xref: /dragonfly/sys/dev/netif/iwi/if_iwi.c (revision 1bf4b486)
1 /*
2  * Copyright (c) 2004, 2005
3  *      Damien Bergamini <damien.bergamini@free.fr>.
4  * Copyright (c) 2004, 2005
5  *      Andrew Atrens <atrens@nortelnetworks.com>.
6  *
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice unmodified, this list of conditions, and the following
14  *    disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  * $DragonFly: src/sys/dev/netif/iwi/if_iwi.c,v 1.6 2005/07/26 12:40:38 joerg Exp $
32  */
33 
34 #include "opt_inet.h"
35 
36 #include <sys/cdefs.h>
37 
38 /*-
39  * Intel(R) PRO/Wireless 2200BG/2915ABG driver
40  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
41  */
42 
43 #include <sys/param.h>
44 #include <sys/sysctl.h>
45 #include <sys/sockio.h>
46 #include <sys/mbuf.h>
47 #include <sys/kernel.h>
48 #include <sys/kthread.h>
49 #include <sys/socket.h>
50 #include <sys/systm.h>
51 #include <sys/malloc.h>
52 #include <sys/module.h>
53 #include <sys/bus.h>
54 #include <sys/endian.h>
55 #include <sys/proc.h>
56 #include <sys/ucred.h>
57 #include <sys/thread2.h>
58 
59 #include <machine/bus.h>
60 #include <machine/resource.h>
61 #include <machine/clock.h>
62 #include <sys/rman.h>
63 
64 #include <bus/pci/pcireg.h>
65 #include <bus/pci/pcivar.h>
66 
67 #include <net/bpf.h>
68 #include <net/if.h>
69 #include <net/if_arp.h>
70 #include <net/ifq_var.h>
71 #include <net/ethernet.h>
72 #include <net/if_dl.h>
73 #include <net/if_media.h>
74 #include <net/if_types.h>
75 #include <net/ifq_var.h>
76 
77 #include <netinet/in.h>
78 #include <netinet/in_systm.h>
79 #include <netinet/in_var.h>
80 #include <netinet/ip.h>
81 #include <netinet/if_ether.h>
82 
83 #ifdef IPX
84 #include <netproto/ipx/ipx.h>
85 #include <netproto/ipx/ipx_if.h>
86 #endif
87 
88 #include <netproto/802_11/ieee80211_var.h>
89 #include <netproto/802_11/ieee80211_ioctl.h>
90 #include <netproto/802_11/ieee80211_radiotap.h>
91 #include <netproto/802_11/if_wavelan_ieee.h>
92 
93 #include "if_iwireg.h"
94 #include "if_iwivar.h"
95 
96 #ifdef IWI_DEBUG
97 #define DPRINTF(x)	if (sc->debug_level > 0) printf x
98 #define DPRINTFN(n, x)	if (sc->debug_level >= (n)) printf x
99 
100 #else
101 #define DPRINTF(x)
102 #define DPRINTFN(n, x)
103 #endif
104 
105 MODULE_DEPEND(iwi, pci,  1, 1, 1);
106 MODULE_DEPEND(iwi, wlan, 1, 1, 1);
107 
108 struct iwi_dump_buffer {
109 	u_int32_t buf[128];
110 };
111 
112 struct iwi_ident {
113 	u_int16_t	vendor;
114 	u_int16_t	device;
115 	const char	*name;
116 };
117 
118 static const struct iwi_ident iwi_ident_table[] = {
119 	{ 0x8086, 0x4220, "Intel(R) PRO/Wireless 2200BG MiniPCI" },
120 	{ 0x8086, 0x4223, "Intel(R) PRO/Wireless 2915ABG MiniPCI" },
121 	{ 0x8086, 0x4224, "Intel(R) PRO/Wireless 2915ABG MiniPCI" },
122 
123 	{ 0, 0, NULL }
124 };
125 
126 static const struct ieee80211_rateset iwi_rateset_11a =
127 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
128 
129 static const struct ieee80211_rateset iwi_rateset_11b =
130 	{ 4, { 2, 4, 11, 22 } };
131 
132 static const struct ieee80211_rateset iwi_rateset_11g =
133 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
134 
135 static int		iwi_dma_alloc(struct iwi_softc *);
136 static void		iwi_release(struct iwi_softc *);
137 static int		iwi_media_change(struct ifnet *);
138 static void		iwi_media_status(struct ifnet *, struct ifmediareq *);
139 static u_int16_t	iwi_read_prom_word(struct iwi_softc *, u_int8_t);
140 static int		iwi_newstate(struct ieee80211com *,
141 			    enum ieee80211_state, int);
142 static void		iwi_fix_channel(struct iwi_softc *, struct mbuf *);
143 static void		iwi_frame_intr(struct iwi_softc *,
144 			    struct iwi_rx_buf *, int, struct iwi_frame *);
145 static void		iwi_notification_intr(struct iwi_softc *,
146 			    struct iwi_notif *);
147 static void		iwi_rx_intr(struct iwi_softc *);
148 static void		iwi_tx_intr(struct iwi_softc *);
149 static void		iwi_intr(void *);
150 static void		iwi_dma_map_buf(void *, bus_dma_segment_t *, int,
151 			    bus_size_t, int);
152 static void		iwi_dma_map_addr(void *, bus_dma_segment_t *, int, int);
153 static int		iwi_cmd(struct iwi_softc *, u_int8_t, void *, u_int8_t,
154 			    int);
155 static int		iwi_tx_start(struct ifnet *, struct mbuf *,
156 			    struct ieee80211_node *);
157 static void		iwi_start(struct ifnet *);
158 static void		iwi_watchdog(struct ifnet *);
159 static int		iwi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *cr);
160 static void		iwi_stop_master(struct iwi_softc *);
161 static int		iwi_reset(struct iwi_softc *);
162 static int		iwi_load_ucode(struct iwi_softc *, void *, int);
163 static int		iwi_load_firmware(struct iwi_softc *, void *, int);
164 static int		iwi_cache_firmware(struct iwi_softc *, void *, int);
165 static void		iwi_free_firmware(struct iwi_softc *);
166 static int		iwi_config(struct iwi_softc *);
167 static int		iwi_scan(struct iwi_softc *);
168 static int		iwi_auth_and_assoc(struct iwi_softc *);
169 static void		iwi_init(void *);
170 static void		iwi_init_locked(void *);
171 static void		iwi_stop(void *);
172 static void		iwi_dump_fw_event_log(struct iwi_softc *sc);
173 static void		iwi_dump_fw_error_log(struct iwi_softc *sc);
174 static u_int8_t 	iwi_find_station(struct iwi_softc *sc, u_int8_t *mac);
175 static int8_t		iwi_cache_station(struct iwi_softc *sc, u_int8_t *mac);
176 static int		iwi_adapter_config(struct iwi_softc *sc, int is_a, int cmd_wait);
177 
178 static int		iwi_sysctl_bt_coexist(SYSCTL_HANDLER_ARGS);
179 static int		iwi_sysctl_bg_autodetect(SYSCTL_HANDLER_ARGS);
180 static int		iwi_sysctl_cts_to_self(SYSCTL_HANDLER_ARGS);
181 static int		iwi_sysctl_antenna_diversity(SYSCTL_HANDLER_ARGS);
182 static int		iwi_sysctl_radio(SYSCTL_HANDLER_ARGS);
183 static int		iwi_sysctl_stats(SYSCTL_HANDLER_ARGS);
184 static int		iwi_sysctl_dump_logs(SYSCTL_HANDLER_ARGS);
185 static int		iwi_sysctl_neg_best_rates_first(SYSCTL_HANDLER_ARGS);
186 static int		iwi_sysctl_disable_unicast_decryption(SYSCTL_HANDLER_ARGS);
187 static int		iwi_sysctl_disable_multicast_decryption(SYSCTL_HANDLER_ARGS);
188 
189 static __inline u_int8_t MEM_READ_1(struct iwi_softc *sc, u_int32_t addr)
190 {
191 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
192 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
193 }
194 
195 static __inline u_int32_t MEM_READ_4(struct iwi_softc *sc, u_int32_t addr)
196 {
197 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
198 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
199 }
200 
201 static int iwi_probe(device_t);
202 static int iwi_attach(device_t);
203 static int iwi_detach(device_t);
204 static int iwi_shutdown(device_t);
205 static int iwi_suspend(device_t);
206 static int iwi_resume(device_t);
207 
208 static device_method_t iwi_methods[] = {
209 	/* Device interface */
210 	DEVMETHOD(device_probe,		iwi_probe),
211 	DEVMETHOD(device_attach,	iwi_attach),
212 	DEVMETHOD(device_detach,	iwi_detach),
213 	DEVMETHOD(device_shutdown,	iwi_shutdown),
214 	DEVMETHOD(device_suspend,	iwi_suspend),
215 	DEVMETHOD(device_resume,	iwi_resume),
216 
217 	{ 0, 0 }
218 };
219 
220 static driver_t iwi_driver = {
221 	"iwi",
222 	iwi_methods,
223 	sizeof (struct iwi_softc),
224 	0, /* baseclasses */
225 	0, /* refs */
226 	0  /* ops */
227 };
228 
229 static devclass_t iwi_devclass;
230 
231 DRIVER_MODULE(iwi, pci, iwi_driver, iwi_devclass, 0, 0);
232 
233 static int
234 iwi_probe(device_t dev)
235 {
236 	const struct iwi_ident *ident;
237 
238 	for (ident = iwi_ident_table; ident->name != NULL; ident++) {
239 		if (pci_get_vendor(dev) == ident->vendor &&
240 		    pci_get_device(dev) == ident->device) {
241 			device_set_desc(dev, ident->name);
242 			return 0;
243 		}
244 	}
245 	return ENXIO;
246 }
247 
248 static void
249 iwi_fw_monitor(void *arg)
250 {
251 	struct iwi_softc *sc = (struct iwi_softc *)arg;
252 	int error, boff;
253 	for ( ;; ) {
254 		error = tsleep(IWI_FW_WAKE_MONITOR(sc), 0, "iwifwm", 0 );
255 		if ( error == 0 ) {
256 			if ( sc->flags & IWI_FLAG_EXIT ) {
257 				sc->flags &= ~( IWI_FLAG_EXIT );
258 				break;
259 			} else if ( sc->flags & IWI_FLAG_RESET ) {
260 				device_printf(sc->sc_dev, "firmware reset\n");
261 				for ( boff = 1; sc->flags & IWI_FLAG_RESET ; boff++ ) {
262 					if ( sc->debug_level > 0 )
263 						iwi_dump_fw_error_log(sc);
264 					iwi_init_locked(sc);
265 					if ((sc->flags & IWI_FLAG_FW_INITED))
266 						sc->flags &= ~( IWI_FLAG_RESET );
267 					error = tsleep( IWI_FW_CMD_ACKED(sc), 0,
268 						       "iwirun", boff * hz );
269 				}
270 			}
271 		}
272 	}
273 	wakeup(IWI_FW_MON_EXIT(sc));
274 	kthread_exit();
275 }
276 
277 static int
278 iwi_start_fw_monitor_thread( struct iwi_softc *sc )
279 {
280        if (kthread_create(iwi_fw_monitor, sc, &sc->event_thread,
281 		"%s%d:fw-monitor", device_get_name(sc->sc_dev),
282 		device_get_unit(sc->sc_dev))) {
283 		device_printf (sc->sc_dev,
284 		   "unable to create firmware monitor thread.\n");
285 		return -1;
286 	}
287 	return 0;
288 }
289 
290 /* Base Address Register */
291 #define IWI_PCI_BAR0	0x10
292 
293 static int
294 iwi_attach(device_t dev)
295 {
296 	struct iwi_softc *sc = device_get_softc(dev);
297 	struct ieee80211com *ic = &sc->sc_ic;
298 	struct ifnet *ifp = &ic->ic_if;
299 	u_int16_t val;
300 	int error, rid, i;
301 
302 	sc->sc_dev = dev;
303 
304 	IWI_LOCK_INIT( &sc->sc_lock );
305 	IWI_LOCK_INIT( &sc->sc_intrlock );
306 
307 	if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
308 		device_printf(dev, "chip is in D%d power mode "
309 		    "-- setting to D0\n", pci_get_powerstate(dev));
310 		pci_set_powerstate(dev, PCI_POWERSTATE_D0);
311 	}
312 
313 	pci_write_config(dev, 0x41, 0, 1);
314 
315 	/* enable bus-mastering */
316 	pci_enable_busmaster(dev);
317 
318 	sc->num_stations = 0;
319 
320 	/* map the register window */
321 	rid = IWI_PCI_BAR0;
322 	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid, RF_ACTIVE);
323 	if (sc->mem == NULL) {
324 		device_printf(dev, "could not allocate memory resource\n");
325 		error = ENXIO;
326 		goto fail;
327 	}
328 
329 	sc->sc_st = rman_get_bustag(sc->mem);
330 	sc->sc_sh = rman_get_bushandle(sc->mem);
331 
332 	rid = 0;
333 	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
334 	    RF_SHAREABLE);
335 	if (sc->irq == NULL) {
336 		device_printf(dev, "could not allocate interrupt resource\n");
337 		error = ENXIO;
338 		goto fail;
339 	}
340 
341 	error = iwi_reset(sc);
342 	if (error != 0) {
343 		device_printf(dev, "could not reset adapter\n");
344 		goto fail;
345 	}
346 
347 	if (iwi_start_fw_monitor_thread(sc)) {
348 		device_printf(dev, "could not start f/w reset thread\n");
349 		error = ENXIO;
350 		goto fail;
351 	}
352 
353 	error = iwi_dma_alloc(sc);
354 	if (error != 0) {
355 		device_printf(dev, "could not allocate DMA resources\n");
356 		goto fail;
357 	}
358 
359 	ic->ic_phytype = IEEE80211_T_OFDM;
360 	ic->ic_opmode  = IEEE80211_M_STA;
361 	ic->ic_state   = IEEE80211_S_INIT;
362 
363 	/* set device capabilities */
364 	ic->ic_caps = IEEE80211_C_IBSS | IEEE80211_C_PMGT | IEEE80211_C_WEP |
365 	    IEEE80211_C_TXPMGT | IEEE80211_C_SHPREAMBLE;
366 
367 	/* read MAC address from EEPROM */
