xref: /openbsd-src/sys/dev/pci/if_iwi.c (revision f2da64fbbbf1b03f09f390ab01267c93dfd77c4c)
1 /*	$OpenBSD: if_iwi.c,v 1.133 2016/09/05 08:17:48 tedu Exp $	*/
2 
3 /*-
4  * Copyright (c) 2004-2008
5  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Intel PRO/Wireless 2200BG/2915ABG 802.11 network adapters.
22  */
23 
24 #include "bpfilter.h"
25 
26 #include <sys/param.h>
27 #include <sys/sockio.h>
28 #include <sys/mbuf.h>
29 #include <sys/kernel.h>
30 #include <sys/rwlock.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/conf.h>
34 #include <sys/device.h>
35 #include <sys/task.h>
36 #include <sys/endian.h>
37 
38 #include <machine/bus.h>
39 #include <machine/intr.h>
40 
41 #include <dev/pci/pcireg.h>
42 #include <dev/pci/pcivar.h>
43 #include <dev/pci/pcidevs.h>
44 
45 #if NBPFILTER > 0
46 #include <net/bpf.h>
47 #endif
48 #include <net/if.h>
49 #include <net/if_dl.h>
50 #include <net/if_media.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/if_ether.h>
54 
55 #include <net80211/ieee80211_var.h>
56 #include <net80211/ieee80211_radiotap.h>
57 
58 #include <dev/pci/if_iwireg.h>
59 #include <dev/pci/if_iwivar.h>
60 
61 const struct pci_matchid iwi_devices[] = {
62 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2200BG },
63 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2225BG },
64 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1 },
65 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2 }
66 };
67 
68 int		iwi_match(struct device *, void *, void *);
69 void		iwi_attach(struct device *, struct device *, void *);
70 int		iwi_activate(struct device *, int);
71 void		iwi_wakeup(struct iwi_softc *);
72 void		iwi_init_task(void *);
73 int		iwi_alloc_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
74 void		iwi_reset_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
75 void		iwi_free_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
76 int		iwi_alloc_tx_ring(struct iwi_softc *, struct iwi_tx_ring *,
77 		    int);
78 void		iwi_reset_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
79 void		iwi_free_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
80 int		iwi_alloc_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
81 void		iwi_reset_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
82 void		iwi_free_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
83 int		iwi_media_change(struct ifnet *);
84 void		iwi_media_status(struct ifnet *, struct ifmediareq *);
85 uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
86 int		iwi_find_txnode(struct iwi_softc *, const uint8_t *);
87 int		iwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
88 uint8_t		iwi_rate(int);
89 void		iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *,
90 		    struct iwi_frame *);
91 void		iwi_notification_intr(struct iwi_softc *, struct iwi_rx_data *,
92 		    struct iwi_notif *);
93 void		iwi_rx_intr(struct iwi_softc *);
94 void		iwi_tx_intr(struct iwi_softc *, struct iwi_tx_ring *);
95 int		iwi_intr(void *);
96 int		iwi_cmd(struct iwi_softc *, uint8_t, void *, uint8_t, int);
97 int		iwi_send_mgmt(struct ieee80211com *, struct ieee80211_node *,
98 		    int, int, int);
99 int		iwi_tx_start(struct ifnet *, struct mbuf *,
100 		    struct ieee80211_node *);
101 void		iwi_start(struct ifnet *);
102 void		iwi_watchdog(struct ifnet *);
103 int		iwi_ioctl(struct ifnet *, u_long, caddr_t);
104 void		iwi_stop_master(struct iwi_softc *);
105 int		iwi_reset(struct iwi_softc *);
106 int		iwi_load_ucode(struct iwi_softc *, const char *, int);
107 int		iwi_load_firmware(struct iwi_softc *, const char *, int);
108 int		iwi_config(struct iwi_softc *);
109 void		iwi_update_edca(struct ieee80211com *);
110 int		iwi_set_chan(struct iwi_softc *, struct ieee80211_channel *);
111 int		iwi_scan(struct iwi_softc *);
112 int		iwi_auth_and_assoc(struct iwi_softc *);
113 int		iwi_init(struct ifnet *);
114 void		iwi_stop(struct ifnet *, int);
115 
116 static __inline uint8_t
117 MEM_READ_1(struct iwi_softc *sc, uint32_t addr)
118 {
119 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
120 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
121 }
122 
123 static __inline uint32_t
124 MEM_READ_4(struct iwi_softc *sc, uint32_t addr)
125 {
126 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
127 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
128 }
129 
130 #ifdef IWI_DEBUG
131 #define DPRINTF(x)	do { if (iwi_debug > 0) printf x; } while (0)
132 #define DPRINTFN(n, x)	do { if (iwi_debug >= (n)) printf x; } while (0)
133 int iwi_debug = 0;
134 #else
135 #define DPRINTF(x)
136 #define DPRINTFN(n, x)
137 #endif
138 
139 struct cfattach iwi_ca = {
140 	sizeof (struct iwi_softc), iwi_match, iwi_attach, NULL,
141 	iwi_activate
142 };
143 
144 int
145 iwi_match(struct device *parent, void *match, void *aux)
146 {
147 	return pci_matchbyid((struct pci_attach_args *)aux, iwi_devices,
148 	    nitems(iwi_devices));
149 }
150 
151 /* Base Address Register */
152 #define IWI_PCI_BAR0	0x10
153 
154 void
155 iwi_attach(struct device *parent, struct device *self, void *aux)
156 {
157 	struct iwi_softc *sc = (struct iwi_softc *)self;
158 	struct ieee80211com *ic = &sc->sc_ic;
159 	struct ifnet *ifp = &ic->ic_if;
160 	struct pci_attach_args *pa = aux;
161 	const char *intrstr;
162 	bus_space_tag_t memt;
163 	bus_space_handle_t memh;
164 	pci_intr_handle_t ih;
165 	pcireg_t data;
166 	uint16_t val;
167 	int error, ac, i;
168 
169 	sc->sc_pct = pa->pa_pc;
170 	sc->sc_pcitag = pa->pa_tag;
171 
172 	/* clear device specific PCI configuration register 0x41 */
173 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
174 	data &= ~0x0000ff00;
175 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
176 
177 	/* map the register window */
178 	error = pci_mapreg_map(pa, IWI_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
179 	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, NULL, &sc->sc_sz, 0);
180 	if (error != 0) {
181 		printf(": can't map mem space\n");
182 		return;
183 	}
184 
185 	sc->sc_st = memt;
186 	sc->sc_sh = memh;
187 	sc->sc_dmat = pa->pa_dmat;
188 
189 	if (pci_intr_map(pa, &ih) != 0) {
190 		printf(": can't map interrupt\n");
191 		return;
192 	}
193 
194 	intrstr = pci_intr_string(sc->sc_pct, ih);
195 	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, iwi_intr, sc,
196 	    sc->sc_dev.dv_xname);
197 	if (sc->sc_ih == NULL) {
198 		printf(": can't establish interrupt");
199 		if (intrstr != NULL)
200 			printf(" at %s", intrstr);
201 		printf("\n");
202 		return;
203 	}
204 	printf(": %s", intrstr);
205 
206 	if (iwi_reset(sc) != 0) {
207 		printf(": could not reset adapter\n");
208 		return;
209 	}
210 
211 	/*
212 	 * Allocate rings.
