xref: /freebsd/sys/dev/iwm/if_iwm.c (revision c1eb4109f3b1d90a9c1538179ea6a52a191899b2)
1 /*	$OpenBSD: if_iwm.c,v 1.39 2015/03/23 00:35:19 jsg Exp $	*/
2 
3 /*
4  * Copyright (c) 2014 genua mbh <info@genua.de>
5  * Copyright (c) 2014 Fixup Software Ltd.
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*-
21  * Based on BSD-licensed source modules in the Linux iwlwifi driver,
22  * which were used as the reference documentation for this implementation.
23  *
24  * Driver version we are currently based off of is
25  * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd)
26  *
27  ***********************************************************************
28  *
29  * This file is provided under a dual BSD/GPLv2 license.  When using or
30  * redistributing this file, you may do so under either license.
31  *
32  * GPL LICENSE SUMMARY
33  *
34  * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
35  *
36  * This program is free software; you can redistribute it and/or modify
37  * it under the terms of version 2 of the GNU General Public License as
38  * published by the Free Software Foundation.
39  *
40  * This program is distributed in the hope that it will be useful, but
41  * WITHOUT ANY WARRANTY; without even the implied warranty of
42  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
43  * General Public License for more details.
44  *
45  * You should have received a copy of the GNU General Public License
46  * along with this program; if not, write to the Free Software
47  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
48  * USA
49  *
50  * The full GNU General Public License is included in this distribution
51  * in the file called COPYING.
52  *
53  * Contact Information:
54  *  Intel Linux Wireless <ilw@linux.intel.com>
55  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
56  *
57  *
58  * BSD LICENSE
59  *
60  * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
61  * All rights reserved.
62  *
63  * Redistribution and use in source and binary forms, with or without
64  * modification, are permitted provided that the following conditions
65  * are met:
66  *
67  *  * Redistributions of source code must retain the above copyright
68  *    notice, this list of conditions and the following disclaimer.
69  *  * Redistributions in binary form must reproduce the above copyright
70  *    notice, this list of conditions and the following disclaimer in
71  *    the documentation and/or other materials provided with the
72  *    distribution.
73  *  * Neither the name Intel Corporation nor the names of its
74  *    contributors may be used to endorse or promote products derived
75  *    from this software without specific prior written permission.
76  *
77  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
78  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
79  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
80  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
81  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
82  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
83  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
84  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
85  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
86  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
87  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
88  */
89 
90 /*-
91  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
92  *
93  * Permission to use, copy, modify, and distribute this software for any
94  * purpose with or without fee is hereby granted, provided that the above
95  * copyright notice and this permission notice appear in all copies.
96  *
97  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
98  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
99  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
100  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
101  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
102  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
103  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
104  */
105 #include <sys/cdefs.h>
106 __FBSDID("$FreeBSD$");
107 
108 #include <sys/param.h>
109 #include <sys/bus.h>
110 #include <sys/conf.h>
111 #include <sys/endian.h>
112 #include <sys/firmware.h>
113 #include <sys/kernel.h>
114 #include <sys/malloc.h>
115 #include <sys/mbuf.h>
116 #include <sys/mutex.h>
117 #include <sys/module.h>
118 #include <sys/proc.h>
119 #include <sys/rman.h>
120 #include <sys/socket.h>
121 #include <sys/sockio.h>
122 #include <sys/sysctl.h>
123 #include <sys/linker.h>
124 
125 #include <machine/bus.h>
126 #include <machine/endian.h>
127 #include <machine/resource.h>
128 
129 #include <dev/pci/pcivar.h>
130 #include <dev/pci/pcireg.h>
131 
132 #include <net/bpf.h>
133 
134 #include <net/if.h>
135 #include <net/if_var.h>
136 #include <net/if_arp.h>
137 #include <net/if_dl.h>
138 #include <net/if_media.h>
139 #include <net/if_types.h>
140 
141 #include <netinet/in.h>
142 #include <netinet/in_systm.h>
143 #include <netinet/if_ether.h>
144 #include <netinet/ip.h>
145 
146 #include <net80211/ieee80211_var.h>
147 #include <net80211/ieee80211_regdomain.h>
148 #include <net80211/ieee80211_ratectl.h>
149 #include <net80211/ieee80211_radiotap.h>
150 
151 #include <dev/iwm/if_iwmreg.h>
152 #include <dev/iwm/if_iwmvar.h>
153 #include <dev/iwm/if_iwm_debug.h>
154 #include <dev/iwm/if_iwm_util.h>
155 #include <dev/iwm/if_iwm_binding.h>
156 #include <dev/iwm/if_iwm_phy_db.h>
157 #include <dev/iwm/if_iwm_mac_ctxt.h>
158 #include <dev/iwm/if_iwm_phy_ctxt.h>
159 #include <dev/iwm/if_iwm_time_event.h>
160 #include <dev/iwm/if_iwm_power.h>
161 #include <dev/iwm/if_iwm_scan.h>
162 
163 #include <dev/iwm/if_iwm_pcie_trans.h>
164 
165 const uint8_t iwm_nvm_channels[] = {
166 	/* 2.4 GHz */
167 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
168 	/* 5 GHz */
169 	36, 40, 44 , 48, 52, 56, 60, 64,
170 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
171 	149, 153, 157, 161, 165
172 };
173 #define IWM_NUM_2GHZ_CHANNELS	14
174 
175 /*
176  * XXX For now, there's simply a fixed set of rate table entries
177  * that are populated.
178  */
179 const struct iwm_rate {
180 	uint8_t rate;
181 	uint8_t plcp;
182 } iwm_rates[] = {
183 	{   2,	IWM_RATE_1M_PLCP  },
184 	{   4,	IWM_RATE_2M_PLCP  },
185 	{  11,	IWM_RATE_5M_PLCP  },
186 	{  22,	IWM_RATE_11M_PLCP },
187 	{  12,	IWM_RATE_6M_PLCP  },
188 	{  18,	IWM_RATE_9M_PLCP  },
189 	{  24,	IWM_RATE_12M_PLCP },
190 	{  36,	IWM_RATE_18M_PLCP },
191 	{  48,	IWM_RATE_24M_PLCP },
192 	{  72,	IWM_RATE_36M_PLCP },
193 	{  96,	IWM_RATE_48M_PLCP },
194 	{ 108,	IWM_RATE_54M_PLCP },
195 };
196 #define IWM_RIDX_CCK	0
197 #define IWM_RIDX_OFDM	4
198 #define IWM_RIDX_MAX	(nitems(iwm_rates)-1)
199 #define IWM_RIDX_IS_CCK(_i_) ((_i_) < IWM_RIDX_OFDM)
200 #define IWM_RIDX_IS_OFDM(_i_) ((_i_) >= IWM_RIDX_OFDM)
201 
202 static int	iwm_store_cscheme(struct iwm_softc *, const uint8_t *, size_t);
203 static int	iwm_firmware_store_section(struct iwm_softc *,
204                                            enum iwm_ucode_type,
205                                            const uint8_t *, size_t);
206 static int	iwm_set_default_calib(struct iwm_softc *, const void *);
207 static void	iwm_fw_info_free(struct iwm_fw_info *);
208 static int	iwm_read_firmware(struct iwm_softc *, enum iwm_ucode_type);
209 static void	iwm_dma_map_addr(void *, bus_dma_segment_t *, int, int);
210 static int	iwm_dma_contig_alloc(bus_dma_tag_t, struct iwm_dma_info *,
211                                      bus_size_t, bus_size_t);
212 static void	iwm_dma_contig_free(struct iwm_dma_info *);
213 static int	iwm_alloc_fwmem(struct iwm_softc *);
214 static void	iwm_free_fwmem(struct iwm_softc *);
215 static int	iwm_alloc_sched(struct iwm_softc *);
216 static void	iwm_free_sched(struct iwm_softc *);
217 static int	iwm_alloc_kw(struct iwm_softc *);
218 static void	iwm_free_kw(struct iwm_softc *);
219 static int	iwm_alloc_ict(struct iwm_softc *);
220 static void	iwm_free_ict(struct iwm_softc *);
221 static int	iwm_alloc_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
222 static void	iwm_reset_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
223 static void	iwm_free_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
224 static int	iwm_alloc_tx_ring(struct iwm_softc *, struct iwm_tx_ring *,
225                                   int);
226 static void	iwm_reset_tx_ring(struct iwm_softc *, struct iwm_tx_ring *);
227 static void	iwm_free_tx_ring(struct iwm_softc *, struct iwm_tx_ring *);
228 static void	iwm_enable_interrupts(struct iwm_softc *);
229 static void	iwm_restore_interrupts(struct iwm_softc *);
230 static void	iwm_disable_interrupts(struct iwm_softc *);
231 static void	iwm_ict_reset(struct iwm_softc *);
232 static int	iwm_allow_mcast(struct ieee80211vap *, struct iwm_softc *);
233 static void	iwm_stop_device(struct iwm_softc *);
234 static void	iwm_mvm_nic_config(struct iwm_softc *);
235 static int	iwm_nic_rx_init(struct iwm_softc *);
236 static int	iwm_nic_tx_init(struct iwm_softc *);
237 static int	iwm_nic_init(struct iwm_softc *);
238 static void	iwm_enable_txq(struct iwm_softc *, int, int);
239 static int	iwm_post_alive(struct iwm_softc *);
240 static int	iwm_nvm_read_chunk(struct iwm_softc *, uint16_t, uint16_t,
241                                    uint16_t, uint8_t *, uint16_t *);
242 static int	iwm_nvm_read_section(struct iwm_softc *, uint16_t, uint8_t *,
243 				     uint16_t *);
244 static void	iwm_init_channel_map(struct iwm_softc *,
245                                      const uint16_t * const);
246 static int	iwm_parse_nvm_data(struct iwm_softc *, const uint16_t *,
247 			           const uint16_t *, const uint16_t *, uint8_t,
248 				   uint8_t);
249 struct iwm_nvm_section;
250 static int	iwm_parse_nvm_sections(struct iwm_softc *,
251                                        struct iwm_nvm_section *);
252 static int	iwm_nvm_init(struct iwm_softc *);
253 static int	iwm_firmware_load_chunk(struct iwm_softc *, uint32_t,
254                                         const uint8_t *, uint32_t);
255 static int	iwm_load_firmware(struct iwm_softc *, enum iwm_ucode_type);
256 static int	iwm_start_fw(struct iwm_softc *, enum iwm_ucode_type);
257 static int	iwm_fw_alive(struct iwm_softc *, uint32_t);
258 static int	iwm_send_tx_ant_cfg(struct iwm_softc *, uint8_t);
259 static int	iwm_send_phy_cfg_cmd(struct iwm_softc *);
260 static int	iwm_mvm_load_ucode_wait_alive(struct iwm_softc *,
261                                               enum iwm_ucode_type);
262 static int	iwm_run_init_mvm_ucode(struct iwm_softc *, int);
263 static int	iwm_rx_addbuf(struct iwm_softc *, int, int);
264 static int	iwm_mvm_calc_rssi(struct iwm_softc *, struct iwm_rx_phy_info *);
265 static int	iwm_mvm_get_signal_strength(struct iwm_softc *,
266 					    struct iwm_rx_phy_info *);
267 static void	iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *,
268                                       struct iwm_rx_packet *,
269                                       struct iwm_rx_data *);
270 static int	iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *);
271 static void	iwm_mvm_rx_rx_mpdu(struct iwm_softc *, struct iwm_rx_packet *,
272                                    struct iwm_rx_data *);
273 static void	iwm_mvm_rx_tx_cmd_single(struct iwm_softc *,
274                                          struct iwm_rx_packet *,
275 				         struct iwm_node *);
276 static void	iwm_mvm_rx_tx_cmd(struct iwm_softc *, struct iwm_rx_packet *,
277                                   struct iwm_rx_data *);
278 static void	iwm_cmd_done(struct iwm_softc *, struct iwm_rx_packet *);
279 #if 0
280 static void	iwm_update_sched(struct iwm_softc *, int, int, uint8_t,
281                                  uint16_t);
282 #endif
283 static const struct iwm_rate *
284 	iwm_tx_fill_cmd(struct iwm_softc *, struct iwm_node *,
285 			struct ieee80211_frame *, struct iwm_tx_cmd *);
286 static int	iwm_tx(struct iwm_softc *, struct mbuf *,
287                        struct ieee80211_node *, int);
288 static int	iwm_raw_xmit(struct ieee80211_node *, struct mbuf *,
289 			     const struct ieee80211_bpf_params *);
290 static void	iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *,
291 					     struct iwm_mvm_add_sta_cmd_v5 *);
292 static int	iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *,
293 					        struct iwm_mvm_add_sta_cmd_v6 *,
294                                                 int *);
295 static int	iwm_mvm_sta_send_to_fw(struct iwm_softc *, struct iwm_node *,
296                                        int);
297 static int	iwm_mvm_add_sta(struct iwm_softc *, struct iwm_node *);
298 static int	iwm_mvm_update_sta(struct iwm_softc *, struct iwm_node *);
299 static int	iwm_mvm_add_int_sta_common(struct iwm_softc *,
300                                            struct iwm_int_sta *,
301 				           const uint8_t *, uint16_t, uint16_t);
302 static int	iwm_mvm_add_aux_sta(struct iwm_softc *);
303 static int	iwm_mvm_update_quotas(struct iwm_softc *, struct iwm_node *);
304 static int	iwm_auth(struct ieee80211vap *, struct iwm_softc *);
305 static int	iwm_assoc(struct ieee80211vap *, struct iwm_softc *);
306 static int	iwm_release(struct iwm_softc *, struct iwm_node *);
307 static struct ieee80211_node *
308 		iwm_node_alloc(struct ieee80211vap *,
309 		               const uint8_t[IEEE80211_ADDR_LEN]);
310 static void	iwm_setrates(struct iwm_softc *, struct iwm_node *);
311 static int	iwm_media_change(struct ifnet *);
312 static int	iwm_newstate(struct ieee80211vap *, enum ieee80211_state, int);
313 static void	iwm_endscan_cb(void *, int);
314 static int	iwm_init_hw(struct iwm_softc *);
315 static void	iwm_init(struct iwm_softc *);
316 static void	iwm_start(struct iwm_softc *);
317 static void	iwm_stop(struct iwm_softc *);
318 static void	iwm_watchdog(void *);
319 static void	iwm_parent(struct ieee80211com *);
320 #ifdef IWM_DEBUG
321 static const char *
322 		iwm_desc_lookup(uint32_t);
323 static void	iwm_nic_error(struct iwm_softc *);
324 #endif
325 static void	iwm_notif_intr(struct iwm_softc *);
326 static void	iwm_intr(void *);
327 static int	iwm_attach(device_t);
328 static void	iwm_preinit(void *);
329 static int	iwm_detach_local(struct iwm_softc *sc, int);
330 static void	iwm_init_task(void *);
331 static void	iwm_radiotap_attach(struct iwm_softc *);
332 static struct ieee80211vap *
333 		iwm_vap_create(struct ieee80211com *,
334 		               const char [IFNAMSIZ], int,
335 		               enum ieee80211_opmode, int,
336 		               const uint8_t [IEEE80211_ADDR_LEN],
337 		               const uint8_t [IEEE80211_ADDR_LEN]);
338 static void	iwm_vap_delete(struct ieee80211vap *);
339 static void	iwm_scan_start(struct ieee80211com *);
340 static void	iwm_scan_end(struct ieee80211com *);
341 static void	iwm_update_mcast(struct ieee80211com *);
342 static void	iwm_set_channel(struct ieee80211com *);
343 static void	iwm_scan_curchan(struct ieee80211_scan_state *, unsigned long);
344 static void	iwm_scan_mindwell(struct ieee80211_scan_state *);
345 static int	iwm_detach(device_t);
346 
347 /*
348  * Firmware parser.
349  */
350 
351 static int
352 iwm_store_cscheme(struct iwm_softc *sc, const uint8_t *data, size_t dlen)
353 {
354 	const struct iwm_fw_cscheme_list *l = (const void *)data;
355 
356 	if (dlen < sizeof(*l) ||
357 	    dlen < sizeof(l->size) + l->size * sizeof(*l->cs))
358 		return EINVAL;
359 
360 	/* we don't actually store anything for now, always use s/w crypto */
361 
362 	return 0;
363 }
364 
365 static int
366 iwm_firmware_store_section(struct iwm_softc *sc,
367     enum iwm_ucode_type type, const uint8_t *data, size_t dlen)
368 {
369 	struct iwm_fw_sects *fws;
370 	struct iwm_fw_onesect *fwone;
371 
372 	if (type >= IWM_UCODE_TYPE_MAX)
373 		return EINVAL;
374 	if (dlen < sizeof(uint32_t))
375 		return EINVAL;
376 
377 	fws = &sc->sc_fw.fw_sects[type];
378 	if (fws->fw_count >= IWM_UCODE_SECT_MAX)
379 		return EINVAL;
380 
381 	fwone = &fws->fw_sect[fws->fw_count];
382 
383 	/* first 32bit are device load offset */
384 	memcpy(&fwone->fws_devoff, data, sizeof(uint32_t));
385 
386 	/* rest is data */
387 	fwone->fws_data = data + sizeof(uint32_t);
388 	fwone->fws_len = dlen - sizeof(uint32_t);
389 
390 	fws->fw_count++;
391 	fws->fw_totlen += fwone->fws_len;
392 
393 	return 0;
394 }
395 
396 /* iwlwifi: iwl-drv.c */
397 struct iwm_tlv_calib_data {
398 	uint32_t ucode_type;
399 	struct iwm_tlv_calib_ctrl calib;
400 } __packed;
401 
402 static int
403 iwm_set_default_calib(struct iwm_softc *sc, const void *data)
404 {
405 	const struct iwm_tlv_calib_data *def_calib = data;
406 	uint32_t ucode_type = le32toh(def_calib->ucode_type);
407 
408 	if (ucode_type >= IWM_UCODE_TYPE_MAX) {
409 		device_printf(sc->sc_dev,
410 		    "Wrong ucode_type %u for default "
411 		    "calibration.\n", ucode_type);
412 		return EINVAL;
413 	}
414 
415 	sc->sc_default_calib[ucode_type].flow_trigger =
416 	    def_calib->calib.flow_trigger;
417 	sc->sc_default_calib[ucode_type].event_trigger =
418 	    def_calib->calib.event_trigger;
419 
420 	return 0;
421 }
422 
423 static void
424 iwm_fw_info_free(struct iwm_fw_info *fw)
425 {
426 	firmware_put(fw->fw_rawdata, FIRMWARE_UNLOAD);
427 	fw->fw_rawdata = NULL;
428 	fw->fw_rawsize = 0;
429 	/* don't touch fw->fw_status */
430 	memset(fw->fw_sects, 0, sizeof(fw->fw_sects));
431 }
432 
433 static int
434 iwm_read_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type)
435 {
436 	struct iwm_fw_info *fw = &sc->sc_fw;
437 	const struct iwm_tlv_ucode_header *uhdr;
438 	struct iwm_ucode_tlv tlv;
439 	enum iwm_ucode_tlv_type tlv_type;
440 	const struct firmware *fwp;
441 	const uint8_t *data;
442 	int error = 0;
443 	size_t len;
444 
445 	if (fw->fw_status == IWM_FW_STATUS_DONE &&
446 	    ucode_type != IWM_UCODE_TYPE_INIT)
447 		return 0;
448 
449 	while (fw->fw_status == IWM_FW_STATUS_INPROGRESS)
450 		msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfwp", 0);
451 	fw->fw_status = IWM_FW_STATUS_INPROGRESS;
452 
453 	if (fw->fw_rawdata != NULL)
454 		iwm_fw_info_free(fw);
455 
456 	/*
457 	 * Load firmware into driver memory.
458 	 * fw_rawdata and fw_rawsize will be set.
459 	 */
460 	IWM_UNLOCK(sc);
461 	fwp = firmware_get(sc->sc_fwname);
462 	if (fwp == NULL) {
463 		device_printf(sc->sc_dev,
464 		    "could not read firmware %s (error %d)\n",
465 		    sc->sc_fwname, error);
466 		IWM_LOCK(sc);
467 		goto out;
468 	}
469 	IWM_LOCK(sc);
470 	fw->fw_rawdata = fwp->data;
471 	fw->fw_rawsize = fwp->datasize;
472 
473 	/*
474 	 * Parse firmware contents
475 	 */
476 
477 	uhdr = (const void *)fw->fw_rawdata;
478 	if (*(const uint32_t *)fw->fw_rawdata != 0
479 	    || le32toh(uhdr->magic) != IWM_TLV_UCODE_MAGIC) {
480 		device_printf(sc->sc_dev, "invalid firmware %s\n",
481 		    sc->sc_fwname);
482 		error = EINVAL;
483 		goto out;
484 	}
485 
486 	sc->sc_fwver = le32toh(uhdr->ver);
487 	data = uhdr->data;
488 	len = fw->fw_rawsize - sizeof(*uhdr);
489 
490 	while (len >= sizeof(tlv)) {
491 		size_t tlv_len;
492 		const void *tlv_data;
493 
494 		memcpy(&tlv, data, sizeof(tlv));
495 		tlv_len = le32toh(tlv.length);
496 		tlv_type = le32toh(tlv.type);
497 
498 		len -= sizeof(tlv);
499 		data += sizeof(tlv);
500 		tlv_data = data;
501 
502 		if (len < tlv_len) {
503 			device_printf(sc->sc_dev,
504 			    "firmware too short: %zu bytes\n",
505 			    len);
506 			error = EINVAL;
507 			goto parse_out;
508 		}
509 
510 		switch ((int)tlv_type) {
511 		case IWM_UCODE_TLV_PROBE_MAX_LEN:
512 			if (tlv_len < sizeof(uint32_t)) {
513 				device_printf(sc->sc_dev,
514 				    "%s: PROBE_MAX_LEN (%d) < sizeof(uint32_t)\n",
515 				    __func__,
516 				    (int) tlv_len);
517 				error = EINVAL;
518 				goto parse_out;
519 			}
520 			sc->sc_capa_max_probe_len
521 			    = le32toh(*(const uint32_t *)tlv_data);
522 			/* limit it to something sensible */
523 			if (sc->sc_capa_max_probe_len > (1<<16)) {
524 				IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV,
525 				    "%s: IWM_UCODE_TLV_PROBE_MAX_LEN "
526 				    "ridiculous\n", __func__);
527 				error = EINVAL;
528 				goto parse_out;
529 			}
530 			break;
531 		case IWM_UCODE_TLV_PAN:
532 			if (tlv_len) {
533 				device_printf(sc->sc_dev,
534 				    "%s: IWM_UCODE_TLV_PAN: tlv_len (%d) > 0\n",
535 				    __func__,
536 				    (int) tlv_len);
537 				error = EINVAL;
538 				goto parse_out;
539 			}
540 			sc->sc_capaflags |= IWM_UCODE_TLV_FLAGS_PAN;
541 			break;
542 		case IWM_UCODE_TLV_FLAGS:
543 			if (tlv_len < sizeof(uint32_t)) {
544 				device_printf(sc->sc_dev,
545 				    "%s: IWM_UCODE_TLV_FLAGS: tlv_len (%d) < sizeof(uint32_t)\n",
546 				    __func__,
547 				    (int) tlv_len);
548 				error = EINVAL;
549 				goto parse_out;
550 			}
551 			/*
552 			 * Apparently there can be many flags, but Linux driver
553 			 * parses only the first one, and so do we.
