sys/dev/netif/iwi/if_iwi.c

   1 /*
   2  * Copyright (c) 2004-2006
   3  *      Damien Bergamini <damien.bergamini@free.fr>.
   4  * Copyright (c) 2004, 2005
   5  *      Andrew Atrens <atrens@nortelnetworks.com>.
   6  *
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice unmodified, this list of conditions, and the following
  14  *    disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  *
  31  * $FreeBSD: src/sys/dev/iwi/if_iwi.c,v 1.8.2.6 2006/02/23 02:06:46 sam Exp $
  32  * $DragonFly: src/sys/dev/netif/iwi/if_iwi.c,v 1.21 2008/05/14 11:59:20 sephe Exp $
  33  */
  34
  35 /*-
  36  * Intel(R) PRO/Wireless 2200BG/2225BG/2915ABG driver
  37  * http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm
  38  */
  39
  40 #include <sys/param.h>
  41 #include <sys/sysctl.h>
  42 #include <sys/sockio.h>
  43 #include <sys/mbuf.h>
  44 #include <sys/firmware.h>
  45 #include <sys/kernel.h>
  46 #include <sys/kthread.h>
  47 #include <sys/interrupt.h>
  48 #include <sys/socket.h>
  49 #include <sys/systm.h>
  50 #include <sys/malloc.h>
  51 #include <sys/module.h>
  52 #include <sys/endian.h>
  53 #include <sys/proc.h>
  54 #include <sys/priv.h>
  55 #include <sys/ucred.h>
  56 #include <sys/bus.h>
  57 #include <sys/rman.h>
  58 #include <sys/serialize.h>
  59
  60 #include <bus/pci/pcidevs.h>
  61 #include <bus/pci/pcireg.h>
  62 #include <bus/pci/pcivar.h>
  63
  64 #include <net/bpf.h>
  65 #include <net/if.h>
  66 #include <net/if_arp.h>
  67 #include <net/ethernet.h>
  68 #include <net/if_dl.h>
  69 #include <net/if_media.h>
  70 #include <net/if_types.h>
  71 #include <net/ifq_var.h>
  72
  73 #include <netproto/802_11/ieee80211_var.h>
  74 #include <netproto/802_11/ieee80211_radiotap.h>
  75
  76 #include <netinet/in.h>
  77 #include <netinet/in_systm.h>
  78 #include <netinet/in_var.h>
  79 #include <netinet/ip.h>
  80 #include <netinet/if_ether.h>
  81
  82 #include <dev/netif/iwi/if_iwireg.h>
  83 #include <dev/netif/iwi/if_iwivar.h>
  84
  85 #ifdef IWI_DEBUG
  86 #define DPRINTF(x)      do { if (iwi_debug > 0) kprintf x; } while (0)
  87 #define DPRINTFN(n, x)  do { if (iwi_debug >= (n)) kprintf x; } while (0)
  88 int iwi_debug = 0;
  89 SYSCTL_INT(_debug, OID_AUTO, iwi, CTLFLAG_RW, &iwi_debug, 0, "iwi debug level");
  90 #else
  91 #define DPRINTF(x)
  92 #define DPRINTFN(n, x)
  93 #endif
  94
  95 static struct iwi_ident {
  96         uint16_t        vendor;
  97         uint16_t        device;
  98         const char      *name;
  99 } iwi_ident_table[] = {
 100         { PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2200BG,
 101                 "Intel(R) PRO/Wireless 2200BG" },
 102         { PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2225BG,
 103                 "Intel(R) PRO/Wireless 2225BG" },
 104         { PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_1,
 105                 "Intel(R) PRO/Wireless 2915ABG" },
 106         { PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_PRO_WL_2915ABG_2,
 107                 "Intel(R) PRO/Wireless 2915ABG" },
 108         { 0, 0, NULL }
 109 };
 110
 111 static void     iwi_fw_monitor(void *);
 112 static void     iwi_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 113 static void     iwi_dma_map_mbuf(void *, bus_dma_segment_t *, int, bus_size_t,
 114                                  int);
 115 static int      iwi_alloc_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *,
 116                     int);
 117 static void     iwi_reset_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
 118 static void     iwi_free_cmd_ring(struct iwi_softc *, struct iwi_cmd_ring *);
 119 static int      iwi_alloc_tx_ring(struct iwi_softc *, struct iwi_tx_ring *,
 120                     int, bus_addr_t, bus_addr_t);
 121 static void     iwi_reset_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
 122 static void     iwi_free_tx_ring(struct iwi_softc *, struct iwi_tx_ring *);
 123 static int      iwi_alloc_rx_ring(struct iwi_softc *, struct iwi_rx_ring *,
 124                     int);
 125 static void     iwi_reset_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
 126 static void     iwi_free_rx_ring(struct iwi_softc *, struct iwi_rx_ring *);
 127 static struct   ieee80211_node *iwi_node_alloc(struct ieee80211_node_table *);
 128 static void     iwi_node_free(struct ieee80211_node *);
 129 static int      iwi_media_change(struct ifnet *);
 130 static void     iwi_media_status(struct ifnet *, struct ifmediareq *);
 131 static int      iwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
 132 static int      iwi_wme_update(struct ieee80211com *);
 133 static uint16_t iwi_read_prom_word(struct iwi_softc *, uint8_t);
 134 static void     iwi_fix_channel(struct ieee80211com *, struct mbuf *);
 135 static void     iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *, int,
 136                     struct iwi_frame *);
 137 static void     iwi_notification_intr(struct iwi_softc *, struct iwi_notif *);
 138 static void     iwi_rx_intr(struct iwi_softc *);
 139 static void     iwi_tx_intr(struct iwi_softc *, struct iwi_tx_ring *);
 140 static void     iwi_intr(void *);
 141 static int      iwi_cmd(struct iwi_softc *, uint8_t, void *, uint8_t, int);
 142 static void     iwi_write_ibssnode(struct iwi_softc *, const struct iwi_node *);
 143 static int      iwi_tx_start(struct ifnet *, struct mbuf *,
 144                     struct ieee80211_node *, int);
 145 static void     iwi_start(struct ifnet *);
 146 static void     iwi_watchdog(struct ifnet *);
 147 static int      iwi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 148 static void     iwi_stop_master(struct iwi_softc *);
 149 static int      iwi_reset(struct iwi_softc *);
 150 static int      iwi_load_ucode(struct iwi_softc *, void *, int);
 151 static int      iwi_alloc_firmware(struct iwi_softc *, enum ieee80211_opmode);
 152 static int      iwi_free_firmware(struct iwi_softc *);
 153 static int      iwi_load_firmware(struct iwi_softc *, void *, int);
 154 static int      iwi_config(struct iwi_softc *);
 155 static int      iwi_set_chan(struct iwi_softc *, struct ieee80211_channel *);
 156 static int      iwi_scan(struct iwi_softc *);
 157 static int      iwi_auth_and_assoc(struct iwi_softc *);
 158 static void     iwi_init(void *);
 159 static void     iwi_stop(void *);
 160 static int      iwi_sysctl_stats(SYSCTL_HANDLER_ARGS);
 161 static int      iwi_sysctl_radio(SYSCTL_HANDLER_ARGS);
 162
 163 static int      iwi_probe(device_t);
 164 static int      iwi_attach(device_t);
 165 static int      iwi_detach(device_t);
 166 static int      iwi_shutdown(device_t);
 167 static int      iwi_suspend(device_t);
 168 static int      iwi_resume(device_t);
 169
 170 static int      iwi_alloc_ibss_node(struct iwi_softc *);
 171 static void     iwi_free_ibss_node(struct iwi_softc *, int);
 172
 173 static device_method_t iwi_methods[] = {
 174         /* Device interface */
 175         DEVMETHOD(device_probe,         iwi_probe),
 176         DEVMETHOD(device_attach,        iwi_attach),
 177         DEVMETHOD(device_detach,        iwi_detach),
 178         DEVMETHOD(device_shutdown,      iwi_shutdown),
 179         DEVMETHOD(device_suspend,       iwi_suspend),
 180         DEVMETHOD(device_resume,        iwi_resume),
 181
 182         { 0, 0 }
 183 };
 184
 185 static driver_t iwi_driver = {
 186         "iwi",
 187         iwi_methods,
 188         sizeof (struct iwi_softc)
 189 };
 190
 191 static devclass_t iwi_devclass;
 192
 193 DRIVER_MODULE(iwi, pci, iwi_driver, iwi_devclass, 0, 0);
 194
 195 MODULE_DEPEND(iwi, pci,  1, 1, 1);
 196 MODULE_DEPEND(iwi, wlan, 1, 1, 1);
 197
 198 /*
 199  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
 200  */
 201 static const struct ieee80211_rateset iwi_rateset_11a =
 202         { 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
 203
 204 static const struct ieee80211_rateset iwi_rateset_11b =
 205         { 4, { 2, 4, 11, 22 } };
 206
 207 static const struct ieee80211_rateset iwi_rateset_11g =
 208         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
 209
 210 static void
 211 iwi_fw_monitor(void *arg)
 212 {
 213         struct iwi_softc *sc = arg;
 214         struct ifnet *ifp = &sc->sc_ic.ic_if;
 215
 216         lwkt_serialize_enter(ifp->if_serializer);
 217         for (;;) {
 218                 int error = 0;
 219
 220                 /*
 221                  * Test to see whether we are detaching,
 222                  * this is used to avoid race condition
 223                  * especially when attaching fails.
 224                  */
 225                 if ((sc->flags & IWI_FLAG_EXIT) == 0) {
 226                         crit_enter();
 227                         tsleep_interlock(IWI_FW_WAKE_MONITOR(sc));
 228                         lwkt_serialize_exit(ifp->if_serializer);
 229                         error = tsleep(IWI_FW_WAKE_MONITOR(sc),
 230                                        PINTERLOCKED, "iwifwm", 0);
 231                         crit_exit();
 232                         lwkt_serialize_enter(ifp->if_serializer);
 233                 }
 234
 235                 if (error == 0) {
 236                         int boff;
 237
 238                         if (sc->flags & IWI_FLAG_EXIT)
 239                                 break;
 240                         else if ((sc->flags & IWI_FLAG_RESET) == 0)
 241                                 continue;
 242
 243                         if_printf(ifp, "reset firmware\n");
 244                         for (boff = 1; sc->flags & IWI_FLAG_RESET; boff++) {
 245                                 iwi_init(sc);
 246                                 if (sc->flags & IWI_FLAG_FW_INITED) {
 247                                         sc->flags &= ~IWI_FLAG_RESET;
 248                                 } else if (boff > 10) { /* XXX */
 249                                         if_printf(ifp, "fw reset failed.  "
 250                                                   "retrying...\n");
 251
 252                                         /* XXX avoid to sleep to long */
 253                                         boff = 1;
 254                                 }
 255
 256                                 /*
 257                                  * Since this would be infinite loop,
 258                                  * if reseting firmware never succeeded,
 259                                  * we test to see whether we are detaching.
 260                                  */
 261                                 if (sc->flags & IWI_FLAG_EXIT)
 262                                         break;
 263
 264                                 crit_enter();
 265                                 tsleep_interlock(IWI_FW_CMD_ACKED(sc));
 266                                 lwkt_serialize_exit(ifp->if_serializer);
 267                                 error = tsleep(IWI_FW_CMD_ACKED(sc),
 268                                                PINTERLOCKED,
 269                                                "iwirun", boff * hz);
 270                                 crit_exit();
 271                                 lwkt_serialize_enter(ifp->if_serializer);
 272                         }
 273                 }
 274         }
 275         lwkt_serialize_exit(ifp->if_serializer);
 276
 277         if_printf(ifp, "fw monitor exiting\n");
 278         wakeup(IWI_FW_EXIT_MONITOR(sc));
 279         kthread_exit();
 280 }
 281
 282 static int
 283 iwi_probe(device_t dev)
 284 {
 285         const struct iwi_ident *ident;
 286         uint16_t vid, did;
 287
 288         vid = pci_get_vendor(dev);
 289         did = pci_get_device(dev);
 290         for (ident = iwi_ident_table; ident->name != NULL; ident++) {
 291                 if (vid == ident->vendor && did == ident->device) {
 292                         device_set_desc(dev, ident->name);
 293                         return 0;
 294                 }
 295         }
 296         return ENXIO;
 297 }
 298
 299 /* Base Address Register */
 300 #define IWI_PCI_BAR0    0x10
 301
 302 static int
 303 iwi_attach(device_t dev)
 304 {
 305         struct iwi_softc *sc = device_get_softc(dev);
 306         struct ieee80211com *ic = &sc->sc_ic;
 307         struct ifnet *ifp = &ic->ic_if;
 308         uint16_t val;
 309         int error, i;
 310
 311         sc->sc_dev = dev;
 312         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 313
 314         if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
 315                 device_printf(dev, "chip is in D%d power mode "
 316                     "-- setting to D0\n", pci_get_powerstate(dev));
 317                 pci_set_powerstate(dev, PCI_POWERSTATE_D0);
 318         }
 319
 320         pci_write_config(dev, 0x41, 0, 1);
 321
 322         /* enable bus-mastering */
 323         pci_enable_busmaster(dev);
 324
 325         sc->mem_rid = IWI_PCI_BAR0;
 326         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
 327                                          RF_ACTIVE);
 328         if (sc->mem == NULL) {
 329                 device_printf(dev, "could not allocate memory resource\n");
 330                 return ENXIO;
 331         }
 332         sc->sc_st = rman_get_bustag(sc->mem);
 333         sc->sc_sh = rman_get_bushandle(sc->mem);
 334
 335         sc->irq_rid = 0;
 336         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
 337                                          RF_ACTIVE | RF_SHAREABLE);
 338         if (sc->irq == NULL) {
 339                 device_printf(dev, "could not allocate interrupt resource\n");
 340                 goto fail;
 341         }
 342
 343         if (iwi_reset(sc) != 0) {
 344                 device_printf(dev, "could not reset adapter\n");
 345                 goto fail;
 346         }
 347
 348         /*
 349          * Allocate rings.