213 	 */
214 	if (iwi_alloc_cmd_ring(sc, &sc->cmdq) != 0) {
215 		printf(": could not allocate Cmd ring\n");
216 		return;
217 	}
218 	for (ac = 0; ac < EDCA_NUM_AC; ac++) {
219 		if (iwi_alloc_tx_ring(sc, &sc->txq[ac], ac) != 0) {
220 			printf(": could not allocate Tx ring %d\n", ac);
221 			goto fail;
222 		}
223 	}
224 	if (iwi_alloc_rx_ring(sc, &sc->rxq) != 0) {
225 		printf(": could not allocate Rx ring\n");
226 		goto fail;
227 	}
228 
229 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
230 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
231 	ic->ic_state = IEEE80211_S_INIT;
232 
233 	/* set device capabilities */
234 	ic->ic_caps =
235 #ifndef IEEE80211_STA_ONLY
236 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
237 #endif
238 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
239 	    IEEE80211_C_TXPMGT |	/* tx power management */
240 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
241 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
242 	    IEEE80211_C_WEP |		/* s/w WEP */
243 	    IEEE80211_C_RSN |		/* WPA/RSN supported */
244 	    IEEE80211_C_SCANALL;	/* h/w scanning */
245 
246 	/* read MAC address from EEPROM */
247 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
248 	ic->ic_myaddr[0] = val & 0xff;
249 	ic->ic_myaddr[1] = val >> 8;
250 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
251 	ic->ic_myaddr[2] = val & 0xff;
252 	ic->ic_myaddr[3] = val >> 8;
253 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
254 	ic->ic_myaddr[4] = val & 0xff;
255 	ic->ic_myaddr[5] = val >> 8;
256 
257 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
258 
259 	if (PCI_PRODUCT(pa->pa_id) >= PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1) {
260 		/* set supported .11a rates */
261 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
262 		    ieee80211_std_rateset_11a;
263 
264 		/* set supported .11a channels */
265 		for (i = 36; i <= 64; i += 4) {
266 			ic->ic_channels[i].ic_freq =
267 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
268 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
269 		}
270 		for (i = 149; i <= 165; i += 4) {
271 			ic->ic_channels[i].ic_freq =
272 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
273 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
274 		}
275 	}
276 
277 	/* set supported .11b and .11g rates */
278 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
279 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
280 
281 	/* set supported .11b and .11g channels (1 through 14) */
282 	for (i = 1; i <= 14; i++) {
283 		ic->ic_channels[i].ic_freq =
284 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
285 		ic->ic_channels[i].ic_flags =
286 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
287 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
288 	}
289 
290 	/* IBSS channel undefined for now */
291 	ic->ic_ibss_chan = &ic->ic_channels[0];
292 
293 	ifp->if_softc = sc;
294 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
295 	ifp->if_ioctl = iwi_ioctl;
296 	ifp->if_start = iwi_start;
297 	ifp->if_watchdog = iwi_watchdog;
298 	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
299 
300 	if_attach(ifp);
301 	ieee80211_ifattach(ifp);
302 	/* override state transition machine */
303 	sc->sc_newstate = ic->ic_newstate;
304 	ic->ic_newstate = iwi_newstate;
305 	ic->ic_send_mgmt = iwi_send_mgmt;
306 	ieee80211_media_init(ifp, iwi_media_change, iwi_media_status);
307 
308 #if NBPFILTER > 0
309 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
310 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
311 
312 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
313 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
314 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
315 
316 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
317 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
318 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
319 #endif
320 
321 	rw_init(&sc->sc_rwlock, "iwilock");
322 	task_set(&sc->init_task, iwi_init_task, sc);
323 	return;
324 
325 fail:	while (--ac >= 0)
326 		iwi_free_tx_ring(sc, &sc->txq[ac]);
327 	iwi_free_cmd_ring(sc, &sc->cmdq);
328 }
329 
330 int
331 iwi_activate(struct device *self, int act)
332 {
333 	struct iwi_softc *sc = (struct iwi_softc *)self;
334 	struct ifnet *ifp = &sc->sc_ic.ic_if;
335 
336 	switch (act) {
337 	case DVACT_SUSPEND:
338 		if (ifp->if_flags & IFF_RUNNING)
339 			iwi_stop(ifp, 0);
340 		break;
341 	case DVACT_WAKEUP:
342 		iwi_wakeup(sc);
343 		break;
344 	}
345 
346 	return 0;
347 }
348 
349 void
350 iwi_wakeup(struct iwi_softc *sc)
351 {
352 	pcireg_t data;
353 
354 	/* clear device specific PCI configuration register 0x41 */
355 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
356 	data &= ~0x0000ff00;
357 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
358 
359 	iwi_init_task(sc);
360 }
361 
362 void
363 iwi_init_task(void *arg1)
364 {
365 	struct iwi_softc *sc = arg1;
366 	struct ifnet *ifp = &sc->sc_ic.ic_if;
367 	int s;
368 
369 	rw_enter_write(&sc->sc_rwlock);
370 	s = splnet();
371 
372 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == IFF_UP)
373 		iwi_init(ifp);
374 
375 	splx(s);
376 	rw_exit_write(&sc->sc_rwlock);
377 }
378 
379 int
380 iwi_alloc_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
381 {
382 	int nsegs, error;
383 
384 	ring->queued = 0;
385 	ring->cur = ring->next = 0;
386 
387 	error = bus_dmamap_create(sc->sc_dmat,
388 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, 1,
389 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, 0,
390 	    BUS_DMA_NOWAIT, &ring->map);
391 	if (error != 0) {
392 		printf("%s: could not create cmd ring DMA map\n",
393 		    sc->sc_dev.dv_xname);
394 		goto fail;
395 	}
396 
397 	error = bus_dmamem_alloc(sc->sc_dmat,
398 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, PAGE_SIZE, 0,
399 	    &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
400 	if (error != 0) {
401 		printf("%s: could not allocate cmd ring DMA memory\n",
402 		    sc->sc_dev.dv_xname);
403 		goto fail;
404 	}
405 
406 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
407 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT,
408 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
409 	if (error != 0) {
410 		printf("%s: can't map cmd ring DMA memory\n",
411 		    sc->sc_dev.dv_xname);
412 		goto fail;
413 	}
414 
415 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
416 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, NULL,
417 	    BUS_DMA_NOWAIT);
418 	if (error != 0) {
419 		printf("%s: could not load cmd ring DMA map\n",
420 		    sc->sc_dev.dv_xname);
421 		goto fail;
422 	}
423 
424 	return 0;
425 
426 fail:	iwi_free_cmd_ring(sc, ring);
427 	return error;
428 }
429 
430 void
431 iwi_reset_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
432 {
433 	ring->queued = 0;
434 	ring->cur = ring->next = 0;
435 }
436 
437 void
438 iwi_free_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
439 {
440 	if (ring->map != NULL) {
441 		if (ring->desc != NULL) {
442 			bus_dmamap_unload(sc->sc_dmat, ring->map);
443 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
444 			    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT);
445 			bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
446 		}
447 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
448 	}
449 }
450 
451 int
452 iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring, int ac)
453 {
454 	struct iwi_tx_data *data;
455 	int i, nsegs, error;
456 
457 	ring->queued = 0;
458 	ring->cur = ring->next = 0;
459 	ring->csr_ridx = IWI_CSR_TX_RIDX(ac);
460 	ring->csr_widx = IWI_CSR_TX_WIDX(ac);
461 
462 	error = bus_dmamap_create(sc->sc_dmat,
463 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, 1,
464 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, 0, BUS_DMA_NOWAIT,
465 	    &ring->map);
466 	if (error != 0) {
467 		printf("%s: could not create tx ring DMA map\n",
468 		    sc->sc_dev.dv_xname);
469 		goto fail;
470 	}
471 
472 	error = bus_dmamem_alloc(sc->sc_dmat,
473 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, PAGE_SIZE, 0,
474 	    &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
475 	if (error != 0) {
476 		printf("%s: could not allocate tx ring DMA memory\n",
477 		    sc->sc_dev.dv_xname);
478 		goto fail;
479 	}
480 
481 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
482 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT,
483 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
484 	if (error != 0) {
485 		printf("%s: can't map tx ring DMA memory\n",
486 		    sc->sc_dev.dv_xname);
487 		goto fail;
488 	}
489 
490 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
491 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, NULL,
492 	    BUS_DMA_NOWAIT);
493 	if (error != 0) {
494 		printf("%s: could not load tx ring DMA map\n",
495 		    sc->sc_dev.dv_xname);
496 		goto fail;
497 	}
498 
499 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
500 		data = &ring->data[i];
501 
502 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
503 		    IWI_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT, &data->map);
504 		if (error != 0) {
505 			printf("%s: could not create tx buf DMA map\n",
506 			    sc->sc_dev.dv_xname);
507 			goto fail;
508 		}
509 	}
510 
511 	return 0;
512 
513 fail:	iwi_free_tx_ring(sc, ring);
514 	return error;
515 }
516 
517 void
518 iwi_reset_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
519 {
520 	struct iwi_tx_data *data;
521 	int i;
522 
523 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
524 		data = &ring->data[i];
525 
526 		if (data->m != NULL) {
527 			bus_dmamap_unload(sc->sc_dmat, data->map);
528 			m_freem(data->m);
529 			data->m = NULL;
530 		}
531 	}
532 
533 	ring->queued = 0;
534 	ring->cur = ring->next = 0;
535 }
536 
537 void
538 iwi_free_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
539 {
540 	struct iwi_tx_data *data;
541 	int i;
542 
543 	if (ring->map != NULL) {
544 		if (ring->desc != NULL) {
545 			bus_dmamap_unload(sc->sc_dmat, ring->map);
546 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
547 			    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT);
548 			bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
549 		}
550 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
551 	}
552 
553 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
554 		data = &ring->data[i];
555 
556 		if (data->m != NULL) {
557 			bus_dmamap_unload(sc->sc_dmat, data->map);
558 			m_freem(data->m);
559 		}
560 		bus_dmamap_destroy(sc->sc_dmat, data->map);
561 	}
562 }
563 
564 int
565 iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
566 {
567 	struct iwi_rx_data *data;
568 	int i, error;
569 
570 	ring->cur = 0;
571 
572 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
573 		data = &sc->rxq.data[i];
574 
575 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
576 		    0, BUS_DMA_NOWAIT, &data->map);
577 		if (error != 0) {
578 			printf("%s: could not create rx buf DMA map\n",
579 			    sc->sc_dev.dv_xname);
580 			goto fail;
581 		}
582 
583 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
584 		if (data->m == NULL) {
585 			printf("%s: could not allocate rx mbuf\n",
586 			    sc->sc_dev.dv_xname);
587 			error = ENOMEM;
588 			goto fail;
589 		}
590 		MCLGET(data->m, M_DONTWAIT);
591 		if (!(data->m->m_flags & M_EXT)) {
592 			m_freem(data->m);
593 			data->m = NULL;
594 			printf("%s: could not allocate rx mbuf cluster\n",
595 			    sc->sc_dev.dv_xname);
596 			error = ENOMEM;
597 			goto fail;
598 		}
599 
600 		error = bus_dmamap_load(sc->sc_dmat, data->map,
601 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
602 		if (error != 0) {
603 			printf("%s: could not load rx buf DMA map\n",
604 			    sc->sc_dev.dv_xname);
605 			goto fail;
606 		}
607 
608 		data->reg = IWI_CSR_RX_BASE + i * 4;
609 	}
610 
611 	return 0;
612 
613 fail:	iwi_free_rx_ring(sc, ring);
614 	return error;
615 }
616 
617 void
618 iwi_reset_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
619 {
620 	ring->cur = 0;
621 }
622 
623 void
624 iwi_free_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
625 {
626 	struct iwi_rx_data *data;
627 	int i;
628 
629 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
630 		data = &sc->rxq.data[i];
631 
632 		if (data->m != NULL) {
633 			bus_dmamap_unload(sc->sc_dmat, data->map);
634 			m_freem(data->m);
635 		}
636 		bus_dmamap_destroy(sc->sc_dmat, data->map);
637 	}
638 }
639 
640 int
641 iwi_media_change(struct ifnet *ifp)
642 {
643 	int error;
644 
645 	error = ieee80211_media_change(ifp);
646 	if (error != ENETRESET)
647 		return error;
648 
649 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
650 		iwi_init(ifp);
651 
652 	return 0;
653 }
654 
655 void
656 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
657 {
658 	struct iwi_softc *sc = ifp->if_softc;
659 	struct ieee80211com *ic = &sc->sc_ic;
660 	uint32_t val;
661 	int rate;
662 
663 	imr->ifm_status = IFM_AVALID;
664 	imr->ifm_active = IFM_IEEE80211;
665 	if (ic->ic_state == IEEE80211_S_RUN)
666 		imr->ifm_status |= IFM_ACTIVE;
667 
668 	/* read current transmission rate from adapter */
669 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
670 	/* convert PLCP signal to 802.11 rate */
671 	rate = iwi_rate(val);
672 
673 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
674 	switch (ic->ic_opmode) {
675 	case IEEE80211_M_STA:
676 		break;
677 #ifndef IEEE80211_STA_ONLY
678 	case IEEE80211_M_IBSS:
679 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
680 		break;
681 #endif
682 	case IEEE80211_M_MONITOR:
683 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
684 		break;
685 	default:
686 		/* should not get there */
687 		break;
688 	}
689 }
690 
691 #ifndef IEEE80211_STA_ONLY
692 /*
693  * This is only used for IBSS mode where the firmware expect an index to an
694  * internal node table instead of a destination address.