368 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
369 	ic->ic_myaddr[0] = val >> 8;
370 	ic->ic_myaddr[1] = val & 0xff;
371 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
372 	ic->ic_myaddr[2] = val >> 8;
373 	ic->ic_myaddr[3] = val & 0xff;
374 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
375 	ic->ic_myaddr[4] = val >> 8;
376 	ic->ic_myaddr[5] = val & 0xff;
377 
378 	if (pci_get_device(dev) != 0x4220) {
379 		/* set supported .11a rates */
380 		ic->ic_sup_rates[IEEE80211_MODE_11A] = iwi_rateset_11a;
381 
382 		/* set supported .11a channels */
383 		for (i = 36; i <= 64; i += 4) {
384 			ic->ic_channels[i].ic_freq =
385 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
386 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
387 		}
388 		for (i = 149; i <= 165; i += 4) {
389 			ic->ic_channels[i].ic_freq =
390 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
391 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
392 		}
393 	}
394 
395 	/* set supported .11b and .11g rates */
396 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwi_rateset_11b;
397 	ic->ic_sup_rates[IEEE80211_MODE_11G] = iwi_rateset_11g;
398 
399 	/* set supported .11b and .11g channels (1 through 14) */
400 	for (i = 1; i <= 14; i++) {
401 		ic->ic_channels[i].ic_freq =
402 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
403 		ic->ic_channels[i].ic_flags =
404 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
405 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
406 	}
407 
408 	/* default to authmode OPEN */
409 	sc->authmode = IEEE80211_AUTH_OPEN;
410 
411 	/* IBSS channel undefined for now */
412 	ic->ic_ibss_chan = &ic->ic_channels[0];
413 
414 	ifp->if_softc = sc;
415 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
416 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
417 	ifp->if_init = iwi_init_locked;
418 	ifp->if_ioctl = iwi_ioctl;
419 	ifp->if_start = iwi_start;
420 	ifp->if_watchdog = iwi_watchdog;
421 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
422 	ifq_set_ready(&ifp->if_snd);
423 
424 	ieee80211_ifattach(ifp);
425 	/* override state transition machine */
426 	sc->sc_newstate = ic->ic_newstate;
427 	ic->ic_newstate = iwi_newstate;
428 	ieee80211_media_init(ifp, iwi_media_change, iwi_media_status);
429 
430 	bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
431 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
432 
433 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
434 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
435 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
436 
437 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
438 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
439 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
440 
441 	/*
442 	 * Add sysctl knobs
443 	 *
444 	 * use -1 to indicate 'default / not set'
445 	 */
446 
447 	sc->enable_bg_autodetect         = -1;
448 	sc->enable_bt_coexist            = -1;
449 	sc->enable_cts_to_self           = -1;
450 	sc->antenna_diversity            = -1;
451 	sc->enable_neg_best_first        = -1;
452 	sc->disable_unicast_decryption   = -1;
453 	sc->disable_multicast_decryption = -1;
454 
455 	sysctl_ctx_init(&sc->sysctl_ctx);
456 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
457 				SYSCTL_STATIC_CHILDREN(_hw),
458 				OID_AUTO,
459 				device_get_nameunit(dev),
460 				CTLFLAG_RD,
461 				0, "");
462 
463 	if (sc->sysctl_tree == NULL) {
464 		device_printf(dev, "sysctl add node failed\n");
465 		error = EIO;
466 		goto fail2;
467 	}
468 
469 	SYSCTL_ADD_INT(&sc->sysctl_ctx, SYSCTL_CHILDREN(sc->sysctl_tree),
470 		       OID_AUTO, "debug", CTLFLAG_RW, &sc->debug_level, 0,
471 		      "Set driver debug level (0 = off)");
472 
473 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
474 			SYSCTL_CHILDREN(sc->sysctl_tree),
475 			OID_AUTO, "cts_to_self", CTLTYPE_INT|CTLFLAG_RW,
476 			(void *)sc, 0, iwi_sysctl_cts_to_self, "I",
477 			"Enable cts to self [0 = Off] [1 = On] [-1 = Auto]" );
478 
479 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
480 			SYSCTL_CHILDREN(sc->sysctl_tree),
481 			OID_AUTO, "antenna_diversity", CTLTYPE_INT|CTLFLAG_RW,
482 			(void *)sc, 0, iwi_sysctl_antenna_diversity,
483 			"I", "Set antenna diversity [0 = Both] "
484 			"[1 = Antenna A] [3 = Antenna B] [-1 = Auto]" );
485 
486 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
487 			SYSCTL_CHILDREN(sc->sysctl_tree),
488 			OID_AUTO, "bluetooth_coexist", CTLTYPE_INT|CTLFLAG_RW,
489 			(void *)sc, 0, iwi_sysctl_bt_coexist,
490 			"I", "Enable bluetooth coexistence heuristics "
491 			"[0 = Off] [1 = On] [-1 = Auto]" );
492 
493 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
494 			SYSCTL_CHILDREN(sc->sysctl_tree),
495 			OID_AUTO, "bg_autodetect", CTLTYPE_INT|CTLFLAG_RW,
496 			(void *)sc, 0, iwi_sysctl_bg_autodetect,
497 			"I", "Set b/g autodetect [0 = Off] [1 = On] [-1 = Auto]" );
498 
499 
500 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
501 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "radio",
502 			CTLTYPE_INT | CTLFLAG_RD, sc, 0, iwi_sysctl_radio, "I",
503 			"Radio transmitter switch");
504 
505 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
506 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "stats",
507 			CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, iwi_sysctl_stats,
508 			"S,iwi_dump_buffer", "statistics");
509 
510 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
511 			SYSCTL_CHILDREN(sc->sysctl_tree),
512 			OID_AUTO, "firmware_logs", CTLTYPE_INT|CTLFLAG_RW,
513 			(void *)sc, 0, iwi_sysctl_dump_logs, "I", "Dump firmware logs");
514 
515 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
516 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
517 			"neg_best_rates_first",
518 			CTLTYPE_INT | CTLFLAG_RW, sc, 0,
519 			iwi_sysctl_neg_best_rates_first, "I",
520 			 "Negotiate highest rates first.");
521 
522 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
523 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
524 			"disable_unicast_decrypt",
525 			CTLTYPE_INT | CTLFLAG_RW, sc, 0,
526 			iwi_sysctl_disable_unicast_decryption, "I",
527 			 "Disable unicast decryption.");
528 
529 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
530 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
531 			"disable_multicast_decrypt",
532 			CTLTYPE_INT | CTLFLAG_RW, sc, 0,
533 			iwi_sysctl_disable_multicast_decryption, "I",
534 			 "Disable multicast decryption.");
535 
536 	/*
537 	 * Hook our interrupt after all initialization is complete
538 	 */
539 	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
540 			       iwi_intr, sc, &sc->sc_ih, NULL);
541 	if (error != 0) {
542 		device_printf(dev, "could not set up interrupt\n");
543 		goto fail2;
544 	}
545 
546 	return 0;
547 
548 fail2:
549 	bpfdetach(ifp);
550 	ieee80211_ifdetach(ifp);
551 fail:
552 	iwi_detach(dev);
553 	return error;
554 }
555 
556 static int
557 iwi_detach(device_t dev)
558 {
559 	struct iwi_softc *sc = device_get_softc(dev);
560 	struct ifnet *ifp = &sc->sc_ic.ic_if;
561 	IWI_LOCK_INFO;
562 	IWI_IPLLOCK_INFO;
563 
564 	sc->flags |= IWI_FLAG_EXIT;
565 	wakeup(IWI_FW_WAKE_MONITOR(sc)); /* Stop firmware monitor. */
566 
567 	tsleep(IWI_FW_MON_EXIT(sc), 0, "iwiexi", 10 * hz);
568 
569 	IWI_LOCK(sc);
570 	IWI_IPLLOCK(sc);
571 
572 	if (device_is_attached(dev)) {
573 		iwi_stop(sc);
574 		iwi_free_firmware(sc);
575 		bpfdetach(ifp);
576 		ieee80211_ifdetach(ifp);
577 	}
578 
579 	if (sc->sysctl_tree) {
580 		crit_enter();
581 		sysctl_ctx_free(&sc->sysctl_ctx);
582 		crit_exit();
583 		sc->sysctl_tree = 0;
584 	}
585 
586 	if (sc->sc_ih != NULL)
587 		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
588 
589 	IWI_IPLUNLOCK(sc);
590 	IWI_UNLOCK(sc);
591 
592 	if (sc->irq != NULL)
593 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq);
594 
595 	if (sc->mem != NULL) {
596 		bus_release_resource(dev, SYS_RES_MEMORY, IWI_PCI_BAR0,
597 		    sc->mem);
598 	}
599 
600 	iwi_release(sc);
601 
602 	IWI_LOCK_DESTROY(&(sc->sc_lock));
603 	IWI_LOCK_DESTROY(&(sc->sc_intrlock));
604 
605 	return 0;
606 }
607 
608 static int
609 iwi_dma_alloc(struct iwi_softc *sc)
610 {
611 	int i, error;
612 
613 	error = bus_dma_tag_create(NULL, /* parent */
614 				   1, 0,
615 				   BUS_SPACE_MAXADDR_32BIT,
616 				   BUS_SPACE_MAXADDR,
617 				   NULL, NULL,
618 				   MAXBSIZE, 128,
619 				   BUS_SPACE_MAXSIZE_32BIT,
620 				   BUS_DMA_ALLOCNOW,
621 				   &sc->iwi_parent_tag );
622 	if (error != 0) {
623 		device_printf(sc->sc_dev, "could not create parent tag\n");
624 		goto fail;
625 	}
626 	/*
627 	 * Allocate and map Tx ring
628 	 */
629 	error = bus_dma_tag_create(sc->iwi_parent_tag, 4, 0, BUS_SPACE_MAXADDR_32BIT,
630 	    BUS_SPACE_MAXADDR, NULL, NULL,
631 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_SIZE, 1,
632 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_SIZE,
633 	    BUS_DMA_ALLOCNOW, &sc->tx_ring_dmat);
634 	if (error != 0) {
635 		device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
636 		goto fail;
637 	}
638 
639 	error = bus_dmamem_alloc(sc->tx_ring_dmat,(void **) &sc->tx_desc,
640 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->tx_ring_map);
641 	if (error != 0) {
642 		device_printf(sc->sc_dev,
643 		    "could not allocate tx ring DMA memory\n");
644 		goto fail;
645 	}
646 
647 	error = bus_dmamap_load(sc->tx_ring_dmat, sc->tx_ring_map,
648 	    sc->tx_desc, sizeof (struct iwi_tx_desc) * IWI_TX_RING_SIZE,
649 	    iwi_dma_map_addr, &sc->tx_ring_pa, 0);
650 	if (error != 0) {
651 		device_printf(sc->sc_dev, "could not load tx ring DMA map\n");
652 		goto fail;
653 	}
654 
655 	/*
656 	 * Allocate and map command ring
657 	 */
658 	error = bus_dma_tag_create(sc->iwi_parent_tag, 4, 0, BUS_SPACE_MAXADDR_32BIT,
659 	    BUS_SPACE_MAXADDR, NULL, NULL,
660 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_SIZE, 1,
661 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_SIZE,
662 	    BUS_DMA_ALLOCNOW,
663 	    &sc->cmd_ring_dmat);
664 	if (error != 0) {
665 		device_printf(sc->sc_dev,
666 		    "could not create command ring DMA tag\n");
667 		goto fail;
668 	}
669 
670 	error = bus_dmamem_alloc(sc->cmd_ring_dmat, (void **)&sc->cmd_desc,
671 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->cmd_ring_map);
672 	if (error != 0) {
673 		device_printf(sc->sc_dev,
674 		    "could not allocate command ring DMA memory\n");
675 		goto fail;
676 	}
677 
678 	error = bus_dmamap_load(sc->cmd_ring_dmat, sc->cmd_ring_map,
679 	    sc->cmd_desc, sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_SIZE,
680 	    iwi_dma_map_addr, &sc->cmd_ring_pa, 0);
681 	if (error != 0) {
682 		device_printf(sc->sc_dev,
683 		    "could not load command ring DMA map\n");
684 		goto fail;
685 	}
686 
687 	/*
688 	 * Allocate Tx buffers DMA maps
689 	 */
690 	error = bus_dma_tag_create(sc->iwi_parent_tag, 1, 0, BUS_SPACE_MAXADDR_32BIT,
691 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IWI_MAX_NSEG, MCLBYTES,
692 	    BUS_DMA_ALLOCNOW, &sc->tx_buf_dmat);
693 	if (error != 0) {
694 		device_printf(sc->sc_dev, "could not create tx buf DMA tag\n");
695 		goto fail;
696 	}
697 
698 	for (i = 0; i < IWI_TX_RING_SIZE; i++) {
