xref: /openbsd/sys/dev/pci/if_iwi.c (revision 8529ddd3)
1 /*	$OpenBSD: if_iwi.c,v 1.124 2015/03/14 03:38:48 jsg Exp $	*/
2 
3 /*-
4  * Copyright (c) 2004-2008
5  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Intel PRO/Wireless 2200BG/2915ABG 802.11 network adapters.
22  */
23 
24 #include "bpfilter.h"
25 
26 #include <sys/param.h>
27 #include <sys/sockio.h>
28 #include <sys/mbuf.h>
29 #include <sys/kernel.h>
30 #include <sys/socket.h>
31 #include <sys/systm.h>
32 #include <sys/conf.h>
33 #include <sys/device.h>
34 #include <sys/task.h>
35 #include <sys/endian.h>
36 
37 #include <machine/bus.h>
38 #include <machine/intr.h>
39 
40 #include <dev/pci/pcireg.h>
41 #include <dev/pci/pcivar.h>
42 #include <dev/pci/pcidevs.h>
43 
44 #if NBPFILTER > 0
45 #include <net/bpf.h>
46 #endif
47 #include <net/if.h>
48 #include <net/if_arp.h>
49 #include <net/if_dl.h>
50 #include <net/if_media.h>
51 #include <net/if_types.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/if_ether.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_radiotap.h>
58 
59 #include <dev/pci/if_iwireg.h>
60 #include <dev/pci/if_iwivar.h>
61 
62 const struct pci_matchid iwi_devices[] = {
63 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2200BG },
64 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2225BG },
65 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1 },
66 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2 }
67 };
68 
69 int		iwi_match(struct device *, void *, void *);
70 void		iwi_attach(struct device *, struct device *, void *);
71 int		iwi_activate(struct device *, int);
72 void		iwi_wakeup(struct iwi_softc *);
73 void		iwi_init_task(void *);
74 int		iwi_alloc_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
75 void		iwi_reset_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
76 void		iwi_free_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
77 int		iwi_alloc_tx_ring(struct iwi_softc *, struct iwi_tx_ring *,
78 		    int);
79 void		iwi_reset_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
80 void		iwi_free_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
81 int		iwi_alloc_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
82 void		iwi_reset_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
83 void		iwi_free_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
84 int		iwi_media_change(struct ifnet *);
85 void		iwi_media_status(struct ifnet *, struct ifmediareq *);
86 uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
87 int		iwi_find_txnode(struct iwi_softc *, const uint8_t *);
88 int		iwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
89 uint8_t		iwi_rate(int);
90 void		iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *,
91 		    struct iwi_frame *);
92 void		iwi_notification_intr(struct iwi_softc *, struct iwi_rx_data *,
93 		    struct iwi_notif *);
94 void		iwi_rx_intr(struct iwi_softc *);
95 void		iwi_tx_intr(struct iwi_softc *, struct iwi_tx_ring *);
96 int		iwi_intr(void *);
97 int		iwi_cmd(struct iwi_softc *, uint8_t, void *, uint8_t, int);
98 int		iwi_send_mgmt(struct ieee80211com *, struct ieee80211_node *,
99 		    int, int, int);
100 int		iwi_tx_start(struct ifnet *, struct mbuf *,
101 		    struct ieee80211_node *);
102 void		iwi_start(struct ifnet *);
103 void		iwi_watchdog(struct ifnet *);
104 int		iwi_ioctl(struct ifnet *, u_long, caddr_t);
105 void		iwi_stop_master(struct iwi_softc *);
106 int		iwi_reset(struct iwi_softc *);
107 int		iwi_load_ucode(struct iwi_softc *, const char *, int);
108 int		iwi_load_firmware(struct iwi_softc *, const char *, int);
109 int		iwi_config(struct iwi_softc *);
110 void		iwi_update_edca(struct ieee80211com *);
111 int		iwi_set_chan(struct iwi_softc *, struct ieee80211_channel *);
112 int		iwi_scan(struct iwi_softc *);
113 int		iwi_auth_and_assoc(struct iwi_softc *);
114 int		iwi_init(struct ifnet *);
115 void		iwi_stop(struct ifnet *, int);
116 
117 static __inline uint8_t
118 MEM_READ_1(struct iwi_softc *sc, uint32_t addr)
119 {
120 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
121 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
122 }
123 
124 static __inline uint32_t
125 MEM_READ_4(struct iwi_softc *sc, uint32_t addr)
126 {
127 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
128 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
129 }
130 
131 #ifdef IWI_DEBUG
132 #define DPRINTF(x)	do { if (iwi_debug > 0) printf x; } while (0)
133 #define DPRINTFN(n, x)	do { if (iwi_debug >= (n)) printf x; } while (0)
134 int iwi_debug = 0;
135 #else
136 #define DPRINTF(x)
137 #define DPRINTFN(n, x)
138 #endif
139 
140 struct cfattach iwi_ca = {
141 	sizeof (struct iwi_softc), iwi_match, iwi_attach, NULL,
142 	iwi_activate
143 };
144 
145 int
146 iwi_match(struct device *parent, void *match, void *aux)
147 {
148 	return pci_matchbyid((struct pci_attach_args *)aux, iwi_devices,
149 	    nitems(iwi_devices));
150 }
151 
152 /* Base Address Register */
153 #define IWI_PCI_BAR0	0x10
154 
155 void
156 iwi_attach(struct device *parent, struct device *self, void *aux)
157 {
158 	struct iwi_softc *sc = (struct iwi_softc *)self;
159 	struct ieee80211com *ic = &sc->sc_ic;
160 	struct ifnet *ifp = &ic->ic_if;
161 	struct pci_attach_args *pa = aux;
162 	const char *intrstr;
163 	bus_space_tag_t memt;
164 	bus_space_handle_t memh;
165 	pci_intr_handle_t ih;
166 	pcireg_t data;
167 	uint16_t val;
168 	int error, ac, i;
169 
170 	sc->sc_pct = pa->pa_pc;
171 	sc->sc_pcitag = pa->pa_tag;
172 
173 	/* clear device specific PCI configuration register 0x41 */
174 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
175 	data &= ~0x0000ff00;
176 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
177 
178 	/* map the register window */
179 	error = pci_mapreg_map(pa, IWI_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
180 	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, NULL, &sc->sc_sz, 0);
181 	if (error != 0) {
182 		printf(": can't map mem space\n");
183 		return;
184 	}
185 
186 	sc->sc_st = memt;
187 	sc->sc_sh = memh;
188 	sc->sc_dmat = pa->pa_dmat;
189 
190 	if (pci_intr_map(pa, &ih) != 0) {
191 		printf(": can't map interrupt\n");
192 		return;
193 	}
194 
195 	intrstr = pci_intr_string(sc->sc_pct, ih);
196 	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, iwi_intr, sc,
197 	    sc->sc_dev.dv_xname);
198 	if (sc->sc_ih == NULL) {
199 		printf(": can't establish interrupt");
200 		if (intrstr != NULL)
201 			printf(" at %s", intrstr);
202 		printf("\n");
203 		return;
204 	}
205 	printf(": %s", intrstr);
206 
207 	if (iwi_reset(sc) != 0) {
208 		printf(": could not reset adapter\n");
209 		return;
210 	}
211 
212 	/*
213 	 * Allocate rings.