695  */
696 int
697 iwi_find_txnode(struct iwi_softc *sc, const uint8_t *macaddr)
698 {
699 	struct iwi_node node;
700 	int i;
701 
702 	for (i = 0; i < sc->nsta; i++)
703 		if (IEEE80211_ADDR_EQ(sc->sta[i], macaddr))
704 			return i;	/* already existing node */
705 
706 	if (i == IWI_MAX_NODE)
707 		return -1;	/* no place left in neighbor table */
708 
709 	/* save this new node in our softc table */
710 	IEEE80211_ADDR_COPY(sc->sta[i], macaddr);
711 	sc->nsta = i;
712 
713 	/* write node information into NIC memory */
714 	bzero(&node, sizeof node);
715 	IEEE80211_ADDR_COPY(node.bssid, macaddr);
716 
717 	CSR_WRITE_REGION_1(sc, IWI_CSR_NODE_BASE + i * sizeof node,
718 	    (uint8_t *)&node, sizeof node);
719 
720 	return i;
721 }
722 #endif
723 
724 int
725 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
726 {
727 	struct iwi_softc *sc = ic->ic_softc;
728 	enum ieee80211_state ostate;
729 	uint32_t tmp;
730 
731 	ostate = ic->ic_state;
732 
733 	switch (nstate) {
734 	case IEEE80211_S_SCAN:
735 		iwi_scan(sc);
736 		break;
737 
738 	case IEEE80211_S_AUTH:
739 		iwi_auth_and_assoc(sc);
740 		break;
741 
742 	case IEEE80211_S_RUN:
743 #ifndef IEEE80211_STA_ONLY
744 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
745 			sc->nsta = 0;	/* flush IBSS nodes */
746 			ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
747 		} else
748 #endif
749 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
750 			iwi_set_chan(sc, ic->ic_ibss_chan);
751 
752 		/* assoc led on */
753 		tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
754 		MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp | IWI_LED_ASSOC);
755 		break;
756 
757 	case IEEE80211_S_INIT:
758 		if (ostate != IEEE80211_S_RUN)
759 			break;
760 
761 		/* assoc led off */
762 		tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
763 		MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp & ~IWI_LED_ASSOC);
764 		break;
765 
766 	case IEEE80211_S_ASSOC:
767 		break;
768 	}
769 
770 	ic->ic_state = nstate;
771 	return 0;
772 }
773 
774 /*
775  * Read 16 bits at address 'addr' from the serial EEPROM.
776  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
777  */
778 uint16_t
779 iwi_read_prom_word(struct iwi_softc *sc, uint8_t addr)
780 {
781 	uint32_t tmp;
782 	uint16_t val;
783 	int n;
784 
785 	/* clock C once before the first command */
786 	IWI_EEPROM_CTL(sc, 0);
787 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
788 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
789 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
790 
791 	/* write start bit (1) */
792 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
793 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
794 
795 	/* write READ opcode (10) */
796 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
797 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
798 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
799 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
800 
801 	/* write address A7-A0 */
802 	for (n = 7; n >= 0; n--) {
803 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
804 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
805 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
806 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
807 	}
808 
809 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
810 
811 	/* read data Q15-Q0 */
812 	val = 0;
813 	for (n = 15; n >= 0; n--) {
814 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
815 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
816 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
817 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
818 	}
819 
820 	IWI_EEPROM_CTL(sc, 0);
821 
822 	/* clear Chip Select and clock C */
823 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
824 	IWI_EEPROM_CTL(sc, 0);
825 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
826 
827 	return val;
828 }
829 
830 uint8_t
831 iwi_rate(int plcp)
832 {
833 	switch (plcp) {
834 	/* CCK rates (values are device-dependent) */
835 	case  10:	return 2;
836 	case  20:	return 4;
837 	case  55:	return 11;
838 	case 110:	return 22;
839 
840 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
841 	case 0xd:	return 12;
842 	case 0xf:	return 18;
843 	case 0x5:	return 24;
844 	case 0x7:	return 36;
845 	case 0x9:	return 48;
846 	case 0xb:	return 72;
847 	case 0x1:	return 96;
848 	case 0x3:	return 108;
849 
850 	/* unknown rate: should not happen */
851 	default:	return 0;
852 	}
853 }
854 
855 void
856 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_data *data,
857     struct iwi_frame *frame)
858 {
859 	struct ieee80211com *ic = &sc->sc_ic;
860 	struct ifnet *ifp = &ic->ic_if;
861 	struct mbuf *mnew, *m;
862 	struct ieee80211_frame *wh;
863 	struct ieee80211_rxinfo rxi;
864 	struct ieee80211_node *ni;
865 	int error;
866 
867 	DPRINTFN(5, ("received frame len=%u chan=%u rssi=%u\n",
868 	    letoh16(frame->len), frame->chan, frame->rssi_dbm));
869 
870 	if (letoh16(frame->len) < sizeof (struct ieee80211_frame_min) ||
871 	    letoh16(frame->len) > MCLBYTES) {
872 		DPRINTF(("%s: bad frame length\n", sc->sc_dev.dv_xname));
873 		ifp->if_ierrors++;
874 		return;
875 	}
876 
877 	/*
878 	 * Try to allocate a new mbuf for this ring element and load it before
879 	 * processing the current mbuf.  If the ring element cannot be loaded,
880 	 * drop the received packet and reuse the old mbuf.  In the unlikely
881 	 * case that the old mbuf can't be reloaded either, explicitly panic.
882 	 */
883 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
884 	if (mnew == NULL) {
885 		ifp->if_ierrors++;
886 		return;
887 	}
888 	MCLGET(mnew, M_DONTWAIT);
889 	if (!(mnew->m_flags & M_EXT)) {
890 		m_freem(mnew);
891 		ifp->if_ierrors++;
892 		return;
893 	}
894 
895 	bus_dmamap_unload(sc->sc_dmat, data->map);
896 
897 	error = bus_dmamap_load(sc->sc_dmat, data->map, mtod(mnew, void *),
898 	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
899 	if (error != 0) {
900 		m_freem(mnew);
901 
902 		/* try to reload the old mbuf */
903 		error = bus_dmamap_load(sc->sc_dmat, data->map,
904 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
905 		if (error != 0) {
906 			/* very unlikely that it will fail... */
907 			panic("%s: could not load old rx mbuf",
908 			    sc->sc_dev.dv_xname);
909 		}
910 		CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
911 		ifp->if_ierrors++;
912 		return;
913 	}
914 
915 	m = data->m;
916 	data->m = mnew;
917 	CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
918 
919 	/* finalize mbuf */
920 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
921 	    sizeof (struct iwi_frame) + letoh16(frame->len);
922 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
923 
924 #if NBPFILTER > 0
925 	if (sc->sc_drvbpf != NULL) {
926 		struct mbuf mb;
927 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
928 
929 		tap->wr_flags = 0;
930 		tap->wr_rate = iwi_rate(frame->rate);
931 		tap->wr_chan_freq =
932 		    htole16(ic->ic_channels[frame->chan].ic_freq);
933 		tap->wr_chan_flags =
934 		    htole16(ic->ic_channels[frame->chan].ic_flags);
935 		tap->wr_antsignal = frame->signal;
936 		tap->wr_antenna = frame->antenna & 0x3;
937 		if (frame->antenna & 0x40)
938 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
939 
940 		mb.m_data = (caddr_t)tap;
941 		mb.m_len = sc->sc_rxtap_len;
942 		mb.m_next = m;
943 		mb.m_nextpkt = NULL;
944 		mb.m_type = 0;
945 		mb.m_flags = 0;
946 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
947 	}
948 #endif
949 
950 	wh = mtod(m, struct ieee80211_frame *);