699 		error = bus_dmamap_create(sc->tx_buf_dmat, 0,
700 		    &sc->tx_buf[i].map);
701 		if (error != 0) {
702 			device_printf(sc->sc_dev,
703 			    "could not create tx buf DMA map");
704 			goto fail;
705 		}
706 	}
707 
708 	/*
709 	 * Allocate and map Rx buffers
710 	 */
711 	error = bus_dma_tag_create(sc->iwi_parent_tag, 1, 0, BUS_SPACE_MAXADDR_32BIT,
712 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES,
713 	    BUS_DMA_ALLOCNOW, &sc->rx_buf_dmat);
714 	if (error != 0) {
715 		device_printf(sc->sc_dev, "could not create rx buf DMA tag\n");
716 		goto fail;
717 	}
718 
719 	for (i = 0; i < IWI_RX_RING_SIZE; i++) {
720 
721 		error = bus_dmamap_create(sc->rx_buf_dmat, 0,
722 		    &sc->rx_buf[i].map);
723 		if (error != 0) {
724 			device_printf(sc->sc_dev,
725 			    "could not create rx buf DMA map");
726 			goto fail;
727 		}
728 
729 		sc->rx_buf[i].m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
730 		if (sc->rx_buf[i].m == NULL) {
731 			device_printf(sc->sc_dev,
732 			    "could not allocate rx mbuf\n");
733 			error = ENOMEM;
734 			goto fail;
735 		}
736 
737 		error = bus_dmamap_load(sc->rx_buf_dmat, sc->rx_buf[i].map,
738 		    mtod(sc->rx_buf[i].m, void *), MCLBYTES, iwi_dma_map_addr,
739 		    &sc->rx_buf[i].physaddr, 0);
740 		if (error != 0) {
741 			device_printf(sc->sc_dev,
742 			    "could not load rx buf DMA map");
743 			goto fail;
744 		}
745 	}
746 
747 	return 0;
748 
749 fail:	iwi_release(sc);
750 	return error;
751 }
752 
753 static void
754 iwi_release(struct iwi_softc *sc)
755 {
756 	int i;
757 
758 	if (sc->tx_ring_dmat != NULL) {
759 		if (sc->tx_desc != NULL) {
760 			bus_dmamap_sync(sc->tx_ring_dmat, sc->tx_ring_map,
761 			    BUS_DMASYNC_POSTWRITE);
762 			bus_dmamap_unload(sc->tx_ring_dmat, sc->tx_ring_map);
763 			bus_dmamem_free(sc->tx_ring_dmat, sc->tx_desc,
764 			    sc->tx_ring_map);
765 		}
766 		bus_dma_tag_destroy(sc->tx_ring_dmat);
767 	}
768 
769 	if (sc->cmd_ring_dmat != NULL) {
770 		if (sc->cmd_desc != NULL) {
771 			bus_dmamap_sync(sc->cmd_ring_dmat, sc->cmd_ring_map,
772 			    BUS_DMASYNC_POSTWRITE);
773 			bus_dmamap_unload(sc->cmd_ring_dmat, sc->cmd_ring_map);
774 			bus_dmamem_free(sc->cmd_ring_dmat, sc->cmd_desc,
775 			    sc->cmd_ring_map);
776 		}
777 		bus_dma_tag_destroy(sc->cmd_ring_dmat);
778 	}
779 
780 	if (sc->tx_buf_dmat != NULL) {
781 		for (i = 0; i < IWI_TX_RING_SIZE; i++) {
782 			if (sc->tx_buf[i].m != NULL) {
783 				bus_dmamap_sync(sc->tx_buf_dmat,
784 				    sc->tx_buf[i].map, BUS_DMASYNC_POSTWRITE);
785 				bus_dmamap_unload(sc->tx_buf_dmat,
786 				    sc->tx_buf[i].map);
787 				m_freem(sc->tx_buf[i].m);
788 			}
789 			bus_dmamap_destroy(sc->tx_buf_dmat, sc->tx_buf[i].map);
790 		}
791 		bus_dma_tag_destroy(sc->tx_buf_dmat);
792 	}
793 
794 	if (sc->rx_buf_dmat != NULL) {
795 		for (i = 0; i < IWI_RX_RING_SIZE; i++) {
796 			if (sc->rx_buf[i].m != NULL) {
797 				bus_dmamap_sync(sc->rx_buf_dmat,
798 				    sc->rx_buf[i].map, BUS_DMASYNC_POSTREAD);
799 				bus_dmamap_unload(sc->rx_buf_dmat,
800 				    sc->rx_buf[i].map);
801 				m_freem(sc->rx_buf[i].m);
802 			}
803 			bus_dmamap_destroy(sc->rx_buf_dmat, sc->rx_buf[i].map);
804 		}
805 		bus_dma_tag_destroy(sc->rx_buf_dmat);
806 	}
807 	if ( sc->iwi_parent_tag != NULL ) {
808 		bus_dma_tag_destroy(sc->iwi_parent_tag);
809 	}
810 }
811 
812 static int
813 iwi_shutdown(device_t dev)
814 {
815 	struct iwi_softc *sc = device_get_softc(dev);
816 	IWI_LOCK_INFO;
817 
818 	IWI_LOCK(sc);
819 
820 	iwi_stop(sc);
821 
822 	IWI_UNLOCK(sc);
823 
824 	return 0;
825 }
826 
827 static int
828 iwi_suspend(device_t dev)
829 {
830 	struct iwi_softc *sc = device_get_softc(dev);
831 
832 	IWI_LOCK_INFO;
833 
834 	IWI_LOCK(sc);
835 
836 	iwi_stop(sc);
837 
838 	IWI_UNLOCK(sc);
839 
840 	return 0;
841 }
842 
843 static int
844 iwi_resume(device_t dev)
845 {
846 	struct iwi_softc *sc = device_get_softc(dev);
847 	struct ifnet *ifp = &sc->sc_ic.ic_if;
848 	IWI_LOCK_INFO;
849 
850 	IWI_LOCK(sc);
851 
852 	pci_write_config(dev, 0x41, 0, 1);
853 
854 	if (ifp->if_flags & IFF_UP) {
855 		ifp->if_init(ifp->if_softc);
856 		if (ifp->if_flags & IFF_RUNNING)
857 			ifp->if_start(ifp);
858 	}
859 
860 	IWI_UNLOCK(sc);
861 
862 	return 0;
863 }
864 
865 static int
866 iwi_media_change(struct ifnet *ifp)
867 {
868 	struct iwi_softc *sc = ifp->if_softc;
869 	int error = 0;
870 	IWI_LOCK_INFO;
871 
872 	IWI_LOCK(sc);
873 
874 	error = ieee80211_media_change(ifp);
875 	if (error != ENETRESET) {
876 		IWI_UNLOCK(sc);
877 		return error;
878 	}
879 	error = 0; /* clear ENETRESET */
880 
881 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING)){
882 		iwi_init(sc);
883 		error = tsleep( IWI_FW_CMD_ACKED(sc), 0, "iwirun", hz );
884 	}
885 
886 
887 	IWI_UNLOCK(sc);
888 
889 	return error;
890 }
891 
892 static void
893 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
894 {
895 	struct iwi_softc *sc = ifp->if_softc;
896 	struct ieee80211com *ic = &sc->sc_ic;
897 #define N(a)	(sizeof (a) / sizeof (a[0]))
898 	static const struct {
899 		u_int32_t	val;
900 		int		rate;
901 	} rates[] = {
902 		{ IWI_RATE_DS1,      2 },
903 		{ IWI_RATE_DS2,      4 },
904 		{ IWI_RATE_DS5,     11 },
905 		{ IWI_RATE_DS11,    22 },
906 		{ IWI_RATE_OFDM6,   12 },
907 		{ IWI_RATE_OFDM9,   18 },
908 		{ IWI_RATE_OFDM12,  24 },
909 		{ IWI_RATE_OFDM18,  36 },
910 		{ IWI_RATE_OFDM24,  48 },
911 		{ IWI_RATE_OFDM36,  72 },
912 		{ IWI_RATE_OFDM48,  96 },
913 		{ IWI_RATE_OFDM54, 108 },
914 	};
915 	u_int32_t val, i;
916 	int rate;
917 
918 	imr->ifm_status = IFM_AVALID;
919 	imr->ifm_active = IFM_IEEE80211;
920 	if (ic->ic_state == IEEE80211_S_RUN)
921 		imr->ifm_status |= IFM_ACTIVE;
922 
923 	/* read current transmission rate from adapter */
924 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
925 
926 	/* convert rate to 802.11 rate */
927 	for (i = 0; i < N(rates) && rates[i].val != val ; i++);
928 	rate = (i < N(rates)) ? rates[i].rate : 0;
929 
930 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
931 	switch (ic->ic_opmode) {
932 	case IEEE80211_M_STA:
933 		break;
934 
935 	case IEEE80211_M_IBSS:
936 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
937 		break;
938 
939 	case IEEE80211_M_MONITOR:
940 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
941 		break;
942 
943 	case IEEE80211_M_AHDEMO:
944 	case IEEE80211_M_HOSTAP:
945 		/* should not get there */
946 		break;
947 	}
948 #undef N
949 }
950 
951 static int
952 iwi_disassociate( struct iwi_softc *sc  )
953 {
954 	sc->assoc.type = 2; /* DISASSOCIATE */
955 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &sc->assoc, sizeof sc->assoc, 0);
956 }
957 
958 
959 static int
960 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg __unused)
961 {
962 	struct iwi_softc *sc = ic->ic_softc;
963 
964 	switch (nstate) {
965 	case IEEE80211_S_SCAN:
966 		if ( sc->flags & IWI_FLAG_ASSOCIATED ) {
967 			sc->flags &= ~( IWI_FLAG_ASSOCIATED );
968 			iwi_disassociate(sc);
969 			(void) tsleep( IWI_FW_DEASSOCIATED(sc),
970 					0, "iwisca", hz );
971 
972 		}
973 		if ( !(sc->flags & IWI_FLAG_SCANNING) &&
974 		     !(sc->flags & IWI_FLAG_RF_DISABLED) ) {
975 			iwi_scan(sc);
976 		}
977 		break;
978 
979 	case IEEE80211_S_AUTH:
980 		if ( sc->flags & IWI_FLAG_ASSOCIATED ) {
981 			sc->flags &= ~( IWI_FLAG_ASSOCIATED );
982 			iwi_disassociate(sc);
983 			(void) tsleep( IWI_FW_DEASSOCIATED(sc), 0,
984 				       "iwiaut", hz );
985 
986 		}
987 		if ( iwi_auth_and_assoc(sc) != 0 )
988 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
989 		break;
990 
991 	case IEEE80211_S_RUN:
992 		if (sc->flags & IWI_FLAG_SCAN_COMPLETE) {
993 			sc->flags &= ~(IWI_FLAG_SCAN_COMPLETE);
994 			if (ic->ic_opmode == IEEE80211_M_IBSS ||
995 			    ic->ic_opmode == IEEE80211_M_MONITOR ) {
996 				/*
997 				 * In IBSS mode, following an end_scan
998 				 * the ieee80211 stack state machine transitions
999 				 * straight to 'run' state. This is out of
1000 				 * step with the firmware which requires
1001 				 * an association first. Flip our state from
1002 				 * RUN back to AUTH to allow us to tell the
1003 				 * firmware to associate.
1004 				 */
1005 				ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
1006 			}
1007 		}
1008 		break;
1009 
1010 	case IEEE80211_S_ASSOC:
1011 		break;
1012 	case IEEE80211_S_INIT:
1013 		sc->flags &= ~( IWI_FLAG_SCANNING | IWI_FLAG_ASSOCIATED );
1014 		break;
1015 	}
1016 
1017 	ic->ic_state = nstate;
1018 	return 0;
1019 }
1020 
1021 /*
1022  * Read 16 bits at address 'addr' from the serial EEPROM.
1023  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
1024  */
1025 static u_int16_t
1026 iwi_read_prom_word(struct iwi_softc *sc, u_int8_t addr)
1027 {
1028 	u_int32_t tmp;
1029 	u_int16_t val;
1030 	int n;
1031 
1032 	/* Clock C once before the first command */
1033 	IWI_EEPROM_CTL(sc, 0);
1034 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1035 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1036 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1037 
1038 	/* Write start bit (1) */
1039 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1040 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1041 
1042 	/* Write READ opcode (10) */
1043 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1044 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1045 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1046 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1047 
1048 	/* Write address A7-A0 */
1049 	for (n = 7; n >= 0; n--) {
1050 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1051 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
1052 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1053 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
1054 	}
1055 
1056 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1057 
1058 	/* Read data Q15-Q0 */
1059 	val = 0;
1060 	for (n = 15; n >= 0; n--) {
1061 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1062 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1063 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
1064 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
1065 	}
1066 
1067 	IWI_EEPROM_CTL(sc, 0);
1068 
1069 	/* Clear Chip Select and clock C */
1070 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1071 	IWI_EEPROM_CTL(sc, 0);
1072 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
1073 
1074 	return be16toh(val);
1075 }
1076 
1077 /*
1078  * XXX: Hack to set the current channel to the value advertised in beacons or
1079  * probe responses. Only used during AP detection.
1080  */
1081 static void
1082 iwi_fix_channel(struct iwi_softc *sc, struct mbuf *m)
1083 {
1084 	struct ieee80211com *ic = &sc->sc_ic;
1085 	struct ieee80211_frame *wh;
1086 	u_int8_t subtype;
1087 	u_int8_t *frm, *efrm;
1088 
1089 	wh = mtod(m, struct ieee80211_frame *);
1090 
1091 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
1092 		return;
1093 
1094 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1095 
1096 	if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
1097 	    subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1098 		return;
1099 
1100 	/*
1101 	 * Cache station entries from beacons and probes.