 350          */
 351         error = iwi_alloc_cmd_ring(sc, &sc->cmdq, IWI_CMD_RING_COUNT);
 352         if (error != 0) {
 353                 device_printf(dev, "could not allocate Cmd ring\n");
 354                 goto fail;
 355         }
 356
 357         error = iwi_alloc_tx_ring(sc, &sc->txq[0], IWI_TX_RING_COUNT,
 358                                   IWI_CSR_TX1_RIDX, IWI_CSR_TX1_WIDX);
 359         if (error != 0) {
 360                 device_printf(dev, "could not allocate Tx ring 1\n");
 361                 goto fail;
 362         }
 363
 364         error = iwi_alloc_tx_ring(sc, &sc->txq[1], IWI_TX_RING_COUNT,
 365                                   IWI_CSR_TX2_RIDX, IWI_CSR_TX2_WIDX);
 366         if (error != 0) {
 367                 device_printf(dev, "could not allocate Tx ring 2\n");
 368                 goto fail;
 369         }
 370
 371         error = iwi_alloc_tx_ring(sc, &sc->txq[2], IWI_TX_RING_COUNT,
 372                                   IWI_CSR_TX3_RIDX, IWI_CSR_TX3_WIDX);
 373         if (error != 0) {
 374                 device_printf(dev, "could not allocate Tx ring 3\n");
 375                 goto fail;
 376         }
 377
 378         error = iwi_alloc_tx_ring(sc, &sc->txq[3], IWI_TX_RING_COUNT,
 379                                   IWI_CSR_TX4_RIDX, IWI_CSR_TX4_WIDX);
 380         if (error != 0) {
 381                 device_printf(dev, "could not allocate Tx ring 4\n");
 382                 goto fail;
 383         }
 384
 385         error = iwi_alloc_rx_ring(sc, &sc->rxq, IWI_RX_RING_COUNT);
 386         if (error != 0) {
 387                 device_printf(dev, "could not allocate Rx ring\n");
 388                 goto fail;
 389         }
 390
 391         sysctl_ctx_init(&sc->sysctl_ctx);
 392         sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
 393                                 SYSCTL_STATIC_CHILDREN(_hw),
 394                                 OID_AUTO,
 395                                 device_get_nameunit(dev),
 396                                 CTLFLAG_RD,
 397                                 0, "");
 398         if (sc->sysctl_tree == NULL) {
 399                 device_printf(dev, "sysctl add node failed\n");
 400                 error = EIO;
 401                 goto fail;
 402         }
 403
 404         ifp->if_softc = sc;
 405         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 406         ifp->if_init = iwi_init;
 407         ifp->if_ioctl = iwi_ioctl;
 408         ifp->if_start = iwi_start;
 409         ifp->if_watchdog = iwi_watchdog;
 410         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 411         ifq_set_ready(&ifp->if_snd);
 412
 413         ic->ic_wme.wme_update = iwi_wme_update;
 414         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
 415         ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
 416         ic->ic_state = IEEE80211_S_INIT;
 417
 418         /* set device capabilities */
 419         ic->ic_caps =
 420             IEEE80211_C_IBSS |          /* IBSS mode supported */
 421             IEEE80211_C_MONITOR |       /* monitor mode supported */
 422             IEEE80211_C_TXPMGT |        /* tx power management */
 423             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 424             IEEE80211_C_WPA |           /* 802.11i */
 425             IEEE80211_C_WME;            /* 802.11e */
 426
 427         /* read MAC address from EEPROM */
 428         val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
 429         ic->ic_myaddr[0] = val & 0xff;
 430         ic->ic_myaddr[1] = val >> 8;
 431         val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
 432         ic->ic_myaddr[2] = val & 0xff;
 433         ic->ic_myaddr[3] = val >> 8;
 434         val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
 435         ic->ic_myaddr[4] = val & 0xff;
 436         ic->ic_myaddr[5] = val >> 8;
 437
 438         if (pci_get_device(dev) >= 0x4223) {
 439                 /* set supported .11a rates (2915ABG only) */
 440                 ic->ic_sup_rates[IEEE80211_MODE_11A] = iwi_rateset_11a;
 441
 442                 /* set supported .11a channels */
 443                 for (i = 36; i <= 64; i += 4) {
 444                         ic->ic_channels[i].ic_freq =
 445                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 446                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 447                 }
 448                 for (i = 149; i <= 165; i += 4) {
 449                         ic->ic_channels[i].ic_freq =
 450                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 451                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 452                 }
 453         }
 454
 455         /* set supported .11b and .11g rates */
 456         ic->ic_sup_rates[IEEE80211_MODE_11B] = iwi_rateset_11b;
 457         ic->ic_sup_rates[IEEE80211_MODE_11G] = iwi_rateset_11g;
 458
 459         /* set supported .11b and .11g channels (1 through 14) */
 460         for (i = 1; i <= 14; i++) {
 461                 ic->ic_channels[i].ic_freq =
 462                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 463                 ic->ic_channels[i].ic_flags =
 464                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
 465                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
 466         }
 467
 468         ieee80211_ifattach(ic);
 469         /* override default methods */
 470         ic->ic_node_alloc = iwi_node_alloc;
 471         sc->sc_node_free = ic->ic_node_free;
 472         ic->ic_node_free = iwi_node_free;
 473         /* override state transition machine */
 474         sc->sc_newstate = ic->ic_newstate;
 475         ic->ic_newstate = iwi_newstate;
 476         ieee80211_media_init(ic, iwi_media_change, iwi_media_status);
 477
 478         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 479             sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
 480
 481         sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
 482         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
 483         sc->sc_rxtap.wr_ihdr.it_present = htole32(IWI_RX_RADIOTAP_PRESENT);
 484
 485         sc->sc_txtap_len = sizeof sc->sc_txtapu;
 486         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
 487         sc->sc_txtap.wt_ihdr.it_present = htole32(IWI_TX_RADIOTAP_PRESENT);
 488
 489         /*
 490          * Add a few sysctl knobs.
 491          */
 492         sc->dwelltime = 100;
 493         sc->bluetooth = 1;
 494         sc->antenna = 0;
 495
 496         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 497             SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "radio",
 498             CTLTYPE_INT | CTLFLAG_RD, sc, 0, iwi_sysctl_radio, "I",
 499             "radio transmitter switch state (0=off, 1=on)");
 500
 501         SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 502             SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "stats",
 503             CTLTYPE_OPAQUE | CTLFLAG_RD, sc, 0, iwi_sysctl_stats, "S",
 504             "statistics");
 505
 506         SYSCTL_ADD_INT(&sc->sysctl_ctx,
 507             SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "dwell",
 508             CTLFLAG_RW, &sc->dwelltime, 0,
 509             "channel dwell time (ms) for AP/station scanning");
 510
 511         SYSCTL_ADD_INT(&sc->sysctl_ctx,
 512             SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "bluetooth",
 513             CTLFLAG_RW, &sc->bluetooth, 0, "bluetooth coexistence");
 514
 515         SYSCTL_ADD_INT(&sc->sysctl_ctx,
 516             SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "antenna",
 517             CTLFLAG_RW, &sc->antenna, 0, "antenna (0=auto)");
 518
 519         /*
 520          * Start firmware monitoring thread
 521          *
 522          * NOTE:
 523          * This should be done only after serializer is initialized,
 524          * i.e. after ieee80211_ifattach(), because serializer will be
 525          * held once iwi_fw_monitor() is entered.
 526          */
 527         error = kthread_create(iwi_fw_monitor, sc, &sc->sc_fw_monitor,
 528                                "%s:fw-monitor", device_get_nameunit(dev));
 529         if (error) {
 530                 device_printf(dev, "could not create fw monitor\n");
 531                 goto fail1;
 532         }
 533         sc->flags |= IWI_FLAG_MONITOR;
 534
 535         /*
 536          * Hook our interrupt after all initialization is complete.
 537          */
 538         error = bus_setup_intr(dev, sc->irq, INTR_MPSAFE, iwi_intr, sc,
 539                                &sc->sc_ih, ifp->if_serializer);
 540         if (error != 0) {
 541                 device_printf(dev, "could not set up interrupt\n");
 542                 goto fail1;
 543         }
 544
 545         ifp->if_cpuid = ithread_cpuid(rman_get_start(sc->irq));
 546         KKASSERT(ifp->if_cpuid >= 0 && ifp->if_cpuid < ncpus);
 547
 548         if (bootverbose)
 549                 ieee80211_announce(ic);
 550
 551         return 0;
 552
 553 fail1:
 554         bpfdetach(ifp);
 555         ieee80211_ifdetach(ic);
 556 fail:
 557         iwi_detach(dev);
 558         return ENXIO;
 559 }
 560
 561 static int
 562 iwi_detach(device_t dev)
 563 {
 564         struct iwi_softc *sc = device_get_softc(dev);
 565         struct ieee80211com *ic = &sc->sc_ic;
 566         struct ifnet *ifp = ic->ic_ifp;
 567
 568         if (sc->flags & IWI_FLAG_MONITOR) {
 569                 lwkt_serialize_enter(ifp->if_serializer);
 570                 sc->flags |= IWI_FLAG_EXIT;
 571                 wakeup(IWI_FW_WAKE_MONITOR(sc));
 572
 573                 crit_enter();
 574                 tsleep_interlock(IWI_FW_EXIT_MONITOR(sc));
 575                 lwkt_serialize_exit(ifp->if_serializer);
 576                 tsleep(IWI_FW_EXIT_MONITOR(sc), PINTERLOCKED, "iwiexi", 0);
 577                 crit_exit();
 578                 /* No need to hold serializer again */
 579
 580                 if_printf(ifp, "fw monitor exited\n");
 581         }
 582
 583         if (device_is_attached(dev)) {
 584                 lwkt_serialize_enter(ifp->if_serializer);
 585
 586                 iwi_stop(sc);
 587                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
 588                 iwi_free_firmware(sc);
 589
 590                 lwkt_serialize_exit(ifp->if_serializer);
 591
 592                 bpfdetach(ifp);
 593                 ieee80211_ifdetach(ic);
 594         }
 595
 596         iwi_free_cmd_ring(sc, &sc->cmdq);
 597         iwi_free_tx_ring(sc, &sc->txq[0]);
 598         iwi_free_tx_ring(sc, &sc->txq[1]);
 599         iwi_free_tx_ring(sc, &sc->txq[2]);
 600         iwi_free_tx_ring(sc, &sc->txq[3]);
 601         iwi_free_rx_ring(sc, &sc->rxq);
 602
 603         if (sc->irq != NULL)
 604                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
 605
 606         if (sc->mem != NULL)
 607                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
 608
 609         if (sc->sysctl_tree != NULL)
 610                 sysctl_ctx_free(&sc->sysctl_ctx);
 611
 612         return 0;
 613 }
 614
 615 static void
 616 iwi_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
 617 {
 618         if (error != 0)
 619                 return;
 620
 621         KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
 622
 623         *(bus_addr_t *)arg = segs[0].ds_addr;
 624 }
 625
 626 static int
 627 iwi_alloc_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring, int count)
 628 {
 629         int error;
 630
 631         ring->count = count;
 632         ring->queued = 0;
 633         ring->cur = ring->next = 0;
 634
 635         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 636             BUS_SPACE_MAXADDR, NULL, NULL, count * IWI_CMD_DESC_SIZE, 1,
 637             count * IWI_CMD_DESC_SIZE, 0, &ring->desc_dmat);
 638         if (error != 0) {
 639                 device_printf(sc->sc_dev, "could not create desc DMA tag\n");
 640                 goto fail;
 641         }
 642
 643         error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
 644             BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
 645         if (error != 0) {
 646                 device_printf(sc->sc_dev, "could not allocate DMA memory\n");
 647                 goto fail;
 648         }
 649
 650         error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
 651             count * IWI_CMD_DESC_SIZE, iwi_dma_map_addr, &ring->physaddr, 0);
 652         if (error != 0) {
 653                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
 654                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
 655                 ring->desc = NULL;
 656                 return error;
 657         }
 658
 659         return 0;
 660
 661 fail:   iwi_free_cmd_ring(sc, ring);
 662         return error;
 663 }
 664
 665 static void
 666 iwi_reset_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
 667 {
 668         ring->queued = 0;
 669         ring->cur = ring->next = 0;
 670 }
 671
 672 static void
 673 iwi_free_cmd_ring(struct iwi_softc *sc, struct iwi_cmd_ring *ring)
 674 {
 675         if (ring->desc != NULL) {
 676                 bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
 677                     BUS_DMASYNC_POSTWRITE);
 678                 bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
 679                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
 680                 ring->desc = NULL;
 681         }
 682
 683         if (ring->desc_dmat != NULL) {
 684                 bus_dma_tag_destroy(ring->desc_dmat);
 685                 ring->desc_dmat = NULL;
 686         }
 687 }
 688
 689 static int
 690 iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring, int count,
 691     bus_addr_t csr_ridx, bus_addr_t csr_widx)
 692 {
 693         int i, error;
 694
 695         ring->count = count;
 696         ring->queued = 0;
 697         ring->cur = ring->next = 0;
 698         ring->csr_ridx = csr_ridx;
 699         ring->csr_widx = csr_widx;
 700
 701         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
 702             BUS_SPACE_MAXADDR, NULL, NULL, count * IWI_TX_DESC_SIZE, 1,
 703             count * IWI_TX_DESC_SIZE, 0, &ring->desc_dmat);
 704         if (error != 0) {
 705                 device_printf(sc->sc_dev, "could not create desc DMA tag\n");
 706                 goto fail;
 707         }
 708
 709         error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