554 			 *
555 			 * XXX: why does this override IWM_UCODE_TLV_PAN?
556 			 * Intentional or a bug?  Observations from
557 			 * current firmware file:
558 			 *  1) TLV_PAN is parsed first
559 			 *  2) TLV_FLAGS contains TLV_FLAGS_PAN
560 			 * ==> this resets TLV_PAN to itself... hnnnk
561 			 */
562 			sc->sc_capaflags = le32toh(*(const uint32_t *)tlv_data);
563 			break;
564 		case IWM_UCODE_TLV_CSCHEME:
565 			if ((error = iwm_store_cscheme(sc,
566 			    tlv_data, tlv_len)) != 0) {
567 				device_printf(sc->sc_dev,
568 				    "%s: iwm_store_cscheme(): returned %d\n",
569 				    __func__,
570 				    error);
571 				goto parse_out;
572 			}
573 			break;
574 		case IWM_UCODE_TLV_NUM_OF_CPU:
575 			if (tlv_len != sizeof(uint32_t)) {
576 				device_printf(sc->sc_dev,
577 				    "%s: IWM_UCODE_TLV_NUM_OF_CPU: tlv_len (%d) < sizeof(uint32_t)\n",
578 				    __func__,
579 				    (int) tlv_len);
580 				error = EINVAL;
581 				goto parse_out;
582 			}
583 			if (le32toh(*(const uint32_t*)tlv_data) != 1) {
584 				device_printf(sc->sc_dev,
585 				    "%s: driver supports "
586 				    "only TLV_NUM_OF_CPU == 1",
587 				    __func__);
588 				error = EINVAL;
589 				goto parse_out;
590 			}
591 			break;
592 		case IWM_UCODE_TLV_SEC_RT:
593 			if ((error = iwm_firmware_store_section(sc,
594 			    IWM_UCODE_TYPE_REGULAR, tlv_data, tlv_len)) != 0) {
595 				device_printf(sc->sc_dev,
596 				    "%s: IWM_UCODE_TYPE_REGULAR: iwm_firmware_store_section() failed; %d\n",
597 				    __func__,
598 				    error);
599 				goto parse_out;
600 			}
601 			break;
602 		case IWM_UCODE_TLV_SEC_INIT:
603 			if ((error = iwm_firmware_store_section(sc,
604 			    IWM_UCODE_TYPE_INIT, tlv_data, tlv_len)) != 0) {
605 				device_printf(sc->sc_dev,
606 				    "%s: IWM_UCODE_TYPE_INIT: iwm_firmware_store_section() failed; %d\n",
607 				    __func__,
608 				    error);
609 				goto parse_out;
610 			}
611 			break;
612 		case IWM_UCODE_TLV_SEC_WOWLAN:
613 			if ((error = iwm_firmware_store_section(sc,
614 			    IWM_UCODE_TYPE_WOW, tlv_data, tlv_len)) != 0) {
615 				device_printf(sc->sc_dev,
616 				    "%s: IWM_UCODE_TYPE_WOW: iwm_firmware_store_section() failed; %d\n",
617 				    __func__,
618 				    error);
619 				goto parse_out;
620 			}
621 			break;
622 		case IWM_UCODE_TLV_DEF_CALIB:
623 			if (tlv_len != sizeof(struct iwm_tlv_calib_data)) {
624 				device_printf(sc->sc_dev,
625 				    "%s: IWM_UCODE_TLV_DEV_CALIB: tlv_len (%d) < sizeof(iwm_tlv_calib_data) (%d)\n",
626 				    __func__,
627 				    (int) tlv_len,
628 				    (int) sizeof(struct iwm_tlv_calib_data));
629 				error = EINVAL;
630 				goto parse_out;
631 			}
632 			if ((error = iwm_set_default_calib(sc, tlv_data)) != 0) {
633 				device_printf(sc->sc_dev,
634 				    "%s: iwm_set_default_calib() failed: %d\n",
635 				    __func__,
636 				    error);
637 				goto parse_out;
638 			}
639 			break;
640 		case IWM_UCODE_TLV_PHY_SKU:
641 			if (tlv_len != sizeof(uint32_t)) {
642 				error = EINVAL;
643 				device_printf(sc->sc_dev,
644 				    "%s: IWM_UCODE_TLV_PHY_SKU: tlv_len (%d) < sizeof(uint32_t)\n",
645 				    __func__,
646 				    (int) tlv_len);
647 				goto parse_out;
648 			}
649 			sc->sc_fw_phy_config =
650 			    le32toh(*(const uint32_t *)tlv_data);
651 			break;
652 
653 		case IWM_UCODE_TLV_API_CHANGES_SET:
654 		case IWM_UCODE_TLV_ENABLED_CAPABILITIES:
655 			/* ignore, not used by current driver */
656 			break;
657 
658 		default:
659 			device_printf(sc->sc_dev,
660 			    "%s: unknown firmware section %d, abort\n",
661 			    __func__, tlv_type);
662 			error = EINVAL;
663 			goto parse_out;
664 		}
665 
666 		len -= roundup(tlv_len, 4);
667 		data += roundup(tlv_len, 4);
668 	}
669 
670 	KASSERT(error == 0, ("unhandled error"));
671 
672  parse_out:
673 	if (error) {
674 		device_printf(sc->sc_dev, "firmware parse error %d, "
675 		    "section type %d\n", error, tlv_type);
676 	}
677 
678 	if (!(sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_PM_CMD_SUPPORT)) {
679 		device_printf(sc->sc_dev,
680 		    "device uses unsupported power ops\n");
681 		error = ENOTSUP;
682 	}
683 
684  out:
685 	if (error) {
686 		fw->fw_status = IWM_FW_STATUS_NONE;
687 		if (fw->fw_rawdata != NULL)
688 			iwm_fw_info_free(fw);
689 	} else
690 		fw->fw_status = IWM_FW_STATUS_DONE;
691 	wakeup(&sc->sc_fw);
692 
693 	return error;
694 }
695 
696 /*
697  * DMA resource routines
698  */
699 
700 static void
701 iwm_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
702 {
703         if (error != 0)
704                 return;
705 	KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
706         *(bus_addr_t *)arg = segs[0].ds_addr;
707 }
708 
709 static int
710 iwm_dma_contig_alloc(bus_dma_tag_t tag, struct iwm_dma_info *dma,
711     bus_size_t size, bus_size_t alignment)
712 {
713 	int error;
714 
715 	dma->tag = NULL;
716 	dma->size = size;
717 
718 	error = bus_dma_tag_create(tag, alignment,
719             0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
720             1, size, BUS_DMA_NOWAIT, NULL, NULL, &dma->tag);
721         if (error != 0)
722                 goto fail;
723 
724         error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr,
725             BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map);
726         if (error != 0)
727                 goto fail;
728 
729         error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size,
730             iwm_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT);
731         if (error != 0)
732                 goto fail;
733 
734 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
735 
736 	return 0;
737 
738 fail:	iwm_dma_contig_free(dma);
739 	return error;
740 }
741 
742 static void
743 iwm_dma_contig_free(struct iwm_dma_info *dma)
744 {
745 	if (dma->map != NULL) {
746 		if (dma->vaddr != NULL) {
747 			bus_dmamap_sync(dma->tag, dma->map,
748 			    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
749 			bus_dmamap_unload(dma->tag, dma->map);
750 			bus_dmamem_free(dma->tag, dma->vaddr, dma->map);
751 			dma->vaddr = NULL;
752 		}
753 		bus_dmamap_destroy(dma->tag, dma->map);
754 		dma->map = NULL;
755 	}
756 	if (dma->tag != NULL) {
757 		bus_dma_tag_destroy(dma->tag);
758 		dma->tag = NULL;
759 	}
760 
761 }
762 
763 /* fwmem is used to load firmware onto the card */
764 static int
765 iwm_alloc_fwmem(struct iwm_softc *sc)
766 {
767 	/* Must be aligned on a 16-byte boundary. */
768 	return iwm_dma_contig_alloc(sc->sc_dmat, &sc->fw_dma,
769 	    sc->sc_fwdmasegsz, 16);
770 }
771 
772 static void
773 iwm_free_fwmem(struct iwm_softc *sc)
774 {
775 	iwm_dma_contig_free(&sc->fw_dma);
776 }
777 
778 /* tx scheduler rings.  not used? */
779 static int
780 iwm_alloc_sched(struct iwm_softc *sc)
781 {
782 	int rv;
783 
784 	/* TX scheduler rings must be aligned on a 1KB boundary. */
785 	rv = iwm_dma_contig_alloc(sc->sc_dmat, &sc->sched_dma,
786 	    nitems(sc->txq) * sizeof(struct iwm_agn_scd_bc_tbl), 1024);
787 	return rv;
788 }
789 
790 static void
791 iwm_free_sched(struct iwm_softc *sc)
792 {
793 	iwm_dma_contig_free(&sc->sched_dma);
794 }
795 
796 /* keep-warm page is used internally by the card.  see iwl-fh.h for more info */
797 static int
798 iwm_alloc_kw(struct iwm_softc *sc)
799 {
800 	return iwm_dma_contig_alloc(sc->sc_dmat, &sc->kw_dma, 4096, 4096);
801 }
802 
803 static void
804 iwm_free_kw(struct iwm_softc *sc)
805 {
806 	iwm_dma_contig_free(&sc->kw_dma);
807 }
808 
809 /* interrupt cause table */
810 static int
811 iwm_alloc_ict(struct iwm_softc *sc)
812 {
813 	return iwm_dma_contig_alloc(sc->sc_dmat, &sc->ict_dma,
814 	    IWM_ICT_SIZE, 1<<IWM_ICT_PADDR_SHIFT);
815 }
816 
817 static void
818 iwm_free_ict(struct iwm_softc *sc)
819 {
820 	iwm_dma_contig_free(&sc->ict_dma);
821 }
822 
823 static int
824 iwm_alloc_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
825 {
826 	bus_size_t size;
827 	int i, error;
828 
829 	ring->cur = 0;
830 
831 	/* Allocate RX descriptors (256-byte aligned). */
832 	size = IWM_RX_RING_COUNT * sizeof(uint32_t);
833 	error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256);
834 	if (error != 0) {
835 		device_printf(sc->sc_dev,
836 		    "could not allocate RX ring DMA memory\n");
837 		goto fail;
838 	}
839 	ring->desc = ring->desc_dma.vaddr;
840 
841 	/* Allocate RX status area (16-byte aligned). */
842 	error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->stat_dma,
843 	    sizeof(*ring->stat), 16);
844 	if (error != 0) {
845 		device_printf(sc->sc_dev,
846 		    "could not allocate RX status DMA memory\n");
847 		goto fail;
848 	}
849 	ring->stat = ring->stat_dma.vaddr;
850 
851         /* Create RX buffer DMA tag. */
852         error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
853             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
854             IWM_RBUF_SIZE, 1, IWM_RBUF_SIZE, BUS_DMA_NOWAIT, NULL, NULL,
855             &ring->data_dmat);
856         if (error != 0) {
857                 device_printf(sc->sc_dev,
858                     "%s: could not create RX buf DMA tag, error %d\n",
859                     __func__, error);
860                 goto fail;
861         }
862 
863 	/*
864 	 * Allocate and map RX buffers.
865 	 */
866 	for (i = 0; i < IWM_RX_RING_COUNT; i++) {
867 		if ((error = iwm_rx_addbuf(sc, IWM_RBUF_SIZE, i)) != 0) {
868 			goto fail;
869 		}
870 	}
871 	return 0;
872 
873 fail:	iwm_free_rx_ring(sc, ring);
874 	return error;
875 }
876 
877 static void
878 iwm_reset_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
879 {
880 
881 	/* XXX print out if we can't lock the NIC? */
882 	if (iwm_nic_lock(sc)) {
883 		/* XXX handle if RX stop doesn't finish? */
884 		(void) iwm_pcie_rx_stop(sc);
885 		iwm_nic_unlock(sc);
886 	}
887 	ring->cur = 0;
888 }
889 
890 static void
891 iwm_free_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
892 {
893 	int i;
894 
895 	iwm_dma_contig_free(&ring->desc_dma);
896 	iwm_dma_contig_free(&ring->stat_dma);
897 
898 	for (i = 0; i < IWM_RX_RING_COUNT; i++) {
899 		struct iwm_rx_data *data = &ring->data[i];
900 
901 		if (data->m != NULL) {
902 			bus_dmamap_sync(ring->data_dmat, data->map,
903 			    BUS_DMASYNC_POSTREAD);
904 			bus_dmamap_unload(ring->data_dmat, data->map);
905 			m_freem(data->m);
906 			data->m = NULL;
907 		}
908 		if (data->map != NULL) {
909 			bus_dmamap_destroy(ring->data_dmat, data->map);
910 			data->map = NULL;
911 		}
912 	}
913 	if (ring->data_dmat != NULL) {
914 		bus_dma_tag_destroy(ring->data_dmat);
915 		ring->data_dmat = NULL;
916 	}
917 }
918 
919 static int
920 iwm_alloc_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring, int qid)
921 {
922 	bus_addr_t paddr;
923 	bus_size_t size;
924 	int i, error;
925 
926 	ring->qid = qid;
927 	ring->queued = 0;
928 	ring->cur = 0;
929 
930 	/* Allocate TX descriptors (256-byte aligned). */
931 	size = IWM_TX_RING_COUNT * sizeof (struct iwm_tfd);
932 	error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256);
933 	if (error != 0) {
934 		device_printf(sc->sc_dev,
935 		    "could not allocate TX ring DMA memory\n");
936 		goto fail;
937 	}
938 	ring->desc = ring->desc_dma.vaddr;
939 
940 	/*
941 	 * We only use rings 0 through 9 (4 EDCA + cmd) so there is no need
942 	 * to allocate commands space for other rings.
943 	 */
944 	if (qid > IWM_MVM_CMD_QUEUE)
945 		return 0;
946 
947 	size = IWM_TX_RING_COUNT * sizeof(struct iwm_device_cmd);
948 	error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->cmd_dma, size, 4);
949 	if (error != 0) {
950 		device_printf(sc->sc_dev,
951 		    "could not allocate TX cmd DMA memory\n");
952 		goto fail;
953 	}
954 	ring->cmd = ring->cmd_dma.vaddr;
955 
956 	error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
957 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
958             IWM_MAX_SCATTER - 1, MCLBYTES, BUS_DMA_NOWAIT, NULL, NULL,
959             &ring->data_dmat);
960 	if (error != 0) {
961 		device_printf(sc->sc_dev, "could not create TX buf DMA tag\n");
962 		goto fail;
963 	}
964 
965 	paddr = ring->cmd_dma.paddr;
966 	for (i = 0; i < IWM_TX_RING_COUNT; i++) {
967 		struct iwm_tx_data *data = &ring->data[i];
968 
969 		data->cmd_paddr = paddr;
970 		data->scratch_paddr = paddr + sizeof(struct iwm_cmd_header)
971 		    + offsetof(struct iwm_tx_cmd, scratch);
972 		paddr += sizeof(struct iwm_device_cmd);
973 
974 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
975 		if (error != 0) {
976 			device_printf(sc->sc_dev,
977 			    "could not create TX buf DMA map\n");
978 			goto fail;
979 		}
980 	}
981 	KASSERT(paddr == ring->cmd_dma.paddr + size,
982 	    ("invalid physical address"));
983 	return 0;
984 
985 fail:	iwm_free_tx_ring(sc, ring);
986 	return error;
987 }
988 
989 static void
990 iwm_reset_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring)
991 {
992 	int i;
993 
994 	for (i = 0; i < IWM_TX_RING_COUNT; i++) {
995 		struct iwm_tx_data *data = &ring->data[i];
996 
997 		if (data->m != NULL) {
998 			bus_dmamap_sync(ring->data_dmat, data->map,
999 			    BUS_DMASYNC_POSTWRITE);
1000 			bus_dmamap_unload(ring->data_dmat, data->map);
1001 			m_freem(data->m);
1002 			data->m = NULL;
1003 		}
1004 	}
1005 	/* Clear TX descriptors. */
1006 	memset(ring->desc, 0, ring->desc_dma.size);
1007 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
1008 	    BUS_DMASYNC_PREWRITE);
1009 	sc->qfullmsk &= ~(1 << ring->qid);
1010 	ring->queued = 0;
1011 	ring->cur = 0;
1012 }
1013 
1014 static void
1015 iwm_free_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring)
1016 {
1017 	int i;
1018 
1019 	iwm_dma_contig_free(&ring->desc_dma);
1020 	iwm_dma_contig_free(&ring->cmd_dma);
1021 
1022 	for (i = 0; i < IWM_TX_RING_COUNT; i++) {
1023 		struct iwm_tx_data *data = &ring->data[i];
1024 
1025 		if (data->m != NULL) {
1026 			bus_dmamap_sync(ring->data_dmat, data->map,
1027 			    BUS_DMASYNC_POSTWRITE);
1028 			bus_dmamap_unload(ring->data_dmat, data->map);
1029 			m_freem(data->m);
1030 			data->m = NULL;
1031 		}
1032 		if (data->map != NULL) {
1033 			bus_dmamap_destroy(ring->data_dmat, data->map);
1034 			data->map = NULL;
1035 		}
1036 	}
1037 	if (ring->data_dmat != NULL) {
1038 		bus_dma_tag_destroy(ring->data_dmat);
1039 		ring->data_dmat = NULL;
1040 	}
1041 }
1042 
1043 /*
1044  * High-level hardware frobbing routines
1045  */
1046 
1047 static void
1048 iwm_enable_interrupts(struct iwm_softc *sc)
1049 {
1050 	sc->sc_intmask = IWM_CSR_INI_SET_MASK;
1051 	IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask);
1052 }
1053 
1054 static void
1055 iwm_restore_interrupts(struct iwm_softc *sc)
1056 {
1057 	IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask);
1058 }
1059 
1060 static void
1061 iwm_disable_interrupts(struct iwm_softc *sc)
1062 {
1063 	/* disable interrupts */
1064 	IWM_WRITE(sc, IWM_CSR_INT_MASK, 0);
1065 
1066 	/* acknowledge all interrupts */
1067 	IWM_WRITE(sc, IWM_CSR_INT, ~0);
1068 	IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, ~0);
1069 }
1070 
1071 static void
1072 iwm_ict_reset(struct iwm_softc *sc)
1073 {
1074 	iwm_disable_interrupts(sc);
1075 
1076 	/* Reset ICT table. */
1077 	memset(sc->ict_dma.vaddr, 0, IWM_ICT_SIZE);
1078 	sc->ict_cur = 0;
1079 
1080 	/* Set physical address of ICT table (4KB aligned). */
1081 	IWM_WRITE(sc, IWM_CSR_DRAM_INT_TBL_REG,
1082 	    IWM_CSR_DRAM_INT_TBL_ENABLE
1083 	    | IWM_CSR_DRAM_INIT_TBL_WRAP_CHECK
1084 	    | sc->ict_dma.paddr >> IWM_ICT_PADDR_SHIFT);
1085 
1086 	/* Switch to ICT interrupt mode in driver. */
1087 	sc->sc_flags |= IWM_FLAG_USE_ICT;
1088 
1089 	/* Re-enable interrupts. */
1090 	IWM_WRITE(sc, IWM_CSR_INT, ~0);
1091 	iwm_enable_interrupts(sc);
1092 }
1093 
1094 /* iwlwifi pcie/trans.c */
1095 
1096 /*
1097  * Since this .. hard-resets things, it's time to actually
1098  * mark the first vap (if any) as having no mac context.
1099  * It's annoying, but since the driver is potentially being
1100  * stop/start'ed whilst active (thanks openbsd port!) we
1101  * have to correctly track this.
1102  */
1103 static void
1104 iwm_stop_device(struct iwm_softc *sc)
1105 {
1106 	struct ieee80211com *ic = &sc->sc_ic;
1107 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1108 	int chnl, ntries;
1109 	int qid;
1110 
1111 	/* tell the device to stop sending interrupts */
1112 	iwm_disable_interrupts(sc);
1113 
1114 	/*
1115 	 * FreeBSD-local: mark the first vap as not-uploaded,
1116 	 * so the next transition through auth/assoc
1117 	 * will correctly populate the MAC context.
