xref: /openbsd/sys/dev/pci/if_iwi.c (revision 898184e3)
1 /*	$OpenBSD: if_iwi.c,v 1.111 2010/11/15 19:11:57 damien Exp $	*/
2 
3 /*-
4  * Copyright (c) 2004-2008
5  *      Damien Bergamini <damien.bergamini@free.fr>. All rights reserved.
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Intel PRO/Wireless 2200BG/2915ABG 802.11 network adapters.
22  */
23 
24 #include "bpfilter.h"
25 
26 #include <sys/param.h>
27 #include <sys/sockio.h>
28 #include <sys/mbuf.h>
29 #include <sys/kernel.h>
30 #include <sys/socket.h>
31 #include <sys/systm.h>
32 #include <sys/conf.h>
33 #include <sys/device.h>
34 #include <sys/workq.h>
35 
36 #include <machine/bus.h>
37 #include <machine/endian.h>
38 #include <machine/intr.h>
39 
40 #include <dev/pci/pcireg.h>
41 #include <dev/pci/pcivar.h>
42 #include <dev/pci/pcidevs.h>
43 
44 #if NBPFILTER > 0
45 #include <net/bpf.h>
46 #endif
47 #include <net/if.h>
48 #include <net/if_arp.h>
49 #include <net/if_dl.h>
50 #include <net/if_media.h>
51 #include <net/if_types.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/in_systm.h>
55 #include <netinet/in_var.h>
56 #include <netinet/if_ether.h>
57 #include <netinet/ip.h>
58 
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_radiotap.h>
61 
62 #include <dev/rndvar.h>
63 #include <crypto/arc4.h>
64 
65 #include <dev/pci/if_iwireg.h>
66 #include <dev/pci/if_iwivar.h>
67 
68 const struct pci_matchid iwi_devices[] = {
69 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2200BG },
70 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2225BG },
71 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1 },
72 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2 }
73 };
74 
75 int		iwi_match(struct device *, void *, void *);
76 void		iwi_attach(struct device *, struct device *, void *);
77 int		iwi_activate(struct device *, int);
78 void		iwi_resume(void *, void *);
79 int		iwi_alloc_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
80 void		iwi_reset_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
81 void		iwi_free_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
82 int		iwi_alloc_tx_ring(struct iwi_softc *, struct iwi_tx_ring *,
83 		    int);
84 void		iwi_reset_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
85 void		iwi_free_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
86 int		iwi_alloc_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
87 void		iwi_reset_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
88 void		iwi_free_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
89 int		iwi_media_change(struct ifnet *);
90 void		iwi_media_status(struct ifnet *, struct ifmediareq *);
91 uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
92 int		iwi_find_txnode(struct iwi_softc *, const uint8_t *);
93 int		iwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
94 uint8_t		iwi_rate(int);
95 void		iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *,
96 		    struct iwi_frame *);
97 void		iwi_notification_intr(struct iwi_softc *, struct iwi_rx_data *,
98 		    struct iwi_notif *);
99 void		iwi_rx_intr(struct iwi_softc *);
100 void		iwi_tx_intr(struct iwi_softc *, struct iwi_tx_ring *);
101 int		iwi_intr(void *);
102 int		iwi_cmd(struct iwi_softc *, uint8_t, void *, uint8_t, int);
103 int		iwi_send_mgmt(struct ieee80211com *, struct ieee80211_node *,
104 		    int, int, int);
105 int		iwi_tx_start(struct ifnet *, struct mbuf *,
106 		    struct ieee80211_node *);
107 void		iwi_start(struct ifnet *);
108 void		iwi_watchdog(struct ifnet *);
109 int		iwi_ioctl(struct ifnet *, u_long, caddr_t);
110 void		iwi_stop_master(struct iwi_softc *);
111 int		iwi_reset(struct iwi_softc *);
112 int		iwi_load_ucode(struct iwi_softc *, const char *, int);
113 int		iwi_load_firmware(struct iwi_softc *, const char *, int);
114 int		iwi_config(struct iwi_softc *);
115 void		iwi_update_edca(struct ieee80211com *);
116 int		iwi_set_chan(struct iwi_softc *, struct ieee80211_channel *);
117 int		iwi_scan(struct iwi_softc *);
118 int		iwi_auth_and_assoc(struct iwi_softc *);
119 int		iwi_init(struct ifnet *);
120 void		iwi_stop(struct ifnet *, int);
121 
122 static __inline uint8_t
123 MEM_READ_1(struct iwi_softc *sc, uint32_t addr)
124 {
125 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
126 	return CSR_READ_1(sc, IWI_CSR_INDIRECT_DATA);
127 }
128 
129 static __inline uint32_t
130 MEM_READ_4(struct iwi_softc *sc, uint32_t addr)
131 {
132 	CSR_WRITE_4(sc, IWI_CSR_INDIRECT_ADDR, addr);
133 	return CSR_READ_4(sc, IWI_CSR_INDIRECT_DATA);
134 }
135 
136 #ifdef IWI_DEBUG
137 #define DPRINTF(x)	do { if (iwi_debug > 0) printf x; } while (0)
138 #define DPRINTFN(n, x)	do { if (iwi_debug >= (n)) printf x; } while (0)
139 int iwi_debug = 0;
140 #else
141 #define DPRINTF(x)
142 #define DPRINTFN(n, x)
143 #endif
144 
145 struct cfattach iwi_ca = {
146 	sizeof (struct iwi_softc), iwi_match, iwi_attach, NULL,
147 	iwi_activate
148 };
149 
150 int
151 iwi_match(struct device *parent, void *match, void *aux)
152 {
153 	return pci_matchbyid((struct pci_attach_args *)aux, iwi_devices,
154 	    nitems(iwi_devices));
155 }
156 
157 /* Base Address Register */
158 #define IWI_PCI_BAR0	0x10
159 
160 void
161 iwi_attach(struct device *parent, struct device *self, void *aux)
162 {
163 	struct iwi_softc *sc = (struct iwi_softc *)self;
164 	struct ieee80211com *ic = &sc->sc_ic;
165 	struct ifnet *ifp = &ic->ic_if;
166 	struct pci_attach_args *pa = aux;
167 	const char *intrstr;
168 	bus_space_tag_t memt;
169 	bus_space_handle_t memh;
170 	pci_intr_handle_t ih;
171 	pcireg_t data;
172 	uint16_t val;
173 	int error, ac, i;
174 
175 	sc->sc_pct = pa->pa_pc;
176 	sc->sc_pcitag = pa->pa_tag;
177 
178 	/* clear device specific PCI configuration register 0x41 */
179 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
180 	data &= ~0x0000ff00;
181 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
182 
183 	/* map the register window */
184 	error = pci_mapreg_map(pa, IWI_PCI_BAR0, PCI_MAPREG_TYPE_MEM |
185 	    PCI_MAPREG_MEM_TYPE_32BIT, 0, &memt, &memh, NULL, &sc->sc_sz, 0);
186 	if (error != 0) {
187 		printf(": can't map mem space\n");
188 		return;
189 	}
190 
191 	sc->sc_st = memt;
192 	sc->sc_sh = memh;
193 	sc->sc_dmat = pa->pa_dmat;
194 
195 	if (pci_intr_map(pa, &ih) != 0) {
196 		printf(": can't map interrupt\n");
197 		return;
198 	}
199 
200 	intrstr = pci_intr_string(sc->sc_pct, ih);
201 	sc->sc_ih = pci_intr_establish(sc->sc_pct, ih, IPL_NET, iwi_intr, sc,
202 	    sc->sc_dev.dv_xname);
203 	if (sc->sc_ih == NULL) {
204 		printf(": can't establish interrupt");
205 		if (intrstr != NULL)
206 			printf(" at %s", intrstr);
207 		printf("\n");
208 		return;
209 	}
210 	printf(": %s", intrstr);
211 
212 	if (iwi_reset(sc) != 0) {
213 		printf(": could not reset adapter\n");
214 		return;
215 	}
216 
217 	/*
218 	 * Allocate rings.