 710             BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
 711         if (error != 0) {
 712                 device_printf(sc->sc_dev, "could not allocate DMA memory\n");
 713                 goto fail;
 714         }
 715
 716         error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
 717             count * IWI_TX_DESC_SIZE, iwi_dma_map_addr, &ring->physaddr, 0);
 718         if (error != 0) {
 719                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
 720
 721                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
 722                 ring->desc = NULL;
 723                 goto fail;
 724         }
 725
 726         ring->data = kmalloc(count * sizeof (struct iwi_tx_data), M_DEVBUF,
 727             M_WAITOK | M_ZERO);
 728
 729         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 730             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IWI_MAX_NSEG - 2,
 731             MCLBYTES, 0, &ring->data_dmat);
 732         if (error != 0) {
 733                 device_printf(sc->sc_dev, "could not create data DMA tag\n");
 734                 goto fail;
 735         }
 736
 737         for (i = 0; i < count; i++) {
 738                 error = bus_dmamap_create(ring->data_dmat, 0,
 739                     &ring->data[i].map);
 740                 if (error != 0) {
 741                         device_printf(sc->sc_dev, "could not create DMA map\n");
 742                         goto fail;
 743                 }
 744         }
 745
 746         return 0;
 747
 748 fail:   iwi_free_tx_ring(sc, ring);
 749         return error;
 750 }
 751
 752 static void
 753 iwi_reset_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
 754 {
 755         struct iwi_tx_data *data;
 756         int i;
 757
 758         for (i = 0; i < ring->count; i++) {
 759                 data = &ring->data[i];
 760
 761                 if (data->m != NULL) {
 762                         bus_dmamap_sync(ring->data_dmat, data->map,
 763                             BUS_DMASYNC_POSTWRITE);
 764                         bus_dmamap_unload(ring->data_dmat, data->map);
 765                         m_freem(data->m);
 766                         data->m = NULL;
 767                 }
 768
 769                 if (data->ni != NULL) {
 770                         ieee80211_free_node(data->ni);
 771                         data->ni = NULL;
 772                 }
 773         }
 774
 775         ring->queued = 0;
 776         ring->cur = ring->next = 0;
 777 }
 778
 779 static void
 780 iwi_free_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring)
 781 {
 782         struct iwi_tx_data *data;
 783         int i;
 784
 785         if (ring->desc != NULL) {
 786                 bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
 787                     BUS_DMASYNC_POSTWRITE);
 788                 bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
 789                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
 790                 ring->desc = NULL;
 791         }
 792
 793         if (ring->desc_dmat != NULL) {
 794                 bus_dma_tag_destroy(ring->desc_dmat);
 795                 ring->desc_dmat = NULL;
 796         }
 797
 798         if (ring->data != NULL) {
 799                 for (i = 0; i < ring->count; i++) {
 800                         data = &ring->data[i];
 801
 802                         if (data->m != NULL) {
 803                                 bus_dmamap_sync(ring->data_dmat, data->map,
 804                                     BUS_DMASYNC_POSTWRITE);
 805                                 bus_dmamap_unload(ring->data_dmat, data->map);
 806                                 m_freem(data->m);
 807                                 data->m = NULL;
 808                         }
 809
 810                         if (data->ni != NULL) {
 811                                 ieee80211_free_node(data->ni);
 812                                 data->ni = NULL;
 813                         }
 814
 815                         if (data->map != NULL) {
 816                                 bus_dmamap_destroy(ring->data_dmat, data->map);
 817                                 data->map = NULL;
 818                         }
 819                 }
 820
 821                 kfree(ring->data, M_DEVBUF);
 822                 ring->data = NULL;
 823         }
 824
 825         if (ring->data_dmat != NULL) {
 826                 bus_dma_tag_destroy(ring->data_dmat);
 827                 ring->data_dmat = NULL;
 828         }
 829 }
 830
 831 static int
 832 iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring, int count)
 833 {
 834         struct iwi_rx_data *data;
 835         int i, error;
 836
 837         ring->count = count;
 838         ring->cur = 0;
 839
 840         ring->data = kmalloc(count * sizeof (struct iwi_rx_data), M_DEVBUF,
 841             M_WAITOK | M_ZERO);
 842
 843         error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 844             BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0,
 845             &ring->data_dmat);
 846         if (error != 0) {
 847                 device_printf(sc->sc_dev, "could not create data DMA tag\n");
 848                 goto fail;
 849         }
 850
 851         for (i = 0; i < count; i++) {
 852                 data = &ring->data[i];
 853
 854                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
 855                 if (error != 0) {
 856                         device_printf(sc->sc_dev, "could not create DMA map\n");
 857                         goto fail;
 858                 }
 859
 860                 data->m = m_getcl(MB_WAIT, MT_DATA, M_PKTHDR);
 861                 if (data->m == NULL) {
 862                         device_printf(sc->sc_dev,
 863                             "could not allocate rx mbuf\n");
 864                         error = ENOMEM;
 865                         goto fail;
 866                 }
 867
 868                 error = bus_dmamap_load(ring->data_dmat, data->map,
 869                     mtod(data->m, void *), MCLBYTES, iwi_dma_map_addr,
 870                     &data->physaddr, 0);
 871                 if (error != 0) {
 872                         device_printf(sc->sc_dev,
 873                             "could not load rx buf DMA map");
 874
 875                         m_freem(data->m);
 876                         data->m = NULL;
 877                         goto fail;
 878                 }
 879
 880                 data->reg = IWI_CSR_RX_BASE + i * 4;
 881         }
 882
 883         return 0;
 884
 885 fail:   iwi_free_rx_ring(sc, ring);
 886         return error;
 887 }
 888
 889 static void
 890 iwi_reset_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
 891 {
 892         ring->cur = 0;
 893 }
 894
 895 static void
 896 iwi_free_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring)
 897 {
 898         struct iwi_rx_data *data;
 899         int i;
 900
 901         if (ring->data != NULL) {
 902                 for (i = 0; i < ring->count; i++) {
 903                         data = &ring->data[i];
 904
 905                         if (data->m != NULL) {
 906                                 bus_dmamap_sync(ring->data_dmat, data->map,
 907                                     BUS_DMASYNC_POSTREAD);
 908                                 bus_dmamap_unload(ring->data_dmat, data->map);
 909                                 m_freem(data->m);
 910                                 data->m = NULL;
 911                         }
 912
 913                         if (data->map != NULL) {
 914                                 bus_dmamap_destroy(ring->data_dmat, data->map);
 915                                 data->map = NULL;
 916                         }
 917                 }
 918
 919                 kfree(ring->data, M_DEVBUF);
 920                 ring->data = NULL;
 921         }
 922
 923         if (ring->data_dmat != NULL) {
 924                 bus_dma_tag_destroy(ring->data_dmat);
 925                 ring->data_dmat = NULL;
 926         }
 927 }
 928
 929 static int
 930 iwi_shutdown(device_t dev)
 931 {
 932         struct iwi_softc *sc = device_get_softc(dev);
 933         struct ifnet *ifp = &sc->sc_ic.ic_if;
 934
 935         lwkt_serialize_enter(ifp->if_serializer);
 936         iwi_stop(sc);
 937         lwkt_serialize_exit(ifp->if_serializer);
 938
 939         return 0;
 940 }
 941
 942 static int
 943 iwi_suspend(device_t dev)
 944 {
 945         struct iwi_softc *sc = device_get_softc(dev);
 946         struct ifnet *ifp = &sc->sc_ic.ic_if;
 947
 948         lwkt_serialize_enter(ifp->if_serializer);
 949         iwi_stop(sc);
 950         lwkt_serialize_exit(ifp->if_serializer);
 951
 952         return 0;
 953 }
 954
 955 static int
 956 iwi_resume(device_t dev)
 957 {
 958         struct iwi_softc *sc = device_get_softc(dev);
 959         struct ifnet *ifp = sc->sc_ic.ic_ifp;
 960
 961         lwkt_serialize_enter(ifp->if_serializer);
 962
 963         pci_write_config(dev, 0x41, 0, 1);
 964
 965         if (ifp->if_flags & IFF_UP) {
 966                 ifp->if_init(ifp->if_softc);
 967                 if (ifp->if_flags & IFF_RUNNING)
 968                         if_devstart(ifp);
 969         }
 970
 971         lwkt_serialize_exit(ifp->if_serializer);
 972
 973         return 0;
 974 }
 975
 976 static struct ieee80211_node *
 977 iwi_node_alloc(struct ieee80211_node_table *nt)
 978 {
 979         struct iwi_node *in;
 980
 981         in = kmalloc(sizeof (struct iwi_node), M_80211_NODE, M_NOWAIT | M_ZERO);
 982         if (in == NULL)
 983                 return NULL;
 984
 985         in->in_station = -1;
 986
 987         return &in->in_node;
 988 }
 989
 990 static void
 991 iwi_node_free(struct ieee80211_node *ni)
 992 {
 993         struct ieee80211com *ic = ni->ni_ic;
 994         struct iwi_softc *sc = ic->ic_ifp->if_softc;
 995         struct iwi_node *in = (struct iwi_node *)ni;
 996
 997         if (in->in_station != -1)
 998                 iwi_free_ibss_node(sc, in->in_station);
 999
1000         sc->sc_node_free(ni);
1001 }
1002
1003 static int
1004 iwi_media_change(struct ifnet *ifp)
1005 {
1006         struct iwi_softc *sc = ifp->if_softc;
1007         int error;
1008
1009         ASSERT_SERIALIZED(ifp->if_serializer);
1010
1011         error = ieee80211_media_change(ifp);
1012         if (error != ENETRESET)
1013                 return error;
1014
1015         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
1016                 iwi_init(sc);
1017         return 0;
1018 }
1019
1020 /*
1021  * Convert h/w rate code to IEEE rate code.
1022  */
1023 static int
1024 iwi_cvtrate(int iwirate)
1025 {
1026         switch (iwirate) {
1027         case IWI_RATE_DS1:      return 2;
1028         case IWI_RATE_DS2:      return 4;
1029         case IWI_RATE_DS5:      return 11;
1030         case IWI_RATE_DS11:     return 22;
1031         case IWI_RATE_OFDM6:    return 12;
1032         case IWI_RATE_OFDM9:    return 18;
1033         case IWI_RATE_OFDM12:   return 24;
1034         case IWI_RATE_OFDM18:   return 36;
1035         case IWI_RATE_OFDM24:   return 48;
1036         case IWI_RATE_OFDM36:   return 72;
1037         case IWI_RATE_OFDM48:   return 96;
1038         case IWI_RATE_OFDM54:   return 108;
1039         }
1040         return 0;
1041 }
1042
1043 /*
1044  * The firmware automatically adapts the transmit speed.  We report its current
1045  * value here.
1046  */
1047 static void
1048 iwi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
1049 {
1050         struct iwi_softc *sc = ifp->if_softc;
1051         struct ieee80211com *ic = &sc->sc_ic;
1052         int rate;
1053
1054         imr->ifm_status = IFM_AVALID;
1055         imr->ifm_active = IFM_IEEE80211;
1056         if (ic->ic_state == IEEE80211_S_RUN)
1057                 imr->ifm_status |= IFM_ACTIVE;
1058
1059         /* read current transmission rate from adapter */
1060         rate = iwi_cvtrate(CSR_READ_4(sc, IWI_CSR_CURRENT_TX_RATE));
1061         imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);
1062
1063         if (ic->ic_opmode == IEEE80211_M_IBSS)
1064                 imr->ifm_active |= IFM_IEEE80211_ADHOC;
1065         else if (ic->ic_opmode == IEEE80211_M_MONITOR)
1066                 imr->ifm_active |= IFM_IEEE80211_MONITOR;
1067 }
1068
1069 static int
1070 iwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1071 {
1072         struct ifnet *ifp = ic->ic_ifp;
1073         struct iwi_softc *sc = ifp->if_softc;
1074         enum ieee80211_state ostate;
1075         uint32_t tmp;
1076
1077         ostate = ic->ic_state;
1078
1079         switch (nstate) {
1080         case IEEE80211_S_SCAN:
1081                 if (sc->flags & IWI_FLAG_SCANNING)
1082                         break;
1083
1084                 ieee80211_node_table_reset(&ic->ic_scan);
1085                 ic->ic_flags |= IEEE80211_F_SCAN | IEEE80211_F_ASCAN;
1086                 sc->flags |= IWI_FLAG_SCANNING;
1087                 iwi_scan(sc);
1088                 break;
1089
1090         case IEEE80211_S_AUTH:
1091                 iwi_auth_and_assoc(sc);
1092                 break;
1093
1094         case IEEE80211_S_RUN:
1095                 if (ic->ic_opmode == IEEE80211_M_IBSS)
1096                         iwi_auth_and_assoc(sc);
1097                 else if (ic->ic_opmode == IEEE80211_M_MONITOR)
1098                         iwi_set_chan(sc, ic->ic_ibss_chan);
1099
1100                 /* assoc led on */
1101                 tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
1102                 MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp | IWI_LED_ASSOC);
1103
1104                 return sc->sc_newstate(ic, nstate,
1105                     IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
1106
1107         case IEEE80211_S_ASSOC:
1108                 break;
1109
1110         case IEEE80211_S_INIT:
1111                 sc->flags &= ~IWI_FLAG_SCANNING;
1112
1113                 if (ostate != IEEE80211_S_RUN)
1114                         break;
1115
1116                 /* assoc led off */
1117                 tmp = MEM_READ_4(sc, IWI_MEM_EVENT_CTL) & IWI_LED_MASK;
1118                 MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, tmp & ~IWI_LED_ASSOC);
1119                 break;
1120         }
1121
1122         ic->ic_state = nstate;
1123
1124         return 0;
1125 }
1126
1127 /*
1128  * WME parameters coming from IEEE 802.11e specification.  These values are
1129  * already declared in ieee80211_proto.c, but they are static so they can't
1130  * be reused here.