951 	ni = ieee80211_find_rxnode(ic, wh);
952 
953 	/* send the frame to the upper layer */
954 	rxi.rxi_flags = 0;
955 	rxi.rxi_rssi = frame->rssi_dbm;
956 	rxi.rxi_tstamp = 0;	/* unused */
957 	ieee80211_input(ifp, m, ni, &rxi);
958 
959 	/* node is no longer needed */
960 	ieee80211_release_node(ic, ni);
961 }
962 
963 void
964 iwi_notification_intr(struct iwi_softc *sc, struct iwi_rx_data *data,
965     struct iwi_notif *notif)
966 {
967 	struct ieee80211com *ic = &sc->sc_ic;
968 	struct ifnet *ifp = &ic->ic_if;
969 
970 	switch (notif->type) {
971 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
972 	{
973 #ifdef IWI_DEBUG
974 		struct iwi_notif_scan_channel *chan =
975 		    (struct iwi_notif_scan_channel *)(notif + 1);
976 #endif
977 		DPRINTFN(2, ("Scanning channel (%u)\n", chan->nchan));
978 		break;
979 	}
980 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
981 	{
982 #ifdef IWI_DEBUG
983 		struct iwi_notif_scan_complete *scan =
984 		    (struct iwi_notif_scan_complete *)(notif + 1);
985 #endif
986 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
987 		    scan->status));
988 
989 		/* monitor mode uses scan to set the channel ... */
990 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
991 			ieee80211_end_scan(ifp);
992 		else
993 			iwi_set_chan(sc, ic->ic_ibss_chan);
994 		break;
995 	}
996 	case IWI_NOTIF_TYPE_AUTHENTICATION:
997 	{
998 		struct iwi_notif_authentication *auth =
999 		    (struct iwi_notif_authentication *)(notif + 1);
1000 
1001 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1002 
1003 		switch (auth->state) {
1004 		case IWI_AUTHENTICATED:
1005 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1006 			break;
1007 
1008 		case IWI_DEAUTHENTICATED:
1009 			break;
1010 
1011 		default:
1012 			printf("%s: unknown authentication state %u\n",
1013 			    sc->sc_dev.dv_xname, auth->state);
1014 		}
1015 		break;
1016 	}
1017 	case IWI_NOTIF_TYPE_ASSOCIATION:
1018 	{
1019 		struct iwi_notif_association *assoc =
1020 		    (struct iwi_notif_association *)(notif + 1);
1021 
1022 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1023 		    assoc->status));
1024 
1025 		switch (assoc->state) {
1026 		case IWI_AUTHENTICATED:
1027 			/* re-association, do nothing */
1028 			break;
1029 
1030 		case IWI_ASSOCIATED:
1031 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1032 			break;
1033 
1034 		case IWI_DEASSOCIATED:
1035 			ieee80211_begin_scan(ifp);
1036 			break;
1037 
1038 		default:
1039 			printf("%s: unknown association state %u\n",
1040 			    sc->sc_dev.dv_xname, assoc->state);
1041 		}
1042 		break;
1043 	}
1044 	case IWI_NOTIF_TYPE_BEACON:
1045 	{
1046 		struct iwi_notif_beacon *beacon =
1047 		    (struct iwi_notif_beacon *)(notif + 1);
1048 
1049 		if (letoh32(beacon->status) == IWI_BEACON_MISSED) {
1050 			/* XXX should roam when too many beacons missed */
1051 			DPRINTFN(2, ("%s: %u beacon(s) missed\n",
1052 			    sc->sc_dev.dv_xname, letoh32(beacon->count)));
1053 		}
1054 		break;
1055 	}
1056 	case IWI_NOTIF_TYPE_BAD_LINK:
1057 		DPRINTFN(2, ("link deterioration detected\n"));
1058 		break;
1059 
1060 	case IWI_NOTIF_TYPE_NOISE:
1061 		DPRINTFN(5, ("Measured noise %u\n",
1062 		    letoh32(*(uint32_t *)(notif + 1)) & 0xff));
1063 		break;
1064 
1065 	default:
1066 		DPRINTFN(5, ("Notification (%u)\n", notif->type));
1067 	}
1068 }
1069 
1070 void
1071 iwi_rx_intr(struct iwi_softc *sc)
1072 {
1073 	struct iwi_rx_data *data;
1074 	struct iwi_hdr *hdr;
1075 	uint32_t hw;
1076 
1077 	hw = CSR_READ_4(sc, IWI_CSR_RX_RIDX);
1078 
1079 	for (; sc->rxq.cur != hw;) {
1080 		data = &sc->rxq.data[sc->rxq.cur];
1081 
1082 		bus_dmamap_sync(sc->sc_dmat, data->map, 0, MCLBYTES,
1083 		    BUS_DMASYNC_POSTREAD);
1084 
1085 		hdr = mtod(data->m, struct iwi_hdr *);
1086 
1087 		switch (hdr->type) {
1088 		case IWI_HDR_TYPE_FRAME:
1089 			iwi_frame_intr(sc, data,
1090 			    (struct iwi_frame *)(hdr + 1));
1091 			break;
1092 
1093 		case IWI_HDR_TYPE_NOTIF:
1094 			iwi_notification_intr(sc, data,
1095 			    (struct iwi_notif *)(hdr + 1));
1096 			break;
1097 
1098 		default:
1099 			printf("%s: unknown hdr type %u\n",
1100 			    sc->sc_dev.dv_xname, hdr->type);
1101 		}
1102 
1103 		sc->rxq.cur = (sc->rxq.cur + 1) % IWI_RX_RING_COUNT;
1104 	}
1105 
1106 	/* tell the firmware what we have processed */
1107 	hw = (hw == 0) ? IWI_RX_RING_COUNT - 1 : hw - 1;
1108 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, hw);
1109 }
1110 
1111 void
1112 iwi_tx_intr(struct iwi_softc *sc, struct iwi_tx_ring *txq)
1113 {
1114 	struct ieee80211com *ic = &sc->sc_ic;
1115 	struct ifnet *ifp = &ic->ic_if;
1116 	struct iwi_tx_data *data;
1117 	uint32_t hw;
1118 
1119 	hw = CSR_READ_4(sc, txq->csr_ridx);
1120 
1121 	for (; txq->next != hw;) {
1122 		data = &txq->data[txq->next];
1123 
1124 		bus_dmamap_unload(sc->sc_dmat, data->map);
1125 		m_freem(data->m);
1126 		data->m = NULL;
1127 		ieee80211_release_node(ic, data->ni);
1128 		data->ni = NULL;
1129 
1130 		ifp->if_opackets++;
1131 
1132 		txq->queued--;
1133 		txq->next = (txq->next + 1) % IWI_TX_RING_COUNT;
1134 	}
1135 
1136 	sc->sc_tx_timer = 0;
1137 	ifq_clr_oactive(&ifp->if_snd);
1138 	(*ifp->if_start)(ifp);
1139 }
1140 
1141 int
1142 iwi_intr(void *arg)
1143 {
1144 	struct iwi_softc *sc = arg;
1145 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1146 	uint32_t r;
1147 
1148 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff)
1149 		return 0;
1150 
1151 	/* disable interrupts */
1152 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1153 
1154 	/* acknowledge interrupts */
1155 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1156 
1157 	if (r & IWI_INTR_FATAL_ERROR) {
1158 		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1159 		iwi_stop(ifp, 1);
1160 		task_add(systq, &sc->init_task);
1161 		return 1;
1162 	}
1163 
1164 	if (r & IWI_INTR_FW_INITED)
1165 		wakeup(sc);
1166 
1167 	if (r & IWI_INTR_RADIO_OFF) {
1168 		DPRINTF(("radio transmitter off\n"));
1169 		ifp->if_flags &= ~IFF_UP;
1170 		iwi_stop(ifp, 1);
1171 		return 1;
1172 	}
1173 
1174 	if (r & IWI_INTR_CMD_DONE) {
1175 		/* kick next pending command if any */
1176 		sc->cmdq.next = (sc->cmdq.next + 1) % IWI_CMD_RING_COUNT;
1177 		if (--sc->cmdq.queued > 0)
1178 			CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.next);
1179 
1180 		wakeup(sc);
1181 	}
1182 
1183 	if (r & IWI_INTR_TX1_DONE)
1184 		iwi_tx_intr(sc, &sc->txq[0]);
1185 
1186 	if (r & IWI_INTR_TX2_DONE)
1187 		iwi_tx_intr(sc, &sc->txq[1]);
1188 
1189 	if (r & IWI_INTR_TX3_DONE)
1190 		iwi_tx_intr(sc, &sc->txq[2]);
1191 
1192 	if (r & IWI_INTR_TX4_DONE)
1193 		iwi_tx_intr(sc, &sc->txq[3]);
1194 
1195 	if (r & IWI_INTR_RX_DONE)
1196 		iwi_rx_intr(sc);
1197 
1198 	/* re-enable interrupts */
1199 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1200 
1201 	return 1;
1202 }
1203 
1204 int
1205 iwi_cmd(struct iwi_softc *sc, uint8_t type, void *data, uint8_t len, int async)
1206 {
1207 	struct iwi_cmd_desc *desc;
1208 
1209 	desc = &sc->cmdq.desc[sc->cmdq.cur];
1210 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1211 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1212 	desc->type = type;
1213 	desc->len = len;
1214 	bcopy(data, desc->data, len);
1215 
1216 	bus_dmamap_sync(sc->sc_dmat, sc->cmdq.map,
1217 	    sc->cmdq.cur * sizeof (struct iwi_cmd_desc),
1218 	    sizeof (struct iwi_cmd_desc), BUS_DMASYNC_PREWRITE);
1219 
1220 	DPRINTFN(2, ("sending command idx=%u type=%u len=%u\n", sc->cmdq.cur,
1221 	    type, len));
1222 
1223 	sc->cmdq.cur = (sc->cmdq.cur + 1) % IWI_CMD_RING_COUNT;
1224 
