(sc, fw->main, fw->main_size)) != 0) {
2741 		aprint_error("%s: could not load main firmware\n",
2742 		    sc->sc_dev.dv_xname);
2743 		goto fail;
2744 	}
2745 
2746 	sc->flags |= IWI_FLAG_FW_INITED;
2747 
2748 	if ((error = iwi_config(sc)) != 0) {
2749 		aprint_error("%s: device configuration failed\n",
2750 		    sc->sc_dev.dv_xname);
2751 		goto fail;
2752 	}
2753 
2754 	ic->ic_state = IEEE80211_S_INIT;
2755 
2756 	ifp->if_flags &= ~IFF_OACTIVE;
2757 	ifp->if_flags |= IFF_RUNNING;
2758 
2759 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2760 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2761 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2762 	} else
2763 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2764 
2765 	return 0;
2766 
2767 fail:	ifp->if_flags &= ~IFF_UP;
2768 	iwi_stop(ifp, 0);
2769 
2770 	return error;
2771 }
2772 
2773 
2774 /*
2775  * Return whether or not the radio is enabled in hardware
2776  * (i.e. the rfkill switch is "off").
2777  */
2778 static int
2779 iwi_getrfkill(struct iwi_softc *sc)
2780 {
2781 	return (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) == 0;
2782 }
2783 
2784 static int
2785 iwi_sysctl_radio(SYSCTLFN_ARGS)
2786 {
2787 	struct sysctlnode node;
2788 	struct iwi_softc *sc;
2789 	int val, error;
2790 
2791 	node = *rnode;
2792 	sc = (struct iwi_softc *)node.sysctl_data;
2793 
2794 	val = !iwi_getrfkill(sc);
2795 
2796 	node.sysctl_data = &val;
2797 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
2798 
2799 	if (error || newp == NULL)
2800 		return error;
2801 
2802 	return 0;
2803 }
2804 
2805 #ifdef IWI_DEBUG
2806 SYSCTL_SETUP(sysctl_iwi, "sysctl iwi(4) subtree setup")
2807 {
2808 	int rc;
2809 	const struct sysctlnode *rnode;
2810 	const struct sysctlnode *cnode;
2811 
2812 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
2813 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
2814 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
2815 		goto err;
2816 
2817 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
2818 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "iwi",
2819 	    SYSCTL_DESCR("iwi global controls"),
2820 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
2821 		goto err;
2822 
2823 	/* control debugging printfs */
2824 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2825 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2826 	    "debug", SYSCTL_DESCR("Enable debugging output"),
2827 	    NULL, 0, &iwi_debug, 0, CTL_CREATE, CTL_EOL)) != 0)
2828 		goto err;
2829 
2830 	return;
2831 err:
2832 	aprint_error("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
2833 }
2834 
2835 #endif /* IWI_DEBUG */
2836 
2837 /*
2838  * Add sysctl knobs.
2839  */
2840 static void
2841 iwi_sysctlattach(struct iwi_softc *sc)
2842 {
2843 	int rc;
2844 	const struct sysctlnode *rnode;
2845 	const struct sysctlnode *cnode;
2846 
2847 	struct sysctllog **clog = &sc->sc_sysctllog;
2848 
2849 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
2850 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
2851 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
2852 		goto err;
2853 
2854 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
2855 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, sc->sc_dev.dv_xname,
2856 	    SYSCTL_DESCR("iwi controls and statistics"),
2857 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
2858 		goto err;
2859 
2860 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2861 	    CTLFLAG_PERMANENT, CTLTYPE_INT, "radio",
2862 	    SYSCTL_DESCR("radio transmitter switch state (0=off, 1=on)"),