214 	 */
215 	if (iwi_alloc_cmd_ring(sc, &sc->cmdq) != 0) {
216 		printf(": could not allocate Cmd ring\n");
217 		return;
218 	}
219 	for (ac = 0; ac < EDCA_NUM_AC; ac++) {
220 		if (iwi_alloc_tx_ring(sc, &sc->txq[ac], ac) != 0) {
221 			printf(": could not allocate Tx ring %d\n", ac);
222 			goto fail;
223 		}
224 	}
225 	if (iwi_alloc_rx_ring(sc, &sc->rxq) != 0) {
226 		printf(": could not allocate Rx ring\n");
227 		goto fail;
228 	}
229 
230 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
231 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
232 	ic->ic_state = IEEE80211_S_INIT;
233 
234 	/* set device capabilities */
235 	ic->ic_caps =
236 #ifndef IEEE80211_STA_ONLY
237 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
238 #endif
239 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
240 	    IEEE80211_C_TXPMGT |	/* tx power management */
241 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
242 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
243 	    IEEE80211_C_WEP |		/* s/w WEP */
244 	    IEEE80211_C_RSN |		/* WPA/RSN supported */
245 	    IEEE80211_C_SCANALL;	/* h/w scanning */
246 
247 	/* read MAC address from EEPROM */
248 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
249 	ic->ic_myaddr[0] = val & 0xff;
250 	ic->ic_myaddr[1] = val >> 8;
251 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
252 	ic->ic_myaddr[2] = val & 0xff;
253 	ic->ic_myaddr[3] = val >> 8;
254 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
255 	ic->ic_myaddr[4] = val & 0xff;
256 	ic->ic_myaddr[5] = val >> 8;
257 
258 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
259 
260 	if (PCI_PRODUCT(pa->pa_id) >= PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1) {
261 		/* set supported .11a rates */
262 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
263 		    ieee80211_std_rateset_11a;
264 
265 		/* set supported .11a channels */
266 		for (i = 36; i <= 64; i += 4) {
267 			ic->ic_channels[i].ic_freq =
268 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
269 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
270 		}
271 		for (i = 149; i <= 165; i += 4) {
272 			ic->ic_channels[i].ic_freq =
273 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
274 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
275 		}
276 	}
277 
278 	/* set supported .11b and .11g rates */
279 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
280 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
281 
282 	/* set supported .11b and .11g channels (1 through 14) */
283 	for (i = 1; i <= 14; i++) {
284 		ic->ic_channels[i].ic_freq =
285 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
286 		ic->ic_channels[i].ic_flags =
287 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
288 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
289 	}
290 
291 	/* IBSS channel undefined for now */
292 	ic->ic_ibss_chan = &ic->ic_channels[0];
293 
294 	ifp->if_softc = sc;
295 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
296 	ifp->if_ioctl = iwi_ioctl;
297 	ifp->if_start = iwi_start;
298 	ifp->if_watchdog = iwi_watchdog;
299 	IFQ_SET_READY(&ifp->if_snd);
300 	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
301 
302 	if_attach(ifp);
303 	ieee80211_ifattach(ifp);
304 	/* override state transition machine */
305 	sc->sc_newstate = ic->ic_newstate;
306 	ic->ic_newstate = iwi_newstate;
307 	ic->ic_send_mgmt = iwi_send_mgmt;
308 	ieee80211_media_init(ifp, iwi_media_change, iwi_media_status);
309 
310 #if NBPFILTER > 0
311 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
312 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
313 
314 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
315 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
316 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
317 
318 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
319 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
320 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
321 #endif
322 
323 	task_set(&sc->init_task, iwi_init_task, sc);
324 	return;
325 
326 fail:	while (--ac >= 0)
327 		iwi_free_tx_ring(sc, &sc->txq[ac]);
328 	iwi_free_cmd_ring(sc, &sc->cmdq);
329 }
330 
331 int
332 iwi_activate(struct device *self, int act)
333 {
334 	struct iwi_softc *sc = (struct iwi_softc *)self;
335 	struct ifnet *ifp = &sc->sc_ic.ic_if;
336 
337 	switch (act) {
338 	case DVACT_SUSPEND:
339 		if (ifp->if_flags & IFF_RUNNING)
340 			iwi_stop(ifp, 0);
341 		break;
342 	case DVACT_WAKEUP:
343 		iwi_wakeup(sc);
344 		break;
345 	}
346 
347 	return 0;
348 }
349 
350 void
351 iwi_wakeup(struct iwi_softc *sc)
352 {
353 	pcireg_t data;
354 
355 	/* clear device specific PCI configuration register 0x41 */
356 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
357 	data &= ~0x0000ff00;
358 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
359 
360 	iwi_init_task(sc);
361 }
362 
363 void
364 iwi_init_task(void *arg1)
365 {
366 	struct iwi_softc *sc = arg1;
367 	struct ifnet *ifp = &sc->sc_ic.ic_if;
368 	int s;
369 
370 	s = splnet();
371 	while (sc->sc_flags & IWI_FLAG_BUSY)
372 		tsleep(&sc->sc_flags, 0, "iwipwr", 0);
373 	sc->sc_flags |= IWI_FLAG_BUSY;
374 
375 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == IFF_UP)
376 		iwi_init(ifp);
377 
378 	sc->sc_flags &= ~IWI_FLAG_BUSY;
379 	wakeup(&sc->sc_flags);
380 	splx(s);
381 }
382 
383 int
384 iwi_alloc_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
385 {
386 	int nsegs, error;
387 
388 	ring->queued = 0;
389 	ring->cur = ring->next = 0;
390 
391 	error = bus_dmamap_create(sc->sc_dmat,
392 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, 1,
393 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, 0,
394 	    BUS_DMA_NOWAIT, &ring->map);
395 	if (error != 0) {
396 		printf("%s: could not create cmd ring DMA map\n",
397 		    sc->sc_dev.dv_xname);
398 		goto fail;
399 	}
400 
401 	error = bus_dmamem_alloc(sc->sc_dmat,
402 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, PAGE_SIZE, 0,
403 	    &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
404 	if (error != 0) {
405 		printf("%s: could not allocate cmd ring DMA memory\n",
406 		    sc->sc_dev.dv_xname);
407 		goto fail;
408 	}
409 
410 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
411 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT,
412 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
413 	if (error != 0) {
414 		printf("%s: can't map cmd ring DMA memory\n",
415 		    sc->sc_dev.dv_xname);
416 		goto fail;
417 	}
418 
419 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
420 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, NULL,
421 	    BUS_DMA_NOWAIT);
422 	if (error != 0) {
423 		printf("%s: could not load cmd ring DMA map\n",
424 		    sc->sc_dev.dv_xname);
425 		goto fail;
426 	}
427 
428 	return 0;
429 
430 fail:	iwi_free_cmd_ring(sc, ring);
431 	return error;
432 }
433 
434 void
435 iwi_reset_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
436 {
437 	ring->queued = 0;
438 	ring->cur = ring->next = 0;
439 }
440 
441 void
442 iwi_free_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
443 {
444 	if (ring->map != NULL) {
445 		if (ring->desc != NULL) {
446 			bus_dmamap_unload(sc->sc_dmat, ring->map);
447 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
448 			    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT);
449 			bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
450 		}
451 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
452 	}
453 }
454 
455 int
456 iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring, int ac)
457 {
458 	struct iwi_tx_data *data;
459 	int i, nsegs, error;
460 
461 	ring->queued = 0;
462 	ring->cur = ring->next = 0;
463 	ring->csr_ridx = IWI_CSR_TX_RIDX(ac);
464 	ring->csr_widx = IWI_CSR_TX_WIDX(ac);
465 
466 	error = bus_dmamap_create(sc->sc_dmat,
467 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, 1,
468 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, 0, BUS_DMA_NOWAIT,
469 	    &ring->map);
470 	if (error != 0) {
471 		printf("%s: could not create tx ring DMA map\n",
472 		    sc->sc_dev.dv_xname);
473 		goto fail;
474 	}
475 
476 	error = bus_dmamem_alloc(sc->sc_dmat,
477 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, PAGE_SIZE, 0,
478 	    &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
479 	if (error != 0) {
480 		printf("%s: could not allocate tx ring DMA memory\n",
481 		    sc->sc_dev.dv_xname);
482 		goto fail;
483 	}
484 
485 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
486 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT,
487 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
488 	if (error != 0) {
489 		printf("%s: can't map tx ring DMA memory\n",
490 		    sc->sc_dev.dv_xname);
491 		goto fail;
492 	}
493 
494 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
495 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, NULL,
496 	    BUS_DMA_NOWAIT);
497 	if (error != 0) {
498 		printf("%s: could not load tx ring DMA map\n",
499 		    sc->sc_dev.dv_xname);
500 		goto fail;
501 	}
502 
503 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
504 		data = &ring->data[i];
505 
506 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
507 		    IWI_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT, &data->map);
508 		if (error != 0) {
509 			printf("%s: could not create tx buf DMA map\n",
510 			    sc->sc_dev.dv_xname);
511 			goto fail;
512 		}
513 	}
514 
515 	return 0;
516 
517 fail:	iwi_free_tx_ring(sc, ring);
518 	return error;
519 }
520 
521 void
522 iwi_reset_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
523 {
524 	struct iwi_tx_data *data;
525 	int i;
526 
527 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
528 		data = &ring->data[i];
529 
530 		if (data->m != NULL) {
531 			bus_dmamap_unload(sc->sc_dmat, data->map);
532 			m_freem(data->m);
533 			data->m = NULL;
534 		}
535 	}
536 
537 	ring->queued = 0;
538 	ring->cur = ring->next = 0;
539 }
540 
541 void
542 iwi_free_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
543 {
544 	struct iwi_tx_data *data;
545 	int i;
546 
547 	if (ring->map != NULL) {
548 		if (ring->desc != NULL) {
549 			bus_dmamap_unload(sc->sc_dmat, ring->map);
550 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
551 			    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT);
552 			bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
553 		}
554 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
555 	}
556 
557 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
558 		data = &ring->data[i];
559 
560 		if (data->m != NULL) {
561 			bus_dmamap_unload(sc->sc_dmat, data->map);
562 			m_freem(data->m);
563 		}
564 		bus_dmamap_destroy(sc->sc_dmat, data->map);
565 	}
566 }
567 
568 int
569 iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
570 {
571 	struct iwi_rx_data *data;
572 	int i, error;
573 
574 	ring->cur = 0;
575 
576 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
577 		data = &sc->rxq.data[i];
578 
579 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
580 		    0, BUS_DMA_NOWAIT, &data->map);
581 		if (error != 0) {
582 			printf("%s: could not create rx buf DMA map\n",
583 			    sc->sc_dev.dv_xname);
584 			goto fail;
585 		}
586 
587 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
588 		if (data->m == NULL) {
589 			printf("%s: could not allocate rx mbuf\n",
590 			    sc->sc_dev.dv_xname);
591 			error = ENOMEM;
592 			goto fail;
593 		}
594 		MCLGET(data->m, M_DONTWAIT);
595 		if (!(data->m->m_flags & M_EXT)) {
596 			m_freem(data->m);
597 			data->m = NULL;
598 			printf("%s: could not allocate rx mbuf cluster\n",
599 			    sc->sc_dev.dv_xname);
600 			error = ENOMEM;
601 			goto fail;
602 		}
603 
604 		error = bus_dmamap_load(sc->sc_dmat, data->map,
605 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
606 		if (error != 0) {
607 			printf("%s: could not load rx buf DMA map\n",
608 			    sc->sc_dev.dv_xname);
609 			goto fail;
610 		}
611 
612 		data->reg = IWI_CSR_RX_BASE + i * 4;
613 	}
614 
615 	return 0;
616 
617 fail:	iwi_free_rx_ring(sc, ring);
618 	return error;
619 }
620 
621 void
622 iwi_reset_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
623 {
624 	ring->cur = 0;
625 }
626 
627 void
628 iwi_free_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
629 {
630 	struct iwi_rx_data *data;
631 	int i;
632 
633 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
634 		data = &sc->rxq.data[i];
635 
636 		if (data->m != NULL) {
637 			bus_dmamap_unload(sc->sc_dmat, data->map);
638 			m_freem(data->m);
639 		}
640 		bus_dmamap_destroy(sc->sc_dmat, data->map);
641 	}
642 }
643 
644 int
645 iwi_media_change(struct ifnet *ifp)
646 {
647 	int error;
648 
649 	error = ieee80211_media_change(ifp);
650 	if (error != ENETRESET)
651 		return error;
652 
653 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
654 		iwi_init(ifp);
655 
656 	return 0;
657 }
658 
659 void
660 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
661 {
662 	struct iwi_softc *sc = ifp->if_softc;
663 	struct ieee80211com *ic = &sc->sc_ic;
664 	uint32_t val;
665 	int rate;
666 
667 	imr->ifm_status = IFM_AVALID;
668 	imr->ifm_active = IFM_IEEE80211;
669 	if (ic->ic_state == IEEE80211_S_RUN)
670 		imr->ifm_status |= IFM_ACTIVE;
671 
672 	/* read current transmission rate from adapter */
673 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
674 	/* convert PLCP signal to 802.11 rate */
675 	rate = iwi_rate(val);
676 
677 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
678 	switch (ic->ic_opmode) {
679 	case IEEE80211_M_STA:
680 		break;
681 #ifndef IEEE80211_STA_ONLY
682 	case IEEE80211_M_IBSS:
683 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
684 		break;
685 #endif
686 	case IEEE80211_M_MONITOR:
687 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
688 		break;
689 	default:
690 		/* should not get there */
691 		break;
692 	}
693 }
694 
695 #ifndef IEEE80211_STA_ONLY
696 /*
697  * This is only used for IBSS mode where the firmware expect an index to an
698  * internal node table instead of a destination address.