1131  */
1132 static const struct wmeParams iwi_wme_cck_params[WME_NUM_AC] = {
1133         { 0, 3, 5,  7,   0 },   /* WME_AC_BE */
1134         { 0, 3, 5, 10,   0 },   /* WME_AC_BK */
1135         { 0, 2, 4,  5, 188 },   /* WME_AC_VI */
1136         { 0, 2, 3,  4, 102 }    /* WME_AC_VO */
1137 };
1138
1139 static const struct wmeParams iwi_wme_ofdm_params[WME_NUM_AC] = {
1140         { 0, 3, 4,  6,   0 },   /* WME_AC_BE */
1141         { 0, 3, 4, 10,   0 },   /* WME_AC_BK */
1142         { 0, 2, 3,  4,  94 },   /* WME_AC_VI */
1143         { 0, 2, 2,  3,  47 }    /* WME_AC_VO */
1144 };
1145
1146 static int
1147 iwi_wme_update(struct ieee80211com *ic)
1148 {
1149 #define IWI_EXP2(v)     htole16((1 << (v)) - 1)
1150 #define IWI_USEC(v)     htole16(IEEE80211_TXOP_TO_US(v))
1151         struct iwi_softc *sc = ic->ic_ifp->if_softc;
1152         struct iwi_wme_params wme[3];
1153         const struct wmeParams *wmep;
1154         int ac;
1155
1156         /*
1157          * We shall not override firmware default WME values if WME is not
1158          * actually enabled.
1159          */
1160         if (!(ic->ic_flags & IEEE80211_F_WME))
1161                 return 0;
1162
1163         for (ac = 0; ac < WME_NUM_AC; ac++) {
1164                 /* set WME values for current operating mode */
1165                 wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
1166                 wme[0].aifsn[ac] = wmep->wmep_aifsn;
1167                 wme[0].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1168                 wme[0].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1169                 wme[0].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1170                 wme[0].acm[ac]   = wmep->wmep_acm;
1171
1172                 /* set WME values for CCK modulation */
1173                 wmep = &iwi_wme_cck_params[ac];
1174                 wme[1].aifsn[ac] = wmep->wmep_aifsn;
1175                 wme[1].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1176                 wme[1].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1177                 wme[1].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1178                 wme[1].acm[ac]   = wmep->wmep_acm;
1179
1180                 /* set WME values for OFDM modulation */
1181                 wmep = &iwi_wme_ofdm_params[ac];
1182                 wme[2].aifsn[ac] = wmep->wmep_aifsn;
1183                 wme[2].cwmin[ac] = IWI_EXP2(wmep->wmep_logcwmin);
1184                 wme[2].cwmax[ac] = IWI_EXP2(wmep->wmep_logcwmax);
1185                 wme[2].burst[ac] = IWI_USEC(wmep->wmep_txopLimit);
1186                 wme[2].acm[ac]   = wmep->wmep_acm;
1187         }
1188
1189         DPRINTF(("Setting WME parameters\n"));
1190         return iwi_cmd(sc, IWI_CMD_SET_WME_PARAMS, wme, sizeof wme, 1);
1191 #undef IWI_USEC
1192 #undef IWI_EXP2
1193 }
1194
1195 /*
1196  * Read 16 bits at address 'addr' from the serial EEPROM.
1197  */
1198 static uint16_t
1199 iwi_read_prom_word(struct iwi_softc *sc, uint8_t addr)
1200 {
1201         uint32_t tmp;
1202         uint16_t val;
1203         int n;
1204
1205         /* Clock C once before the first command */
1206         IWI_EEPROM_CTL(sc, 0);
1207         IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1208         IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1209         IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1210
1211         /* Write start bit (1) */
1212         IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1213         IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1214
1215         /* Write READ opcode (10) */
1216         IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D);
1217         IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_D | IWI_EEPROM_C);
1218         IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1219         IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1220
1221         /* Write address A7-A0 */
1222         for (n = 7; n >= 0; n--) {
1223                 IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1224                     (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D));
1225                 IWI_EEPROM_CTL(sc, IWI_EEPROM_S |
1226                     (((addr >> n) & 1) << IWI_EEPROM_SHIFT_D) | IWI_EEPROM_C);
1227         }
1228
1229         IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1230
1231         /* Read data Q15-Q0 */
1232         val = 0;
1233         for (n = 15; n >= 0; n--) {
1234                 IWI_EEPROM_CTL(sc, IWI_EEPROM_S | IWI_EEPROM_C);
1235                 IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1236                 tmp = MEM_READ_4(sc, IWI_MEM_EEPROM_CTL);
1237                 val |= ((tmp & IWI_EEPROM_Q) >> IWI_EEPROM_SHIFT_Q) << n;
1238         }
1239
1240         IWI_EEPROM_CTL(sc, 0);
1241
1242         /* Clear Chip Select and clock C */
1243         IWI_EEPROM_CTL(sc, IWI_EEPROM_S);
1244         IWI_EEPROM_CTL(sc, 0);
1245         IWI_EEPROM_CTL(sc, IWI_EEPROM_C);
1246
1247         return val;
1248 }
1249
1250 /*
1251  * XXX: Hack to set the current channel to the value advertised in beacons or
1252  * probe responses. Only used during AP detection.
1253  */
1254 static void
1255 iwi_fix_channel(struct ieee80211com *ic, struct mbuf *m)
1256 {
1257         struct ieee80211_frame *wh;
1258         uint8_t subtype;
1259         uint8_t *frm, *efrm;
1260
1261         wh = mtod(m, struct ieee80211_frame *);
1262
1263         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
1264                 return;
1265
1266         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1267
1268         if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
1269             subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1270                 return;
1271
1272         frm = (uint8_t *)(wh + 1);
1273         efrm = mtod(m, uint8_t *) + m->m_len;
1274
1275         frm += 12;      /* skip tstamp, bintval and capinfo fields */
1276         while (frm < efrm) {
1277                 if (*frm == IEEE80211_ELEMID_DSPARMS)
1278 #if IEEE80211_CHAN_MAX < 255
1279                 if (frm[2] <= IEEE80211_CHAN_MAX)
1280 #endif
1281                         ic->ic_curchan = &ic->ic_channels[frm[2]];
1282
1283                 frm += frm[1] + 2;
1284         }
1285 }
1286
1287 static void
1288 iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_data *data, int i,
1289     struct iwi_frame *frame)
1290 {
1291         struct ieee80211com *ic = &sc->sc_ic;
1292         struct ifnet *ifp = ic->ic_ifp;
1293         struct mbuf *mnew, *m;
1294         struct ieee80211_frame *wh;
1295         struct ieee80211_node *ni;
1296         int error;
1297
1298         DPRINTFN(5, ("received frame len=%u chan=%u rssi=%u\n",
1299             le16toh(frame->len), frame->chan, frame->rssi_dbm));
1300
1301         if (le16toh(frame->len) < sizeof (struct ieee80211_frame))
1302                 return;
1303
1304         /*
1305          * Try to allocate a new mbuf for this ring element and load it before
1306          * processing the current mbuf. If the ring element cannot be loaded,
1307          * drop the received packet and reuse the old mbuf. In the unlikely
1308          * case that the old mbuf can't be reloaded either, explicitly panic.
1309          */
1310         mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1311         if (mnew == NULL) {
1312                 ifp->if_ierrors++;
1313                 return;
1314         }
1315
1316         bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1317
1318         error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1319             mtod(mnew, void *), MCLBYTES, iwi_dma_map_addr, &data->physaddr,
1320             0);
1321         if (error != 0) {
1322                 m_freem(mnew);
1323
1324                 /* try to reload the old mbuf */
1325                 error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1326                     mtod(data->m, void *), MCLBYTES, iwi_dma_map_addr,
1327                     &data->physaddr, 0);
1328                 if (error != 0) {
1329                         /* very unlikely that it will fail... */
1330                         panic("%s: could not load old rx mbuf",
1331                             device_get_name(sc->sc_dev));
1332                 }
1333                 ifp->if_ierrors++;
1334                 return;
1335         }
1336
1337         /*
1338          * New mbuf successfully loaded, update Rx ring and continue
1339          * processing.
1340          */
1341         m = data->m;
1342         data->m = mnew;
1343         CSR_WRITE_4(sc, data->reg, data->physaddr);
1344
1345         /* Finalize mbuf */
1346         m->m_pkthdr.rcvif = ifp;
1347         m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
1348             sizeof (struct iwi_frame) + le16toh(frame->len);
1349
1350         m_adj(m, sizeof (struct iwi_hdr) + sizeof (struct iwi_frame));
1351
1352         if (ic->ic_state == IEEE80211_S_SCAN)
1353                 iwi_fix_channel(ic, m);
1354
1355         if (sc->sc_drvbpf != NULL) {
1356                 struct iwi_rx_radiotap_header *tap = &sc->sc_rxtap;
1357
1358                 tap->wr_flags = 0;
1359                 tap->wr_rate = frame->rate;
1360                 tap->wr_chan_freq =
1361                     htole16(ic->ic_channels[frame->chan].ic_freq);
1362                 tap->wr_chan_flags =
1363                     htole16(ic->ic_channels[frame->chan].ic_flags);
1364                 tap->wr_antsignal = frame->signal;
1365                 tap->wr_antenna = frame->antenna;
1366
1367                 bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1368         }
1369
1370         wh = mtod(m, struct ieee80211_frame *);
1371         ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
1372
1373         /* send the frame to the 802.11 layer */
1374         ieee80211_input(ic, m, ni, frame->rssi_dbm, 0);
1375
1376         /* node is no longer needed */
1377         ieee80211_free_node(ni);
1378 }
1379
1380 static void
1381 iwi_notification_intr(struct iwi_softc *sc, struct iwi_notif *notif)
1382 {
1383         struct ieee80211com *ic = &sc->sc_ic;
1384         struct iwi_notif_scan_channel *chan;
1385         struct iwi_notif_scan_complete *scan;
1386         struct iwi_notif_authentication *auth;
1387         struct iwi_notif_association *assoc;
1388
1389         switch (notif->type) {
1390         case IWI_NOTIF_TYPE_SCAN_CHANNEL:
1391                 chan = (struct iwi_notif_scan_channel *)(notif + 1);
1392
1393                 DPRINTFN(2, ("Scanning channel (%u)\n", chan->nchan));
1394                 break;
1395
1396         case IWI_NOTIF_TYPE_SCAN_COMPLETE:
1397                 scan = (struct iwi_notif_scan_complete *)(notif + 1);
1398
1399                 DPRINTFN(2, ("Scan completed (%u, %u)\n", scan->nchan,
1400                     scan->status));
1401
1402                 /* monitor mode uses scan to set the channel ... */
1403                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1404                         sc->flags &= ~IWI_FLAG_SCANNING;
1405                         ieee80211_end_scan(ic);
1406                 } else
1407                         iwi_set_chan(sc, ic->ic_ibss_chan);
1408                 break;
1409
1410         case IWI_NOTIF_TYPE_AUTHENTICATION:
1411                 auth = (struct iwi_notif_authentication *)(notif + 1);
1412
1413                 DPRINTFN(2, ("Authentication (%u)\n", auth->state));
1414
1415                 switch (auth->state) {
1416                 case IWI_AUTHENTICATED:
1417                         ieee80211_node_authorize(ic->ic_bss);
1418                         ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
1419                         break;
1420
1421                 case IWI_DEAUTHENTICATED:
1422                         break;
1423
1424                 default:
1425                         device_printf(sc->sc_dev,
1426                             "unknown authentication state %u\n", auth->state);
1427                 }
1428                 break;
1429
1430         case IWI_NOTIF_TYPE_ASSOCIATION:
1431                 assoc = (struct iwi_notif_association *)(notif + 1);
1432
1433                 DPRINTFN(2, ("Association (%u, %u)\n", assoc->state,
1434                     assoc->status));
1435
1436                 switch (assoc->state) {
1437                 case IWI_AUTHENTICATED:
1438                         /* re-association, do nothing */
1439                         break;
1440
1441                 case IWI_ASSOCIATED:
1442                         ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1443                         break;
1444
1445                 case IWI_DEASSOCIATED:
1446                         ieee80211_begin_scan(ic, 1);
1447                         break;
1448
1449                 default:
1450                         device_printf(sc->sc_dev,
1451                             "unknown association state %u\n", assoc->state);
1452                 }
1453                 break;
1454
1455         default:
1456                 DPRINTFN(5, ("Notification (%u)\n", notif->type));
1457         }
1458 }
1459
1460 static void
1461 iwi_rx_intr(struct iwi_softc *sc)
1462 {
1463         struct iwi_rx_data *data;
1464         struct iwi_hdr *hdr;
1465         uint32_t hw;
1466
1467         hw = CSR_READ_4(sc, IWI_CSR_RX_RIDX);
1468
1469         for (; sc->rxq.cur != hw;) {
1470                 data = &sc->rxq.data[sc->rxq.cur];
1471
1472                 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1473                     BUS_DMASYNC_POSTREAD);
1474
1475                 hdr = mtod(data->m, struct iwi_hdr *);
1476
1477                 switch (hdr->type) {
