xref: /dragonfly/sys/dev/netif/iwi/if_iwi.c (revision d600454b)
1 /*
2  * Copyright (c) 2004, 2005
3  *      Damien Bergamini <damien.bergamini@free.fr>.
4  * Copyright (c) 2004, 2005
5  *      Andrew Atrens <atrens@nortelnetworks.com>.
6  *
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice unmodified, this list of conditions, and the following
14  *    disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  * $DragonFly: src/sys/dev/netif/iwi/if_iwi.c,v 1.10 2005/12/31 14:07:59 sephe Exp $
32  */
33 
34 #include "opt_inet.h"
35 
36 #include <sys/cdefs.h>
37 
38 /*-
39  * Intel(R) PRO/Wireless 2200BG/2915ABG driver
40  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
41  */
42 
43 #include <sys/param.h>
44 #include <sys/sysctl.h>
45 #include <sys/sockio.h>
46 #include <sys/mbuf.h>
47 #include <sys/kernel.h>
48 #include <sys/kthread.h>
49 #include <sys/socket.h>
50 #include <sys/systm.h>
51 #include <sys/malloc.h>
52 #include <sys/module.h>
53 #include <sys/bus.h>
54 #include <sys/endian.h>
55 #include <sys/proc.h>
56 #include <sys/ucred.h>
57 #include <sys/thread2.h>
58 
59 #include <machine/bus.h>
60 #include <machine/resource.h>
61 #include <machine/clock.h>
62 #include <sys/rman.h>
63 
64 #include <bus/pci/pcireg.h>
65 #include <bus/pci/pcivar.h>
66 
67 #include <net/bpf.h>
68 #include <net/if.h>
69 #include <net/if_arp.h>
70 #include <net/ifq_var.h>
71 #include <net/ethernet.h>
72 #include <net/if_dl.h>
73 #include <net/if_media.h>
74 #include <net/if_types.h>
75 #include <net/ifq_var.h>
76 
77 #include <netinet/in.h>
78 #include <netinet/in_systm.h>
79 #include <netinet/in_var.h>
80 #include <netinet/ip.h>
81 #include <netinet/if_ether.h>
82 
83 #ifdef IPX
84 #include <netproto/ipx/ipx.h>
85 #include <netproto/ipx/ipx_if.h>
86 #endif
87 
88 #include <netproto/802_11/ieee80211_var.h>
89 #include <netproto/802_11/ieee80211_ioctl.h>
90 #include <netproto/802_11/ieee80211_radiotap.h>
91 #include <netproto/802_11/if_wavelan_ieee.h>
92 
93 #include "if_iwireg.h"
94 #include "if_iwivar.h"
95 
96 #ifdef IWI_DEBUG
97 #define DPRINTF(x)	if (sc->debug_level > 0) printf x
98 #define DPRINTFN(n, x)	if (sc->debug_level >= (n)) printf x
99 
100 #else
101 #define DPRINTF(x)
102 #define DPRINTFN(n, x)
103 #endif
104 
105 MODULE_DEPEND(iwi, pci,  1, 1, 1);
106 MODULE_DEPEND(iwi, wlan, 1, 1, 1);
107 
108 struct iwi_dump_buffer {
109 	u_int32_t buf[128];
110 };
111 
112 struct iwi_ident {
113 	u_int16_t	vendor;
114 	u_int16_t	device;
115 	const char	*name;
116 };
117 
118 static const struct iwi_ident iwi_ident_table[] = {
119 	{ 0x8086, 0x4220, "Intel(R) PRO/Wireless 2200BG MiniPCI" },
120 	{ 0x8086, 0x4223, "Intel(R) PRO/Wireless 2915ABG MiniPCI" },
121 	{ 0x8086, 0x4224, "Intel(R) PRO/Wireless 2915ABG MiniPCI" },
122 
123 	{ 0, 0, NULL }
124 };
125 
126 static const struct ieee80211_rateset iwi_rateset_11a =
127 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
128 
129 static const struct ieee80211_rateset iwi_rateset_11b =
130 	{ 4, { 2, 4, 11, 22 } };
131 
132 static const struct ieee80211_rateset iwi_rateset_11g =
133 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
134 
135 static int		iwi_dma_alloc(struct iwi_softc *);
136 static void		iwi_release(struct iwi_softc *);
137 static int		iwi_media_change(struct ifnet *);
138 static void		iwi_media_status(struct ifnet *, struct ifmediareq *);
139 static u_int16_t	iwi_read_prom_word(struct iwi_softc *, u_int8_t);
140 static int		iwi_newstate(struct ieee80211com *,
141 			    enum ieee80211_state, int);
142 static void		iwi_fix_channel(struct iwi_softc *, struct mbuf *);
143 static void		iwi_frame_intr(struct iwi_softc *,
144 			    struct iwi_rx_buf *, int, struct iwi_frame *);
145 static void		iwi_notification_intr(struct iwi_softc *,
146 			    struct iwi_notif *);
147 static void		iwi_rx_intr(struct iwi_softc *);
148 static void		iwi_tx_intr(struct iwi_softc *);
149 static void		iwi_intr(void *);
150 static void		iwi_dma_map_buf(void *, bus_dma_segment_t *, int,
151 			    bus_size_t, int);
152 static void		iwi_dma_map_addr(void *, bus_dma_segment_t *, int, int);
153 static int		iwi_cmd(struct iwi_softc *, u_int8_t, void *, u_int8_t,
154 			    int);
155 static int		iwi_tx_start(struct ifnet *, struct mbuf *,
156 			    struct ieee80211_node *);
157 static void		iwi_start(struct ifnet *);
158 static void		iwi_watchdog(struct ifnet *);
159 static int		iwi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *cr);
160 static void		iwi_stop_master(struct iwi_softc *);
161 static int		iwi_reset(struct iwi_softc *);
162 static int		iwi_load_ucode(struct iwi_softc *, void *, int);
163 static int		iwi_load_firmware(struct iwi_softc *, void *, int);
164 static int		iwi_cache_firmware(struct iwi_softc *, void *, int);
165 static void		iwi_free_firmware(struct iwi_softc *);
166 static int		iwi_config(struct iwi_softc *);
167 static int		iwi_scan(struct iwi_softc *);
168 static int		iwi_auth_and_assoc(struct iwi_softc *);
169 static void		iwi_init(void *);
170 static void		iwi_stop(void *);
171 static void		iwi_dump_fw_event_log(struct iwi_softc *sc);
172 static void		iwi_dump_fw_error_log(struct iwi_softc *sc);
173 static u_int8_t 	iwi_find_station(struct iwi_softc *sc, u_int8_t *mac);
174 static int8_t		iwi_cache_station(struct iwi_softc *sc, u_int8_t *mac);
175 static int		iwi_adapter_config(struct iwi_softc *sc, int is_a, int cmd_wait);
176 
177 static int		iwi_sysctl_bt_coexist(SYSCTL_HANDLER_ARGS);
178 static int		iwi_sysctl_bg_autodetect(SYSCTL_HANDLER_ARGS);
179 static int		iwi_sysctl_cts_to_self(SYSCTL_HANDLER_ARGS);
180 static int		iwi_sysctl_antenna_diversity(SYSCTL_HANDLER_ARGS);
181 static int		iwi_sysctl_radio(SYSCTL_HANDLER_ARGS);
182 static int		iwi_sysctl_stats(SYSCTL_HANDLER_ARGS);
183 static int		iwi_sysctl_dump_logs(SYSCTL_HANDLER_ARGS);
184 static int		iwi_sysctl_neg_best_rates_first(SYSCTL_HANDLER_ARGS);
185 static int		iwi_sysctl_disable_unicast_decryption(SYSCTL_HANDLER_ARGS);
186 static int		iwi_sysctl_disable_multicast_decryption(SYSCTL_HANDLER_ARGS);
187 
188 static __inline u_int8_t MEM_READ_1(struct iwi_softc *sc, u_int32_t addr)
189 {
190 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
191 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
192 }
193 
194 static __inline u_int32_t MEM_READ_4(struct iwi_softc *sc, u_int32_t addr)
195 {
196 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
197 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
198 }
199 
200 static int iwi_probe(device_t);
201 static int iwi_attach(device_t);
202 static int iwi_detach(device_t);
203 static int iwi_shutdown(device_t);
204 static int iwi_suspend(device_t);
205 static int iwi_resume(device_t);
206 
207 static device_method_t iwi_methods[] = {
208 	/* Device interface */
209 	DEVMETHOD(device_probe,		iwi_probe),
210 	DEVMETHOD(device_attach,	iwi_attach),
211 	DEVMETHOD(device_detach,	iwi_detach),
212 	DEVMETHOD(device_shutdown,	iwi_shutdown),
213 	DEVMETHOD(device_suspend,	iwi_suspend),
214 	DEVMETHOD(device_resume,	iwi_resume),
215 
216 	{ 0, 0 }
217 };
218 
219 static driver_t iwi_driver = {
220 	"iwi",
221 	iwi_methods,
222 	sizeof (struct iwi_softc),
223 	0, /* baseclasses */
224 	0, /* refs */
225 	0  /* ops */
226 };
227 
228 static devclass_t iwi_devclass;
229 
230 DRIVER_MODULE(iwi, pci, iwi_driver, iwi_devclass, 0, 0);
231 
232 static int
233 iwi_probe(device_t dev)
234 {
235 	const struct iwi_ident *ident;
236 
237 	for (ident = iwi_ident_table; ident->name != NULL; ident++) {
238 		if (pci_get_vendor(dev) == ident->vendor &&
239 		    pci_get_device(dev) == ident->device) {
240 			device_set_desc(dev, ident->name);
241 			return 0;
242 		}
243 	}
244 	return ENXIO;
245 }
246 
247 static void
248 iwi_fw_monitor(void *arg)
249 {
250 	struct iwi_softc *sc = (struct iwi_softc *)arg;
251 	struct ifnet *ifp = &sc->sc_ic.ic_if;
252 	int error, boff;
253 
254 	for ( ;; ) {
255 		crit_enter();
256 		tsleep_interlock(IWI_FW_WAKE_MONITOR(sc));
257 		error = tsleep(IWI_FW_WAKE_MONITOR(sc), 0, "iwifwm", 0 );
258 		crit_exit();
259 
260 		if ( error == 0 ) {
261 			if ( sc->flags & IWI_FLAG_EXIT ) {
262 				sc->flags &= ~( IWI_FLAG_EXIT );
263 				break;
264 			} else if ( sc->flags & IWI_FLAG_RESET ) {
265 				device_printf(sc->sc_dev, "firmware reset\n");
266 				for ( boff = 1; sc->flags & IWI_FLAG_RESET ; boff++ ) {
267 					if ( sc->debug_level > 0 )
268 						iwi_dump_fw_error_log(sc);
269 					lwkt_serialize_enter(ifp->if_serializer);
270 					iwi_init(sc);
271 					lwkt_serialize_exit(ifp->if_serializer);
272 					if ((sc->flags & IWI_FLAG_FW_INITED))
273 						sc->flags &= ~( IWI_FLAG_RESET );
274 					crit_enter();
275 					tsleep_interlock(IWI_FW_CMD_ACKED(sc));
276 					error = tsleep(IWI_FW_CMD_ACKED(sc), 0,
277 						       "iwirun", boff * hz );
278 					crit_exit();
279 				}
280 			}
281 		}
282 	}
283 	wakeup(IWI_FW_MON_EXIT(sc));
284 	kthread_exit();
285 }
286 
287 static int
288 iwi_start_fw_monitor_thread( struct iwi_softc *sc )
289 {
290        if (kthread_create(iwi_fw_monitor, sc, &sc->event_thread,
291 		"%s%d:fw-monitor", device_get_name(sc->sc_dev),
292 		device_get_unit(sc->sc_dev))) {
293 		device_printf (sc->sc_dev,
294 		   "unable to create firmware monitor thread.\n");
295 		return -1;
296 	}
297 	return 0;
298 }
299 
300 /* Base Address Register */
301 #define IWI_PCI_BAR0	0x10
302 
303 static int
304 iwi_attach(device_t dev)
305 {
306 	struct iwi_softc *sc = device_get_softc(dev);
307 	struct ieee80211com *ic = &sc->sc_ic;
308 	struct ifnet *ifp = &ic->ic_if;
309 	u_int16_t val;
310 	int error, rid, i;
311 
312 	sc->sc_dev = dev;
313 
314 	if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
315 		device_printf(dev, "chip is in D%d power mode "
316 		    "-- setting to D0\n", pci_get_powerstate(dev));
317 		pci_set_powerstate(dev, PCI_POWERSTATE_D0);
318 	}
319 
320 	pci_write_config(dev, 0x41, 0, 1);
321 
322 	/* enable bus-mastering */
323 	pci_enable_busmaster(dev);
324 
325 	sc->num_stations = 0;
326 
327 	/* map the register window */
328 	rid = IWI_PCI_BAR0;
329 	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid, RF_ACTIVE);
330 	if (sc->mem == NULL) {
331 		device_printf(dev, "could not allocate memory resource\n");
332 		error = ENXIO;
333 		goto fail;
334 	}
335 
336 	sc->sc_st = rman_get_bustag(sc->mem);
337 	sc->sc_sh = rman_get_bushandle(sc->mem);
338 
339 	rid = 0;
340 	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
341 	    RF_SHAREABLE);
342 	if (sc->irq == NULL) {
343 		device_printf(dev, "could not allocate interrupt resource\n");
344 		error = ENXIO;
345 		goto fail;
346 	}
347 
348 	error = iwi_reset(sc);
349 	if (error != 0) {
350 		device_printf(dev, "could not reset adapter\n");
351 		goto fail;
352 	}
353 
354 	if (iwi_start_fw_monitor_thread(sc)) {
355 		device_printf(dev, "could not start f/w reset thread\n");
356 		error = ENXIO;
357 		goto fail;
358 	}
359 
360 	error = iwi_dma_alloc(sc);
361 	if (error != 0) {
362 		device_printf(dev, "could not allocate DMA resources\n");
363 		goto fail;
364 	}
365 
366 	ic->ic_phytype = IEEE80211_T_OFDM;
367 	ic->ic_opmode  = IEEE80211_M_STA;
368 	ic->ic_state   = IEEE80211_S_INIT;
369 
370 	/* set device capabilities */
371 	ic->ic_caps = IEEE80211_C_IBSS | IEEE80211_C_PMGT | IEEE80211_C_WEP |
372 	    IEEE80211_C_TXPMGT | IEEE80211_C_SHPREAMBLE;
373 