699  */
700 int
701 iwi_find_txnode(struct iwi_softc *sc, const uint8_t *macaddr)
702 {
703 	struct iwi_node node;
704 	int i;
705 
706 	for (i = 0; i < sc->nsta; i++)
707 		if (IEEE80211_ADDR_EQ(sc->sta[i], macaddr))
708 			return i;	/* already existing node */
709 
710 	if (i == IWI_MAX_NODE)
711 		return -1;	/* no place left in neighbor table */
712 
713 	/* save this new node in our softc table */
714 	IEEE80211_ADDR_COPY(sc->sta[i], macaddr);
715 	sc->nsta = i;
716 
717 	/* write node information into NIC memory */
718 	bzero(&node, sizeof node);
719 	IEEE80211_ADDR_COPY(node.bssid, macaddr);
720 
721 	CSR_WRITE_REGION_1(sc, IWI_CSR_NODE_BASE + i * sizeof node,
722 	    (uint8_t *)&node, sizeof node);
723 
724 	return i;
725 }
726 #endif
727 
728 int
729 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
730 {
731 	struct iwi_softc *sc = ic->ic_softc;
732 	enum ieee80211_state ostate;
733 	uint32_t tmp;
734 
735 	ostate = ic->ic_state;
736 
737 	switch (nstate) {
738 	case IEEE80211_S_SCAN:
739 		iwi_scan(sc);
740 		break;
741 
742 	case IEEE80211_S_AUTH:
743 		iwi_auth_and_assoc(sc);
744 		break;
745 
746 	case IEEE80211_S_RUN:
747 #ifndef IEEE80211_STA_ONLY
748 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
749 			sc->nsta = 0;	/* flush IBSS nodes */
750 			ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
751 		} else
752 #endif
753 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
754 			iwi_set_chan(sc, ic->ic_ibss_chan);
755 
756 		/* assoc led on */
757 		tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
758 		MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp | IWI_LED_ASSOC);
759 		break;
760 
761 	case IEEE80211_S_INIT:
762 		if (ostate != IEEE80211_S_RUN)
763 			break;
764 
765 		/* assoc led off */
766 		tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
767 		MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp & ~IWI_LED_ASSOC);
768 		break;
769 
770 	case IEEE80211_S_ASSOC:
771 		break;
772 	}
773 
774 	ic->ic_state = nstate;
775 	return 0;
776 }
777 
778 /*
779  * Read 16 bits at address 'addr' from the serial EEPROM.
780  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
781  */
782 uint16_t
783 iwi_read_prom_word(struct iwi_softc *sc, uint8_t addr)
784 {
785 	uint32_t tmp;
786 	uint16_t val;
787 	int n;
788 
789 	/* clock C once before the first command */
790 	IWI_EEPROM_CTL(sc, 0);
791 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
792 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
793 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
794 
795 	/* write start bit (1) */
796 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
797 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
798 
799 	/* write READ opcode (10) */
800 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
801 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
802 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
803 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
804 
805 	/* write address A7-A0 */
806 	for (n = 7; n >= 0; n--) {
807 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
808 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
809 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
810 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
811 	}
812 
813 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
814 
815 	/* read data Q15-Q0 */
816 	val = 0;
817 	for (n = 15; n >= 0; n--) {
818 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
819 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
820 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
821 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
822 	}
823 
824 	IWI_EEPROM_CTL(sc, 0);
825 
826 	/* clear Chip Select and clock C */
827 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
828 	IWI_EEPROM_CTL(sc, 0);
829 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
830 
831 	return val;
832 }
833 
834 uint8_t
835 iwi_rate(int plcp)
836 {
837 	switch (plcp) {
838 	/* CCK rates (values are device-dependent) */
839 	case  10:	return 2;
840 	case  20:	return 4;
841 	case  55:	return 11;
842 	case 110:	return 22;
843 
844 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
845 	case 0xd:	return 12;
846 	case 0xf:	return 18;
847 	case 0x5:	return 24;
848 	case 0x7:	return 36;
849 	case 0x9:	return 48;
850 	case 0xb:	return 72;
851 	case 0x1:	return 96;
852 	case 0x3:	return 108;
853 
854 	/* unknown rate: should not happen */
855 	default:	return 0;
856 	}
857 }
858 
859 void
860 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_data *data,
861     struct iwi_frame *frame)
862 {
863 	struct ieee80211com *ic = &sc->sc_ic;
864 	struct ifnet *ifp = &ic->ic_if;
865 	struct mbuf *mnew, *m;
866 	struct ieee80211_frame *wh;
867 	struct ieee80211_rxinfo rxi;
868 	struct ieee80211_node *ni;
869 	int error;
870 
871 	DPRINTFN(5, ("received frame len=%u chan=%u rssi=%u\n",
872 	    letoh16(frame->len), frame->chan, frame->rssi_dbm));
873 
874 	if (letoh16(frame->len) < sizeof (struct ieee80211_frame_min) ||
875 	    letoh16(frame->len) > MCLBYTES) {
876 		DPRINTF(("%s: bad frame length\n", sc->sc_dev.dv_xname));
877 		ifp->if_ierrors++;
878 		return;
879 	}
880 
881 	/*
882 	 * Try to allocate a new mbuf for this ring element and load it before
883 	 * processing the current mbuf.  If the ring element cannot be loaded,
884 	 * drop the received packet and reuse the old mbuf.  In the unlikely
885 	 * case that the old mbuf can't be reloaded either, explicitly panic.
886 	 */
887 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
888 	if (mnew == NULL) {
889 		ifp->if_ierrors++;
890 		return;
891 	}
892 	MCLGET(mnew, M_DONTWAIT);
893 	if (!(mnew->m_flags & M_EXT)) {
894 		m_freem(mnew);
895 		ifp->if_ierrors++;
896 		return;
897 	}
898 
899 	bus_dmamap_unload(sc->sc_dmat, data->map);
900 
901 	error = bus_dmamap_load(sc->sc_dmat, data->map, mtod(mnew, void *),
902 	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
903 	if (error != 0) {
904 		m_freem(mnew);
905 
906 		/* try to reload the old mbuf */
907 		error = bus_dmamap_load(sc->sc_dmat, data->map,
908 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
909 		if (error != 0) {
910 			/* very unlikely that it will fail... */
911 			panic("%s: could not load old rx mbuf",
912 			    sc->sc_dev.dv_xname);
913 		}
914 		CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
915 		ifp->if_ierrors++;
916 		return;
917 	}
918 
919 	m = data->m;
920 	data->m = mnew;
921 	CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
922 
923 	/* finalize mbuf */
924 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
925 	    sizeof (struct iwi_frame) + letoh16(frame->len);
926 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
927 
928 #if NBPFILTER > 0
929 	if (sc->sc_drvbpf != NULL) {
930 		struct mbuf mb;
931 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
932 
933 		tap->wr_flags = 0;
934 		tap->wr_rate = iwi_rate(frame->rate);
935 		tap->wr_chan_freq =
936 		    htole16(ic->ic_channels[frame->chan].ic_freq);
937 		tap->wr_chan_flags =
938 		    htole16(ic->ic_channels[frame->chan].ic_flags);
939 		tap->wr_antsignal = frame->signal;
940 		tap->wr_antenna = frame->antenna & 0x3;
941 		if (frame->antenna & 0x40)
942 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
943 
944 		mb.m_data = (caddr_t)tap;
945 		mb.m_len = sc->sc_rxtap_len;
946 		mb.m_next = m;
947 		mb.m_nextpkt = NULL;
948 		mb.m_type = 0;
949 		mb.m_flags = 0;
950 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
951 	}
952 #endif
953 
954 	wh = mtod(m, struct ieee80211_frame *);
955 	ni = ieee80211_find_rxnode(ic, wh);
956 
957 	/* send the frame to the upper layer */
958 	rxi.rxi_flags = 0;
959 	rxi.rxi_rssi = frame->rssi_dbm;
960 	rxi.rxi_tstamp = 0;	/* unused */
961 	ieee80211_input(ifp, m, ni, &rxi);
962 
963 	/* node is no longer needed */