1225 	/* don't kick cmd immediately if another async command is pending */
1226 	if (++sc->cmdq.queued == 1) {
1227 		sc->cmdq.next = sc->cmdq.cur;
1228 		CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.next);
1229 	}
1230 
1231 	return async ? 0 : tsleep(sc, PCATCH, "iwicmd", hz);
1232 }
1233 
1234 /* ARGSUSED */
1235 int
1236 iwi_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, int type,
1237     int arg1, int arg2)
1238 {
1239 	return EOPNOTSUPP;
1240 }
1241 
1242 int
1243 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1244 {
1245 	struct iwi_softc *sc = ifp->if_softc;
1246 	struct ieee80211com *ic = &sc->sc_ic;
1247 	struct ieee80211_frame *wh;
1248 	struct ieee80211_key *k;
1249 	struct iwi_tx_data *data;
1250 	struct iwi_tx_desc *desc;
1251 	struct iwi_tx_ring *txq = &sc->txq[0];
1252 	int hdrlen, error, i, station = 0;
1253 
1254 	wh = mtod(m0, struct ieee80211_frame *);
1255 
1256 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1257 		k = ieee80211_get_txkey(ic, wh, ni);
1258 
1259 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
1260 			return ENOBUFS;
1261 
1262 		/* packet header may have moved, reset our local pointer */
1263 		wh = mtod(m0, struct ieee80211_frame *);
1264 	}
1265 
1266 #if NBPFILTER > 0
1267 	if (sc->sc_drvbpf != NULL) {
1268 		struct mbuf mb;
1269 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1270 
1271 		tap->wt_flags = 0;
1272 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1273 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1274 
1275 		mb.m_data = (caddr_t)tap;
1276 		mb.m_len = sc->sc_txtap_len;
1277 		mb.m_next = m0;
1278 		mb.m_nextpkt = NULL;
1279 		mb.m_type = 0;
1280 		mb.m_flags = 0;
1281 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1282 	}
1283 #endif
1284 
1285 	data = &txq->data[txq->cur];
1286 	desc = &txq->desc[txq->cur];
1287 
1288 	/* copy and trim IEEE802.11 header */
1289 	hdrlen = ieee80211_get_hdrlen(wh);
1290 	bcopy(wh, &desc->wh, hdrlen);
1291 	m_adj(m0, hdrlen);
1292 
1293 #ifndef IEEE80211_STA_ONLY
1294 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1295 		station = iwi_find_txnode(sc, desc->wh.i_addr1);
1296 		if (station == -1) {
1297 			m_freem(m0);
1298 			ieee80211_release_node(ic, ni);
1299 			ifp->if_oerrors++;
1300 			return 0;
1301 		}
1302 	}
1303 #endif
1304 
1305 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1306 	    BUS_DMA_NOWAIT);
1307 	if (error != 0 && error != EFBIG) {
1308 		printf("%s: can't map mbuf (error %d)\n",
1309 		    sc->sc_dev.dv_xname, error);
1310 		m_freem(m0);
1311 		return error;
1312 	}
1313 	if (error != 0) {
1314 		/* too many fragments, linearize */
1315 		if (m_defrag(m0, M_DONTWAIT)) {
1316 			m_freem(m0);
1317 			return ENOBUFS;
1318 		}
1319 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1320 		    BUS_DMA_NOWAIT);
1321 		if (error != 0) {
1322 			printf("%s: can't map mbuf (error %d)\n",
1323 			    sc->sc_dev.dv_xname, error);
1324 			m_freem(m0);
1325 			return error;
1326 		}
1327 	}
1328 
1329 	data->m = m0;
1330 	data->ni = ni;
1331 
1332 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1333 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1334 	desc->cmd = IWI_DATA_CMD_TX;
1335 	desc->len = htole16(m0->m_pkthdr.len);
1336 	desc->station = station;
1337 	desc->flags = IWI_DATA_FLAG_NO_WEP;
1338 	desc->xflags = 0;
1339 
1340 	if (!IEEE80211_IS_MULTICAST(desc->wh.i_addr1))
1341 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1342 
1343 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1344 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1345 
1346 	if ((desc->wh.i_fc[0] &
1347 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
1348 	    (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
1349 		desc->xflags |= IWI_DATA_XFLAG_QOS;
1350 
1351 	if (ic->ic_curmode == IEEE80211_MODE_11B)
1352 		desc->xflags |= IWI_DATA_XFLAG_CCK;
1353 
1354 	desc->nseg = htole32(data->map->dm_nsegs);
1355 	for (i = 0; i < data->map->dm_nsegs; i++) {
1356 		desc->seg_addr[i] = htole32(data->map->dm_segs[i].ds_addr);
1357 		desc->seg_len[i]  = htole16(data->map->dm_segs[i].ds_len);
1358 	}
1359 
1360 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1361 	    BUS_DMASYNC_PREWRITE);
1362 	bus_dmamap_sync(sc->sc_dmat, txq->map,
1363 	    txq->cur * sizeof (struct iwi_tx_desc),
1364 	    sizeof (struct iwi_tx_desc), BUS_DMASYNC_PREWRITE);
1365 
1366 	DPRINTFN(5, ("sending data frame idx=%u len=%u nseg=%u\n", txq->cur,
1367 	    letoh16(desc->len), data->map->dm_nsegs));
1368 
1369 	txq->queued++;
1370 	txq->cur = (txq->cur + 1) % IWI_TX_RING_COUNT;
1371 	CSR_WRITE_4(sc, txq->csr_widx, txq->cur);
1372 
1373 	return 0;
1374 }
1375 
1376 void
1377 iwi_start(struct ifnet *ifp)
1378 {
1379 	struct iwi_softc *sc = ifp->if_softc;
1380 	struct ieee80211com *ic = &sc->sc_ic;
1381 	struct mbuf *m0;
1382 	struct ieee80211_node *ni;
1383 
1384 	if (ic->ic_state != IEEE80211_S_RUN)
1385 		return;
1386 
1387 	for (;;) {
1388 		if (sc->txq[0].queued + IWI_MAX_NSEG + 2 >= IWI_TX_RING_COUNT) {
1389 			ifq_set_oactive(&ifp->if_snd);
1390 			break;
1391 		}
1392 
1393 		IFQ_DEQUEUE(&ifp->if_snd, m0);
1394 		if (m0 == NULL)
1395 			break;
1396 
1397 #if NBPFILTER > 0
1398 		if (ifp->if_bpf != NULL)
1399 			bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1400 #endif
1401 
1402 		m0 = ieee80211_encap(ifp, m0, &ni);
1403 		if (m0 == NULL)
1404 			continue;
1405 
1406 #if NBPFILTER > 0
1407 		if (ic->ic_rawbpf != NULL)
1408 			bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1409 #endif
1410 
1411 		if (iwi_tx_start(ifp, m0, ni) != 0) {
1412 			if (ni != NULL)
1413 				ieee80211_release_node(ic, ni);
1414 			ifp->if_oerrors++;
1415 			break;
1416 		}
1417 
1418 		/* start watchdog timer */
1419 		sc->sc_tx_timer = 5;
1420 		ifp->if_timer = 1;
1421 	}
1422 }
1423 
1424 void
1425 iwi_watchdog(struct ifnet *ifp)
1426 {
1427 	struct iwi_softc *sc = ifp->if_softc;
1428 
1429 	ifp->if_timer = 0;
1430 
1431 	if (sc->sc_tx_timer > 0) {
1432 		if (--sc->sc_tx_timer == 0) {
1433 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1434 			ifp->if_flags &= ~IFF_UP;
1435 			iwi_stop(ifp, 1);
1436 			ifp->if_oerrors++;
1437 			return;
1438 		}
1439 		ifp->if_timer = 1;
1440 	}
1441 
1442 	ieee80211_watchdog(ifp);
1443 }
1444 
1445 int
1446 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1447 {
1448 	struct iwi_softc *sc = ifp->if_softc;
1449 	struct ieee80211com *ic = &sc->sc_ic;
1450 	struct ifreq *ifr;
1451 	int s, error = 0;
1452 
1453 	error = rw_enter(&sc->sc_rwlock, RW_WRITE | RW_INTR);
1454 	if (error)
1455 		return error;
1456 	s = splnet();
1457 
1458 	switch (cmd) {
1459 	case SIOCSIFADDR:
1460 		ifp->if_flags |= IFF_UP;
1461 		/* FALLTHROUGH */
1462 	case SIOCSIFFLAGS:
1463 		if (ifp->if_flags & IFF_UP) {
1464 			if (!(ifp->if_flags & IFF_RUNNING))
1465 				iwi_init(ifp);
1466 		} else {
1467 			if (ifp->if_flags & IFF_RUNNING)
1468 				iwi_stop(ifp, 1);
1469 		}
1470 		break;
1471 
1472 	case SIOCADDMULTI:
1473 	case SIOCDELMULTI:
1474 		ifr = (struct ifreq *)data;
1475 		error = (cmd == SIOCADDMULTI) ?
1476 		    ether_addmulti(ifr, &ic->ic_ac) :
1477 		    ether_delmulti(ifr, &ic->ic_ac);
1478 
1479 		if (error == ENETRESET)
1480 			error = 0;
1481 		break;
1482 
1483 	case SIOCG80211TXPOWER:
1484 		/*
1485 		 * If the hardware radio transmitter switch is off, report a
1486 		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1487 		 * transmitter is killed.
1488 		 */
1489 		((struct ieee80211_txpower *)data)->i_val =
1490 		    (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) ?