374 	/* read MAC address from EEPROM */
375 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
376 	ic->ic_myaddr[0] = val >> 8;
377 	ic->ic_myaddr[1] = val & 0xff;
378 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
379 	ic->ic_myaddr[2] = val >> 8;
380 	ic->ic_myaddr[3] = val & 0xff;
381 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
382 	ic->ic_myaddr[4] = val >> 8;
383 	ic->ic_myaddr[5] = val & 0xff;
384 
385 	if (pci_get_device(dev) != 0x4220) {
386 		/* set supported .11a rates */
387 		ic->ic_sup_rates[IEEE80211_MODE_11A] = iwi_rateset_11a;
388 
389 		/* set supported .11a channels */
390 		for (i = 36; i <= 64; i += 4) {
391 			ic->ic_channels[i].ic_freq =
392 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
393 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
394 		}
395 		for (i = 149; i <= 165; i += 4) {
396 			ic->ic_channels[i].ic_freq =
397 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
398 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
399 		}
400 	}
401 
402 	/* set supported .11b and .11g rates */
403 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwi_rateset_11b;
404 	ic->ic_sup_rates[IEEE80211_MODE_11G] = iwi_rateset_11g;
405 
406 	/* set supported .11b and .11g channels (1 through 14) */
407 	for (i = 1; i <= 14; i++) {
408 		ic->ic_channels[i].ic_freq =
409 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
410 		ic->ic_channels[i].ic_flags =
411 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
412 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
413 	}
414 
415 	/* default to authmode OPEN */
416 	sc->authmode = IEEE80211_AUTH_OPEN;
417 
418 	/* IBSS channel undefined for now */
419 	ic->ic_ibss_chan = &ic->ic_channels[0];
420 
421 	ifp->if_softc = sc;
422 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
423 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
424 	ifp->if_init = iwi_init;
425 	ifp->if_ioctl = iwi_ioctl;
426 	ifp->if_start = iwi_start;
427 	ifp->if_watchdog = iwi_watchdog;
428 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
429 	ifq_set_ready(&ifp->if_snd);
430 
431 	ieee80211_ifattach(ifp);
432 	/* override state transition machine */
433 	sc->sc_newstate = ic->ic_newstate;
434 	ic->ic_newstate = iwi_newstate;
435 	ieee80211_media_init(ifp, iwi_media_change, iwi_media_status);
436 
437 	bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
438 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
439 
440 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
441 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
442 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
443 
444 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
445 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
446 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
447 
448 	/*
449 	 * Add sysctl knobs
450 	 *
451 	 * use -1 to indicate 'default / not set'
452 	 */
453 
454 	sc->enable_bg_autodetect         = -1;
455 	sc->enable_bt_coexist            = -1;
456 	sc->enable_cts_to_self           = -1;
457 	sc->antenna_diversity            = -1;
458 	sc->enable_neg_best_first        = -1;
459 	sc->disable_unicast_decryption   = -1;
460 	sc->disable_multicast_decryption = -1;
461 
462 	sysctl_ctx_init(&sc->sysctl_ctx);
463 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
464 				SYSCTL_STATIC_CHILDREN(_hw),
465 				OID_AUTO,
466 				device_get_nameunit(dev),
467 				CTLFLAG_RD,
468 				0, "");
469 
470 	if (sc->sysctl_tree == NULL) {
471 		device_printf(dev, "sysctl add node failed\n");
472 		error = EIO;
473 		goto fail2;
474 	}
475 
476 	SYSCTL_ADD_INT(&sc->sysctl_ctx, SYSCTL_CHILDREN(sc->sysctl_tree),
477 		       OID_AUTO, "debug", CTLFLAG_RW, &sc->debug_level, 0,
478 		      "Set driver debug level (0 = off)");
479 
480 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
481 			SYSCTL_CHILDREN(sc->sysctl_tree),
482 			OID_AUTO, "cts_to_self", CTLTYPE_INT|CTLFLAG_RW,
483 			(void *)sc, 0, iwi_sysctl_cts_to_self, "I",
484 			"Enable cts to self [0 = Off] [1 = On] [-1 = Auto]" );
485 
486 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
487 			SYSCTL_CHILDREN(sc->sysctl_tree),
488 			OID_AUTO, "antenna_diversity", CTLTYPE_INT|CTLFLAG_RW,
489 			(void *)sc, 0, iwi_sysctl_antenna_diversity,
490 			"I", "Set antenna diversity [0 = Both] "
491 			"[1 = Antenna A] [3 = Antenna B] [-1 = Auto]" );
492 
493 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
494 			SYSCTL_CHILDREN(sc->sysctl_tree),
495 			OID_AUTO, "bluetooth_coexist", CTLTYPE_INT|CTLFLAG_RW,
496 			(void *)sc, 0, iwi_sysctl_bt_coexist,
497 			"I", "Enable bluetooth coexistence heuristics "
498 			"[0 = Off] [1 = On] [-1 = Auto]" );
499 
500 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
501 			SYSCTL_CHILDREN(sc->sysctl_tree),
502 			OID_AUTO, "bg_autodetect", CTLTYPE_INT|CTLFLAG_RW,
503 			(void *)sc, 0, iwi_sysctl_bg_autodetect,
504 			"I", "Set b/g autodetect [0 = Off] [1 = On] [-1 = Auto]" );
505 
506 
507 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
508 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "radio",
509 			CTLTYPE_INT | CTLFLAG_RD, sc, 0, iwi_sysctl_radio, "I",
510 			"Radio transmitter switch");
511 
512 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
513 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "stats",
514 			CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, iwi_sysctl_stats,
515 			"S,iwi_dump_buffer", "statistics");
516 
517 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
518 			SYSCTL_CHILDREN(sc->sysctl_tree),
519 			OID_AUTO, "firmware_logs", CTLTYPE_INT|CTLFLAG_RW,
520 			(void *)sc, 0, iwi_sysctl_dump_logs, "I", "Dump firmware logs");
521 
522 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
523 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
524 			"neg_best_rates_first",
525 			CTLTYPE_INT | CTLFLAG_RW, sc, 0,
526 			iwi_sysctl_neg_best_rates_first, "I",
527 			 "Negotiate highest rates first.");
528 
529 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
530 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
531 			"disable_unicast_decrypt",
532 			CTLTYPE_INT | CTLFLAG_RW, sc, 0,
533 			iwi_sysctl_disable_unicast_decryption, "I",
534 			 "Disable unicast decryption.");
535 
536 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
537 			SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
538 			"disable_multicast_decrypt",
539 			CTLTYPE_INT | CTLFLAG_RW, sc, 0,
540 			iwi_sysctl_disable_multicast_decryption, "I",
541 			 "Disable multicast decryption.");
542 
543 	/*
544 	 * Hook our interrupt after all initialization is complete
545 	 */
546 	error = bus_setup_intr(dev, sc->irq, INTR_MPSAFE,
547 			       iwi_intr, sc, &sc->sc_ih, ifp->if_serializer);
548 	if (error != 0) {
549 		device_printf(dev, "could not set up interrupt\n");
550 		goto fail2;
551 	}
552 
553 	return 0;
554 
555 fail2:
556 	bpfdetach(ifp);
557 	ieee80211_ifdetach(ifp);
558 fail:
559 	iwi_detach(dev);
560 	return error;
561 }
562 
563 static int
564 iwi_detach(device_t dev)
565 {
566 	struct iwi_softc *sc = device_get_softc(dev);
567 	struct ifnet *ifp = &sc->sc_ic.ic_if;
568 
569 	sc->flags |= IWI_FLAG_EXIT;
570 	wakeup(IWI_FW_WAKE_MONITOR(sc)); /* Stop firmware monitor. */
571 
572 	tsleep(IWI_FW_MON_EXIT(sc), 0, "iwiexi", 10 * hz);
573 
574 	if (device_is_attached(dev)) {
575 		lwkt_serialize_enter(ifp->if_serializer);
576 		iwi_stop(sc);
577 		iwi_free_firmware(sc);
578 		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
579 		lwkt_serialize_exit(ifp->if_serializer);
580 
581 		bpfdetach(ifp);
582 		ieee80211_ifdetach(ifp);
583 	}
584 
585 	if (sc->sysctl_tree) {
586 		sysctl_ctx_free(&sc->sysctl_ctx);
587 		sc->sysctl_tree = 0;
588 	}
589 
590 	if (sc->irq != NULL)
591 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq);
592 
593 	if (sc->mem != NULL) {
594 		bus_release_resource(dev, SYS_RES_MEMORY, IWI_PCI_BAR0,
595 		    sc->mem);
596 	}
597 
598 	iwi_release(sc);
599 
600 	return 0;
601 }
602 
603 static int
604 iwi_dma_alloc(struct iwi_softc *sc)
605 {
606 	int i, error;
607 
608 	error = bus_dma_tag_create(NULL, /* parent */
609 				   1, 0,
610 				   BUS_SPACE_MAXADDR_32BIT,
611 				   BUS_SPACE_MAXADDR,
612 				   NULL, NULL,
613 				   MAXBSIZE, 128,
614 				   BUS_SPACE_MAXSIZE_32BIT,
615 				   BUS_DMA_ALLOCNOW,
616 				   &sc->iwi_parent_tag );
617 	if (error != 0) {
618 		device_printf(sc->sc_dev, "could not create parent tag\n");
619 		goto fail;
620 	}
621 	/*
622 	 * Allocate and map Tx ring
623 	 */
624 	error = bus_dma_tag_create(sc->iwi_parent_tag, 4, 0, BUS_SPACE_MAXADDR_32BIT,
625 	    BUS_SPACE_MAXADDR, NULL, NULL,
626 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_SIZE, 1,
627 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_SIZE,
628 	    BUS_DMA_ALLOCNOW, &sc->tx_ring_dmat);
629 	if (error != 0) {
630 		device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
631 		goto fail;
632 	}
633 
634 	error = bus_dmamem_alloc(sc->tx_ring_dmat,(void **) &sc->tx_desc,
635 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->tx_ring_map);
636 	if (error != 0) {
637 		device_printf(sc->sc_dev,
638 		    "could not allocate tx ring DMA memory\n");
639 		goto fail;
640 	}
641 
642 	error = bus_dmamap_load(sc->tx_ring_dmat, sc->tx_ring_map,
643 	    sc->tx_desc, sizeof (struct iwi_tx_desc) * IWI_TX_RING_SIZE,
644 	    iwi_dma_map_addr, &sc->tx_ring_pa, 0);
645 	if (error != 0) {
646 		device_printf(sc->sc_dev, "could not load tx ring DMA map\n");
647 		goto fail;
648 	}
649 
650 	/*
651 	 * Allocate and map command ring
652 	 */
653 	error = bus_dma_tag_create(sc->iwi_parent_tag, 4, 0, BUS_SPACE_MAXADDR_32BIT,
654 	    BUS_SPACE_MAXADDR, NULL, NULL,
655 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_SIZE, 1,
656 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_SIZE,
657 	    BUS_DMA_ALLOCNOW,
658 	    &sc->cmd_ring_dmat);
659 	if (error != 0) {
660 		device_printf(sc->sc_dev,
661 		    "could not create command ring DMA tag\n");
662 		goto fail;
663 	}
664 
665 	error = bus_dmamem_alloc(sc->cmd_ring_dmat, (void **)&sc->cmd_desc,
666 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &sc->cmd_ring_map);
667 	if (error != 0) {
668 		device_printf(sc->sc_dev,
669 		    "could not allocate command ring DMA memory\n");
670 		goto fail;
671 	}
672 
673 	error = bus_dmamap_load(sc->cmd_ring_dmat, sc->cmd_ring_map,
674 	    sc->cmd_desc, sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_SIZE,
675 	    iwi_dma_map_addr, &sc->cmd_ring_pa, 0);
676 	if (error != 0) {
677 		device_printf(sc->sc_dev,
678 		    "could not load command ring DMA map\n");
679 		goto fail;
680 	}
681 
682 	/*
683 	 * Allocate Tx buffers DMA maps
684 	 */
685 	error = bus_dma_tag_create(sc->iwi_parent_tag, 1, 0, BUS_SPACE_MAXADDR_32BIT,
686 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IWI_MAX_NSEG, MCLBYTES,
687 	    BUS_DMA_ALLOCNOW, &sc->tx_buf_dmat);
688 	if (error != 0) {
689 		device_printf(sc->sc_dev, "could not create tx buf DMA tag\n");
690 		goto fail;
691 	}
692 
693 	for (i = 0; i < IWI_TX_RING_SIZE; i++) {
694 		error = bus_dmamap_create(sc->tx_buf_dmat, 0,
695 		    &sc->tx_buf[i].map);
696 		if (error != 0) {
697 			device_printf(sc->sc_dev,
698 			    "could not create tx buf DMA map");
699 			goto fail;
700 		}
701 	}
702 
703 	/*
704 	 * Allocate and map Rx buffers
705 	 */