964 	ieee80211_release_node(ic, ni);
965 }
966 
967 void
968 iwi_notification_intr(struct iwi_softc *sc, struct iwi_rx_data *data,
969     struct iwi_notif *notif)
970 {
971 	struct ieee80211com *ic = &sc->sc_ic;
972 	struct ifnet *ifp = &ic->ic_if;
973 
974 	switch (notif->type) {
975 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
976 	{
977 #ifdef IWI_DEBUG
978 		struct iwi_notif_scan_channel *chan =
979 		    (struct iwi_notif_scan_channel *)(notif + 1);
980 #endif
981 		DPRINTFN(2, ("Scanning channel (%u)\n", chan->nchan));
982 		break;
983 	}
984 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
985 	{
986 #ifdef IWI_DEBUG
987 		struct iwi_notif_scan_complete *scan =
988 		    (struct iwi_notif_scan_complete *)(notif + 1);
989 #endif
990 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
991 		    scan->status));
992 
993 		/* monitor mode uses scan to set the channel ... */
994 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
995 			ieee80211_end_scan(ifp);
996 		else
997 			iwi_set_chan(sc, ic->ic_ibss_chan);
998 		break;
999 	}
1000 	case IWI_NOTIF_TYPE_AUTHENTICATION:
1001 	{
1002 		struct iwi_notif_authentication *auth =
1003 		    (struct iwi_notif_authentication *)(notif + 1);
1004 
1005 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1006 
1007 		switch (auth->state) {
1008 		case IWI_AUTHENTICATED:
1009 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1010 			break;
1011 
1012 		case IWI_DEAUTHENTICATED:
1013 			break;
1014 
1015 		default:
1016 			printf("%s: unknown authentication state %u\n",
1017 			    sc->sc_dev.dv_xname, auth->state);
1018 		}
1019 		break;
1020 	}
1021 	case IWI_NOTIF_TYPE_ASSOCIATION:
1022 	{
1023 		struct iwi_notif_association *assoc =
1024 		    (struct iwi_notif_association *)(notif + 1);
1025 
1026 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1027 		    assoc->status));
1028 
1029 		switch (assoc->state) {
1030 		case IWI_AUTHENTICATED:
1031 			/* re-association, do nothing */
1032 			break;
1033 
1034 		case IWI_ASSOCIATED:
1035 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1036 			break;
1037 
1038 		case IWI_DEASSOCIATED:
1039 			ieee80211_begin_scan(ifp);
1040 			break;
1041 
1042 		default:
1043 			printf("%s: unknown association state %u\n",
1044 			    sc->sc_dev.dv_xname, assoc->state);
1045 		}
1046 		break;
1047 	}
1048 	case IWI_NOTIF_TYPE_BEACON:
1049 	{
1050 		struct iwi_notif_beacon *beacon =
1051 		    (struct iwi_notif_beacon *)(notif + 1);
1052 
1053 		if (letoh32(beacon->status) == IWI_BEACON_MISSED) {
1054 			/* XXX should roam when too many beacons missed */
1055 			DPRINTFN(2, ("%s: %u beacon(s) missed\n",
1056 			    sc->sc_dev.dv_xname, letoh32(beacon->count)));
1057 		}
1058 		break;
1059 	}
1060 	case IWI_NOTIF_TYPE_BAD_LINK:
1061 		DPRINTFN(2, ("link deterioration detected\n"));
1062 		break;
1063 
1064 	case IWI_NOTIF_TYPE_NOISE:
1065 		DPRINTFN(5, ("Measured noise %u\n",
1066 		    letoh32(*(uint32_t *)(notif + 1)) & 0xff));
1067 		break;
1068 
1069 	default:
1070 		DPRINTFN(5, ("Notification (%u)\n", notif->type));
1071 	}
1072 }
1073 
1074 void
1075 iwi_rx_intr(struct iwi_softc *sc)
1076 {
1077 	struct iwi_rx_data *data;
1078 	struct iwi_hdr *hdr;
1079 	uint32_t hw;
1080 
1081 	hw = CSR_READ_4(sc, IWI_CSR_RX_RIDX);
1082 
1083 	for (; sc->rxq.cur != hw;) {
1084 		data = &sc->rxq.data[sc->rxq.cur];
1085 
1086 		bus_dmamap_sync(sc->sc_dmat, data->map, 0, MCLBYTES,
1087 		    BUS_DMASYNC_POSTREAD);
1088 
1089 		hdr = mtod(data->m, struct iwi_hdr *);
1090 
1091 		switch (hdr->type) {
1092 		case IWI_HDR_TYPE_FRAME:
1093 			iwi_frame_intr(sc, data,
1094 			    (struct iwi_frame *)(hdr + 1));
1095 			break;
1096 
1097 		case IWI_HDR_TYPE_NOTIF:
1098 			iwi_notification_intr(sc, data,
1099 			    (struct iwi_notif *)(hdr + 1));
1100 			break;
1101 
1102 		default:
1103 			printf("%s: unknown hdr type %u\n",
1104 			    sc->sc_dev.dv_xname, hdr->type);
1105 		}
1106 
1107 		sc->rxq.cur = (sc->rxq.cur + 1) % IWI_RX_RING_COUNT;
1108 	}
1109 
1110 	/* tell the firmware what we have processed */
1111 	hw = (hw == 0) ? IWI_RX_RING_COUNT - 1 : hw - 1;
1112 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, hw);
1113 }
1114 
1115 void
1116 iwi_tx_intr(struct iwi_softc *sc, struct iwi_tx_ring *txq)
1117 {
1118 	struct ieee80211com *ic = &sc->sc_ic;
1119 	struct ifnet *ifp = &ic->ic_if;
1120 	struct iwi_tx_data *data;
1121 	uint32_t hw;
1122 
1123 	hw = CSR_READ_4(sc, txq->csr_ridx);
1124 
1125 	for (; txq->next != hw;) {
1126 		data = &txq->data[txq->next];
1127 
1128 		bus_dmamap_unload(sc->sc_dmat, data->map);
1129 		m_freem(data->m);
1130 		data->m = NULL;
1131 		ieee80211_release_node(ic, data->ni);
1132 		data->ni = NULL;
1133 
1134 		ifp->if_opackets++;
1135 
1136 		txq->queued--;
1137 		txq->next = (txq->next + 1) % IWI_TX_RING_COUNT;
1138 	}
1139 
1140 	sc->sc_tx_timer = 0;
1141 	ifp->if_flags &= ~IFF_OACTIVE;
1142 	(*ifp->if_start)(ifp);
1143 }
1144 
1145 int
1146 iwi_intr(void *arg)
1147 {
1148 	struct iwi_softc *sc = arg;
1149 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1150 	uint32_t r;
1151 
1152 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff)
1153 		return 0;
1154 
1155 	/* disable interrupts */
1156 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1157 
1158 	/* acknowledge interrupts */
1159 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1160 
1161 	if (r & IWI_INTR_FATAL_ERROR) {
1162 		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1163 		iwi_stop(ifp, 1);
1164 		task_add(systq, &sc->init_task);
1165 		return 1;
1166 	}
1167 
1168 	if (r & IWI_INTR_FW_INITED)
1169 		wakeup(sc);
1170 
1171 	if (r & IWI_INTR_RADIO_OFF) {
1172 		DPRINTF(("radio transmitter off\n"));
1173 		ifp->if_flags &= ~IFF_UP;
1174 		iwi_stop(ifp, 1);
1175 		return 1;
1176 	}
1177 
1178 	if (r & IWI_INTR_CMD_DONE) {
1179 		/* kick next pending command if any */
1180 		sc->cmdq.next = (sc->cmdq.next + 1) % IWI_CMD_RING_COUNT;
1181 		if (--sc->cmdq.queued > 0)
1182 			CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.next);
1183 
1184 		wakeup(sc);
1185 	}
1186 
1187 	if (r & IWI_INTR_TX1_DONE)
1188 		iwi_tx_intr(sc, &sc->txq[0]);
1189 
1190 	if (r & IWI_INTR_TX2_DONE)
1191 		iwi_tx_intr(sc, &sc->txq[1]);
1192 
1193 	if (r & IWI_INTR_TX3_DONE)
1194 		iwi_tx_intr(sc, &sc->txq[2]);
1195 
1196 	if (r & IWI_INTR_TX4_DONE)
1197 		iwi_tx_intr(sc, &sc->txq[3]);
1198 
1199 	if (r & IWI_INTR_RX_DONE)
1200 		iwi_rx_intr(sc);
1201 
1202 	/* re-enable interrupts */
1203 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1204 
1205 	return 1;
1206 }
1207 
1208 int
1209 iwi_cmd(struct iwi_softc *sc, uint8_t type, void *data, uint8_t len, int async)
1210 {
1211 	struct iwi_cmd_desc *desc;
1212 
1213 	desc = &sc->cmdq.desc[sc->cmdq.cur];
1214 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1215 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1216 	desc->type = type;
1217 	desc->len = len;
1218 	bcopy(data, desc->data, len);
1219 
1220 	bus_dmamap_sync(sc->sc_dmat, sc->cmdq.map,
1221 	    sc->cmdq.cur * sizeof (struct iwi_cmd_desc),
1222 	    sizeof (struct iwi_cmd_desc), BUS_DMASYNC_PREWRITE);
1223 
1224 	DPRINTFN(2, ("sending command idx=%u type=%u len=%u\n", sc->cmdq.cur,
1225 	    type, len));
1226 
1227 	sc->cmdq.cur = (sc->cmdq.cur + 1) % IWI_CMD_RING_COUNT;
1228 
1229 	/* don't kick cmd immediately if another async command is pending */
1230 	if (++sc->cmdq.queued == 1) {
1231 		sc->cmdq.next = sc->cmdq.cur;
1232 		CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.next);
1233 	}
1234 
1235 	return async ? 0 : tsleep(sc, PCATCH, "iwicmd", hz);
1236 }
1237 
1238 /* ARGSUSED */
1239 int
1240 iwi_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, int type,
1241     int arg1, int arg2)
1242 {
1243 	return EOPNOTSUPP;
1244 }
1245 
1246 int
1247 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1248 {