219 	 */
220 	if (iwi_alloc_cmd_ring(sc, &sc->cmdq) != 0) {
221 		printf(": could not allocate Cmd ring\n");
222 		return;
223 	}
224 	for (ac = 0; ac < EDCA_NUM_AC; ac++) {
225 		if (iwi_alloc_tx_ring(sc, &sc->txq[ac], ac) != 0) {
226 			printf(": could not allocate Tx ring %d\n", ac);
227 			goto fail;
228 		}
229 	}
230 	if (iwi_alloc_rx_ring(sc, &sc->rxq) != 0) {
231 		printf(": could not allocate Rx ring\n");
232 		goto fail;
233 	}
234 
235 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
236 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
237 	ic->ic_state = IEEE80211_S_INIT;
238 
239 	/* set device capabilities */
240 	ic->ic_caps =
241 #ifndef IEEE80211_STA_ONLY
242 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
243 #endif
244 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
245 	    IEEE80211_C_TXPMGT |	/* tx power management */
246 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
247 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
248 	    IEEE80211_C_WEP |		/* s/w WEP */
249 	    IEEE80211_C_RSN |		/* WPA/RSN supported */
250 	    IEEE80211_C_SCANALL;	/* h/w scanning */
251 
252 	/* read MAC address from EEPROM */
253 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
254 	ic->ic_myaddr[0] = val & 0xff;
255 	ic->ic_myaddr[1] = val >> 8;
256 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
257 	ic->ic_myaddr[2] = val & 0xff;
258 	ic->ic_myaddr[3] = val >> 8;
259 	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
260 	ic->ic_myaddr[4] = val & 0xff;
261 	ic->ic_myaddr[5] = val >> 8;
262 
263 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
264 
265 	if (PCI_PRODUCT(pa->pa_id) >= PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1) {
266 		/* set supported .11a rates */
267 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
268 		    ieee80211_std_rateset_11a;
269 
270 		/* set supported .11a channels */
271 		for (i = 36; i <= 64; i += 4) {
272 			ic->ic_channels[i].ic_freq =
273 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
274 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
275 		}
276 		for (i = 149; i <= 165; i += 4) {
277 			ic->ic_channels[i].ic_freq =
278 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
279 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
280 		}
281 	}
282 
283 	/* set supported .11b and .11g rates */
284 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
285 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
286 
287 	/* set supported .11b and .11g channels (1 through 14) */
288 	for (i = 1; i <= 14; i++) {
289 		ic->ic_channels[i].ic_freq =
290 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
291 		ic->ic_channels[i].ic_flags =
292 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
293 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
294 	}
295 
296 	/* IBSS channel undefined for now */
297 	ic->ic_ibss_chan = &ic->ic_channels[0];
298 
299 	ifp->if_softc = sc;
300 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
301 	ifp->if_ioctl = iwi_ioctl;
302 	ifp->if_start = iwi_start;
303 	ifp->if_watchdog = iwi_watchdog;
304 	IFQ_SET_READY(&ifp->if_snd);
305 	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
306 
307 	if_attach(ifp);
308 	ieee80211_ifattach(ifp);
309 	/* override state transition machine */
310 	sc->sc_newstate = ic->ic_newstate;
311 	ic->ic_newstate = iwi_newstate;
312 	ic->ic_send_mgmt = iwi_send_mgmt;
313 	ieee80211_media_init(ifp, iwi_media_change, iwi_media_status);
314 
315 #if NBPFILTER > 0
316 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
317 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
318 
319 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
320 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
321 	sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
322 
323 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
324 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
325 	sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
326 #endif
327 
328 	return;
329 
330 fail:	while (--ac >= 0)
331 		iwi_free_tx_ring(sc, &sc->txq[ac]);
332 	iwi_free_cmd_ring(sc, &sc->cmdq);
333 }
334 
335 int
336 iwi_activate(struct device *self, int act)
337 {
338 	struct iwi_softc *sc = (struct iwi_softc *)self;
339 	struct ifnet *ifp = &sc->sc_ic.ic_if;
340 
341 	switch (act) {
342 	case DVACT_SUSPEND:
343 		if (ifp->if_flags & IFF_RUNNING)
344 			iwi_stop(ifp, 0);
345 		break;
346 	case DVACT_RESUME:
347 		workq_queue_task(NULL, &sc->sc_resume_wqt, 0,
348 		    iwi_resume, sc, NULL);
349 		break;
350 	}
351 
352 	return 0;
353 }
354 
355 void
356 iwi_resume(void *arg1, void *arg2)
357 {
358 	struct iwi_softc *sc = arg1;
359 	struct ifnet *ifp = &sc->sc_ic.ic_if;
360 	pcireg_t data;
361 	int s;
362 
363 	/* clear device specific PCI configuration register 0x41 */
364 	data = pci_conf_read(sc->sc_pct, sc->sc_pcitag, 0x40);
365 	data &= ~0x0000ff00;
366 	pci_conf_write(sc->sc_pct, sc->sc_pcitag, 0x40, data);
367 
368 	s = splnet();
369 	while (sc->sc_flags & IWI_FLAG_BUSY)
370 		tsleep(&sc->sc_flags, 0, "iwipwr", 0);
371 	sc->sc_flags |= IWI_FLAG_BUSY;
372 
373 	if (ifp->if_flags & IFF_UP)
374 		iwi_init(ifp);
375 
376 	sc->sc_flags &= ~IWI_FLAG_BUSY;
377 	wakeup(&sc->sc_flags);
378 	splx(s);
379 }
380 
381 int
382 iwi_alloc_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
383 {
384 	int nsegs, error;
385 
386 	ring->queued = 0;
387 	ring->cur = ring->next = 0;
388 
389 	error = bus_dmamap_create(sc->sc_dmat,
390 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, 1,
391 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, 0,
392 	    BUS_DMA_NOWAIT, &ring->map);
393 	if (error != 0) {
394 		printf("%s: could not create cmd ring DMA map\n",
395 		    sc->sc_dev.dv_xname);
396 		goto fail;
397 	}
398 
399 	error = bus_dmamem_alloc(sc->sc_dmat,
400 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, PAGE_SIZE, 0,
401 	    &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
402 	if (error != 0) {
403 		printf("%s: could not allocate cmd ring DMA memory\n",
404 		    sc->sc_dev.dv_xname);
405 		goto fail;
406 	}
407 
408 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
409 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT,
410 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
411 	if (error != 0) {
412 		printf("%s: can't map cmd ring DMA memory\n",
413 		    sc->sc_dev.dv_xname);
414 		goto fail;
415 	}
416 
417 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
418 	    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT, NULL,
419 	    BUS_DMA_NOWAIT);
420 	if (error != 0) {
421 		printf("%s: could not load cmd ring DMA map\n",
422 		    sc->sc_dev.dv_xname);
423 		goto fail;
424 	}
425 
426 	return 0;
427 
428 fail:	iwi_free_cmd_ring(sc, ring);
429 	return error;
430 }
431 
432 void
433 iwi_reset_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
434 {
435 	ring->queued = 0;
436 	ring->cur = ring->next = 0;
437 }
438 
439 void
440 iwi_free_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
441 {
442 	if (ring->map != NULL) {
443 		if (ring->desc != NULL) {
444 			bus_dmamap_unload(sc->sc_dmat, ring->map);
445 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
446 			    sizeof (struct iwi_cmd_desc) * IWI_CMD_RING_COUNT);
447 			bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
448 		}
449 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
450 	}
451 }
452 
453 int
454 iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring, int ac)
455 {
456 	struct iwi_tx_data *data;
457 	int i, nsegs, error;
458 
459 	ring->queued = 0;
460 	ring->cur = ring->next = 0;
461 	ring->csr_ridx = IWI_CSR_TX_RIDX(ac);
462 	ring->csr_widx = IWI_CSR_TX_WIDX(ac);
463 
464 	error = bus_dmamap_create(sc->sc_dmat,
465 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, 1,
466 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, 0, BUS_DMA_NOWAIT,
467 	    &ring->map);
468 	if (error != 0) {
469 		printf("%s: could not create tx ring DMA map\n",
470 		    sc->sc_dev.dv_xname);
471 		goto fail;
472 	}
473 
474 	error = bus_dmamem_alloc(sc->sc_dmat,
475 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, PAGE_SIZE, 0,
476 	    &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
477 	if (error != 0) {
478 		printf("%s: could not allocate tx ring DMA memory\n",
479 		    sc->sc_dev.dv_xname);
480 		goto fail;
481 	}
482 
483 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
484 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT,
485 	    (caddr_t *)&ring->desc, BUS_DMA_NOWAIT);
486 	if (error != 0) {
487 		printf("%s: can't map tx ring DMA memory\n",
488 		    sc->sc_dev.dv_xname);
489 		goto fail;
490 	}
491 
492 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
493 	    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT, NULL,
494 	    BUS_DMA_NOWAIT);
495 	if (error != 0) {
496 		printf("%s: could not load tx ring DMA map\n",
497 		    sc->sc_dev.dv_xname);
498 		goto fail;
499 	}
500 
501 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
502 		data = &ring->data[i];
503 
504 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
505 		    IWI_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT, &data->map);
506 		if (error != 0) {
507 			printf("%s: could not create tx buf DMA map\n",
508 			    sc->sc_dev.dv_xname);
509 			goto fail;
510 		}
511 	}
512 
513 	return 0;
514 
515 fail:	iwi_free_tx_ring(sc, ring);
516 	return error;
517 }
518 
519 void
520 iwi_reset_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
521 {
522 	struct iwi_tx_data *data;
523 	int i;
524 
525 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
526 		data = &ring->data[i];
527 
528 		if (data->m != NULL) {
529 			bus_dmamap_unload(sc->sc_dmat, data->map);
530 			m_freem(data->m);
531 			data->m = NULL;
532 		}
533 	}
534 
535 	ring->queued = 0;
536 	ring->cur = ring->next = 0;
537 }
538 
539 void
540 iwi_free_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
541 {
542 	struct iwi_tx_data *data;
543 	int i;
544 
545 	if (ring->map != NULL) {
546 		if (ring->desc != NULL) {
547 			bus_dmamap_unload(sc->sc_dmat, ring->map);
548 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
549 			    sizeof (struct iwi_tx_desc) * IWI_TX_RING_COUNT);
550 			bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
551 		}
552 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
553 	}
554 
555 	for (i = 0; i < IWI_TX_RING_COUNT; i++) {
556 		data = &ring->data[i];
557 
558 		if (data->m != NULL) {
559 			bus_dmamap_unload(sc->sc_dmat, data->map);
560 			m_freem(data->m);
561 		}
562 		bus_dmamap_destroy(sc->sc_dmat, data->map);
563 	}
564 }
565 
566 int
567 iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
568 {
569 	struct iwi_rx_data *data;
570 	int i, error;
571 
572 	ring->cur = 0;
573 
574 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
575 		data = &sc->rxq.data[i];
576 
577 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
578 		    0, BUS_DMA_NOWAIT, &data->map);
579 		if (error != 0) {
580 			printf("%s: could not create rx buf DMA map\n",
581 			    sc->sc_dev.dv_xname);
582 			goto fail;
583 		}
584 
585 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
586 		if (data->m == NULL) {
587 			printf("%s: could not allocate rx mbuf\n",
588 			    sc->sc_dev.dv_xname);
589 			error = ENOMEM;
590 			goto fail;
591 		}
592 		MCLGET(data->m, M_DONTWAIT);
593 		if (!(data->m->m_flags & M_EXT)) {
594 			m_freem(data->m);
595 			data->m = NULL;
596 			printf("%s: could not allocate rx mbuf cluster\n",
597 			    sc->sc_dev.dv_xname);
598 			error = ENOMEM;
599 			goto fail;
600 		}
601 
602 		error = bus_dmamap_load(sc->sc_dmat, data->map,
603 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
604 		if (error != 0) {
605 			printf("%s: could not load rx buf DMA map\n",
606 			    sc->sc_dev.dv_xname);
607 			goto fail;
608 		}
609 
610 		data->reg = IWI_CSR_RX_BASE + i * 4;
611 	}
612 
613 	return 0;
614 
615 fail:	iwi_free_rx_ring(sc, ring);
616 	return error;
617 }
618 
619 void
620 iwi_reset_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
621 {
622 	ring->cur = 0;
623 }
624 
625 void
626 iwi_free_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
627 {
628 	struct iwi_rx_data *data;
629 	int i;
630 
631 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
632 		data = &sc->rxq.data[i];
633 
634 		if (data->m != NULL) {
635 			bus_dmamap_unload(sc->sc_dmat, data->map);
636 			m_freem(data->m);
637 		}
638 		bus_dmamap_destroy(sc->sc_dmat, data->map);
639 	}
640 }
641 
642 int
643 iwi_media_change(struct ifnet *ifp)
644 {
645 	int error;
646 
647 	error = ieee80211_media_change(ifp);
648 	if (error != ENETRESET)
649 		return error;
650 
651 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
652 		iwi_init(ifp);
653 
654 	return 0;
655 }
656 
657 void
658 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
659 {
660 	struct iwi_softc *sc = ifp->if_softc;
661 	struct ieee80211com *ic = &sc->sc_ic;
662 	uint32_t val;
663 	int rate;
664 
665 	imr->ifm_status = IFM_AVALID;
666 	imr->ifm_active = IFM_IEEE80211;
667 	if (ic->ic_state == IEEE80211_S_RUN)
668 		imr->ifm_status |= IFM_ACTIVE;
669 
670 	/* read current transmission rate from adapter */
671 	val = CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE);
672 	/* convert PLCP signal to 802.11 rate */
673 	rate = iwi_rate(val);
674 
675 	imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
676 	switch (ic->ic_opmode) {
677 	case IEEE80211_M_STA:
678 		break;
679 #ifndef IEEE80211_STA_ONLY
680 	case IEEE80211_M_IBSS:
681 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
682 		break;
683 #endif
684 	case IEEE80211_M_MONITOR:
685 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
686 		break;
687 	default:
688 		/* should not get there */
689 		break;
690 	}
691 }
692 
693 #ifndef IEEE80211_STA_ONLY
694 /*
695  * This is only used for IBSS mode where the firmware expect an index to an
696  * internal node table instead of a destination address.