1478                 case IWI_HDR_TYPE_FRAME:
1479                         iwi_frame_intr(sc, data, sc->rxq.cur,
1480                             (struct iwi_frame *)(hdr + 1));
1481                         break;
1482
1483                 case IWI_HDR_TYPE_NOTIF:
1484                         iwi_notification_intr(sc,
1485                             (struct iwi_notif *)(hdr + 1));
1486                         break;
1487
1488                 default:
1489                         device_printf(sc->sc_dev, "unknown hdr type %u\n",
1490                             hdr->type);
1491                 }
1492
1493                 DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1494
1495                 sc->rxq.cur = (sc->rxq.cur + 1) % IWI_RX_RING_COUNT;
1496         }
1497
1498         /* Tell the firmware what we have processed */
1499         hw = (hw == 0) ? IWI_RX_RING_COUNT - 1 : hw - 1;
1500         CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, hw);
1501 }
1502
1503 static void
1504 iwi_tx_intr(struct iwi_softc *sc, struct iwi_tx_ring *txq)
1505 {
1506         struct ieee80211com *ic = &sc->sc_ic;
1507         struct ifnet *ifp = ic->ic_ifp;
1508         struct iwi_tx_data *data;
1509         uint32_t hw;
1510
1511         hw = CSR_READ_4(sc, txq->csr_ridx);
1512
1513         for (; txq->next != hw;) {
1514                 data = &txq->data[txq->next];
1515
1516                 bus_dmamap_sync(txq->data_dmat, data->map,
1517                     BUS_DMASYNC_POSTWRITE);
1518                 bus_dmamap_unload(txq->data_dmat, data->map);
1519                 m_freem(data->m);
1520                 data->m = NULL;
1521                 ieee80211_free_node(data->ni);
1522                 data->ni = NULL;
1523
1524                 DPRINTFN(15, ("tx done idx=%u\n", txq->next));
1525
1526                 ifp->if_opackets++;
1527
1528                 txq->queued--;
1529                 txq->next = (txq->next + 1) % IWI_TX_RING_COUNT;
1530         }
1531
1532         sc->sc_tx_timer = 0;
1533         ifp->if_flags &= ~IFF_OACTIVE;
1534         if_devstart(ifp);
1535 }
1536
1537 static void
1538 iwi_intr(void *arg)
1539 {
1540         struct iwi_softc *sc = arg;
1541         uint32_t r;
1542
1543         r = CSR_READ_4(sc, IWI_CSR_INTR);
1544         if (r == 0 || r == 0xffffffff)
1545                 return;
1546
1547         /* disable interrupts */
1548         CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1549
1550         if (r & IWI_INTR_FATAL_ERROR) {
1551                 device_printf(sc->sc_dev, "fatal error\n");
1552
1553                 if ((sc->flags & (IWI_FLAG_EXIT | IWI_FLAG_RESET)) == 0) {
1554                         sc->flags |= IWI_FLAG_RESET;
1555                         device_printf(sc->sc_dev, "wake firmware monitor\n");
1556                         wakeup(IWI_FW_WAKE_MONITOR(sc));
1557                 }
1558         }
1559
1560         if (r & IWI_INTR_PARITY_ERROR) {
1561                 device_printf(sc->sc_dev, "parity error\n");
1562                 sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1563                 iwi_stop(sc);
1564         }
1565
1566         if (r & IWI_INTR_FW_INITED) {
1567                 if (!(r & (IWI_INTR_FATAL_ERROR | IWI_INTR_PARITY_ERROR)))
1568                         wakeup(IWI_FW_INITIALIZED(sc));
1569         }
1570
1571         if (r & IWI_INTR_RADIO_OFF) {
1572                 DPRINTF(("radio transmitter turned off\n"));
1573                 sc->sc_ic.ic_ifp->if_flags &= ~IFF_UP;
1574                 iwi_stop(sc);
1575         }
1576
1577         if (r & IWI_INTR_CMD_DONE)
1578                 wakeup(IWI_FW_CMD_ACKED(sc));
1579
1580         if (r & IWI_INTR_TX1_DONE)
1581                 iwi_tx_intr(sc, &sc->txq[0]);
1582
1583         if (r & IWI_INTR_TX2_DONE)
1584                 iwi_tx_intr(sc, &sc->txq[1]);
1585
1586         if (r & IWI_INTR_TX3_DONE)
1587                 iwi_tx_intr(sc, &sc->txq[2]);
1588
1589         if (r & IWI_INTR_TX4_DONE)
1590                 iwi_tx_intr(sc, &sc->txq[3]);
1591
1592         if (r & IWI_INTR_RX_DONE)
1593                 iwi_rx_intr(sc);
1594
1595         /* acknowledge interrupts */
1596         CSR_WRITE_4(sc, IWI_CSR_INTR, r);
1597
1598         /* re-enable interrupts */
1599         CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
1600 }
1601
1602 static int
1603 iwi_cmd(struct iwi_softc *sc, uint8_t type, void *data, uint8_t len, int async)
1604 {
1605         struct iwi_cmd_desc *desc;
1606         struct ifnet *ifp = &sc->sc_ic.ic_if;
1607         int ret;
1608
1609         desc = &sc->cmdq.desc[sc->cmdq.cur];
1610
1611         desc->hdr.type = IWI_HDR_TYPE_COMMAND;
1612         desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1613         desc->type = type;
1614         desc->len = len;
1615         memcpy(desc->data, data, len);
1616
1617         bus_dmamap_sync(sc->cmdq.desc_dmat, sc->cmdq.desc_map,
1618             BUS_DMASYNC_PREWRITE);
1619
1620         DPRINTFN(2, ("sending command idx=%u type=%u len=%u\n", sc->cmdq.cur,
1621             type, len));
1622
1623         sc->cmdq.cur = (sc->cmdq.cur + 1) % IWI_CMD_RING_COUNT;
1624         CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
1625
1626         if (!async) {
1627                 ASSERT_SERIALIZED(ifp->if_serializer);
1628
1629                 crit_enter();
1630                 tsleep_interlock(IWI_FW_CMD_ACKED(sc));
1631                 lwkt_serialize_exit(ifp->if_serializer);
1632                 ret = tsleep(IWI_FW_CMD_ACKED(sc), PINTERLOCKED, "iwicmd", hz);
1633                 crit_exit();
1634                 lwkt_serialize_enter(ifp->if_serializer);
1635         } else {
1636                 ret = 0;
1637         }
1638
1639         return ret;
1640 }
1641
1642 static void
1643 iwi_write_ibssnode(struct iwi_softc *sc, const struct iwi_node *in)
1644 {
1645         struct iwi_ibssnode node;
1646
1647         /* write node information into NIC memory */
1648         memset(&node, 0, sizeof node);
1649         IEEE80211_ADDR_COPY(node.bssid, in->in_node.ni_macaddr);
1650
1651         CSR_WRITE_REGION_1(sc,
1652             IWI_CSR_NODE_BASE + in->in_station * sizeof node,
1653             (uint8_t *)&node, sizeof node);
1654 }
1655
1656 struct iwi_dma_mapping {
1657         bus_dma_segment_t segs[IWI_MAX_NSEG];
1658         int nseg;
1659         bus_size_t mapsize;
1660 };
1661
1662 static void
1663 iwi_dma_map_mbuf(void *arg, bus_dma_segment_t *segs, int nseg,
1664                  bus_size_t mapsize, int error)
1665 {
1666         struct iwi_dma_mapping *map = arg;
1667
1668         if (error != 0)
1669                 return;
1670
1671         KASSERT(nseg <= IWI_MAX_NSEG, ("too many DMA segments %d", nseg));
1672
1673         bcopy(segs, map->segs, nseg * sizeof(bus_dma_segment_t));
1674         map->nseg = nseg;
1675         map->mapsize = mapsize;
1676 }
1677
1678 static int
1679 iwi_tx_start(struct ifnet *ifp, struct mbuf *m0, struct ieee80211_node *ni,
1680     int ac)
1681 {
1682         struct iwi_softc *sc = ifp->if_softc;
1683         struct ieee80211com *ic = &sc->sc_ic;
1684         struct iwi_node *in = (struct iwi_node *)ni;
1685         struct ieee80211_frame *wh;
1686         struct ieee80211_key *k;
1687         const struct chanAccParams *cap;
1688         struct iwi_tx_ring *txq = &sc->txq[ac];
1689         struct iwi_tx_data *data;
1690         struct iwi_tx_desc *desc;
1691         struct mbuf *mnew;
1692         struct iwi_dma_mapping map;
1693         int error, hdrlen, i, noack = 0;
1694
1695         wh = mtod(m0, struct ieee80211_frame *);
1696
1697         if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1698                 hdrlen = sizeof (struct ieee80211_qosframe);
1699                 cap = &ic->ic_wme.wme_chanParams;
1700                 noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1701         } else
1702                 hdrlen = sizeof (struct ieee80211_frame);
1703
1704         /*
1705          * This is only used in IBSS mode where the firmware expect an index
1706          * in a h/w table instead of a destination address.
1707          */
1708         if (ic->ic_opmode == IEEE80211_M_IBSS && in->in_station == -1) {
1709                 in->in_station = iwi_alloc_ibss_node(sc);
1710                 if (in->in_station == -1) {     /* h/w table is full */
1711                         m_freem(m0);
1712                         ieee80211_free_node(ni);
1713                         ifp->if_oerrors++;
1714                         if_printf(ifp, "ibss table is full\n");
1715                         return 0;
1716                 }
1717                 iwi_write_ibssnode(sc, in);
1718         }
1719
1720         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1721                 k = ieee80211_crypto_encap(ic, ni, m0);
1722                 if (k == NULL) {
1723                         m_freem(m0);
1724                         return ENOBUFS;
1725                 }
1726
1727                 /* packet header may have moved, reset our local pointer */
1728                 wh = mtod(m0, struct ieee80211_frame *);
1729         }
1730
1731         if (sc->sc_drvbpf != NULL) {
1732                 struct iwi_tx_radiotap_header *tap = &sc->sc_txtap;
1733
1734                 tap->wt_flags = 0;
1735                 tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1736                 tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1737
1738                 bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1739         }
1740
1741         data = &txq->data[txq->cur];
1742         desc = &txq->desc[txq->cur];
1743
1744         /* save and trim IEEE802.11 header */
1745         m_copydata(m0, 0, hdrlen, (caddr_t)&desc->wh);
1746         m_adj(m0, hdrlen);
1747
1748         error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1749                                      iwi_dma_map_mbuf, &map, BUS_DMA_NOWAIT);
1750         if (error != 0 && error != EFBIG) {
1751                 device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1752                     error);
1753                 m_freem(m0);
1754                 return error;
1755         }
1756         if (error != 0) {
1757                 mnew = m_defrag(m0, MB_DONTWAIT);
1758                 if (mnew == NULL) {
1759                         device_printf(sc->sc_dev,
1760                             "could not defragment mbuf\n");
1761                         m_freem(m0);
1762                         return ENOBUFS;
1763                 }
1764                 m0 = mnew;
1765
1766                 error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1767                                              iwi_dma_map_mbuf, &map,
1768                                              BUS_DMA_NOWAIT);
1769                 if (error != 0) {
1770                         device_printf(sc->sc_dev,
1771                             "could not map mbuf (error %d)\n", error);
1772                         m_freem(m0);
1773                         return error;
1774                 }
1775         }
1776
1777         data->m = m0;
1778         data->ni = ni;
1779
1780         desc->hdr.type = IWI_HDR_TYPE_DATA;
1781         desc->hdr.flags = IWI_HDR_FLAG_IRQ;
1782         desc->station =
1783             (ic->ic_opmode == IEEE80211_M_IBSS) ? in->in_station : 0;
1784         desc->cmd = IWI_DATA_CMD_TX;
1785         desc->len = htole16(m0->m_pkthdr.len);
1786         desc->flags = 0;
1787         desc->xflags = 0;
1788
1789         if (!noack && !IEEE80211_IS_MULTICAST(desc->wh.i_addr1))
1790                 desc->flags |= IWI_DATA_FLAG_NEED_ACK;
1791
1792 #if 0
1793         if (ic->ic_flags & IEEE80211_F_PRIVACY) {
1794                 desc->wh.i_fc[1] |= IEEE80211_FC1_WEP;
1795                 desc->weptxkey = ic->ic_crypto.cs_def_txkey;
1796         } else
1797 #endif
1798                 desc->flags |= IWI_DATA_FLAG_NO_WEP;
1799
1800         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1801                 desc->flags |= IWI_DATA_FLAG_SHPREAMBLE;
1802
1803         if (desc->wh.i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS)
1804                 desc->xflags |= IWI_DATA_XFLAG_QOS;
1805
1806         desc->nseg = htole32(map.nseg);
1807         for (i = 0; i < map.nseg; i++) {
1808                 desc->seg_addr[i] = htole32(map.segs[i].ds_addr);
1809                 desc->seg_len[i]  = htole16(map.segs[i].ds_len);
1810         }
1811
1812         bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1813         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1814
1815         DPRINTFN(5, ("sending data frame txq=%u idx=%u len=%u nseg=%u\n",
1816             ac, txq->cur, le16toh(desc->len), map.nseg));
1817
1818         txq->queued++;
1819         txq->cur = (txq->cur + 1) % IWI_TX_RING_COUNT;
1820         CSR_WRITE_4(sc, txq->csr_widx, txq->cur);
1821
1822         return 0;
1823 }
1824
1825 static void
1826 iwi_start(struct ifnet *ifp)
1827 {
1828         struct iwi_softc *sc = ifp->if_softc;
1829         struct ieee80211com *ic = &sc->sc_ic;
1830         struct mbuf *m0;
1831         struct ether_header *eh;
1832         struct ieee80211_node *ni;
1833         int ac;
1834
1835         ieee80211_drain_mgtq(&ic->ic_mgtq);
1836         if (ic->ic_state != IEEE80211_S_RUN) {
1837                 ifq_purge(&ifp->if_snd);
1838                 return;
1839         }
1840
1841         for (;;) {
1842                 m0 = ifq_dequeue(&ifp->if_snd, NULL);
1843                 if (m0 == NULL)
1844                         break;
1845
1846                 if (m0->m_len < sizeof (struct ether_header) &&
1847                     (m0 = m_pullup(m0, sizeof (struct ether_header))) == NULL) {