706 	error = bus_dma_tag_create(sc->iwi_parent_tag, 1, 0, BUS_SPACE_MAXADDR_32BIT,
707 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES,
708 	    BUS_DMA_ALLOCNOW, &sc->rx_buf_dmat);
709 	if (error != 0) {
710 		device_printf(sc->sc_dev, "could not create rx buf DMA tag\n");
711 		goto fail;
712 	}
713 
714 	for (i = 0; i < IWI_RX_RING_SIZE; i++) {
715 
716 		error = bus_dmamap_create(sc->rx_buf_dmat, 0,
717 		    &sc->rx_buf[i].map);
718 		if (error != 0) {
719 			device_printf(sc->sc_dev,
720 			    "could not create rx buf DMA map");
721 			goto fail;
722 		}
723 
724 		sc->rx_buf[i].m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
725 		if (sc->rx_buf[i].m == NULL) {
726 			device_printf(sc->sc_dev,
727 			    "could not allocate rx mbuf\n");
728 			error = ENOMEM;
729 			goto fail;
730 		}
731 
732 		error = bus_dmamap_load(sc->rx_buf_dmat, sc->rx_buf[i].map,
733 		    mtod(sc->rx_buf[i].m, void *), MCLBYTES, iwi_dma_map_addr,
734 		    &sc->rx_buf[i].physaddr, 0);
735 		if (error != 0) {
736 			device_printf(sc->sc_dev,
737 			    "could not load rx buf DMA map");
738 			goto fail;
739 		}
740 	}
741 
742 	return 0;
743 
744 fail:	iwi_release(sc);
745 	return error;
746 }
747 
748 static void
749 iwi_release(struct iwi_softc *sc)
750 {
751 	int i;
752 
753 	if (sc->tx_ring_dmat != NULL) {
754 		if (sc->tx_desc != NULL) {
755 			bus_dmamap_sync(sc->tx_ring_dmat, sc->tx_ring_map,
756 			    BUS_DMASYNC_POSTWRITE);
757 			bus_dmamap_unload(sc->tx_ring_dmat, sc->tx_ring_map);
758 			bus_dmamem_free(sc->tx_ring_dmat, sc->tx_desc,
759 			    sc->tx_ring_map);
760 		}
761 		bus_dma_tag_destroy(sc->tx_ring_dmat);
762 	}
763 
764 	if (sc->cmd_ring_dmat != NULL) {
765 		if (sc->cmd_desc != NULL) {
766 			bus_dmamap_sync(sc->cmd_ring_dmat, sc->cmd_ring_map,
767 			    BUS_DMASYNC_POSTWRITE);
768 			bus_dmamap_unload(sc->cmd_ring_dmat, sc->cmd_ring_map);
769 			bus_dmamem_free(sc->cmd_ring_dmat, sc->cmd_desc,
770 			    sc->cmd_ring_map);
771 		}
772 		bus_dma_tag_destroy(sc->cmd_ring_dmat);
773 	}
774 
775 	if (sc->tx_buf_dmat != NULL) {
776 		for (i = 0; i < IWI_TX_RING_SIZE; i++) {
777 			if (sc->tx_buf[i].m != NULL) {
778 				bus_dmamap_sync(sc->tx_buf_dmat,
779 				    sc->tx_buf[i].map, BUS_DMASYNC_POSTWRITE);
780 				bus_dmamap_unload(sc->tx_buf_dmat,
781 				    sc->tx_buf[i].map);
782 				m_freem(sc->tx_buf[i].m);
783 			}
784 			bus_dmamap_destroy(sc->tx_buf_dmat, sc->tx_buf[i].map);
785 		}
786 		bus_dma_tag_destroy(sc->tx_buf_dmat);
787 	}
788 
789 	if (sc->rx_buf_dmat != NULL) {
790 		for (i = 0; i < IWI_RX_RING_SIZE; i++) {
791 			if (sc->rx_buf[i].m != NULL) {
792 				bus_dmamap_sync(sc->rx_buf_dmat,
793 				    sc->rx_buf[i].map, BUS_DMASYNC_POSTREAD);
794 				bus_dmamap_unload(sc->rx_buf_dmat,
795 				    sc->rx_buf[i].map);
796 				m_freem(sc->rx_buf[i].m);
797 			}
798 			bus_dmamap_destroy(sc->rx_buf_dmat, sc->rx_buf[i].map);
799 		}
800 		bus_dma_tag_destroy(sc->rx_buf_dmat);
801 	}
802 	if ( sc->iwi_parent_tag != NULL ) {
803 		bus_dma_tag_destroy(sc->iwi_parent_tag);
804 	}
805 }
806 
807 static int
808 iwi_shutdown(device_t dev)
809 {
810 	struct iwi_softc *sc = device_get_softc(dev);
811 	struct ifnet *ifp = &sc->sc_ic.ic_if;
812 
813 	lwkt_serialize_enter(ifp->if_serializer);
814 	iwi_stop(sc);
815 	lwkt_serialize_exit(ifp->if_serializer);
816 
817 	return 0;
818 }
819 
820 static int
821 iwi_suspend(device_t dev)
822 {
823 	struct iwi_softc *sc = device_get_softc(dev);
824 	struct ifnet *ifp = &sc->sc_ic.ic_if;
825 
826 	lwkt_serialize_enter(ifp->if_serializer);
827 	iwi_stop(sc);
828 	lwkt_serialize_exit(ifp->if_serializer);
829 
830 	return 0;
831 }
832 
833 static int
834 iwi_resume(device_t dev)
835 {
836 	struct iwi_softc *sc = device_get_softc(dev);
837 	struct ifnet *ifp = &sc->sc_ic.ic_if;
838 
839 	lwkt_serialize_enter(ifp->if_serializer);
840 	pci_write_config(dev, 0x41, 0, 1);
841 
842 	if (ifp->if_flags & IFF_UP) {
843 		ifp->if_init(ifp->if_softc);
844 		if (ifp->if_flags & IFF_RUNNING)
845 			ifp->if_start(ifp);
846 	}
847 	lwkt_serialize_exit(ifp->if_serializer);
848 	return 0;
849 }
850 
851 static int
852 iwi_media_change(struct ifnet *ifp)
853 {
854 	struct iwi_softc *sc = ifp->if_softc;
855 	int error = 0;
856 
857 	error = ieee80211_media_change(ifp);
858 	if (error != ENETRESET) {
859 		return error;
860 	}
861 	error = 0; /* clear ENETRESET */
862 
863 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING)){
864 		iwi_init(sc);
865 		error = tsleep( IWI_FW_CMD_ACKED(sc), 0, "iwirun", hz );
866 	}
867 	return error;
868 }
869 
870 static void
871 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
872 {
873 	struct iwi_softc *sc = ifp->if_softc;
874 	struct ieee80211com *ic = &sc->sc_ic;
875 #define N(a)	(sizeof (a) / sizeof (a[0]))
876 	static const struct {
877 		u_int32_t	val;
878 		int		rate;
879 	} rates[] = {
880 		{ IWI_RATE_DS1,      2 },
881 		{ IWI_RATE_DS2,      4 },
882 		{ IWI_RATE_DS5,     11 },
883 		{ IWI_RATE_DS11,    22 },
884 		{ IWI_RATE_OFDM6,   12 },
885 		{ IWI_RATE_OFDM9,   18 },
886 		{ IWI_RATE_OFDM12,  24 },
887 		{ IWI_RATE_OFDM18,  36 },
888 		{ IWI_RATE_OFDM24,  48 },
889 		{ IWI_RATE_OFDM36,  72 },
890 		{ IWI_RATE_OFDM48,  96 },
891 		{ IWI_RATE_OFDM54, 108 },
892 	};
893 	u_int32_t val, i;
894 	int rate;
895 
896 	imr->ifm_status = IFM_AVALID;
897 	imr->ifm_active = IFM_IEEE80211;
898 	if (ic->ic_state == IEEE80211_S_RUN)
899 		imr->ifm_status |= IFM_ACTIVE;
900 
901 	/* read current transmission rate from adapter */
902 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
903 
904 	/* convert rate to 802.11 rate */
905 	for (i = 0; i < N(rates) && rates[i].val != val ; i++);
906 	rate = (i < N(rates)) ? rates[i].rate : 0;
907 
908 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
909 	switch (ic->ic_opmode) {
910 	case IEEE80211_M_STA:
911 		break;
912 
913 	case IEEE80211_M_IBSS:
914 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
915 		break;
916 
917 	case IEEE80211_M_MONITOR:
918 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
919 		break;
920 
921 	case IEEE80211_M_AHDEMO:
922 	case IEEE80211_M_HOSTAP:
923 		/* should not get there */
924 		break;
925 	}
926 #undef N
927 }
928 
929 static int
930 iwi_disassociate( struct iwi_softc *sc  )
931 {
932 	sc->assoc.type = 2; /* DISASSOCIATE */
933 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &sc->assoc, sizeof sc->assoc, 0);
934 }
935 
936 
937 static int
938 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg __unused)
939 {
940 	struct iwi_softc *sc = ic->ic_softc;
941 	struct ifnet *ifp = &ic->ic_if;
942 
943 	ASSERT_SERIALIZED(ifp->if_serializer);
944 
945 	switch (nstate) {
946 	case IEEE80211_S_SCAN:
947 		if (sc->flags & IWI_FLAG_ASSOCIATED) {
948 			sc->flags &= ~( IWI_FLAG_ASSOCIATED );
949 			iwi_disassociate(sc);
950 
951 			crit_enter();
952 			tsleep_interlock(IWI_FW_DEASSOCIATED(sc));
953 			lwkt_serialize_exit(ifp->if_serializer);
954 			tsleep(IWI_FW_DEASSOCIATED(sc), 0, "iwisca", hz );
955 			crit_exit();
956 			lwkt_serialize_enter(ifp->if_serializer);
957 		}
958 		if ( !(sc->flags & IWI_FLAG_SCANNING) &&
959 		     !(sc->flags & IWI_FLAG_RF_DISABLED) ) {
960 			iwi_scan(sc);
961 		}
962 		break;
963 
964 	case IEEE80211_S_AUTH:
965 		if ( sc->flags & IWI_FLAG_ASSOCIATED ) {
966 			sc->flags &= ~( IWI_FLAG_ASSOCIATED );
967 			iwi_disassociate(sc);
968 
969 			crit_enter();
970 			tsleep_interlock(IWI_FW_DEASSOCIATED(sc));
971 			lwkt_serialize_exit(ifp->if_serializer);
972 			tsleep(IWI_FW_DEASSOCIATED(sc), 0, "iwiaut", hz );
973 			crit_exit();
974 			lwkt_serialize_enter(ifp->if_serializer);
975 		}
976 		if ( iwi_auth_and_assoc(sc) != 0 )
977 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
978 		break;
979 
980 	case IEEE80211_S_RUN:
981 		if (sc->flags & IWI_FLAG_SCAN_COMPLETE) {
982 			sc->flags &= ~(IWI_FLAG_SCAN_COMPLETE);
983 			if (ic->ic_opmode == IEEE80211_M_IBSS ||
984 			    ic->ic_opmode == IEEE80211_M_MONITOR ) {
985 				/*
986 				 * In IBSS mode, following an end_scan
987 				 * the ieee80211 stack state machine transitions
988 				 * straight to 'run' state. This is out of
989 				 * step with the firmware which requires
990 				 * an association first. Flip our state from
991 				 * RUN back to AUTH to allow us to tell the
992 				 * firmware to associate.
993 				 */
994 				ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
995 			}
996 		}
997 		break;
998 
999 	case IEEE80211_S_ASSOC:
1000 		break;
1001 	case IEEE80211_S_INIT:
1002 		sc->flags &= ~( IWI_FLAG_SCANNING | IWI_FLAG_ASSOCIATED );
1003 		break;
1004 	}
1005 
1006 	ic->ic_state = nstate;
1007 	return 0;
1008 }
1009 
1010 /*
1011  * Read 16 bits at address 'addr' from the serial EEPROM.
1012  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
1013  */
1014 static u_int16_t
1015 iwi_read_prom_word(struct iwi_softc *sc, u_int8_t addr)
1016 {
1017 	u_int32_t tmp;
1018 	u_int16_t val;
1019 	int n;
1020 
1021 	/* Clock C once before the first command */
1022 	IWI_EEPROM_CTL(sc, 0);
1023 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1024 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1025 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1026 
1027 	/* Write start bit (1) */
1028 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1029 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1030 
1031 	/* Write READ opcode (10) */
1032 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1033 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1034 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1035 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1036 
1037 	/* Write address A7-A0 */
1038 	for (n = 7; n >= 0; n--) {
1039 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1040 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
1041 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1042 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
1043 	}
1044 
1045 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1046 
1047 	/* Read data Q15-Q0 */
1048 	val = 0;
1049 	for (n = 15; n >= 0; n--) {
1050 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1051 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1052 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
1053 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
1054 	}
1055 
1056 	IWI_EEPROM_CTL(sc, 0);
1057 
1058 	/* Clear Chip Select and clock C */
1059 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1060 	IWI_EEPROM_CTL(sc, 0);
1061 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
1062 
1063 	return be16toh(val);
1064 }
1065 
1066 /*
1067  * XXX: Hack to set the current channel to the value advertised in beacons or
1068  * probe responses. Only used during AP detection.
1069  */
1070 static void
1071 iwi_fix_channel(struct iwi_softc *sc, struct mbuf *m)
1072 {
1073 	struct ieee80211com *ic = &sc->sc_ic;
1074 	struct ieee80211_frame *wh;
1075 	u_int8_t subtype;
1076 	u_int8_t *frm, *efrm;
1077 
1078 	wh = mtod(m, struct ieee80211_frame *);
1079 
1080 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
1081 		return;
1082 
1083 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1084 
1085 	if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
1086 	    subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1087 		return;
1088 
1089 	/*
1090 	 * Cache station entries from beacons and probes.
