o Use firmware extended scan command; this one doesn't crash when scanning

the 5GHz band.
o Enable 802.11a channels scanning for 2915ABG adapters.
o Fix a typo (negociated->negotiated).

With hints from NetBSD.

MFC after:	2 days

sys/dev/iwi/if_iwi.c

@@ -359,7 +359,6 @@ iwi_attach(device_t dev)
 	ic->ic_myaddr[4] = val >> 8;
 	ic->ic_myaddr[5] = val & 0xff;
 
-#if 0
 	if (pci_get_device(dev) >= 0x4223) {
 		/* set supported .11a rates (2915ABG only) */
 		ic->ic_sup_rates[IEEE80211_MODE_11A] = iwi_rateset_11a;
@@ -376,7 +375,6 @@ iwi_attach(device_t dev)
 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 		}
 	}
-#endif
 
 	/* set supported .11b and .11g rates */
 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwi_rateset_11b;
@@ -2278,10 +2276,10 @@ iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
 	struct iwi_scan scan;
 
 	memset(&scan, 0, sizeof scan);
-	scan.type = IWI_SCAN_TYPE_PASSIVE;
+	memset(scan.type, 26, IWI_SCAN_TYPE_PASSIVE);
-	scan.dwelltime = htole16(2000);
+	scan.passive = htole16(2000);
-	scan.channels[0] = 1 | (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ :
+	scan.channels[0] = 1 |
-	    IWI_CHAN_2GHZ);
+	    (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
 	scan.channels[1] = ieee80211_chan2ieee(ic, chan);
 
 	DPRINTF(("Setting channel to %u\n", ieee80211_chan2ieee(ic, chan)));
@@ -2297,9 +2295,14 @@ iwi_scan(struct iwi_softc *sc)
 	int i, count;
 
 	memset(&scan, 0, sizeof scan);
-	scan.type = (ic->ic_des_esslen != 0) ? IWI_SCAN_TYPE_BDIRECTED :
+
-	    IWI_SCAN_TYPE_BROADCAST;
+	if (ic->ic_des_esslen != 0) {
-	scan.dwelltime = htole16(sc->dwelltime);
+		scan.bdirected = htole16(sc->dwelltime);
+		memset(scan.type, 26, IWI_SCAN_TYPE_BDIRECTED);
+	} else {
+		scan.broadcast = htole16(sc->dwelltime);
+		memset(scan.type, 26, IWI_SCAN_TYPE_BROADCAST);
+	}
 
 	p = scan.channels;
 	count = 0;
@@ -2368,10 +2371,10 @@ iwi_auth_and_assoc(struct iwi_softc *sc)
 	if (error != 0)
 		return error;
 
-	/* the rate set has already been "negociated" */
+	/* the rate set has already been "negotiated" */
 	rs.mode = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? IWI_MODE_11A :
 	    IWI_MODE_11G;
-	rs.type = IWI_RATESET_TYPE_NEGOCIATED;
+	rs.type = IWI_RATESET_TYPE_NEGOTIATED;
 	rs.nrates = ni->ni_rates.rs_nrates;
 	memcpy(rs.rates, ni->ni_rates.rs_rates, rs.nrates);
 	DPRINTF(("Setting negociated rates (%u)\n", rs.nrates));

sys/dev/iwi/if_iwireg.h

@@ -253,11 +253,11 @@ struct iwi_cmd_desc {
 #define IWI_CMD_SET_FRAG_THRESHOLD		16
 #define IWI_CMD_SET_POWER_MODE			17
 #define IWI_CMD_SET_WEP_KEY			18
-#define IWI_CMD_SCAN				20
 #define IWI_CMD_ASSOCIATE			21
 #define IWI_CMD_SET_RATES			22
 #define IWI_CMD_ABORT_SCAN			23
 #define IWI_CMD_SET_WME_PARAMS			25
+#define IWI_CMD_SCAN				26
 #define IWI_CMD_SET_OPTIE			31
 #define IWI_CMD_DISABLE				33
 #define IWI_CMD_SET_IV				34
@@ -289,7 +289,7 @@ struct iwi_rateset {
 	uint8_t	mode;
 	uint8_t	nrates;
 	uint8_t	type;
-#define IWI_RATESET_TYPE_NEGOCIATED	0
+#define IWI_RATESET_TYPE_NEGOTIATED	0
 #define IWI_RATESET_TYPE_SUPPORTED	1
 
 	uint8_t	reserved;
@@ -336,18 +336,23 @@ struct iwi_associate {
 
 /* structure for command IWI_CMD_SCAN */
 struct iwi_scan {
-	uint8_t		type;
+	uint32_t	index;
-#define IWI_SCAN_TYPE_PASSIVE	1
-#define IWI_SCAN_TYPE_DIRECTED	2
-#define IWI_SCAN_TYPE_BROADCAST	3
-#define IWI_SCAN_TYPE_BDIRECTED	4
-
-	uint16_t	dwelltime;
 	uint8_t		channels[54];
 #define IWI_CHAN_5GHZ	(0 << 6)
 #define IWI_CHAN_2GHZ	(1 << 6)
 
-	uint8_t		reserved[3];
+	uint8_t		type[26];
+#define IWI_SCAN_TYPE_PASSIVE	0x11
+#define IWI_SCAN_TYPE_DIRECTED	0x22
+#define IWI_SCAN_TYPE_BROADCAST	0x33
+#define IWI_SCAN_TYPE_BDIRECTED	0x44
+
+	uint8_t		reserved1[2];
+	uint16_t	reserved2;
+	uint16_t	passive;	/* dwell time */
+	uint16_t	directed;	/* dwell time */
+	uint16_t	broadcast;	/* dwell time */
+	uint16_t	bdirected;	/* dwell time */
 } __packed;
 
 /* structure for command IWI_CMD_SET_CONFIG */