1848                         ifp->if_oerrors++;
1849                         continue;
1850                 }
1851                 eh = mtod(m0, struct ether_header *);
1852                 ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1853                 if (ni == NULL) {
1854                         m_freem(m0);
1855                         ifp->if_oerrors++;
1856                         continue;
1857                 }
1858
1859                 /* classify mbuf so we can find which tx ring to use */
1860                 if (ieee80211_classify(ic, m0, ni) != 0) {
1861                         m_freem(m0);
1862                         ieee80211_free_node(ni);
1863                         ifp->if_oerrors++;
1864                         continue;
1865                 }
1866
1867                 /* no QoS encapsulation for EAPOL frames */
1868                 ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
1869                     M_WME_GETAC(m0) : WME_AC_BE;
1870
1871                 if (sc->txq[ac].queued > IWI_TX_RING_COUNT - 8) {
1872                         /* there is no place left in this ring */
1873                         m_freem(m0);
1874                         ieee80211_free_node(ni);
1875                         ifp->if_flags |= IFF_OACTIVE;
1876                         break;
1877                 }
1878
1879                 BPF_MTAP(ifp, m0);
1880
1881                 m0 = ieee80211_encap(ic, m0, ni);
1882                 if (m0 == NULL) {
1883                         ieee80211_free_node(ni);
1884                         ifp->if_oerrors++;
1885                         continue;
1886                 }
1887
1888                 if (ic->ic_rawbpf != NULL)
1889                         bpf_mtap(ic->ic_rawbpf, m0);
1890
1891                 if (iwi_tx_start(ifp, m0, ni, ac) != 0) {
1892                         ieee80211_free_node(ni);
1893                         ifp->if_oerrors++;
1894                         break;
1895                 }
1896
1897                 sc->sc_tx_timer = 5;
1898                 ifp->if_timer = 1;
1899         }
1900 }
1901
1902 static void
1903 iwi_watchdog(struct ifnet *ifp)
1904 {
1905         struct iwi_softc *sc = ifp->if_softc;
1906         struct ieee80211com *ic = &sc->sc_ic;
1907
1908         ifp->if_timer = 0;
1909
1910         if (sc->sc_tx_timer > 0) {
1911                 if (--sc->sc_tx_timer == 0) {
1912                         if_printf(ifp, "device timeout\n");
1913                         ifp->if_oerrors++;
1914                         sc->flags |= IWI_FLAG_RESET;
1915                         wakeup(IWI_FW_WAKE_MONITOR(sc));
1916                         return;
1917                 }
1918                 ifp->if_timer = 1;
1919         }
1920
1921         ieee80211_watchdog(ic);
1922 }
1923
1924 static int
1925 iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1926 {
1927         struct iwi_softc *sc = ifp->if_softc;
1928         struct ieee80211com *ic = &sc->sc_ic;
1929         int error = 0;
1930
1931         switch (cmd) {
1932         case SIOCSIFFLAGS:
1933                 if (ifp->if_flags & IFF_UP) {
1934                         if (!(ifp->if_flags & IFF_RUNNING))
1935                                 iwi_init(sc);
1936                 } else {
1937                         if (ifp->if_flags & IFF_RUNNING)
1938                                 iwi_stop(sc);
1939                 }
1940                 break;
1941
1942         default:
1943                 error = ieee80211_ioctl(ic, cmd, data, cr);
1944         }
1945
1946         if (error == ENETRESET) {
1947                 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1948                     (IFF_UP | IFF_RUNNING) &&
1949                     (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
1950                         iwi_init(sc);
1951                 error = 0;
1952         }
1953
1954         return error;
1955 }
1956
1957 static void
1958 iwi_stop_master(struct iwi_softc *sc)
1959 {
1960         uint32_t tmp;
1961         int ntries;
1962
1963         /* disable interrupts */
1964         CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, 0);
1965
1966         CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_STOP_MASTER);
1967         for (ntries = 0; ntries < 5; ntries++) {
1968                 if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
1969                         break;
1970                 DELAY(10);
1971         }
1972         if (ntries == 5)
1973                 if_printf(&sc->sc_ic.ic_if, "timeout waiting for master\n");
1974
1975         tmp = CSR_READ_4(sc, IWI_CSR_RST);
1976         CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_PRINCETON_RESET);
1977
1978         sc->flags &= ~IWI_FLAG_FW_INITED;
1979 }
1980
1981 static int
1982 iwi_reset(struct iwi_softc *sc)
1983 {
1984         uint32_t tmp;
1985         int i, ntries;
1986
1987         iwi_stop_master(sc);
1988
1989         tmp = CSR_READ_4(sc, IWI_CSR_CTL);
1990         CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
1991
1992         CSR_WRITE_4(sc, IWI_CSR_READ_INT, IWI_READ_INT_INIT_HOST);
1993
1994         /* Wait for clock stabilization */
1995         for (ntries = 0; ntries < 1000; ntries++) {
1996                 if (CSR_READ_4(sc, IWI_CSR_CTL) & IWI_CTL_CLOCK_READY)
1997                         break;
1998                 DELAY(200);
1999         }
2000         if (ntries == 1000) {
2001                 if_printf(&sc->sc_ic.ic_if,
2002                           "timeout waiting for clock stabilization\n");
2003                 return EIO;
2004         }
2005
2006         tmp = CSR_READ_4(sc, IWI_CSR_RST);
2007         CSR_WRITE_4(sc, IWI_CSR_RST, tmp | IWI_RST_SOFT_RESET);
2008
2009         DELAY(10);
2010
2011         tmp = CSR_READ_4(sc, IWI_CSR_CTL);
2012         CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_INIT);
2013
2014         /* Clear NIC memory */
2015         CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0);
2016         for (i = 0; i < 0xc000; i++)
2017                 CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2018
2019         return 0;
2020 }
2021
2022 static int
2023 iwi_load_ucode(struct iwi_softc *sc, void *uc, int size)
2024 {
2025         uint32_t tmp;
2026         uint16_t *w;
2027         int ntries, i;
2028
2029         CSR_WRITE_4(sc, IWI_CSR_RST, CSR_READ_4(sc, IWI_CSR_RST) |
2030             IWI_RST_STOP_MASTER);
2031         for (ntries = 0; ntries < 5; ntries++) {
2032                 if (CSR_READ_4(sc, IWI_CSR_RST) & IWI_RST_MASTER_DISABLED)
2033                         break;
2034                 DELAY(10);
2035         }
2036         if (ntries == 5) {
2037                 device_printf(sc->sc_dev, "timeout waiting for master\n");
2038                 return EIO;
2039         }
2040
2041         MEM_WRITE_4(sc, 0x3000e0, 0x80000000);
2042         DELAY(5000);
2043
2044         tmp = CSR_READ_4(sc, IWI_CSR_RST);
2045         tmp &= ~IWI_RST_PRINCETON_RESET;
2046         CSR_WRITE_4(sc, IWI_CSR_RST, tmp);
2047
2048         DELAY(5000);
2049         MEM_WRITE_4(sc, 0x3000e0, 0);
2050         DELAY(1000);
2051         MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 1);
2052         DELAY(1000);
2053         MEM_WRITE_4(sc, IWI_MEM_EVENT_CTL, 0);
2054         DELAY(1000);
2055         MEM_WRITE_1(sc, 0x200000, 0x00);
2056         MEM_WRITE_1(sc, 0x200000, 0x40);
2057         DELAY(1000);
2058
2059         /* write microcode into adapter memory */
2060         for (w = uc; size > 0; w++, size -= 2)
2061                 MEM_WRITE_2(sc, 0x200010, htole16(*w));
2062
2063         MEM_WRITE_1(sc, 0x200000, 0x00);
2064         MEM_WRITE_1(sc, 0x200000, 0x80);
2065
2066         /* wait until we get an answer */
2067         for (ntries = 0; ntries < 100; ntries++) {
2068                 if (MEM_READ_1(sc, 0x200000) & 1)
2069                         break;
2070                 DELAY(100);
2071         }
2072         if (ntries == 100) {
2073                 device_printf(sc->sc_dev,
2074                     "timeout waiting for ucode to initialize\n");
2075                 return EIO;
2076         }
2077
2078         /* read the answer or the firmware will not initialize properly */
2079         for (i = 0; i < 7; i++)
2080                 MEM_READ_4(sc, 0x200004);
2081
2082         MEM_WRITE_1(sc, 0x200000, 0x00);
2083
2084         return 0;
2085 }
2086
2087 static int
2088 iwi_alloc_firmware(struct iwi_softc *sc, enum ieee80211_opmode opmode)
2089 {
2090         struct {
2091                 const char *suffix;
2092                 enum ieee80211_opmode opmode;
2093         } fw_arr[] = {
2094                 { "bss", IEEE80211_M_STA },
2095                 { "ibss", IEEE80211_M_IBSS},
2096                 { "sniffer", IEEE80211_M_MONITOR},
2097                 { NULL, 0 }
2098         };
2099         struct ifnet *ifp = &sc->sc_ic.ic_if;
2100         struct iwi_firmware_hdr *hdr;
2101         struct iwi_firmware *fw = &sc->fw;
2102         struct fw_image *image;
2103         char filename[128];
2104         int i, error, length_sum;
2105
2106         for (i = 0; fw_arr[i].suffix != NULL; ++i) {
2107                 if (fw_arr[i].opmode == opmode)
2108                         break;
2109         }
2110
2111         KASSERT(fw_arr[i].suffix != NULL, ("unsupported opmode %u\n", opmode));
2112
2113         ksnprintf(filename, sizeof(filename), IWI_FW_PATH, fw_arr[i].suffix);
2114
2115         /*
2116          * Release the serializer to avoid possible dead lock
2117          */
2118         lwkt_serialize_exit(ifp->if_serializer);
2119         image = firmware_image_load(filename, NULL);
2120         lwkt_serialize_enter(ifp->if_serializer);
2121
2122         if (image == NULL)
2123                 return ENOENT;
2124         fw->fw_image = image;
2125
2126         /*
2127          * Verify the image
2128          */
2129         error = EINVAL;
2130
2131         if (fw->fw_image->fw_imglen < sizeof(struct iwi_firmware_hdr)) {
2132                 if_printf(ifp, "%s firmware too short", image->fw_name);
2133                 goto back;
2134         }
2135
2136         hdr = (struct iwi_firmware_hdr *)image->fw_image;
2137         if (hdr->vermaj != 3) {
2138                 if_printf(ifp, "%s unsupported firmware version %d.%d\n",
2139                         image->fw_name, hdr->vermaj, hdr->vermin);
2140                 goto back;
2141         }
2142
2143         length_sum = le32toh(hdr->bsize) + le32toh(hdr->usize) + le32toh(hdr->fsize);
2144         if (length_sum + sizeof(*hdr) != image->fw_imglen) {
2145                 if_printf(ifp, "%s size mismatch, %u/hdr %u\n", image->fw_name,
2146                         fw->fw_image->fw_imglen, length_sum + sizeof(*hdr));
2147                 goto back;
2148         }
2149
2150         fw->boot = (uint8_t *)(hdr + 1);
2151         fw->boot_size = le32toh(hdr->bsize);
2152         fw->ucode = fw->boot + fw->boot_size;
2153         fw->ucode_size = le32toh(hdr->usize);
2154         fw->main = fw->ucode + fw->ucode_size;
2155         fw->main_size = le32toh(hdr->fsize);
2156
2157         error = 0;
2158
2159 back:
2160         if (error) {
2161                 firmware_image_unload(fw->fw_image);
2162                 bzero(fw, sizeof(*fw));
2163         }
2164         return error;
2165 }
2166
2167 static int
2168 iwi_free_firmware(struct iwi_softc *sc)
2169 {
2170         if (sc->fw.fw_image != NULL)
2171                 firmware_image_unload(sc->fw.fw_image);
2172         return 0;
2173 }
2174
2175 /* macro to handle unaligned little endian data in firmware image */
2176 #define GETLE32(p) ((p)[0] | (p)[1] << 8 | (p)[2] << 16 | (p)[3] << 24)
2177
2178 static int
2179 iwi_load_firmware(struct iwi_softc *sc, void *fw, int size)
2180 {
2181         bus_dma_tag_t dmat;
2182         bus_dmamap_t map;
2183         bus_addr_t physaddr;
2184         void *virtaddr;
2185         u_char *p, *end;
2186         uint32_t sentinel, ctl, src, dst, sum, len, mlen, tmp;
2187         int ntries, error = 0;
2188         struct ifnet *ifp = &sc->sc_ic.ic_if;
2189
2190         ASSERT_SERIALIZED(ifp->if_serializer);
2191
2192         /* Allocate DMA memory for mapping firmware image */
2193         error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
2194             BUS_SPACE_MAXADDR, NULL, NULL, size, 1, size, 0, &dmat);
2195         if (error != 0) {
2196                 device_printf(sc->sc_dev,
2197                     "could not create firmware DMA tag\n");
2198                 goto fail1;
2199         }
2200
2201         error = bus_dmamem_alloc(dmat, &virtaddr, BUS_DMA_WAITOK, &map);
2202         if (error != 0) {
2203                 device_printf(sc->sc_dev,
2204                     "could not allocate firmware DMA memory\n");
2205                 goto fail2;
2206         }
2207
2208         error = bus_dmamap_load(dmat, map, virtaddr, size, iwi_dma_map_addr,
2209             &physaddr, 0);
2210         if (error != 0) {
2211                 device_printf(sc->sc_dev, "could not load firmware DMA map\n");
2212                 goto fail3;
2213         }
2214
2215         /* Copy firmware image to DMA memory */
2216         memcpy(virtaddr, fw, size);
2217
2218         /* Make sure the adapter will get up-to-date values */
2219         bus_dmamap_sync(dmat, map, BUS_DMASYNC_PREWRITE);
2220
2221         /* Tell the adapter where the command blocks are stored */
2222         MEM_WRITE_4(sc, 0x3000a0, 0x27000);
2223
2224         /*
2225          * Store command blocks into adapter's internal memory using register
2226          * indirections. The adapter will read the firmware image through DMA
2227          * using information stored in command blocks.