1118 	 */
1119 	if (vap) {
1120 		struct iwm_vap *iv = IWM_VAP(vap);
1121 		iv->is_uploaded = 0;
1122 	}
1123 
1124 	/* device going down, Stop using ICT table */
1125 	sc->sc_flags &= ~IWM_FLAG_USE_ICT;
1126 
1127 	/* stop tx and rx.  tx and rx bits, as usual, are from if_iwn */
1128 
1129 	iwm_write_prph(sc, IWM_SCD_TXFACT, 0);
1130 
1131 	/* Stop all DMA channels. */
1132 	if (iwm_nic_lock(sc)) {
1133 		for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) {
1134 			IWM_WRITE(sc,
1135 			    IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl), 0);
1136 			for (ntries = 0; ntries < 200; ntries++) {
1137 				uint32_t r;
1138 
1139 				r = IWM_READ(sc, IWM_FH_TSSR_TX_STATUS_REG);
1140 				if (r & IWM_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(
1141 				    chnl))
1142 					break;
1143 				DELAY(20);
1144 			}
1145 		}
1146 		iwm_nic_unlock(sc);
1147 	}
1148 
1149 	/* Stop RX ring. */
1150 	iwm_reset_rx_ring(sc, &sc->rxq);
1151 
1152 	/* Reset all TX rings. */
1153 	for (qid = 0; qid < nitems(sc->txq); qid++)
1154 		iwm_reset_tx_ring(sc, &sc->txq[qid]);
1155 
1156 	/*
1157 	 * Power-down device's busmaster DMA clocks
1158 	 */
1159 	iwm_write_prph(sc, IWM_APMG_CLK_DIS_REG, IWM_APMG_CLK_VAL_DMA_CLK_RQT);
1160 	DELAY(5);
1161 
1162 	/* Make sure (redundant) we've released our request to stay awake */
1163 	IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL,
1164 	    IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
1165 
1166 	/* Stop the device, and put it in low power state */
1167 	iwm_apm_stop(sc);
1168 
1169 	/* Upon stop, the APM issues an interrupt if HW RF kill is set.
1170 	 * Clean again the interrupt here
1171 	 */
1172 	iwm_disable_interrupts(sc);
1173 	/* stop and reset the on-board processor */
1174 	IWM_WRITE(sc, IWM_CSR_RESET, IWM_CSR_RESET_REG_FLAG_NEVO_RESET);
1175 
1176 	/*
1177 	 * Even if we stop the HW, we still want the RF kill
1178 	 * interrupt
1179 	 */
1180 	iwm_enable_rfkill_int(sc);
1181 	iwm_check_rfkill(sc);
1182 }
1183 
1184 /* iwlwifi: mvm/ops.c */
1185 static void
1186 iwm_mvm_nic_config(struct iwm_softc *sc)
1187 {
1188 	uint8_t radio_cfg_type, radio_cfg_step, radio_cfg_dash;
1189 	uint32_t reg_val = 0;
1190 
1191 	radio_cfg_type = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_TYPE) >>
1192 	    IWM_FW_PHY_CFG_RADIO_TYPE_POS;
1193 	radio_cfg_step = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_STEP) >>
1194 	    IWM_FW_PHY_CFG_RADIO_STEP_POS;
1195 	radio_cfg_dash = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_DASH) >>
1196 	    IWM_FW_PHY_CFG_RADIO_DASH_POS;
1197 
1198 	/* SKU control */
1199 	reg_val |= IWM_CSR_HW_REV_STEP(sc->sc_hw_rev) <<
1200 	    IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_STEP;
1201 	reg_val |= IWM_CSR_HW_REV_DASH(sc->sc_hw_rev) <<
1202 	    IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_DASH;
1203 
1204 	/* radio configuration */
1205 	reg_val |= radio_cfg_type << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_TYPE;
1206 	reg_val |= radio_cfg_step << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_STEP;
1207 	reg_val |= radio_cfg_dash << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_DASH;
1208 
1209 	IWM_WRITE(sc, IWM_CSR_HW_IF_CONFIG_REG, reg_val);
1210 
1211 	IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1212 	    "Radio type=0x%x-0x%x-0x%x\n", radio_cfg_type,
1213 	    radio_cfg_step, radio_cfg_dash);
1214 
1215 	/*
1216 	 * W/A : NIC is stuck in a reset state after Early PCIe power off
1217 	 * (PCIe power is lost before PERST# is asserted), causing ME FW
1218 	 * to lose ownership and not being able to obtain it back.
1219 	 */
1220 	iwm_set_bits_mask_prph(sc, IWM_APMG_PS_CTRL_REG,
1221 	    IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS,
1222 	    ~IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS);
1223 }
1224 
1225 static int
1226 iwm_nic_rx_init(struct iwm_softc *sc)
1227 {
1228 	if (!iwm_nic_lock(sc))
1229 		return EBUSY;
1230 
1231 	/*
1232 	 * Initialize RX ring.  This is from the iwn driver.
1233 	 */
1234 	memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat));
1235 
1236 	/* stop DMA */
1237 	IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
1238 	IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_RBDCB_WPTR, 0);
1239 	IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_FLUSH_RB_REQ, 0);
1240 	IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RDPTR, 0);
1241 	IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
1242 
1243 	/* Set physical address of RX ring (256-byte aligned). */
1244 	IWM_WRITE(sc,
1245 	    IWM_FH_RSCSR_CHNL0_RBDCB_BASE_REG, sc->rxq.desc_dma.paddr >> 8);
1246 
1247 	/* Set physical address of RX status (16-byte aligned). */
1248 	IWM_WRITE(sc,
1249 	    IWM_FH_RSCSR_CHNL0_STTS_WPTR_REG, sc->rxq.stat_dma.paddr >> 4);
1250 
1251 	/* Enable RX. */
1252 	/*
1253 	 * Note: Linux driver also sets this:
1254 	 *  (IWM_RX_RB_TIMEOUT << IWM_FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS) |
1255 	 *
1256 	 * It causes weird behavior.  YMMV.
1257 	 */
1258 	IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG,
1259 	    IWM_FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL		|
1260 	    IWM_FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY		|  /* HW bug */
1261 	    IWM_FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL	|
1262 	    IWM_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K		|
1263 	    IWM_RX_QUEUE_SIZE_LOG << IWM_FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS);
1264 
1265 	IWM_WRITE_1(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_TIMEOUT_DEF);
1266 
1267 	/* W/A for interrupt coalescing bug in 7260 and 3160 */
1268 	if (sc->host_interrupt_operation_mode)
1269 		IWM_SETBITS(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_OPER_MODE);
1270 
1271 	/*
1272 	 * Thus sayeth el jefe (iwlwifi) via a comment:
1273 	 *
1274 	 * This value should initially be 0 (before preparing any
1275  	 * RBs), should be 8 after preparing the first 8 RBs (for example)
1276 	 */
1277 	IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, 8);
1278 
1279 	iwm_nic_unlock(sc);
1280 
1281 	return 0;
1282 }
1283 
1284 static int
1285 iwm_nic_tx_init(struct iwm_softc *sc)
1286 {
1287 	int qid;
1288 
1289 	if (!iwm_nic_lock(sc))
1290 		return EBUSY;
1291 
1292 	/* Deactivate TX scheduler. */
1293 	iwm_write_prph(sc, IWM_SCD_TXFACT, 0);
1294 
1295 	/* Set physical address of "keep warm" page (16-byte aligned). */
1296 	IWM_WRITE(sc, IWM_FH_KW_MEM_ADDR_REG, sc->kw_dma.paddr >> 4);
1297 
1298 	/* Initialize TX rings. */
1299 	for (qid = 0; qid < nitems(sc->txq); qid++) {
1300 		struct iwm_tx_ring *txq = &sc->txq[qid];
1301 
1302 		/* Set physical address of TX ring (256-byte aligned). */
1303 		IWM_WRITE(sc, IWM_FH_MEM_CBBC_QUEUE(qid),
1304 		    txq->desc_dma.paddr >> 8);
1305 		IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
1306 		    "%s: loading ring %d descriptors (%p) at %lx\n",
1307 		    __func__,
1308 		    qid, txq->desc,
1309 		    (unsigned long) (txq->desc_dma.paddr >> 8));
1310 	}
1311 	iwm_nic_unlock(sc);
1312 
1313 	return 0;
1314 }
1315 
1316 static int
1317 iwm_nic_init(struct iwm_softc *sc)
1318 {
1319 	int error;
1320 
1321 	iwm_apm_init(sc);
1322 	iwm_set_pwr(sc);
1323 
1324 	iwm_mvm_nic_config(sc);
1325 
1326 	if ((error = iwm_nic_rx_init(sc)) != 0)
1327 		return error;
1328 
1329 	/*
1330 	 * Ditto for TX, from iwn
1331 	 */
1332 	if ((error = iwm_nic_tx_init(sc)) != 0)
1333 		return error;
1334 
1335 	IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1336 	    "%s: shadow registers enabled\n", __func__);
1337 	IWM_SETBITS(sc, IWM_CSR_MAC_SHADOW_REG_CTRL, 0x800fffff);
1338 
1339 	return 0;
1340 }
1341 
1342 enum iwm_mvm_tx_fifo {
1343 	IWM_MVM_TX_FIFO_BK = 0,
1344 	IWM_MVM_TX_FIFO_BE,
1345 	IWM_MVM_TX_FIFO_VI,
1346 	IWM_MVM_TX_FIFO_VO,
1347 	IWM_MVM_TX_FIFO_MCAST = 5,
1348 };
1349 
1350 const uint8_t iwm_mvm_ac_to_tx_fifo[] = {
1351 	IWM_MVM_TX_FIFO_VO,
1352 	IWM_MVM_TX_FIFO_VI,
1353 	IWM_MVM_TX_FIFO_BE,
1354 	IWM_MVM_TX_FIFO_BK,
1355 };
1356 
1357 static void
1358 iwm_enable_txq(struct iwm_softc *sc, int qid, int fifo)
1359 {
1360 	if (!iwm_nic_lock(sc)) {
1361 		device_printf(sc->sc_dev,
1362 		    "%s: cannot enable txq %d\n",
1363 		    __func__,
1364 		    qid);
1365 		return; /* XXX return EBUSY */
1366 	}
1367 
1368 	/* unactivate before configuration */
1369 	iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid),
1370 	    (0 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE)
1371 	    | (1 << IWM_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
1372 
1373 	if (qid != IWM_MVM_CMD_QUEUE) {
1374 		iwm_set_bits_prph(sc, IWM_SCD_QUEUECHAIN_SEL, (1 << qid));
1375 	}
1376 
1377 	iwm_clear_bits_prph(sc, IWM_SCD_AGGR_SEL, (1 << qid));
1378 
1379 	IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, qid << 8 | 0);
1380 	iwm_write_prph(sc, IWM_SCD_QUEUE_RDPTR(qid), 0);
1381 
1382 	iwm_write_mem32(sc, sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid), 0);
1383 	/* Set scheduler window size and frame limit. */
1384 	iwm_write_mem32(sc,
1385 	    sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid) +
1386 	    sizeof(uint32_t),
1387 	    ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
1388 	    IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
1389 	    ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
1390 	    IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
1391 
1392 	iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid),
1393 	    (1 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
1394 	    (fifo << IWM_SCD_QUEUE_STTS_REG_POS_TXF) |
1395 	    (1 << IWM_SCD_QUEUE_STTS_REG_POS_WSL) |
1396 	    IWM_SCD_QUEUE_STTS_REG_MSK);
1397 
1398 	iwm_nic_unlock(sc);
1399 
1400 	IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
1401 	    "%s: enabled txq %d FIFO %d\n",
1402 	    __func__, qid, fifo);
1403 }
1404 
1405 static int
1406 iwm_post_alive(struct iwm_softc *sc)
1407 {
1408 	int nwords;
1409 	int error, chnl;
1410 
1411 	if (!iwm_nic_lock(sc))
1412 		return EBUSY;
1413 
1414 	if (sc->sched_base != iwm_read_prph(sc, IWM_SCD_SRAM_BASE_ADDR)) {
1415 		device_printf(sc->sc_dev,
1416 		    "%s: sched addr mismatch",
1417 		    __func__);
1418 		error = EINVAL;
1419 		goto out;
1420 	}
1421 
1422 	iwm_ict_reset(sc);
1423 
1424 	/* Clear TX scheduler state in SRAM. */
1425 	nwords = (IWM_SCD_TRANS_TBL_MEM_UPPER_BOUND -
1426 	    IWM_SCD_CONTEXT_MEM_LOWER_BOUND)
1427 	    / sizeof(uint32_t);
1428 	error = iwm_write_mem(sc,
1429 	    sc->sched_base + IWM_SCD_CONTEXT_MEM_LOWER_BOUND,
1430 	    NULL, nwords);
1431 	if (error)
1432 		goto out;
1433 
1434 	/* Set physical address of TX scheduler rings (1KB aligned). */
1435 	iwm_write_prph(sc, IWM_SCD_DRAM_BASE_ADDR, sc->sched_dma.paddr >> 10);
1436 
1437 	iwm_write_prph(sc, IWM_SCD_CHAINEXT_EN, 0);
1438 
1439 	/* enable command channel */
1440 	iwm_enable_txq(sc, IWM_MVM_CMD_QUEUE, 7);
1441 
1442 	iwm_write_prph(sc, IWM_SCD_TXFACT, 0xff);
1443 
1444 	/* Enable DMA channels. */
1445 	for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) {
1446 		IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl),
1447 		    IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
1448 		    IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
1449 	}
1450 
1451 	IWM_SETBITS(sc, IWM_FH_TX_CHICKEN_BITS_REG,
1452 	    IWM_FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
1453 
1454 	/* Enable L1-Active */
1455 	iwm_clear_bits_prph(sc, IWM_APMG_PCIDEV_STT_REG,
1456 	    IWM_APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
1457 
1458  out:
1459  	iwm_nic_unlock(sc);
1460 	return error;
1461 }
1462 
1463 /*
1464  * NVM read access and content parsing.  We do not support
1465  * external NVM or writing NVM.
1466  * iwlwifi/mvm/nvm.c
1467  */
1468 
1469 /* list of NVM sections we are allowed/need to read */
1470 const int nvm_to_read[] = {
1471 	IWM_NVM_SECTION_TYPE_HW,
1472 	IWM_NVM_SECTION_TYPE_SW,
1473 	IWM_NVM_SECTION_TYPE_CALIBRATION,
1474 	IWM_NVM_SECTION_TYPE_PRODUCTION,
1475 };
1476 
1477 /* Default NVM size to read */
1478 #define IWM_NVM_DEFAULT_CHUNK_SIZE (2*1024)
1479 #define IWM_MAX_NVM_SECTION_SIZE 7000
1480 
1481 #define IWM_NVM_WRITE_OPCODE 1
1482 #define IWM_NVM_READ_OPCODE 0
1483 
1484 static int
1485 iwm_nvm_read_chunk(struct iwm_softc *sc, uint16_t section,
1486 	uint16_t offset, uint16_t length, uint8_t *data, uint16_t *len)
1487 {
1488 	offset = 0;
1489 	struct iwm_nvm_access_cmd nvm_access_cmd = {
1490 		.offset = htole16(offset),
1491 		.length = htole16(length),
1492 		.type = htole16(section),
1493 		.op_code = IWM_NVM_READ_OPCODE,
1494 	};
1495 	struct iwm_nvm_access_resp *nvm_resp;
1496 	struct iwm_rx_packet *pkt;
1497 	struct iwm_host_cmd cmd = {
1498 		.id = IWM_NVM_ACCESS_CMD,
1499 		.flags = IWM_CMD_SYNC | IWM_CMD_WANT_SKB |
1500 		    IWM_CMD_SEND_IN_RFKILL,
1501 		.data = { &nvm_access_cmd, },
1502 	};
1503 	int ret, bytes_read, offset_read;
1504 	uint8_t *resp_data;
1505 
1506 	cmd.len[0] = sizeof(struct iwm_nvm_access_cmd);
1507 
1508 	ret = iwm_send_cmd(sc, &cmd);
1509 	if (ret)
1510 		return ret;
1511 
1512 	pkt = cmd.resp_pkt;
1513 	if (pkt->hdr.flags & IWM_CMD_FAILED_MSK) {
1514 		device_printf(sc->sc_dev,
1515 		    "%s: Bad return from IWM_NVM_ACCES_COMMAND (0x%08X)\n",
1516 		    __func__, pkt->hdr.flags);
1517 		ret = EIO;
1518 		goto exit;
1519 	}
1520 
1521 	/* Extract NVM response */
1522 	nvm_resp = (void *)pkt->data;
1523 
1524 	ret = le16toh(nvm_resp->status);
1525 	bytes_read = le16toh(nvm_resp->length);
1526 	offset_read = le16toh(nvm_resp->offset);
1527 	resp_data = nvm_resp->data;
1528 	if (ret) {
1529 		device_printf(sc->sc_dev,
1530 		    "%s: NVM access command failed with status %d\n",
1531 		    __func__, ret);
1532 		ret = EINVAL;
1533 		goto exit;
1534 	}
1535 
1536 	if (offset_read != offset) {
1537 		device_printf(sc->sc_dev,
1538 		    "%s: NVM ACCESS response with invalid offset %d\n",
1539 		    __func__, offset_read);
1540 		ret = EINVAL;
1541 		goto exit;
1542 	}
1543 
1544 	memcpy(data + offset, resp_data, bytes_read);
1545 	*len = bytes_read;
1546 
1547  exit:
1548 	iwm_free_resp(sc, &cmd);
1549 	return ret;
1550 }
1551 
1552 /*
1553  * Reads an NVM section completely.
1554  * NICs prior to 7000 family doesn't have a real NVM, but just read
1555  * section 0 which is the EEPROM. Because the EEPROM reading is unlimited
1556  * by uCode, we need to manually check in this case that we don't
1557  * overflow and try to read more than the EEPROM size.
1558  * For 7000 family NICs, we supply the maximal size we can read, and
1559  * the uCode fills the response with as much data as we can,
1560  * without overflowing, so no check is needed.
1561  */
1562 static int
1563 iwm_nvm_read_section(struct iwm_softc *sc,
1564 	uint16_t section, uint8_t *data, uint16_t *len)
1565 {
1566 	uint16_t length, seglen;
1567 	int error;
1568 
1569 	/* Set nvm section read length */
1570 	length = seglen = IWM_NVM_DEFAULT_CHUNK_SIZE;
1571 	*len = 0;
1572 
1573 	/* Read the NVM until exhausted (reading less than requested) */
1574 	while (seglen == length) {
1575 		error = iwm_nvm_read_chunk(sc,
1576 		    section, *len, length, data, &seglen);
1577 		if (error) {
1578 			device_printf(sc->sc_dev,
1579 			    "Cannot read NVM from section "
1580 			    "%d offset %d, length %d\n",
1581 			    section, *len, length);
1582 			return error;
1583 		}
1584 		*len += seglen;
1585 	}
1586 
1587 	IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1588 	    "NVM section %d read completed\n", section);
1589 	return 0;
1590 }
1591 
1592 /*
1593  * BEGIN IWM_NVM_PARSE
1594  */
1595 
1596 /* iwlwifi/iwl-nvm-parse.c */
1597 
1598 /* NVM offsets (in words) definitions */
1599 enum wkp_nvm_offsets {
1600 	/* NVM HW-Section offset (in words) definitions */
1601 	IWM_HW_ADDR = 0x15,
1602 
1603 /* NVM SW-Section offset (in words) definitions */
1604 	IWM_NVM_SW_SECTION = 0x1C0,
1605 	IWM_NVM_VERSION = 0,
1606 	IWM_RADIO_CFG = 1,
1607 	IWM_SKU = 2,
1608 	IWM_N_HW_ADDRS = 3,
1609 	IWM_NVM_CHANNELS = 0x1E0 - IWM_NVM_SW_SECTION,
1610 
1611 /* NVM calibration section offset (in words) definitions */
1612 	IWM_NVM_CALIB_SECTION = 0x2B8,
1613 	IWM_XTAL_CALIB = 0x316 - IWM_NVM_CALIB_SECTION
1614 };
1615 
1616 /* SKU Capabilities (actual values from NVM definition) */
1617 enum nvm_sku_bits {
1618 	IWM_NVM_SKU_CAP_BAND_24GHZ	= (1 << 0),
1619 	IWM_NVM_SKU_CAP_BAND_52GHZ	= (1 << 1),
1620 	IWM_NVM_SKU_CAP_11N_ENABLE	= (1 << 2),
1621 	IWM_NVM_SKU_CAP_11AC_ENABLE	= (1 << 3),
1622 };
1623 
1624 /* radio config bits (actual values from NVM definition) */
1625 #define IWM_NVM_RF_CFG_DASH_MSK(x)   (x & 0x3)         /* bits 0-1   */
1626 #define IWM_NVM_RF_CFG_STEP_MSK(x)   ((x >> 2)  & 0x3) /* bits 2-3   */
1627 #define IWM_NVM_RF_CFG_TYPE_MSK(x)   ((x >> 4)  & 0x3) /* bits 4-5   */
1628 #define IWM_NVM_RF_CFG_PNUM_MSK(x)   ((x >> 6)  & 0x3) /* bits 6-7   */
1629 #define IWM_NVM_RF_CFG_TX_ANT_MSK(x) ((x >> 8)  & 0xF) /* bits 8-11  */
1630 #define IWM_NVM_RF_CFG_RX_ANT_MSK(x) ((x >> 12) & 0xF) /* bits 12-15 */
1631 
1632 #define DEFAULT_MAX_TX_POWER 16
1633 
1634 /**
1635  * enum iwm_nvm_channel_flags - channel flags in NVM
1636  * @IWM_NVM_CHANNEL_VALID: channel is usable for this SKU/geo
1637  * @IWM_NVM_CHANNEL_IBSS: usable as an IBSS channel
1638  * @IWM_NVM_CHANNEL_ACTIVE: active scanning allowed
1639  * @IWM_NVM_CHANNEL_RADAR: radar detection required
1640  * @IWM_NVM_CHANNEL_DFS: dynamic freq selection candidate
1641  * @IWM_NVM_CHANNEL_WIDE: 20 MHz channel okay (?)