1249 	struct iwi_softc *sc = ifp->if_softc;
1250 	struct ieee80211com *ic = &sc->sc_ic;
1251 	struct ieee80211_frame *wh;
1252 	struct ieee80211_key *k;
1253 	struct mbuf *m1;
1254 	struct iwi_tx_data *data;
1255 	struct iwi_tx_desc *desc;
1256 	struct iwi_tx_ring *txq = &sc->txq[0];
1257 	int hdrlen, error, i, station = 0;
1258 
1259 	wh = mtod(m0, struct ieee80211_frame *);
1260 
1261 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1262 		k = ieee80211_get_txkey(ic, wh, ni);
1263 
1264 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
1265 			return ENOBUFS;
1266 
1267 		/* packet header may have moved, reset our local pointer */
1268 		wh = mtod(m0, struct ieee80211_frame *);
1269 	}
1270 
1271 #if NBPFILTER > 0
1272 	if (sc->sc_drvbpf != NULL) {
1273 		struct mbuf mb;
1274 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1275 
1276 		tap->wt_flags = 0;
1277 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1278 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1279 
1280 		mb.m_data = (caddr_t)tap;
1281 		mb.m_len = sc->sc_txtap_len;
1282 		mb.m_next = m0;
1283 		mb.m_nextpkt = NULL;
1284 		mb.m_type = 0;
1285 		mb.m_flags = 0;
1286 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1287 	}
1288 #endif
1289 
1290 	data = &txq->data[txq->cur];
1291 	desc = &txq->desc[txq->cur];
1292 
1293 	/* copy and trim IEEE802.11 header */
1294 	hdrlen = ieee80211_get_hdrlen(wh);
1295 	bcopy(wh, &desc->wh, hdrlen);
1296 	m_adj(m0, hdrlen);
1297 
1298 #ifndef IEEE80211_STA_ONLY
1299 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1300 		station = iwi_find_txnode(sc, desc->wh.i_addr1);
1301 		if (station == -1) {
1302 			m_freem(m0);
1303 			ieee80211_release_node(ic, ni);
1304 			ifp->if_oerrors++;
1305 			return 0;
1306 		}
1307 	}
1308 #endif
1309 
1310 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1311 	    BUS_DMA_NOWAIT);
1312 	if (error != 0 && error != EFBIG) {
1313 		printf("%s: can't map mbuf (error %d)\n",
1314 		    sc->sc_dev.dv_xname, error);
1315 		m_freem(m0);
1316 		return error;
1317 	}
1318 	if (error != 0) {
1319 		/* too many fragments, linearize */
1320 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1321 		if (m1 == NULL) {
1322 			m_freem(m0);
1323 			return ENOBUFS;
1324 		}
1325 		if (m0->m_pkthdr.len > MHLEN) {
1326 			MCLGET(m1, M_DONTWAIT);
1327 			if (!(m1->m_flags & M_EXT)) {
1328 				m_freem(m0);
1329 				m_freem(m1);
1330 				return ENOBUFS;
1331 			}
1332 		}
1333 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m1, caddr_t));
1334 		m1->m_pkthdr.len = m1->m_len = m0->m_pkthdr.len;
1335 		m_freem(m0);
1336 		m0 = m1;
1337 
1338 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1339 		    BUS_DMA_NOWAIT);
1340 		if (error != 0) {
1341 			printf("%s: can't map mbuf (error %d)\n",
1342 			    sc->sc_dev.dv_xname, error);
1343 			m_freem(m0);
1344 			return error;
1345 		}
1346 	}
1347 
1348 	data->m = m0;
1349 	data->ni = ni;
1350 
1351 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1352 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1353 	desc->cmd = IWI_DATA_CMD_TX;
1354 	desc->len = htole16(m0->m_pkthdr.len);
1355 	desc->station = station;
1356 	desc->flags = IWI_DATA_FLAG_NO_WEP;
1357 	desc->xflags = 0;
1358 
1359 	if (!IEEE80211_IS_MULTICAST(desc->wh.i_addr1))
1360 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1361 
1362 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1363 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1364 
1365 	if ((desc->wh.i_fc[0] &
1366 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
1367 	    (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
1368 		desc->xflags |= IWI_DATA_XFLAG_QOS;
1369 
1370 	if (ic->ic_curmode == IEEE80211_MODE_11B)
1371 		desc->xflags |= IWI_DATA_XFLAG_CCK;
1372 
1373 	desc->nseg = htole32(data->map->dm_nsegs);
1374 	for (i = 0; i < data->map->dm_nsegs; i++) {
1375 		desc->seg_addr[i] = htole32(data->map->dm_segs[i].ds_addr);
1376 		desc->seg_len[i]  = htole16(data->map->dm_segs[i].ds_len);
1377 	}
1378 
1379 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1380 	    BUS_DMASYNC_PREWRITE);
1381 	bus_dmamap_sync(sc->sc_dmat, txq->map,
1382 	    txq->cur * sizeof (struct iwi_tx_desc),
1383 	    sizeof (struct iwi_tx_desc), BUS_DMASYNC_PREWRITE);
1384 
1385 	DPRINTFN(5, ("sending data frame idx=%u len=%u nseg=%u\n", txq->cur,
1386 	    letoh16(desc->len), data->map->dm_nsegs));
1387 
1388 	txq->queued++;
1389 	txq->cur = (txq->cur + 1) % IWI_TX_RING_COUNT;
1390 	CSR_WRITE_4(sc, txq->csr_widx, txq->cur);
1391 
1392 	return 0;
1393 }
1394 
1395 void
1396 iwi_start(struct ifnet *ifp)
1397 {
1398 	struct iwi_softc *sc = ifp->if_softc;
1399 	struct ieee80211com *ic = &sc->sc_ic;
1400 	struct mbuf *m0;
1401 	struct ieee80211_node *ni;
1402 
1403 	if (ic->ic_state != IEEE80211_S_RUN)
1404 		return;
1405 
1406 	for (;;) {
1407 		IFQ_POLL(&ifp->if_snd, m0);
1408 		if (m0 == NULL)
1409 			break;
1410 
1411 		if (sc->txq[0].queued >= IWI_TX_RING_COUNT - 8) {
1412 			ifp->if_flags |= IFF_OACTIVE;
1413 			break;
1414 		}
1415 		IFQ_DEQUEUE(&ifp->if_snd, m0);
1416 #if NBPFILTER > 0
1417 		if (ifp->if_bpf != NULL)
1418 			bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1419 #endif
1420 
1421 		m0 = ieee80211_encap(ifp, m0, &ni);
1422 		if (m0 == NULL)
1423 			continue;
1424 
1425 #if NBPFILTER > 0
1426 		if (ic->ic_rawbpf != NULL)
1427 			bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1428 #endif
1429 
1430 		if (iwi_tx_start(ifp, m0, ni) != 0) {
1431 			if (ni != NULL)
1432 				ieee80211_release_node(ic, ni);
1433 			ifp->if_oerrors++;
1434 			break;
1435 		}
1436 
1437 		/* start watchdog timer */
1438 		sc->sc_tx_timer = 5;
1439 		ifp->if_timer = 1;
1440 	}
1441 }
1442 
1443 void
1444 iwi_watchdog(struct ifnet *ifp)
1445 {
1446 	struct iwi_softc *sc = ifp->if_softc;
1447 
1448 	ifp->if_timer = 0;
1449 
1450 	if (sc->sc_tx_timer > 0) {
1451 		if (--sc->sc_tx_timer == 0) {
1452 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1453 			ifp->if_flags &= ~IFF_UP;
1454 			iwi_stop(ifp, 1);
1455 			ifp->if_oerrors++;
1456 			return;
1457 		}
1458 		ifp->if_timer = 1;
1459 	}
1460 
1461 	ieee80211_watchdog(ifp);
1462 }
1463 
1464 int
1465 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1466 {
1467 	struct iwi_softc *sc = ifp->if_softc;
1468 	struct ieee80211com *ic = &sc->sc_ic;
1469 	struct ifaddr *ifa;
1470 	struct ifreq *ifr;
1471 	int s, error = 0;
1472 
1473 	s = splnet();
1474 	/*
1475 	 * Prevent processes from entering this function while another
1476 	 * process is tsleep'ing in it.
1477 	 */
1478 	while ((sc->sc_flags & IWI_FLAG_BUSY) && error == 0)
1479 		error = tsleep(&sc->sc_flags, PCATCH, "iwiioc", 0);
1480 	if (error != 0) {
1481 		splx(s);
1482 		return error;
1483 	}
1484 	sc->sc_flags |= IWI_FLAG_BUSY;
1485 
1486 	switch (cmd) {
1487 	case SIOCSIFADDR:
1488 		ifa = (struct ifaddr *)data;
1489 		ifp->if_flags |= IFF_UP;
1490 		if (ifa->ifa_addr->sa_family == AF_INET)
1491 			arp_ifinit(&ic->ic_ac, ifa);
1492 		/* FALLTHROUGH */
1493 	case SIOCSIFFLAGS:
1494 		if (ifp->if_flags & IFF_UP) {
1495 			if (!(ifp->if_flags & IFF_RUNNING))
1496 				iwi_init(ifp);
1497 		} else {
1498 			if (ifp->if_flags & IFF_RUNNING)
1499 				iwi_stop(ifp, 1);
1500 		}
1501 		break;
1502 
1503 	case SIOCADDMULTI:
1504 	case SIOCDELMULTI:
1505 		ifr = (struct ifreq *)data;
1506 		error = (cmd == SIOCADDMULTI) ?
1507 		    ether_addmulti(ifr, &ic->ic_ac) :
1508 		    ether_delmulti(ifr, &ic->ic_ac);
1509 
1510 		if (error == ENETRESET)
1511 			error = 0;
1512 		break;
1513 
1514 	case SIOCG80211TXPOWER:
1515 		/*
1516 		 * If the hardware radio transmitter switch is off, report a
1517 		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1518 		 * transmitter is killed.
1519 		 */
1520 		((struct ieee80211_txpower *)data)->i_val =
1521 		    (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) ?