2228          */
2229         src = physaddr;
2230         p = virtaddr;
2231         end = p + size;
2232         CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
2233
2234         while (p < end) {
2235                 dst = GETLE32(p); p += 4; src += 4;
2236                 len = GETLE32(p); p += 4; src += 4;
2237                 p += len;
2238
2239                 while (len > 0) {
2240                         mlen = min(len, IWI_CB_MAXDATALEN);
2241
2242                         ctl = IWI_CB_DEFAULT_CTL | mlen;
2243                         sum = ctl ^ src ^ dst;
2244
2245                         /* Write a command block */
2246                         CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, ctl);
2247                         CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, src);
2248                         CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, dst);
2249                         CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, sum);
2250
2251                         src += mlen;
2252                         dst += mlen;
2253                         len -= mlen;
2254                 }
2255         }
2256
2257         /* Write a fictive final command block (sentinel) */
2258         sentinel = CSR_READ_4(sc, IWI_CSR_AUTOINC_ADDR);
2259         CSR_WRITE_4(sc, IWI_CSR_AUTOINC_DATA, 0);
2260
2261         tmp = CSR_READ_4(sc, IWI_CSR_RST);
2262         tmp &= ~(IWI_RST_MASTER_DISABLED | IWI_RST_STOP_MASTER);
2263         CSR_WRITE_4(sc, IWI_CSR_RST, tmp);
2264
2265         /* Tell the adapter to start processing command blocks */
2266         MEM_WRITE_4(sc, 0x3000a4, 0x540100);
2267
2268         /* Wait until the adapter reaches the sentinel */
2269         for (ntries = 0; ntries < 400; ntries++) {
2270                 if (MEM_READ_4(sc, 0x3000d0) >= sentinel)
2271                         break;
2272                 DELAY(100);
2273         }
2274         if (ntries == 400) {
2275                 device_printf(sc->sc_dev,
2276                     "timeout processing command blocks\n");
2277                 error = EIO;
2278                 goto fail4;
2279         }
2280
2281         /* We're done with command blocks processing */
2282         MEM_WRITE_4(sc, 0x3000a4, 0x540c00);
2283
2284         /* Allow interrupts so we know when the firmware is ready */
2285         CSR_WRITE_4(sc, IWI_CSR_INTR_MASK, IWI_INTR_MASK);
2286
2287         /* Tell the adapter to initialize the firmware */
2288         CSR_WRITE_4(sc, IWI_CSR_RST, 0);
2289
2290         tmp = CSR_READ_4(sc, IWI_CSR_CTL);
2291         CSR_WRITE_4(sc, IWI_CSR_CTL, tmp | IWI_CTL_ALLOW_STANDBY);
2292
2293         /* wait at most one second for firmware initialization to complete */
2294         crit_enter();
2295         tsleep_interlock(IWI_FW_INITIALIZED(sc));
2296         lwkt_serialize_exit(ifp->if_serializer);
2297         error = tsleep(IWI_FW_INITIALIZED(sc), PINTERLOCKED, "iwiinit", hz);
2298         crit_exit();
2299         lwkt_serialize_enter(ifp->if_serializer);
2300         if (error != 0) {
2301                 device_printf(sc->sc_dev, "timeout waiting for firmware "
2302                     "initialization to complete\n");
2303                 goto fail4;
2304         }
2305
2306 fail4:  bus_dmamap_sync(dmat, map, BUS_DMASYNC_POSTWRITE);
2307         bus_dmamap_unload(dmat, map);
2308 fail3:  bus_dmamem_free(dmat, virtaddr, map);
2309 fail2:  bus_dma_tag_destroy(dmat);
2310 fail1:
2311         return error;
2312 }
2313
2314 static int
2315 iwi_config(struct iwi_softc *sc)
2316 {
2317         struct ieee80211com *ic = &sc->sc_ic;
2318         struct ifnet *ifp = ic->ic_ifp;
2319         struct iwi_configuration config;
2320         struct iwi_rateset rs;
2321         struct iwi_txpower power;
2322         struct ieee80211_key *wk;
2323         struct iwi_wep_key wepkey;
2324         uint32_t data;
2325         int error, i;
2326
2327         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2328         DPRINTF(("Setting MAC address to %6D\n", ic->ic_myaddr, ":"));
2329         error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_myaddr,
2330             IEEE80211_ADDR_LEN, 0);
2331         if (error != 0)
2332                 return error;
2333
2334         memset(&config, 0, sizeof config);
2335         config.bluetooth_coexistence = sc->bluetooth;
2336         config.antenna = sc->antenna;
2337         config.multicast_enabled = 1;
2338         config.answer_pbreq = (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2339         config.disable_unicast_decryption = 1;
2340         config.disable_multicast_decryption = 1;
2341         DPRINTF(("Configuring adapter\n"));
2342         error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config, 0);
2343         if (error != 0)
2344                 return error;
2345
2346         data = htole32(IWI_POWER_MODE_CAM);
2347         DPRINTF(("Setting power mode to %u\n", le32toh(data)));
2348         error = iwi_cmd(sc, IWI_CMD_SET_POWER_MODE, &data, sizeof data, 0);
2349         if (error != 0)
2350                 return error;
2351
2352         data = htole32(ic->ic_rtsthreshold);
2353         DPRINTF(("Setting RTS threshold to %u\n", le32toh(data)));
2354         error = iwi_cmd(sc, IWI_CMD_SET_RTS_THRESHOLD, &data, sizeof data, 0);
2355         if (error != 0)
2356                 return error;
2357
2358         data = htole32(ic->ic_fragthreshold);
2359         DPRINTF(("Setting fragmentation threshold to %u\n", le32toh(data)));
2360         error = iwi_cmd(sc, IWI_CMD_SET_FRAG_THRESHOLD, &data, sizeof data, 0);
2361         if (error != 0)
2362                 return error;
2363
2364         if (ic->ic_opmode == IEEE80211_M_IBSS) {
2365                 power.mode = IWI_MODE_11B;
2366                 power.nchan = 11;
2367                 for (i = 0; i < 11; i++) {
2368                         power.chan[i].chan = i + 1;
2369                         power.chan[i].power = IWI_TXPOWER_MAX;
2370                 }
2371                 DPRINTF(("Setting .11b channels tx power\n"));
2372                 error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2373                     0);
2374                 if (error != 0)
2375                         return error;
2376
2377                 power.mode = IWI_MODE_11G;
2378                 DPRINTF(("Setting .11g channels tx power\n"));
2379                 error = iwi_cmd(sc, IWI_CMD_SET_TX_POWER, &power, sizeof power,
2380                     0);
2381                 if (error != 0)
2382                         return error;
2383         }
2384
2385         rs.mode = IWI_MODE_11G;
2386         rs.type = IWI_RATESET_TYPE_SUPPORTED;
2387         rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11G].rs_nrates;
2388         memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates,
2389             rs.nrates);
2390         DPRINTF(("Setting .11bg supported rates (%u)\n", rs.nrates));
2391         error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2392         if (error != 0)
2393                 return error;
2394
2395         rs.mode = IWI_MODE_11A;
2396         rs.type = IWI_RATESET_TYPE_SUPPORTED;
2397         rs.nrates = ic->ic_sup_rates[IEEE80211_MODE_11A].rs_nrates;
2398         memcpy(rs.rates, ic->ic_sup_rates[IEEE80211_MODE_11A].rs_rates,
2399             rs.nrates);
2400         DPRINTF(("Setting .11a supported rates (%u)\n", rs.nrates));
2401         error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 0);
2402         if (error != 0)
2403                 return error;
2404
2405         /* if we have a desired ESSID, set it now */
2406         if (ic->ic_des_esslen != 0) {
2407 #ifdef IWI_DEBUG
2408                 if (iwi_debug > 0) {
2409                         kprintf("Setting desired ESSID to ");
2410                         ieee80211_print_essid(ic->ic_des_essid,
2411                             ic->ic_des_esslen);
2412                         kprintf("\n");
2413                 }
2414 #endif
2415                 error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ic->ic_des_essid,
2416                     ic->ic_des_esslen, 0);
2417                 if (error != 0)
2418                         return error;
2419         }
2420
2421         data = htole32(karc4random());
2422         DPRINTF(("Setting initialization vector to %u\n", le32toh(data)));
2423         error = iwi_cmd(sc, IWI_CMD_SET_IV, &data, sizeof data, 0);
2424         if (error != 0)
2425                 return error;
2426
2427         for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2428                 wk = &ic->ic_crypto.cs_nw_keys[i];
2429
2430                 wepkey.cmd = IWI_WEP_KEY_CMD_SETKEY;
2431                 wepkey.idx = i;
2432                 wepkey.len = wk->wk_keylen;
2433                 memset(wepkey.key, 0, sizeof wepkey.key);
2434                 memcpy(wepkey.key, wk->wk_key, wk->wk_keylen);
2435                 DPRINTF(("Setting wep key index %u len %u\n", wepkey.idx,
2436                     wepkey.len));
2437                 error = iwi_cmd(sc, IWI_CMD_SET_WEP_KEY, &wepkey,
2438                     sizeof wepkey, 0);
2439                 if (error != 0)
2440                         return error;
2441         }
2442
2443         /* Enable adapter */
2444         DPRINTF(("Enabling adapter\n"));
2445         return iwi_cmd(sc, IWI_CMD_ENABLE, NULL, 0, 0);
2446 }
2447
2448 static int
2449 iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
2450 {
2451         struct ieee80211com *ic = &sc->sc_ic;
2452         struct iwi_scan scan;
2453
2454         memset(&scan, 0, sizeof scan);
2455         memset(scan.type, IWI_SCAN_TYPE_PASSIVE, sizeof scan.type);
2456         scan.passive = htole16(2000);
2457         scan.channels[0] = 1 |
2458             (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
2459         scan.channels[1] = ieee80211_chan2ieee(ic, chan);
2460
2461         DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
2462         return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2463 }
2464
2465 static int
2466 iwi_scan(struct iwi_softc *sc)
2467 {
2468         struct ieee80211com *ic = &sc->sc_ic;
2469         struct iwi_scan scan;
2470         uint8_t *p;
2471         int i, count;
2472
2473         memset(&scan, 0, sizeof scan);
2474
2475         if (ic->ic_des_esslen != 0) {
2476                 scan.bdirected = htole16(sc->dwelltime);
2477                 memset(scan.type, IWI_SCAN_TYPE_BDIRECTED, sizeof scan.type);
2478         } else {
2479                 scan.broadcast = htole16(sc->dwelltime);
2480                 memset(scan.type, IWI_SCAN_TYPE_BROADCAST, sizeof scan.type);
2481         }
2482
2483         p = scan.channels;
2484         count = 0;
2485         for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2486                 if (IEEE80211_IS_CHAN_5GHZ(&ic->ic_channels[i]) &&
2487                     isset(ic->ic_chan_active, i)) {
2488                         *++p = i;
2489                         count++;
2490                 }
2491         }
2492         *(p - count) = IWI_CHAN_5GHZ | count;
2493
2494         p = (count > 0) ? p + 1 : scan.channels;
2495         count = 0;
2496         for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
2497                 if (IEEE80211_IS_CHAN_2GHZ(&ic->ic_channels[i]) &&
2498                     isset(ic->ic_chan_active, i)) {
2499                         *++p = i;
2500                         count++;
2501                 }
2502         }
2503         *(p - count) = IWI_CHAN_2GHZ | count;
2504
2505         DPRINTF(("Start scanning\n"));
2506         return iwi_cmd(sc, IWI_CMD_SCAN, &scan, sizeof scan, 1);
2507 }
2508
2509 static int
2510 iwi_auth_and_assoc(struct iwi_softc *sc)
2511 {
2512         struct ieee80211com *ic = &sc->sc_ic;
2513         struct ifnet *ifp = ic->ic_ifp;
2514         struct ieee80211_node *ni = ic->ic_bss;
2515         struct ieee80211_wme_info wme;
2516         struct iwi_configuration config;
2517         struct iwi_associate assoc;
2518         struct iwi_rateset rs;
2519         uint16_t capinfo;
2520         uint32_t data;
2521         int error;
2522
2523         if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
2524                 memset(&config, 0, sizeof config);
2525                 config.bluetooth_coexistence = sc->bluetooth;
2526                 config.antenna = sc->antenna;