1642  * @IWM_NVM_CHANNEL_40MHZ: 40 MHz channel okay (?)
1643  * @IWM_NVM_CHANNEL_80MHZ: 80 MHz channel okay (?)
1644  * @IWM_NVM_CHANNEL_160MHZ: 160 MHz channel okay (?)
1645  */
1646 enum iwm_nvm_channel_flags {
1647 	IWM_NVM_CHANNEL_VALID = (1 << 0),
1648 	IWM_NVM_CHANNEL_IBSS = (1 << 1),
1649 	IWM_NVM_CHANNEL_ACTIVE = (1 << 3),
1650 	IWM_NVM_CHANNEL_RADAR = (1 << 4),
1651 	IWM_NVM_CHANNEL_DFS = (1 << 7),
1652 	IWM_NVM_CHANNEL_WIDE = (1 << 8),
1653 	IWM_NVM_CHANNEL_40MHZ = (1 << 9),
1654 	IWM_NVM_CHANNEL_80MHZ = (1 << 10),
1655 	IWM_NVM_CHANNEL_160MHZ = (1 << 11),
1656 };
1657 
1658 /*
1659  * Add a channel to the net80211 channel list.
1660  *
1661  * ieee is the ieee channel number
1662  * ch_idx is channel index.
1663  * mode is the channel mode - CHAN_A, CHAN_B, CHAN_G.
1664  * ch_flags is the iwm channel flags.
1665  *
1666  * Return 0 on OK, < 0 on error.
1667  */
1668 static int
1669 iwm_init_net80211_channel(struct iwm_softc *sc, int ieee, int ch_idx,
1670     int mode, uint16_t ch_flags)
1671 {
1672 	/* XXX for now, no overflow checking! */
1673 	struct ieee80211com *ic = &sc->sc_ic;
1674 	int is_5ghz, flags;
1675 	struct ieee80211_channel *channel;
1676 
1677 	channel = &ic->ic_channels[ic->ic_nchans++];
1678 	channel->ic_ieee = ieee;
1679 
1680 	is_5ghz = ch_idx >= IWM_NUM_2GHZ_CHANNELS;
1681 	if (!is_5ghz) {
1682 		flags = IEEE80211_CHAN_2GHZ;
1683 		channel->ic_flags = mode;
1684 	} else {
1685 		flags = IEEE80211_CHAN_5GHZ;
1686 		channel->ic_flags = mode;
1687 	}
1688 	channel->ic_freq = ieee80211_ieee2mhz(ieee, flags);
1689 
1690 	if (!(ch_flags & IWM_NVM_CHANNEL_ACTIVE))
1691 		channel->ic_flags |= IEEE80211_CHAN_PASSIVE;
1692 	return (0);
1693 }
1694 
1695 static void
1696 iwm_init_channel_map(struct iwm_softc *sc, const uint16_t * const nvm_ch_flags)
1697 {
1698 	struct ieee80211com *ic = &sc->sc_ic;
1699 	struct iwm_nvm_data *data = &sc->sc_nvm;
1700 	int ch_idx;
1701 	uint16_t ch_flags;
1702 	int hw_value;
1703 
1704 	for (ch_idx = 0; ch_idx < nitems(iwm_nvm_channels); ch_idx++) {
1705 		ch_flags = le16_to_cpup(nvm_ch_flags + ch_idx);
1706 
1707 		if (ch_idx >= IWM_NUM_2GHZ_CHANNELS &&
1708 		    !data->sku_cap_band_52GHz_enable)
1709 			ch_flags &= ~IWM_NVM_CHANNEL_VALID;
1710 
1711 		if (!(ch_flags & IWM_NVM_CHANNEL_VALID)) {
1712 			IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1713 			    "Ch. %d Flags %x [%sGHz] - No traffic\n",
1714 			    iwm_nvm_channels[ch_idx],
1715 			    ch_flags,
1716 			    (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ?
1717 			    "5.2" : "2.4");
1718 			continue;
1719 		}
1720 
1721 		hw_value = iwm_nvm_channels[ch_idx];
1722 
1723 		/* 5GHz? */
1724 		if (ch_idx >= IWM_NUM_2GHZ_CHANNELS) {
1725 			(void) iwm_init_net80211_channel(sc, hw_value,
1726 			    ch_idx,
1727 			    IEEE80211_CHAN_A,
1728 			    ch_flags);
1729 		} else {
1730 			(void) iwm_init_net80211_channel(sc, hw_value,
1731 			    ch_idx,
1732 			    IEEE80211_CHAN_B,
1733 			    ch_flags);
1734 			/* If it's not channel 13, also add 11g */
1735 			if (hw_value != 13)
1736 				(void) iwm_init_net80211_channel(sc, hw_value,
1737 				    ch_idx,
1738 				    IEEE80211_CHAN_G,
1739 				    ch_flags);
1740 		}
1741 
1742 		IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1743 		    "Ch. %d Flags %x [%sGHz] - Added\n",
1744 		    iwm_nvm_channels[ch_idx],
1745 		    ch_flags,
1746 		    (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ?
1747 		    "5.2" : "2.4");
1748 	}
1749 	ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
1750 }
1751 
1752 static int
1753 iwm_parse_nvm_data(struct iwm_softc *sc,
1754 	const uint16_t *nvm_hw, const uint16_t *nvm_sw,
1755 	const uint16_t *nvm_calib, uint8_t tx_chains, uint8_t rx_chains)
1756 {
1757 	struct iwm_nvm_data *data = &sc->sc_nvm;
1758 	uint8_t hw_addr[IEEE80211_ADDR_LEN];
1759 	uint16_t radio_cfg, sku;
1760 
1761 	data->nvm_version = le16_to_cpup(nvm_sw + IWM_NVM_VERSION);
1762 
1763 	radio_cfg = le16_to_cpup(nvm_sw + IWM_RADIO_CFG);
1764 	data->radio_cfg_type = IWM_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1765 	data->radio_cfg_step = IWM_NVM_RF_CFG_STEP_MSK(radio_cfg);
1766 	data->radio_cfg_dash = IWM_NVM_RF_CFG_DASH_MSK(radio_cfg);
1767 	data->radio_cfg_pnum = IWM_NVM_RF_CFG_PNUM_MSK(radio_cfg);
1768 	data->valid_tx_ant = IWM_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1769 	data->valid_rx_ant = IWM_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1770 
1771 	sku = le16_to_cpup(nvm_sw + IWM_SKU);
1772 	data->sku_cap_band_24GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_24GHZ;
1773 	data->sku_cap_band_52GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_52GHZ;
1774 	data->sku_cap_11n_enable = 0;
1775 
1776 	if (!data->valid_tx_ant || !data->valid_rx_ant) {
1777 		device_printf(sc->sc_dev,
1778 		    "%s: invalid antennas (0x%x, 0x%x)\n",
1779 		    __func__, data->valid_tx_ant,
1780 		    data->valid_rx_ant);
1781 		return EINVAL;
1782 	}
1783 
1784 	data->n_hw_addrs = le16_to_cpup(nvm_sw + IWM_N_HW_ADDRS);
1785 
1786 	data->xtal_calib[0] = *(nvm_calib + IWM_XTAL_CALIB);
1787 	data->xtal_calib[1] = *(nvm_calib + IWM_XTAL_CALIB + 1);
1788 
1789 	/* The byte order is little endian 16 bit, meaning 214365 */
1790 	IEEE80211_ADDR_COPY(hw_addr, nvm_hw + IWM_HW_ADDR);
1791 	data->hw_addr[0] = hw_addr[1];
1792 	data->hw_addr[1] = hw_addr[0];
1793 	data->hw_addr[2] = hw_addr[3];
1794 	data->hw_addr[3] = hw_addr[2];
1795 	data->hw_addr[4] = hw_addr[5];
1796 	data->hw_addr[5] = hw_addr[4];
1797 
1798 	iwm_init_channel_map(sc, &nvm_sw[IWM_NVM_CHANNELS]);
1799 	data->calib_version = 255;   /* TODO:
1800 					this value will prevent some checks from
1801 					failing, we need to check if this
1802 					field is still needed, and if it does,
1803 					where is it in the NVM */
1804 
1805 	return 0;
1806 }
1807 
1808 /*
1809  * END NVM PARSE
1810  */
1811 
1812 struct iwm_nvm_section {
1813 	uint16_t length;
1814 	const uint8_t *data;
1815 };
1816 
1817 static int
1818 iwm_parse_nvm_sections(struct iwm_softc *sc, struct iwm_nvm_section *sections)
1819 {
1820 	const uint16_t *hw, *sw, *calib;
1821 
1822 	/* Checking for required sections */
1823 	if (!sections[IWM_NVM_SECTION_TYPE_SW].data ||
1824 	    !sections[IWM_NVM_SECTION_TYPE_HW].data) {
1825 		device_printf(sc->sc_dev,
1826 		    "%s: Can't parse empty NVM sections\n",
1827 		    __func__);
1828 		return ENOENT;
1829 	}
1830 
1831 	hw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_HW].data;
1832 	sw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_SW].data;
1833 	calib = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_CALIBRATION].data;
1834 	return iwm_parse_nvm_data(sc, hw, sw, calib,
1835 	    IWM_FW_VALID_TX_ANT(sc), IWM_FW_VALID_RX_ANT(sc));
1836 }
1837 
1838 static int
1839 iwm_nvm_init(struct iwm_softc *sc)
1840 {
1841 	struct iwm_nvm_section nvm_sections[IWM_NVM_NUM_OF_SECTIONS];
1842 	int i, section, error;
1843 	uint16_t len;
1844 	uint8_t *nvm_buffer, *temp;
1845 
1846 	/* Read From FW NVM */
1847 	IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1848 	    "%s: Read NVM\n",
1849 	    __func__);
1850 
1851 	/* TODO: find correct NVM max size for a section */
1852 	nvm_buffer = malloc(IWM_OTP_LOW_IMAGE_SIZE, M_DEVBUF, M_NOWAIT);
1853 	if (nvm_buffer == NULL)
1854 		return (ENOMEM);
1855 	for (i = 0; i < nitems(nvm_to_read); i++) {
1856 		section = nvm_to_read[i];
1857 		KASSERT(section <= nitems(nvm_sections),
1858 		    ("too many sections"));
1859 
1860 		error = iwm_nvm_read_section(sc, section, nvm_buffer, &len);
1861 		if (error)
1862 			break;
1863 
1864 		temp = malloc(len, M_DEVBUF, M_NOWAIT);
1865 		if (temp == NULL) {
1866 			error = ENOMEM;
1867 			break;
1868 		}
1869 		memcpy(temp, nvm_buffer, len);
1870 		nvm_sections[section].data = temp;
1871 		nvm_sections[section].length = len;
1872 	}
1873 	free(nvm_buffer, M_DEVBUF);
1874 	if (error)
1875 		return error;
1876 
1877 	return iwm_parse_nvm_sections(sc, nvm_sections);
1878 }
1879 
1880 /*
1881  * Firmware loading gunk.  This is kind of a weird hybrid between the
1882  * iwn driver and the Linux iwlwifi driver.
1883  */
1884 
1885 static int
1886 iwm_firmware_load_chunk(struct iwm_softc *sc, uint32_t dst_addr,
1887 	const uint8_t *section, uint32_t byte_cnt)
1888 {
1889 	struct iwm_dma_info *dma = &sc->fw_dma;
1890 	int error;
1891 
1892 	/* Copy firmware section into pre-allocated DMA-safe memory. */
1893 	memcpy(dma->vaddr, section, byte_cnt);
1894 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
1895 
1896 	if (!iwm_nic_lock(sc))
1897 		return EBUSY;
1898 
1899 	sc->sc_fw_chunk_done = 0;
1900 
1901 	IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL),
1902 	    IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
1903 	IWM_WRITE(sc, IWM_FH_SRVC_CHNL_SRAM_ADDR_REG(IWM_FH_SRVC_CHNL),
1904 	    dst_addr);
1905 	IWM_WRITE(sc, IWM_FH_TFDIB_CTRL0_REG(IWM_FH_SRVC_CHNL),
1906 	    dma->paddr & IWM_FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
1907 	IWM_WRITE(sc, IWM_FH_TFDIB_CTRL1_REG(IWM_FH_SRVC_CHNL),
1908 	    (iwm_get_dma_hi_addr(dma->paddr)
1909 	      << IWM_FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
1910 	IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_BUF_STS_REG(IWM_FH_SRVC_CHNL),
1911 	    1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
1912 	    1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
1913 	    IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
1914 	IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL),
1915 	    IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE    |
1916 	    IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE |
1917 	    IWM_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
1918 
1919 	iwm_nic_unlock(sc);
1920 
1921 	/* wait 1s for this segment to load */
1922 	while (!sc->sc_fw_chunk_done)
1923 		if ((error = msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfw", hz)) != 0)
1924 			break;
1925 
1926 	return error;
1927 }
1928 
1929 static int
1930 iwm_load_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type)
1931 {
1932 	struct iwm_fw_sects *fws;
1933 	int error, i, w;
1934 	const void *data;
1935 	uint32_t dlen;
1936 	uint32_t offset;
1937 
1938 	sc->sc_uc.uc_intr = 0;
1939 
1940 	fws = &sc->sc_fw.fw_sects[ucode_type];
1941 	for (i = 0; i < fws->fw_count; i++) {
1942 		data = fws->fw_sect[i].fws_data;
1943 		dlen = fws->fw_sect[i].fws_len;
1944 		offset = fws->fw_sect[i].fws_devoff;
1945 		IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV,
1946 		    "LOAD FIRMWARE type %d offset %u len %d\n",
1947 		    ucode_type, offset, dlen);
1948 		error = iwm_firmware_load_chunk(sc, offset, data, dlen);
1949 		if (error) {
1950 			device_printf(sc->sc_dev,
1951 			    "%s: chunk %u of %u returned error %02d\n",
1952 			    __func__, i, fws->fw_count, error);
1953 			return error;
1954 		}
1955 	}
1956 
1957 	/* wait for the firmware to load */
1958 	IWM_WRITE(sc, IWM_CSR_RESET, 0);
1959 
1960 	for (w = 0; !sc->sc_uc.uc_intr && w < 10; w++) {
1961 		error = msleep(&sc->sc_uc, &sc->sc_mtx, 0, "iwmuc", hz/10);
1962 	}
1963 
1964 	return error;
1965 }
1966 
1967 /* iwlwifi: pcie/trans.c */
1968 static int
1969 iwm_start_fw(struct iwm_softc *sc, enum iwm_ucode_type ucode_type)
1970 {
1971 	int error;
1972 
1973 	IWM_WRITE(sc, IWM_CSR_INT, ~0);
1974 
1975 	if ((error = iwm_nic_init(sc)) != 0) {
1976 		device_printf(sc->sc_dev, "unable to init nic\n");
1977 		return error;
1978 	}
1979 
1980 	/* make sure rfkill handshake bits are cleared */
1981 	IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
1982 	IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR,
1983 	    IWM_CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
1984 
1985 	/* clear (again), then enable host interrupts */
1986 	IWM_WRITE(sc, IWM_CSR_INT, ~0);
1987 	iwm_enable_interrupts(sc);
1988 
1989 	/* really make sure rfkill handshake bits are cleared */
1990 	/* maybe we should write a few times more?  just to make sure */
1991 	IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
1992 	IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
1993 
1994 	/* Load the given image to the HW */
1995 	return iwm_load_firmware(sc, ucode_type);
1996 }
1997 
1998 static int
1999 iwm_fw_alive(struct iwm_softc *sc, uint32_t sched_base)
2000 {
2001 	return iwm_post_alive(sc);
2002 }
2003 
2004 static int
2005 iwm_send_tx_ant_cfg(struct iwm_softc *sc, uint8_t valid_tx_ant)
2006 {
2007 	struct iwm_tx_ant_cfg_cmd tx_ant_cmd = {
2008 		.valid = htole32(valid_tx_ant),
2009 	};
2010 
2011 	return iwm_mvm_send_cmd_pdu(sc, IWM_TX_ANT_CONFIGURATION_CMD,
2012 	    IWM_CMD_SYNC, sizeof(tx_ant_cmd), &tx_ant_cmd);
2013 }
2014 
2015 /* iwlwifi: mvm/fw.c */
2016 static int
2017 iwm_send_phy_cfg_cmd(struct iwm_softc *sc)
2018 {
2019 	struct iwm_phy_cfg_cmd phy_cfg_cmd;
2020 	enum iwm_ucode_type ucode_type = sc->sc_uc_current;
2021 
2022 	/* Set parameters */
2023 	phy_cfg_cmd.phy_cfg = htole32(sc->sc_fw_phy_config);
2024 	phy_cfg_cmd.calib_control.event_trigger =
2025 	    sc->sc_default_calib[ucode_type].event_trigger;
2026 	phy_cfg_cmd.calib_control.flow_trigger =
2027 	    sc->sc_default_calib[ucode_type].flow_trigger;
2028 
2029 	IWM_DPRINTF(sc, IWM_DEBUG_CMD | IWM_DEBUG_RESET,
2030 	    "Sending Phy CFG command: 0x%x\n", phy_cfg_cmd.phy_cfg);
2031 	return iwm_mvm_send_cmd_pdu(sc, IWM_PHY_CONFIGURATION_CMD, IWM_CMD_SYNC,
2032 	    sizeof(phy_cfg_cmd), &phy_cfg_cmd);
2033 }
2034 
2035 static int
2036 iwm_mvm_load_ucode_wait_alive(struct iwm_softc *sc,
2037 	enum iwm_ucode_type ucode_type)
2038 {
2039 	enum iwm_ucode_type old_type = sc->sc_uc_current;
2040 	int error;
2041 
2042 	if ((error = iwm_read_firmware(sc, ucode_type)) != 0)
2043 		return error;
2044 
2045 	sc->sc_uc_current = ucode_type;
2046 	error = iwm_start_fw(sc, ucode_type);
2047 	if (error) {
2048 		sc->sc_uc_current = old_type;
2049 		return error;
2050 	}
2051 
2052 	return iwm_fw_alive(sc, sc->sched_base);
2053 }
2054 
2055 /*
2056  * mvm misc bits
2057  */
2058 
2059 /*
2060  * follows iwlwifi/fw.c
2061  */
2062 static int
2063 iwm_run_init_mvm_ucode(struct iwm_softc *sc, int justnvm)
2064 {
2065 	int error;
2066 
2067 	/* do not operate with rfkill switch turned on */
2068 	if ((sc->sc_flags & IWM_FLAG_RFKILL) && !justnvm) {
2069 		device_printf(sc->sc_dev,
2070 		    "radio is disabled by hardware switch\n");
2071 		return EPERM;
2072 	}
2073 
2074 	sc->sc_init_complete = 0;
2075 	if ((error = iwm_mvm_load_ucode_wait_alive(sc,
2076 	    IWM_UCODE_TYPE_INIT)) != 0)
2077 		return error;
2078 
2079 	if (justnvm) {
2080 		if ((error = iwm_nvm_init(sc)) != 0) {
2081 			device_printf(sc->sc_dev, "failed to read nvm\n");
2082 			return error;
2083 		}
2084 		IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, &sc->sc_nvm.hw_addr);
2085 
2086 		sc->sc_scan_cmd_len = sizeof(struct iwm_scan_cmd)
2087 		    + sc->sc_capa_max_probe_len
2088 		    + IWM_MAX_NUM_SCAN_CHANNELS
2089 		    * sizeof(struct iwm_scan_channel);
2090 		sc->sc_scan_cmd = malloc(sc->sc_scan_cmd_len, M_DEVBUF,
2091 		    M_NOWAIT);
2092 		if (sc->sc_scan_cmd == NULL)
2093 			return (ENOMEM);
2094 
2095 		return 0;
2096 	}
2097 
2098 	/* Send TX valid antennas before triggering calibrations */
2099 	if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0)
2100 		return error;
2101 
2102 	/*
2103 	* Send phy configurations command to init uCode
2104 	* to start the 16.0 uCode init image internal calibrations.