2863 	    iwi_sysctl_radio, 0, sc, 0, CTL_CREATE, CTL_EOL)) != 0)
2864 		goto err;
2865 
2866 	sc->dwelltime = 100;
2867 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2868 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2869 	    "dwell", SYSCTL_DESCR("channel dwell time (ms) for AP/station scanning"),
2870 	    NULL, 0, &sc->dwelltime, 0, CTL_CREATE, CTL_EOL)) != 0)
2871 		goto err;
2872 
2873 	sc->bluetooth = 1;
2874 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2875 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2876 	    "bluetooth", SYSCTL_DESCR("bluetooth coexistence"),
2877 	    NULL, 0, &sc->bluetooth, 0, CTL_CREATE, CTL_EOL)) != 0)
2878 		goto err;
2879 
2880 	sc->antenna = 0;
2881 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
2882 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
2883 	    "antenna", SYSCTL_DESCR("antenna (0=auto)"),
2884 	    NULL, 0, &sc->antenna, 0, CTL_CREATE, CTL_EOL)) != 0)
2885 		goto err;
2886 
2887 	return;
2888 err:
2889 	aprint_error("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
2890 }
2891 
2892 static void
2893 iwi_stop(struct ifnet *ifp, int disable)
2894 {
2895 	struct iwi_softc *sc = ifp->if_softc;
2896 	struct ieee80211com *ic = &sc->sc_ic;
2897 
2898 	IWI_LED_OFF(sc);
2899 
2900 	iwi_stop_master(sc);
2901 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SW_RESET);
2902 
2903 	/* reset rings */
2904 	iwi_reset_cmd_ring(sc, &sc->cmdq);
2905 	iwi_reset_tx_ring(sc, &sc->txq[0]);
2906 	iwi_reset_tx_ring(sc, &sc->txq[1]);
2907 	iwi_reset_tx_ring(sc, &sc->txq[2]);
2908 	iwi_reset_tx_ring(sc, &sc->txq[3]);
2909 	iwi_reset_rx_ring(sc, &sc->rxq);
2910 
2911 	ifp->if_timer = 0;
2912 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2913 
2914 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2915 }
2916 
2917 static void
2918 iwi_led_set(struct iwi_softc *sc, uint32_t state, int toggle)
2919 {
2920 	uint32_t val;
2921 
2922 	val = MEM_READ_4(sc, IWI_MEM_EVENT_CTL);
2923 
2924 	switch (sc->nictype) {
2925 	case 1:
2926 		/* special NIC type: reversed leds */
2927 		if (state == IWI_LED_ACTIVITY) {
2928 			state &= ~IWI_LED_ACTIVITY;
2929 			state |= IWI_LED_ASSOCIATED;
2930 		} else if (state == IWI_LED_ASSOCIATED) {
2931 			state &= ~IWI_LED_ASSOCIATED;
2932 			state |= IWI_LED_ACTIVITY;
2933 		}
2934 		/* and ignore toggle effect */
2935 		val |= state;
2936 		break;
2937 	case 0:
2938 	case 2:
2939 	case 3:
2940 	case 4:
2941 		val = (toggle && (val & state)) ? val & ~state : val | state;
2942 		break;
2943 	default:
2944 		aprint_normal("%s: unknown NIC type %d\n",
2945 		    sc->sc_dev.dv_xname, sc->nictype);
2946 		return;
2947 		break;
2948 	}
2949 
2950 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, val);
2951 
2952 	return;
2953 }
2954 
2955 static void
2956 iwi_error_log(struct iwi_softc *sc)
2957 {
2958 	uint32_t b, n;
2959 	int i;
2960 
2961 	static const char *const msg[] = {
2962 		"no error",
2963 		"failed",
2964 		"memory range low",
2965 		"memory range high",
2966 		"bad parameter",
2967 		"checksum",
2968 		"NMI",
2969 		"bad database",
2970 		"allocation failed",
2971 		"DMA underrun",
2972 		"DMA status",
2973 		"DINO",
2974 		"EEPROM",
2975 		"device assert",
2976 		"fatal"
2977 	};
2978 
2979 	b = CSR_READ_4(sc, IWI_CSR_ERRORLOG);
2980 	n = MEM_READ_4(sc, b);
2981 
2982 	b += 4;
2983 
2984 	for (i = 0; i < n ; i++) {
2985 		struct iwi_error fw_error;
2986 
2987 		MEM_CPY(sc, &fw_error, b, sizeof(fw_error));
2988 
2989 		printf("%s: %s\n", sc->sc_dev.dv_xname,
2990 		    msg[fw_error.type]);
2991 
2992 		b += sizeof(fw_error);
2993 	}
2994 }
2995