2527                 config.multicast_enabled = 1;
2528                 config.use_protection = 1;
2529                 config.answer_pbreq =
2530                     (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
2531                 config.disable_unicast_decryption = 1;
2532                 config.disable_multicast_decryption = 1;
2533                 DPRINTF(("Configuring adapter\n"));
2534                 error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config,
2535                     1);
2536                 if (error != 0)
2537                         return error;
2538         }
2539
2540 #ifdef IWI_DEBUG
2541         if (iwi_debug > 0) {
2542                 kprintf("Setting ESSID to ");
2543                 ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
2544                 kprintf("\n");
2545         }
2546 #endif
2547         error = iwi_cmd(sc, IWI_CMD_SET_ESSID, ni->ni_essid, ni->ni_esslen, 1);
2548         if (error != 0)
2549                 return error;
2550
2551         /* the rate set has already been "negotiated" */
2552         rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2553             IWI_MODE_11G;
2554         rs.type = IWI_RATESET_TYPE_NEGOTIATED;
2555         rs.nrates = ni->ni_rates.rs_nrates;
2556         KKASSERT(rs.nrates <= IWI_RATESET_MAXSIZE);
2557         memcpy(rs.rates, ni->ni_rates.rs_rates, rs.nrates);
2558         DPRINTF(("Setting negociated rates (%u)\n", rs.nrates));
2559         error = iwi_cmd(sc, IWI_CMD_SET_RATES, &rs, sizeof rs, 1);
2560         if (error != 0)
2561                 return error;
2562
2563         if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL) {
2564                 wme.wme_id = IEEE80211_ELEMID_VENDOR;
2565                 wme.wme_len = sizeof (struct ieee80211_wme_info) - 2;
2566                 wme.wme_oui[0] = 0x00;
2567                 wme.wme_oui[1] = 0x50;
2568                 wme.wme_oui[2] = 0xf2;
2569                 wme.wme_type = WME_OUI_TYPE;
2570                 wme.wme_subtype = WME_INFO_OUI_SUBTYPE;
2571                 wme.wme_version = WME_VERSION;
2572                 wme.wme_info = 0;
2573
2574                 DPRINTF(("Setting WME IE (len=%u)\n", wme.wme_len));
2575                 error = iwi_cmd(sc, IWI_CMD_SET_WMEIE, &wme, sizeof wme, 1);
2576                 if (error != 0)
2577                         return error;
2578         }
2579
2580         if (ic->ic_opt_ie != NULL) {
2581                 DPRINTF(("Setting optional IE (len=%u)\n", ic->ic_opt_ie_len));
2582                 error = iwi_cmd(sc, IWI_CMD_SET_OPTIE, ic->ic_opt_ie,
2583                     ic->ic_opt_ie_len, 1);
2584                 if (error != 0)
2585                         return error;
2586         }
2587
2588         data = htole32(ni->ni_rssi);
2589         DPRINTF(("Setting sensitivity to %d\n", (int8_t)ni->ni_rssi));
2590         error = iwi_cmd(sc, IWI_CMD_SET_SENSITIVITY, &data, sizeof data, 1);
2591         if (error != 0)
2592                 return error;
2593
2594         memset(&assoc, 0, sizeof assoc);
2595         assoc.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
2596             IWI_MODE_11G;
2597         assoc.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
2598         if (ni->ni_authmode == IEEE80211_AUTH_SHARED)
2599                 assoc.auth = ic->ic_crypto.cs_def_txkey << 4 | IWI_AUTH_SHARED;
2600         if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
2601                 assoc.policy |= htole16(IWI_POLICY_WME);
2602         if (ic->ic_flags & IEEE80211_F_WPA)
2603                 assoc.policy |= htole16(IWI_POLICY_WPA);
2604         memcpy(assoc.tstamp, ni->ni_tstamp.data, 8);
2605
2606         if (ic->ic_opmode == IEEE80211_M_IBSS)
2607                 capinfo = IEEE80211_CAPINFO_IBSS;
2608         else
2609                 capinfo = IEEE80211_CAPINFO_ESS;
2610         if (ic->ic_flags & IEEE80211_F_PRIVACY)
2611                 capinfo |= IEEE80211_CAPINFO_PRIVACY;
2612         if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2613             IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2614                 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2615         if (ic->ic_flags & IEEE80211_F_SHSLOT)
2616                 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2617         assoc.capinfo = htole16(capinfo);
2618
2619         assoc.lintval = htole16(ic->ic_lintval);
2620         assoc.intval = htole16(ni->ni_intval);
2621         IEEE80211_ADDR_COPY(assoc.bssid, ni->ni_bssid);
2622         if (ic->ic_opmode == IEEE80211_M_IBSS)
2623                 IEEE80211_ADDR_COPY(assoc.dst, ifp->if_broadcastaddr);
2624         else
2625                 IEEE80211_ADDR_COPY(assoc.dst, ni->ni_bssid);
2626
2627         DPRINTF(("Trying to associate to %6D channel %u auth %u\n",
2628             assoc.bssid, ":", assoc.chan, assoc.auth));
2629         return iwi_cmd(sc, IWI_CMD_ASSOCIATE, &assoc, sizeof assoc, 1);
2630 }
2631
2632 static void
2633 iwi_init(void *priv)
2634 {
2635         struct iwi_softc *sc = priv;
2636         struct ieee80211com *ic = &sc->sc_ic;
2637         struct ifnet *ifp = ic->ic_ifp;
2638         struct iwi_firmware *fw = &sc->fw;
2639         struct iwi_rx_data *data;
2640         int i;
2641
2642         iwi_stop(sc);
2643
2644         if (iwi_reset(sc) != 0) {
2645                 device_printf(sc->sc_dev, "could not reset adapter\n");
2646                 goto fail;
2647         }
2648
2649         if (iwi_alloc_firmware(sc, ic->ic_opmode) != 0) {
2650                 device_printf(sc->sc_dev, "could not allocate firmware\n");
2651                 goto fail;
2652         }
2653
2654         if (iwi_load_firmware(sc, fw->boot, fw->boot_size) != 0) {
2655                 device_printf(sc->sc_dev, "could not load boot firmware\n");
2656                 goto fail;
2657         }
2658
2659         if (iwi_load_ucode(sc, fw->ucode, fw->ucode_size) != 0) {
2660                 device_printf(sc->sc_dev, "could not load microcode\n");
2661                 goto fail;
2662         }
2663
2664         iwi_stop_master(sc);
2665
2666         CSR_WRITE_4(sc, IWI_CSR_CMD_BASE, sc->cmdq.physaddr);
2667         CSR_WRITE_4(sc, IWI_CSR_CMD_SIZE, sc->cmdq.count);
2668         CSR_WRITE_4(sc, IWI_CSR_CMD_WIDX, sc->cmdq.cur);
2669
2670         CSR_WRITE_4(sc, IWI_CSR_TX1_BASE, sc->txq[0].physaddr);
2671         CSR_WRITE_4(sc, IWI_CSR_TX1_SIZE, sc->txq[0].count);
2672         CSR_WRITE_4(sc, IWI_CSR_TX1_WIDX, sc->txq[0].cur);
2673
2674         CSR_WRITE_4(sc, IWI_CSR_TX2_BASE, sc->txq[1].physaddr);
2675         CSR_WRITE_4(sc, IWI_CSR_TX2_SIZE, sc->txq[1].count);
2676         CSR_WRITE_4(sc, IWI_CSR_TX2_WIDX, sc->txq[1].cur);
2677
2678         CSR_WRITE_4(sc, IWI_CSR_TX3_BASE, sc->txq[2].physaddr);
2679         CSR_WRITE_4(sc, IWI_CSR_TX3_SIZE, sc->txq[2].count);
2680         CSR_WRITE_4(sc, IWI_CSR_TX3_WIDX, sc->txq[2].cur);
2681
2682         CSR_WRITE_4(sc, IWI_CSR_TX4_BASE, sc->txq[3].physaddr);
2683         CSR_WRITE_4(sc, IWI_CSR_TX4_SIZE, sc->txq[3].count);
2684         CSR_WRITE_4(sc, IWI_CSR_TX4_WIDX, sc->txq[3].cur);
2685
2686         for (i = 0; i < sc->rxq.count; i++) {
2687                 data = &sc->rxq.data[i];
2688                 CSR_WRITE_4(sc, data->reg, data->physaddr);
2689         }
2690
2691         CSR_WRITE_4(sc, IWI_CSR_RX_WIDX, sc->rxq.count - 1);
2692
2693         if (iwi_load_firmware(sc, fw->main, fw->main_size) != 0) {
2694                 device_printf(sc->sc_dev, "could not load main firmware\n");
2695                 goto fail;
2696         }
2697
2698         sc->flags |= IWI_FLAG_FW_INITED;
2699
2700         if (iwi_config(sc) != 0) {
2701                 device_printf(sc->sc_dev, "device configuration failed\n");
2702                 goto fail;
2703         }
2704
2705         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2706                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2707                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2708         } else
2709                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2710
2711         ifp->if_flags &= ~IFF_OACTIVE;
2712         ifp->if_flags |= IFF_RUNNING;
2713
2714         return;
2715
2716 fail:   ifp->if_flags &= ~IFF_UP;
2717         iwi_stop(sc);
2718 }
2719
2720 static void
2721 iwi_stop(void *priv)
2722 {
2723         struct iwi_softc *sc = priv;
2724         struct ieee80211com *ic = &sc->sc_ic;
2725         struct ifnet *ifp = ic->ic_ifp;
2726
2727         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2728
2729         iwi_stop_master(sc);
2730
2731         CSR_WRITE_4(sc, IWI_CSR_RST, IWI_RST_SOFT_RESET);
2732
2733         /* reset rings */
2734         iwi_reset_cmd_ring(sc, &sc->cmdq);
2735         iwi_reset_tx_ring(sc, &sc->txq[0]);
2736         iwi_reset_tx_ring(sc, &sc->txq[1]);
2737         iwi_reset_tx_ring(sc, &sc->txq[2]);
2738         iwi_reset_tx_ring(sc, &sc->txq[3]);
2739         iwi_reset_rx_ring(sc, &sc->rxq);
2740
2741         sc->sc_tx_timer = 0;
2742         ifp->if_timer = 0;
2743         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2744 }
2745
2746 static int
2747 iwi_sysctl_stats(SYSCTL_HANDLER_ARGS)
2748 {
2749         struct iwi_softc *sc = arg1;
2750         struct ifnet *ifp = &sc->sc_ic.ic_if;
2751         uint32_t size, buf[128];
2752
2753         lwkt_serialize_enter(ifp->if_serializer);
2754
2755         if (!(sc->flags & IWI_FLAG_FW_INITED)) {
2756                 memset(buf, 0, sizeof buf);
2757                 goto back;
2758         }
2759
2760         size = min(CSR_READ_4(sc, IWI_CSR_TABLE0_SIZE), 128 - 1);
2761         CSR_READ_REGION_4(sc, IWI_CSR_TABLE0_BASE, &buf[1], size);
2762 back:
2763         lwkt_serialize_exit(ifp->if_serializer);
2764         return SYSCTL_OUT(req, buf, sizeof buf);
2765 }
2766
2767 static int
2768 iwi_sysctl_radio(SYSCTL_HANDLER_ARGS)
2769 {
2770         struct iwi_softc *sc = arg1;
2771         struct ifnet *ifp = &sc->sc_ic.ic_if;
2772         int val;
2773
2774         lwkt_serialize_enter(ifp->if_serializer);
2775         val = (CSR_READ_4(sc, IWI_CSR_IO) & IWI_IO_RADIO_ENABLED) ? 1 : 0;
2776         lwkt_serialize_exit(ifp->if_serializer);
2777
2778         return SYSCTL_OUT(req, &val, sizeof val);
2779 }
2780
2781 static const int8_t     iwi_bitmap[256] = {
2782         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2783         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 5,
2784         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2785         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 6,
2786         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2787         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 5,
2788         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2789         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 7,
2790         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2791         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 5,
2792         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2793         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 6,
2794         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2795         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 5,
2796         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 4,
2797         0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, -1
2798 };
2799
2800 static int
2801 iwi_alloc_ibss_node(struct iwi_softc *sc)
2802 {
2803         int i;
2804
2805         ASSERT_SERIALIZED(sc->sc_ic.ic_if.if_serializer);
2806
2807         for (i = 0; i < IWI_MAX_IBSSNODE_NBYTE; ++i) {
2808                 int ret;
2809
2810                 ret = iwi_bitmap[sc->sc_ibss_node[i]];
2811                 if (ret != -1) {
2812                         sc->sc_ibss_node[i] |= (1 << ret);
2813                         ret += (i * NBBY);
2814                         return ret;
2815                 }
2816         }
2817         return -1;
2818 }
2819
2820 static void
2821 iwi_free_ibss_node(struct iwi_softc *sc, int ibss_node)
2822 {
2823         int i, b;
2824
2825         ASSERT_SERIALIZED(sc->sc_ic.ic_if.if_serializer);
2826         KASSERT(ibss_node < IWI_MAX_IBSSNODE, ("free ibss node, out of range"));
2827
2828         i = ibss_node / NBBY;
2829         b = ibss_node % NBBY;
2830
2831         sc->sc_ibss_node[i] &= ~(1 << b);
2832 }