1491 		    sc->sc_ic.ic_txpower : IEEE80211_TXPOWER_MIN;
1492 		break;
1493 
1494 	default:
1495 		error = ieee80211_ioctl(ifp, cmd, data);
1496 	}
1497 
1498 	if (error == ENETRESET) {
1499 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1500 		    (IFF_UP | IFF_RUNNING))
1501 			iwi_init(ifp);
1502 		error = 0;
1503 	}
1504 
1505 	splx(s);
1506 	rw_exit_write(&sc->sc_rwlock);
1507 	return error;
1508 }
1509 
1510 void
1511 iwi_stop_master(struct iwi_softc *sc)
1512 {
1513 	uint32_t tmp;
1514 	int ntries;
1515 
1516 	/* disable interrupts */
1517 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1518 
1519 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1520 	for (ntries = 0; ntries < 5; ntries++) {
1521 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1522 			break;
1523 		DELAY(10);
1524 	}
1525 	if (ntries == 5) {
1526 		printf("%s: timeout waiting for master\n",
1527 		    sc->sc_dev.dv_xname);
1528 	}
1529 
1530 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1531 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_PRINCETON_RESET);
1532 }
1533 
1534 int
1535 iwi_reset(struct iwi_softc *sc)
1536 {
1537 	uint32_t tmp;
1538 	int i, ntries;
1539 
1540 	iwi_stop_master(sc);
1541 
1542 	/* move adapter to D0 state */
1543 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1544 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1545 
1546 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
1547 
1548 	/* wait for clock stabilization */
1549 	for (ntries = 0; ntries < 1000; ntries++) {
1550 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
1551 			break;
1552 		DELAY(200);
1553 	}
1554 	if (ntries == 1000) {
1555 		printf("%s: timeout waiting for clock stabilization\n",
1556 		    sc->sc_dev.dv_xname);
1557 		return ETIMEDOUT;
1558 	}
1559 
1560 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1561 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_SW_RESET);
1562 
1563 	DELAY(10);
1564 
1565 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1566 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1567 
1568 	/* clear NIC memory */
1569 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
1570 	for (i = 0; i < 0xc000; i++)
1571 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1572 
1573 	return 0;
1574 }
1575 
1576 int
1577 iwi_load_ucode(struct iwi_softc *sc, const char *data, int size)
1578 {
1579 	const uint16_t *w;
1580 	uint32_t tmp;
1581 	int ntries, i;
1582 
1583 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1584 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_STOP_MASTER);
1585 	for (ntries = 0; ntries < 5; ntries++) {
1586 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1587 			break;
1588 		DELAY(10);
1589 	}
1590 	if (ntries == 5) {
1591 		printf("%s: timeout waiting for master\n",
1592 		    sc->sc_dev.dv_xname);
1593 		return ETIMEDOUT;
1594 	}
1595 
1596 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1597 	DELAY(5000);
1598 
1599 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1600 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp & ~IWI_RST_PRINCETON_RESET);
1601 
1602 	DELAY(5000);
1603 	MEM_WRITE_4(sc, 0x3000e0, 0);
1604 	DELAY(1000);
1605 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 1);
1606 	DELAY(1000);
1607 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 0);
1608 	DELAY(1000);
1609 	MEM_WRITE_1(sc, 0x200000, 0x00);
1610 	MEM_WRITE_1(sc, 0x200000, 0x40);
1611 	DELAY(1000);
1612 
1613 	/* adapter is buggy, we must set the address for each word */
1614 	for (w = (const uint16_t *)data; size > 0; w++, size -= 2)
1615 		MEM_WRITE_2(sc, 0x200010, htole16(*w));
1616 
1617 	MEM_WRITE_1(sc, 0x200000, 0x00);
1618 	MEM_WRITE_1(sc, 0x200000, 0x80);
1619 
1620 	/* wait until we get an answer */
1621 	for (ntries = 0; ntries < 100; ntries++) {
1622 		if (MEM_READ_1(sc, 0x200000) & 1)
1623 			break;
1624 		DELAY(100);
1625 	}
1626 	if (ntries == 100) {
1627 		printf("%s: timeout waiting for ucode to initialize\n",
1628 		    sc->sc_dev.dv_xname);
1629 		return ETIMEDOUT;
1630 	}
1631 
1632 	/* read the answer or the firmware will not initialize properly */
1633 	for (i = 0; i < 7; i++)
1634 		MEM_READ_4(sc, 0x200004);
1635 
1636 	MEM_WRITE_1(sc, 0x200000, 0x00);
1637 
1638 	return 0;
1639 }
1640 
1641 /* macro to handle unaligned little endian data in firmware image */
1642 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1643 
1644 int
1645 iwi_load_firmware(struct iwi_softc *sc, const char *data, int size)
1646 {
1647 	bus_dmamap_t map;
1648 	bus_dma_segment_t seg;
1649 	caddr_t virtaddr;
1650 	u_char *p, *end;
1651 	uint32_t sentinel, tmp, ctl, src, dst, sum, len, mlen;
1652 	int ntries, nsegs, error;
1653 
1654 	/* allocate DMA memory to store firmware image */
1655 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
1656 	    BUS_DMA_NOWAIT, &map);
1657 	if (error != 0) {
1658 		printf("%s: could not create firmware DMA map\n",
1659 		    sc->sc_dev.dv_xname);
1660 		goto fail1;
1661 	}
1662 
1663 	error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0, &seg, 1,
1664 	    &nsegs, BUS_DMA_NOWAIT);
1665 	if (error != 0) {
1666 		printf("%s: could not allocate firmware DMA memory\n",
1667 		    sc->sc_dev.dv_xname);
1668 		goto fail2;
1669 	}
1670 
1671 	error = bus_dmamem_map(sc->sc_dmat, &seg, nsegs, size, &virtaddr,
1672 	    BUS_DMA_NOWAIT);
1673 	if (error != 0) {
1674 		printf("%s: can't map firmware DMA memory\n",
1675 		    sc->sc_dev.dv_xname);
1676 		goto fail3;
1677 	}
1678 
1679 	error = bus_dmamap_load(sc->sc_dmat, map, virtaddr, size, NULL,
1680 	    BUS_DMA_NOWAIT);
1681 	if (error != 0) {
1682 		printf("%s: could not load firmware DMA map\n",
1683 		    sc->sc_dev.dv_xname);
1684 		goto fail4;
1685 	}
1686 
1687 	/* copy firmware image to DMA memory */
1688 	bcopy(data, virtaddr, size);
1689 
1690 	/* make sure the adapter will get up-to-date values */
1691 	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_PREWRITE);
1692 
1693 	/* tell the adapter where the command blocks are stored */
1694 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
1695 
1696 	/*
1697 	 * Store command blocks into adapter's internal memory using register
1698 	 * indirections. The adapter will read the firmware image through DMA
1699 	 * using information stored in command blocks.
1700 	 */
1701 	src = map->dm_segs[0].ds_addr;
1702 	p = virtaddr;
1703 	end = p + size;
1704 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
1705 
1706 	while (p < end) {
1707 		dst = GETLE32(p); p += 4; src += 4;
1708 		len = GETLE32(p); p += 4; src += 4;
1709 		p += len;
1710 
1711 		while (len > 0) {
1712 			mlen = min(len, IWI_CB_MAXDATALEN);
1713 
1714 			ctl = IWI_CB_DEFAULT_CTL | mlen;
1715 			sum = ctl ^ src ^ dst;
1716 
1717 			/* write a command block */
1718 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
1719 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, src);
1720 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, dst);
1721 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
1722 
1723 			src += mlen;
1724 			dst += mlen;
1725 			len -= mlen;
1726 		}
1727 	}
1728 
1729 	/* write a fictive final command block (sentinel) */
1730 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
1731 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1732 
1733 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1734 	tmp &= ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER);
1735 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp);
1736 
1737 	/* tell the adapter to start processing command blocks */
1738 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
1739 
1740 	/* wait until the adapter has processed all command blocks */
1741 	for (ntries = 0; ntries < 400; ntries++) {
1742 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
1743 			break;
1744 		DELAY(100);
1745 	}
1746 	if (ntries == 400) {
1747 		printf("%s: timeout processing cb\n", sc->sc_dev.dv_xname);
1748 		error = ETIMEDOUT;
1749 		goto fail5;
1750 	}
1751 
1752 	/* we're done with command blocks processing */
1753 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
1754 
1755 	/* allow interrupts so we know when the firmware is inited */
1756 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1757 
1758 	/* tell the adapter to initialize the firmware */
1759 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
1760 
1761 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1762 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_ALLOW_STANDBY);
1763 
1764 	/* wait at most one second for firmware initialization to complete */
1765 	if ((error = tsleep(sc, PCATCH, "iwiinit", hz)) != 0) {
1766 		printf("%s: timeout waiting for firmware initialization to "
1767 		    "complete\n", sc->sc_dev.dv_xname);
1768 		goto fail5;
1769 	}
1770 
1771 fail5:	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_POSTWRITE);
1772 	bus_dmamap_unload(sc->sc_dmat, map);
1773 fail4:	bus_dmamem_unmap(sc->sc_dmat, virtaddr, size);
1774 fail3:	bus_dmamem_free(sc->sc_dmat, &seg, 1);
1775 fail2:	bus_dmamap_destroy(sc->sc_dmat, map);
1776 fail1:	return error;
1777 }
1778 
1779 int
1780 iwi_config(struct iwi_softc *sc)
1781 {
1782 	struct ieee80211com *ic = &sc->sc_ic;
1783 	struct ifnet *ifp = &ic->ic_if;
1784 	struct iwi_configuration config;
1785 	struct iwi_rateset rs;
1786 	struct iwi_txpower power;
1787 	uint32_t data;
1788 	int error, nchan, i;
1789 
1790 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1791 	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1792 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1793 	    IEEE80211_ADDR_LEN, 0);
1794 	if (error != 0)
1795 		return error;
1796 
1797 	bzero(&config, sizeof config);
1798 	config.multicast_enabled = 1;
1799 	config.silence_threshold = 30;
1800 	config.report_noise = 1;
1801 	config.answer_pbreq =
1802 #ifndef IEEE80211_STA_ONLY
1803 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 :
1804 #endif
1805 	    0;
1806 	DPRINTF(("Configuring adapter\n"));
1807 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 0);
1808 	if (error != 0)
1809 		return error;
1810 
1811 	data = htole32(IWI_POWER_MODE_CAM);
1812 	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1813 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
1814 	if (error != 0)
1815 		return error;
1816 
1817 	data = htole32(ic->ic_rtsthreshold);
1818 	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1819 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
1820 	if (error != 0)
1821 		return error;
1822 
1823 	data = htole32(ic->ic_fragthreshold);
1824 	DPRINTF(("Setting fragmentation threshold to %u\n", letoh32(data)));
1825 	error = iwi_cmd(sc, IWI_CMD_SET_FRAG_THRESHOLD, &data, sizeof data, 0);
1826 	if (error != 0)
1827 		return error;
1828 
1829 	/*
1830 	 * Set default Tx power for 802.11b/g and 802.11a channels.