1091 	 */
1092 	if ( iwi_find_station(sc, wh->i_addr2) == 0xff )
1093 		iwi_cache_station(sc, wh->i_addr2);
1094 
1095 	frm = (u_int8_t *)(wh + 1);
1096 	efrm = mtod(m, u_int8_t *) + m->m_len;
1097 
1098 	frm += 12;	/* skip tstamp, bintval and capinfo fields */
1099 #if 0
1100 	{ /* XXX - debugging code */
1101 		u_int8_t *ptr;
1102 		u_int32_t cnt;
1103 		printf("Frame -->");
1104 		for ( ptr = frm, cnt = 0 ; ptr < efrm ; ptr++, cnt++ ) {
1105 			if ( cnt % 8 == 0 )
1106 				printf("\n");
1107 			printf("0x%-2.2x ", *ptr);
1108 		}
1109 		printf("<-- End Frame\n");
1110 	}
1111 #endif
1112 
1113 	while (frm < efrm) {
1114 		if (*frm == IEEE80211_ELEMID_DSPARMS)
1115 #if IEEE80211_CHAN_MAX < 255
1116 		if (frm[2] <= IEEE80211_CHAN_MAX)
1117 #endif
1118 			ic->ic_bss->ni_chan = &ic->ic_channels[frm[2]];
1119 
1120 		frm += frm[1] + 2; /* advance to the next tag */
1121 	}
1122 }
1123 
1124 static void
1125 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_buf *buf, int i,
1126     struct iwi_frame *frame)
1127 {
1128 	struct ieee80211com *ic = &sc->sc_ic;
1129 	struct ifnet *ifp = &ic->ic_if;
1130 	struct mbuf *m;
1131 	struct ieee80211_frame *wh;
1132 	struct ieee80211_node *ni;
1133 	int error;
1134 
1135 	DPRINTFN(5, ("RX!DATA!%u!%u!%u\n", le16toh(frame->len), frame->chan,
1136 	    frame->rssi_dbm));
1137 
1138 	if (le16toh(frame->len) < sizeof (struct ieee80211_frame_min) ||
1139 	    le16toh(frame->len) > MCLBYTES) {
1140 		device_printf(sc->sc_dev, "bad frame length\n");
1141 		return;
1142 	}
1143 
1144 	bus_dmamap_unload(sc->rx_buf_dmat, buf->map);
1145 
1146 	/* Finalize mbuf */
1147 	m = buf->m;
1148 	m->m_pkthdr.rcvif = ifp;
1149 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
1150 	    sizeof (struct iwi_frame) + le16toh(frame->len);
1151 
1152 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
1153 
1154 	wh = mtod(m, struct ieee80211_frame *);
1155 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1156 		/*
1157 		 * Hardware decrypts the frame itself but leaves the WEP bit
1158 		 * set in the 802.11 header and don't remove the iv and crc
1159 		 * fields
1160 		 */
1161 		wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1162 		bcopy(wh, (char *)wh + IEEE80211_WEP_IVLEN +
1163 		    IEEE80211_WEP_KIDLEN, sizeof (struct ieee80211_frame));
1164 		m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1165 		m_adj(m, -IEEE80211_WEP_CRCLEN);
1166 		wh = mtod(m, struct ieee80211_frame *);
1167 	}
1168 
1169 	if (sc->sc_drvbpf != NULL) {
1170 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
1171 
1172 		tap->wr_flags = 0;
1173 		tap->wr_rate = frame->rate;
1174 		tap->wr_chan_freq =
1175 		    htole16(ic->ic_channels[frame->chan].ic_freq);
1176 		tap->wr_chan_flags =
1177 		    htole16(ic->ic_channels[frame->chan].ic_flags);
1178 		tap->wr_antsignal = frame->signal;
1179 		tap->wr_antnoise = frame->noise;
1180 		tap->wr_antenna = frame->antenna;
1181 
1182 		bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1183 	}
1184 
1185 	if (ic->ic_state == IEEE80211_S_SCAN)
1186 		iwi_fix_channel(sc, m);
1187 
1188 	if (ic->ic_opmode != IEEE80211_M_STA) {
1189 		ni = ieee80211_find_node(ic, wh->i_addr2);
1190 		if (ni == NULL)
1191 			ni = ieee80211_ref_node(ic->ic_bss);
1192 	} else
1193 		ni = ieee80211_ref_node(ic->ic_bss);
1194 
1195 	/* Send the frame to the upper layer */
1196 	ieee80211_input(ifp, m, ni, IWI_RSSIDBM2RAW(frame->rssi_dbm), 0);
1197 
1198 	if (ni == ic->ic_bss)
1199 		ieee80211_unref_node(&ni);
1200 	else
1201 		ieee80211_free_node(ic, ni);
1202 
1203 	buf->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1204 	if (buf->m == NULL) {
1205 		device_printf(sc->sc_dev, "could not allocate rx mbuf\n");
1206 		return;
1207 	}
1208 
1209 	error = bus_dmamap_load(sc->rx_buf_dmat, buf->map, mtod(buf->m, void *),
1210 	    MCLBYTES, iwi_dma_map_addr, &buf->physaddr, 0);
1211 	if (error != 0) {
1212 		device_printf(sc->sc_dev, "could not load rx buf DMA map\n");
1213 		m_freem(buf->m);
1214 		buf->m = NULL;
1215 		return;
1216 	}
1217 
1218 	CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4, buf->physaddr);
1219 }
1220 
1221 static void
1222 iwi_notification_intr(struct iwi_softc *sc, struct iwi_notif *notif)
1223 {
1224 	struct ieee80211com *ic = &sc->sc_ic;
1225 	struct ifnet *ifp = &ic->ic_if;
1226 	struct iwi_notif_scan_channel *chan;
1227 	struct iwi_notif_scan_complete *scan;
1228 	struct iwi_notif_authentication *auth;
1229 	struct iwi_notif_association *assoc;
1230 
1231 	switch (notif->type) {
1232 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
1233 		chan = (struct iwi_notif_scan_channel *)(notif + 1);
1234 
1235 		DPRINTFN(2, ("Scan channel (%u)\n", chan->nchan));
1236 		break;
1237 
1238 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
1239 		scan = (struct iwi_notif_scan_complete *)(notif + 1);
1240 
1241 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
1242 		    scan->status));
1243 
1244 		sc->flags &= ~(IWI_FLAG_SCANNING);
1245 		sc->flags |= IWI_FLAG_SCAN_COMPLETE;
1246 
1247 		if ( sc->flags & IWI_FLAG_SCAN_ABORT )
1248 			sc->flags &= ~(IWI_FLAG_SCAN_ABORT);
1249 		else
1250 			ieee80211_end_scan(ifp);
1251 		wakeup(IWI_FW_SCAN_COMPLETED(sc));
1252 		break;
1253 
1254 	case IWI_NOTIF_TYPE_AUTHENTICATION:
1255 		auth = (struct iwi_notif_authentication *)(notif + 1);
1256 
1257 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1258 
1259 		switch (auth->state) {
1260 		case IWI_AUTHENTICATED:
1261 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1262 			break;
1263 
1264 		case IWI_DEAUTHENTICATED:
1265 			ieee80211_begin_scan(ifp);/* not necessary */
1266 			break;
1267 
1268 		default:
1269 			device_printf(sc->sc_dev,
1270 			    "unknown authentication state %u\n", auth->state);
1271 		}
1272 		break;
1273 
1274 	case IWI_NOTIF_TYPE_ASSOCIATION:
1275 		assoc = (struct iwi_notif_association *)(notif + 1);
1276 
1277 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1278 		    assoc->status));
1279 
1280 		switch (assoc->state) {
1281 		case IWI_ASSOCIATED:
1282 			sc->flags |= IWI_FLAG_ASSOCIATED;
1283 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1284 			break;
1285 
1286 		case IWI_DEASSOCIATED:
1287 			sc->flags &= ~(IWI_FLAG_ASSOCIATED);
1288 			wakeup(IWI_FW_DEASSOCIATED(sc));
1289 			ieee80211_begin_scan(ifp);/* probably not necessary */
1290 			break;
1291 
1292 		default:
1293 			device_printf(sc->sc_dev,
1294 			    "unknown association state %u\n", assoc->state);
1295 		}
1296 		break;
1297 
1298 	case IWI_NOTIF_TYPE_CALIBRATION:
1299 		DPRINTFN(5, ("Notification calib (%u)\n", notif->type));
1300 		break;
1301 	case IWI_NOTIF_TYPE_BEACON:
1302 		DPRINTFN(5, ("Notification beacon (%u)\n", notif->type));
1303 		break;
1304 	case IWI_NOTIF_TYPE_NOISE:
1305 		DPRINTFN(5, ("Notification noise (%u)\n", notif->type));
1306 		break;
1307 
1308 	default:
1309 		device_printf(sc->sc_dev, "unknown notification type %u\n",
1310 		    notif->type);
1311 	}
1312 }
1313 
1314 static void
1315 iwi_rx_intr(struct iwi_softc *sc)
1316 {
1317 	struct iwi_rx_buf *buf;
1318 	struct iwi_hdr *hdr;
1319 	u_int32_t r, i;
1320 
1321 	r = CSR_READ_4(sc, IWI_CSR_RX_READ_INDEX);
1322 
1323 	for (i = (sc->rx_cur + 1) % IWI_RX_RING_SIZE; i != r;
1324 	     i = (i + 1) % IWI_RX_RING_SIZE) {
1325 
1326 		buf = &sc->rx_buf[i];
1327 
1328 		bus_dmamap_sync(sc->rx_buf_dmat, buf->map,
1329 		    BUS_DMASYNC_POSTREAD);
1330 
1331 		hdr = mtod(buf->m, struct iwi_hdr *);
1332 
1333 		switch (hdr->type) {
1334 		case IWI_HDR_TYPE_FRAME:
1335 			iwi_frame_intr(sc, buf, i,
1336 			    (struct iwi_frame *)(hdr + 1));
1337 			break;
1338 
1339 		case IWI_HDR_TYPE_NOTIF:
1340 			iwi_notification_intr(sc,
1341 			    (struct iwi_notif *)(hdr + 1));
1342 			break;
1343 
1344 		default:
1345 			device_printf(sc->sc_dev, "unknown hdr type %u\n",
1346 			    hdr->type);
1347 		}
1348 	}
1349 
1350 	/* Tell the firmware what we have processed */
1351 	sc->rx_cur = (r == 0) ? IWI_RX_RING_SIZE - 1 : r - 1;
1352 	CSR_WRITE_4(sc, IWI_CSR_RX_WRITE_INDEX, sc->rx_cur);
1353 }
1354 
1355 static void
1356 iwi_tx_intr(struct iwi_softc *sc)
1357 {
1358 	struct ieee80211com *ic = &sc->sc_ic;
1359 	struct ifnet *ifp = &ic->ic_if;
1360 	struct iwi_tx_buf *buf;
1361 	u_int32_t r, i;
1362 
1363 	r = CSR_READ_4(sc, IWI_CSR_TX1_READ_INDEX);
1364 #if  notyet
1365 	bus_dmamap_sync(sc->tx_ring_dmat, sc->tx_ring_map, BUS_DMASYNC_POSTWRITE);
1366 #endif
1367 
1368 	for (i = (sc->tx_old + 1) % IWI_TX_RING_SIZE; i != r;
1369 	     i = (i + 1) % IWI_TX_RING_SIZE) {
1370 
1371 		buf = &sc->tx_buf[i];
1372 
1373 		bus_dmamap_sync(sc->tx_buf_dmat, buf->map,
1374 		    BUS_DMASYNC_POSTWRITE);
1375 		bus_dmamap_unload(sc->tx_buf_dmat, buf->map);
1376 		m_freem(buf->m);
1377 		buf->m = NULL;
1378 		if (buf->ni != ic->ic_bss)
1379 			ieee80211_free_node(ic, buf->ni);
1380 		buf->ni = NULL;
1381 
1382 		sc->tx_queued--;
1383 
1384 		/* kill watchdog timer */
1385 		sc->sc_tx_timer = 0;
1386 	}
1387 
1388 	/* Remember what the firmware has processed */
1389 	sc->tx_old = (r == 0) ? IWI_TX_RING_SIZE - 1 : r - 1;
1390 
1391 	/* Call start() since some buffer descriptors have been released */
1392 	ifp->if_flags &= ~IFF_OACTIVE;
1393 	(*ifp->if_start)(ifp);
1394 }
1395 
1396 static void
1397 iwi_intr(void *arg)
1398 {
1399 	struct iwi_softc *sc = arg;
1400 	struct ieee80211com *ic = &sc->sc_ic;
1401 	struct ifnet *ifp = &ic->ic_if;
1402 	u_int32_t r;
1403 
1404 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff)
1405 		return;
1406 
1407 	/* Disable interrupts */
1408 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1409 
1410 	DPRINTFN(8, ("INTR!0x%08x\n", r));
1411 
1412 	sc->flags &= ~(IWI_FLAG_RF_DISABLED);
1413 
1414 	if (r & IWI_INTR_FATAL_ERROR) {
1415 		if (!(sc->flags & (IWI_FLAG_RESET | IWI_FLAG_EXIT))) {
1416 			sc->flags |= IWI_FLAG_RESET;
1417 			wakeup(IWI_FW_WAKE_MONITOR(sc));
1418 		}
1419 	}
1420 
1421 	if (r & IWI_INTR_PARITY_ERROR) {
1422 		device_printf(sc->sc_dev, "fatal error\n");
1423 		sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1424 		iwi_stop(sc);
1425 	}
1426 
1427 	if (r & IWI_INTR_FW_INITED) {
1428 		if (!(r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)))
1429 			wakeup(IWI_FW_INITIALIZED(sc));
1430 	}
1431 
1432 	if (r & IWI_INTR_RADIO_OFF) {
1433 		DPRINTF(("radio transmitter off\n"));
1434 		sc->sc_ic.ic_if.if_flags &= ~IFF_UP;
1435 		iwi_stop(sc);
1436 		sc->flags |= IWI_FLAG_RF_DISABLED;
1437 	}
1438 
1439 	if (r & IWI_INTR_RX_TRANSFER)
1440 		iwi_rx_intr(sc);
1441 
1442 	if (r & IWI_INTR_CMD_TRANSFER)
1443 		wakeup(IWI_FW_CMD_ACKED(sc));
1444 
1445 	if (r & IWI_INTR_TX1_TRANSFER)
1446 		iwi_tx_intr(sc);
1447 
1448 	if (r & ~(IWI_HANDLED_INTR_MASK)) {
1449 		device_printf(sc->sc_dev,
1450 			      "unhandled interrupt(s) INTR!0x%08x\n",
1451 			      r & ~(IWI_HANDLED_INTR_MASK));
1452 	}
1453 
1454 	/* Acknowledge interrupts */
1455 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1456 
1457 	/* Re-enable interrupts */
1458 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1459 
1460 	if ((ifp->if_flags & IFF_RUNNING) && !ifq_is_empty(&ifp->if_snd))
1461 		iwi_start(ifp);
1462 }
1463 
1464 struct iwi_dma_mapping {
1465 	bus_dma_segment_t segs[IWI_MAX_NSEG];
1466 	int nseg;
1467 	bus_size_t mapsize;
1468 };
1469 
1470 static void
1471 iwi_dma_map_buf(void *arg, bus_dma_segment_t *segs, int nseg,
1472     bus_size_t mapsize, int error)
1473 {
1474 	struct iwi_dma_mapping *map = arg;
1475 
1476 	if (error != 0)
1477 		return;
1478 
1479 	KASSERT(nseg <= IWI_MAX_NSEG, ("too many DMA segments %d", nseg));
1480 
1481 	bcopy(segs, map->segs, nseg * sizeof (bus_dma_segment_t));