1102 	 */
1103 	if ( iwi_find_station(sc, wh->i_addr2) == 0xff )
1104 		iwi_cache_station(sc, wh->i_addr2);
1105 
1106 	frm = (u_int8_t *)(wh + 1);
1107 	efrm = mtod(m, u_int8_t *) + m->m_len;
1108 
1109 	frm += 12;	/* skip tstamp, bintval and capinfo fields */
1110 #if 0
1111 	{ /* XXX - debugging code */
1112 		u_int8_t *ptr;
1113 		u_int32_t cnt;
1114 		printf("Frame -->");
1115 		for ( ptr = frm, cnt = 0 ; ptr < efrm ; ptr++, cnt++ ) {
1116 			if ( cnt % 8 == 0 )
1117 				printf("\n");
1118 			printf("0x%-2.2x ", *ptr);
1119 		}
1120 		printf("<-- End Frame\n");
1121 	}
1122 #endif
1123 
1124 	while (frm < efrm) {
1125 		if (*frm == IEEE80211_ELEMID_DSPARMS)
1126 #if IEEE80211_CHAN_MAX < 255
1127 		if (frm[2] <= IEEE80211_CHAN_MAX)
1128 #endif
1129 			ic->ic_bss->ni_chan = &ic->ic_channels[frm[2]];
1130 
1131 		frm += frm[1] + 2; /* advance to the next tag */
1132 	}
1133 }
1134 
1135 static void
1136 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_buf *buf, int i,
1137     struct iwi_frame *frame)
1138 {
1139 	struct ieee80211com *ic = &sc->sc_ic;
1140 	struct ifnet *ifp = &ic->ic_if;
1141 	struct mbuf *m;
1142 	struct ieee80211_frame *wh;
1143 	struct ieee80211_node *ni;
1144 	int error;
1145 
1146 	DPRINTFN(5, ("RX!DATA!%u!%u!%u\n", le16toh(frame->len), frame->chan,
1147 	    frame->rssi_dbm));
1148 
1149 	if (le16toh(frame->len) < sizeof (struct ieee80211_frame_min) ||
1150 	    le16toh(frame->len) > MCLBYTES) {
1151 		device_printf(sc->sc_dev, "bad frame length\n");
1152 		return;
1153 	}
1154 
1155 	bus_dmamap_unload(sc->rx_buf_dmat, buf->map);
1156 
1157 	/* Finalize mbuf */
1158 	m = buf->m;
1159 	m->m_pkthdr.rcvif = ifp;
1160 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
1161 	    sizeof (struct iwi_frame) + le16toh(frame->len);
1162 
1163 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
1164 
1165 	wh = mtod(m, struct ieee80211_frame *);
1166 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1167 		/*
1168 		 * Hardware decrypts the frame itself but leaves the WEP bit
1169 		 * set in the 802.11 header and don't remove the iv and crc
1170 		 * fields
1171 		 */
1172 		wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1173 		bcopy(wh, (char *)wh + IEEE80211_WEP_IVLEN +
1174 		    IEEE80211_WEP_KIDLEN, sizeof (struct ieee80211_frame));
1175 		m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1176 		m_adj(m, -IEEE80211_WEP_CRCLEN);
1177 		wh = mtod(m, struct ieee80211_frame *);
1178 	}
1179 
1180 	if (sc->sc_drvbpf != NULL) {
1181 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
1182 
1183 		tap->wr_flags = 0;
1184 		tap->wr_rate = frame->rate;
1185 		tap->wr_chan_freq =
1186 		    htole16(ic->ic_channels[frame->chan].ic_freq);
1187 		tap->wr_chan_flags =
1188 		    htole16(ic->ic_channels[frame->chan].ic_flags);
1189 		tap->wr_antsignal = frame->signal;
1190 		tap->wr_antnoise = frame->noise;
1191 		tap->wr_antenna = frame->antenna;
1192 
1193 		bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1194 	}
1195 
1196 	if (ic->ic_state == IEEE80211_S_SCAN)
1197 		iwi_fix_channel(sc, m);
1198 
1199 	if (ic->ic_opmode != IEEE80211_M_STA) {
1200 		ni = ieee80211_find_node(ic, wh->i_addr2);
1201 		if (ni == NULL)
1202 			ni = ieee80211_ref_node(ic->ic_bss);
1203 	} else
1204 		ni = ieee80211_ref_node(ic->ic_bss);
1205 
1206 	/* Send the frame to the upper layer */
1207 	ieee80211_input(ifp, m, ni, IWI_RSSIDBM2RAW(frame->rssi_dbm), 0);
1208 
1209 	if (ni == ic->ic_bss)
1210 		ieee80211_unref_node(&ni);
1211 	else
1212 		ieee80211_free_node(ic, ni);
1213 
1214 	buf->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1215 	if (buf->m == NULL) {
1216 		device_printf(sc->sc_dev, "could not allocate rx mbuf\n");
1217 		return;
1218 	}
1219 
1220 	error = bus_dmamap_load(sc->rx_buf_dmat, buf->map, mtod(buf->m, void *),
1221 	    MCLBYTES, iwi_dma_map_addr, &buf->physaddr, 0);
1222 	if (error != 0) {
1223 		device_printf(sc->sc_dev, "could not load rx buf DMA map\n");
1224 		m_freem(buf->m);
1225 		buf->m = NULL;
1226 		return;
1227 	}
1228 
1229 	CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4, buf->physaddr);
1230 }
1231 
1232 static void
1233 iwi_notification_intr(struct iwi_softc *sc, struct iwi_notif *notif)
1234 {
1235 	struct ieee80211com *ic = &sc->sc_ic;
1236 	struct ifnet *ifp = &ic->ic_if;
1237 	struct iwi_notif_scan_channel *chan;
1238 	struct iwi_notif_scan_complete *scan;
1239 	struct iwi_notif_authentication *auth;
1240 	struct iwi_notif_association *assoc;
1241 
1242 	switch (notif->type) {
1243 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
1244 		chan = (struct iwi_notif_scan_channel *)(notif + 1);
1245 
1246 		DPRINTFN(2, ("Scan channel (%u)\n", chan->nchan));
1247 		break;
1248 
1249 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
1250 		scan = (struct iwi_notif_scan_complete *)(notif + 1);
1251 
1252 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
1253 		    scan->status));
1254 
1255 		sc->flags &= ~(IWI_FLAG_SCANNING);
1256 		sc->flags |= IWI_FLAG_SCAN_COMPLETE;
1257 
1258 		if ( sc->flags & IWI_FLAG_SCAN_ABORT ) {
1259 			sc->flags &= ~(IWI_FLAG_SCAN_ABORT);
1260 			wakeup(IWI_FW_SCAN_COMPLETED(sc));
1261 		} else {
1262 			ieee80211_end_scan(ifp);
1263 			wakeup(IWI_FW_SCAN_COMPLETED(sc));
1264 		}
1265 		break;
1266 
1267 	case IWI_NOTIF_TYPE_AUTHENTICATION:
1268 		auth = (struct iwi_notif_authentication *)(notif + 1);
1269 
1270 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1271 
1272 		switch (auth->state) {
1273 		case IWI_AUTHENTICATED:
1274 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1275 			break;
1276 
1277 		case IWI_DEAUTHENTICATED:
1278 			ieee80211_begin_scan(ifp);/* not necessary */
1279 			break;
1280 
1281 		default:
1282 			device_printf(sc->sc_dev,
1283 			    "unknown authentication state %u\n", auth->state);
1284 		}
1285 		break;
1286 
1287 	case IWI_NOTIF_TYPE_ASSOCIATION:
1288 		assoc = (struct iwi_notif_association *)(notif + 1);
1289 
1290 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1291 		    assoc->status));
1292 
1293 		switch (assoc->state) {
1294 		case IWI_ASSOCIATED:
1295 			sc->flags |= IWI_FLAG_ASSOCIATED;
1296 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1297 			break;
1298 
1299 		case IWI_DEASSOCIATED:
1300 			sc->flags &= ~(IWI_FLAG_ASSOCIATED);
1301 			wakeup(IWI_FW_DEASSOCIATED(sc));
1302 			ieee80211_begin_scan(ifp);/* probably not necessary */
1303 			break;
1304 
1305 		default:
1306 			device_printf(sc->sc_dev,
1307 			    "unknown association state %u\n", assoc->state);
1308 		}
1309 		break;
1310 
1311 	case IWI_NOTIF_TYPE_CALIBRATION:
1312 		DPRINTFN(5, ("Notification calib (%u)\n", notif->type));
1313 		break;
1314 	case IWI_NOTIF_TYPE_BEACON:
1315 		DPRINTFN(5, ("Notification beacon (%u)\n", notif->type));
1316 		break;
1317 	case IWI_NOTIF_TYPE_NOISE:
1318 		DPRINTFN(5, ("Notification noise (%u)\n", notif->type));
1319 		break;
1320 
1321 	default:
1322 		device_printf(sc->sc_dev, "unknown notification type %u\n",
1323 		    notif->type);
1324 	}
1325 }
1326 
1327 static void
1328 iwi_rx_intr(struct iwi_softc *sc)
1329 {
1330 	struct iwi_rx_buf *buf;
1331 	struct iwi_hdr *hdr;
1332 	u_int32_t r, i;
1333 
1334 	r = CSR_READ_4(sc, IWI_CSR_RX_READ_INDEX);
1335 
1336 	for (i = (sc->rx_cur + 1) % IWI_RX_RING_SIZE; i != r;
1337 	     i = (i + 1) % IWI_RX_RING_SIZE) {
1338 
1339 		buf = &sc->rx_buf[i];
1340 
1341 		bus_dmamap_sync(sc->rx_buf_dmat, buf->map,
1342 		    BUS_DMASYNC_POSTREAD);
1343 
1344 		hdr = mtod(buf->m, struct iwi_hdr *);
1345 
1346 		switch (hdr->type) {
1347 		case IWI_HDR_TYPE_FRAME:
1348 			iwi_frame_intr(sc, buf, i,
1349 			    (struct iwi_frame *)(hdr + 1));
1350 			break;
1351 
1352 		case IWI_HDR_TYPE_NOTIF:
1353 			iwi_notification_intr(sc,
1354 			    (struct iwi_notif *)(hdr + 1));
1355 			break;
1356 
1357 		default:
1358 			device_printf(sc->sc_dev, "unknown hdr type %u\n",
1359 			    hdr->type);
1360 		}
1361 	}
1362 
1363 	/* Tell the firmware what we have processed */
1364 	sc->rx_cur = (r == 0) ? IWI_RX_RING_SIZE - 1 : r - 1;
1365 	CSR_WRITE_4(sc, IWI_CSR_RX_WRITE_INDEX, sc->rx_cur);
1366 }
1367 
1368 static void
1369 iwi_tx_intr(struct iwi_softc *sc)
1370 {
1371 	struct ieee80211com *ic = &sc->sc_ic;
1372 	struct ifnet *ifp = &ic->ic_if;
1373 	struct iwi_tx_buf *buf;
1374 	u_int32_t r, i;
1375 
1376 	r = CSR_READ_4(sc, IWI_CSR_TX1_READ_INDEX);
1377 #if  notyet
1378 	bus_dmamap_sync(sc->tx_ring_dmat, sc->tx_ring_map, BUS_DMASYNC_POSTWRITE);
1379 #endif
1380 
1381 	for (i = (sc->tx_old + 1) % IWI_TX_RING_SIZE; i != r;
1382 	     i = (i + 1) % IWI_TX_RING_SIZE) {
1383 
1384 		buf = &sc->tx_buf[i];
1385 
1386 		bus_dmamap_sync(sc->tx_buf_dmat, buf->map,
1387 		    BUS_DMASYNC_POSTWRITE);
1388 		bus_dmamap_unload(sc->tx_buf_dmat, buf->map);
1389 		m_freem(buf->m);
1390 		buf->m = NULL;
1391 		if (buf->ni != ic->ic_bss)
1392 			ieee80211_free_node(ic, buf->ni);
1393 		buf->ni = NULL;
1394 
1395 		sc->tx_queued--;
1396 
1397 		/* kill watchdog timer */
1398 		sc->sc_tx_timer = 0;
1399 	}
1400 
1401 	/* Remember what the firmware has processed */
1402 	sc->tx_old = (r == 0) ? IWI_TX_RING_SIZE - 1 : r - 1;
1403 
1404 	/* Call start() since some buffer descriptors have been released */
1405 	ifp->if_flags &= ~IFF_OACTIVE;
1406 	(*ifp->if_start)(ifp);
1407 }
1408 
1409 static void
1410 iwi_intr(void *arg)
1411 {
1412 	struct iwi_softc *sc = arg;
1413 	struct ieee80211com *ic = &sc->sc_ic;
1414 	struct ifnet *ifp = &ic->ic_if;
1415 	u_int32_t r;
1416 	IWI_LOCK_INFO;
1417 	IWI_IPLLOCK_INFO;
1418 
1419 	IWI_IPLLOCK(sc);
1420 
1421 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff) {
1422 		IWI_IPLUNLOCK(sc);
1423 		return;
1424 	}
1425 
1426 	/* Disable interrupts */
1427 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1428 
1429 	DPRINTFN(8, ("INTR!0x%08x\n", r));
1430 
1431 	sc->flags &= ~(IWI_FLAG_RF_DISABLED);
1432 
1433 	if ( r & IWI_INTR_FATAL_ERROR ) {
1434 		if ( !(sc->flags & (IWI_FLAG_RESET | IWI_FLAG_EXIT))) {
1435 			sc->flags |= IWI_FLAG_RESET;
1436 			wakeup(IWI_FW_WAKE_MONITOR(sc));
1437 		}
1438 	}
1439 
1440 	if (r & IWI_INTR_PARITY_ERROR) {
1441 			device_printf(sc->sc_dev, "fatal error\n");
1442 			sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1443 			IWI_LOCK(sc);
1444 			iwi_stop(sc);
1445 			IWI_UNLOCK(sc);
1446 	}
1447 
1448 	if (r & IWI_INTR_FW_INITED) {
1449 		if (!(r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)))
1450 			wakeup(IWI_FW_INITIALIZED(sc));
1451 	}
1452 
1453 	if (r & IWI_INTR_RADIO_OFF) {
1454 		DPRINTF(("radio transmitter off\n"));
1455 		sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1456 		IWI_LOCK(sc);
1457 		iwi_stop(sc);
1458 		IWI_UNLOCK(sc);
1459 		sc->flags |= IWI_FLAG_RF_DISABLED;
1460 	}
1461 
1462 	if (r & IWI_INTR_RX_TRANSFER)
1463 		iwi_rx_intr(sc);
1464 
1465 	if (r & IWI_INTR_CMD_TRANSFER)
1466 		wakeup(IWI_FW_CMD_ACKED(sc));
1467 
1468 	if (r & IWI_INTR_TX1_TRANSFER)
1469 		iwi_tx_intr(sc);
1470 
1471 	if (r & ~(IWI_HANDLED_INTR_MASK))
1472 		device_printf(sc->sc_dev,
1473 			      "unhandled interrupt(s) INTR!0x%08x\n",
1474 			      r & ~(IWI_HANDLED_INTR_MASK));
1475 
1476 	/* Acknowledge interrupts */
1477 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1478 
1479 	/* Re-enable interrupts */
1480 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1481 
1482 	IWI_IPLUNLOCK(sc);
1483 
1484 	if ((ifp->if_flags & IFF_RUNNING) && !ifq_is_empty(&ifp->if_snd))
1485 		iwi_start(ifp);
1486 }
1487 
1488 struct iwi_dma_mapping {
1489 	bus_dma_segment_t segs[IWI_MAX_NSEG];
1490 	int nseg;
1491 	bus_size_t mapsize;
1492 };
1493 
1494 static void
1495 iwi_dma_map_buf(void *arg, bus_dma_segment_t *segs, int nseg,