1831 	 */
1832 	nchan = 0;
1833 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1834 		if (!IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]))
1835 			continue;
1836 		power.chan[nchan].chan = i;
1837 		power.chan[nchan].power = IWI_TXPOWER_MAX;
1838 		nchan++;
1839 	}
1840 	power.nchan = nchan;
1841 
1842 	power.mode = IWI_MODE_11G;
1843 	DPRINTF(("Setting .11g channels tx power\n"));
1844 	error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power, 0);
1845 	if (error != 0)
1846 		return error;
1847 
1848 	power.mode = IWI_MODE_11B;
1849 	DPRINTF(("Setting .11b channels tx power\n"));
1850 	error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power, 0);
1851 	if (error != 0)
1852 		return error;
1853 
1854 	nchan = 0;
1855 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1856 		if (!IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]))
1857 			continue;
1858 		power.chan[nchan].chan = i;
1859 		power.chan[nchan].power = IWI_TXPOWER_MAX;
1860 		nchan++;
1861 	}
1862 	power.nchan = nchan;
1863 
1864 	if (nchan > 0) {	/* 2915ABG only */
1865 		power.mode = IWI_MODE_11A;
1866 		DPRINTF(("Setting .11a channels tx power\n"));
1867 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
1868 		    0);
1869 		if (error != 0)
1870 			return error;
1871 	}
1872 
1873 	rs.mode = IWI_MODE_11G;
1874 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
1875 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
1876 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates, rs.rates,
1877 	    rs.nrates);
1878 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
1879 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
1880 	if (error != 0)
1881 		return error;
1882 
1883 	rs.mode = IWI_MODE_11A;
1884 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
1885 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
1886 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates, rs.rates,
1887 	    rs.nrates);
1888 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
1889 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
1890 	if (error != 0)
1891 		return error;
1892 
1893 	/* if we have a desired ESSID, set it now */
1894 	if (ic->ic_des_esslen != 0) {
1895 #ifdef IWI_DEBUG
1896 		if (iwi_debug > 0) {
1897 			printf("Setting desired ESSID to ");
1898 			ieee80211_print_essid(ic->ic_des_essid,
1899 			    ic->ic_des_esslen);
1900 			printf("\n");
1901 		}
1902 #endif
1903 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ic->ic_des_essid,
1904 		    ic->ic_des_esslen, 0);
1905 		if (error != 0)
1906 			return error;
1907 	}
1908 
1909 	arc4random_buf(&data, sizeof data);
1910 	DPRINTF(("Setting random seed to %u\n", data));
1911 	error = iwi_cmd(sc, IWI_CMD_SET_RANDOM_SEED, &data, sizeof data, 0);
1912 	if (error != 0)
1913 		return error;
1914 
1915 	/* enable adapter */
1916 	DPRINTF(("Enabling adapter\n"));
1917 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
1918 }
1919 
1920 void
1921 iwi_update_edca(struct ieee80211com *ic)
1922 {
1923 #define IWI_EXP2(v)	htole16((1 << (v)) - 1)
1924 #define IWI_TXOP(v)	IEEE80211_TXOP_TO_US(v)
1925 	struct iwi_softc *sc = ic->ic_softc;
1926 	struct iwi_qos_cmd cmd;
1927 	struct iwi_qos_params *qos;
1928 	struct ieee80211_edca_ac_params *edca = ic->ic_edca_ac;
1929 	int aci;
1930 
1931 	/* set default QoS parameters for CCK */
1932 	qos = &cmd.cck;
1933 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1934 		qos->cwmin[aci] = IWI_EXP2(iwi_cck[aci].ac_ecwmin);
1935 		qos->cwmax[aci] = IWI_EXP2(iwi_cck[aci].ac_ecwmax);
1936 		qos->txop [aci] = IWI_TXOP(iwi_cck[aci].ac_txoplimit);
1937 		qos->aifsn[aci] = iwi_cck[aci].ac_aifsn;
1938 		qos->acm  [aci] = 0;
1939 	}
1940 	/* set default QoS parameters for OFDM */
1941 	qos = &cmd.ofdm;
1942 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1943 		qos->cwmin[aci] = IWI_EXP2(iwi_ofdm[aci].ac_ecwmin);
1944 		qos->cwmax[aci] = IWI_EXP2(iwi_ofdm[aci].ac_ecwmax);
1945 		qos->txop [aci] = IWI_TXOP(iwi_ofdm[aci].ac_txoplimit);
1946 		qos->aifsn[aci] = iwi_ofdm[aci].ac_aifsn;
1947 		qos->acm  [aci] = 0;
1948 	}
1949 	/* set current QoS parameters */
1950 	qos = &cmd.current;
1951 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1952 		qos->cwmin[aci] = IWI_EXP2(edca[aci].ac_ecwmin);
1953 		qos->cwmax[aci] = IWI_EXP2(edca[aci].ac_ecwmax);
1954 		qos->txop [aci] = IWI_TXOP(edca[aci].ac_txoplimit);
1955 		qos->aifsn[aci] = edca[aci].ac_aifsn;
1956 		qos->acm  [aci] = 0;
1957 	}
1958 
1959 	DPRINTF(("Setting QoS parameters\n"));
1960 	(void)iwi_cmd(sc, IWI_CMD_SET_QOS_PARAMS, &cmd, sizeof cmd, 1);
1961 #undef IWI_EXP2
1962 #undef IWI_TXOP
1963 }
1964 
1965 int
1966 iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
1967 {
1968 	struct ieee80211com *ic = &sc->sc_ic;
1969 	struct iwi_scan scan;
1970 
1971 	bzero(&scan, sizeof scan);
1972 	memset(scan.type, IWI_SCAN_TYPE_PASSIVE, sizeof scan.type);
1973 	scan.passive = htole16(2000);
1974 	scan.channels[0] = 1 |
1975 	    (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
1976 	scan.channels[1] = ieee80211_chan2ieee(ic, chan);
1977 
1978 	DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
1979 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
1980 }
1981 
1982 int
1983 iwi_scan(struct iwi_softc *sc)
1984 {
1985 	struct ieee80211com *ic = &sc->sc_ic;
1986 	struct iwi_scan scan;
1987 	uint8_t *p;
1988 	int i, count;
1989 
1990 	bzero(&scan, sizeof scan);
1991 
1992 	if (ic->ic_des_esslen != 0) {
1993 		scan.bdirected = htole16(40);
1994 		memset(scan.type, IWI_SCAN_TYPE_BDIRECTED, sizeof scan.type);
1995 	} else {
1996 		scan.broadcast = htole16(40);
1997 		memset(scan.type, IWI_SCAN_TYPE_BROADCAST, sizeof scan.type);
1998 	}
1999 
2000 	p = scan.channels;
2001 	count = 0;
2002 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2003 		if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i])) {
2004 			*++p = i;
2005 			count++;
2006 		}
2007 	}
2008 	*(p - count) = IWI_CHAN_5GHZ | count;
2009 
2010 	p = (count > 0) ? p + 1 : scan.channels;
2011 	count = 0;
2012 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2013 		if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i])) {
2014 			*++p = i;
2015 			count++;
2016 		}
2017 	}
2018 	*(p - count) = IWI_CHAN_2GHZ | count;
2019 
2020 	DPRINTF(("Start scanning\n"));
2021 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2022 }
2023 
2024 int
2025 iwi_auth_and_assoc(struct iwi_softc *sc)
2026 {
2027 	struct ieee80211com *ic = &sc->sc_ic;
2028 	struct ieee80211_node *ni = ic->ic_bss;
2029 	struct iwi_configuration config;
2030 	struct iwi_associate assoc;
2031 	struct iwi_rateset rs;
2032 	uint8_t *frm;
2033 	uint32_t data;
2034 	uint16_t capinfo;
2035 	uint8_t buf[64];	/* XXX max WPA/RSN/WMM IE length */
2036 	int error;
2037 
2038 	/* update adapter configuration */
2039 	bzero(&config, sizeof config);
2040 	config.multicast_enabled = 1;
2041 	config.disable_unicast_decryption = 1;
2042 	config.disable_multicast_decryption = 1;
2043 	config.silence_threshold = 30;
2044 	config.report_noise = 1;
2045 	config.answer_pbreq =
2046 #ifndef IEEE80211_STA_ONLY
2047 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 :
2048 #endif
2049 	    0;
2050 	if (ic->ic_curmode == IEEE80211_MODE_11G)
2051 		config.bg_autodetection = 1;
2052 	DPRINTF(("Configuring adapter\n"));
2053 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 1);
2054 	if (error != 0)
2055 		return error;
2056 
2057 #ifdef IWI_DEBUG
2058 	if (iwi_debug > 0) {
2059 		printf("Setting ESSID to ");
2060 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2061 		printf("\n");
2062 	}
2063 #endif
2064 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2065 	if (error != 0)
2066 		return error;
2067 
2068 	/* the rate set has already been "negotiated" */
2069 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2070 	    IWI_MODE_11G;
2071 	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2072 	rs.nrates = ni->ni_rates.rs_nrates;
2073 	if (rs.nrates > sizeof rs.rates) {
2074 #ifdef DIAGNOSTIC
2075 		/* should not happen since the rates are negotiated */
2076 		printf("%s: XXX too many rates (count=%d, last=%d)\n",
2077 		    sc->sc_dev.dv_xname, ni->ni_rates.rs_nrates,
2078 		    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates - 1] &