2105 	*/
2106 	if ((error = iwm_send_phy_cfg_cmd(sc)) != 0 ) {
2107 		device_printf(sc->sc_dev,
2108 		    "%s: failed to run internal calibration: %d\n",
2109 		    __func__, error);
2110 		return error;
2111 	}
2112 
2113 	/*
2114 	 * Nothing to do but wait for the init complete notification
2115 	 * from the firmware
2116 	 */
2117 	while (!sc->sc_init_complete)
2118 		if ((error = msleep(&sc->sc_init_complete, &sc->sc_mtx,
2119 		    0, "iwminit", 2*hz)) != 0)
2120 			break;
2121 
2122 	return error;
2123 }
2124 
2125 /*
2126  * receive side
2127  */
2128 
2129 /* (re)stock rx ring, called at init-time and at runtime */
2130 static int
2131 iwm_rx_addbuf(struct iwm_softc *sc, int size, int idx)
2132 {
2133 	struct iwm_rx_ring *ring = &sc->rxq;
2134 	struct iwm_rx_data *data = &ring->data[idx];
2135 	struct mbuf *m;
2136 	int error;
2137 	bus_addr_t paddr;
2138 
2139 	m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWM_RBUF_SIZE);
2140 	if (m == NULL)
2141 		return ENOBUFS;
2142 
2143 	if (data->m != NULL)
2144 		bus_dmamap_unload(ring->data_dmat, data->map);
2145 
2146 	m->m_len = m->m_pkthdr.len = m->m_ext.ext_size;
2147 	error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
2148 	if (error != 0) {
2149 		device_printf(sc->sc_dev,
2150 		    "%s: could not create RX buf DMA map, error %d\n",
2151 		    __func__, error);
2152 		goto fail;
2153 	}
2154 	data->m = m;
2155 	error = bus_dmamap_load(ring->data_dmat, data->map,
2156 	    mtod(data->m, void *), IWM_RBUF_SIZE, iwm_dma_map_addr,
2157 	    &paddr, BUS_DMA_NOWAIT);
2158 	if (error != 0 && error != EFBIG) {
2159 		device_printf(sc->sc_dev,
2160 		    "%s: can't not map mbuf, error %d\n", __func__,
2161 		    error);
2162 		goto fail;
2163 	}
2164 	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREREAD);
2165 
2166 	/* Update RX descriptor. */
2167 	ring->desc[idx] = htole32(paddr >> 8);
2168 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2169 	    BUS_DMASYNC_PREWRITE);
2170 
2171 	return 0;
2172 fail:
2173 	return error;
2174 }
2175 
2176 /* iwlwifi: mvm/rx.c */
2177 #define IWM_RSSI_OFFSET 50
2178 static int
2179 iwm_mvm_calc_rssi(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info)
2180 {
2181 	int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm;
2182 	uint32_t agc_a, agc_b;
2183 	uint32_t val;
2184 
2185 	val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_AGC_IDX]);
2186 	agc_a = (val & IWM_OFDM_AGC_A_MSK) >> IWM_OFDM_AGC_A_POS;
2187 	agc_b = (val & IWM_OFDM_AGC_B_MSK) >> IWM_OFDM_AGC_B_POS;
2188 
2189 	val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_RSSI_AB_IDX]);
2190 	rssi_a = (val & IWM_OFDM_RSSI_INBAND_A_MSK) >> IWM_OFDM_RSSI_A_POS;
2191 	rssi_b = (val & IWM_OFDM_RSSI_INBAND_B_MSK) >> IWM_OFDM_RSSI_B_POS;
2192 
2193 	/*
2194 	 * dBm = rssi dB - agc dB - constant.
2195 	 * Higher AGC (higher radio gain) means lower signal.
2196 	 */
2197 	rssi_a_dbm = rssi_a - IWM_RSSI_OFFSET - agc_a;
2198 	rssi_b_dbm = rssi_b - IWM_RSSI_OFFSET - agc_b;
2199 	max_rssi_dbm = MAX(rssi_a_dbm, rssi_b_dbm);
2200 
2201 	IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2202 	    "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n",
2203 	    rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b);
2204 
2205 	return max_rssi_dbm;
2206 }
2207 
2208 /* iwlwifi: mvm/rx.c */
2209 /*
2210  * iwm_mvm_get_signal_strength - use new rx PHY INFO API
2211  * values are reported by the fw as positive values - need to negate
2212  * to obtain their dBM.  Account for missing antennas by replacing 0
2213  * values by -256dBm: practically 0 power and a non-feasible 8 bit value.
2214  */
2215 static int
2216 iwm_mvm_get_signal_strength(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info)
2217 {
2218 	int energy_a, energy_b, energy_c, max_energy;
2219 	uint32_t val;
2220 
2221 	val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_ENERGY_ANT_ABC_IDX]);
2222 	energy_a = (val & IWM_RX_INFO_ENERGY_ANT_A_MSK) >>
2223 	    IWM_RX_INFO_ENERGY_ANT_A_POS;
2224 	energy_a = energy_a ? -energy_a : -256;
2225 	energy_b = (val & IWM_RX_INFO_ENERGY_ANT_B_MSK) >>
2226 	    IWM_RX_INFO_ENERGY_ANT_B_POS;
2227 	energy_b = energy_b ? -energy_b : -256;
2228 	energy_c = (val & IWM_RX_INFO_ENERGY_ANT_C_MSK) >>
2229 	    IWM_RX_INFO_ENERGY_ANT_C_POS;
2230 	energy_c = energy_c ? -energy_c : -256;
2231 	max_energy = MAX(energy_a, energy_b);
2232 	max_energy = MAX(max_energy, energy_c);
2233 
2234 	IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2235 	    "energy In A %d B %d C %d , and max %d\n",
2236 	    energy_a, energy_b, energy_c, max_energy);
2237 
2238 	return max_energy;
2239 }
2240 
2241 static void
2242 iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *sc,
2243 	struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
2244 {
2245 	struct iwm_rx_phy_info *phy_info = (void *)pkt->data;
2246 
2247 	IWM_DPRINTF(sc, IWM_DEBUG_RECV, "received PHY stats\n");
2248 	bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2249 
2250 	memcpy(&sc->sc_last_phy_info, phy_info, sizeof(sc->sc_last_phy_info));
2251 }
2252 
2253 /*
2254  * Retrieve the average noise (in dBm) among receivers.
2255  */
2256 static int
2257 iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *stats)
2258 {
2259 	int i, total, nbant, noise;
2260 
2261 	total = nbant = noise = 0;
2262 	for (i = 0; i < 3; i++) {
2263 		noise = le32toh(stats->beacon_silence_rssi[i]) & 0xff;
2264 		if (noise) {
2265 			total += noise;
2266 			nbant++;
2267 		}
2268 	}
2269 
2270 	/* There should be at least one antenna but check anyway. */
2271 	return (nbant == 0) ? -127 : (total / nbant) - 107;
2272 }
2273 
2274 /*
2275  * iwm_mvm_rx_rx_mpdu - IWM_REPLY_RX_MPDU_CMD handler
2276  *
2277  * Handles the actual data of the Rx packet from the fw
2278  */
2279 static void
2280 iwm_mvm_rx_rx_mpdu(struct iwm_softc *sc,
2281 	struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
2282 {
2283 	struct ieee80211com *ic = &sc->sc_ic;
2284 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2285 	struct ieee80211_frame *wh;
2286 	struct ieee80211_node *ni;
2287 	struct ieee80211_rx_stats rxs;
2288 	struct mbuf *m;
2289 	struct iwm_rx_phy_info *phy_info;
2290 	struct iwm_rx_mpdu_res_start *rx_res;
2291 	uint32_t len;
2292 	uint32_t rx_pkt_status;
2293 	int rssi;
2294 
2295 	bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2296 
2297 	phy_info = &sc->sc_last_phy_info;
2298 	rx_res = (struct iwm_rx_mpdu_res_start *)pkt->data;
2299 	wh = (struct ieee80211_frame *)(pkt->data + sizeof(*rx_res));
2300 	len = le16toh(rx_res->byte_count);
2301 	rx_pkt_status = le32toh(*(uint32_t *)(pkt->data + sizeof(*rx_res) + len));
2302 
2303 	m = data->m;
2304 	m->m_data = pkt->data + sizeof(*rx_res);
2305 	m->m_pkthdr.len = m->m_len = len;
2306 
2307 	if (__predict_false(phy_info->cfg_phy_cnt > 20)) {
2308 		device_printf(sc->sc_dev,
2309 		    "dsp size out of range [0,20]: %d\n",
2310 		    phy_info->cfg_phy_cnt);
2311 		return;
2312 	}
2313 
2314 	if (!(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_CRC_OK) ||
2315 	    !(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_OVERRUN_OK)) {
2316 		IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2317 		    "Bad CRC or FIFO: 0x%08X.\n", rx_pkt_status);
2318 		return; /* drop */
2319 	}
2320 
2321 	if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_RX_ENERGY_API) {
2322 		rssi = iwm_mvm_get_signal_strength(sc, phy_info);
2323 	} else {
2324 		rssi = iwm_mvm_calc_rssi(sc, phy_info);
2325 	}
2326 	rssi = (0 - IWM_MIN_DBM) + rssi;	/* normalize */
2327 	rssi = MIN(rssi, sc->sc_max_rssi);	/* clip to max. 100% */
2328 
2329 	/* replenish ring for the buffer we're going to feed to the sharks */
2330 	if (iwm_rx_addbuf(sc, IWM_RBUF_SIZE, sc->rxq.cur) != 0) {
2331 		device_printf(sc->sc_dev, "%s: unable to add more buffers\n",
2332 		    __func__);
2333 		return;
2334 	}
2335 
2336 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
2337 
2338 	IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2339 	    "%s: phy_info: channel=%d, flags=0x%08x\n",
2340 	    __func__,
2341 	    le16toh(phy_info->channel),
2342 	    le16toh(phy_info->phy_flags));
2343 
2344 	/*
2345 	 * Populate an RX state struct with the provided information.
2346 	 */
2347 	bzero(&rxs, sizeof(rxs));
2348 	rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ;
2349 	rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
2350 	rxs.c_ieee = le16toh(phy_info->channel);
2351 	if (le16toh(phy_info->phy_flags & IWM_RX_RES_PHY_FLAGS_BAND_24)) {
2352 		rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ);
2353 	} else {
2354 		rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_5GHZ);
2355 	}
2356 	rxs.rssi = rssi - sc->sc_noise;
2357 	rxs.nf = sc->sc_noise;
2358 
2359 	if (ieee80211_radiotap_active_vap(vap)) {
2360 		struct iwm_rx_radiotap_header *tap = &sc->sc_rxtap;
2361 
2362 		tap->wr_flags = 0;
2363 		if (phy_info->phy_flags & htole16(IWM_PHY_INFO_FLAG_SHPREAMBLE))
2364 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2365 		tap->wr_chan_freq = htole16(rxs.c_freq);
2366 		/* XXX only if ic->ic_curchan->ic_ieee == rxs.c_ieee */
2367 		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2368 		tap->wr_dbm_antsignal = (int8_t)rssi;
2369 		tap->wr_dbm_antnoise = (int8_t)sc->sc_noise;
2370 		tap->wr_tsft = phy_info->system_timestamp;
2371 		switch (phy_info->rate) {
2372 		/* CCK rates. */
2373 		case  10: tap->wr_rate =   2; break;
2374 		case  20: tap->wr_rate =   4; break;
2375 		case  55: tap->wr_rate =  11; break;
2376 		case 110: tap->wr_rate =  22; break;
2377 		/* OFDM rates. */
2378 		case 0xd: tap->wr_rate =  12; break;
2379 		case 0xf: tap->wr_rate =  18; break;
2380 		case 0x5: tap->wr_rate =  24; break;
2381 		case 0x7: tap->wr_rate =  36; break;
2382 		case 0x9: tap->wr_rate =  48; break;
2383 		case 0xb: tap->wr_rate =  72; break;
2384 		case 0x1: tap->wr_rate =  96; break;
2385 		case 0x3: tap->wr_rate = 108; break;
2386 		/* Unknown rate: should not happen. */
2387 		default:  tap->wr_rate =   0;
2388 		}
2389 	}
2390 
2391 	IWM_UNLOCK(sc);
2392 	if (ni != NULL) {
2393 		IWM_DPRINTF(sc, IWM_DEBUG_RECV, "input m %p\n", m);
2394 		ieee80211_input_mimo(ni, m, &rxs);
2395 		ieee80211_free_node(ni);
2396 	} else {
2397 		IWM_DPRINTF(sc, IWM_DEBUG_RECV, "inputall m %p\n", m);
2398 		ieee80211_input_mimo_all(ic, m, &rxs);
2399 	}
2400 	IWM_LOCK(sc);
2401 }
2402 
2403 static void
2404 iwm_mvm_rx_tx_cmd_single(struct iwm_softc *sc, struct iwm_rx_packet *pkt,
2405 	struct iwm_node *in)
2406 {
2407 	struct iwm_mvm_tx_resp *tx_resp = (void *)pkt->data;
2408 	struct ieee80211vap *vap = in->in_ni.ni_vap;
2409 	int status = le16toh(tx_resp->status.status) & IWM_TX_STATUS_MSK;
2410 	int failack = tx_resp->failure_frame;
2411 
2412 	KASSERT(tx_resp->frame_count == 1, ("too many frames"));
2413 
2414 	/* Update rate control statistics. */
2415 	if (status != IWM_TX_STATUS_SUCCESS &&
2416 	    status != IWM_TX_STATUS_DIRECT_DONE) {
2417 		if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
2418 		ieee80211_ratectl_tx_complete(vap, &in->in_ni,
2419 		    IEEE80211_RATECTL_TX_FAILURE, &failack, NULL);
2420 	} else {
2421 		if_inc_counter(vap->iv_ifp, IFCOUNTER_OPACKETS, 1);
2422 		ieee80211_ratectl_tx_complete(vap, &in->in_ni,
2423 		    IEEE80211_RATECTL_TX_SUCCESS, &failack, NULL);
2424 
2425 	}
2426 }
2427 
2428 static void
2429 iwm_mvm_rx_tx_cmd(struct iwm_softc *sc,
2430 	struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
2431 {
2432 	struct iwm_cmd_header *cmd_hdr = &pkt->hdr;
2433 	int idx = cmd_hdr->idx;
2434 	int qid = cmd_hdr->qid;
2435 	struct iwm_tx_ring *ring = &sc->txq[qid];
2436 	struct iwm_tx_data *txd = &ring->data[idx];
2437 	struct iwm_node *in = txd->in;
2438 
2439 	if (txd->done) {
2440 		device_printf(sc->sc_dev,
2441 		    "%s: got tx interrupt that's already been handled!\n",
2442 		    __func__);
2443 		return;
2444 	}
2445 	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2446 
2447 	sc->sc_tx_timer = 0;
2448 
2449 	iwm_mvm_rx_tx_cmd_single(sc, pkt, in);
2450 
2451 	/* Unmap and free mbuf. */
2452 	bus_dmamap_sync(ring->data_dmat, txd->map, BUS_DMASYNC_POSTWRITE);
2453 	bus_dmamap_unload(ring->data_dmat, txd->map);
2454 	m_freem(txd->m);
2455 
2456 	IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2457 	    "free txd %p, in %p\n", txd, txd->in);
2458 	KASSERT(txd->done == 0, ("txd not done"));
2459 	txd->done = 1;
2460 	KASSERT(txd->in, ("txd without node"));
2461 
2462 	txd->m = NULL;
2463 	txd->in = NULL;
2464 	ieee80211_free_node((struct ieee80211_node *)in);
2465 
2466 	if (--ring->queued < IWM_TX_RING_LOMARK) {
2467 		sc->qfullmsk &= ~(1 << ring->qid);
2468 		if (sc->qfullmsk == 0) {
2469 			/*
2470 			 * Well, we're in interrupt context, but then again
2471 			 * I guess net80211 does all sorts of stunts in
2472 			 * interrupt context, so maybe this is no biggie.
2473 			 */
2474 			iwm_start(sc);
2475 		}
2476 	}
2477 }
2478 
2479 /*
2480  * transmit side
2481  */
2482 
2483 /*
2484  * Process a "command done" firmware notification.  This is where we wakeup
2485  * processes waiting for a synchronous command completion.
2486  * from if_iwn
2487  */
2488 static void
2489 iwm_cmd_done(struct iwm_softc *sc, struct iwm_rx_packet *pkt)
2490 {
2491 	struct iwm_tx_ring *ring = &sc->txq[IWM_MVM_CMD_QUEUE];
2492 	struct iwm_tx_data *data;
2493 
2494 	if (pkt->hdr.qid != IWM_MVM_CMD_QUEUE) {
2495 		return;	/* Not a command ack. */
2496 	}
2497 
2498 	data = &ring->data[pkt->hdr.idx];
2499 
2500 	/* If the command was mapped in an mbuf, free it. */
2501 	if (data->m != NULL) {
2502 		bus_dmamap_sync(ring->data_dmat, data->map,
2503 		    BUS_DMASYNC_POSTWRITE);
2504 		bus_dmamap_unload(ring->data_dmat, data->map);
2505 		m_freem(data->m);
2506 		data->m = NULL;
2507 	}
2508 	wakeup(&ring->desc[pkt->hdr.idx]);
2509 }
2510 
2511 #if 0
2512 /*
2513  * necessary only for block ack mode
2514  */
2515 void
2516 iwm_update_sched(struct iwm_softc *sc, int qid, int idx, uint8_t sta_id,
2517 	uint16_t len)
2518 {
2519 	struct iwm_agn_scd_bc_tbl *scd_bc_tbl;
2520 	uint16_t w_val;
2521 
2522 	scd_bc_tbl = sc->sched_dma.vaddr;
2523 
2524 	len += 8; /* magic numbers came naturally from paris */
2525 	if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_DW_BC_TABLE)
2526 		len = roundup(len, 4) / 4;
2527 
2528 	w_val = htole16(sta_id << 12 | len);
2529 
2530 	/* Update TX scheduler. */
2531 	scd_bc_tbl[qid].tfd_offset[idx] = w_val;
2532 	bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
2533 	    BUS_DMASYNC_PREWRITE);
2534 
2535 	/* I really wonder what this is ?!? */
2536 	if (idx < IWM_TFD_QUEUE_SIZE_BC_DUP) {
2537 		scd_bc_tbl[qid].tfd_offset[IWM_TFD_QUEUE_SIZE_MAX + idx] = w_val;
2538 		bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
2539 		    BUS_DMASYNC_PREWRITE);
2540 	}
2541 }
2542 #endif
2543 
2544 /*
2545  * Take an 802.11 (non-n) rate, find the relevant rate
2546  * table entry.  return the index into in_ridx[].
2547  *
2548  * The caller then uses that index back into in_ridx
2549  * to figure out the rate index programmed /into/
2550  * the firmware for this given node.
2551  */
2552 static int
2553 iwm_tx_rateidx_lookup(struct iwm_softc *sc, struct iwm_node *in,
2554     uint8_t rate)
2555 {
2556 	int i;
2557 	uint8_t r;
2558 
2559 	for (i = 0; i < nitems(in->in_ridx); i++) {
2560 		r = iwm_rates[in->in_ridx[i]].rate;
2561 		if (rate == r)
2562 			return (i);
2563 	}
2564 	/* XXX Return the first */
2565 	/* XXX TODO: have it return the /lowest/ */
2566 	return (0);
2567 }
2568 
2569 /*
2570  * Fill in various bit for management frames, and leave them
2571  * unfilled for data frames (firmware takes care of that).
2572  * Return the selected TX rate.
2573  */
2574 static const struct iwm_rate *
2575 iwm_tx_fill_cmd(struct iwm_softc *sc, struct iwm_node *in,
2576 	struct ieee80211_frame *wh, struct iwm_tx_cmd *tx)
2577 {
2578 	struct ieee80211com *ic = &sc->sc_ic;
2579 	struct ieee80211_node *ni = &in->in_ni;
2580 	const struct iwm_rate *rinfo;
2581 	int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2582 	int ridx, rate_flags;
2583 
2584 	tx->rts_retry_limit = IWM_RTS_DFAULT_RETRY_LIMIT;
2585 	tx->data_retry_limit = IWM_DEFAULT_TX_RETRY;
2586 
2587 	/*
2588 	 * XXX TODO: everything about the rate selection here is terrible!
2589 	 */
2590 
2591 	if (type == IEEE80211_FC0_TYPE_DATA) {
2592 		int i;
2593 		/* for data frames, use RS table */
2594 		(void) ieee80211_ratectl_rate(ni, NULL, 0);
2595 		i = iwm_tx_rateidx_lookup(sc, in, ni->ni_txrate);
2596 		ridx = in->in_ridx[i];
2597 
2598 		/* This is the index into the programmed table */
2599 		tx->initial_rate_index = i;
2600 		tx->tx_flags |= htole32(IWM_TX_CMD_FLG_STA_RATE);
2601 		IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE,
2602 		    "%s: start with i=%d, txrate %d\n",
2603 		    __func__, i, iwm_rates[ridx].rate);
2604 		/* XXX no rate_n_flags? */
2605 		return &iwm_rates[ridx];
2606 	}
2607 
2608 	/*
2609 	 * For non-data, use the lowest supported rate for the given
2610 	 * operational mode.
2611 	 *
2612 	 * Note: there may not be any rate control information available.
2613 	 * This driver currently assumes if we're transmitting data
2614 	 * frames, use the rate control table.  Grr.
2615 	 *
2616 	 * XXX TODO: use the configured rate for the traffic type!
2617 	 */
2618 	if (ic->ic_curmode == IEEE80211_MODE_11A) {
2619 		/*
2620 		 * XXX this assumes the mode is either 11a or not 11a;
2621 		 * definitely won't work for 11n.