1522 		    sc->sc_ic.ic_txpower : IEEE80211_TXPOWER_MIN;
1523 		break;
1524 
1525 	default:
1526 		error = ieee80211_ioctl(ifp, cmd, data);
1527 	}
1528 
1529 	if (error == ENETRESET) {
1530 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1531 		    (IFF_UP | IFF_RUNNING))
1532 			iwi_init(ifp);
1533 		error = 0;
1534 	}
1535 
1536 	sc->sc_flags &= ~IWI_FLAG_BUSY;
1537 	wakeup(&sc->sc_flags);
1538 	splx(s);
1539 	return error;
1540 }
1541 
1542 void
1543 iwi_stop_master(struct iwi_softc *sc)
1544 {
1545 	uint32_t tmp;
1546 	int ntries;
1547 
1548 	/* disable interrupts */
1549 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1550 
1551 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1552 	for (ntries = 0; ntries < 5; ntries++) {
1553 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1554 			break;
1555 		DELAY(10);
1556 	}
1557 	if (ntries == 5) {
1558 		printf("%s: timeout waiting for master\n",
1559 		    sc->sc_dev.dv_xname);
1560 	}
1561 
1562 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1563 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_PRINCETON_RESET);
1564 
1565 	sc->sc_flags &= ~IWI_FLAG_FW_INITED;
1566 }
1567 
1568 int
1569 iwi_reset(struct iwi_softc *sc)
1570 {
1571 	uint32_t tmp;
1572 	int i, ntries;
1573 
1574 	iwi_stop_master(sc);
1575 
1576 	/* move adapter to D0 state */
1577 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1578 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1579 
1580 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
1581 
1582 	/* wait for clock stabilization */
1583 	for (ntries = 0; ntries < 1000; ntries++) {
1584 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
1585 			break;
1586 		DELAY(200);
1587 	}
1588 	if (ntries == 1000) {
1589 		printf("%s: timeout waiting for clock stabilization\n",
1590 		    sc->sc_dev.dv_xname);
1591 		return ETIMEDOUT;
1592 	}
1593 
1594 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1595 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_SW_RESET);
1596 
1597 	DELAY(10);
1598 
1599 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1600 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1601 
1602 	/* clear NIC memory */
1603 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
1604 	for (i = 0; i < 0xc000; i++)
1605 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1606 
1607 	return 0;
1608 }
1609 
1610 int
1611 iwi_load_ucode(struct iwi_softc *sc, const char *data, int size)
1612 {
1613 	const uint16_t *w;
1614 	uint32_t tmp;
1615 	int ntries, i;
1616 
1617 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1618 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_STOP_MASTER);
1619 	for (ntries = 0; ntries < 5; ntries++) {
1620 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1621 			break;
1622 		DELAY(10);
1623 	}
1624 	if (ntries == 5) {
1625 		printf("%s: timeout waiting for master\n",
1626 		    sc->sc_dev.dv_xname);
1627 		return ETIMEDOUT;
1628 	}
1629 
1630 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1631 	DELAY(5000);
1632 
1633 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1634 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp & ~IWI_RST_PRINCETON_RESET);
1635 
1636 	DELAY(5000);
1637 	MEM_WRITE_4(sc, 0x3000e0, 0);
1638 	DELAY(1000);
1639 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 1);
1640 	DELAY(1000);
1641 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 0);
1642 	DELAY(1000);
1643 	MEM_WRITE_1(sc, 0x200000, 0x00);
1644 	MEM_WRITE_1(sc, 0x200000, 0x40);
1645 	DELAY(1000);
1646 
1647 	/* adapter is buggy, we must set the address for each word */
1648 	for (w = (const uint16_t *)data; size > 0; w++, size -= 2)
1649 		MEM_WRITE_2(sc, 0x200010, htole16(*w));
1650 
1651 	MEM_WRITE_1(sc, 0x200000, 0x00);
1652 	MEM_WRITE_1(sc, 0x200000, 0x80);
1653 
1654 	/* wait until we get an answer */
1655 	for (ntries = 0; ntries < 100; ntries++) {
1656 		if (MEM_READ_1(sc, 0x200000) & 1)
1657 			break;
1658 		DELAY(100);
1659 	}
1660 	if (ntries == 100) {
1661 		printf("%s: timeout waiting for ucode to initialize\n",
1662 		    sc->sc_dev.dv_xname);
1663 		return ETIMEDOUT;
1664 	}
1665 
1666 	/* read the answer or the firmware will not initialize properly */
1667 	for (i = 0; i < 7; i++)
1668 		MEM_READ_4(sc, 0x200004);
1669 
1670 	MEM_WRITE_1(sc, 0x200000, 0x00);
1671 
1672 	return 0;
1673 }
1674 
1675 /* macro to handle unaligned little endian data in firmware image */
1676 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1677 
1678 int
1679 iwi_load_firmware(struct iwi_softc *sc, const char *data, int size)
1680 {
1681 	bus_dmamap_t map;
1682 	bus_dma_segment_t seg;
1683 	caddr_t virtaddr;
1684 	u_char *p, *end;
1685 	uint32_t sentinel, tmp, ctl, src, dst, sum, len, mlen;
1686 	int ntries, nsegs, error;
1687 
1688 	/* allocate DMA memory to store firmware image */
1689 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
1690 	    BUS_DMA_NOWAIT, &map);
1691 	if (error != 0) {
1692 		printf("%s: could not create firmware DMA map\n",
1693 		    sc->sc_dev.dv_xname);
1694 		goto fail1;
1695 	}
1696 
1697 	error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0, &seg, 1,
1698 	    &nsegs, BUS_DMA_NOWAIT);
1699 	if (error != 0) {
1700 		printf("%s: could not allocate firmware DMA memory\n",
1701 		    sc->sc_dev.dv_xname);
1702 		goto fail2;
1703 	}
1704 
1705 	error = bus_dmamem_map(sc->sc_dmat, &seg, nsegs, size, &virtaddr,
1706 	    BUS_DMA_NOWAIT);
1707 	if (error != 0) {
1708 		printf("%s: can't map firmware DMA memory\n",
1709 		    sc->sc_dev.dv_xname);
1710 		goto fail3;
1711 	}
1712 
1713 	error = bus_dmamap_load(sc->sc_dmat, map, virtaddr, size, NULL,
1714 	    BUS_DMA_NOWAIT);
1715 	if (error != 0) {
1716 		printf("%s: could not load firmware DMA map\n",
1717 		    sc->sc_dev.dv_xname);
1718 		goto fail4;
1719 	}
1720 
1721 	/* copy firmware image to DMA memory */
1722 	bcopy(data, virtaddr, size);
1723 
1724 	/* make sure the adapter will get up-to-date values */
1725 	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_PREWRITE);
1726 
1727 	/* tell the adapter where the command blocks are stored */
1728 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
1729 
1730 	/*
1731 	 * Store command blocks into adapter's internal memory using register
1732 	 * indirections. The adapter will read the firmware image through DMA
1733 	 * using information stored in command blocks.
1734 	 */
1735 	src = map->dm_segs[0].ds_addr;
1736 	p = virtaddr;
1737 	end = p + size;
1738 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
1739 
1740 	while (p < end) {
1741 		dst = GETLE32(p); p += 4; src += 4;
1742 		len = GETLE32(p); p += 4; src += 4;
1743 		p += len;
1744 
1745 		while (len > 0) {
1746 			mlen = min(len, IWI_CB_MAXDATALEN);
1747 
1748 			ctl = IWI_CB_DEFAULT_CTL | mlen;
1749 			sum = ctl ^ src ^ dst;
1750 
1751 			/* write a command block */
1752 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
1753 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, src);
1754 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, dst);
1755 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
1756 
1757 			src += mlen;
1758 			dst += mlen;
1759 			len -= mlen;
1760 		}
1761 	}
1762 
1763 	/* write a fictive final command block (sentinel) */
1764 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
1765 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1766 
1767 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1768 	tmp &= ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER);
1769 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp);
1770 
1771 	/* tell the adapter to start processing command blocks */
1772 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
1773 
1774 	/* wait until the adapter has processed all command blocks */
1775 	for (ntries = 0; ntries < 400; ntries++) {
1776 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
1777 			break;
1778 		DELAY(100);
1779 	}
1780 	if (ntries == 400) {
1781 		printf("%s: timeout processing cb\n", sc->sc_dev.dv_xname);
1782 		error = ETIMEDOUT;
1783 		goto fail5;
1784 	}
1785 
1786 	/* we're done with command blocks processing */
1787 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
1788 
1789 	/* allow interrupts so we know when the firmware is inited */
1790 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1791 
1792 	/* tell the adapter to initialize the firmware */
1793 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
1794 
1795 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1796 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_ALLOW_STANDBY);
1797 
1798 	/* wait at most one second for firmware initialization to complete */
1799 	if ((error = tsleep(sc, PCATCH, "iwiinit", hz)) != 0) {
1800 		printf("%s: timeout waiting for firmware initialization to "
1801 		    "complete\n", sc->sc_dev.dv_xname);
1802 		goto fail5;
1803 	}
1804 
1805 fail5:	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_POSTWRITE);
1806 	bus_dmamap_unload(sc->sc_dmat, map);
1807 fail4:	bus_dmamem_unmap(sc->sc_dmat, virtaddr, size);
1808 fail3:	bus_dmamem_free(sc->sc_dmat, &seg, 1);
1809 fail2:	bus_dmamap_destroy(sc->sc_dmat, map);
1810 fail1:	return error;
1811 }
1812 
1813 int
1814 iwi_config(struct iwi_softc *sc)
1815 {
1816 	struct ieee80211com *ic = &sc->sc_ic;
1817 	struct ifnet *ifp = &ic->ic_if;
1818 	struct iwi_configuration config;
1819 	struct iwi_rateset rs;
1820 	struct iwi_txpower power;
1821 	uint32_t data;
1822 	int error, nchan, i;
1823 
1824 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1825 	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1826 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1827 	    IEEE80211_ADDR_LEN, 0);
1828 	if (error != 0)
1829 		return error;
1830 
1831 	bzero(&config, sizeof config);
1832 	config.multicast_enabled = 1;
1833 	config.silence_threshold = 30;
1834 	config.report_noise = 1;
1835 	config.answer_pbreq =
1836 #ifndef IEEE80211_STA_ONLY
1837 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 :
1838 #endif
1839 	    0;
1840 	DPRINTF(("Configuring adapter\n"));
1841 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 0);
1842 	if (error != 0)
1843 		return error;
1844 
1845 	data = htole32(IWI_POWER_MODE_CAM);
1846 	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1847 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
1848 	if (error != 0)
1849 		return error;
1850 
1851 	data = htole32(ic->ic_rtsthreshold);
1852 	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1853 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
1854 	if (error != 0)
1855 		return error;
1856 
1857 	data = htole32(ic->ic_fragthreshold);
1858 	DPRINTF(("Setting fragmentation threshold to %u\n", letoh32(data)));
1859 	error = iwi_cmd(sc, IWI_CMD_SET_FRAG_THRESHOLD, &data, sizeof data, 0);
1860 	if (error != 0)
1861 		return error;
1862 
1863 	/*
1864 	 * Set default Tx power for 802.11b/g and 802.11a channels.