2079 		    IEEE80211_RATE_VAL);
2080 #endif
2081 		rs.nrates = sizeof rs.rates;
2082 	}
2083 	bcopy(ni->ni_rates.rs_rates, rs.rates, rs.nrates);
2084 	DPRINTF(("Setting negotiated rates (%u)\n", rs.nrates));
2085 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2086 	if (error != 0)
2087 		return error;
2088 
2089 	data = htole32(ni->ni_rssi);
2090 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2091 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2092 	if (error != 0)
2093 		return error;
2094 
2095 	if (ic->ic_flags & IEEE80211_F_QOS) {
2096 		iwi_update_edca(ic);
2097 
2098 		frm = ieee80211_add_qos_capability(buf, ic);
2099 		DPRINTF(("Setting QoS Capability IE length %d\n", frm - buf));
2100 		error = iwi_cmd(sc, IWI_CMD_SET_QOS_CAP, buf, frm - buf, 1);
2101 		if (error != 0)
2102 			return error;
2103 	}
2104 	if (ic->ic_flags & IEEE80211_F_RSNON) {
2105 		/* tell firmware to add WPA/RSN IE to (re)assoc request */
2106 		if (ni->ni_rsnprotos == IEEE80211_PROTO_RSN)
2107 			frm = ieee80211_add_rsn(buf, ic, ni);
2108 		else
2109 			frm = ieee80211_add_wpa(buf, ic, ni);
2110 		DPRINTF(("Setting RSN IE length %d\n", frm - buf));
2111 		error = iwi_cmd(sc, IWI_CMD_SET_OPTIE, buf, frm - buf, 1);
2112 		if (error != 0)
2113 			return error;
2114 	}
2115 
2116 	bzero(&assoc, sizeof assoc);
2117 #ifndef IEEE80211_STA_ONLY
2118 	if (ic->ic_flags & IEEE80211_F_SIBSS)
2119 		assoc.type = IWI_ASSOC_SIBSS;
2120 	else
2121 #endif
2122 		assoc.type = IWI_ASSOC_ASSOCIATE;
2123 	assoc.policy = 0;
2124 	if (ic->ic_flags & IEEE80211_F_RSNON)
2125 		assoc.policy |= htole16(IWI_ASSOC_POLICY_RSN);
2126 	if (ic->ic_flags & IEEE80211_F_QOS)
2127 		assoc.policy |= htole16(IWI_ASSOC_POLICY_QOS);
2128 	if (ic->ic_curmode == IEEE80211_MODE_11A)
2129 		assoc.mode = IWI_MODE_11A;
2130 	else if (ic->ic_curmode == IEEE80211_MODE_11B)
2131 		assoc.mode = IWI_MODE_11B;
2132 	else	/* assume 802.11b/g */
2133 		assoc.mode = IWI_MODE_11G;
2134 	assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2135 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2136 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2137 		assoc.plen = IWI_ASSOC_SHPREAMBLE;
2138 	bcopy(ni->ni_tstamp, assoc.tstamp, 8);
2139 	capinfo = IEEE80211_CAPINFO_ESS;
2140 	if (ic->ic_flags & IEEE80211_F_WEPON)
2141 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2142 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2143 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2144 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2145 	if (ic->ic_caps & IEEE80211_C_SHSLOT)
2146 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2147 	assoc.capinfo = htole16(capinfo);
2148 
2149 	assoc.lintval = htole16(ic->ic_lintval);
2150 	assoc.intval = htole16(ni->ni_intval);
2151 	IEEE80211_ADDR_COPY(assoc.bssid, ni->ni_bssid);
2152 #ifndef IEEE80211_STA_ONLY
2153 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2154 		IEEE80211_ADDR_COPY(assoc.dst, etherbroadcastaddr);
2155 	else
2156 #endif
2157 		IEEE80211_ADDR_COPY(assoc.dst, ni->ni_bssid);
2158 
2159 	DPRINTF(("Trying to associate to %s channel %u auth %u\n",
2160 	    ether_sprintf(assoc.bssid), assoc.chan, assoc.auth));
2161 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &assoc, sizeof assoc, 1);
2162 }
2163 
2164 int
2165 iwi_init(struct ifnet *ifp)
2166 {
2167 	struct iwi_softc *sc = ifp->if_softc;
2168 	struct ieee80211com *ic = &sc->sc_ic;
2169 	struct iwi_firmware_hdr *hdr;
2170 	const char *name, *fw;
2171 	u_char *data;
2172 	size_t size;
2173 	int i, ac, error;
2174 
2175 	iwi_stop(ifp, 0);
2176 
2177 	if ((error = iwi_reset(sc)) != 0) {
2178 		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
2179 		goto fail1;
2180 	}
2181 
2182 	switch (ic->ic_opmode) {
2183 	case IEEE80211_M_STA:
2184 		name = "iwi-bss";
2185 		break;
2186 #ifndef IEEE80211_STA_ONLY
2187 	case IEEE80211_M_IBSS:
2188 	case IEEE80211_M_AHDEMO:
2189 		name = "iwi-ibss";
2190 		break;
2191 #endif
2192 	case IEEE80211_M_MONITOR:
2193 		name = "iwi-monitor";
2194 		break;
2195 	default:
2196 		/* should not get there */
2197 		error = EINVAL;
2198 		goto fail1;
2199 	}
2200 
2201 	if ((error = loadfirmware(name, &data, &size)) != 0) {
2202 		printf("%s: error %d, could not read firmware %s\n",
2203 		    sc->sc_dev.dv_xname, error, name);
2204 		goto fail1;
2205 	}
2206 	if (size < sizeof (struct iwi_firmware_hdr)) {
2207 		printf("%s: firmware image too short: %zu bytes\n",
2208 		    sc->sc_dev.dv_xname, size);
2209 		error = EINVAL;
2210 		goto fail2;
2211 	}
2212 	hdr = (struct iwi_firmware_hdr *)data;
2213 
2214 	if (hdr->vermaj < 3 || hdr->bootsz == 0 || hdr->ucodesz == 0 ||
2215 	    hdr->mainsz == 0) {
2216 		printf("%s: firmware image too old (need at least 3.0)\n",
2217 		    sc->sc_dev.dv_xname);
2218 		error = EINVAL;
2219 		goto fail2;
2220 	}
2221 
2222 	if (size < sizeof (struct iwi_firmware_hdr) + letoh32(hdr->bootsz) +
2223 	    letoh32(hdr->ucodesz) + letoh32(hdr->mainsz)) {
2224 		printf("%s: firmware image too short: %zu bytes\n",
2225 		    sc->sc_dev.dv_xname, size);
2226 		error = EINVAL;
2227 		goto fail2;
2228 	}
2229 
2230 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr);
2231 	if ((error = iwi_load_firmware(sc, fw, letoh32(hdr->bootsz))) != 0) {
2232 		printf("%s: could not load boot firmware\n",
2233 		    sc->sc_dev.dv_xname);
2234 		goto fail2;
2235 	}
2236 
2237 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr) +
2238 	    letoh32(hdr->bootsz);
2239 	if ((error = iwi_load_ucode(sc, fw, letoh32(hdr->ucodesz))) != 0) {
2240 		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
2241 		goto fail2;
2242 	}
2243 
2244 	iwi_stop_master(sc);
2245 
2246 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmdq.map->dm_segs[0].ds_addr);
2247 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, IWI_CMD_RING_COUNT);
2248 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
2249 
2250 	for (ac = 0; ac < EDCA_NUM_AC; ac++) {
2251 		CSR_WRITE_4(sc, IWI_CSR_TX_BASE(ac),
2252 		    sc->txq[ac].map->dm_segs[0].ds_addr);
2253 		CSR_WRITE_4(sc, IWI_CSR_TX_SIZE(ac), IWI_TX_RING_COUNT);
2254 		CSR_WRITE_4(sc, IWI_CSR_TX_WIDX(ac), sc->txq[ac].cur);
2255 	}
2256 
2257 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
2258 		struct iwi_rx_data *data = &sc->rxq.data[i];
2259 		CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
2260 	}
2261 
2262 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, IWI_RX_RING_COUNT - 1);
2263 
2264 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr) +
2265 	    letoh32(hdr->bootsz) + letoh32(hdr->ucodesz);
2266 	if ((error = iwi_load_firmware(sc, fw, letoh32(hdr->mainsz))) != 0) {
2267 		printf("%s: could not load main firmware\n",
2268 		    sc->sc_dev.dv_xname);
2269 		goto fail2;
2270 	}
2271 
2272 	free(data, M_DEVBUF, size);
2273 
2274 	if ((error = iwi_config(sc)) != 0) {
2275 		printf("%s: device configuration failed\n",
2276 		    sc->sc_dev.dv_xname);
2277 		goto fail1;
2278 	}
2279 
2280 	ifq_clr_oactive(&ifp->if_snd);
2281 	ifp->if_flags |= IFF_RUNNING;
2282 
2283 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2284 		ieee80211_begin_scan(ifp);
2285 	else
2286 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2287 
2288 	return 0;
2289 
2290 fail2:	free(data, M_DEVBUF, size);
2291 fail1:	iwi_stop(ifp, 0);
2292 	return error;
2293 }
2294 
2295 void
2296 iwi_stop(struct ifnet *ifp, int disable)
2297 {
2298 	struct iwi_softc *sc = ifp->if_softc;
2299 	struct ieee80211com *ic = &sc->sc_ic;
2300 	int ac;
2301 
2302 	sc->sc_tx_timer = 0;
2303 	ifp->if_timer = 0;
2304 	ifp->if_flags &= ~IFF_RUNNING;
2305 	ifq_clr_oactive(&ifp->if_snd);
2306 
2307 	/* in case we were scanning, release the scan "lock" */
2308 	ic->ic_scan_lock = IEEE80211_SCAN_UNLOCKED;
2309 
2310 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2311 
2312 	iwi_stop_master(sc);
2313 
2314 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SW_RESET);
2315 
2316 	/* reset rings */
2317 	iwi_reset_cmd_ring(sc, &sc->cmdq);
2318 	for (ac = 0; ac < EDCA_NUM_AC; ac++)
2319 		iwi_reset_tx_ring(sc, &sc->txq[ac]);
2320 	iwi_reset_rx_ring(sc, &sc->rxq);
2321 }
2322 
2323 struct cfdriver iwi_cd = {
2324 	NULL, "iwi", DV_IFNET
2325 };
2326