2622 		 */
2623 		ridx = IWM_RIDX_OFDM;
2624 	} else {
2625 		ridx = IWM_RIDX_CCK;
2626 	}
2627 
2628 	rinfo = &iwm_rates[ridx];
2629 
2630 	IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, "%s: ridx=%d; rate=%d, CCK=%d\n",
2631 	    __func__, ridx,
2632 	    rinfo->rate,
2633 	    !! (IWM_RIDX_IS_CCK(ridx))
2634 	    );
2635 
2636 	/* XXX TODO: hard-coded TX antenna? */
2637 	rate_flags = 1 << IWM_RATE_MCS_ANT_POS;
2638 	if (IWM_RIDX_IS_CCK(ridx))
2639 		rate_flags |= IWM_RATE_MCS_CCK_MSK;
2640 	/* XXX hard-coded tx rate */
2641 	tx->rate_n_flags = htole32(rate_flags | rinfo->plcp);
2642 
2643 	return rinfo;
2644 }
2645 
2646 #define TB0_SIZE 16
2647 static int
2648 iwm_tx(struct iwm_softc *sc, struct mbuf *m, struct ieee80211_node *ni, int ac)
2649 {
2650 	struct ieee80211com *ic = &sc->sc_ic;
2651 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2652 	struct iwm_node *in = (struct iwm_node *)ni;
2653 	struct iwm_tx_ring *ring;
2654 	struct iwm_tx_data *data;
2655 	struct iwm_tfd *desc;
2656 	struct iwm_device_cmd *cmd;
2657 	struct iwm_tx_cmd *tx;
2658 	struct ieee80211_frame *wh;
2659 	struct ieee80211_key *k = NULL;
2660 	struct mbuf *m1;
2661 	const struct iwm_rate *rinfo;
2662 	uint32_t flags;
2663 	u_int hdrlen;
2664 	bus_dma_segment_t *seg, segs[IWM_MAX_SCATTER];
2665 	int nsegs;
2666 	uint8_t tid, type;
2667 	int i, totlen, error, pad;
2668 
2669 	wh = mtod(m, struct ieee80211_frame *);
2670 	hdrlen = ieee80211_anyhdrsize(wh);
2671 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2672 	tid = 0;
2673 	ring = &sc->txq[ac];
2674 	desc = &ring->desc[ring->cur];
2675 	memset(desc, 0, sizeof(*desc));
2676 	data = &ring->data[ring->cur];
2677 
2678 	/* Fill out iwm_tx_cmd to send to the firmware */
2679 	cmd = &ring->cmd[ring->cur];
2680 	cmd->hdr.code = IWM_TX_CMD;
2681 	cmd->hdr.flags = 0;
2682 	cmd->hdr.qid = ring->qid;
2683 	cmd->hdr.idx = ring->cur;
2684 
2685 	tx = (void *)cmd->data;
2686 	memset(tx, 0, sizeof(*tx));
2687 
2688 	rinfo = iwm_tx_fill_cmd(sc, in, wh, tx);
2689 
2690 	/* Encrypt the frame if need be. */
2691 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2692 		/* Retrieve key for TX && do software encryption. */
2693 		k = ieee80211_crypto_encap(ni, m);
2694 		if (k == NULL) {
2695 			m_freem(m);
2696 			return (ENOBUFS);
2697 		}
2698 		/* 802.11 header may have moved. */
2699 		wh = mtod(m, struct ieee80211_frame *);
2700 	}
2701 
2702 	if (ieee80211_radiotap_active_vap(vap)) {
2703 		struct iwm_tx_radiotap_header *tap = &sc->sc_txtap;
2704 
2705 		tap->wt_flags = 0;
2706 		tap->wt_chan_freq = htole16(ni->ni_chan->ic_freq);
2707 		tap->wt_chan_flags = htole16(ni->ni_chan->ic_flags);
2708 		tap->wt_rate = rinfo->rate;
2709 		tap->wt_hwqueue = ac;
2710 		if (k != NULL)
2711 			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2712 		ieee80211_radiotap_tx(vap, m);
2713 	}
2714 
2715 
2716 	totlen = m->m_pkthdr.len;
2717 
2718 	flags = 0;
2719 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2720 		flags |= IWM_TX_CMD_FLG_ACK;
2721 	}
2722 
2723 	if (type != IEEE80211_FC0_TYPE_DATA
2724 	    && (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2725 	    && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2726 		flags |= IWM_TX_CMD_FLG_PROT_REQUIRE;
2727 	}
2728 
2729 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
2730 	    type != IEEE80211_FC0_TYPE_DATA)
2731 		tx->sta_id = sc->sc_aux_sta.sta_id;
2732 	else
2733 		tx->sta_id = IWM_STATION_ID;
2734 
2735 	if (type == IEEE80211_FC0_TYPE_MGT) {
2736 		uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2737 
2738 		if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
2739 		    subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
2740 			tx->pm_frame_timeout = htole16(3);
2741 		else
2742 			tx->pm_frame_timeout = htole16(2);
2743 	} else {
2744 		tx->pm_frame_timeout = htole16(0);
2745 	}
2746 
2747 	if (hdrlen & 3) {
2748 		/* First segment length must be a multiple of 4. */
2749 		flags |= IWM_TX_CMD_FLG_MH_PAD;
2750 		pad = 4 - (hdrlen & 3);
2751 	} else
2752 		pad = 0;
2753 
2754 	tx->driver_txop = 0;
2755 	tx->next_frame_len = 0;
2756 
2757 	tx->len = htole16(totlen);
2758 	tx->tid_tspec = tid;
2759 	tx->life_time = htole32(IWM_TX_CMD_LIFE_TIME_INFINITE);
2760 
2761 	/* Set physical address of "scratch area". */
2762 	tx->dram_lsb_ptr = htole32(data->scratch_paddr);
2763 	tx->dram_msb_ptr = iwm_get_dma_hi_addr(data->scratch_paddr);
2764 
2765 	/* Copy 802.11 header in TX command. */
2766 	memcpy(((uint8_t *)tx) + sizeof(*tx), wh, hdrlen);
2767 
2768 	flags |= IWM_TX_CMD_FLG_BT_DIS | IWM_TX_CMD_FLG_SEQ_CTL;
2769 
2770 	tx->sec_ctl = 0;
2771 	tx->tx_flags |= htole32(flags);
2772 
2773 	/* Trim 802.11 header. */
2774 	m_adj(m, hdrlen);
2775 	error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
2776 	    segs, &nsegs, BUS_DMA_NOWAIT);
2777 	if (error != 0) {
2778 		if (error != EFBIG) {
2779 			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
2780 			    error);
2781 			m_freem(m);
2782 			return error;
2783 		}
2784 		/* Too many DMA segments, linearize mbuf. */
2785 		MGETHDR(m1, M_NOWAIT, MT_DATA);
2786 		if (m1 == NULL) {
2787 			m_freem(m);
2788 			return ENOBUFS;
2789 		}
2790 		if (m->m_pkthdr.len > MHLEN) {
2791 			MCLGET(m1, M_NOWAIT);
2792 			if (!(m1->m_flags & M_EXT)) {
2793 				m_freem(m);
2794 				m_freem(m1);
2795 				return ENOBUFS;
2796 			}
2797 		}
2798 		m_copydata(m, 0, m->m_pkthdr.len, mtod(m1, void *));
2799 		m1->m_pkthdr.len = m1->m_len = m->m_pkthdr.len;
2800 		m_freem(m);
2801 		m = m1;
2802 		error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
2803 		    segs, &nsegs, BUS_DMA_NOWAIT);
2804 		if (error != 0) {
2805 			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
2806 			    error);
2807 			m_freem(m);
2808 			return error;
2809 		}
2810 	}
2811 	data->m = m;
2812 	data->in = in;
2813 	data->done = 0;
2814 
2815 	IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2816 	    "sending txd %p, in %p\n", data, data->in);
2817 	KASSERT(data->in != NULL, ("node is NULL"));
2818 
2819 	IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2820 	    "sending data: qid=%d idx=%d len=%d nsegs=%d\n",
2821 	    ring->qid, ring->cur, totlen, nsegs);
2822 
2823 	/* Fill TX descriptor. */
2824 	desc->num_tbs = 2 + nsegs;
2825 
2826 	desc->tbs[0].lo = htole32(data->cmd_paddr);
2827 	desc->tbs[0].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) |
2828 	    (TB0_SIZE << 4);
2829 	desc->tbs[1].lo = htole32(data->cmd_paddr + TB0_SIZE);
2830 	desc->tbs[1].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) |
2831 	    ((sizeof(struct iwm_cmd_header) + sizeof(*tx)
2832 	      + hdrlen + pad - TB0_SIZE) << 4);
2833 
2834 	/* Other DMA segments are for data payload. */
2835 	for (i = 0; i < nsegs; i++) {
2836 		seg = &segs[i];
2837 		desc->tbs[i+2].lo = htole32(seg->ds_addr);
2838 		desc->tbs[i+2].hi_n_len = \
2839 		    htole16(iwm_get_dma_hi_addr(seg->ds_addr))
2840 		    | ((seg->ds_len) << 4);
2841 	}
2842 
2843 	bus_dmamap_sync(ring->data_dmat, data->map,
2844 	    BUS_DMASYNC_PREWRITE);
2845 	bus_dmamap_sync(ring->cmd_dma.tag, ring->cmd_dma.map,
2846 	    BUS_DMASYNC_PREWRITE);
2847 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2848 	    BUS_DMASYNC_PREWRITE);
2849 
2850 #if 0
2851 	iwm_update_sched(sc, ring->qid, ring->cur, tx->sta_id, le16toh(tx->len));
2852 #endif
2853 
2854 	/* Kick TX ring. */
2855 	ring->cur = (ring->cur + 1) % IWM_TX_RING_COUNT;
2856 	IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
2857 
2858 	/* Mark TX ring as full if we reach a certain threshold. */
2859 	if (++ring->queued > IWM_TX_RING_HIMARK) {
2860 		sc->qfullmsk |= 1 << ring->qid;
2861 	}
2862 
2863 	return 0;
2864 }
2865 
2866 static int
2867 iwm_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2868     const struct ieee80211_bpf_params *params)
2869 {
2870 	struct ieee80211com *ic = ni->ni_ic;
2871 	struct iwm_softc *sc = ic->ic_softc;
2872 	int error = 0;
2873 
2874 	IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2875 	    "->%s begin\n", __func__);
2876 
2877 	if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
2878 		ieee80211_free_node(ni);
2879 		m_freem(m);
2880 		IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2881 		    "<-%s not RUNNING\n", __func__);
2882 		return (ENETDOWN);
2883         }
2884 
2885 	IWM_LOCK(sc);
2886 	/* XXX fix this */
2887         if (params == NULL) {
2888 		error = iwm_tx(sc, m, ni, 0);
2889 	} else {
2890 		error = iwm_tx(sc, m, ni, 0);
2891 	}
2892 	if (error != 0) {
2893 		/* NB: m is reclaimed on tx failure */
2894 		ieee80211_free_node(ni);
2895 	}
2896 	sc->sc_tx_timer = 5;
2897 	IWM_UNLOCK(sc);
2898 
2899         return (error);
2900 }
2901 
2902 /*
2903  * mvm/tx.c
2904  */
2905 
2906 #if 0
2907 /*
2908  * Note that there are transports that buffer frames before they reach
2909  * the firmware. This means that after flush_tx_path is called, the
2910  * queue might not be empty. The race-free way to handle this is to:
2911  * 1) set the station as draining
2912  * 2) flush the Tx path
2913  * 3) wait for the transport queues to be empty
2914  */
2915 int
2916 iwm_mvm_flush_tx_path(struct iwm_softc *sc, int tfd_msk, int sync)
2917 {
2918 	struct iwm_tx_path_flush_cmd flush_cmd = {
2919 		.queues_ctl = htole32(tfd_msk),
2920 		.flush_ctl = htole16(IWM_DUMP_TX_FIFO_FLUSH),
2921 	};
2922 	int ret;
2923 
2924 	ret = iwm_mvm_send_cmd_pdu(sc, IWM_TXPATH_FLUSH,
2925 	    sync ? IWM_CMD_SYNC : IWM_CMD_ASYNC,
2926 	    sizeof(flush_cmd), &flush_cmd);
2927 	if (ret)
2928                 device_printf(sc->sc_dev,
2929 		    "Flushing tx queue failed: %d\n", ret);
2930 	return ret;
2931 }
2932 #endif
2933 
2934 /*
2935  * BEGIN mvm/sta.c
2936  */
2937 
2938 static void
2939 iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *cmd_v6,
2940 	struct iwm_mvm_add_sta_cmd_v5 *cmd_v5)
2941 {
2942 	memset(cmd_v5, 0, sizeof(*cmd_v5));
2943 
2944 	cmd_v5->add_modify = cmd_v6->add_modify;
2945 	cmd_v5->tid_disable_tx = cmd_v6->tid_disable_tx;
2946 	cmd_v5->mac_id_n_color = cmd_v6->mac_id_n_color;
2947 	IEEE80211_ADDR_COPY(cmd_v5->addr, cmd_v6->addr);
2948 	cmd_v5->sta_id = cmd_v6->sta_id;
2949 	cmd_v5->modify_mask = cmd_v6->modify_mask;
2950 	cmd_v5->station_flags = cmd_v6->station_flags;
2951 	cmd_v5->station_flags_msk = cmd_v6->station_flags_msk;
2952 	cmd_v5->add_immediate_ba_tid = cmd_v6->add_immediate_ba_tid;
2953 	cmd_v5->remove_immediate_ba_tid = cmd_v6->remove_immediate_ba_tid;
2954 	cmd_v5->add_immediate_ba_ssn = cmd_v6->add_immediate_ba_ssn;
2955 	cmd_v5->sleep_tx_count = cmd_v6->sleep_tx_count;
2956 	cmd_v5->sleep_state_flags = cmd_v6->sleep_state_flags;
2957 	cmd_v5->assoc_id = cmd_v6->assoc_id;
2958 	cmd_v5->beamform_flags = cmd_v6->beamform_flags;
2959 	cmd_v5->tfd_queue_msk = cmd_v6->tfd_queue_msk;
2960 }
2961 
2962 static int
2963 iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *sc,
2964 	struct iwm_mvm_add_sta_cmd_v6 *cmd, int *status)
2965 {
2966 	struct iwm_mvm_add_sta_cmd_v5 cmd_v5;
2967 
2968 	if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_STA_KEY_CMD) {
2969 		return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA,
2970 		    sizeof(*cmd), cmd, status);
2971 	}
2972 
2973 	iwm_mvm_add_sta_cmd_v6_to_v5(cmd, &cmd_v5);
2974 
2975 	return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA, sizeof(cmd_v5),
2976 	    &cmd_v5, status);
2977 }
2978 
2979 /* send station add/update command to firmware */
2980 static int
2981 iwm_mvm_sta_send_to_fw(struct iwm_softc *sc, struct iwm_node *in, int update)
2982 {
2983 	struct iwm_mvm_add_sta_cmd_v6 add_sta_cmd;
2984 	int ret;
2985 	uint32_t status;
2986 
2987 	memset(&add_sta_cmd, 0, sizeof(add_sta_cmd));
2988 
2989 	add_sta_cmd.sta_id = IWM_STATION_ID;
2990 	add_sta_cmd.mac_id_n_color
2991 	    = htole32(IWM_FW_CMD_ID_AND_COLOR(IWM_DEFAULT_MACID,
2992 	        IWM_DEFAULT_COLOR));
2993 	if (!update) {
2994 		add_sta_cmd.tfd_queue_msk = htole32(0xf);
2995 		IEEE80211_ADDR_COPY(&add_sta_cmd.addr, in->in_ni.ni_bssid);
2996 	}
2997 	add_sta_cmd.add_modify = update ? 1 : 0;
2998 	add_sta_cmd.station_flags_msk
2999 	    |= htole32(IWM_STA_FLG_FAT_EN_MSK | IWM_STA_FLG_MIMO_EN_MSK);
3000 
3001 	status = IWM_ADD_STA_SUCCESS;
3002 	ret = iwm_mvm_send_add_sta_cmd_status(sc, &add_sta_cmd, &status);
3003 	if (ret)
3004 		return ret;
3005 
3006 	switch (status) {
3007 	case IWM_ADD_STA_SUCCESS:
3008 		break;
3009 	default:
3010 		ret = EIO;
3011 		device_printf(sc->sc_dev, "IWM_ADD_STA failed\n");
3012 		break;
3013 	}
3014 
3015 	return ret;
3016 }
3017 
3018 static int
3019 iwm_mvm_add_sta(struct iwm_softc *sc, struct iwm_node *in)
3020 {
3021 	int ret;
3022 
3023 	ret = iwm_mvm_sta_send_to_fw(sc, in, 0);
3024 	if (ret)
3025 		return ret;
3026 
3027 	return 0;
3028 }
3029 
3030 static int
3031 iwm_mvm_update_sta(struct iwm_softc *sc, struct iwm_node *in)
3032 {
3033 	return iwm_mvm_sta_send_to_fw(sc, in, 1);
3034 }
3035 
3036 static int
3037 iwm_mvm_add_int_sta_common(struct iwm_softc *sc, struct iwm_int_sta *sta,
3038 	const uint8_t *addr, uint16_t mac_id, uint16_t color)
3039 {
3040 	struct iwm_mvm_add_sta_cmd_v6 cmd;
3041 	int ret;
3042 	uint32_t status;
3043 
3044 	memset(&cmd, 0, sizeof(cmd));
3045 	cmd.sta_id = sta->sta_id;
3046 	cmd.mac_id_n_color = htole32(IWM_FW_CMD_ID_AND_COLOR(mac_id, color));
3047 
3048 	cmd.tfd_queue_msk = htole32(sta->tfd_queue_msk);
3049 
3050 	if (addr)
3051 		IEEE80211_ADDR_COPY(cmd.addr, addr);
3052 
3053 	ret = iwm_mvm_send_add_sta_cmd_status(sc, &cmd, &status);
3054 	if (ret)
3055 		return ret;
3056 
3057 	switch (status) {
3058 	case IWM_ADD_STA_SUCCESS:
3059 		IWM_DPRINTF(sc, IWM_DEBUG_RESET,
3060 		    "%s: Internal station added.\n", __func__);
3061 		return 0;
3062 	default:
3063 		device_printf(sc->sc_dev,
3064 		    "%s: Add internal station failed, status=0x%x\n",
3065 		    __func__, status);
3066 		ret = EIO;
3067 		break;
3068 	}
3069 	return ret;
3070 }
3071 
3072 static int
3073 iwm_mvm_add_aux_sta(struct iwm_softc *sc)
3074 {
3075 	int ret;
3076 
3077 	sc->sc_aux_sta.sta_id = 3;
3078 	sc->sc_aux_sta.tfd_queue_msk = 0;
3079 
3080 	ret = iwm_mvm_add_int_sta_common(sc,
3081 	    &sc->sc_aux_sta, NULL, IWM_MAC_INDEX_AUX, 0);
3082 
3083 	if (ret)
3084 		memset(&sc->sc_aux_sta, 0, sizeof(sc->sc_aux_sta));
3085 	return ret;
3086 }
3087 
3088 /*
3089  * END mvm/sta.c
3090  */
3091 
3092 /*
3093  * BEGIN mvm/quota.c
3094  */
3095 
3096 static int
3097 iwm_mvm_update_quotas(struct iwm_softc *sc, struct iwm_node *in)
3098 {
3099 	struct iwm_time_quota_cmd cmd;
3100 	int i, idx, ret, num_active_macs, quota, quota_rem;
3101 	int colors[IWM_MAX_BINDINGS] = { -1, -1, -1, -1, };
3102 	int n_ifs[IWM_MAX_BINDINGS] = {0, };
3103 	uint16_t id;
3104 
3105 	memset(&cmd, 0, sizeof(cmd));
3106 
3107 	/* currently, PHY ID == binding ID */
3108 	if (in) {
3109 		id = in->in_phyctxt->id;
3110 		KASSERT(id < IWM_MAX_BINDINGS, ("invalid id"));
3111 		colors[id] = in->in_phyctxt->color;
3112 
3113 		if (1)
3114 			n_ifs[id] = 1;
3115 	}
3116 
3117 	/*
3118 	 * The FW's scheduling session consists of
3119 	 * IWM_MVM_MAX_QUOTA fragments. Divide these fragments
3120 	 * equally between all the bindings that require quota
3121 	 */
3122 	num_active_macs = 0;
3123 	for (i = 0; i < IWM_MAX_BINDINGS; i++) {
3124 		cmd.quotas[i].id_and_color = htole32(IWM_FW_CTXT_INVALID);
3125 		num_active_macs += n_ifs[i];
3126 	}
3127 
3128 	quota = 0;
3129 	quota_rem = 0;
3130 	if (num_active_macs) {
3131 		quota = IWM_MVM_MAX_QUOTA / num_active_macs;
3132 		quota_rem = IWM_MVM_MAX_QUOTA % num_active_macs;
3133 	}
3134 
3135 	for (idx = 0, i = 0; i < IWM_MAX_BINDINGS; i++) {
3136 		if (colors[i] < 0)
3137 			continue;
3138 
3139 		cmd.quotas[idx].id_and_color =
3140 			htole32(IWM_FW_CMD_ID_AND_COLOR(i, colors[i]));
3141 
3142 		if (n_ifs[i] <= 0) {
3143 			cmd.quotas[idx].quota = htole32(0);
3144 			cmd.quotas[idx].max_duration = htole32(0);
3145 		} else {
3146 			cmd.quotas[idx].quota = htole32(quota * n_ifs[i]);
3147 			cmd.quotas[idx].max_duration = htole32(0);
3148 		}
3149 		idx++;
3150 	}
3151 
3152 	/* Give the remainder of the session to the first binding */
3153 	cmd.quotas[0].quota = htole32(le32toh(cmd.quotas[0].quota) + quota_rem);
3154 
3155 	ret = iwm_mvm_send_cmd_pdu(sc, IWM_TIME_QUOTA_CMD, IWM_CMD_SYNC,
3156 	    sizeof(cmd), &cmd);
3157 	if (ret)
3158 		device_printf(sc->sc_dev,
3159 		    "%s: Failed to send quota: %d\n", __func__, ret);
3160 	return ret;
3161 }
3162 
3163 /*
3164  * END mvm/quota.c
3165  */
3166 
3167 /*
3168  * ieee80211 routines
3169  */
3170 
3171 /*
3172  * Change to AUTH state in 80211 state machine.  Roughly matches what
3173  * Linux does in bss_info_changed().
3174  */
3175 static int
3176 iwm_auth(struct ieee80211vap *vap, struct iwm_softc *sc)
3177 {
3178 	struct ieee80211_node *ni;
3179 	struct iwm_node *in;
3180 	struct iwm_vap *iv = IWM_VAP(vap);
3181 	uint32_t duration;
3182 	uint32_t min_duration;
3183 	int error;
3184 
3185 	/*
3186 	 * XXX i have a feeling that the vap node is being
3187 	 * freed from underneath us. Grr.
3188 	 */
3189 	ni = ieee80211_ref_node(vap->iv_bss);
3190 	in = (struct iwm_node *) ni;
3191 	IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_STATE,
3192 	    "%s: called; vap=%p, bss ni=%p\n",
3193 	    __func__,
3194 	    vap,
3195 	    ni);
3196 
3197 	in->in_assoc = 0;
3198 
3199 	error = iwm_allow_mcast(vap, sc);
3200 	if (error) {
3201 		device_printf(sc->sc_dev,
3202 		    "%s: failed to set multicast\n", __func__);
3203 		goto out;
3204 	}
3205 
3206 	/*
3207 	 * This is where it deviates from what Linux does.