1496     bus_size_t mapsize, int error)
1497 {
1498 	struct iwi_dma_mapping *map = arg;
1499 
1500 	if (error != 0)
1501 		return;
1502 
1503 	KASSERT(nseg <= IWI_MAX_NSEG, ("too many DMA segments %d", nseg));
1504 
1505 	bcopy(segs, map->segs, nseg * sizeof (bus_dma_segment_t));
1506 	map->nseg = nseg;
1507 	map->mapsize = mapsize;
1508 }
1509 
1510 static void
1511 iwi_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg __unused, int error)
1512 {
1513 	if (error != 0) {
1514 		printf("iwi: fatal DMA mapping error !!!\n");
1515 		return;
1516 	}
1517 
1518 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
1519 
1520 	*(bus_addr_t *)arg = segs[0].ds_addr;
1521 }
1522 
1523 static int
1524 iwi_cmd(struct iwi_softc *sc, u_int8_t type, void *data, u_int8_t len,
1525     int async)
1526 {
1527 	struct iwi_cmd_desc *desc;
1528 
1529 	DPRINTFN(2, ("TX!CMD!%u!%u\n", type, len));
1530 
1531 	desc = &sc->cmd_desc[sc->cmd_cur];
1532 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1533 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1534 	desc->type = type;
1535 	desc->len = len;
1536 	bcopy(data, desc->data, len);
1537 
1538 	bus_dmamap_sync(sc->cmd_ring_dmat, sc->cmd_ring_map,
1539 	    BUS_DMASYNC_PREWRITE);
1540 
1541 	sc->cmd_cur = (sc->cmd_cur + 1) % IWI_CMD_RING_SIZE;
1542 	CSR_WRITE_4(sc, IWI_CSR_CMD_WRITE_INDEX, sc->cmd_cur);
1543 
1544 	return async ? 0 : tsleep( IWI_FW_CMD_ACKED(sc), 0, "iwicmd", hz);
1545 }
1546 
1547 static int
1548 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1549 {
1550 	struct iwi_softc *sc = ifp->if_softc;
1551 	struct ieee80211com *ic = &sc->sc_ic;
1552 	struct ieee80211_frame *wh;
1553 	struct iwi_tx_buf *buf;
1554 	struct iwi_tx_desc *desc;
1555 	struct iwi_dma_mapping map;
1556 	struct mbuf *mnew;
1557 	u_int32_t id = 0;
1558 	int error, i;
1559 	IWI_IPLLOCK_INFO; /* XXX still need old ipl locking mech. here */
1560 	IWI_IPLLOCK(sc);
1561 
1562 	if (sc->sc_drvbpf != NULL) {
1563 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1564 
1565 		tap->wt_flags = 0;
1566 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1567 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1568 
1569 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1570 	}
1571 
1572 	buf = &sc->tx_buf[sc->tx_cur];
1573 	desc = &sc->tx_desc[sc->tx_cur];
1574 
1575 	wh = mtod(m0, struct ieee80211_frame *);
1576 
1577 	if ( (id = iwi_find_station( sc, wh->i_addr1 ) ) == 0xff )
1578 		id = iwi_cache_station( sc, wh->i_addr1 );
1579 
1580 	bzero( desc, sizeof (struct iwi_tx_desc) );
1581 	desc->station_number = id;
1582 
1583 	/* trim IEEE802.11 header */
1584 	m_adj(m0, sizeof (struct ieee80211_frame));
1585 
1586 	error = bus_dmamap_load_mbuf(sc->tx_buf_dmat, buf->map, m0,
1587 	    iwi_dma_map_buf, &map, BUS_DMA_NOWAIT);
1588 	if (error != 0 && error != EFBIG) {
1589 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1590 		    error);
1591 		m_freem(m0);
1592 		IWI_IPLUNLOCK(sc);
1593 		return error;
1594 	}
1595 	if (error != 0) {
1596 		mnew = m_defrag(m0, MB_DONTWAIT);
1597 		if (mnew == NULL) {
1598 			device_printf(sc->sc_dev,
1599 			    "could not defragment mbuf\n");
1600 			m_freem(m0);
1601 			IWI_IPLUNLOCK(sc);
1602 			return ENOBUFS;
1603 		}
1604 		m0 = mnew;
1605 
1606 		error = bus_dmamap_load_mbuf(sc->tx_buf_dmat, buf->map, m0,
1607 		    iwi_dma_map_buf, &map, BUS_DMA_NOWAIT);
1608 		if (error != 0) {
1609 			device_printf(sc->sc_dev,
1610 			    "could not map mbuf (error %d)\n", error);
1611 			m_freem(m0);
1612 			IWI_IPLUNLOCK(sc);
1613 			return error;
1614 		}
1615 	}
1616 
1617 	buf->m = m0;
1618 	buf->ni = ni;
1619 
1620 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1621 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1622 	desc->cmd = IWI_DATA_CMD_TX;
1623 	desc->len = htole16(m0->m_pkthdr.len);
1624 	desc->flags = 0;
1625 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1626 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
1627 			desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1628 	} else if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
1629 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1630 
1631 	if (ic->ic_flags & IEEE80211_F_WEPON) {
1632 		wh->i_fc[1] |= IEEE80211_FC1_WEP;
1633 		desc->wep_txkey = ic->ic_wep_txkey;
1634 	} else
1635 		desc->flags |= IWI_DATA_FLAG_NO_WEP;
1636 
1637 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1638 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1639 
1640 	bcopy(wh, &desc->wh, sizeof (struct ieee80211_frame));
1641 	desc->nseg = htole32(map.nseg);
1642 	for (i = 0; i < map.nseg; i++) {
1643 		desc->seg_addr[i] = htole32(map.segs[i].ds_addr);
1644 		desc->seg_len[i]  = htole32(map.segs[i].ds_len);
1645 	}
1646 
1647 	bus_dmamap_sync(sc->tx_buf_dmat, buf->map, BUS_DMASYNC_PREWRITE);
1648 	bus_dmamap_sync(sc->tx_ring_dmat, sc->tx_ring_map,
1649 	    BUS_DMASYNC_PREWRITE);
1650 
1651 	DPRINTFN(5, ("TX!DATA!%u!%u\n", desc->len, desc->nseg));
1652 
1653 	/* Inform firmware about this new packet */
1654 	sc->tx_queued++;
1655 	sc->tx_cur = (sc->tx_cur + 1) % IWI_TX_RING_SIZE;
1656 	CSR_WRITE_4(sc, IWI_CSR_TX1_WRITE_INDEX, sc->tx_cur);
1657 
1658 	IWI_IPLUNLOCK(sc);
1659 	return 0;
1660 }
1661 
1662 static void
1663 iwi_start(struct ifnet *ifp)
1664 {
1665 	struct iwi_softc *sc = ifp->if_softc;
1666 	struct ieee80211com *ic = &sc->sc_ic;
1667 	struct mbuf *m0;
1668 	struct ieee80211_node *ni;
1669 
1670 	if (ic->ic_state != IEEE80211_S_RUN) {
1671 		return;
1672 	}
1673 
1674 	for (;;) {
1675 		m0 = ifq_poll(&ifp->if_snd);
1676 		if (m0 == NULL)
1677 			break;
1678 
1679 		if (sc->tx_queued >= IWI_TX_RING_SIZE - 4) {
1680 			ifp->if_flags |= IFF_OACTIVE;
1681 			break;
1682 		}
1683 
1684 		m0 = ifq_dequeue(&ifp->if_snd);
1685 
1686 		BPF_MTAP(ifp, m0);
1687 
1688 		m0 = ieee80211_encap(ifp, m0, &ni);
1689 		if (m0 == NULL)
1690 			continue;
1691 
1692 		if (ic->ic_rawbpf != NULL)
1693 			bpf_mtap(ic->ic_rawbpf, m0);
1694 
1695 		if (iwi_tx_start(ifp, m0, ni) != 0) {
1696 			if (ni != NULL && ni != ic->ic_bss)
1697 				ieee80211_free_node(ic, ni);
1698 			break;
1699 		}
1700 
1701 		/* start watchdog timer */
1702 		sc->sc_tx_timer = 5;
1703 		ifp->if_timer = 1;
1704 	}
1705 
1706 }
1707 
1708 static void
1709 iwi_watchdog(struct ifnet *ifp)
1710 {
1711 	struct iwi_softc *sc = ifp->if_softc;
1712 
1713 	ifp->if_timer = 0;
1714 
1715 	if (sc->sc_tx_timer > 0) {
1716 		if (--sc->sc_tx_timer == 0) {
1717 			if_printf(ifp, "device timeout\n");
1718 			wakeup(IWI_FW_WAKE_MONITOR(sc));
1719 			return;
1720 		}
1721 		ifp->if_timer = 1;
1722 	}
1723 
1724 	ieee80211_watchdog(ifp);
1725 }
1726 
1727 
1728 static int
1729 iwi_wi_ioctl_get(struct ifnet *ifp, caddr_t data)
1730 {
1731 	struct wi_req		wreq;
1732 	struct ifreq		*ifr;
1733 	struct iwi_softc	*sc;
1734 	int			error;
1735 
1736 	sc = ifp->if_softc;
1737 	ifr = (struct ifreq *)data;
1738 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1739 	if (error)
1740 		return (error);
1741 
1742 	switch (wreq.wi_type) {
1743 	case WI_RID_READ_APS:
1744 		ieee80211_begin_scan(ifp);
1745 		(void) tsleep(IWI_FW_SCAN_COMPLETED(sc),
1746 			PCATCH, "ssidscan", hz * 2);
1747 		ieee80211_end_scan(ifp);
1748 		break;
1749 	default:
1750 		error = ENOTTY;
1751 		break;
1752 	}
1753 	return (error);
1754 }
1755 
1756 
1757 
1758 
1759 static int
1760 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1761 {
1762 	struct iwi_softc *sc = ifp->if_softc;
1763 	struct ifreq *ifr;
1764 	struct ieee80211req *ireq;
1765 	struct ifaddr *ifa;
1766 	int error = 0;
1767 	IWI_LOCK_INFO;
1768 
1769 	IWI_LOCK(sc);
1770 
1771 	switch (cmd) {
1772        case SIOCSIFADDR:
1773 		/*
1774 		 * Handle this here instead of in net80211_ioctl.c
1775 		 * so that we can lock (IWI_LOCK) the call to
1776 		 * iwi_init().
1777 		 */
1778 		ifa = (struct ifaddr *) data;
1779 		switch (ifa->ifa_addr->sa_family) {
1780 #ifdef INET
1781 		case AF_INET:
1782 			if ((ifp->if_flags & IFF_UP) == 0) {
1783 				ifp->if_flags |= IFF_UP;
1784 				ifp->if_init(ifp->if_softc);
1785 			}
1786 			arp_ifinit(ifp, ifa);
1787 			break;
1788 #endif
1789 #ifdef IPX
1790 #warning "IPX support has not been tested"
1791 		/*
1792 		 * XXX - This code is probably wrong,
1793 		 *       but has been copied many times.
1794 		 */
1795 		case AF_IPX: {
1796 			struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
1797 			struct arpcom *ac = (struct arpcom *)ifp;
1798 
1799 			if (ipx_nullhost(*ina))
1800 				ina->x_host = *(union ipx_host *) ac->ac_enaddr;
1801 			else
1802 				bcopy((caddr_t) ina->x_host.c_host,
1803 				      (caddr_t) ac->ac_enaddr,
1804 				      sizeof(ac->ac_enaddr));
1805 			/* fall thru... */
1806 		}
1807 #endif
1808 		default:
1809 			if ((ifp->if_flags & IFF_UP) == 0) {
1810 				ifp->if_flags |= IFF_UP;
1811 				ifp->if_init(ifp->if_softc);
1812 			}
1813 			break;
1814 		}
1815 		break;
1816 
1817 	case SIOCSIFFLAGS:
1818 		if (ifp->if_flags & IFF_UP) {
1819 			if (!(ifp->if_flags & IFF_RUNNING)) {
1820 				iwi_init(sc);
1821 				error = tsleep(IWI_FW_CMD_ACKED(sc), 0,
1822 						 "iwirun", hz);
1823 			}
1824 		} else {
1825 			if (ifp->if_flags & IFF_RUNNING) {
1826 				iwi_stop(sc);
1827 			}
1828 		}
1829 		break;
1830 
1831 	case SIOCSLOADFW:
1832 	case SIOCSLOADIBSSFW:
1833 		/* only super-user can do that! */
1834 		if ((error = suser(curthread)) != 0)
1835 			break;
1836 
1837 		ifr = (struct ifreq *)data;
1838 		error = iwi_cache_firmware(sc, ifr->ifr_data,
1839 				(cmd == SIOCSLOADIBSSFW) ? 1 : 0);
1840 		break;
1841 
1842 	case SIOCSKILLFW:
1843 		/* only super-user can do that! */
1844 		if ((error = suser(curthread)) != 0)
1845 			break;
1846 
1847 		ifp->if_flags &= ~IFF_UP;
1848 		iwi_stop(sc);
1849 		iwi_free_firmware(sc);
1850 		break;
1851 
1852 	case SIOCG80211:
1853 		ireq = (struct ieee80211req *)data;
1854 		switch (ireq->i_type) {
1855 		case IEEE80211_IOC_AUTHMODE:
1856 			ireq->i_val = sc->authmode;
1857 			break;
1858 
1859 		default:
1860 			error = ieee80211_ioctl(ifp, cmd, data, cr);
1861 		}
1862 		break;
1863 
1864 	case SIOCS80211:
1865 		/* only super-user can do that! */
1866 		if ((error = suser(curthread)) != 0)
1867 			break;
1868 
1869 		ireq = (struct ieee80211req *)data;
1870 		switch (ireq->i_type) {
1871 		case IEEE80211_IOC_AUTHMODE:
1872 			sc->authmode = ireq->i_val;
1873 			break;
1874 
1875 		default:
1876 			error = ieee80211_ioctl(ifp, cmd, data, cr);
1877 		}
1878 		break;
1879 	case SIOCGIFGENERIC:
1880 		if (sc->flags & IWI_FLAG_FW_INITED) {
1881 			error = iwi_wi_ioctl_get(ifp, data);
1882 			if (! error)
1883 				error = ieee80211_ioctl(ifp, cmd, data, cr);
1884 		} else
1885 			error = ENOTTY;
1886 		if (error != ENOTTY)
1887 			break;
1888 
1889 	default:
1890 		error = ieee80211_ioctl(ifp, cmd, data, cr);
1891 	}
1892 
1893 	if (error == ENETRESET) {
1894 		error = 0;
1895 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1896 		    (IFF_UP | IFF_RUNNING)) {
1897 			iwi_init(sc);
1898 			error = tsleep(IWI_FW_CMD_ACKED(sc), 0, "iwirun", hz);
1899 		}
1900 	}
1901 
1902 	IWI_UNLOCK(sc);
1903 
1904 	return error;
1905 }
1906 
1907 static int
1908 iwi_abort_scan( struct iwi_softc *sc  )
1909 {
1910 	sc->flags |= IWI_FLAG_SCAN_ABORT;
1911 	return iwi_cmd(sc, IWI_CMD_SCAN_ABORT, NULL, 0, 1);
1912 }
1913 
1914 static void
1915 iwi_stop_master(struct iwi_softc *sc)
1916 {
1917 	int ntries;
1918 
1919 	/*
1920 	 * If the master is busy scanning, we will occasionally
1921 	 * timeout waiting for it (the master) to stop. Make the
1922 	 * 'stopping' process more robust by ceasing all scans
1923 	 * prior to asking for the stop.