697  */
698 int
699 iwi_find_txnode(struct iwi_softc *sc, const uint8_t *macaddr)
700 {
701 	struct iwi_node node;
702 	int i;
703 
704 	for (i = 0; i < sc->nsta; i++)
705 		if (IEEE80211_ADDR_EQ(sc->sta[i], macaddr))
706 			return i;	/* already existing node */
707 
708 	if (i == IWI_MAX_NODE)
709 		return -1;	/* no place left in neighbor table */
710 
711 	/* save this new node in our softc table */
712 	IEEE80211_ADDR_COPY(sc->sta[i], macaddr);
713 	sc->nsta = i;
714 
715 	/* write node information into NIC memory */
716 	bzero(&node, sizeof node);
717 	IEEE80211_ADDR_COPY(node.bssid, macaddr);
718 
719 	CSR_WRITE_REGION_1(sc, IWI_CSR_NODE_BASE + i * sizeof node,
720 	    (uint8_t *)&node, sizeof node);
721 
722 	return i;
723 }
724 #endif
725 
726 int
727 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
728 {
729 	struct iwi_softc *sc = ic->ic_softc;
730 	enum ieee80211_state ostate;
731 	uint32_t tmp;
732 
733 	ostate = ic->ic_state;
734 
735 	switch (nstate) {
736 	case IEEE80211_S_SCAN:
737 		iwi_scan(sc);
738 		break;
739 
740 	case IEEE80211_S_AUTH:
741 		iwi_auth_and_assoc(sc);
742 		break;
743 
744 	case IEEE80211_S_RUN:
745 #ifndef IEEE80211_STA_ONLY
746 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
747 			sc->nsta = 0;	/* flush IBSS nodes */
748 			ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
749 		} else
750 #endif
751 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
752 			iwi_set_chan(sc, ic->ic_ibss_chan);
753 
754 		/* assoc led on */
755 		tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
756 		MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp | IWI_LED_ASSOC);
757 		break;
758 
759 	case IEEE80211_S_INIT:
760 		if (ostate != IEEE80211_S_RUN)
761 			break;
762 
763 		/* assoc led off */
764 		tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
765 		MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp & ~IWI_LED_ASSOC);
766 		break;
767 
768 	case IEEE80211_S_ASSOC:
769 		break;
770 	}
771 
772 	ic->ic_state = nstate;
773 	return 0;
774 }
775 
776 /*
777  * Read 16 bits at address 'addr' from the serial EEPROM.
778  * DON'T PLAY WITH THIS CODE UNLESS YOU KNOW *EXACTLY* WHAT YOU'RE DOING!
779  */
780 uint16_t
781 iwi_read_prom_word(struct iwi_softc *sc, uint8_t addr)
782 {
783 	uint32_t tmp;
784 	uint16_t val;
785 	int n;
786 
787 	/* clock C once before the first command */
788 	IWI_EEPROM_CTL(sc, 0);
789 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
790 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
791 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
792 
793 	/* write start bit (1) */
794 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
795 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
796 
797 	/* write READ opcode (10) */
798 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
799 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
800 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
801 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
802 
803 	/* write address A7-A0 */
804 	for (n = 7; n >= 0; n--) {
805 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
806 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
807 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
808 		    (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
809 	}
810 
811 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
812 
813 	/* read data Q15-Q0 */
814 	val = 0;
815 	for (n = 15; n >= 0; n--) {
816 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
817 		IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
818 		tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
819 		val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
820 	}
821 
822 	IWI_EEPROM_CTL(sc, 0);
823 
824 	/* clear Chip Select and clock C */
825 	IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
826 	IWI_EEPROM_CTL(sc, 0);
827 	IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
828 
829 	return val;
830 }
831 
832 uint8_t
833 iwi_rate(int plcp)
834 {
835 	switch (plcp) {
836 	/* CCK rates (values are device-dependent) */
837 	case  10:	return 2;
838 	case  20:	return 4;
839 	case  55:	return 11;
840 	case 110:	return 22;
841 
842 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
843 	case 0xd:	return 12;
844 	case 0xf:	return 18;
845 	case 0x5:	return 24;
846 	case 0x7:	return 36;
847 	case 0x9:	return 48;
848 	case 0xb:	return 72;
849 	case 0x1:	return 96;
850 	case 0x3:	return 108;
851 
852 	/* unknown rate: should not happen */
853 	default:	return 0;
854 	}
855 }
856 
857 void
858 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_data *data,
859     struct iwi_frame *frame)
860 {
861 	struct ieee80211com *ic = &sc->sc_ic;
862 	struct ifnet *ifp = &ic->ic_if;
863 	struct mbuf *mnew, *m;
864 	struct ieee80211_frame *wh;
865 	struct ieee80211_rxinfo rxi;
866 	struct ieee80211_node *ni;
867 	int error;
868 
869 	DPRINTFN(5, ("received frame len=%u chan=%u rssi=%u\n",
870 	    letoh16(frame->len), frame->chan, frame->rssi_dbm));
871 
872 	if (letoh16(frame->len) < sizeof (struct ieee80211_frame_min) ||
873 	    letoh16(frame->len) > MCLBYTES) {
874 		DPRINTF(("%s: bad frame length\n", sc->sc_dev.dv_xname));
875 		ifp->if_ierrors++;
876 		return;
877 	}
878 
879 	/*
880 	 * Try to allocate a new mbuf for this ring element and load it before
881 	 * processing the current mbuf.  If the ring element cannot be loaded,
882 	 * drop the received packet and reuse the old mbuf.  In the unlikely
883 	 * case that the old mbuf can't be reloaded either, explicitly panic.
884 	 */
885 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
886 	if (mnew == NULL) {
887 		ifp->if_ierrors++;
888 		return;
889 	}
890 	MCLGET(mnew, M_DONTWAIT);
891 	if (!(mnew->m_flags & M_EXT)) {
892 		m_freem(mnew);
893 		ifp->if_ierrors++;
894 		return;
895 	}
896 
897 	bus_dmamap_unload(sc->sc_dmat, data->map);
898 
899 	error = bus_dmamap_load(sc->sc_dmat, data->map, mtod(mnew, void *),
900 	    MCLBYTES, NULL, BUS_DMA_NOWAIT);
901 	if (error != 0) {
902 		m_freem(mnew);
903 
904 		/* try to reload the old mbuf */
905 		error = bus_dmamap_load(sc->sc_dmat, data->map,
906 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
907 		if (error != 0) {
908 			/* very unlikely that it will fail... */
909 			panic("%s: could not load old rx mbuf",
910 			    sc->sc_dev.dv_xname);
911 		}
912 		CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
913 		ifp->if_ierrors++;
914 		return;
915 	}
916 
917 	m = data->m;
918 	data->m = mnew;
919 	CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
920 
921 	/* finalize mbuf */
922 	m->m_pkthdr.rcvif = ifp;
923 	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
924 	    sizeof (struct iwi_frame) + letoh16(frame->len);
925 	m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
926 
927 #if NBPFILTER > 0
928 	if (sc->sc_drvbpf != NULL) {
929 		struct mbuf mb;
930 		struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
931 
932 		tap->wr_flags = 0;
933 		tap->wr_rate = iwi_rate(frame->rate);
934 		tap->wr_chan_freq =
935 		    htole16(ic->ic_channels[frame->chan].ic_freq);
936 		tap->wr_chan_flags =
937 		    htole16(ic->ic_channels[frame->chan].ic_flags);
938 		tap->wr_antsignal = frame->signal;
939 		tap->wr_antenna = frame->antenna & 0x3;
940 		if (frame->antenna & 0x40)
941 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
942 
943 		mb.m_data = (caddr_t)tap;
944 		mb.m_len = sc->sc_rxtap_len;
945 		mb.m_next = m;
946 		mb.m_nextpkt = NULL;
947 		mb.m_type = 0;
948 		mb.m_flags = 0;
949 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
950 	}
951 #endif
952 
953 	wh = mtod(m, struct ieee80211_frame *);
954 	ni = ieee80211_find_rxnode(ic, wh);
955 
956 	/* send the frame to the upper layer */
957 	rxi.rxi_flags = 0;
958 	rxi.rxi_rssi = frame->rssi_dbm;
959 	rxi.rxi_tstamp = 0;	/* unused */
960 	ieee80211_input(ifp, m, ni, &rxi);
961 