1865 	 */
1866 	nchan = 0;
1867 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1868 		if (!IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]))
1869 			continue;
1870 		power.chan[nchan].chan = i;
1871 		power.chan[nchan].power = IWI_TXPOWER_MAX;
1872 		nchan++;
1873 	}
1874 	power.nchan = nchan;
1875 
1876 	power.mode = IWI_MODE_11G;
1877 	DPRINTF(("Setting .11g channels tx power\n"));
1878 	error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power, 0);
1879 	if (error != 0)
1880 		return error;
1881 
1882 	power.mode = IWI_MODE_11B;
1883 	DPRINTF(("Setting .11b channels tx power\n"));
1884 	error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power, 0);
1885 	if (error != 0)
1886 		return error;
1887 
1888 	nchan = 0;
1889 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1890 		if (!IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]))
1891 			continue;
1892 		power.chan[nchan].chan = i;
1893 		power.chan[nchan].power = IWI_TXPOWER_MAX;
1894 		nchan++;
1895 	}
1896 	power.nchan = nchan;
1897 
1898 	if (nchan > 0) {	/* 2915ABG only */
1899 		power.mode = IWI_MODE_11A;
1900 		DPRINTF(("Setting .11a channels tx power\n"));
1901 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
1902 		    0);
1903 		if (error != 0)
1904 			return error;
1905 	}
1906 
1907 	rs.mode = IWI_MODE_11G;
1908 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
1909 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
1910 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates, rs.rates,
1911 	    rs.nrates);
1912 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
1913 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
1914 	if (error != 0)
1915 		return error;
1916 
1917 	rs.mode = IWI_MODE_11A;
1918 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
1919 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
1920 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates, rs.rates,
1921 	    rs.nrates);
1922 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
1923 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
1924 	if (error != 0)
1925 		return error;
1926 
1927 	/* if we have a desired ESSID, set it now */
1928 	if (ic->ic_des_esslen != 0) {
1929 #ifdef IWI_DEBUG
1930 		if (iwi_debug > 0) {
1931 			printf("Setting desired ESSID to ");
1932 			ieee80211_print_essid(ic->ic_des_essid,
1933 			    ic->ic_des_esslen);
1934 			printf("\n");
1935 		}
1936 #endif
1937 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ic->ic_des_essid,
1938 		    ic->ic_des_esslen, 0);
1939 		if (error != 0)
1940 			return error;
1941 	}
1942 
1943 	arc4random_buf(&data, sizeof data);
1944 	DPRINTF(("Setting random seed to %u\n", data));
1945 	error = iwi_cmd(sc, IWI_CMD_SET_RANDOM_SEED, &data, sizeof data, 0);
1946 	if (error != 0)
1947 		return error;
1948 
1949 	/* enable adapter */
1950 	DPRINTF(("Enabling adapter\n"));
1951 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
1952 }
1953 
1954 void
1955 iwi_update_edca(struct ieee80211com *ic)
1956 {
1957 #define IWI_EXP2(v)	htole16((1 << (v)) - 1)
1958 #define IWI_TXOP(v)	IEEE80211_TXOP_TO_US(v)
1959 	struct iwi_softc *sc = ic->ic_softc;
1960 	struct iwi_qos_cmd cmd;
1961 	struct iwi_qos_params *qos;
1962 	struct ieee80211_edca_ac_params *edca = ic->ic_edca_ac;
1963 	int aci;
1964 
1965 	/* set default QoS parameters for CCK */
1966 	qos = &cmd.cck;
1967 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1968 		qos->cwmin[aci] = IWI_EXP2(iwi_cck[aci].ac_ecwmin);
1969 		qos->cwmax[aci] = IWI_EXP2(iwi_cck[aci].ac_ecwmax);
1970 		qos->txop [aci] = IWI_TXOP(iwi_cck[aci].ac_txoplimit);
1971 		qos->aifsn[aci] = iwi_cck[aci].ac_aifsn;
1972 		qos->acm  [aci] = 0;
1973 	}
1974 	/* set default QoS parameters for OFDM */
1975 	qos = &cmd.ofdm;
1976 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1977 		qos->cwmin[aci] = IWI_EXP2(iwi_ofdm[aci].ac_ecwmin);
1978 		qos->cwmax[aci] = IWI_EXP2(iwi_ofdm[aci].ac_ecwmax);
1979 		qos->txop [aci] = IWI_TXOP(iwi_ofdm[aci].ac_txoplimit);
1980 		qos->aifsn[aci] = iwi_ofdm[aci].ac_aifsn;
1981 		qos->acm  [aci] = 0;
1982 	}
1983 	/* set current QoS parameters */
1984 	qos = &cmd.current;
1985 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1986 		qos->cwmin[aci] = IWI_EXP2(edca[aci].ac_ecwmin);
1987 		qos->cwmax[aci] = IWI_EXP2(edca[aci].ac_ecwmax);
1988 		qos->txop [aci] = IWI_TXOP(edca[aci].ac_txoplimit);
1989 		qos->aifsn[aci] = edca[aci].ac_aifsn;
1990 		qos->acm  [aci] = 0;
1991 	}
1992 
1993 	DPRINTF(("Setting QoS parameters\n"));
1994 	(void)iwi_cmd(sc, IWI_CMD_SET_QOS_PARAMS, &cmd, sizeof cmd, 1);
1995 #undef IWI_EXP2
1996 #undef IWI_TXOP
1997 }
1998 
1999 int
2000 iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
2001 {
2002 	struct ieee80211com *ic = &sc->sc_ic;
2003 	struct iwi_scan scan;
2004 
2005 	bzero(&scan, sizeof scan);
2006 	memset(scan.type, IWI_SCAN_TYPE_PASSIVE, sizeof scan.type);
2007 	scan.passive = htole16(2000);
2008 	scan.channels[0] = 1 |
2009 	    (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
2010 	scan.channels[1] = ieee80211_chan2ieee(ic, chan);
2011 
2012 	DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
2013 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2014 }
2015 
2016 int
2017 iwi_scan(struct iwi_softc *sc)
2018 {
2019 	struct ieee80211com *ic = &sc->sc_ic;
2020 	struct iwi_scan scan;
2021 	uint8_t *p;
2022 	int i, count;
2023 
2024 	bzero(&scan, sizeof scan);
2025 
2026 	if (ic->ic_des_esslen != 0) {
2027 		scan.bdirected = htole16(40);
2028 		memset(scan.type, IWI_SCAN_TYPE_BDIRECTED, sizeof scan.type);
2029 	} else {
2030 		scan.broadcast = htole16(40);
2031 		memset(scan.type, IWI_SCAN_TYPE_BROADCAST, sizeof scan.type);
2032 	}
2033 
2034 	p = scan.channels;
2035 	count = 0;
2036 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2037 		if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i])) {
2038 			*++p = i;
2039 			count++;
2040 		}
2041 	}
2042 	*(p - count) = IWI_CHAN_5GHZ | count;
2043 
2044 	p = (count > 0) ? p + 1 : scan.channels;
2045 	count = 0;
2046 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2047 		if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i])) {
2048 			*++p = i;
2049 			count++;
2050 		}
2051 	}
2052 	*(p - count) = IWI_CHAN_2GHZ | count;
2053 
2054 	DPRINTF(("Start scanning\n"));
2055 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2056 }
2057 
2058 int
2059 iwi_auth_and_assoc(struct iwi_softc *sc)
2060 {
2061 	struct ieee80211com *ic = &sc->sc_ic;
2062 	struct ieee80211_node *ni = ic->ic_bss;
2063 	struct iwi_configuration config;
2064 	struct iwi_associate assoc;
2065 	struct iwi_rateset rs;
2066 	uint8_t *frm;
2067 	uint32_t data;
2068 	uint16_t capinfo;
2069 	uint8_t buf[64];	/* XXX max WPA/RSN/WMM IE length */
2070 	int error;
2071 
2072 	/* update adapter configuration */
2073 	bzero(&config, sizeof config);
2074 	config.multicast_enabled = 1;
2075 	config.disable_unicast_decryption = 1;
2076 	config.disable_multicast_decryption = 1;
2077 	config.silence_threshold = 30;
2078 	config.report_noise = 1;
2079 	config.answer_pbreq =
2080 #ifndef IEEE80211_STA_ONLY
2081 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 :
2082 #endif
2083 	    0;
2084 	if (ic->ic_curmode == IEEE80211_MODE_11G)
2085 		config.bg_autodetection = 1;
2086 	DPRINTF(("Configuring adapter\n"));
2087 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 1);
2088 	if (error != 0)
2089 		return error;
2090 
2091 #ifdef IWI_DEBUG
2092 	if (iwi_debug > 0) {
2093 		printf("Setting ESSID to ");
2094 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2095 		printf("\n");
2096 	}
2097 #endif
2098 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2099 	if (error != 0)
2100 		return error;
2101 
2102 	/* the rate set has already been "negotiated" */
2103 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2104 	    IWI_MODE_11G;
2105 	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2106 	rs.nrates = ni->ni_rates.rs_nrates;
2107 	if (rs.nrates > sizeof rs.rates) {
2108 #ifdef DIAGNOSTIC
2109 		/* should not happen since the rates are negotiated */
2110 		printf("%s: XXX too many rates (count=%d, last=%d)\n",
2111 		    sc->sc_dev.dv_xname, ni->ni_rates.rs_nrates,
2112 		    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates - 1] &