1924 	 */
1925 	if ( ( sc->flags & IWI_FLAG_SCANNING ) &&
1926 	     !( sc->flags & IWI_FLAG_RF_DISABLED ) ) {
1927 		iwi_abort_scan(sc);
1928 		if (( sc->flags & IWI_FLAG_SCAN_ABORT ) &&
1929 		    !( sc->flags & IWI_FLAG_RF_DISABLED )) {
1930 			(void) tsleep(IWI_FW_SCAN_COMPLETED(sc), 0,
1931 					 "iwiabr", hz);
1932 		}
1933 	}
1934 	/* Disable interrupts */
1935 
1936 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1937 
1938 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1939 	for (ntries = 0; ntries < 5; ntries++) {
1940 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1941 			break;
1942 		DELAY(10);
1943 	}
1944 	if (ntries == 5 && sc->debug_level > 0)
1945 		device_printf(sc->sc_dev, "timeout waiting for master\n");
1946 
1947 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1948 	    IWI_RST_PRINCETON_RESET);
1949 
1950 	sc->flags &= ~IWI_FLAG_FW_INITED;
1951 }
1952 
1953 static int
1954 iwi_reset(struct iwi_softc *sc)
1955 {
1956 	int i, ntries;
1957 
1958 	iwi_stop_master(sc);
1959 
1960 	/* Move adapter to D0 state */
1961 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
1962 	    IWI_CTL_INIT);
1963 
1964 	/* Initialize Phase-Locked Level  (PLL) */
1965 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
1966 
1967 	/* Wait for clock stabilization */
1968 	for (ntries = 0; ntries < 1000; ntries++) {
1969 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
1970 			break;
1971 		DELAY(200);
1972 	}
1973 	if (ntries == 1000) {
1974 		return EIO;
1975 	}
1976 
1977 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1978 	    IWI_RST_SW_RESET);
1979 
1980 	DELAY(10);
1981 
1982 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
1983 	    IWI_CTL_INIT);
1984 
1985 
1986 	/* Clear NIC memory */
1987 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
1988 
1989 	for (i = 0; i < 0xc000; i++) {
1990 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1991 	}
1992 
1993 	sc->num_stations = 0;
1994 	return 0;
1995 }
1996 
1997 static int
1998 iwi_load_ucode(struct iwi_softc *sc, void *uc, int size)
1999 {
2000 	u_int16_t *w;
2001 	int ntries, i;
2002 
2003 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
2004 	    IWI_RST_STOP_MASTER);
2005 	for (ntries = 0; ntries < 5; ntries++) {
2006 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
2007 			break;
2008 		DELAY(10);
2009 	}
2010 	if (ntries == 5) {
2011 		device_printf(sc->sc_dev, "timeout waiting for master\n");
2012 		return EIO;
2013 	}
2014 
2015 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
2016 	DELAY(5000);
2017 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2018 	    ~IWI_RST_PRINCETON_RESET);
2019 	DELAY(5000);
2020 	MEM_WRITE_4(sc, 0x3000e0, 0);
2021 	DELAY(1000);
2022 	MEM_WRITE_4(sc, 0x300004, 1);
2023 	DELAY(1000);
2024 	MEM_WRITE_4(sc, 0x300004, 0);
2025 	DELAY(1000);
2026 	MEM_WRITE_1(sc, 0x200000, 0x00);
2027 	MEM_WRITE_1(sc, 0x200000, 0x40);
2028 	DELAY(1000);
2029 
2030 	/* Adapter is buggy, we must set the address for each word */
2031 	for (w = uc; size > 0; w++, size -= 2)
2032 		MEM_WRITE_2(sc, 0x200010, *w);
2033 
2034 	MEM_WRITE_1(sc, 0x200000, 0x00);
2035 	MEM_WRITE_1(sc, 0x200000, 0x80);
2036 
2037 	/* Wait until we get a response in the uc queue */
2038 	for (ntries = 0; ntries < 100; ntries++) {
2039 		if (MEM_READ_1(sc, 0x200000) & 1)
2040 			break;
2041 		DELAY(100);
2042 	}
2043 	if (ntries == 100) {
2044 		device_printf(sc->sc_dev,
2045 		    "timeout waiting for ucode to initialize\n");
2046 		return EIO;
2047 	}
2048 
2049 	/* Empty the uc queue or the firmware will not initialize properly */
2050 	for (i = 0; i < 7; i++)
2051 		MEM_READ_4(sc, 0x200004);
2052 
2053 	MEM_WRITE_1(sc, 0x200000, 0x00);
2054 
2055 	return 0;
2056 }
2057 
2058 /* macro to handle unaligned little endian data in firmware image */
2059 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
2060 static int
2061 iwi_load_firmware(struct iwi_softc *sc, void *fw, int size)
2062 {
2063 	bus_dma_tag_t dmat;
2064 	bus_dmamap_t map;
2065 	bus_addr_t physaddr;
2066 	void *virtaddr;
2067 	u_char *p, *end;
2068 	u_int32_t sentinel, ctl, src, dst, sum, len, mlen;
2069 	int ntries, error = 0;
2070 
2071 	sc->flags &= ~(IWI_FLAG_FW_INITED);
2072 
2073 	/* Allocate DMA memory for storing firmware image */
2074 	error = bus_dma_tag_create(sc->iwi_parent_tag, 1, 0, BUS_SPACE_MAXADDR_32BIT,
2075 	    BUS_SPACE_MAXADDR, NULL, NULL, size, 1, size, BUS_DMA_ALLOCNOW, &dmat);
2076 	if (error != 0) {
2077 		device_printf(sc->sc_dev,
2078 		    "could not create firmware DMA tag\n");
2079 		goto fail1;
2080 	}
2081 
2082 	/*
2083 	 * We cannot map fw directly because of some hardware constraints on
2084 	 * the mapping address.
2085 	 */
2086 	error = bus_dmamem_alloc(dmat, &virtaddr, BUS_DMA_WAITOK, &map);
2087 	if (error != 0) {
2088 		device_printf(sc->sc_dev,
2089 		    "could not allocate firmware DMA memory\n");
2090 		goto fail2;
2091 	}
2092 
2093 	error = bus_dmamap_load(dmat, map, virtaddr, size, iwi_dma_map_addr,
2094 	    &physaddr, 0);
2095 	if (error != 0) {
2096 		device_printf(sc->sc_dev, "could not load firmware DMA map\n");
2097 		goto fail3;
2098 	}
2099 
2100 	/* Copy firmware image to DMA memory */
2101 	bcopy(fw, virtaddr, size);
2102 
2103 	/* Make sure the adapter will get up-to-date values */
2104 	bus_dmamap_sync(dmat, map, BUS_DMASYNC_PREWRITE);
2105 
2106 	/* Tell the adapter where the command blocks are stored */
2107 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
2108 
2109 	/*
2110 	 * Store command blocks into adapter's internal memory using register
2111 	 * indirections. The adapter will read the firmware image through DMA
2112 	 * using information stored in command blocks.
2113 	 */
2114 	src = physaddr;
2115 	p = virtaddr;
2116 	end = p + size;
2117 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
2118 
2119 	while (p < end) {
2120 		dst = GETLE32(p); p += 4; src += 4;
2121 		len = GETLE32(p); p += 4; src += 4;
2122 		p += len;
2123 
2124 		while (len > 0) {
2125 			mlen = min(len, IWI_CB_MAXDATALEN);
2126 
2127 			ctl = IWI_CB_DEFAULT_CTL | mlen;
2128 			sum = ctl ^ src ^ dst;
2129 
2130 			/* Write a command block */
2131 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
2132 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, src);
2133 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, dst);
2134 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
2135 
2136 			src += mlen;
2137 			dst += mlen;
2138 			len -= mlen;
2139 		}
2140 	}
2141 
2142 	/* Write a fictive final command block (sentinel) */
2143 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
2144 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2145 
2146 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2147 	    ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER));
2148 
2149 	/* Tell the adapter to start processing command blocks */
2150 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
2151 
2152 	/* Wait until the adapter has processed all command blocks */
2153 	for (ntries = 0; ntries < 400; ntries++) {
2154 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
2155 			break;
2156 		DELAY(100);
2157 	}
2158 	if (ntries == 400) {
2159 		device_printf(sc->sc_dev,
2160 		    "timeout processing command blocks\n");
2161 		error = EIO;
2162 		goto fail4;
2163 	}
2164 
2165 
2166 	/* We're done with command blocks processing */
2167 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
2168 
2169 	/* Allow interrupts so we know when the firmware is inited */
2170 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
2171 
2172 	/* Tell the adapter to initialize the firmware */
2173 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
2174 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
2175 	    IWI_CTL_ALLOW_STANDBY);
2176 
2177 	/* Wait at most one second for firmware initialization to complete */
2178 	if ((error = tsleep(IWI_FW_INITIALIZED(sc), 0, "iwiini", hz)) != 0) {
2179 		device_printf(sc->sc_dev, "timeout waiting for firmware "
2180 		    "initialization to complete\n");
2181 		goto fail4;
2182 	}
2183 
2184 fail4:  bus_dmamap_sync(dmat, map, BUS_DMASYNC_POSTWRITE);
2185 	bus_dmamap_unload(dmat, map);
2186 fail3:	bus_dmamem_free(dmat, virtaddr, map);
2187 fail2:	bus_dma_tag_destroy(dmat);
2188 fail1:
2189 	return error;
2190 }
2191 
2192 /*
2193  * Store firmware into kernel memory so we can download it when we need to,
2194  * e.g when the adapter wakes up from suspend mode.
2195  */
2196 static int
2197 iwi_cache_firmware(struct iwi_softc *sc, void *data, int is_ibss)
2198 {
2199 	struct iwi_firmware *kfw = &sc->fw;
2200 	struct iwi_firmware ufw;
2201 	int error;
2202 
2203 	iwi_free_firmware(sc);
2204 
2205 	/*
2206 	 * mutex(9): no mutexes should be held across functions which access
2207 	 * memory in userspace, such as copyin(9) [...]
2208 	 */
2209 
2210 	if ((error = copyin(data, &ufw, sizeof ufw)) != 0)
2211 		goto fail1;
2212 
2213 	kfw->boot_size  = ufw.boot_size;
2214 	kfw->ucode_size = ufw.ucode_size;
2215 	kfw->main_size  = ufw.main_size;
2216 
2217 	kfw->boot = malloc(kfw->boot_size, M_DEVBUF, M_WAITOK);
2218 	if (kfw->boot == NULL) {
2219 		error = ENOMEM;
2220 		goto fail1;
2221 	}
2222 
2223 	kfw->ucode = malloc(kfw->ucode_size, M_DEVBUF, M_WAITOK);
2224 	if (kfw->ucode == NULL) {
2225 		error = ENOMEM;
2226 		goto fail2;
2227 	}
2228 
2229 	kfw->main = malloc(kfw->main_size, M_DEVBUF, M_WAITOK);
2230 	if (kfw->main == NULL) {
2231 		error = ENOMEM;
2232 		goto fail3;
2233 	}
2234 
2235 	if ((error = copyin(ufw.boot, kfw->boot, kfw->boot_size)) != 0)
2236 		goto fail4;
2237 
2238 	if ((error = copyin(ufw.ucode, kfw->ucode, kfw->ucode_size)) != 0)
2239 		goto fail4;
2240 
2241 	if ((error = copyin(ufw.main, kfw->main, kfw->main_size)) != 0)
2242 		goto fail4;
2243 
2244 	DPRINTF(("Firmware cached: boot %u, ucode %u, main %u\n",
2245 	    kfw->boot_size, kfw->ucode_size, kfw->main_size));
2246 
2247 
2248 	sc->flags |= IWI_FLAG_FW_CACHED;
2249 	sc->flags |= is_ibss ? IWI_FLAG_FW_IBSS : 0;
2250 	return 0;
2251 
2252 fail4:	free(kfw->boot, M_DEVBUF);
2253 fail3:	free(kfw->ucode, M_DEVBUF);
2254 fail2:	free(kfw->main, M_DEVBUF);
2255 fail1:
2256 
2257 	return error;
2258 }
2259 
2260 static void
2261 iwi_free_firmware(struct iwi_softc *sc)
2262 {
2263 	if (!(sc->flags & IWI_FLAG_FW_CACHED))
2264 		return;
2265 
2266 	free(sc->fw.boot, M_DEVBUF);
2267 	free(sc->fw.ucode, M_DEVBUF);
2268 	free(sc->fw.main, M_DEVBUF);
2269 
2270 	sc->flags &= ~( IWI_FLAG_FW_CACHED | IWI_FLAG_FW_IBSS );
2271 }
2272 
2273 static int
2274 iwi_adapter_config(struct iwi_softc *sc, int is_a, int cmd_wait)
2275 {
2276 	struct iwi_configuration config;
2277 
2278 	bzero(&config, sizeof config);
2279 	config.enable_multicast = 1;
2280 	config.noise_reported = 1;
2281 
2282 	config.bg_autodetect =
2283 		( !(is_a) &&
2284 		  ( sc->enable_bg_autodetect != 0 ) ) ? 1 : 0;	/* default: on  */
2285 
2286 	config.bluetooth_coexistence =
2287 		( sc->enable_bt_coexist != 0 ) ? 1 : 0;		/* default: on  */
2288 
2289 	config.enable_cts_to_self =
2290 		( sc->enable_cts_to_self > 0 ) ? 1 : 0;		/* default: off */
2291 
2292 	if (sc->antenna_diversity > 0 ) {			/* default: BOTH */
2293 		switch( sc->antenna_diversity ) {
2294 			case 1: case 3:
2295 				config.antenna_diversity = sc->antenna_diversity;
2296 		}
2297 	}
2298 
2299 	config.disable_unicast_decryption =
2300 		( sc->disable_unicast_decryption != 0 ) ? 1 : 0; /* default: on */
2301 
2302 	config.disable_multicast_decryption =
2303 		( sc->disable_multicast_decryption != 0 ) ? 1 : 0;/* default: on */
2304 
2305 
2306 	if ( sc->debug_level > 0 ) {
2307 		printf("config.bluetooth_coexistence = %d\n",
2308 			 config.bluetooth_coexistence );
2309 		printf("config.bg_autodetect = %d\n",
2310 			 config.bg_autodetect );
2311 		printf("config.enable_cts_to_self = %d\n",
2312 			 config.enable_cts_to_self );
2313 		printf("config.antenna_diversity = %d\n",
2314 			 config.antenna_diversity );
2315 		printf("config.disable_unicast_decryption = %d\n",
2316 			 config.disable_unicast_decryption );
2317 		printf("config.disable_multicast_decryption = %d\n",
2318 			 config.disable_multicast_decryption );
2319 		printf("config.neg_best_rates_first = %d\n",
2320 			 sc->enable_neg_best_first );
2321 	}
2322 
2323 	return iwi_cmd(sc, IWI_CMD_SET_CONFIGURATION, &config,
2324 		 sizeof config, cmd_wait );
2325 }
2326 
2327 static int
2328 iwi_config(struct iwi_softc *sc)
2329 {
2330 	struct ieee80211com *ic = &sc->sc_ic;
2331 	struct ifnet *ifp = &ic->ic_if;
2332 	struct iwi_rateset rs;
2333 	struct iwi_txpower power;
2334 	struct ieee80211_wepkey *k;
2335 	struct iwi_wep_key wepkey;
2336 	u_int32_t data;
2337 	int error, i;
2338 
2339 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2340 	DPRINTF(("Setting MAC address to %6D\n", ic->ic_myaddr, ":"));
2341 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
2342 	    IEEE80211_ADDR_LEN, 0);
2343 	if (error != 0)
2344 		return error;
2345 
2346 	DPRINTF(("Configuring adapter\n"));
2347 	if ((error = iwi_adapter_config(sc, 1, 0)) != 0)
2348 		return error;
2349 
2350 	data = htole32(IWI_POWER_MODE_CAM);
2351 	DPRINTF(("Setting power mode to %u\n", le32toh(data)));
2352 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
2353 	if (error != 0)
2354 		return error;
2355 
2356 	data = htole32(ic->ic_rtsthreshold);
2357 	DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
2358 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
2359 	if (error != 0)
2360 		return error;
2361 
2362 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
2363 		power.mode = IWI_MODE_11B;
2364 		power.nchan = 11;
2365 		for (i = 0; i < 11; i++) {
2366 			power.chan[i].chan = i + 1;
2367 			power.chan[i].power = IWI_TXPOWER_MAX;
2368 		}
2369 		DPRINTF(("Setting .11b channels tx power\n"));
2370 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2371 		    0);
2372 		if (error != 0)
2373 			return error;
2374 
2375 		power.mode = IWI_MODE_11G;
2376 		DPRINTF(("Setting .11g channels tx power\n"));
2377 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2378 		    0);
2379 		if (error != 0)
2380 			return error;
2381 	}
2382 
2383 	rs.mode = IWI_MODE_11G;
2384 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2385 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
2386 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates, rs.rates,
2387 	    rs.nrates);
2388 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
2389 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2390 	if (error != 0)
2391 		return error;
2392 
2393 	rs.mode = IWI_MODE_11A;
2394 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2395 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
2396 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates, rs.rates,
2397 	    rs.nrates);
2398 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
2399 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2400 	if (error != 0)
2401 		return error;
2402 
2403 	data = htole32(arc4random());
2404 	DPRINTF(("Setting initialization vector to %u\n", le32toh(data)));
2405 	error = iwi_cmd(sc, IWI_CMD_SET_IV, &data, sizeof data, 0);
2406 	if (error != 0)
2407 		return error;
2408 
2409 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2410 		k = ic->ic_nw_keys;
2411 		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
2412 			wepkey.cmd = IWI_WEP_KEY_CMD_SETKEY;
2413 			wepkey.idx = i;
2414 			wepkey.len = k->wk_len;
2415 			bzero(wepkey.key, sizeof wepkey.key);
2416 			bcopy(k->wk_key, wepkey.key, k->wk_len);
2417 			DPRINTF(("Setting wep key index %u len %u\n",
2418 			    wepkey.idx, wepkey.len));
2419 			error = iwi_cmd(sc, IWI_CMD_SET_WEP_KEY, &wepkey,
2420 			    sizeof wepkey, 0);
2421 			if (error != 0)
2422 				return error;
2423 		}
2424 	}
2425 
2426 	/* Enable adapter */
2427 	DPRINTF(("Enabling adapter\n"));
2428 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
2429 }
2430 
2431 static int
2432 iwi_scan(struct iwi_softc *sc)
2433 {
2434 	struct ieee80211com *ic = &sc->sc_ic;
2435 	struct iwi_scan scan;
2436 	u_int8_t *p;
2437 	int i, count;
2438 	int do_5ghz_scan = 0;
2439 
2440 	sc->scan_counter++; /* track the number of scans started */
2441 
2442 	sc->flags |= IWI_FLAG_SCANNING;
2443 
2444 	bzero(&scan, sizeof scan);
2445 
2446 	/*
2447 	 * Alternate two broadcast scans with
2448 	 * two broadcast/direct scans.