962 	/* node is no longer needed */
963 	ieee80211_release_node(ic, ni);
964 }
965 
966 void
967 iwi_notification_intr(struct iwi_softc *sc, struct iwi_rx_data *data,
968     struct iwi_notif *notif)
969 {
970 	struct ieee80211com *ic = &sc->sc_ic;
971 	struct ifnet *ifp = &ic->ic_if;
972 
973 	switch (notif->type) {
974 	case IWI_NOTIF_TYPE_SCAN_CHANNEL:
975 	{
976 #ifdef IWI_DEBUG
977 		struct iwi_notif_scan_channel *chan =
978 		    (struct iwi_notif_scan_channel *)(notif + 1);
979 #endif
980 		DPRINTFN(2, ("Scanning channel (%u)\n", chan->nchan));
981 		break;
982 	}
983 	case IWI_NOTIF_TYPE_SCAN_COMPLETE:
984 	{
985 #ifdef IWI_DEBUG
986 		struct iwi_notif_scan_complete *scan =
987 		    (struct iwi_notif_scan_complete *)(notif + 1);
988 #endif
989 		DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
990 		    scan->status));
991 
992 		/* monitor mode uses scan to set the channel ... */
993 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
994 			ieee80211_end_scan(ifp);
995 		else
996 			iwi_set_chan(sc, ic->ic_ibss_chan);
997 		break;
998 	}
999 	case IWI_NOTIF_TYPE_AUTHENTICATION:
1000 	{
1001 		struct iwi_notif_authentication *auth =
1002 		    (struct iwi_notif_authentication *)(notif + 1);
1003 
1004 		DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1005 
1006 		switch (auth->state) {
1007 		case IWI_AUTHENTICATED:
1008 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1009 			break;
1010 
1011 		case IWI_DEAUTHENTICATED:
1012 			break;
1013 
1014 		default:
1015 			printf("%s: unknown authentication state %u\n",
1016 			    sc->sc_dev.dv_xname, auth->state);
1017 		}
1018 		break;
1019 	}
1020 	case IWI_NOTIF_TYPE_ASSOCIATION:
1021 	{
1022 		struct iwi_notif_association *assoc =
1023 		    (struct iwi_notif_association *)(notif + 1);
1024 
1025 		DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1026 		    assoc->status));
1027 
1028 		switch (assoc->state) {
1029 		case IWI_AUTHENTICATED:
1030 			/* re-association, do nothing */
1031 			break;
1032 
1033 		case IWI_ASSOCIATED:
1034 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1035 			break;
1036 
1037 		case IWI_DEASSOCIATED:
1038 			ieee80211_begin_scan(ifp);
1039 			break;
1040 
1041 		default:
1042 			printf("%s: unknown association state %u\n",
1043 			    sc->sc_dev.dv_xname, assoc->state);
1044 		}
1045 		break;
1046 	}
1047 	case IWI_NOTIF_TYPE_BEACON:
1048 	{
1049 		struct iwi_notif_beacon *beacon =
1050 		    (struct iwi_notif_beacon *)(notif + 1);
1051 
1052 		if (letoh32(beacon->status) == IWI_BEACON_MISSED) {
1053 			/* XXX should roam when too many beacons missed */
1054 			DPRINTFN(2, ("%s: %u beacon(s) missed\n",
1055 			    sc->sc_dev.dv_xname, letoh32(beacon->count)));
1056 		}
1057 		break;
1058 	}
1059 	case IWI_NOTIF_TYPE_BAD_LINK:
1060 		DPRINTFN(2, ("link deterioration detected\n"));
1061 		break;
1062 
1063 	case IWI_NOTIF_TYPE_NOISE:
1064 		DPRINTFN(5, ("Measured noise %u\n",
1065 		    letoh32(*(uint32_t *)(notif + 1)) & 0xff));
1066 		break;
1067 
1068 	default:
1069 		DPRINTFN(5, ("Notification (%u)\n", notif->type));
1070 	}
1071 }
1072 
1073 void
1074 iwi_rx_intr(struct iwi_softc *sc)
1075 {
1076 	struct iwi_rx_data *data;
1077 	struct iwi_hdr *hdr;
1078 	uint32_t hw;
1079 
1080 	hw = CSR_READ_4(sc, IWI_CSR_RX_RIDX);
1081 
1082 	for (; sc->rxq.cur != hw;) {
1083 		data = &sc->rxq.data[sc->rxq.cur];
1084 
1085 		bus_dmamap_sync(sc->sc_dmat, data->map, 0, MCLBYTES,
1086 		    BUS_DMASYNC_POSTREAD);
1087 
1088 		hdr = mtod(data->m, struct iwi_hdr *);
1089 
1090 		switch (hdr->type) {
1091 		case IWI_HDR_TYPE_FRAME:
1092 			iwi_frame_intr(sc, data,
1093 			    (struct iwi_frame *)(hdr + 1));
1094 			break;
1095 
1096 		case IWI_HDR_TYPE_NOTIF:
1097 			iwi_notification_intr(sc, data,
1098 			    (struct iwi_notif *)(hdr + 1));
1099 			break;
1100 
1101 		default:
1102 			printf("%s: unknown hdr type %u\n",
1103 			    sc->sc_dev.dv_xname, hdr->type);
1104 		}
1105 
1106 		sc->rxq.cur = (sc->rxq.cur + 1) % IWI_RX_RING_COUNT;
1107 	}
1108 
1109 	/* tell the firmware what we have processed */
1110 	hw = (hw == 0) ? IWI_RX_RING_COUNT - 1 : hw - 1;
1111 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, hw);
1112 }
1113 
1114 void
1115 iwi_tx_intr(struct iwi_softc *sc, struct iwi_tx_ring *txq)
1116 {
1117 	struct ieee80211com *ic = &sc->sc_ic;
1118 	struct ifnet *ifp = &ic->ic_if;
1119 	struct iwi_tx_data *data;
1120 	uint32_t hw;
1121 
1122 	hw = CSR_READ_4(sc, txq->csr_ridx);
1123 
1124 	for (; txq->next != hw;) {
1125 		data = &txq->data[txq->next];
1126 
1127 		bus_dmamap_unload(sc->sc_dmat, data->map);
1128 		m_freem(data->m);
1129 		data->m = NULL;
1130 		ieee80211_release_node(ic, data->ni);
1131 		data->ni = NULL;
1132 
1133 		ifp->if_opackets++;
1134 
1135 		txq->queued--;
1136 		txq->next = (txq->next + 1) % IWI_TX_RING_COUNT;
1137 	}
1138 
1139 	sc->sc_tx_timer = 0;
1140 	ifp->if_flags &= ~IFF_OACTIVE;
1141 	(*ifp->if_start)(ifp);
1142 }
1143 
1144 int
1145 iwi_intr(void *arg)
1146 {
1147 	struct iwi_softc *sc = arg;
1148 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1149 	uint32_t r;
1150 
1151 	if ((r = CSR_READ_4(sc, IWI_CSR_INTR)) == 0 || r == 0xffffffff)
1152 		return 0;
1153 
1154 	/* disable interrupts */
1155 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1156 
1157 	/* acknowledge interrupts */
1158 	CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1159 
1160 	if (r & IWI_INTR_FATAL_ERROR) {
1161 		printf("%s: fatal firmware error\n", sc->sc_dev.dv_xname);
1162 		ifp->if_flags &= ~IFF_UP;
1163 		iwi_stop(ifp, 1);
1164 		return 1;
1165 	}
1166 
1167 	if (r & IWI_INTR_FW_INITED)
1168 		wakeup(sc);
1169 
1170 	if (r & IWI_INTR_RADIO_OFF) {
1171 		DPRINTF(("radio transmitter off\n"));
1172 		ifp->if_flags &= ~IFF_UP;
1173 		iwi_stop(ifp, 1);
1174 		return 1;
1175 	}
1176 
1177 	if (r & IWI_INTR_CMD_DONE) {
1178 		/* kick next pending command if any */
1179 		sc->cmdq.next = (sc->cmdq.next + 1) % IWI_CMD_RING_COUNT;
1180 		if (--sc->cmdq.queued > 0)
1181 			CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.next);
1182 
1183 		wakeup(sc);
1184 	}
1185 
1186 	if (r & IWI_INTR_TX1_DONE)
1187 		iwi_tx_intr(sc, &sc->txq[0]);
1188 
1189 	if (r & IWI_INTR_TX2_DONE)
1190 		iwi_tx_intr(sc, &sc->txq[1]);
1191 
1192 	if (r & IWI_INTR_TX3_DONE)
1193 		iwi_tx_intr(sc, &sc->txq[2]);
1194 
1195 	if (r & IWI_INTR_TX4_DONE)
1196 		iwi_tx_intr(sc, &sc->txq[3]);
1197 
1198 	if (r & IWI_INTR_RX_DONE)
1199 		iwi_rx_intr(sc);
1200 
1201 	/* re-enable interrupts */
1202 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1203 
1204 	return 1;
1205 }
1206 
1207 int
1208 iwi_cmd(struct iwi_softc *sc, uint8_t type, void *data, uint8_t len, int async)
1209 {
1210 	struct iwi_cmd_desc *desc;
1211 
1212 	desc = &sc->cmdq.desc[sc->cmdq.cur];
1213 	desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1214 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1215 	desc->type = type;
1216 	desc->len = len;
1217 	bcopy(data, desc->data, len);
1218 
1219 	bus_dmamap_sync(sc->sc_dmat, sc->cmdq.map,
1220 	    sc->cmdq.cur * sizeof (struct iwi_cmd_desc),
1221 	    sizeof (struct iwi_cmd_desc), BUS_DMASYNC_PREWRITE);
1222 
1223 	DPRINTFN(2, ("sending command idx=%u type=%u len=%u\n", sc->cmdq.cur,
1224 	    type, len));
1225 
1226 	sc->cmdq.cur = (sc->cmdq.cur + 1) % IWI_CMD_RING_COUNT;
1227 
1228 	/* don't kick cmd immediately if another async command is pending */
1229 	if (++sc->cmdq.queued == 1) {
1230 		sc->cmdq.next = sc->cmdq.cur;
1231 		CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.next);
1232 	}
1233 
1234 	return async ? 0 : tsleep(sc, PCATCH, "iwicmd", hz);
1235 }
1236 
1237 /* ARGSUSED */
1238 int
1239 iwi_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, int type,
1240     int arg1, int arg2)
1241 {
1242 	return EOPNOTSUPP;
1243 }
1244 
1245 int
1246 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni)
1247 {