3208 	 *
3209 	 * Linux iwlwifi doesn't reset the nic each time, nor does it
3210 	 * call ctxt_add() here.  Instead, it adds it during vap creation,
3211 	 * and always does does a mac_ctx_changed().
3212 	 *
3213 	 * The openbsd port doesn't attempt to do that - it reset things
3214 	 * at odd states and does the add here.
3215 	 *
3216 	 * So, until the state handling is fixed (ie, we never reset
3217 	 * the NIC except for a firmware failure, which should drag
3218 	 * the NIC back to IDLE, re-setup and re-add all the mac/phy
3219 	 * contexts that are required), let's do a dirty hack here.
3220 	 */
3221 	if (iv->is_uploaded) {
3222 		if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) {
3223 			device_printf(sc->sc_dev,
3224 			    "%s: failed to add MAC\n", __func__);
3225 			goto out;
3226 		}
3227 	} else {
3228 		if ((error = iwm_mvm_mac_ctxt_add(sc, vap)) != 0) {
3229 			device_printf(sc->sc_dev,
3230 			    "%s: failed to add MAC\n", __func__);
3231 			goto out;
3232 		}
3233 	}
3234 
3235 	if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0],
3236 	    in->in_ni.ni_chan, 1, 1)) != 0) {
3237 		device_printf(sc->sc_dev,
3238 		    "%s: failed add phy ctxt\n", __func__);
3239 		goto out;
3240 	}
3241 	in->in_phyctxt = &sc->sc_phyctxt[0];
3242 
3243 	if ((error = iwm_mvm_binding_add_vif(sc, in)) != 0) {
3244 		device_printf(sc->sc_dev,
3245 		    "%s: binding cmd\n", __func__);
3246 		goto out;
3247 	}
3248 
3249 	if ((error = iwm_mvm_add_sta(sc, in)) != 0) {
3250 		device_printf(sc->sc_dev,
3251 		    "%s: failed to add MAC\n", __func__);
3252 		goto out;
3253 	}
3254 
3255 	/* a bit superfluous? */
3256 	while (sc->sc_auth_prot)
3257 		msleep(&sc->sc_auth_prot, &sc->sc_mtx, 0, "iwmauth", 0);
3258 	sc->sc_auth_prot = 1;
3259 
3260 	duration = min(IWM_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS,
3261 	    200 + in->in_ni.ni_intval);
3262 	min_duration = min(IWM_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS,
3263 	    100 + in->in_ni.ni_intval);
3264 	iwm_mvm_protect_session(sc, in, duration, min_duration, 500);
3265 
3266 	IWM_DPRINTF(sc, IWM_DEBUG_RESET,
3267 	    "%s: waiting for auth_prot\n", __func__);
3268 	while (sc->sc_auth_prot != 2) {
3269 		/*
3270 		 * well, meh, but if the kernel is sleeping for half a
3271 		 * second, we have bigger problems
3272 		 */
3273 		if (sc->sc_auth_prot == 0) {
3274 			device_printf(sc->sc_dev,
3275 			    "%s: missed auth window!\n", __func__);
3276 			error = ETIMEDOUT;
3277 			goto out;
3278 		} else if (sc->sc_auth_prot == -1) {
3279 			device_printf(sc->sc_dev,
3280 			    "%s: no time event, denied!\n", __func__);
3281 			sc->sc_auth_prot = 0;
3282 			error = EAUTH;
3283 			goto out;
3284 		}
3285 		msleep(&sc->sc_auth_prot, &sc->sc_mtx, 0, "iwmau2", 0);
3286 	}
3287 	IWM_DPRINTF(sc, IWM_DEBUG_RESET, "<-%s\n", __func__);
3288 	error = 0;
3289 out:
3290 	ieee80211_free_node(ni);
3291 	return (error);
3292 }
3293 
3294 static int
3295 iwm_assoc(struct ieee80211vap *vap, struct iwm_softc *sc)
3296 {
3297 	struct iwm_node *in = (struct iwm_node *)vap->iv_bss;
3298 	int error;
3299 
3300 	if ((error = iwm_mvm_update_sta(sc, in)) != 0) {
3301 		device_printf(sc->sc_dev,
3302 		    "%s: failed to update STA\n", __func__);
3303 		return error;
3304 	}
3305 
3306 	in->in_assoc = 1;
3307 	if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) {
3308 		device_printf(sc->sc_dev,
3309 		    "%s: failed to update MAC\n", __func__);
3310 		return error;
3311 	}
3312 
3313 	return 0;
3314 }
3315 
3316 static int
3317 iwm_release(struct iwm_softc *sc, struct iwm_node *in)
3318 {
3319 	/*
3320 	 * Ok, so *technically* the proper set of calls for going
3321 	 * from RUN back to SCAN is:
3322 	 *
3323 	 * iwm_mvm_power_mac_disable(sc, in);
3324 	 * iwm_mvm_mac_ctxt_changed(sc, in);
3325 	 * iwm_mvm_rm_sta(sc, in);
3326 	 * iwm_mvm_update_quotas(sc, NULL);
3327 	 * iwm_mvm_mac_ctxt_changed(sc, in);
3328 	 * iwm_mvm_binding_remove_vif(sc, in);
3329 	 * iwm_mvm_mac_ctxt_remove(sc, in);
3330 	 *
3331 	 * However, that freezes the device not matter which permutations
3332 	 * and modifications are attempted.  Obviously, this driver is missing
3333 	 * something since it works in the Linux driver, but figuring out what
3334 	 * is missing is a little more complicated.  Now, since we're going
3335 	 * back to nothing anyway, we'll just do a complete device reset.
3336 	 * Up your's, device!
3337 	 */
3338 	//iwm_mvm_flush_tx_path(sc, 0xf, 1);
3339 	iwm_stop_device(sc);
3340 	iwm_init_hw(sc);
3341 	if (in)
3342 		in->in_assoc = 0;
3343 	return 0;
3344 
3345 #if 0
3346 	int error;
3347 
3348 	iwm_mvm_power_mac_disable(sc, in);
3349 
3350 	if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) {
3351 		device_printf(sc->sc_dev, "mac ctxt change fail 1 %d\n", error);
3352 		return error;
3353 	}
3354 
3355 	if ((error = iwm_mvm_rm_sta(sc, in)) != 0) {
3356 		device_printf(sc->sc_dev, "sta remove fail %d\n", error);
3357 		return error;
3358 	}
3359 	error = iwm_mvm_rm_sta(sc, in);
3360 	in->in_assoc = 0;
3361 	iwm_mvm_update_quotas(sc, NULL);
3362 	if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) {
3363 		device_printf(sc->sc_dev, "mac ctxt change fail 2 %d\n", error);
3364 		return error;
3365 	}
3366 	iwm_mvm_binding_remove_vif(sc, in);
3367 
3368 	iwm_mvm_mac_ctxt_remove(sc, in);
3369 
3370 	return error;
3371 #endif
3372 }
3373 
3374 static struct ieee80211_node *
3375 iwm_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
3376 {
3377 	return malloc(sizeof (struct iwm_node), M_80211_NODE,
3378 	    M_NOWAIT | M_ZERO);
3379 }
3380 
3381 static void
3382 iwm_setrates(struct iwm_softc *sc, struct iwm_node *in)
3383 {
3384 	struct ieee80211_node *ni = &in->in_ni;
3385 	struct iwm_lq_cmd *lq = &in->in_lq;
3386 	int nrates = ni->ni_rates.rs_nrates;
3387 	int i, ridx, tab = 0;
3388 	int txant = 0;
3389 
3390 	if (nrates > nitems(lq->rs_table)) {
3391 		device_printf(sc->sc_dev,
3392 		    "%s: node supports %d rates, driver handles "
3393 		    "only %zu\n", __func__, nrates, nitems(lq->rs_table));
3394 		return;
3395 	}
3396 
3397 	/*
3398 	 * XXX .. and most of iwm_node is not initialised explicitly;
3399 	 * it's all just 0x0 passed to the firmware.
3400 	 */
3401 
3402 	/* first figure out which rates we should support */
3403 	/* XXX TODO: this isn't 11n aware /at all/ */
3404 	memset(&in->in_ridx, -1, sizeof(in->in_ridx));
3405 	IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3406 	    "%s: nrates=%d\n", __func__, nrates);
3407 	for (i = 0; i < nrates; i++) {
3408 		int rate = ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL;
3409 
3410 		/* Map 802.11 rate to HW rate index. */
3411 		for (ridx = 0; ridx <= IWM_RIDX_MAX; ridx++)
3412 			if (iwm_rates[ridx].rate == rate)
3413 				break;
3414 		if (ridx > IWM_RIDX_MAX) {
3415 			device_printf(sc->sc_dev,
3416 			    "%s: WARNING: device rate for %d not found!\n",
3417 			    __func__, rate);
3418 		} else {
3419 			IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3420 			    "%s: rate: i: %d, rate=%d, ridx=%d\n",
3421 			    __func__,
3422 			    i,
3423 			    rate,
3424 			    ridx);
3425 			in->in_ridx[i] = ridx;
3426 		}
3427 	}
3428 
3429 	/* then construct a lq_cmd based on those */
3430 	memset(lq, 0, sizeof(*lq));
3431 	lq->sta_id = IWM_STATION_ID;
3432 
3433 	/*
3434 	 * are these used? (we don't do SISO or MIMO)
3435 	 * need to set them to non-zero, though, or we get an error.
3436 	 */
3437 	lq->single_stream_ant_msk = 1;
3438 	lq->dual_stream_ant_msk = 1;
3439 
3440 	/*
3441 	 * Build the actual rate selection table.
3442 	 * The lowest bits are the rates.  Additionally,
3443 	 * CCK needs bit 9 to be set.  The rest of the bits
3444 	 * we add to the table select the tx antenna
3445 	 * Note that we add the rates in the highest rate first
3446 	 * (opposite of ni_rates).
3447 	 */
3448 	/*
3449 	 * XXX TODO: this should be looping over the min of nrates
3450 	 * and LQ_MAX_RETRY_NUM.  Sigh.
3451 	 */
3452 	for (i = 0; i < nrates; i++) {
3453 		int nextant;
3454 
3455 		if (txant == 0)
3456 			txant = IWM_FW_VALID_TX_ANT(sc);
3457 		nextant = 1<<(ffs(txant)-1);
3458 		txant &= ~nextant;
3459 
3460 		/*
3461 		 * Map the rate id into a rate index into
3462 		 * our hardware table containing the
3463 		 * configuration to use for this rate.
3464 		 */
3465 		ridx = in->in_ridx[(nrates-1)-i];
3466 		tab = iwm_rates[ridx].plcp;
3467 		tab |= nextant << IWM_RATE_MCS_ANT_POS;
3468 		if (IWM_RIDX_IS_CCK(ridx))
3469 			tab |= IWM_RATE_MCS_CCK_MSK;
3470 		IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3471 		    "station rate i=%d, rate=%d, hw=%x\n",
3472 		    i, iwm_rates[ridx].rate, tab);
3473 		lq->rs_table[i] = htole32(tab);
3474 	}
3475 	/* then fill the rest with the lowest possible rate */
3476 	for (i = nrates; i < nitems(lq->rs_table); i++) {
3477 		KASSERT(tab != 0, ("invalid tab"));
3478 		lq->rs_table[i] = htole32(tab);
3479 	}
3480 }
3481 
3482 static int
3483 iwm_media_change(struct ifnet *ifp)
3484 {
3485 	struct ieee80211vap *vap = ifp->if_softc;
3486 	struct ieee80211com *ic = vap->iv_ic;
3487 	struct iwm_softc *sc = ic->ic_softc;
3488 	int error;
3489 
3490 	error = ieee80211_media_change(ifp);
3491 	if (error != ENETRESET)
3492 		return error;
3493 
3494 	IWM_LOCK(sc);
3495 	if (ic->ic_nrunning > 0) {
3496 		iwm_stop(sc);
3497 		iwm_init(sc);
3498 	}
3499 	IWM_UNLOCK(sc);
3500 	return error;
3501 }
3502 
3503 
3504 static int
3505 iwm_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3506 {
3507 	struct iwm_vap *ivp = IWM_VAP(vap);
3508 	struct ieee80211com *ic = vap->iv_ic;
3509 	struct iwm_softc *sc = ic->ic_softc;
3510 	struct iwm_node *in;
3511 	int error;
3512 
3513 	IWM_DPRINTF(sc, IWM_DEBUG_STATE,
3514 	    "switching state %s -> %s\n",
3515 	    ieee80211_state_name[vap->iv_state],
3516 	    ieee80211_state_name[nstate]);
3517 	IEEE80211_UNLOCK(ic);
3518 	IWM_LOCK(sc);
3519 	/* disable beacon filtering if we're hopping out of RUN */
3520 	if (vap->iv_state == IEEE80211_S_RUN && nstate != vap->iv_state) {
3521 		iwm_mvm_disable_beacon_filter(sc);
3522 
3523 		if (((in = (void *)vap->iv_bss) != NULL))
3524 			in->in_assoc = 0;
3525 
3526 		iwm_release(sc, NULL);
3527 
3528 		/*
3529 		 * It's impossible to directly go RUN->SCAN. If we iwm_release()
3530 		 * above then the card will be completely reinitialized,
3531 		 * so the driver must do everything necessary to bring the card
3532 		 * from INIT to SCAN.
3533 		 *
3534 		 * Additionally, upon receiving deauth frame from AP,
3535 		 * OpenBSD 802.11 stack puts the driver in IEEE80211_S_AUTH
3536 		 * state. This will also fail with this driver, so bring the FSM
3537 		 * from IEEE80211_S_RUN to IEEE80211_S_SCAN in this case as well.
3538 		 *
3539 		 * XXX TODO: fix this for FreeBSD!
3540 		 */
3541 		if (nstate == IEEE80211_S_SCAN ||
3542 		    nstate == IEEE80211_S_AUTH ||
3543 		    nstate == IEEE80211_S_ASSOC) {
3544 			IWM_DPRINTF(sc, IWM_DEBUG_STATE,
3545 			    "Force transition to INIT; MGT=%d\n", arg);
3546 			IWM_UNLOCK(sc);
3547 			IEEE80211_LOCK(ic);
3548 			vap->iv_newstate(vap, IEEE80211_S_INIT, arg);
3549 			IWM_DPRINTF(sc, IWM_DEBUG_STATE,
3550 			    "Going INIT->SCAN\n");
3551 			nstate = IEEE80211_S_SCAN;
3552 			IEEE80211_UNLOCK(ic);
3553 			IWM_LOCK(sc);
3554 		}
3555 	}
3556 
3557 	switch (nstate) {
3558 	case IEEE80211_S_INIT:
3559 		sc->sc_scanband = 0;
3560 		break;
3561 
3562 	case IEEE80211_S_AUTH:
3563 		if ((error = iwm_auth(vap, sc)) != 0) {
3564 			device_printf(sc->sc_dev,
3565 			    "%s: could not move to auth state: %d\n",
3566 			    __func__, error);
3567 			break;
3568 		}
3569 		break;
3570 
3571 	case IEEE80211_S_ASSOC:
3572 		if ((error = iwm_assoc(vap, sc)) != 0) {
3573 			device_printf(sc->sc_dev,
3574 			    "%s: failed to associate: %d\n", __func__,
3575 			    error);
3576 			break;
3577 		}
3578 		break;
3579 
3580 	case IEEE80211_S_RUN:
3581 	{
3582 		struct iwm_host_cmd cmd = {
3583 			.id = IWM_LQ_CMD,
3584 			.len = { sizeof(in->in_lq), },
3585 			.flags = IWM_CMD_SYNC,
3586 		};
3587 
3588 		/* Update the association state, now we have it all */
3589 		/* (eg associd comes in at this point */
3590 		error = iwm_assoc(vap, sc);
3591 		if (error != 0) {
3592 			device_printf(sc->sc_dev,
3593 			    "%s: failed to update association state: %d\n",
3594 			    __func__,
3595 			    error);
3596 			break;
3597 		}
3598 
3599 		in = (struct iwm_node *)vap->iv_bss;
3600 		iwm_mvm_power_mac_update_mode(sc, in);
3601 		iwm_mvm_enable_beacon_filter(sc, in);
3602 		iwm_mvm_update_quotas(sc, in);
3603 		iwm_setrates(sc, in);
3604 
3605 		cmd.data[0] = &in->in_lq;
3606 		if ((error = iwm_send_cmd(sc, &cmd)) != 0) {
3607 			device_printf(sc->sc_dev,
3608 			    "%s: IWM_LQ_CMD failed\n", __func__);
3609 		}
3610 
3611 		break;
3612 	}
3613 
3614 	default:
3615 		break;
3616 	}
3617 	IWM_UNLOCK(sc);
3618 	IEEE80211_LOCK(ic);
3619 
3620 	return (ivp->iv_newstate(vap, nstate, arg));
3621 }
3622 
3623 void
3624 iwm_endscan_cb(void *arg, int pending)
3625 {
3626 	struct iwm_softc *sc = arg;
3627 	struct ieee80211com *ic = &sc->sc_ic;
3628 	int done;
3629 	int error;
3630 
3631 	IWM_DPRINTF(sc, IWM_DEBUG_SCAN | IWM_DEBUG_TRACE,
3632 	    "%s: scan ended\n",
3633 	    __func__);
3634 
3635 	IWM_LOCK(sc);
3636 	if (sc->sc_scanband == IEEE80211_CHAN_2GHZ &&
3637 	    sc->sc_nvm.sku_cap_band_52GHz_enable) {
3638 		done = 0;
3639 		if ((error = iwm_mvm_scan_request(sc,
3640 		    IEEE80211_CHAN_5GHZ, 0, NULL, 0)) != 0) {
3641 			device_printf(sc->sc_dev, "could not initiate scan\n");
3642 			done = 1;
3643 		}
3644 	} else {
3645 		done = 1;
3646 	}
3647 
3648 	if (done) {
3649 		IWM_UNLOCK(sc);
3650 		ieee80211_scan_done(TAILQ_FIRST(&ic->ic_vaps));
3651 		IWM_LOCK(sc);
3652 		sc->sc_scanband = 0;
3653 	}
3654 	IWM_UNLOCK(sc);
3655 }
3656 
3657 static int
3658 iwm_init_hw(struct iwm_softc *sc)
3659 {
3660 	struct ieee80211com *ic = &sc->sc_ic;
3661 	int error, i, qid;
3662 
3663 	if ((error = iwm_start_hw(sc)) != 0)
3664 		return error;
3665 
3666 	if ((error = iwm_run_init_mvm_ucode(sc, 0)) != 0) {
3667 		return error;
3668 	}
3669 
3670 	/*
3671 	 * should stop and start HW since that INIT
3672 	 * image just loaded
3673 	 */
3674 	iwm_stop_device(sc);
3675 	if ((error = iwm_start_hw(sc)) != 0) {
3676 		device_printf(sc->sc_dev, "could not initialize hardware\n");
3677 		return error;
3678 	}
3679 
3680 	/* omstart, this time with the regular firmware */
3681 	error = iwm_mvm_load_ucode_wait_alive(sc, IWM_UCODE_TYPE_REGULAR);
3682 	if (error) {
3683 		device_printf(sc->sc_dev, "could not load firmware\n");
3684 		goto error;
3685 	}
3686 
3687 	if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0)
3688 		goto error;
3689 
3690 	/* Send phy db control command and then phy db calibration*/
3691 	if ((error = iwm_send_phy_db_data(sc)) != 0)
3692 		goto error;
3693 
3694 	if ((error = iwm_send_phy_cfg_cmd(sc)) != 0)
3695 		goto error;
3696 
3697 	/* Add auxiliary station for scanning */
3698 	if ((error = iwm_mvm_add_aux_sta(sc)) != 0)
3699 		goto error;
3700 
3701 	for (i = 0; i < IWM_NUM_PHY_CTX; i++) {
3702 		/*
3703 		 * The channel used here isn't relevant as it's
3704 		 * going to be overwritten in the other flows.
3705 		 * For now use the first channel we have.
3706 		 */
3707 		if ((error = iwm_mvm_phy_ctxt_add(sc,
3708 		    &sc->sc_phyctxt[i], &ic->ic_channels[1], 1, 1)) != 0)
3709 			goto error;
3710 	}
3711 
3712 	error = iwm_mvm_power_update_device(sc);
3713 	if (error)
3714 		goto error;
3715 
3716 	/* Mark TX rings as active. */
3717 	for (qid = 0; qid < 4; qid++) {
3718 		iwm_enable_txq(sc, qid, qid);
3719 	}
3720 
3721 	return 0;
3722 
3723  error:
3724 	iwm_stop_device(sc);
3725 	return error;
3726 }
3727 
3728 /* Allow multicast from our BSSID. */
3729 static int
3730 iwm_allow_mcast(struct ieee80211vap *vap, struct iwm_softc *sc)
3731 {
3732 	struct ieee80211_node *ni = vap->iv_bss;
3733 	struct iwm_mcast_filter_cmd *cmd;
3734 	size_t size;
3735 	int error;
3736 
3737 	size = roundup(sizeof(*cmd), 4);
3738 	cmd = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
3739 	if (cmd == NULL)
3740 		return ENOMEM;
3741 	cmd->filter_own = 1;
3742 	cmd->port_id = 0;
3743 	cmd->count = 0;
3744 	cmd->pass_all = 1;
3745 	IEEE80211_ADDR_COPY(cmd->bssid, ni->ni_bssid);
3746 
3747 	error = iwm_mvm_send_cmd_pdu(sc, IWM_MCAST_FILTER_CMD,
3748 	    IWM_CMD_SYNC, size, cmd);
3749 	free(cmd, M_DEVBUF);
3750 
3751 	return (error);
3752 }
3753 
3754 static void
3755 iwm_init(struct iwm_softc *sc)
3756 {
3757 	int error;
3758 
3759 	if (sc->sc_flags & IWM_FLAG_HW_INITED) {
3760 		return;
3761 	}
3762 	sc->sc_generation++;
3763 	sc->sc_flags &= ~IWM_FLAG_STOPPED;
3764 
3765 	if ((error = iwm_init_hw(sc)) != 0) {
3766 		iwm_stop(sc);
3767 		return;
3768 	}
3769 
3770 	/*
3771  	 * Ok, firmware loaded and we are jogging
3772 	 */
3773 	sc->sc_flags |= IWM_FLAG_HW_INITED;
3774 	callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc);
3775 }
3776 
3777 static int
3778 iwm_transmit(struct ieee80211com *ic, struct mbuf *m)
3779 {
3780 	struct iwm_softc *sc;
3781 	int error;
3782 
3783 	sc = ic->ic_softc;
3784 
3785 	IWM_LOCK(sc);
3786 	if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
3787 		IWM_UNLOCK(sc);
3788 		return (ENXIO);
3789 	}
3790 	error = mbufq_enqueue(&sc->sc_snd, m);
3791 	if (error) {
3792 		IWM_UNLOCK(sc);
3793 		return (error);
3794 	}
3795 	iwm_start(sc);
3796 	IWM_UNLOCK(sc);
3797 	return (0);
3798 }
3799 
3800 /*
3801  * Dequeue packets from sendq and call send.