2113 		    IEEE80211_RATE_VAL);
2114 #endif
2115 		rs.nrates = sizeof rs.rates;
2116 	}
2117 	bcopy(ni->ni_rates.rs_rates, rs.rates, rs.nrates);
2118 	DPRINTF(("Setting negotiated rates (%u)\n", rs.nrates));
2119 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2120 	if (error != 0)
2121 		return error;
2122 
2123 	data = htole32(ni->ni_rssi);
2124 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2125 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2126 	if (error != 0)
2127 		return error;
2128 
2129 	if (ic->ic_flags & IEEE80211_F_QOS) {
2130 		iwi_update_edca(ic);
2131 
2132 		frm = ieee80211_add_qos_capability(buf, ic);
2133 		DPRINTF(("Setting QoS Capability IE length %d\n", frm - buf));
2134 		error = iwi_cmd(sc, IWI_CMD_SET_QOS_CAP, buf, frm - buf, 1);
2135 		if (error != 0)
2136 			return error;
2137 	}
2138 	if (ic->ic_flags & IEEE80211_F_RSNON) {
2139 		/* tell firmware to add WPA/RSN IE to (re)assoc request */
2140 		if (ni->ni_rsnprotos == IEEE80211_PROTO_RSN)
2141 			frm = ieee80211_add_rsn(buf, ic, ni);
2142 		else
2143 			frm = ieee80211_add_wpa(buf, ic, ni);
2144 		DPRINTF(("Setting RSN IE length %d\n", frm - buf));
2145 		error = iwi_cmd(sc, IWI_CMD_SET_OPTIE, buf, frm - buf, 1);
2146 		if (error != 0)
2147 			return error;
2148 	}
2149 
2150 	bzero(&assoc, sizeof assoc);
2151 #ifndef IEEE80211_STA_ONLY
2152 	if (ic->ic_flags & IEEE80211_F_SIBSS)
2153 		assoc.type = IWI_ASSOC_SIBSS;
2154 	else
2155 #endif
2156 		assoc.type = IWI_ASSOC_ASSOCIATE;
2157 	assoc.policy = 0;
2158 	if (ic->ic_flags & IEEE80211_F_RSNON)
2159 		assoc.policy |= htole16(IWI_ASSOC_POLICY_RSN);
2160 	if (ic->ic_flags & IEEE80211_F_QOS)
2161 		assoc.policy |= htole16(IWI_ASSOC_POLICY_QOS);
2162 	if (ic->ic_curmode == IEEE80211_MODE_11A)
2163 		assoc.mode = IWI_MODE_11A;
2164 	else if (ic->ic_curmode == IEEE80211_MODE_11B)
2165 		assoc.mode = IWI_MODE_11B;
2166 	else	/* assume 802.11b/g */
2167 		assoc.mode = IWI_MODE_11G;
2168 	assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2169 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2170 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2171 		assoc.plen = IWI_ASSOC_SHPREAMBLE;
2172 	bcopy(ni->ni_tstamp, assoc.tstamp, 8);
2173 	capinfo = IEEE80211_CAPINFO_ESS;
2174 	if (ic->ic_flags & IEEE80211_F_WEPON)
2175 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2176 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2177 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2178 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2179 	if (ic->ic_caps & IEEE80211_C_SHSLOT)
2180 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2181 	assoc.capinfo = htole16(capinfo);
2182 
2183 	assoc.lintval = htole16(ic->ic_lintval);
2184 	assoc.intval = htole16(ni->ni_intval);
2185 	IEEE80211_ADDR_COPY(assoc.bssid, ni->ni_bssid);
2186 #ifndef IEEE80211_STA_ONLY
2187 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2188 		IEEE80211_ADDR_COPY(assoc.dst, etherbroadcastaddr);
2189 	else
2190 #endif
2191 		IEEE80211_ADDR_COPY(assoc.dst, ni->ni_bssid);
2192 
2193 	DPRINTF(("Trying to associate to %s channel %u auth %u\n",
2194 	    ether_sprintf(assoc.bssid), assoc.chan, assoc.auth));
2195 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &assoc, sizeof assoc, 1);
2196 }
2197 
2198 int
2199 iwi_init(struct ifnet *ifp)
2200 {
2201 	struct iwi_softc *sc = ifp->if_softc;
2202 	struct ieee80211com *ic = &sc->sc_ic;
2203 	struct iwi_firmware_hdr *hdr;
2204 	const char *name, *fw;
2205 	u_char *data;
2206 	size_t size;
2207 	int i, ac, error;
2208 
2209 	iwi_stop(ifp, 0);
2210 
2211 	if ((error = iwi_reset(sc)) != 0) {
2212 		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
2213 		goto fail1;
2214 	}
2215 
2216 	switch (ic->ic_opmode) {
2217 	case IEEE80211_M_STA:
2218 		name = "iwi-bss";
2219 		break;
2220 #ifndef IEEE80211_STA_ONLY
2221 	case IEEE80211_M_IBSS:
2222 	case IEEE80211_M_AHDEMO:
2223 		name = "iwi-ibss";
2224 		break;
2225 #endif
2226 	case IEEE80211_M_MONITOR:
2227 		name = "iwi-monitor";
2228 		break;
2229 	default:
2230 		/* should not get there */
2231 		error = EINVAL;
2232 		goto fail1;
2233 	}
2234 
2235 	if ((error = loadfirmware(name, &data, &size)) != 0) {
2236 		printf("%s: error %d, could not read firmware %s\n",
2237 		    sc->sc_dev.dv_xname, error, name);
2238 		goto fail1;
2239 	}
2240 	if (size < sizeof (struct iwi_firmware_hdr)) {
2241 		printf("%s: firmware image too short: %zu bytes\n",
2242 		    sc->sc_dev.dv_xname, size);
2243 		error = EINVAL;
2244 		goto fail2;
2245 	}
2246 	hdr = (struct iwi_firmware_hdr *)data;
2247 
2248 	if (hdr->vermaj < 3 || hdr->bootsz == 0 || hdr->ucodesz == 0 ||
2249 	    hdr->mainsz == 0) {
2250 		printf("%s: firmware image too old (need at least 3.0)\n",
2251 		    sc->sc_dev.dv_xname);
2252 		error = EINVAL;
2253 		goto fail2;
2254 	}
2255 
2256 	if (size < sizeof (struct iwi_firmware_hdr) + letoh32(hdr->bootsz) +
2257 	    letoh32(hdr->ucodesz) + letoh32(hdr->mainsz)) {
2258 		printf("%s: firmware image too short: %zu bytes\n",
2259 		    sc->sc_dev.dv_xname, size);
2260 		error = EINVAL;
2261 		goto fail2;
2262 	}
2263 
2264 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr);
2265 	if ((error = iwi_load_firmware(sc, fw, letoh32(hdr->bootsz))) != 0) {
2266 		printf("%s: could not load boot firmware\n",
2267 		    sc->sc_dev.dv_xname);
2268 		goto fail2;
2269 	}
2270 
2271 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr) +
2272 	    letoh32(hdr->bootsz);
2273 	if ((error = iwi_load_ucode(sc, fw, letoh32(hdr->ucodesz))) != 0) {
2274 		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
2275 		goto fail2;
2276 	}
2277 
2278 	iwi_stop_master(sc);
2279 
2280 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmdq.map->dm_segs[0].ds_addr);
2281 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, IWI_CMD_RING_COUNT);
2282 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
2283 
2284 	for (ac = 0; ac < EDCA_NUM_AC; ac++) {
2285 		CSR_WRITE_4(sc, IWI_CSR_TX_BASE(ac),
2286 		    sc->txq[ac].map->dm_segs[0].ds_addr);
2287 		CSR_WRITE_4(sc, IWI_CSR_TX_SIZE(ac), IWI_TX_RING_COUNT);
2288 		CSR_WRITE_4(sc, IWI_CSR_TX_WIDX(ac), sc->txq[ac].cur);
2289 	}
2290 
2291 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
2292 		struct iwi_rx_data *data = &sc->rxq.data[i];
2293 		CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
2294 	}
2295 
2296 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, IWI_RX_RING_COUNT - 1);
2297 
2298 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr) +
2299 	    letoh32(hdr->bootsz) + letoh32(hdr->ucodesz);
2300 	if ((error = iwi_load_firmware(sc, fw, letoh32(hdr->mainsz))) != 0) {
2301 		printf("%s: could not load main firmware\n",
2302 		    sc->sc_dev.dv_xname);
2303 		goto fail2;
2304 	}
2305 
2306 	free(data, M_DEVBUF, 0);
2307 	sc->sc_flags |= IWI_FLAG_FW_INITED;
2308 
2309 	if ((error = iwi_config(sc)) != 0) {
2310 		printf("%s: device configuration failed\n",
2311 		    sc->sc_dev.dv_xname);
2312 		goto fail1;
2313 	}
2314 
2315 	ifp->if_flags &= ~IFF_OACTIVE;
2316 	ifp->if_flags |= IFF_RUNNING;
2317 
2318 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2319 		ieee80211_begin_scan(ifp);
2320 	else
2321 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2322 
2323 	return 0;
2324 
2325 fail2:	free(data, M_DEVBUF, 0);
2326 fail1:	iwi_stop(ifp, 0);
2327 	return error;
2328 }
2329 
2330 void
2331 iwi_stop(struct ifnet *ifp, int disable)
2332 {
2333 	struct iwi_softc *sc = ifp->if_softc;
2334 	struct ieee80211com *ic = &sc->sc_ic;
2335 	int ac;
2336 
2337 	sc->sc_tx_timer = 0;
2338 	ifp->if_timer = 0;
2339 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2340 
2341 	/* in case we were scanning, release the scan "lock" */
2342 	ic->ic_scan_lock = IEEE80211_SCAN_UNLOCKED;
2343 
2344 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2345 
2346 	iwi_stop_master(sc);
2347 
2348 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SW_RESET);
2349 
2350 	/* reset rings */
2351 	iwi_reset_cmd_ring(sc, &sc->cmdq);
2352 	for (ac = 0; ac < EDCA_NUM_AC; ac++)
2353 		iwi_reset_tx_ring(sc, &sc->txq[ac]);
2354 	iwi_reset_rx_ring(sc, &sc->rxq);
2355 }
2356 
2357 struct cfdriver iwi_cd = {
2358 	NULL, "iwi", DV_IFNET
2359 };
2360