1248 	struct iwi_softc *sc = ifp->if_softc;
1249 	struct ieee80211com *ic = &sc->sc_ic;
1250 	struct ieee80211_frame *wh;
1251 	struct ieee80211_key *k;
1252 	struct mbuf *m1;
1253 	struct iwi_tx_data *data;
1254 	struct iwi_tx_desc *desc;
1255 	struct iwi_tx_ring *txq = &sc->txq[0];
1256 	int hdrlen, error, i, station = 0;
1257 
1258 	wh = mtod(m0, struct ieee80211_frame *);
1259 
1260 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1261 		k = ieee80211_get_txkey(ic, wh, ni);
1262 
1263 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
1264 			return ENOBUFS;
1265 
1266 		/* packet header may have moved, reset our local pointer */
1267 		wh = mtod(m0, struct ieee80211_frame *);
1268 	}
1269 
1270 #if NBPFILTER > 0
1271 	if (sc->sc_drvbpf != NULL) {
1272 		struct mbuf mb;
1273 		struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1274 
1275 		tap->wt_flags = 0;
1276 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1277 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1278 
1279 		mb.m_data = (caddr_t)tap;
1280 		mb.m_len = sc->sc_txtap_len;
1281 		mb.m_next = m0;
1282 		mb.m_nextpkt = NULL;
1283 		mb.m_type = 0;
1284 		mb.m_flags = 0;
1285 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1286 	}
1287 #endif
1288 
1289 	data = &txq->data[txq->cur];
1290 	desc = &txq->desc[txq->cur];
1291 
1292 	/* copy and trim IEEE802.11 header */
1293 	hdrlen = ieee80211_get_hdrlen(wh);
1294 	bcopy(wh, &desc->wh, hdrlen);
1295 	m_adj(m0, hdrlen);
1296 
1297 #ifndef IEEE80211_STA_ONLY
1298 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1299 		station = iwi_find_txnode(sc, desc->wh.i_addr1);
1300 		if (station == -1) {
1301 			m_freem(m0);
1302 			ieee80211_release_node(ic, ni);
1303 			ifp->if_oerrors++;
1304 			return 0;
1305 		}
1306 	}
1307 #endif
1308 
1309 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1310 	    BUS_DMA_NOWAIT);
1311 	if (error != 0 && error != EFBIG) {
1312 		printf("%s: can't map mbuf (error %d)\n",
1313 		    sc->sc_dev.dv_xname, error);
1314 		m_freem(m0);
1315 		return error;
1316 	}
1317 	if (error != 0) {
1318 		/* too many fragments, linearize */
1319 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1320 		if (m1 == NULL) {
1321 			m_freem(m0);
1322 			return ENOBUFS;
1323 		}
1324 		if (m0->m_pkthdr.len > MHLEN) {
1325 			MCLGET(m1, M_DONTWAIT);
1326 			if (!(m1->m_flags & M_EXT)) {
1327 				m_freem(m0);
1328 				m_freem(m1);
1329 				return ENOBUFS;
1330 			}
1331 		}
1332 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m1, caddr_t));
1333 		m1->m_pkthdr.len = m1->m_len = m0->m_pkthdr.len;
1334 		m_freem(m0);
1335 		m0 = m1;
1336 
1337 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1338 		    BUS_DMA_NOWAIT);
1339 		if (error != 0) {
1340 			printf("%s: can't map mbuf (error %d)\n",
1341 			    sc->sc_dev.dv_xname, error);
1342 			m_freem(m0);
1343 			return error;
1344 		}
1345 	}
1346 
1347 	data->m = m0;
1348 	data->ni = ni;
1349 
1350 	desc->hdr.type = IWI_HDR_TYPE_DATA;
1351 	desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1352 	desc->cmd = IWI_DATA_CMD_TX;
1353 	desc->len = htole16(m0->m_pkthdr.len);
1354 	desc->station = station;
1355 	desc->flags = IWI_DATA_FLAG_NO_WEP;
1356 	desc->xflags = 0;
1357 
1358 	if (!IEEE80211_IS_MULTICAST(desc->wh.i_addr1))
1359 		desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1360 
1361 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1362 		desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1363 
1364 	if ((desc->wh.i_fc[0] &
1365 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
1366 	    (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
1367 		desc->xflags |= IWI_DATA_XFLAG_QOS;
1368 
1369 	if (ic->ic_curmode == IEEE80211_MODE_11B)
1370 		desc->xflags |= IWI_DATA_XFLAG_CCK;
1371 
1372 	desc->nseg = htole32(data->map->dm_nsegs);
1373 	for (i = 0; i < data->map->dm_nsegs; i++) {
1374 		desc->seg_addr[i] = htole32(data->map->dm_segs[i].ds_addr);
1375 		desc->seg_len[i]  = htole16(data->map->dm_segs[i].ds_len);
1376 	}
1377 
1378 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1379 	    BUS_DMASYNC_PREWRITE);
1380 	bus_dmamap_sync(sc->sc_dmat, txq->map,
1381 	    txq->cur * sizeof (struct iwi_tx_desc),
1382 	    sizeof (struct iwi_tx_desc), BUS_DMASYNC_PREWRITE);
1383 
1384 	DPRINTFN(5, ("sending data frame idx=%u len=%u nseg=%u\n", txq->cur,
1385 	    letoh16(desc->len), data->map->dm_nsegs));
1386 
1387 	txq->queued++;
1388 	txq->cur = (txq->cur + 1) % IWI_TX_RING_COUNT;
1389 	CSR_WRITE_4(sc, txq->csr_widx, txq->cur);
1390 
1391 	return 0;
1392 }
1393 
1394 void
1395 iwi_start(struct ifnet *ifp)
1396 {
1397 	struct iwi_softc *sc = ifp->if_softc;
1398 	struct ieee80211com *ic = &sc->sc_ic;
1399 	struct mbuf *m0;
1400 	struct ieee80211_node *ni;
1401 
1402 	if (ic->ic_state != IEEE80211_S_RUN)
1403 		return;
1404 
1405 	for (;;) {
1406 		IFQ_POLL(&ifp->if_snd, m0);
1407 		if (m0 == NULL)
1408 			break;
1409 
1410 		if (sc->txq[0].queued >= IWI_TX_RING_COUNT - 8) {
1411 			ifp->if_flags |= IFF_OACTIVE;
1412 			break;
1413 		}
1414 		IFQ_DEQUEUE(&ifp->if_snd, m0);
1415 #if NBPFILTER > 0
1416 		if (ifp->if_bpf != NULL)
1417 			bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1418 #endif
1419 
1420 		m0 = ieee80211_encap(ifp, m0, &ni);
1421 		if (m0 == NULL)
1422 			continue;
1423 
1424 #if NBPFILTER > 0
1425 		if (ic->ic_rawbpf != NULL)
1426 			bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1427 #endif
1428 
1429 		if (iwi_tx_start(ifp, m0, ni) != 0) {
1430 			if (ni != NULL)
1431 				ieee80211_release_node(ic, ni);
1432 			ifp->if_oerrors++;
1433 			break;
1434 		}
1435 
1436 		/* start watchdog timer */
1437 		sc->sc_tx_timer = 5;
1438 		ifp->if_timer = 1;
1439 	}
1440 }
1441 
1442 void
1443 iwi_watchdog(struct ifnet *ifp)
1444 {
1445 	struct iwi_softc *sc = ifp->if_softc;
1446 
1447 	ifp->if_timer = 0;
1448 
1449 	if (sc->sc_tx_timer > 0) {
1450 		if (--sc->sc_tx_timer == 0) {
1451 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1452 			ifp->if_flags &= ~IFF_UP;
1453 			iwi_stop(ifp, 1);
1454 			ifp->if_oerrors++;
1455 			return;
1456 		}
1457 		ifp->if_timer = 1;
1458 	}
1459 
1460 	ieee80211_watchdog(ifp);
1461 }
1462 
1463 int
1464 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1465 {
1466 	struct iwi_softc *sc = ifp->if_softc;
1467 	struct ieee80211com *ic = &sc->sc_ic;
1468 	struct ifaddr *ifa;
1469 	struct ifreq *ifr;
1470 	int s, error = 0;
1471 
1472 	s = splnet();
1473 	/*
1474 	 * Prevent processes from entering this function while another
1475 	 * process is tsleep'ing in it.
1476 	 */
1477 	while ((sc->sc_flags & IWI_FLAG_BUSY) && error == 0)
1478 		error = tsleep(&sc->sc_flags, PCATCH, "iwiioc", 0);
1479 	if (error != 0) {
1480 		splx(s);
1481 		return error;
1482 	}
1483 	sc->sc_flags |= IWI_FLAG_BUSY;
1484 
1485 	switch (cmd) {
1486 	case SIOCSIFADDR:
1487 		ifa = (struct ifaddr *)data;
1488 		ifp->if_flags |= IFF_UP;
1489 #ifdef INET
1490 		if (ifa->ifa_addr->sa_family == AF_INET)
1491 			arp_ifinit(&ic->ic_ac, ifa);
1492 #endif
1493 		/* FALLTHROUGH */
1494 	case SIOCSIFFLAGS:
1495 		if (ifp->if_flags & IFF_UP) {
1496 			if (!(ifp->if_flags & IFF_RUNNING))
1497 				iwi_init(ifp);
1498 		} else {
1499 			if (ifp->if_flags & IFF_RUNNING)
1500 				iwi_stop(ifp, 1);
1501 		}
1502 		break;
1503 
1504 	case SIOCADDMULTI:
1505 	case SIOCDELMULTI:
1506 		ifr = (struct ifreq *)data;
1507 		error = (cmd == SIOCADDMULTI) ?
1508 		    ether_addmulti(ifr, &ic->ic_ac) :
1509 		    ether_delmulti(ifr, &ic->ic_ac);
1510 
1511 		if (error == ENETRESET)
1512 			error = 0;
1513 		break;
1514 
1515 	case SIOCG80211TXPOWER:
1516 		/*
1517 		 * If the hardware radio transmitter switch is off, report a
1518 		 * tx power of IEEE80211_TXPOWER_MIN to indicate that radio
1519 		 * transmitter is killed.
1520 		 */
1521 		((struct ieee80211_txpower *)data)->i_val =
1522 		    (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) ?