2449 	 */
2450 	if ( sc->scan_counter & 2 ) {
2451 		scan.type = IWI_SCAN_TYPE_BROADCAST_AND_DIRECT;
2452 		scan.intval = htole16(100);
2453 	} else {
2454 		scan.type = IWI_SCAN_TYPE_BROADCAST;
2455 		scan.intval = htole16(40);
2456 	}
2457 
2458 	p = scan.channels;
2459 
2460 	/*
2461 	 * If we have .11a capable adapter, and
2462 	 * 	- we are in .11a mode, or
2463 	 *	- we are in auto mode and this is an odd numbered scan
2464 	 * then do a 5GHz scan, otherwise do a 2GHz scan.
2465 	 */
2466 	if ( ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates > 0 ) {
2467 		if (( ic->ic_curmode == IEEE80211_MODE_11A ) ||
2468 		    (( ic->ic_curmode == IEEE80211_MODE_AUTO ) &&
2469 		     ( sc->scan_counter & 1)))
2470 			do_5ghz_scan = 1;
2471 	}
2472 	count = 0;
2473 	if ( do_5ghz_scan ) {
2474 		DPRINTF(("Scanning 5GHz band\n"));
2475 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2476 			if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]) &&
2477 					isset(ic->ic_chan_active, i)) {
2478 				*++p = i;
2479 				count++;
2480 			}
2481 		}
2482 		*(p - count) = IWI_CHAN_5GHZ | count;
2483 	} else {
2484 		DPRINTF(("Scanning 2GHz band\n"));
2485 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2486 			if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]) &&
2487 					isset(ic->ic_chan_active, i)) {
2488 				*++p = i;
2489 				count++;
2490 			}
2491 		}
2492 		*(p - count) = IWI_CHAN_2GHZ | count;
2493 	}
2494 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2495 }
2496 
2497 static int
2498 iwi_auth_and_assoc(struct iwi_softc *sc)
2499 {
2500 	struct ieee80211com *ic = &sc->sc_ic;
2501 	struct ifnet *ifp = &ic->ic_if;
2502 	struct ieee80211_node *ni = ic->ic_bss;
2503 	struct iwi_rateset rs;
2504 	u_int32_t data;
2505 	int error, x;
2506 
2507 	if ( ( sc->flags & IWI_FLAG_FW_IBSS ) &&
2508 	     !( ni->ni_capinfo & IEEE80211_CAPINFO_IBSS ) ) {
2509 		return -1; /* IBSS F/W requires network ibss capability */
2510 	}
2511 
2512 	DPRINTF(("Configuring adapter\n"));
2513 	if ((error = iwi_adapter_config(sc,
2514 		IEEE80211_IS_CHAN_5GHZ(ni->ni_chan), 1)) != 0)
2515 			return error;
2516 
2517 #ifdef IWI_DEBUG
2518 	if (sc->debug_level > 0) {
2519 		printf("Setting ESSID to ");
2520 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2521 		printf("\n");
2522 	}
2523 #endif
2524 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2525 	if (error != 0)
2526 		return error;
2527 
2528 	/* the rate set has already been "negotiated" */
2529 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2530 	    IWI_MODE_11G;
2531 	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2532 	rs.nrates = ni->ni_rates.rs_nrates;
2533 	if ( sc->enable_neg_best_first != 1 ) {
2534 		bcopy(ni->ni_rates.rs_rates, rs.rates, rs.nrates);
2535 	} else {
2536 		for ( x = 0 ; x < rs.nrates; x++ ) {
2537 			/*
2538 			 * Present the firmware with the most favourable
2539 			 * of the negotiated rates first.
2540 			 */
2541 			rs.rates[rs.nrates-x-1] = ni->ni_rates.rs_rates[x];
2542 		}
2543 	}
2544 
2545 	if ( sc->debug_level > 0 ) {
2546 		printf("Setting negotiated rates (%u) : ", rs.nrates);
2547 		for ( x = 0 ; x < rs.nrates; x++ ) {
2548 			printf("%d ", rs.rates[x]);
2549 		}
2550 		printf("\n");
2551 	}
2552 
2553 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2554 	if (error != 0)
2555 		return error;
2556 
2557 	data = htole32(ni->ni_rssi);
2558 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2559 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2560 	if (error != 0)
2561 		return error;
2562 
2563 	bzero(&sc->assoc, sizeof sc->assoc);
2564 	sc->assoc.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2565 	    IWI_MODE_11G;
2566 	sc->assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2567 	if (sc->authmode == IEEE80211_AUTH_SHARED)
2568 		sc->assoc.auth = (ic->ic_wep_txkey << 4) | IWI_AUTH_SHARED;
2569 	bcopy(ni->ni_tstamp, sc->assoc.tstamp, 8);
2570 	sc->assoc.capinfo = htole16(ni->ni_capinfo);
2571 	sc->assoc.lintval = htole16(ic->ic_lintval);
2572 	sc->assoc.intval = htole16(ni->ni_intval);
2573 	IEEE80211_ADDR_COPY(sc->assoc.bssid, ni->ni_bssid);
2574 	if ( ic->ic_opmode == IEEE80211_M_IBSS )
2575 		IEEE80211_ADDR_COPY(sc->assoc.dst, ifp->if_broadcastaddr);
2576 	else
2577 		IEEE80211_ADDR_COPY(sc->assoc.dst, ni->ni_bssid);
2578 
2579 	DPRINTF(("Trying to associate to %6D channel %u auth %u\n",
2580 	    sc->assoc.bssid, ":", sc->assoc.chan, sc->assoc.auth));
2581 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &sc->assoc, sizeof sc->assoc, 1);
2582 }
2583 
2584 static void
2585 iwi_init(void *priv)
2586 {
2587 	struct iwi_softc *sc = priv;
2588 	struct ieee80211com *ic = &sc->sc_ic;
2589 	struct ifnet *ifp = &ic->ic_if;
2590 	struct iwi_firmware *fw = &sc->fw;
2591 	int i;
2592 
2593 	/* exit immediately if firmware has not been ioctl'd */
2594 	if (!(sc->flags & IWI_FLAG_FW_CACHED)) {
2595 		ifp->if_flags &= ~IFF_UP;
2596 		return;
2597 	}
2598 
2599 	iwi_stop(sc);
2600 
2601 	if (iwi_reset(sc) != 0) {
2602 		device_printf(sc->sc_dev, "could not reset adapter\n");
2603 		goto fail;
2604 	}
2605 
2606 	if (iwi_load_firmware(sc, fw->boot, fw->boot_size) != 0) {
2607 		device_printf(sc->sc_dev, "could not load boot firmware\n");
2608 		goto fail;
2609 	}
2610 
2611 	if (iwi_load_ucode(sc, fw->ucode, fw->ucode_size) != 0) {
2612 		device_printf(sc->sc_dev, "could not load microcode\n");
2613 		goto fail;
2614 	}
2615 
2616 	iwi_stop_master(sc);
2617 
2618 	sc->tx_cur = 0;
2619 	sc->tx_queued = 0;
2620 	sc->tx_old = IWI_TX_RING_SIZE - 1;
2621 	sc->cmd_cur = 0;
2622 	sc->rx_cur = IWI_RX_RING_SIZE - 1;
2623 
2624 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmd_ring_pa);
2625 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, IWI_CMD_RING_SIZE);
2626 	CSR_WRITE_4(sc, IWI_CSR_CMD_READ_INDEX, 0);
2627 	CSR_WRITE_4(sc, IWI_CSR_CMD_WRITE_INDEX, sc->cmd_cur);
2628 
2629 	CSR_WRITE_4(sc, IWI_CSR_TX1_BASE, sc->tx_ring_pa);
2630 	CSR_WRITE_4(sc, IWI_CSR_TX1_SIZE, IWI_TX_RING_SIZE);
2631 	CSR_WRITE_4(sc, IWI_CSR_TX1_READ_INDEX, 0);
2632 	CSR_WRITE_4(sc, IWI_CSR_TX1_WRITE_INDEX, sc->tx_cur);
2633 
2634 	CSR_WRITE_4(sc, IWI_CSR_TX2_BASE, sc->tx_ring_pa);
2635 	CSR_WRITE_4(sc, IWI_CSR_TX2_SIZE, IWI_TX_RING_SIZE);
2636 	CSR_WRITE_4(sc, IWI_CSR_TX2_READ_INDEX, 0);
2637 	CSR_WRITE_4(sc, IWI_CSR_TX2_WRITE_INDEX, 0);
2638 
2639 	CSR_WRITE_4(sc, IWI_CSR_TX3_BASE, sc->tx_ring_pa);
2640 	CSR_WRITE_4(sc, IWI_CSR_TX3_SIZE, IWI_TX_RING_SIZE);
2641 	CSR_WRITE_4(sc, IWI_CSR_TX3_READ_INDEX, 0);
2642 	CSR_WRITE_4(sc, IWI_CSR_TX3_WRITE_INDEX, 0);
2643 
2644 	CSR_WRITE_4(sc, IWI_CSR_TX4_BASE, sc->tx_ring_pa);
2645 	CSR_WRITE_4(sc, IWI_CSR_TX4_SIZE, IWI_TX_RING_SIZE);
2646 	CSR_WRITE_4(sc, IWI_CSR_TX4_READ_INDEX, 0);
2647 	CSR_WRITE_4(sc, IWI_CSR_TX4_WRITE_INDEX, 0);
2648 
2649 	for (i = 0; i < IWI_RX_RING_SIZE; i++)
2650 		CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4,
2651 		    sc->rx_buf[i].physaddr);
2652 
2653 	/*
2654 	 * Kick Rx
2655 	 */
2656 	CSR_WRITE_4(sc, IWI_CSR_RX_WRITE_INDEX, sc->rx_cur);
2657 	CSR_WRITE_4(sc, IWI_CSR_RX_READ_INDEX, 0);
2658 
2659 	if (iwi_load_firmware(sc, fw->main, fw->main_size) != 0) {
2660 		device_printf(sc->sc_dev, "could not load main firmware\n");
2661 		goto fail;
2662 	}
2663 
2664 	/*
2665 	 * Force the opmode based on what firmware is loaded. This
2666 	 * stops folks from killing the firmware by asking it to
2667 	 * do something it doesn't support.