1482 	map->nseg = nseg;
1483 	map->mapsize = mapsize;
1484 }
1485 
1486 static void
1487 iwi_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg __unused, int error)
1488 {
1489 	if (error != 0) {
1490 		printf("iwi: fatal DMA mapping error !!!\n");
1491 		return;
1492 	}
1493 
1494 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
1495 
1496 	*(bus_addr_t *)arg = segs[0].ds_addr;
1497 }
1498 
1499 static int
1500 iwi_cmd(struct iwi_softc *sc, u_int8_t type, void *data, u_int8_t len,
1501     int async)
1502 {
1503 	struct iwi_cmd_desc *desc;
1504 	int ret;
1505 
1506 	DPRINTFN(2, ("TX!CMD!%u!%u\n", type, len));
1507 
1508 	desc = &sc->cmd_desc[sc->cmd_cur];
1509 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1510 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1511 	desc->type = type;
1512 	desc->len = len;
1513 	bcopy(data, desc->data, len);
1514 
1515 	bus_dmamap_sync(sc->cmd_ring_dmat, sc->cmd_ring_map,
1516 	    BUS_DMASYNC_PREWRITE);
1517 
1518 	sc->cmd_cur = (sc->cmd_cur + 1) % IWI_CMD_RING_SIZE;
1519 	if (!async) {
1520 		struct ifnet *ifp = &sc->sc_ic.ic_if;
1521 
1522 		crit_enter();
1523 		CSR_WRITE_4(sc, IWI_CSR_CMD_WRITE_INDEX, sc->cmd_cur);
1524 		tsleep_interlock(IWI_FW_CMD_ACKED(sc));
1525 		lwkt_serialize_exit(ifp->if_serializer);
1526 		ret = tsleep(IWI_FW_CMD_ACKED(sc), 0, "iwicmd", hz);
1527 		crit_exit();
1528 		lwkt_serialize_enter(ifp->if_serializer);
1529 	} else {
1530 		CSR_WRITE_4(sc, IWI_CSR_CMD_WRITE_INDEX, sc->cmd_cur);
1531 		ret = 0;
1532 	}
1533 
1534 	return ret;
1535 }
1536 
1537 static int
1538 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1539 {
1540 	struct iwi_softc *sc = ifp->if_softc;
1541 	struct ieee80211com *ic = &sc->sc_ic;
1542 	struct ieee80211_frame *wh;
1543 	struct iwi_tx_buf *buf;
1544 	struct iwi_tx_desc *desc;
1545 	struct iwi_dma_mapping map;
1546 	struct mbuf *mnew;
1547 	u_int32_t id = 0;
1548 	int error, i;
1549 
1550 	if (sc->sc_drvbpf != NULL) {
1551 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1552 
1553 		tap->wt_flags = 0;
1554 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1555 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1556 
1557 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1558 	}
1559 
1560 	buf = &sc->tx_buf[sc->tx_cur];
1561 	desc = &sc->tx_desc[sc->tx_cur];
1562 
1563 	wh = mtod(m0, struct ieee80211_frame *);
1564 
1565 	if ( (id = iwi_find_station( sc, wh->i_addr1 ) ) == 0xff )
1566 		id = iwi_cache_station( sc, wh->i_addr1 );
1567 
1568 	bzero( desc, sizeof (struct iwi_tx_desc) );
1569 	desc->station_number = id;
1570 
1571 	/* trim IEEE802.11 header */
1572 	m_adj(m0, sizeof (struct ieee80211_frame));
1573 
1574 	error = bus_dmamap_load_mbuf(sc->tx_buf_dmat, buf->map, m0,
1575 	    iwi_dma_map_buf, &map, BUS_DMA_NOWAIT);
1576 	if (error != 0 && error != EFBIG) {
1577 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1578 		    error);
1579 		m_freem(m0);
1580 		return error;
1581 	}
1582 	if (error != 0) {
1583 		mnew = m_defrag(m0, MB_DONTWAIT);
1584 		if (mnew == NULL) {
1585 			device_printf(sc->sc_dev,
1586 			    "could not defragment mbuf\n");
1587 			m_freem(m0);
1588 			return ENOBUFS;
1589 		}
1590 		m0 = mnew;
1591 
1592 		error = bus_dmamap_load_mbuf(sc->tx_buf_dmat, buf->map, m0,
1593 		    iwi_dma_map_buf, &map, BUS_DMA_NOWAIT);
1594 		if (error != 0) {
1595 			device_printf(sc->sc_dev,
1596 			    "could not map mbuf (error %d)\n", error);
1597 			m_freem(m0);
1598 			return error;
1599 		}
1600 	}
1601 
1602 	buf->m = m0;
1603 	buf->ni = ni;
1604 
1605 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1606 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1607 	desc->cmd = IWI_DATA_CMD_TX;
1608 	desc->len = htole16(m0->m_pkthdr.len);
1609 	desc->flags = 0;
1610 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1611 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
1612 			desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1613 	} else if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
1614 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1615 
1616 	if (ic->ic_flags & IEEE80211_F_WEPON) {
1617 		wh->i_fc[1] |= IEEE80211_FC1_WEP;
1618 		desc->wep_txkey = ic->ic_wep_txkey;
1619 	} else
1620 		desc->flags |= IWI_DATA_FLAG_NO_WEP;
1621 
1622 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1623 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1624 
1625 	bcopy(wh, &desc->wh, sizeof (struct ieee80211_frame));
1626 	desc->nseg = htole32(map.nseg);
1627 	for (i = 0; i < map.nseg; i++) {
1628 		desc->seg_addr[i] = htole32(map.segs[i].ds_addr);
1629 		desc->seg_len[i]  = htole32(map.segs[i].ds_len);
1630 	}
1631 
1632 	bus_dmamap_sync(sc->tx_buf_dmat, buf->map, BUS_DMASYNC_PREWRITE);
1633 	bus_dmamap_sync(sc->tx_ring_dmat, sc->tx_ring_map,
1634 	    BUS_DMASYNC_PREWRITE);
1635 
1636 	DPRINTFN(5, ("TX!DATA!%u!%u\n", desc->len, desc->nseg));
1637 
1638 	/* Inform firmware about this new packet */
1639 	sc->tx_queued++;
1640 	sc->tx_cur = (sc->tx_cur + 1) % IWI_TX_RING_SIZE;
1641 	CSR_WRITE_4(sc, IWI_CSR_TX1_WRITE_INDEX, sc->tx_cur);
1642 
1643 	return 0;
1644 }
1645 
1646 static void
1647 iwi_start(struct ifnet *ifp)
1648 {
1649 	struct iwi_softc *sc = ifp->if_softc;
1650 	struct ieee80211com *ic = &sc->sc_ic;
1651 	struct mbuf *m0;
1652 	struct ieee80211_node *ni;
1653 
1654 	if (ic->ic_state != IEEE80211_S_RUN) {
1655 		return;
1656 	}
1657 
1658 	for (;;) {
1659 		m0 = ifq_poll(&ifp->if_snd);
1660 		if (m0 == NULL)
1661 			break;
1662 
1663 		if (sc->tx_queued >= IWI_TX_RING_SIZE - 4) {
1664 			ifp->if_flags |= IFF_OACTIVE;
1665 			break;
1666 		}
1667 
1668 		ifq_dequeue(&ifp->if_snd, m0);
1669 
1670 		BPF_MTAP(ifp, m0);
1671 
1672 		m0 = ieee80211_encap(ifp, m0, &ni);
1673 		if (m0 == NULL)
1674 			continue;
1675 
1676 		if (ic->ic_rawbpf != NULL)
1677 			bpf_mtap(ic->ic_rawbpf, m0);
1678 
1679 		if (iwi_tx_start(ifp, m0, ni) != 0) {
1680 			if (ni != NULL && ni != ic->ic_bss)
1681 				ieee80211_free_node(ic, ni);
1682 			break;
1683 		}
1684 
1685 		/* start watchdog timer */
1686 		sc->sc_tx_timer = 5;
1687 		ifp->if_timer = 1;
1688 	}
1689 
1690 }
1691 
1692 static void
1693 iwi_watchdog(struct ifnet *ifp)
1694 {
1695 	struct iwi_softc *sc = ifp->if_softc;
1696 
1697 	ifp->if_timer = 0;
1698 
1699 	if (sc->sc_tx_timer > 0) {
1700 		if (--sc->sc_tx_timer == 0) {
1701 			if_printf(ifp, "device timeout\n");
1702 			wakeup(IWI_FW_WAKE_MONITOR(sc));
1703 			return;
1704 		}
1705 		ifp->if_timer = 1;
1706 	}
1707 
1708 	ieee80211_watchdog(ifp);
1709 }
1710 
1711 
1712 static int
1713 iwi_wi_ioctl_get(struct ifnet *ifp, caddr_t data)
1714 {
1715 	struct wi_req		wreq;
1716 	struct ifreq		*ifr;
1717 	struct iwi_softc	*sc;
1718 	int			error;
1719 
1720 	sc = ifp->if_softc;
1721 	ifr = (struct ifreq *)data;
1722 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1723 	if (error)
1724 		return (error);
1725 
1726 	switch (wreq.wi_type) {
1727 	case WI_RID_READ_APS:
1728 		ieee80211_begin_scan(ifp);
1729 
1730 		crit_enter();
1731 		tsleep_interlock(IWI_FW_SCAN_COMPLETED(sc));
1732 		lwkt_serialize_exit(ifp->if_serializer);
1733 		tsleep(IWI_FW_SCAN_COMPLETED(sc), PCATCH, "ssidscan", hz * 2);
1734 		crit_exit();
1735 		lwkt_serialize_enter(ifp->if_serializer);
1736 
1737 		ieee80211_end_scan(ifp);
1738 		break;
1739 	default:
1740 		error = ENOTTY;
1741 		break;
1742 	}
1743 	return (error);
1744 }
1745 
1746 
1747 
1748 
1749 static int
1750 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1751 {
1752 	struct iwi_softc *sc = ifp->if_softc;
1753 	struct ifreq *ifr;
1754 	struct ieee80211req *ireq;
1755 	struct ifaddr *ifa;
1756 	int error = 0;
1757 
1758 	switch (cmd) {
1759        case SIOCSIFADDR:
1760 		/*
1761 		 * Handle this here instead of in net80211_ioctl.c
1762 		 * so that we can lock the call to iwi_init().
1763 		 */
1764 		ifa = (struct ifaddr *) data;
1765 		switch (ifa->ifa_addr->sa_family) {
1766 #ifdef INET
1767 		case AF_INET:
1768 			if ((ifp->if_flags & IFF_UP) == 0) {
1769 				ifp->if_flags |= IFF_UP;
1770 				ifp->if_init(ifp->if_softc);
1771 			}
1772 			arp_ifinit(ifp, ifa);
1773 			break;
1774 #endif
1775 #ifdef IPX
1776 #warning "IPX support has not been tested"
1777 		/*
1778 		 * XXX - This code is probably wrong,
1779 		 *       but has been copied many times.
1780 		 */
1781 		case AF_IPX: {
1782 			struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
1783 			struct arpcom *ac = (struct arpcom *)ifp;
1784 
1785 			if (ipx_nullhost(*ina))
1786 				ina->x_host = *(union ipx_host *) ac->ac_enaddr;
1787 			else
1788 				bcopy((caddr_t) ina->x_host.c_host,
1789 				      (caddr_t) ac->ac_enaddr,
1790 				      sizeof(ac->ac_enaddr));
1791 			/* fall thru... */
1792 		}
1793 #endif
1794 		default:
1795 			if ((ifp->if_flags & IFF_UP) == 0) {
1796 				ifp->if_flags |= IFF_UP;
1797 				ifp->if_init(ifp->if_softc);
1798 			}
1799 			break;
1800 		}
1801 		break;
1802 
1803 	case SIOCSIFFLAGS:
1804 		if (ifp->if_flags & IFF_UP) {
1805 			if (!(ifp->if_flags & IFF_RUNNING)) {
1806 				iwi_init(sc);
1807 				error = tsleep(IWI_FW_CMD_ACKED(sc), 0,
1808 						 "iwirun", hz);
1809 			}
1810 		} else {
1811 			if (ifp->if_flags & IFF_RUNNING) {
1812 				iwi_stop(sc);
1813 			}
1814 		}
1815 		break;
1816 
1817 	case SIOCSLOADFW:
1818 	case SIOCSLOADIBSSFW:
1819 		/* only super-user can do that! */
1820 		if ((error = suser(curthread)) != 0)
1821 			break;
1822 
1823 		ifr = (struct ifreq *)data;
1824 		error = iwi_cache_firmware(sc, ifr->ifr_data,
1825 				(cmd == SIOCSLOADIBSSFW) ? 1 : 0);
1826 		break;
1827 
1828 	case SIOCSKILLFW:
1829 		/* only super-user can do that! */
1830 		if ((error = suser(curthread)) != 0)
1831 			break;
1832 
1833 		ifp->if_flags &= ~IFF_UP;
1834 		iwi_stop(sc);
1835 		iwi_free_firmware(sc);
1836 		break;
1837 
1838 	case SIOCG80211:
1839 		ireq = (struct ieee80211req *)data;
1840 		switch (ireq->i_type) {
1841 		case IEEE80211_IOC_AUTHMODE:
1842 			ireq->i_val = sc->authmode;
1843 			break;
1844 
1845 		default:
1846 			error = ieee80211_ioctl(ifp, cmd, data, cr);
1847 		}
1848 		break;
1849 
1850 	case SIOCS80211:
1851 		/* only super-user can do that! */
1852 		if ((error = suser(curthread)) != 0)
1853 			break;
1854 
1855 		ireq = (struct ieee80211req *)data;
1856 		switch (ireq->i_type) {
1857 		case IEEE80211_IOC_AUTHMODE:
1858 			sc->authmode = ireq->i_val;
1859 			break;
1860 
1861 		default:
1862 			error = ieee80211_ioctl(ifp, cmd, data, cr);
1863 		}
1864 		break;
1865 	case SIOCGIFGENERIC:
1866 		if (sc->flags & IWI_FLAG_FW_INITED) {
1867 			error = iwi_wi_ioctl_get(ifp, data);
1868 			if (! error)
1869 				error = ieee80211_ioctl(ifp, cmd, data, cr);
1870 		} else
1871 			error = ENOTTY;
1872 		if (error != ENOTTY)
1873 			break;
1874 
1875 	default:
1876 		error = ieee80211_ioctl(ifp, cmd, data, cr);
1877 	}
1878 
1879 	if (error == ENETRESET) {
1880 		error = 0;
1881 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1882 		    (IFF_UP | IFF_RUNNING)) {
1883 			iwi_init(sc);
1884 			error = tsleep(IWI_FW_CMD_ACKED(sc), 0, "iwirun", hz);
1885 		}
1886 	}
1887 	return error;
1888 }
1889 
1890 static int
1891 iwi_abort_scan( struct iwi_softc *sc  )
1892 {
1893 	sc->flags |= IWI_FLAG_SCAN_ABORT;
1894 	return iwi_cmd(sc, IWI_CMD_SCAN_ABORT, NULL, 0, 1);
1895 }
1896 
1897 static void
1898 iwi_stop_master(struct iwi_softc *sc)
1899 {
1900 	int ntries;
1901 
1902 	/*
1903 	 * If the master is busy scanning, we will occasionally
1904 	 * timeout waiting for it (the master) to stop. Make the
1905 	 * 'stopping' process more robust by ceasing all scans
1906 	 * prior to asking for the stop.