1523 		    sc->sc_ic.ic_txpower : IEEE80211_TXPOWER_MIN;
1524 		break;
1525 
1526 	default:
1527 		error = ieee80211_ioctl(ifp, cmd, data);
1528 	}
1529 
1530 	if (error == ENETRESET) {
1531 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1532 		    (IFF_UP | IFF_RUNNING))
1533 			iwi_init(ifp);
1534 		error = 0;
1535 	}
1536 
1537 	sc->sc_flags &= ~IWI_FLAG_BUSY;
1538 	wakeup(&sc->sc_flags);
1539 	splx(s);
1540 	return error;
1541 }
1542 
1543 void
1544 iwi_stop_master(struct iwi_softc *sc)
1545 {
1546 	uint32_t tmp;
1547 	int ntries;
1548 
1549 	/* disable interrupts */
1550 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1551 
1552 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1553 	for (ntries = 0; ntries < 5; ntries++) {
1554 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1555 			break;
1556 		DELAY(10);
1557 	}
1558 	if (ntries == 5) {
1559 		printf("%s: timeout waiting for master\n",
1560 		    sc->sc_dev.dv_xname);
1561 	}
1562 
1563 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1564 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_PRINCETON_RESET);
1565 
1566 	sc->sc_flags &= ~IWI_FLAG_FW_INITED;
1567 }
1568 
1569 int
1570 iwi_reset(struct iwi_softc *sc)
1571 {
1572 	uint32_t tmp;
1573 	int i, ntries;
1574 
1575 	iwi_stop_master(sc);
1576 
1577 	/* move adapter to D0 state */
1578 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1579 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1580 
1581 	CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
1582 
1583 	/* wait for clock stabilization */
1584 	for (ntries = 0; ntries < 1000; ntries++) {
1585 		if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
1586 			break;
1587 		DELAY(200);
1588 	}
1589 	if (ntries == 1000) {
1590 		printf("%s: timeout waiting for clock stabilization\n",
1591 		    sc->sc_dev.dv_xname);
1592 		return ETIMEDOUT;
1593 	}
1594 
1595 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1596 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_SW_RESET);
1597 
1598 	DELAY(10);
1599 
1600 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1601 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1602 
1603 	/* clear NIC memory */
1604 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
1605 	for (i = 0; i < 0xc000; i++)
1606 		CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1607 
1608 	return 0;
1609 }
1610 
1611 int
1612 iwi_load_ucode(struct iwi_softc *sc, const char *data, int size)
1613 {
1614 	const uint16_t *w;
1615 	uint32_t tmp;
1616 	int ntries, i;
1617 
1618 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1619 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_STOP_MASTER);
1620 	for (ntries = 0; ntries < 5; ntries++) {
1621 		if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1622 			break;
1623 		DELAY(10);
1624 	}
1625 	if (ntries == 5) {
1626 		printf("%s: timeout waiting for master\n",
1627 		    sc->sc_dev.dv_xname);
1628 		return ETIMEDOUT;
1629 	}
1630 
1631 	MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
1632 	DELAY(5000);
1633 
1634 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1635 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp & ~IWI_RST_PRINCETON_RESET);
1636 
1637 	DELAY(5000);
1638 	MEM_WRITE_4(sc, 0x3000e0, 0);
1639 	DELAY(1000);
1640 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 1);
1641 	DELAY(1000);
1642 	MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 0);
1643 	DELAY(1000);
1644 	MEM_WRITE_1(sc, 0x200000, 0x00);
1645 	MEM_WRITE_1(sc, 0x200000, 0x40);
1646 	DELAY(1000);
1647 
1648 	/* adapter is buggy, we must set the address for each word */
1649 	for (w = (const uint16_t *)data; size > 0; w++, size -= 2)
1650 		MEM_WRITE_2(sc, 0x200010, htole16(*w));
1651 
1652 	MEM_WRITE_1(sc, 0x200000, 0x00);
1653 	MEM_WRITE_1(sc, 0x200000, 0x80);
1654 
1655 	/* wait until we get an answer */
1656 	for (ntries = 0; ntries < 100; ntries++) {
1657 		if (MEM_READ_1(sc, 0x200000) & 1)
1658 			break;
1659 		DELAY(100);
1660 	}
1661 	if (ntries == 100) {
1662 		printf("%s: timeout waiting for ucode to initialize\n",
1663 		    sc->sc_dev.dv_xname);
1664 		return ETIMEDOUT;
1665 	}
1666 
1667 	/* read the answer or the firmware will not initialize properly */
1668 	for (i = 0; i < 7; i++)
1669 		MEM_READ_4(sc, 0x200004);
1670 
1671 	MEM_WRITE_1(sc, 0x200000, 0x00);
1672 
1673 	return 0;
1674 }
1675 
1676 /* macro to handle unaligned little endian data in firmware image */
1677 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
1678 
1679 int
1680 iwi_load_firmware(struct iwi_softc *sc, const char *data, int size)
1681 {
1682 	bus_dmamap_t map;
1683 	bus_dma_segment_t seg;
1684 	caddr_t virtaddr;
1685 	u_char *p, *end;
1686 	uint32_t sentinel, tmp, ctl, src, dst, sum, len, mlen;
1687 	int ntries, nsegs, error;
1688 
1689 	/* allocate DMA memory to store firmware image */
1690 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
1691 	    BUS_DMA_NOWAIT, &map);
1692 	if (error != 0) {
1693 		printf("%s: could not create firmware DMA map\n",
1694 		    sc->sc_dev.dv_xname);
1695 		goto fail1;
1696 	}
1697 
1698 	error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0, &seg, 1,
1699 	    &nsegs, BUS_DMA_NOWAIT);
1700 	if (error != 0) {
1701 		printf("%s: could not allocate firmware DMA memory\n",
1702 		    sc->sc_dev.dv_xname);
1703 		goto fail2;
1704 	}
1705 
1706 	error = bus_dmamem_map(sc->sc_dmat, &seg, nsegs, size, &virtaddr,
1707 	    BUS_DMA_NOWAIT);
1708 	if (error != 0) {
1709 		printf("%s: can't map firmware DMA memory\n",
1710 		    sc->sc_dev.dv_xname);
1711 		goto fail3;
1712 	}
1713 
1714 	error = bus_dmamap_load(sc->sc_dmat, map, virtaddr, size, NULL,
1715 	    BUS_DMA_NOWAIT);
1716 	if (error != 0) {
1717 		printf("%s: could not load firmware DMA map\n",
1718 		    sc->sc_dev.dv_xname);
1719 		goto fail4;
1720 	}
1721 
1722 	/* copy firmware image to DMA memory */
1723 	bcopy(data, virtaddr, size);
1724 
1725 	/* make sure the adapter will get up-to-date values */
1726 	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_PREWRITE);
1727 
1728 	/* tell the adapter where the command blocks are stored */
1729 	MEM_WRITE_4(sc, 0x3000a0, 0x27000);
1730 
1731 	/*
1732 	 * Store command blocks into adapter's internal memory using register
1733 	 * indirections. The adapter will read the firmware image through DMA
1734 	 * using information stored in command blocks.
1735 	 */
1736 	src = map->dm_segs[0].ds_addr;
1737 	p = virtaddr;
1738 	end = p + size;
1739 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
1740 
1741 	while (p < end) {
1742 		dst = GETLE32(p); p += 4; src += 4;
1743 		len = GETLE32(p); p += 4; src += 4;
1744 		p += len;
1745 
1746 		while (len > 0) {
1747 			mlen = min(len, IWI_CB_MAXDATALEN);
1748 
1749 			ctl = IWI_CB_DEFAULT_CTL | mlen;
1750 			sum = ctl ^ src ^ dst;
1751 
1752 			/* write a command block */
1753 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
1754 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, src);
1755 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, dst);
1756 			CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
1757 
1758 			src += mlen;
1759 			dst += mlen;
1760 			len -= mlen;
1761 		}
1762 	}
1763 
1764 	/* write a fictive final command block (sentinel) */
1765 	sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
1766 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
1767 
1768 	tmp = CSR_READ_4(sc, IWI_CSR_RST);
1769 	tmp &= ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER);
1770 	CSR_WRITE_4(sc, IWI_CSR_RST, tmp);
1771 
1772 	/* tell the adapter to start processing command blocks */
1773 	MEM_WRITE_4(sc, 0x3000a4, 0x540100);
1774 
1775 	/* wait until the adapter has processed all command blocks */
1776 	for (ntries = 0; ntries < 400; ntries++) {
1777 		if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
1778 			break;
1779 		DELAY(100);
1780 	}
1781 	if (ntries == 400) {
1782 		printf("%s: timeout processing cb\n", sc->sc_dev.dv_xname);
1783 		error = ETIMEDOUT;
1784 		goto fail5;
1785 	}
1786 
1787 	/* we're done with command blocks processing */
1788 	MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
1789 
1790 	/* allow interrupts so we know when the firmware is inited */
1791 	CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1792 
1793 	/* tell the adapter to initialize the firmware */
1794 	CSR_WRITE_4(sc, IWI_CSR_RST, 0);
1795 
1796 	tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1797 	CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_ALLOW_STANDBY);
1798 
1799 	/* wait at most one second for firmware initialization to complete */
1800 	if ((error = tsleep(sc, PCATCH, "iwiinit", hz)) != 0) {
1801 		printf("%s: timeout waiting for firmware initialization to "
1802 		    "complete\n", sc->sc_dev.dv_xname);
1803 		goto fail5;
1804 	}
1805 
1806 fail5:	bus_dmamap_sync(sc->sc_dmat, map, 0, size, BUS_DMASYNC_POSTWRITE);
1807 	bus_dmamap_unload(sc->sc_dmat, map);
1808 fail4:	bus_dmamem_unmap(sc->sc_dmat, virtaddr, size);
1809 fail3:	bus_dmamem_free(sc->sc_dmat, &seg, 1);
1810 fail2:	bus_dmamap_destroy(sc->sc_dmat, map);
1811 fail1:	return error;
1812 }
1813 
1814 int
1815 iwi_config(struct iwi_softc *sc)
1816 {
1817 	struct ieee80211com *ic = &sc->sc_ic;
1818 	struct ifnet *ifp = &ic->ic_if;
1819 	struct iwi_configuration config;
1820 	struct iwi_rateset rs;
1821 	struct iwi_txpower power;
1822 	uint32_t data;
1823 	int error, nchan, i;
1824 
1825 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1826 	DPRINTF(("Setting MAC address to %s\n", ether_sprintf(ic->ic_myaddr)));
1827 	error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
1828 	    IEEE80211_ADDR_LEN, 0);
1829 	if (error != 0)
1830 		return error;
1831 
1832 	bzero(&config, sizeof config);
1833 	config.multicast_enabled = 1;
1834 	config.silence_threshold = 30;
1835 	config.report_noise = 1;
1836 	config.answer_pbreq =
1837 #ifndef IEEE80211_STA_ONLY
1838 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 :
1839 #endif
1840 	    0;
1841 	DPRINTF(("Configuring adapter\n"));
1842 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 0);
1843 	if (error != 0)
1844 		return error;
1845 
1846 	data = htole32(IWI_POWER_MODE_CAM);
1847 	DPRINTF(("Setting power mode to %u\n", letoh32(data)));
1848 	error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
1849 	if (error != 0)
1850 		return error;
1851 
1852 	data = htole32(ic->ic_rtsthreshold);
1853 	DPRINTF(("Setting RTS threshold to %u\n", letoh32(data)));
1854 	error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
1855 	if (error != 0)
1856 		return error;
1857 
1858 	data = htole32(ic->ic_fragthreshold);
1859 	DPRINTF(("Setting fragmentation threshold to %u\n", letoh32(data)));
1860 	error = iwi_cmd(sc, IWI_CMD_SET_FRAG_THRESHOLD, &data, sizeof data, 0);
1861 	if (error != 0)
1862 		return error;
1863 
1864 	/*
1865 	 * Set default Tx power for 802.11b/g and 802.11a channels.