2668 	 */
2669 	if ( ic->ic_opmode != IEEE80211_M_MONITOR ) {
2670 		ic->ic_opmode = ( sc->flags & IWI_FLAG_FW_IBSS )
2671 			? IEEE80211_M_IBSS : IEEE80211_M_STA;
2672 	}
2673 
2674 	sc->flags |= IWI_FLAG_FW_INITED;
2675 
2676 	sc->flags &= ~( IWI_FLAG_SCANNING |
2677 			IWI_FLAG_SCAN_COMPLETE |
2678 			IWI_FLAG_SCAN_ABORT |
2679 			IWI_FLAG_ASSOCIATED );
2680 
2681 	if (iwi_config(sc) != 0) {
2682 		device_printf(sc->sc_dev, "device configuration failed\n");
2683 		goto fail;
2684 	}
2685 
2686 	if ( ic->ic_opmode != IEEE80211_M_MONITOR ) {
2687 		ieee80211_begin_scan(ifp);
2688 		ifp->if_flags &= ~IFF_OACTIVE;
2689 		ifp->if_flags |= IFF_RUNNING;
2690 	} else {
2691 		ieee80211_begin_scan(ifp);
2692 		ifp->if_flags &= ~IFF_OACTIVE;
2693 		ifp->if_flags |= IFF_RUNNING;
2694 	}
2695 
2696 	return;
2697 
2698 fail:
2699 	if ( !(sc->flags & IWI_FLAG_RESET) )
2700 		ifp->if_flags &= ~IFF_UP;
2701 	iwi_stop(sc);
2702 }
2703 
2704 static void
2705 iwi_init_locked(void *priv)
2706 {
2707 	struct iwi_softc *sc = priv;
2708 	IWI_LOCK_INFO;
2709 	IWI_LOCK(sc);
2710 	iwi_init(sc);
2711 	IWI_UNLOCK(sc);
2712 }
2713 
2714 static void
2715 iwi_stop(void *priv)
2716 {
2717 	struct iwi_softc *sc = priv;
2718 	struct ieee80211com *ic = &sc->sc_ic;
2719 	struct ifnet *ifp = &ic->ic_if;
2720 	struct iwi_tx_buf *buf;
2721 	int i;
2722 
2723 	iwi_stop_master(sc);
2724 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SW_RESET);
2725 
2726 	/*
2727 	 * Release Tx buffers
2728 	 */
2729 	for (i = 0; i < IWI_TX_RING_SIZE; i++) {
2730 		buf = &sc->tx_buf[i];
2731 
2732 		if (buf->m != NULL) {
2733 			bus_dmamap_sync(sc->tx_buf_dmat, buf->map,
2734 			    BUS_DMASYNC_POSTWRITE);
2735 			bus_dmamap_unload(sc->tx_buf_dmat, buf->map);
2736 			m_freem(buf->m);
2737 			buf->m = NULL;
2738 
2739 			if (buf->ni != NULL) {
2740 				if (buf->ni != ic->ic_bss)
2741 					ieee80211_free_node(ic, buf->ni);
2742 				buf->ni = NULL;
2743 			}
2744 		}
2745 	}
2746 
2747 	ifp->if_timer = 0;
2748 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2749 
2750 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2751 }
2752 
2753 static int8_t
2754 iwi_cache_station(struct iwi_softc *sc, u_int8_t *mac)
2755 {
2756 	int i, x, base, elemsize = sizeof(struct iwi_fw_station);
2757 	for (i = 0; i < sc->num_stations; i++)
2758 		if (!memcmp(sc->stations[i], mac, IEEE80211_ADDR_LEN))
2759 			break;
2760 	if (i == IWI_FW_MAX_STATIONS)
2761 		return 0xff;
2762 	memcpy(sc->stations[i], mac, IEEE80211_ADDR_LEN);
2763 	for (x = 0, base = IWI_STATION_TABLE + (i * elemsize) ;
2764 	     x < IEEE80211_ADDR_LEN ; x++ ) {
2765 		CSR_WRITE_1(sc, base + x, mac[x]);
2766 	}
2767 	if ( (i + 1) > sc->num_stations )
2768 		sc->num_stations++;
2769 	return i;
2770 }
2771 
2772 static u_int8_t
2773 iwi_find_station(struct iwi_softc *sc, u_int8_t *mac)
2774 {
2775 	u_int8_t i;
2776 	for (i = 0; i < sc->num_stations; i++)
2777 		if (!memcmp(sc->stations[i], mac, IEEE80211_ADDR_LEN))
2778 			return i;
2779 	return 0xff;
2780 }
2781 
2782 static const char *
2783 iwi_error_desc(u_int32_t val)
2784 {
2785 	switch (val) {
2786 	case IWI_FW_ERROR_OK:
2787 		return "OK";
2788 	case IWI_FW_ERROR_FAIL:
2789 		return "FAIL";
2790 	case IWI_FW_ERROR_MEMORY_UNDERFLOW:
2791 		return "MEMORY_UNDERFLOW";
2792 	case IWI_FW_ERROR_MEMORY_OVERFLOW:
2793 		return "MEMORY_OVERFLOW";
2794 	case IWI_FW_ERROR_BAD_PARAM:
2795 		return "BAD_PARAMETER";
2796 	case IWI_FW_ERROR_BAD_CHECKSUM:
2797 		return "BAD_CHECKSUM";
2798 	case IWI_FW_ERROR_NMI_INTERRUPT:
2799 		return "NMI_INTERRUPT";
2800 	case IWI_FW_ERROR_BAD_DATABASE:
2801 		return "BAD_DATABASE";
2802 	case IWI_FW_ERROR_ALLOC_FAIL:
2803 		return "ALLOC_FAIL";
2804 	case IWI_FW_ERROR_DMA_UNDERRUN:
2805 		return "DMA_UNDERRUN";
2806 	case IWI_FW_ERROR_DMA_STATUS:
2807 		return "DMA_STATUS";
2808 	case IWI_FW_ERROR_DINOSTATUS_ERROR:
2809 		return "DINOSTATUS_ERROR";
2810 	case IWI_FW_ERROR_EEPROMSTATUS_ERROR:
2811 		return "EEPROMSTATUS_ERROR";
2812 	case IWI_FW_ERROR_SYSASSERT:
2813 		return "SYSASSERT";
2814 	case IWI_FW_ERROR_FATAL_ERROR:
2815 		return "FATAL";
2816 	default:
2817 		return "UNKNOWN_ERROR";
2818 	}
2819 }
2820 
2821 static void
2822 iwi_dump_fw_event_log(struct iwi_softc *sc)
2823 {
2824 	u_int32_t ev, time, data, i, count, base;
2825 	base = CSR_READ_4(sc, IWI_FW_EVENT_LOG);
2826 	count = MEM_READ_4(sc, base);
2827 	if ( count > 0 && (sc->flags & IWI_FLAG_FW_INITED) ) {
2828 		printf("Reading %d event log entries from base address 0x%x.\n",
2829 			count,  base);
2830 		if (IWI_FW_EVENT_START_OFFSET <= count * IWI_FW_EVENT_ELEM_SIZE)
2831 			device_printf(sc->sc_dev,"Start IWI Event Log Dump:\n");
2832 		for (i = IWI_FW_EVENT_START_OFFSET;
2833 				i <= count * IWI_FW_EVENT_ELEM_SIZE;
2834 				i += IWI_FW_EVENT_ELEM_SIZE) {
2835 			ev = MEM_READ_4(sc, base + i);
2836 			time  = MEM_READ_4(sc, base + i + 1 * sizeof(u_int32_t));
2837 			data  = MEM_READ_4(sc, base + i + 2 * sizeof(u_int32_t));
2838 			printf("%d %8p %8.8d\n", time, (void *) data, ev);
2839 		}
2840 	} else {
2841 		printf("There are no entries in the firmware event log.\n");
2842 	}
2843 }
2844 
2845 static void
2846 iwi_dump_fw_error_log(struct iwi_softc *sc)
2847 {
2848 	u_int32_t i = 0;
2849 	int32_t count, base;
2850 	base = CSR_READ_4(sc, IWI_FW_ERROR_LOG);
2851 	count = MEM_READ_4(sc, base);
2852 	if ( count > 0 && (sc->flags & IWI_FLAG_FW_INITED) ) {
2853 		printf("Reading %d error log entries "
2854 		    "from base address 0x%p.\n", count,  (void *)base);
2855 		for ( i = IWI_FW_ERROR_START_OFFSET;
2856 			i <= count * IWI_FW_EVENT_ELEM_SIZE;
2857 			i += IWI_FW_ERROR_ELEM_SIZE ) {
2858 			u_int32_t elems;
2859 			printf("%15.15s",
2860 			    iwi_error_desc(MEM_READ_4(sc, base + i)));
2861 			printf(" time(%8.8d)", MEM_READ_4(sc, base + i + 4));
2862 			for ( elems = 2 ; elems < 7 ; elems++ ) {
2863 				printf(" %8p", (void *)
2864 				    MEM_READ_4(sc, base + i + (4 * elems)));
2865 			}
2866 			printf("\n");
2867 		}
2868 	}
2869 }
2870 
2871 static int
2872 iwi_sysctl_cts_to_self(SYSCTL_HANDLER_ARGS)
2873 {
2874 	struct iwi_softc *sc = (void *)arg1;
2875 	int cts_to_self = sc->enable_cts_to_self;
2876 	int error = sysctl_handle_int(oidp, &cts_to_self, 0, req);
2877 
2878 	(void)arg2; /* silence WARNS == 6 */
2879 
2880 	if ( !error && req->newptr && cts_to_self != sc->enable_cts_to_self ) {
2881 		switch ( cts_to_self ) {
2882 			case -1: case 0: case 1:
2883 				sc->enable_cts_to_self = cts_to_self;
2884 				error = iwi_adapter_config(sc, 0, 0);
2885 			break;
2886 		}
2887 	}
2888 	return error;
2889 }
2890 
2891 
2892 static int
2893 iwi_sysctl_antenna_diversity(SYSCTL_HANDLER_ARGS)
2894 {
2895 	struct iwi_softc *sc = (void *)arg1;
2896 	int antenna_diversity = sc->antenna_diversity;
2897 	int error = sysctl_handle_int(oidp, &antenna_diversity, 0, req);
2898 
2899 	(void)arg2; /* silence WARNS == 6 */
2900 
2901 	if ( !error && req->newptr && antenna_diversity != sc->antenna_diversity ) {
2902 		switch ( antenna_diversity ) {
2903 			case 1: case 3: case 0: case -1:
2904 				sc->antenna_diversity = antenna_diversity;
2905 				error = iwi_adapter_config(sc, 0, 0);
2906 			break;
2907 		}
2908 	}
2909 	return error;
2910 }
2911 
2912 static int
2913 iwi_sysctl_bg_autodetect(SYSCTL_HANDLER_ARGS)
2914 {
2915 	struct iwi_softc *sc = (void *)arg1;
2916 	int bg_autodetect = sc->enable_bg_autodetect;
2917 	int error = sysctl_handle_int(oidp, &bg_autodetect, 0, req);
2918 
2919 	(void)arg2; /* silence WARNS == 6 */
2920 
2921 	if ( !error && req->newptr && bg_autodetect != sc->enable_bg_autodetect ) {
2922 		switch ( bg_autodetect ) {
2923 			case 1: case 0: case -1:
2924 				sc->enable_bg_autodetect = bg_autodetect;
2925 				error = iwi_adapter_config(sc, 0, 0);
2926 			break;
2927 		}
2928 	}
2929 	return error;
2930 }
2931 
2932 static int
2933 iwi_sysctl_bt_coexist(SYSCTL_HANDLER_ARGS)
2934 {
2935 	struct iwi_softc *sc = (void *)arg1;
2936 	int bt_coexist = sc->enable_bt_coexist;
2937 	int error = sysctl_handle_int(oidp, &bt_coexist, 0, req);
2938 
2939 	(void)arg2; /* silence WARNS == 6 */
2940 
2941 	if ( !error && req->newptr && bt_coexist != sc->enable_bt_coexist ) {
2942 		switch ( bt_coexist ) {
2943 			case 1: case 0: case -1:
2944 				sc->enable_bt_coexist = bt_coexist;
2945 				error = iwi_adapter_config(sc, 0, 0);
2946 			break;
2947 		}
2948 	}
2949 	return error;
2950 }
2951 
2952 static int
2953 iwi_sysctl_dump_logs(SYSCTL_HANDLER_ARGS)
2954 {
2955 	struct iwi_softc *sc = arg1;
2956 	int result = -1;
2957 	int error = sysctl_handle_int(oidp, &result, 0, req);
2958 
2959 	(void)arg2; /* silence WARNS == 6 */
2960 
2961 	if (!error && req->newptr && result == 1) {
2962 		iwi_dump_fw_event_log(sc);
2963 		iwi_dump_fw_error_log(sc);
2964 	}
2965 	return error;
2966 }
2967 
2968 static int
2969 iwi_sysctl_stats(SYSCTL_HANDLER_ARGS)
2970 {
2971 	struct iwi_softc *sc = arg1;
2972 	u_int32_t size;
2973 	struct iwi_dump_buffer dump;
2974 
2975 	(void)arg2; /* silence WARNS == 6 */
2976 	(void)oidp; /* silence WARNS == 6 */
2977 
2978 	if (!(sc->flags & IWI_FLAG_FW_INITED)) {
2979 		bzero(dump.buf, sizeof dump.buf);
2980 		return SYSCTL_OUT(req, &dump, sizeof dump);
2981 	}
2982 
2983 	size = min(CSR_READ_4(sc, IWI_CSR_TABLE0_SIZE), 128 - 1);
2984 	CSR_READ_REGION_4(sc, IWI_CSR_TABLE0_BASE, &dump.buf[1], size);
2985 
2986 	return SYSCTL_OUT(req, &dump, sizeof dump);
2987 }
2988 
2989 static int
2990 iwi_sysctl_radio(SYSCTL_HANDLER_ARGS)
2991 {
2992 	struct iwi_softc *sc = arg1;
2993 	int val;
2994 
2995 	(void)arg2; /* silence WARNS == 6 */
2996 	(void)oidp; /* silence WARNS == 6 */
2997 
2998 	val = (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) ? 1 : 0;
2999 	return SYSCTL_OUT(req, &val, sizeof val);
3000 }
3001 
3002 static int
3003 iwi_sysctl_neg_best_rates_first(SYSCTL_HANDLER_ARGS)
3004 {
3005 	struct iwi_softc *sc = arg1;
3006 	int best_first = sc->enable_neg_best_first;
3007 	int error = sysctl_handle_int(oidp, &best_first, 0, req);
3008 
3009 	(void)arg2; /* silence WARNS == 6 */
3010 	(void)oidp; /* silence WARNS == 6 */
3011 
3012 	if ( !error && req->newptr && best_first != sc->enable_neg_best_first ) {
3013 		switch ( best_first ) {
3014 			case 1: case 0: case -1:
3015 				sc->enable_neg_best_first = best_first;
3016 			break;
3017 		}
3018 	}
3019 	return error;
3020 }
3021 
3022 static int
3023 iwi_sysctl_disable_unicast_decryption(SYSCTL_HANDLER_ARGS)
3024 {
3025 	struct iwi_softc *sc = arg1;
3026 	int disable_uni = sc->disable_unicast_decryption;
3027 	int error = sysctl_handle_int(oidp, &disable_uni, 0, req);
3028 
3029 	(void)arg2; /* silence WARNS == 6 */
3030 	(void)oidp; /* silence WARNS == 6 */
3031 
3032 	if (!error && req->newptr && disable_uni != sc->disable_unicast_decryption) {
3033 		switch ( disable_uni ) {
3034 			case 1: case 0: case -1:
3035 				sc->disable_unicast_decryption = disable_uni;
3036 			break;
3037 		}
3038 	}
3039 	return error;
3040 }
3041 
3042 static int
3043 iwi_sysctl_disable_multicast_decryption(SYSCTL_HANDLER_ARGS)
3044 {
3045 	struct iwi_softc *sc = arg1;
3046 	int disable_mul = sc->disable_multicast_decryption;
3047 	int error = sysctl_handle_int(oidp, &disable_mul, 0, req);
3048 
3049 	(void)arg2; /* silence WARNS == 6 */
3050 	(void)oidp; /* silence WARNS == 6 */
3051 
3052 	if (!error && req->newptr && disable_mul!=sc->disable_multicast_decryption){
3053 		switch ( disable_mul ) {
3054 			case 1: case 0: case -1:
3055 				sc->disable_multicast_decryption = disable_mul;
3056 			break;
3057 		}
3058 	}
3059 	return error;
3060 }
3061 
3062 
3063