1907 	 */
1908 	if ( ( sc->flags & IWI_FLAG_SCANNING ) &&
1909 	     !( sc->flags & IWI_FLAG_RF_DISABLED ) ) {
1910 	     	struct ifnet *ifp = &sc->sc_ic.ic_if;
1911 
1912 	     	ASSERT_SERIALIZED(ifp->if_serializer);
1913 
1914 		iwi_abort_scan(sc);
1915 		if (( sc->flags & IWI_FLAG_SCAN_ABORT ) &&
1916 		    !( sc->flags & IWI_FLAG_RF_DISABLED )) {
1917 		    	crit_enter();
1918 			tsleep_interlock(IWI_FW_SCAN_COMPLETED(sc));
1919 			lwkt_serialize_exit(ifp->if_serializer);
1920 			tsleep(IWI_FW_SCAN_COMPLETED(sc), 0, "iwiabr", hz);
1921 			crit_exit();
1922 			lwkt_serialize_enter(ifp->if_serializer);
1923 		}
1924 	}
1925 	/* Disable interrupts */
1926 
1927 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1928 
1929 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1930 	for (ntries = 0; ntries < 5; ntries++) {
1931 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1932 			break;
1933 		DELAY(10);
1934 	}
1935 	if (ntries == 5 && sc->debug_level > 0)
1936 		device_printf(sc->sc_dev, "timeout waiting for master\n");
1937 
1938 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1939 	    IWI_RST_PRINCETON_RESET);
1940 
1941 	sc->flags &= ~IWI_FLAG_FW_INITED;
1942 }
1943 
1944 static int
1945 iwi_reset(struct iwi_softc *sc)
1946 {
1947 	int i, ntries;
1948 
1949 	iwi_stop_master(sc);
1950 
1951 	/* Move adapter to D0 state */
1952 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
1953 	    IWI_CTL_INIT);
1954 
1955 	/* Initialize Phase-Locked Level  (PLL) */
1956 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
1957 
1958 	/* Wait for clock stabilization */
1959 	for (ntries = 0; ntries < 1000; ntries++) {
1960 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
1961 			break;
1962 		DELAY(200);
1963 	}
1964 	if (ntries == 1000) {
1965 		return EIO;
1966 	}
1967 
1968 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1969 	    IWI_RST_SW_RESET);
1970 
1971 	DELAY(10);
1972 
1973 	CSR_WRITE_4(sc, IWI_CSR_CTL, CSR_READ_4(sc, IWI_CSR_CTL) |
1974 	    IWI_CTL_INIT);
1975 
1976 
1977 	/* Clear NIC memory */
1978 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
1979 
1980 	for (i = 0; i < 0xc000; i++) {
1981 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1982 	}
1983 
1984 	sc->num_stations = 0;
1985 	return 0;
1986 }
1987 
1988 static int
1989 iwi_load_ucode(struct iwi_softc *sc, void *uc, int size)
1990 {
1991 	u_int16_t *w;
1992 	int ntries, i;
1993 
1994 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
1995 	    IWI_RST_STOP_MASTER);
1996 	for (ntries = 0; ntries < 5; ntries++) {
1997 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1998 			break;
1999 		DELAY(10);
2000 	}
2001 	if (ntries == 5) {
2002 		device_printf(sc->sc_dev, "timeout waiting for master\n");
2003 		return EIO;
2004 	}
2005 
2006 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
2007 	DELAY(5000);
2008 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2009 	    ~IWI_RST_PRINCETON_RESET);
2010 	DELAY(5000);
2011 	MEM_WRITE_4(sc, 0x3000e0, 0);
2012 	DELAY(1000);
2013 	MEM_WRITE_4(sc, 0x300004, 1);
2014 	DELAY(1000);
2015 	MEM_WRITE_4(sc, 0x300004, 0);
2016 	DELAY(1000);
2017 	MEM_WRITE_1(sc, 0x200000, 0x00);
2018 	MEM_WRITE_1(sc, 0x200000, 0x40);
2019 	DELAY(1000);
2020 
2021 	/* Adapter is buggy, we must set the address for each word */
2022 	for (w = uc; size > 0; w++, size -= 2)
2023 		MEM_WRITE_2(sc, 0x200010, *w);
2024 
2025 	MEM_WRITE_1(sc, 0x200000, 0x00);
2026 	MEM_WRITE_1(sc, 0x200000, 0x80);
2027 
2028 	/* Wait until we get a response in the uc queue */
2029 	for (ntries = 0; ntries < 100; ntries++) {
2030 		if (MEM_READ_1(sc, 0x200000) & 1)
2031 			break;
2032 		DELAY(100);
2033 	}
2034 	if (ntries == 100) {
2035 		device_printf(sc->sc_dev,
2036 		    "timeout waiting for ucode to initialize\n");
2037 		return EIO;
2038 	}
2039 
2040 	/* Empty the uc queue or the firmware will not initialize properly */
2041 	for (i = 0; i < 7; i++)
2042 		MEM_READ_4(sc, 0x200004);
2043 
2044 	MEM_WRITE_1(sc, 0x200000, 0x00);
2045 
2046 	return 0;
2047 }
2048 
2049 /* macro to handle unaligned little endian data in firmware image */
2050 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
2051 static int
2052 iwi_load_firmware(struct iwi_softc *sc, void *fw, int size)
2053 {
2054 	bus_dma_tag_t dmat;
2055 	bus_dmamap_t map;
2056 	bus_addr_t physaddr;
2057 	void *virtaddr;
2058 	u_char *p, *end;
2059 	u_int32_t sentinel, ctl, src, dst, sum, len, mlen;
2060 	int ntries, error = 0;
2061 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2062 
2063 	sc->flags &= ~(IWI_FLAG_FW_INITED);
2064 
2065 	/* Allocate DMA memory for storing firmware image */
2066 	error = bus_dma_tag_create(sc->iwi_parent_tag, 1, 0, BUS_SPACE_MAXADDR_32BIT,
2067 	    BUS_SPACE_MAXADDR, NULL, NULL, size, 1, size, BUS_DMA_ALLOCNOW, &dmat);
2068 	if (error != 0) {
2069 		device_printf(sc->sc_dev,
2070 		    "could not create firmware DMA tag\n");
2071 		goto fail1;
2072 	}
2073 
2074 	/*
2075 	 * We cannot map fw directly because of some hardware constraints on
2076 	 * the mapping address.
2077 	 */
2078 	error = bus_dmamem_alloc(dmat, &virtaddr, BUS_DMA_WAITOK, &map);
2079 	if (error != 0) {
2080 		device_printf(sc->sc_dev,
2081 		    "could not allocate firmware DMA memory\n");
2082 		goto fail2;
2083 	}
2084 
2085 	error = bus_dmamap_load(dmat, map, virtaddr, size, iwi_dma_map_addr,
2086 	    &physaddr, 0);
2087 	if (error != 0) {
2088 		device_printf(sc->sc_dev, "could not load firmware DMA map\n");
2089 		goto fail3;
2090 	}
2091 
2092 	/* Copy firmware image to DMA memory */
2093 	bcopy(fw, virtaddr, size);
2094 
2095 	/* Make sure the adapter will get up-to-date values */
2096 	bus_dmamap_sync(dmat, map, BUS_DMASYNC_PREWRITE);
2097 
2098 	/* Tell the adapter where the command blocks are stored */
2099 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
2100 
2101 	/*
2102 	 * Store command blocks into adapter's internal memory using register
2103 	 * indirections. The adapter will read the firmware image through DMA
2104 	 * using information stored in command blocks.
2105 	 */
2106 	src = physaddr;
2107 	p = virtaddr;
2108 	end = p + size;
2109 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
2110 
2111 	while (p < end) {
2112 		dst = GETLE32(p); p += 4; src += 4;
2113 		len = GETLE32(p); p += 4; src += 4;
2114 		p += len;
2115 
2116 		while (len > 0) {
2117 			mlen = min(len, IWI_CB_MAXDATALEN);
2118 
2119 			ctl = IWI_CB_DEFAULT_CTL | mlen;
2120 			sum = ctl ^ src ^ dst;
2121 
2122 			/* Write a command block */
2123 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
2124 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, src);
2125 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, dst);
2126 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
2127 
2128 			src += mlen;
2129 			dst += mlen;
2130 			len -= mlen;
2131 		}
2132 	}
2133 
2134 	/* Write a fictive final command block (sentinel) */
2135 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
2136 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2137 
2138 	CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) &
2139 	    ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER));
2140 
2141 	/* Tell the adapter to start processing command blocks */
2142 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
2143 
2144 	/* Wait until the adapter has processed all command blocks */
2145 	for (ntries = 0; ntries < 400; ntries++) {
2146 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
2147 			break;
2148 		DELAY(100);
2149 	}
2150 	if (ntries == 400) {
2151 		device_printf(sc->sc_dev,
2152 		    "timeout processing command blocks\n");
2153 		error = EIO;
2154 		goto fail4;
2155 	}
2156 
2157 
2158 	/* We're done with command blocks processing */
2159 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
2160 
2161 	/* Allow interrupts so we know when the firmware is inited */
2162 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
2163 
2164 	/* Tell the adapter to initialize the firmware */
2165 	crit_enter();
2166 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
2167 	CSR_WRITE_4(sc, IWI_CSR_CTL,
2168 		    CSR_READ_4(sc, IWI_CSR_CTL) | IWI_CTL_ALLOW_STANDBY);
2169 
2170 	tsleep_interlock(IWI_FW_INITIALIZED(sc));
2171 	lwkt_serialize_exit(ifp->if_serializer);
2172 	error = tsleep(IWI_FW_INITIALIZED(sc), 0, "iwiini", hz);
2173 	crit_exit();
2174 	lwkt_serialize_enter(ifp->if_serializer);
2175 	if (error != 0) {
2176 		device_printf(sc->sc_dev, "timeout waiting for firmware "
2177 		    "initialization to complete\n");
2178 		goto fail4;
2179 	}
2180 
2181 fail4:  bus_dmamap_sync(dmat, map, BUS_DMASYNC_POSTWRITE);
2182 	bus_dmamap_unload(dmat, map);
2183 fail3:	bus_dmamem_free(dmat, virtaddr, map);
2184 fail2:	bus_dma_tag_destroy(dmat);
2185 fail1:
2186 	return error;
2187 }
2188 
2189 /*
2190  * Store firmware into kernel memory so we can download it when we need to,
2191  * e.g when the adapter wakes up from suspend mode.
2192  */
2193 static int
2194 iwi_cache_firmware(struct iwi_softc *sc, void *data, int is_ibss)
2195 {
2196 	struct iwi_firmware *kfw = &sc->fw;
2197 	struct iwi_firmware ufw;
2198 	int error;
2199 
2200 	iwi_free_firmware(sc);
2201 
2202 	/*
2203 	 * mutex(9): no mutexes should be held across functions which access
2204 	 * memory in userspace, such as copyin(9) [...]
2205 	 */
2206 
2207 	if ((error = copyin(data, &ufw, sizeof ufw)) != 0)
2208 		goto fail1;
2209 
2210 	kfw->boot_size  = ufw.boot_size;
2211 	kfw->ucode_size = ufw.ucode_size;
2212 	kfw->main_size  = ufw.main_size;
2213 
2214 	kfw->boot = malloc(kfw->boot_size, M_DEVBUF, M_WAITOK);
2215 	if (kfw->boot == NULL) {
2216 		error = ENOMEM;
2217 		goto fail1;
2218 	}
2219 
2220 	kfw->ucode = malloc(kfw->ucode_size, M_DEVBUF, M_WAITOK);
2221 	if (kfw->ucode == NULL) {
2222 		error = ENOMEM;
2223 		goto fail2;
2224 	}
2225 
2226 	kfw->main = malloc(kfw->main_size, M_DEVBUF, M_WAITOK);
2227 	if (kfw->main == NULL) {
2228 		error = ENOMEM;
2229 		goto fail3;
2230 	}
2231 
2232 	if ((error = copyin(ufw.boot, kfw->boot, kfw->boot_size)) != 0)
2233 		goto fail4;
2234 
2235 	if ((error = copyin(ufw.ucode, kfw->ucode, kfw->ucode_size)) != 0)
2236 		goto fail4;
2237 
2238 	if ((error = copyin(ufw.main, kfw->main, kfw->main_size)) != 0)
2239 		goto fail4;
2240 
2241 	DPRINTF(("Firmware cached: boot %u, ucode %u, main %u\n",
2242 	    kfw->boot_size, kfw->ucode_size, kfw->main_size));
2243 
2244 
2245 	sc->flags |= IWI_FLAG_FW_CACHED;
2246 	sc->flags |= is_ibss ? IWI_FLAG_FW_IBSS : 0;
2247 	return 0;
2248 
2249 fail4:	free(kfw->boot, M_DEVBUF);
2250 fail3:	free(kfw->ucode, M_DEVBUF);
2251 fail2:	free(kfw->main, M_DEVBUF);
2252 fail1:
2253 
2254 	return error;
2255 }
2256 
2257 static void
2258 iwi_free_firmware(struct iwi_softc *sc)
2259 {
2260 	if (!(sc->flags & IWI_FLAG_FW_CACHED))
2261 		return;
2262 
2263 	free(sc->fw.boot, M_DEVBUF);
2264 	free(sc->fw.ucode, M_DEVBUF);
2265 	free(sc->fw.main, M_DEVBUF);
2266 
2267 	sc->flags &= ~( IWI_FLAG_FW_CACHED | IWI_FLAG_FW_IBSS );
2268 }
2269 
2270 static int
2271 iwi_adapter_config(struct iwi_softc *sc, int is_a, int cmd_wait)
2272 {
2273 	struct iwi_configuration config;
2274 
2275 	bzero(&config, sizeof config);
2276 	config.enable_multicast = 1;
2277 	config.noise_reported = 1;
2278 
2279 	config.bg_autodetect =
2280 		( !(is_a) &&
2281 		  ( sc->enable_bg_autodetect != 0 ) ) ? 1 : 0;	/* default: on  */
2282 
2283 	config.bluetooth_coexistence =
2284 		( sc->enable_bt_coexist != 0 ) ? 1 : 0;		/* default: on  */
2285 
2286 	config.enable_cts_to_self =
2287 		( sc->enable_cts_to_self > 0 ) ? 1 : 0;		/* default: off */
2288 
2289 	if (sc->antenna_diversity > 0 ) {			/* default: BOTH */
2290 		switch( sc->antenna_diversity ) {
2291 			case 1: case 3:
2292 				config.antenna_diversity = sc->antenna_diversity;
2293 		}
2294 	}
2295 
2296 	config.disable_unicast_decryption =
2297 		( sc->disable_unicast_decryption != 0 ) ? 1 : 0; /* default: on */
2298 
2299 	config.disable_multicast_decryption =
2300 		( sc->disable_multicast_decryption != 0 ) ? 1 : 0;/* default: on */
2301 
2302 
2303 	if ( sc->debug_level > 0 ) {
2304 		printf("config.bluetooth_coexistence = %d\n",
2305 			 config.bluetooth_coexistence );
2306 		printf("config.bg_autodetect = %d\n",
2307 			 config.bg_autodetect );
2308 		printf("config.enable_cts_to_self = %d\n",
2309 			 config.enable_cts_to_self );
2310 		printf("config.antenna_diversity = %d\n",
2311 			 config.antenna_diversity );
2312 		printf("config.disable_unicast_decryption = %d\n",
2313 			 config.disable_unicast_decryption );
2314 		printf("config.disable_multicast_decryption = %d\n",
2315 			 config.disable_multicast_decryption );
2316 		printf("config.neg_best_rates_first = %d\n",
2317 			 sc->enable_neg_best_first );
2318 	}
2319 
2320 	return iwi_cmd(sc, IWI_CMD_SET_CONFIGURATION, &config,
2321 		 sizeof config, cmd_wait );
2322 }
2323 
2324 static int
2325 iwi_config(struct iwi_softc *sc)
2326 {
2327 	struct ieee80211com *ic = &sc->sc_ic;
2328 	struct ifnet *ifp = &ic->ic_if;
2329 	struct iwi_rateset rs;
2330 	struct iwi_txpower power;
2331 	struct ieee80211_wepkey *k;
2332 	struct iwi_wep_key wepkey;
2333 	u_int32_t data;
2334 	int error, i;
2335 
2336 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2337 	DPRINTF(("Setting MAC address to %6D\n", ic->ic_myaddr, ":"));
2338 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
2339 	    IEEE80211_ADDR_LEN, 0);
2340 	if (error != 0)
2341 		return error;
2342 
2343 	DPRINTF(("Configuring adapter\n"));
2344 	if ((error = iwi_adapter_config(sc, 1, 0)) != 0)
2345 		return error;
2346 
2347 	data = htole32(IWI_POWER_MODE_CAM);
2348 	DPRINTF(("Setting power mode to %u\n", le32toh(data)));
2349 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
2350 	if (error != 0)
2351 		return error;
2352 
2353 	data = htole32(ic->ic_rtsthreshold);
2354 	DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
2355 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
2356 	if (error != 0)
2357 		return error;
2358 
2359 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
2360 		power.mode = IWI_MODE_11B;
2361 		power.nchan = 11;
2362 		for (i = 0; i < 11; i++) {
2363 			power.chan[i].chan = i + 1;
2364 			power.chan[i].power = IWI_TXPOWER_MAX;
2365 		}
2366 		DPRINTF(("Setting .11b channels tx power\n"));
2367 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2368 		    0);
2369 		if (error != 0)
2370 			return error;
2371 
2372 		power.mode = IWI_MODE_11G;
2373 		DPRINTF(("Setting .11g channels tx power\n"));
2374 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2375 		    0);
2376 		if (error != 0)
2377 			return error;
2378 	}
2379 
2380 	rs.mode = IWI_MODE_11G;
2381 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2382 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
2383 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates, rs.rates,
2384 	    rs.nrates);
2385 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
2386 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2387 	if (error != 0)
2388 		return error;
2389 
2390 	rs.mode = IWI_MODE_11A;
2391 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
2392 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
2393 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates, rs.rates,
2394 	    rs.nrates);
2395 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
2396 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2397 	if (error != 0)
2398 		return error;
2399 
2400 	data = htole32(arc4random());
2401 	DPRINTF(("Setting initialization vector to %u\n", le32toh(data)));
2402 	error = iwi_cmd(sc, IWI_CMD_SET_IV, &data, sizeof data, 0);
2403 	if (error != 0)
2404 		return error;
2405 
2406 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2407 		k = ic->ic_nw_keys;
2408 		for (i = 0; i < IEEE80211_WEP_NKID; i++, k++) {
2409 			wepkey.cmd = IWI_WEP_KEY_CMD_SETKEY;
2410 			wepkey.idx = i;
2411 			wepkey.len = k->wk_len;
2412 			bzero(wepkey.key, sizeof wepkey.key);
2413 			bcopy(k->wk_key, wepkey.key, k->wk_len);
2414 			DPRINTF(("Setting wep key index %u len %u\n",
2415 			    wepkey.idx, wepkey.len));
2416 			error = iwi_cmd(sc, IWI_CMD_SET_WEP_KEY, &wepkey,
2417 			    sizeof wepkey, 0);
2418 			if (error != 0)
2419 				return error;
2420 		}
2421 	}
2422 
2423 	/* Enable adapter */
2424 	DPRINTF(("Enabling adapter\n"));
2425 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
2426 }
2427 
2428 static int
2429 iwi_scan(struct iwi_softc *sc)
2430 {
2431 	struct ieee80211com *ic = &sc->sc_ic;
2432 	struct iwi_scan scan;
2433 	u_int8_t *p;
2434 	int i, count;
2435 	int do_5ghz_scan = 0;
2436 
2437 	sc->scan_counter++; /* track the number of scans started */
2438 
2439 	sc->flags |= IWI_FLAG_SCANNING;
2440 
2441 	bzero(&scan, sizeof scan);
2442 
2443 	/*
2444 	 * Alternate two broadcast scans with
2445 	 * two broadcast/direct scans.