1866 	 */
1867 	nchan = 0;
1868 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1869 		if (!IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]))
1870 			continue;
1871 		power.chan[nchan].chan = i;
1872 		power.chan[nchan].power = IWI_TXPOWER_MAX;
1873 		nchan++;
1874 	}
1875 	power.nchan = nchan;
1876 
1877 	power.mode = IWI_MODE_11G;
1878 	DPRINTF(("Setting .11g channels tx power\n"));
1879 	error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power, 0);
1880 	if (error != 0)
1881 		return error;
1882 
1883 	power.mode = IWI_MODE_11B;
1884 	DPRINTF(("Setting .11b channels tx power\n"));
1885 	error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power, 0);
1886 	if (error != 0)
1887 		return error;
1888 
1889 	nchan = 0;
1890 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1891 		if (!IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]))
1892 			continue;
1893 		power.chan[nchan].chan = i;
1894 		power.chan[nchan].power = IWI_TXPOWER_MAX;
1895 		nchan++;
1896 	}
1897 	power.nchan = nchan;
1898 
1899 	if (nchan > 0) {	/* 2915ABG only */
1900 		power.mode = IWI_MODE_11A;
1901 		DPRINTF(("Setting .11a channels tx power\n"));
1902 		error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
1903 		    0);
1904 		if (error != 0)
1905 			return error;
1906 	}
1907 
1908 	rs.mode = IWI_MODE_11G;
1909 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
1910 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
1911 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates, rs.rates,
1912 	    rs.nrates);
1913 	DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
1914 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
1915 	if (error != 0)
1916 		return error;
1917 
1918 	rs.mode = IWI_MODE_11A;
1919 	rs.type = IWI_RATESET_TYPE_SUPPORTED;
1920 	rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
1921 	bcopy(ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates, rs.rates,
1922 	    rs.nrates);
1923 	DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
1924 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
1925 	if (error != 0)
1926 		return error;
1927 
1928 	/* if we have a desired ESSID, set it now */
1929 	if (ic->ic_des_esslen != 0) {
1930 #ifdef IWI_DEBUG
1931 		if (iwi_debug > 0) {
1932 			printf("Setting desired ESSID to ");
1933 			ieee80211_print_essid(ic->ic_des_essid,
1934 			    ic->ic_des_esslen);
1935 			printf("\n");
1936 		}
1937 #endif
1938 		error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ic->ic_des_essid,
1939 		    ic->ic_des_esslen, 0);
1940 		if (error != 0)
1941 			return error;
1942 	}
1943 
1944 	arc4random_buf(&data, sizeof data);
1945 	DPRINTF(("Setting random seed to %u\n", data));
1946 	error = iwi_cmd(sc, IWI_CMD_SET_RANDOM_SEED, &data, sizeof data, 0);
1947 	if (error != 0)
1948 		return error;
1949 
1950 	/* enable adapter */
1951 	DPRINTF(("Enabling adapter\n"));
1952 	return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
1953 }
1954 
1955 void
1956 iwi_update_edca(struct ieee80211com *ic)
1957 {
1958 #define IWI_EXP2(v)	htole16((1 << (v)) - 1)
1959 #define IWI_TXOP(v)	IEEE80211_TXOP_TO_US(v)
1960 	struct iwi_softc *sc = ic->ic_softc;
1961 	struct iwi_qos_cmd cmd;
1962 	struct iwi_qos_params *qos;
1963 	struct ieee80211_edca_ac_params *edca = ic->ic_edca_ac;
1964 	int aci;
1965 
1966 	/* set default QoS parameters for CCK */
1967 	qos = &cmd.cck;
1968 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1969 		qos->cwmin[aci] = IWI_EXP2(iwi_cck[aci].ac_ecwmin);
1970 		qos->cwmax[aci] = IWI_EXP2(iwi_cck[aci].ac_ecwmax);
1971 		qos->txop [aci] = IWI_TXOP(iwi_cck[aci].ac_txoplimit);
1972 		qos->aifsn[aci] = iwi_cck[aci].ac_aifsn;
1973 		qos->acm  [aci] = 0;
1974 	}
1975 	/* set default QoS parameters for OFDM */
1976 	qos = &cmd.ofdm;
1977 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1978 		qos->cwmin[aci] = IWI_EXP2(iwi_ofdm[aci].ac_ecwmin);
1979 		qos->cwmax[aci] = IWI_EXP2(iwi_ofdm[aci].ac_ecwmax);
1980 		qos->txop [aci] = IWI_TXOP(iwi_ofdm[aci].ac_txoplimit);
1981 		qos->aifsn[aci] = iwi_ofdm[aci].ac_aifsn;
1982 		qos->acm  [aci] = 0;
1983 	}
1984 	/* set current QoS parameters */
1985 	qos = &cmd.current;
1986 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1987 		qos->cwmin[aci] = IWI_EXP2(edca[aci].ac_ecwmin);
1988 		qos->cwmax[aci] = IWI_EXP2(edca[aci].ac_ecwmax);
1989 		qos->txop [aci] = IWI_TXOP(edca[aci].ac_txoplimit);
1990 		qos->aifsn[aci] = edca[aci].ac_aifsn;
1991 		qos->acm  [aci] = 0;
1992 	}
1993 
1994 	DPRINTF(("Setting QoS parameters\n"));
1995 	(void)iwi_cmd(sc, IWI_CMD_SET_QOS_PARAMS, &cmd, sizeof cmd, 1);
1996 #undef IWI_EXP2
1997 #undef IWI_TXOP
1998 }
1999 
2000 int
2001 iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
2002 {
2003 	struct ieee80211com *ic = &sc->sc_ic;
2004 	struct iwi_scan scan;
2005 
2006 	bzero(&scan, sizeof scan);
2007 	memset(scan.type, IWI_SCAN_TYPE_PASSIVE, sizeof scan.type);
2008 	scan.passive = htole16(2000);
2009 	scan.channels[0] = 1 |
2010 	    (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
2011 	scan.channels[1] = ieee80211_chan2ieee(ic, chan);
2012 
2013 	DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
2014 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2015 }
2016 
2017 int
2018 iwi_scan(struct iwi_softc *sc)
2019 {
2020 	struct ieee80211com *ic = &sc->sc_ic;
2021 	struct iwi_scan scan;
2022 	uint8_t *p;
2023 	int i, count;
2024 
2025 	bzero(&scan, sizeof scan);
2026 
2027 	if (ic->ic_des_esslen != 0) {
2028 		scan.bdirected = htole16(40);
2029 		memset(scan.type, IWI_SCAN_TYPE_BDIRECTED, sizeof scan.type);
2030 	} else {
2031 		scan.broadcast = htole16(40);
2032 		memset(scan.type, IWI_SCAN_TYPE_BROADCAST, sizeof scan.type);
2033 	}
2034 
2035 	p = scan.channels;
2036 	count = 0;
2037 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2038 		if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i])) {
2039 			*++p = i;
2040 			count++;
2041 		}
2042 	}
2043 	*(p - count) = IWI_CHAN_5GHZ | count;
2044 
2045 	p = (count > 0) ? p + 1 : scan.channels;
2046 	count = 0;
2047 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2048 		if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i])) {
2049 			*++p = i;
2050 			count++;
2051 		}
2052 	}
2053 	*(p - count) = IWI_CHAN_2GHZ | count;
2054 
2055 	DPRINTF(("Start scanning\n"));
2056 	return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2057 }
2058 
2059 int
2060 iwi_auth_and_assoc(struct iwi_softc *sc)
2061 {
2062 	struct ieee80211com *ic = &sc->sc_ic;
2063 	struct ieee80211_node *ni = ic->ic_bss;
2064 	struct iwi_configuration config;
2065 	struct iwi_associate assoc;
2066 	struct iwi_rateset rs;
2067 	uint8_t *frm;
2068 	uint32_t data;
2069 	uint16_t capinfo;
2070 	uint8_t buf[64];	/* XXX max WPA/RSN/WMM IE length */
2071 	int error;
2072 
2073 	/* update adapter configuration */
2074 	bzero(&config, sizeof config);
2075 	config.multicast_enabled = 1;
2076 	config.disable_unicast_decryption = 1;
2077 	config.disable_multicast_decryption = 1;
2078 	config.silence_threshold = 30;
2079 	config.report_noise = 1;
2080 	config.answer_pbreq =
2081 #ifndef IEEE80211_STA_ONLY
2082 	    (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 :
2083 #endif
2084 	    0;
2085 	if (ic->ic_curmode == IEEE80211_MODE_11G)
2086 		config.bg_autodetection = 1;
2087 	DPRINTF(("Configuring adapter\n"));
2088 	error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 1);
2089 	if (error != 0)
2090 		return error;
2091 
2092 #ifdef IWI_DEBUG
2093 	if (iwi_debug > 0) {
2094 		printf("Setting ESSID to ");
2095 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2096 		printf("\n");
2097 	}
2098 #endif
2099 	error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2100 	if (error != 0)
2101 		return error;
2102 
2103 	/* the rate set has already been "negotiated" */
2104 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2105 	    IWI_MODE_11G;
2106 	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2107 	rs.nrates = ni->ni_rates.rs_nrates;
2108 	if (rs.nrates > sizeof rs.rates) {
2109 #ifdef DIAGNOSTIC
2110 		/* should not happen since the rates are negotiated */
2111 		printf("%s: XXX too many rates (count=%d, last=%d)\n",
2112 		    sc->sc_dev.dv_xname, ni->ni_rates.rs_nrates,
2113 		    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates - 1] &