2446 	 */
2447 	if ( sc->scan_counter & 2 ) {
2448 		scan.type = IWI_SCAN_TYPE_BROADCAST_AND_DIRECT;
2449 		scan.intval = htole16(100);
2450 	} else {
2451 		scan.type = IWI_SCAN_TYPE_BROADCAST;
2452 		scan.intval = htole16(40);
2453 	}
2454 
2455 	p = scan.channels;
2456 
2457 	/*
2458 	 * If we have .11a capable adapter, and
2459 	 * 	- we are in .11a mode, or
2460 	 *	- we are in auto mode and this is an odd numbered scan
2461 	 * then do a 5GHz scan, otherwise do a 2GHz scan.
2462 	 */
2463 	if ( ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates > 0 ) {
2464 		if (( ic->ic_curmode == IEEE80211_MODE_11A ) ||
2465 		    (( ic->ic_curmode == IEEE80211_MODE_AUTO ) &&
2466 		     ( sc->scan_counter & 1)))
2467 			do_5ghz_scan = 1;
2468 	}
2469 	count = 0;
2470 	if ( do_5ghz_scan ) {
2471 		DPRINTF(("Scanning 5GHz band\n"));
2472 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2473 			if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]) &&
2474 					isset(ic->ic_chan_active, i)) {
2475 				*++p = i;
2476 				count++;
2477 			}
2478 		}
2479 		*(p - count) = IWI_CHAN_5GHZ | count;
2480 	} else {
2481 		DPRINTF(("Scanning 2GHz band\n"));
2482 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2483 			if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]) &&
2484 					isset(ic->ic_chan_active, i)) {
2485 				*++p = i;
2486 				count++;
2487 			}
2488 		}
2489 		*(p - count) = IWI_CHAN_2GHZ | count;
2490 	}
2491 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2492 }
2493 
2494 static int
2495 iwi_auth_and_assoc(struct iwi_softc *sc)
2496 {
2497 	struct ieee80211com *ic = &sc->sc_ic;
2498 	struct ifnet *ifp = &ic->ic_if;
2499 	struct ieee80211_node *ni = ic->ic_bss;
2500 	struct iwi_rateset rs;
2501 	u_int32_t data;
2502 	int error, x;
2503 
2504 	if ( ( sc->flags & IWI_FLAG_FW_IBSS ) &&
2505 	     !( ni->ni_capinfo & IEEE80211_CAPINFO_IBSS ) ) {
2506 		return -1; /* IBSS F/W requires network ibss capability */
2507 	}
2508 
2509 	DPRINTF(("Configuring adapter\n"));
2510 	if ((error = iwi_adapter_config(sc,
2511 		IEEE80211_IS_CHAN_5GHZ(ni->ni_chan), 1)) != 0)
2512 			return error;
2513 
2514 #ifdef IWI_DEBUG
2515 	if (sc->debug_level > 0) {
2516 		printf("Setting ESSID to ");
2517 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2518 		printf("\n");
2519 	}
2520 #endif
2521 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2522 	if (error != 0)
2523 		return error;
2524 
2525 	/* the rate set has already been "negotiated" */
2526 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2527 	    IWI_MODE_11G;
2528 	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2529 	rs.nrates = ni->ni_rates.rs_nrates;
2530 	if ( sc->enable_neg_best_first != 1 ) {
2531 		bcopy(ni->ni_rates.rs_rates, rs.rates, rs.nrates);
2532 	} else {
2533 		for ( x = 0 ; x < rs.nrates; x++ ) {
2534 			/*
2535 			 * Present the firmware with the most favourable
2536 			 * of the negotiated rates first.
2537 			 */
2538 			rs.rates[rs.nrates-x-1] = ni->ni_rates.rs_rates[x];
2539 		}
2540 	}
2541 
2542 	if ( sc->debug_level > 0 ) {
2543 		printf("Setting negotiated rates (%u) : ", rs.nrates);
2544 		for ( x = 0 ; x < rs.nrates; x++ ) {
2545 			printf("%d ", rs.rates[x]);
2546 		}
2547 		printf("\n");
2548 	}
2549 
2550 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2551 	if (error != 0)
2552 		return error;
2553 
2554 	data = htole32(ni->ni_rssi);
2555 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2556 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2557 	if (error != 0)
2558 		return error;
2559 
2560 	bzero(&sc->assoc, sizeof sc->assoc);
2561 	sc->assoc.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2562 	    IWI_MODE_11G;
2563 	sc->assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2564 	if (sc->authmode == IEEE80211_AUTH_SHARED)
2565 		sc->assoc.auth = (ic->ic_wep_txkey << 4) | IWI_AUTH_SHARED;
2566 	bcopy(ni->ni_tstamp, sc->assoc.tstamp, 8);
2567 	sc->assoc.capinfo = htole16(ni->ni_capinfo);
2568 	sc->assoc.lintval = htole16(ic->ic_lintval);
2569 	sc->assoc.intval = htole16(ni->ni_intval);
2570 	IEEE80211_ADDR_COPY(sc->assoc.bssid, ni->ni_bssid);
2571 	if ( ic->ic_opmode == IEEE80211_M_IBSS )
2572 		IEEE80211_ADDR_COPY(sc->assoc.dst, ifp->if_broadcastaddr);
2573 	else
2574 		IEEE80211_ADDR_COPY(sc->assoc.dst, ni->ni_bssid);
2575 
2576 	DPRINTF(("Trying to associate to %6D channel %u auth %u\n",
2577 	    sc->assoc.bssid, ":", sc->assoc.chan, sc->assoc.auth));
2578 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &sc->assoc, sizeof sc->assoc, 1);
2579 }
2580 
2581 static void
2582 iwi_init(void *priv)
2583 {
2584 	struct iwi_softc *sc = priv;
2585 	struct ieee80211com *ic = &sc->sc_ic;
2586 	struct ifnet *ifp = &ic->ic_if;
2587 	struct iwi_firmware *fw = &sc->fw;
2588 	int i;
2589 
2590 	/* exit immediately if firmware has not been ioctl'd */
2591 	if (!(sc->flags & IWI_FLAG_FW_CACHED)) {
2592 		ifp->if_flags &= ~IFF_UP;
2593 		return;
2594 	}
2595 
2596 	iwi_stop(sc);
2597 
2598 	if (iwi_reset(sc) != 0) {
2599 		device_printf(sc->sc_dev, "could not reset adapter\n");
2600 		goto fail;
2601 	}
2602 
2603 	if (iwi_load_firmware(sc, fw->boot, fw->boot_size) != 0) {
2604 		device_printf(sc->sc_dev, "could not load boot firmware\n");
2605 		goto fail;
2606 	}
2607 
2608 	if (iwi_load_ucode(sc, fw->ucode, fw->ucode_size) != 0) {
2609 		device_printf(sc->sc_dev, "could not load microcode\n");
2610 		goto fail;
2611 	}
2612 
2613 	iwi_stop_master(sc);
2614 
2615 	sc->tx_cur = 0;
2616 	sc->tx_queued = 0;
2617 	sc->tx_old = IWI_TX_RING_SIZE - 1;
2618 	sc->cmd_cur = 0;
2619 	sc->rx_cur = IWI_RX_RING_SIZE - 1;
2620 
2621 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmd_ring_pa);
2622 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, IWI_CMD_RING_SIZE);
2623 	CSR_WRITE_4(sc, IWI_CSR_CMD_READ_INDEX, 0);
2624 	CSR_WRITE_4(sc, IWI_CSR_CMD_WRITE_INDEX, sc->cmd_cur);
2625 
2626 	CSR_WRITE_4(sc, IWI_CSR_TX1_BASE, sc->tx_ring_pa);
2627 	CSR_WRITE_4(sc, IWI_CSR_TX1_SIZE, IWI_TX_RING_SIZE);
2628 	CSR_WRITE_4(sc, IWI_CSR_TX1_READ_INDEX, 0);
2629 	CSR_WRITE_4(sc, IWI_CSR_TX1_WRITE_INDEX, sc->tx_cur);
2630 
2631 	CSR_WRITE_4(sc, IWI_CSR_TX2_BASE, sc->tx_ring_pa);
2632 	CSR_WRITE_4(sc, IWI_CSR_TX2_SIZE, IWI_TX_RING_SIZE);
2633 	CSR_WRITE_4(sc, IWI_CSR_TX2_READ_INDEX, 0);
2634 	CSR_WRITE_4(sc, IWI_CSR_TX2_WRITE_INDEX, 0);
2635 
2636 	CSR_WRITE_4(sc, IWI_CSR_TX3_BASE, sc->tx_ring_pa);
2637 	CSR_WRITE_4(sc, IWI_CSR_TX3_SIZE, IWI_TX_RING_SIZE);
2638 	CSR_WRITE_4(sc, IWI_CSR_TX3_READ_INDEX, 0);
2639 	CSR_WRITE_4(sc, IWI_CSR_TX3_WRITE_INDEX, 0);
2640 
2641 	CSR_WRITE_4(sc, IWI_CSR_TX4_BASE, sc->tx_ring_pa);
2642 	CSR_WRITE_4(sc, IWI_CSR_TX4_SIZE, IWI_TX_RING_SIZE);
2643 	CSR_WRITE_4(sc, IWI_CSR_TX4_READ_INDEX, 0);
2644 	CSR_WRITE_4(sc, IWI_CSR_TX4_WRITE_INDEX, 0);
2645 
2646 	for (i = 0; i < IWI_RX_RING_SIZE; i++)
2647 		CSR_WRITE_4(sc, IWI_CSR_RX_BASE + i * 4,
2648 		    sc->rx_buf[i].physaddr);
2649 
2650 	/*
2651 	 * Kick Rx
2652 	 */
2653 	CSR_WRITE_4(sc, IWI_CSR_RX_WRITE_INDEX, sc->rx_cur);
2654 	CSR_WRITE_4(sc, IWI_CSR_RX_READ_INDEX, 0);
2655 
2656 	if (iwi_load_firmware(sc, fw->main, fw->main_size) != 0) {
2657 		device_printf(sc->sc_dev, "could not load main firmware\n");
2658 		goto fail;
2659 	}
2660 
2661 	/*
2662 	 * Force the opmode based on what firmware is loaded. This
2663 	 * stops folks from killing the firmware by asking it to
2664 	 * do something it doesn't support.
2665 	 */
2666 	if ( ic->ic_opmode != IEEE80211_M_MONITOR ) {
2667 		ic->ic_opmode = ( sc->flags & IWI_FLAG_FW_IBSS )
2668 			? IEEE80211_M_IBSS : IEEE80211_M_STA;
2669 	}
2670 
2671 	sc->flags |= IWI_FLAG_FW_INITED;
2672 
2673 	sc->flags &= ~( IWI_FLAG_SCANNING |
2674 			IWI_FLAG_SCAN_COMPLETE |
2675 			IWI_FLAG_SCAN_ABORT |
2676 			IWI_FLAG_ASSOCIATED );
2677 
2678 	if (iwi_config(sc) != 0) {
2679 		device_printf(sc->sc_dev, "device configuration failed\n");
2680 		goto fail;
2681 	}
2682 
2683 	if ( ic->ic_opmode != IEEE80211_M_MONITOR ) {
2684 		ieee80211_begin_scan(ifp);
2685 		ifp->if_flags &= ~IFF_OACTIVE;
2686 		ifp->if_flags |= IFF_RUNNING;
2687 	} else {
2688 		ieee80211_begin_scan(ifp);
2689 		ifp->if_flags &= ~IFF_OACTIVE;
2690 		ifp->if_flags |= IFF_RUNNING;
2691 	}
2692 
2693 	return;
2694 
2695 fail:
2696 	if ( !(sc->flags & IWI_FLAG_RESET) )
2697 		ifp->if_flags &= ~IFF_UP;
2698 	iwi_stop(sc);
2699 }
2700 
2701 static void
2702 iwi_stop(void *priv)
2703 {
2704 	struct iwi_softc *sc = priv;
2705 	struct ieee80211com *ic = &sc->sc_ic;
2706 	struct ifnet *ifp = &ic->ic_if;
2707 	struct iwi_tx_buf *buf;
2708 	int i;
2709 
2710 	iwi_stop_master(sc);
2711 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SW_RESET);
2712 
2713 	/*
2714 	 * Release Tx buffers
2715 	 */
2716 	for (i = 0; i < IWI_TX_RING_SIZE; i++) {
2717 		buf = &sc->tx_buf[i];
2718 
2719 		if (buf->m != NULL) {
2720 			bus_dmamap_sync(sc->tx_buf_dmat, buf->map,
2721 			    BUS_DMASYNC_POSTWRITE);
2722 			bus_dmamap_unload(sc->tx_buf_dmat, buf->map);
2723 			m_freem(buf->m);
2724 			buf->m = NULL;
2725 
2726 			if (buf->ni != NULL) {
2727 				if (buf->ni != ic->ic_bss)
2728 					ieee80211_free_node(ic, buf->ni);
2729 				buf->ni = NULL;
2730 			}
2731 		}
2732 	}
2733 
2734 	ifp->if_timer = 0;
2735 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2736 
2737 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2738 }
2739 
2740 static int8_t
2741 iwi_cache_station(struct iwi_softc *sc, u_int8_t *mac)
2742 {
2743 	int i, x, base, elemsize = sizeof(struct iwi_fw_station);
2744 	for (i = 0; i < sc->num_stations; i++)
2745 		if (!memcmp(sc->stations[i], mac, IEEE80211_ADDR_LEN))
2746 			break;
2747 	if (i == IWI_FW_MAX_STATIONS)
2748 		return 0xff;
2749 	memcpy(sc->stations[i], mac, IEEE80211_ADDR_LEN);
2750 	for (x = 0, base = IWI_STATION_TABLE + (i * elemsize) ;
2751 	     x < IEEE80211_ADDR_LEN ; x++ ) {
2752 		CSR_WRITE_1(sc, base + x, mac[x]);
2753 	}
2754 	if ( (i + 1) > sc->num_stations )
2755 		sc->num_stations++;
2756 	return i;
2757 }
2758 
2759 static u_int8_t
2760 iwi_find_station(struct iwi_softc *sc, u_int8_t *mac)
2761 {
2762 	u_int8_t i;
2763 	for (i = 0; i < sc->num_stations; i++)
2764 		if (!memcmp(sc->stations[i], mac, IEEE80211_ADDR_LEN))
2765 			return i;
2766 	return 0xff;
2767 }
2768 
2769 static const char *
2770 iwi_error_desc(u_int32_t val)
2771 {
2772 	switch (val) {
2773 	case IWI_FW_ERROR_OK:
2774 		return "OK";
2775 	case IWI_FW_ERROR_FAIL:
2776 		return "FAIL";
2777 	case IWI_FW_ERROR_MEMORY_UNDERFLOW:
2778 		return "MEMORY_UNDERFLOW";
2779 	case IWI_FW_ERROR_MEMORY_OVERFLOW:
2780 		return "MEMORY_OVERFLOW";
2781 	case IWI_FW_ERROR_BAD_PARAM:
2782 		return "BAD_PARAMETER";
2783 	case IWI_FW_ERROR_BAD_CHECKSUM:
2784 		return "BAD_CHECKSUM";
2785 	case IWI_FW_ERROR_NMI_INTERRUPT:
2786 		return "NMI_INTERRUPT";
2787 	case IWI_FW_ERROR_BAD_DATABASE:
2788 		return "BAD_DATABASE";
2789 	case IWI_FW_ERROR_ALLOC_FAIL:
2790 		return "ALLOC_FAIL";
2791 	case IWI_FW_ERROR_DMA_UNDERRUN:
2792 		return "DMA_UNDERRUN";
2793 	case IWI_FW_ERROR_DMA_STATUS:
2794 		return "DMA_STATUS";
2795 	case IWI_FW_ERROR_DINOSTATUS_ERROR:
2796 		return "DINOSTATUS_ERROR";
2797 	case IWI_FW_ERROR_EEPROMSTATUS_ERROR:
2798 		return "EEPROMSTATUS_ERROR";
2799 	case IWI_FW_ERROR_SYSASSERT:
2800 		return "SYSASSERT";
2801 	case IWI_FW_ERROR_FATAL_ERROR:
2802 		return "FATAL";
2803 	default:
2804 		return "UNKNOWN_ERROR";
2805 	}
2806 }
2807 
2808 static void
2809 iwi_dump_fw_event_log(struct iwi_softc *sc)
2810 {
2811 	u_int32_t ev, time, data, i, count, base;
2812 	base = CSR_READ_4(sc, IWI_FW_EVENT_LOG);
2813 	count = MEM_READ_4(sc, base);
2814 	if ( count > 0 && (sc->flags & IWI_FLAG_FW_INITED) ) {
2815 		printf("Reading %d event log entries from base address 0x%x.\n",
2816 			count,  base);
2817 		if (IWI_FW_EVENT_START_OFFSET <= count * IWI_FW_EVENT_ELEM_SIZE)
2818 			device_printf(sc->sc_dev,"Start IWI Event Log Dump:\n");
2819 		for (i = IWI_FW_EVENT_START_OFFSET;
2820 				i <= count * IWI_FW_EVENT_ELEM_SIZE;
2821 				i += IWI_FW_EVENT_ELEM_SIZE) {
2822 			ev = MEM_READ_4(sc, base + i);
2823 			time  = MEM_READ_4(sc, base + i + 1 * sizeof(u_int32_t));
2824 			data  = MEM_READ_4(sc, base + i + 2 * sizeof(u_int32_t));
2825 			printf("%d %8p %8.8d\n", time, (void *) data, ev);
2826 		}
2827 	} else {
2828 		printf("There are no entries in the firmware event log.\n");
2829 	}
2830 }
2831 
2832 static void
2833 iwi_dump_fw_error_log(struct iwi_softc *sc)
2834 {
2835 	u_int32_t i = 0;
2836 	int32_t count, base;
2837 	base = CSR_READ_4(sc, IWI_FW_ERROR_LOG);
2838 	count = MEM_READ_4(sc, base);
2839 	if ( count > 0 && (sc->flags & IWI_FLAG_FW_INITED) ) {
2840 		printf("Reading %d error log entries "
2841 		    "from base address 0x%p.\n", count,  (void *)base);
2842 		for ( i = IWI_FW_ERROR_START_OFFSET;
2843 			i <= count * IWI_FW_EVENT_ELEM_SIZE;
2844 			i += IWI_FW_ERROR_ELEM_SIZE ) {
2845 			u_int32_t elems;
2846 			printf("%15.15s",
2847 			    iwi_error_desc(MEM_READ_4(sc, base + i)));
2848 			printf(" time(%8.8d)", MEM_READ_4(sc, base + i + 4));
2849 			for ( elems = 2 ; elems < 7 ; elems++ ) {
2850 				printf(" %8p", (void *)
2851 				    MEM_READ_4(sc, base + i + (4 * elems)));
2852 			}
2853 			printf("\n");
2854 		}
2855 	}
2856 }
2857 
2858 static int
2859 iwi_sysctl_cts_to_self(SYSCTL_HANDLER_ARGS)
2860 {
2861 	struct iwi_softc *sc = (void *)arg1;
2862 	int cts_to_self = sc->enable_cts_to_self;
2863 	int error = sysctl_handle_int(oidp, &cts_to_self, 0, req);
2864 
2865 	(void)arg2; /* silence WARNS == 6 */
2866 
2867 	if ( !error && req->newptr && cts_to_self != sc->enable_cts_to_self ) {
2868 		switch ( cts_to_self ) {
2869 			case -1: case 0: case 1:
2870 				sc->enable_cts_to_self = cts_to_self;
2871 				error = iwi_adapter_config(sc, 0, 0);
2872 			break;
2873 		}
2874 	}
2875 	return error;
2876 }
2877 
2878 
2879 static int
2880 iwi_sysctl_antenna_diversity(SYSCTL_HANDLER_ARGS)
2881 {
2882 	struct iwi_softc *sc = (void *)arg1;
2883 	int antenna_diversity = sc->antenna_diversity;
2884 	int error = sysctl_handle_int(oidp, &antenna_diversity, 0, req);
2885 
2886 	(void)arg2; /* silence WARNS == 6 */
2887 
2888 	if ( !error && req->newptr && antenna_diversity != sc->antenna_diversity ) {
2889 		switch ( antenna_diversity ) {
2890 			case 1: case 3: case 0: case -1:
2891 				sc->antenna_diversity = antenna_diversity;
2892 				error = iwi_adapter_config(sc, 0, 0);
2893 			break;
2894 		}
2895 	}
2896 	return error;
2897 }
2898 
2899 static int
2900 iwi_sysctl_bg_autodetect(SYSCTL_HANDLER_ARGS)
2901 {
2902 	struct iwi_softc *sc = (void *)arg1;
2903 	int bg_autodetect = sc->enable_bg_autodetect;
2904 	int error = sysctl_handle_int(oidp, &bg_autodetect, 0, req);
2905 
2906 	(void)arg2; /* silence WARNS == 6 */
2907 
2908 	if ( !error && req->newptr && bg_autodetect != sc->enable_bg_autodetect ) {
2909 		switch ( bg_autodetect ) {
2910 			case 1: case 0: case -1:
2911 				sc->enable_bg_autodetect = bg_autodetect;
2912 				error = iwi_adapter_config(sc, 0, 0);
2913 			break;
2914 		}
2915 	}
2916 	return error;
2917 }
2918 
2919 static int
2920 iwi_sysctl_bt_coexist(SYSCTL_HANDLER_ARGS)
2921 {
2922 	struct iwi_softc *sc = (void *)arg1;
2923 	int bt_coexist = sc->enable_bt_coexist;
2924 	int error = sysctl_handle_int(oidp, &bt_coexist, 0, req);
2925 
2926 	(void)arg2; /* silence WARNS == 6 */
2927 
2928 	if ( !error && req->newptr && bt_coexist != sc->enable_bt_coexist ) {
2929 		switch ( bt_coexist ) {
2930 			case 1: case 0: case -1:
2931 				sc->enable_bt_coexist = bt_coexist;
2932 				error = iwi_adapter_config(sc, 0, 0);
2933 			break;
2934 		}
2935 	}
2936 	return error;
2937 }
2938 
2939 static int
2940 iwi_sysctl_dump_logs(SYSCTL_HANDLER_ARGS)
2941 {
2942 	struct iwi_softc *sc = arg1;
2943 	int result = -1;
2944 	int error = sysctl_handle_int(oidp, &result, 0, req);
2945 
2946 	(void)arg2; /* silence WARNS == 6 */
2947 
2948 	if (!error && req->newptr && result == 1) {
2949 		iwi_dump_fw_event_log(sc);
2950 		iwi_dump_fw_error_log(sc);
2951 	}
2952 	return error;
2953 }
2954 
2955 static int
2956 iwi_sysctl_stats(SYSCTL_HANDLER_ARGS)
2957 {
2958 	struct iwi_softc *sc = arg1;
2959 	u_int32_t size;
2960 	struct iwi_dump_buffer dump;
2961 
2962 	(void)arg2; /* silence WARNS == 6 */
2963 	(void)oidp; /* silence WARNS == 6 */
2964 
2965 	if (!(sc->flags & IWI_FLAG_FW_INITED)) {
2966 		bzero(dump.buf, sizeof dump.buf);
2967 		return SYSCTL_OUT(req, &dump, sizeof dump);
2968 	}
2969 
2970 	size = min(CSR_READ_4(sc, IWI_CSR_TABLE0_SIZE), 128 - 1);
2971 	CSR_READ_REGION_4(sc, IWI_CSR_TABLE0_BASE, &dump.buf[1], size);
2972 
2973 	return SYSCTL_OUT(req, &dump, sizeof dump);
2974 }
2975 
2976 static int
2977 iwi_sysctl_radio(SYSCTL_HANDLER_ARGS)
2978 {
2979 	struct iwi_softc *sc = arg1;
2980 	int val;
2981 
2982 	(void)arg2; /* silence WARNS == 6 */
2983 	(void)oidp; /* silence WARNS == 6 */
2984 
2985 	val = (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) ? 1 : 0;
2986 	return SYSCTL_OUT(req, &val, sizeof val);
2987 }
2988 
2989 static int
2990 iwi_sysctl_neg_best_rates_first(SYSCTL_HANDLER_ARGS)
2991 {
2992 	struct iwi_softc *sc = arg1;
2993 	int best_first = sc->enable_neg_best_first;
2994 	int error = sysctl_handle_int(oidp, &best_first, 0, req);
2995 
2996 	(void)arg2; /* silence WARNS == 6 */
2997 	(void)oidp; /* silence WARNS == 6 */
2998 
2999 	if ( !error && req->newptr && best_first != sc->enable_neg_best_first ) {
3000 		switch ( best_first ) {
3001 			case 1: case 0: case -1:
3002 				sc->enable_neg_best_first = best_first;
3003 			break;
3004 		}
3005 	}
3006 	return error;
3007 }
3008 
3009 static int
3010 iwi_sysctl_disable_unicast_decryption(SYSCTL_HANDLER_ARGS)
3011 {
3012 	struct iwi_softc *sc = arg1;
3013 	int disable_uni = sc->disable_unicast_decryption;
3014 	int error = sysctl_handle_int(oidp, &disable_uni, 0, req);
3015 
3016 	(void)arg2; /* silence WARNS == 6 */
3017 	(void)oidp; /* silence WARNS == 6 */
3018 
3019 	if (!error && req->newptr && disable_uni != sc->disable_unicast_decryption) {
3020 		switch ( disable_uni ) {
3021 			case 1: case 0: case -1:
3022 				sc->disable_unicast_decryption = disable_uni;
3023 			break;
3024 		}
3025 	}
3026 	return error;
3027 }
3028 
3029 static int
3030 iwi_sysctl_disable_multicast_decryption(SYSCTL_HANDLER_ARGS)
3031 {
3032 	struct iwi_softc *sc = arg1;
3033 	int disable_mul = sc->disable_multicast_decryption;
3034 	int error = sysctl_handle_int(oidp, &disable_mul, 0, req);
3035 
3036 	(void)arg2; /* silence WARNS == 6 */
3037 	(void)oidp; /* silence WARNS == 6 */
3038 
3039 	if (!error && req->newptr && disable_mul!=sc->disable_multicast_decryption){
3040 		switch ( disable_mul ) {
3041 			case 1: case 0: case -1:
3042 				sc->disable_multicast_decryption = disable_mul;
3043 			break;
3044 		}
3045 	}
3046 	return error;
3047 }
3048 
3049 
3050