2114 		    IEEE80211_RATE_VAL);
2115 #endif
2116 		rs.nrates = sizeof rs.rates;
2117 	}
2118 	bcopy(ni->ni_rates.rs_rates, rs.rates, rs.nrates);
2119 	DPRINTF(("Setting negotiated rates (%u)\n", rs.nrates));
2120 	error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2121 	if (error != 0)
2122 		return error;
2123 
2124 	data = htole32(ni->ni_rssi);
2125 	DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2126 	error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2127 	if (error != 0)
2128 		return error;
2129 
2130 	if (ic->ic_flags & IEEE80211_F_QOS) {
2131 		iwi_update_edca(ic);
2132 
2133 		frm = ieee80211_add_qos_capability(buf, ic);
2134 		DPRINTF(("Setting QoS Capability IE length %d\n", frm - buf));
2135 		error = iwi_cmd(sc, IWI_CMD_SET_QOS_CAP, buf, frm - buf, 1);
2136 		if (error != 0)
2137 			return error;
2138 	}
2139 	if (ic->ic_flags & IEEE80211_F_RSNON) {
2140 		/* tell firmware to add WPA/RSN IE to (re)assoc request */
2141 		if (ni->ni_rsnprotos == IEEE80211_PROTO_RSN)
2142 			frm = ieee80211_add_rsn(buf, ic, ni);
2143 		else
2144 			frm = ieee80211_add_wpa(buf, ic, ni);
2145 		DPRINTF(("Setting RSN IE length %d\n", frm - buf));
2146 		error = iwi_cmd(sc, IWI_CMD_SET_OPTIE, buf, frm - buf, 1);
2147 		if (error != 0)
2148 			return error;
2149 	}
2150 
2151 	bzero(&assoc, sizeof assoc);
2152 #ifndef IEEE80211_STA_ONLY
2153 	if (ic->ic_flags & IEEE80211_F_SIBSS)
2154 		assoc.type = IWI_ASSOC_SIBSS;
2155 	else
2156 #endif
2157 		assoc.type = IWI_ASSOC_ASSOCIATE;
2158 	assoc.policy = 0;
2159 	if (ic->ic_flags & IEEE80211_F_RSNON)
2160 		assoc.policy |= htole16(IWI_ASSOC_POLICY_RSN);
2161 	if (ic->ic_flags & IEEE80211_F_QOS)
2162 		assoc.policy |= htole16(IWI_ASSOC_POLICY_QOS);
2163 	if (ic->ic_curmode == IEEE80211_MODE_11A)
2164 		assoc.mode = IWI_MODE_11A;
2165 	else if (ic->ic_curmode == IEEE80211_MODE_11B)
2166 		assoc.mode = IWI_MODE_11B;
2167 	else	/* assume 802.11b/g */
2168 		assoc.mode = IWI_MODE_11G;
2169 	assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2170 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2171 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2172 		assoc.plen = IWI_ASSOC_SHPREAMBLE;
2173 	bcopy(ni->ni_tstamp, assoc.tstamp, 8);
2174 	capinfo = IEEE80211_CAPINFO_ESS;
2175 	if (ic->ic_flags & IEEE80211_F_WEPON)
2176 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2177 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2178 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2179 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2180 	if (ic->ic_caps & IEEE80211_C_SHSLOT)
2181 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2182 	assoc.capinfo = htole16(capinfo);
2183 
2184 	assoc.lintval = htole16(ic->ic_lintval);
2185 	assoc.intval = htole16(ni->ni_intval);
2186 	IEEE80211_ADDR_COPY(assoc.bssid, ni->ni_bssid);
2187 #ifndef IEEE80211_STA_ONLY
2188 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2189 		IEEE80211_ADDR_COPY(assoc.dst, etherbroadcastaddr);
2190 	else
2191 #endif
2192 		IEEE80211_ADDR_COPY(assoc.dst, ni->ni_bssid);
2193 
2194 	DPRINTF(("Trying to associate to %s channel %u auth %u\n",
2195 	    ether_sprintf(assoc.bssid), assoc.chan, assoc.auth));
2196 	return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &assoc, sizeof assoc, 1);
2197 }
2198 
2199 int
2200 iwi_init(struct ifnet *ifp)
2201 {
2202 	struct iwi_softc *sc = ifp->if_softc;
2203 	struct ieee80211com *ic = &sc->sc_ic;
2204 	struct iwi_firmware_hdr *hdr;
2205 	const char *name, *fw;
2206 	u_char *data;
2207 	size_t size;
2208 	int i, ac, error;
2209 
2210 	iwi_stop(ifp, 0);
2211 
2212 	if ((error = iwi_reset(sc)) != 0) {
2213 		printf("%s: could not reset adapter\n", sc->sc_dev.dv_xname);
2214 		goto fail1;
2215 	}
2216 
2217 	switch (ic->ic_opmode) {
2218 	case IEEE80211_M_STA:
2219 		name = "iwi-bss";
2220 		break;
2221 #ifndef IEEE80211_STA_ONLY
2222 	case IEEE80211_M_IBSS:
2223 	case IEEE80211_M_AHDEMO:
2224 		name = "iwi-ibss";
2225 		break;
2226 #endif
2227 	case IEEE80211_M_MONITOR:
2228 		name = "iwi-monitor";
2229 		break;
2230 	default:
2231 		/* should not get there */
2232 		error = EINVAL;
2233 		goto fail1;
2234 	}
2235 
2236 	if ((error = loadfirmware(name, &data, &size)) != 0) {
2237 		printf("%s: error %d, could not read firmware %s\n",
2238 		    sc->sc_dev.dv_xname, error, name);
2239 		goto fail1;
2240 	}
2241 	if (size < sizeof (struct iwi_firmware_hdr)) {
2242 		printf("%s: firmware image too short: %u bytes\n",
2243 		    sc->sc_dev.dv_xname, size);
2244 		error = EINVAL;
2245 		goto fail2;
2246 	}
2247 	hdr = (struct iwi_firmware_hdr *)data;
2248 
2249 	if (hdr->vermaj < 3 || hdr->bootsz == 0 || hdr->ucodesz == 0 ||
2250 	    hdr->mainsz == 0) {
2251 		printf("%s: firmware image too old (need at least 3.0)\n",
2252 		    sc->sc_dev.dv_xname);
2253 		error = EINVAL;
2254 		goto fail2;
2255 	}
2256 
2257 	if (size < sizeof (struct iwi_firmware_hdr) + letoh32(hdr->bootsz) +
2258 	    letoh32(hdr->ucodesz) + letoh32(hdr->mainsz)) {
2259 		printf("%s: firmware image too short: %u bytes\n",
2260 		    sc->sc_dev.dv_xname, size);
2261 		error = EINVAL;
2262 		goto fail2;
2263 	}
2264 
2265 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr);
2266 	if ((error = iwi_load_firmware(sc, fw, letoh32(hdr->bootsz))) != 0) {
2267 		printf("%s: could not load boot firmware\n",
2268 		    sc->sc_dev.dv_xname);
2269 		goto fail2;
2270 	}
2271 
2272 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr) +
2273 	    letoh32(hdr->bootsz);
2274 	if ((error = iwi_load_ucode(sc, fw, letoh32(hdr->ucodesz))) != 0) {
2275 		printf("%s: could not load microcode\n", sc->sc_dev.dv_xname);
2276 		goto fail2;
2277 	}
2278 
2279 	iwi_stop_master(sc);
2280 
2281 	CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmdq.map->dm_segs[0].ds_addr);
2282 	CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, IWI_CMD_RING_COUNT);
2283 	CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
2284 
2285 	for (ac = 0; ac < EDCA_NUM_AC; ac++) {
2286 		CSR_WRITE_4(sc, IWI_CSR_TX_BASE(ac),
2287 		    sc->txq[ac].map->dm_segs[0].ds_addr);
2288 		CSR_WRITE_4(sc, IWI_CSR_TX_SIZE(ac), IWI_TX_RING_COUNT);
2289 		CSR_WRITE_4(sc, IWI_CSR_TX_WIDX(ac), sc->txq[ac].cur);
2290 	}
2291 
2292 	for (i = 0; i < IWI_RX_RING_COUNT; i++) {
2293 		struct iwi_rx_data *data = &sc->rxq.data[i];
2294 		CSR_WRITE_4(sc, data->reg, data->map->dm_segs[0].ds_addr);
2295 	}
2296 
2297 	CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, IWI_RX_RING_COUNT - 1);
2298 
2299 	fw = (const char *)data + sizeof (struct iwi_firmware_hdr) +
2300 	    letoh32(hdr->bootsz) + letoh32(hdr->ucodesz);
2301 	if ((error = iwi_load_firmware(sc, fw, letoh32(hdr->mainsz))) != 0) {
2302 		printf("%s: could not load main firmware\n",
2303 		    sc->sc_dev.dv_xname);
2304 		goto fail2;
2305 	}
2306 
2307 	free(data, M_DEVBUF);
2308 	sc->sc_flags |= IWI_FLAG_FW_INITED;
2309 
2310 	if ((error = iwi_config(sc)) != 0) {
2311 		printf("%s: device configuration failed\n",
2312 		    sc->sc_dev.dv_xname);
2313 		goto fail1;
2314 	}
2315 
2316 	ifp->if_flags &= ~IFF_OACTIVE;
2317 	ifp->if_flags |= IFF_RUNNING;
2318 
2319 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2320 		ieee80211_begin_scan(ifp);
2321 	else
2322 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2323 
2324 	return 0;
2325 
2326 fail2:	free(data, M_DEVBUF);
2327 fail1:	iwi_stop(ifp, 0);
2328 	return error;
2329 }
2330 
2331 void
2332 iwi_stop(struct ifnet *ifp, int disable)
2333 {
2334 	struct iwi_softc *sc = ifp->if_softc;
2335 	struct ieee80211com *ic = &sc->sc_ic;
2336 	int ac;
2337 
2338 	sc->sc_tx_timer = 0;
2339 	ifp->if_timer = 0;
2340 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2341 
2342 	/* in case we were scanning, release the scan "lock" */
2343 	ic->ic_scan_lock = IEEE80211_SCAN_UNLOCKED;
2344 
2345 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2346 
2347 	iwi_stop_master(sc);
2348 
2349 	CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SW_RESET);
2350 
2351 	/* reset rings */
2352 	iwi_reset_cmd_ring(sc, &sc->cmdq);
2353 	for (ac = 0; ac < EDCA_NUM_AC; ac++)
2354 		iwi_reset_tx_ring(sc, &sc->txq[ac]);
2355 	iwi_reset_rx_ring(sc, &sc->rxq);
2356 }
2357 
2358 struct cfdriver iwi_cd = {
2359 	NULL, "iwi", DV_IFNET
2360 };
2361