3802  */
3803 static void
3804 iwm_start(struct iwm_softc *sc)
3805 {
3806 	struct ieee80211_node *ni;
3807 	struct mbuf *m;
3808 	int ac = 0;
3809 
3810 	IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "->%s\n", __func__);
3811 	while (sc->qfullmsk == 0 &&
3812 		(m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3813 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3814 		if (iwm_tx(sc, m, ni, ac) != 0) {
3815 			if_inc_counter(ni->ni_vap->iv_ifp,
3816 			    IFCOUNTER_OERRORS, 1);
3817 			ieee80211_free_node(ni);
3818 			continue;
3819 		}
3820 		sc->sc_tx_timer = 15;
3821 	}
3822 	IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "<-%s\n", __func__);
3823 }
3824 
3825 static void
3826 iwm_stop(struct iwm_softc *sc)
3827 {
3828 
3829 	sc->sc_flags &= ~IWM_FLAG_HW_INITED;
3830 	sc->sc_flags |= IWM_FLAG_STOPPED;
3831 	sc->sc_generation++;
3832 	sc->sc_scanband = 0;
3833 	sc->sc_auth_prot = 0;
3834 	sc->sc_tx_timer = 0;
3835 	iwm_stop_device(sc);
3836 }
3837 
3838 static void
3839 iwm_watchdog(void *arg)
3840 {
3841 	struct iwm_softc *sc = arg;
3842 
3843 	if (sc->sc_tx_timer > 0) {
3844 		if (--sc->sc_tx_timer == 0) {
3845 			device_printf(sc->sc_dev, "device timeout\n");
3846 #ifdef IWM_DEBUG
3847 			iwm_nic_error(sc);
3848 #endif
3849 			iwm_stop(sc);
3850 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
3851 			return;
3852 		}
3853 	}
3854 	callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc);
3855 }
3856 
3857 static void
3858 iwm_parent(struct ieee80211com *ic)
3859 {
3860 	struct iwm_softc *sc = ic->ic_softc;
3861 	int startall = 0;
3862 
3863 	IWM_LOCK(sc);
3864 	if (ic->ic_nrunning > 0) {
3865 		if (!(sc->sc_flags & IWM_FLAG_HW_INITED)) {
3866 			iwm_init(sc);
3867 			startall = 1;
3868 		}
3869 	} else if (sc->sc_flags & IWM_FLAG_HW_INITED)
3870 		iwm_stop(sc);
3871 	IWM_UNLOCK(sc);
3872 	if (startall)
3873 		ieee80211_start_all(ic);
3874 }
3875 
3876 /*
3877  * The interrupt side of things
3878  */
3879 
3880 /*
3881  * error dumping routines are from iwlwifi/mvm/utils.c
3882  */
3883 
3884 /*
3885  * Note: This structure is read from the device with IO accesses,
3886  * and the reading already does the endian conversion. As it is
3887  * read with uint32_t-sized accesses, any members with a different size
3888  * need to be ordered correctly though!
3889  */
3890 struct iwm_error_event_table {
3891 	uint32_t valid;		/* (nonzero) valid, (0) log is empty */
3892 	uint32_t error_id;		/* type of error */
3893 	uint32_t pc;			/* program counter */
3894 	uint32_t blink1;		/* branch link */
3895 	uint32_t blink2;		/* branch link */
3896 	uint32_t ilink1;		/* interrupt link */
3897 	uint32_t ilink2;		/* interrupt link */
3898 	uint32_t data1;		/* error-specific data */
3899 	uint32_t data2;		/* error-specific data */
3900 	uint32_t data3;		/* error-specific data */
3901 	uint32_t bcon_time;		/* beacon timer */
3902 	uint32_t tsf_low;		/* network timestamp function timer */
3903 	uint32_t tsf_hi;		/* network timestamp function timer */
3904 	uint32_t gp1;		/* GP1 timer register */
3905 	uint32_t gp2;		/* GP2 timer register */
3906 	uint32_t gp3;		/* GP3 timer register */
3907 	uint32_t ucode_ver;		/* uCode version */
3908 	uint32_t hw_ver;		/* HW Silicon version */
3909 	uint32_t brd_ver;		/* HW board version */
3910 	uint32_t log_pc;		/* log program counter */
3911 	uint32_t frame_ptr;		/* frame pointer */
3912 	uint32_t stack_ptr;		/* stack pointer */
3913 	uint32_t hcmd;		/* last host command header */
3914 	uint32_t isr0;		/* isr status register LMPM_NIC_ISR0:
3915 				 * rxtx_flag */
3916 	uint32_t isr1;		/* isr status register LMPM_NIC_ISR1:
3917 				 * host_flag */
3918 	uint32_t isr2;		/* isr status register LMPM_NIC_ISR2:
3919 				 * enc_flag */
3920 	uint32_t isr3;		/* isr status register LMPM_NIC_ISR3:
3921 				 * time_flag */
3922 	uint32_t isr4;		/* isr status register LMPM_NIC_ISR4:
3923 				 * wico interrupt */
3924 	uint32_t isr_pref;		/* isr status register LMPM_NIC_PREF_STAT */
3925 	uint32_t wait_event;		/* wait event() caller address */
3926 	uint32_t l2p_control;	/* L2pControlField */
3927 	uint32_t l2p_duration;	/* L2pDurationField */
3928 	uint32_t l2p_mhvalid;	/* L2pMhValidBits */
3929 	uint32_t l2p_addr_match;	/* L2pAddrMatchStat */
3930 	uint32_t lmpm_pmg_sel;	/* indicate which clocks are turned on
3931 				 * (LMPM_PMG_SEL) */
3932 	uint32_t u_timestamp;	/* indicate when the date and time of the
3933 				 * compilation */
3934 	uint32_t flow_handler;	/* FH read/write pointers, RX credit */
3935 } __packed;
3936 
3937 #define ERROR_START_OFFSET  (1 * sizeof(uint32_t))
3938 #define ERROR_ELEM_SIZE     (7 * sizeof(uint32_t))
3939 
3940 #ifdef IWM_DEBUG
3941 struct {
3942 	const char *name;
3943 	uint8_t num;
3944 } advanced_lookup[] = {
3945 	{ "NMI_INTERRUPT_WDG", 0x34 },
3946 	{ "SYSASSERT", 0x35 },
3947 	{ "UCODE_VERSION_MISMATCH", 0x37 },
3948 	{ "BAD_COMMAND", 0x38 },
3949 	{ "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C },
3950 	{ "FATAL_ERROR", 0x3D },
3951 	{ "NMI_TRM_HW_ERR", 0x46 },
3952 	{ "NMI_INTERRUPT_TRM", 0x4C },
3953 	{ "NMI_INTERRUPT_BREAK_POINT", 0x54 },
3954 	{ "NMI_INTERRUPT_WDG_RXF_FULL", 0x5C },
3955 	{ "NMI_INTERRUPT_WDG_NO_RBD_RXF_FULL", 0x64 },
3956 	{ "NMI_INTERRUPT_HOST", 0x66 },
3957 	{ "NMI_INTERRUPT_ACTION_PT", 0x7C },
3958 	{ "NMI_INTERRUPT_UNKNOWN", 0x84 },
3959 	{ "NMI_INTERRUPT_INST_ACTION_PT", 0x86 },
3960 	{ "ADVANCED_SYSASSERT", 0 },
3961 };
3962 
3963 static const char *
3964 iwm_desc_lookup(uint32_t num)
3965 {
3966 	int i;
3967 
3968 	for (i = 0; i < nitems(advanced_lookup) - 1; i++)
3969 		if (advanced_lookup[i].num == num)
3970 			return advanced_lookup[i].name;
3971 
3972 	/* No entry matches 'num', so it is the last: ADVANCED_SYSASSERT */
3973 	return advanced_lookup[i].name;
3974 }
3975 
3976 /*
3977  * Support for dumping the error log seemed like a good idea ...
3978  * but it's mostly hex junk and the only sensible thing is the
3979  * hw/ucode revision (which we know anyway).  Since it's here,
3980  * I'll just leave it in, just in case e.g. the Intel guys want to
3981  * help us decipher some "ADVANCED_SYSASSERT" later.
3982  */
3983 static void
3984 iwm_nic_error(struct iwm_softc *sc)
3985 {
3986 	struct iwm_error_event_table table;
3987 	uint32_t base;
3988 
3989 	device_printf(sc->sc_dev, "dumping device error log\n");
3990 	base = sc->sc_uc.uc_error_event_table;
3991 	if (base < 0x800000 || base >= 0x80C000) {
3992 		device_printf(sc->sc_dev,
3993 		    "Not valid error log pointer 0x%08x\n", base);
3994 		return;
3995 	}
3996 
3997 	if (iwm_read_mem(sc, base, &table, sizeof(table)/sizeof(uint32_t)) != 0) {
3998 		device_printf(sc->sc_dev, "reading errlog failed\n");
3999 		return;
4000 	}
4001 
4002 	if (!table.valid) {
4003 		device_printf(sc->sc_dev, "errlog not found, skipping\n");
4004 		return;
4005 	}
4006 
4007 	if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) {
4008 		device_printf(sc->sc_dev, "Start IWL Error Log Dump:\n");
4009 		device_printf(sc->sc_dev, "Status: 0x%x, count: %d\n",
4010 		    sc->sc_flags, table.valid);
4011 	}
4012 
4013 	device_printf(sc->sc_dev, "0x%08X | %-28s\n", table.error_id,
4014 		iwm_desc_lookup(table.error_id));
4015 	device_printf(sc->sc_dev, "%08X | uPc\n", table.pc);
4016 	device_printf(sc->sc_dev, "%08X | branchlink1\n", table.blink1);
4017 	device_printf(sc->sc_dev, "%08X | branchlink2\n", table.blink2);
4018 	device_printf(sc->sc_dev, "%08X | interruptlink1\n", table.ilink1);
4019 	device_printf(sc->sc_dev, "%08X | interruptlink2\n", table.ilink2);
4020 	device_printf(sc->sc_dev, "%08X | data1\n", table.data1);
4021 	device_printf(sc->sc_dev, "%08X | data2\n", table.data2);
4022 	device_printf(sc->sc_dev, "%08X | data3\n", table.data3);
4023 	device_printf(sc->sc_dev, "%08X | beacon time\n", table.bcon_time);
4024 	device_printf(sc->sc_dev, "%08X | tsf low\n", table.tsf_low);
4025 	device_printf(sc->sc_dev, "%08X | tsf hi\n", table.tsf_hi);
4026 	device_printf(sc->sc_dev, "%08X | time gp1\n", table.gp1);
4027 	device_printf(sc->sc_dev, "%08X | time gp2\n", table.gp2);
4028 	device_printf(sc->sc_dev, "%08X | time gp3\n", table.gp3);
4029 	device_printf(sc->sc_dev, "%08X | uCode version\n", table.ucode_ver);
4030 	device_printf(sc->sc_dev, "%08X | hw version\n", table.hw_ver);
4031 	device_printf(sc->sc_dev, "%08X | board version\n", table.brd_ver);
4032 	device_printf(sc->sc_dev, "%08X | hcmd\n", table.hcmd);
4033 	device_printf(sc->sc_dev, "%08X | isr0\n", table.isr0);
4034 	device_printf(sc->sc_dev, "%08X | isr1\n", table.isr1);
4035 	device_printf(sc->sc_dev, "%08X | isr2\n", table.isr2);
4036 	device_printf(sc->sc_dev, "%08X | isr3\n", table.isr3);
4037 	device_printf(sc->sc_dev, "%08X | isr4\n", table.isr4);
4038 	device_printf(sc->sc_dev, "%08X | isr_pref\n", table.isr_pref);
4039 	device_printf(sc->sc_dev, "%08X | wait_event\n", table.wait_event);
4040 	device_printf(sc->sc_dev, "%08X | l2p_control\n", table.l2p_control);
4041 	device_printf(sc->sc_dev, "%08X | l2p_duration\n", table.l2p_duration);
4042 	device_printf(sc->sc_dev, "%08X | l2p_mhvalid\n", table.l2p_mhvalid);
4043 	device_printf(sc->sc_dev, "%08X | l2p_addr_match\n", table.l2p_addr_match);
4044 	device_printf(sc->sc_dev, "%08X | lmpm_pmg_sel\n", table.lmpm_pmg_sel);
4045 	device_printf(sc->sc_dev, "%08X | timestamp\n", table.u_timestamp);
4046 	device_printf(sc->sc_dev, "%08X | flow_handler\n", table.flow_handler);
4047 }
4048 #endif
4049 
4050 #define SYNC_RESP_STRUCT(_var_, _pkt_)					\
4051 do {									\
4052 	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\
4053 	_var_ = (void *)((_pkt_)+1);					\
4054 } while (/*CONSTCOND*/0)
4055 
4056 #define SYNC_RESP_PTR(_ptr_, _len_, _pkt_)				\
4057 do {									\
4058 	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\
4059 	_ptr_ = (void *)((_pkt_)+1);					\
4060 } while (/*CONSTCOND*/0)
4061 
4062 #define ADVANCE_RXQ(sc) (sc->rxq.cur = (sc->rxq.cur + 1) % IWM_RX_RING_COUNT);
4063 
4064 /*
4065  * Process an IWM_CSR_INT_BIT_FH_RX or IWM_CSR_INT_BIT_SW_RX interrupt.
4066  * Basic structure from if_iwn
4067  */
4068 static void
4069 iwm_notif_intr(struct iwm_softc *sc)
4070 {
4071 	uint16_t hw;
4072 
4073 	bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
4074 	    BUS_DMASYNC_POSTREAD);
4075 
4076 	hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff;
4077 	while (sc->rxq.cur != hw) {
4078 		struct iwm_rx_ring *ring = &sc->rxq;
4079 		struct iwm_rx_data *data = &sc->rxq.data[sc->rxq.cur];
4080 		struct iwm_rx_packet *pkt;
4081 		struct iwm_cmd_response *cresp;
4082 		int qid, idx;
4083 
4084 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
4085 		    BUS_DMASYNC_POSTREAD);
4086 		pkt = mtod(data->m, struct iwm_rx_packet *);
4087 
4088 		qid = pkt->hdr.qid & ~0x80;
4089 		idx = pkt->hdr.idx;
4090 
4091 		IWM_DPRINTF(sc, IWM_DEBUG_INTR,
4092 		    "rx packet qid=%d idx=%d flags=%x type=%x %d %d\n",
4093 		    pkt->hdr.qid & ~0x80, pkt->hdr.idx, pkt->hdr.flags,
4094 		    pkt->hdr.code, sc->rxq.cur, hw);
4095 
4096 		/*
4097 		 * randomly get these from the firmware, no idea why.
4098 		 * they at least seem harmless, so just ignore them for now
4099 		 */
4100 		if (__predict_false((pkt->hdr.code == 0 && qid == 0 && idx == 0)
4101 		    || pkt->len_n_flags == htole32(0x55550000))) {
4102 			ADVANCE_RXQ(sc);
4103 			continue;
4104 		}
4105 
4106 		switch (pkt->hdr.code) {
4107 		case IWM_REPLY_RX_PHY_CMD:
4108 			iwm_mvm_rx_rx_phy_cmd(sc, pkt, data);
4109 			break;
4110 
4111 		case IWM_REPLY_RX_MPDU_CMD:
4112 			iwm_mvm_rx_rx_mpdu(sc, pkt, data);
4113 			break;
4114 
4115 		case IWM_TX_CMD:
4116 			iwm_mvm_rx_tx_cmd(sc, pkt, data);
4117 			break;
4118 
4119 		case IWM_MISSED_BEACONS_NOTIFICATION: {
4120 			struct iwm_missed_beacons_notif *resp;
4121 			int missed;
4122 
4123 			/* XXX look at mac_id to determine interface ID */
4124 			struct ieee80211com *ic = &sc->sc_ic;
4125 			struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4126 
4127 			SYNC_RESP_STRUCT(resp, pkt);
4128 			missed = le32toh(resp->consec_missed_beacons);
4129 
4130 			IWM_DPRINTF(sc, IWM_DEBUG_BEACON | IWM_DEBUG_STATE,
4131 			    "%s: MISSED_BEACON: mac_id=%d, "
4132 			    "consec_since_last_rx=%d, consec=%d, num_expect=%d "
4133 			    "num_rx=%d\n",
4134 			    __func__,
4135 			    le32toh(resp->mac_id),
4136 			    le32toh(resp->consec_missed_beacons_since_last_rx),
4137 			    le32toh(resp->consec_missed_beacons),
4138 			    le32toh(resp->num_expected_beacons),
4139 			    le32toh(resp->num_recvd_beacons));
4140 
4141 			/* Be paranoid */
4142 			if (vap == NULL)
4143 				break;
4144 
4145 			/* XXX no net80211 locking? */
4146 			if (vap->iv_state == IEEE80211_S_RUN &&
4147 			    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
4148 				if (missed > vap->iv_bmissthreshold) {
4149 					/* XXX bad locking; turn into task */
4150 					IWM_UNLOCK(sc);
4151 					ieee80211_beacon_miss(ic);
4152 					IWM_LOCK(sc);
4153 				}
4154 			}
4155 
4156 			break; }
4157 
4158 		case IWM_MVM_ALIVE: {
4159 			struct iwm_mvm_alive_resp *resp;
4160 			SYNC_RESP_STRUCT(resp, pkt);
4161 
4162 			sc->sc_uc.uc_error_event_table
4163 			    = le32toh(resp->error_event_table_ptr);
4164 			sc->sc_uc.uc_log_event_table
4165 			    = le32toh(resp->log_event_table_ptr);
4166 			sc->sched_base = le32toh(resp->scd_base_ptr);
4167 			sc->sc_uc.uc_ok = resp->status == IWM_ALIVE_STATUS_OK;
4168 
4169 			sc->sc_uc.uc_intr = 1;
4170 			wakeup(&sc->sc_uc);
4171 			break; }
4172 
4173 		case IWM_CALIB_RES_NOTIF_PHY_DB: {
4174 			struct iwm_calib_res_notif_phy_db *phy_db_notif;
4175 			SYNC_RESP_STRUCT(phy_db_notif, pkt);
4176 
4177 			iwm_phy_db_set_section(sc, phy_db_notif);
4178 
4179 			break; }
4180 
4181 		case IWM_STATISTICS_NOTIFICATION: {
4182 			struct iwm_notif_statistics *stats;
4183 			SYNC_RESP_STRUCT(stats, pkt);
4184 			memcpy(&sc->sc_stats, stats, sizeof(sc->sc_stats));
4185 			sc->sc_noise = iwm_get_noise(&stats->rx.general);
4186 			break; }
4187 
4188 		case IWM_NVM_ACCESS_CMD:
4189 			if (sc->sc_wantresp == ((qid << 16) | idx)) {
4190 				bus_dmamap_sync(sc->rxq.data_dmat, data->map,
4191 				    BUS_DMASYNC_POSTREAD);
4192 				memcpy(sc->sc_cmd_resp,
4193 				    pkt, sizeof(sc->sc_cmd_resp));
4194 			}
4195 			break;
4196 
4197 		case IWM_PHY_CONFIGURATION_CMD:
4198 		case IWM_TX_ANT_CONFIGURATION_CMD:
4199 		case IWM_ADD_STA:
4200 		case IWM_MAC_CONTEXT_CMD:
4201 		case IWM_REPLY_SF_CFG_CMD:
4202 		case IWM_POWER_TABLE_CMD:
4203 		case IWM_PHY_CONTEXT_CMD:
4204 		case IWM_BINDING_CONTEXT_CMD:
4205 		case IWM_TIME_EVENT_CMD:
4206 		case IWM_SCAN_REQUEST_CMD:
4207 		case IWM_REPLY_BEACON_FILTERING_CMD:
4208 		case IWM_MAC_PM_POWER_TABLE:
4209 		case IWM_TIME_QUOTA_CMD:
4210 		case IWM_REMOVE_STA:
4211 		case IWM_TXPATH_FLUSH:
4212 		case IWM_LQ_CMD:
4213 			SYNC_RESP_STRUCT(cresp, pkt);
4214 			if (sc->sc_wantresp == ((qid << 16) | idx)) {
4215 				memcpy(sc->sc_cmd_resp,
4216 				    pkt, sizeof(*pkt)+sizeof(*cresp));
4217 			}
4218 			break;
4219 
4220 		/* ignore */
4221 		case 0x6c: /* IWM_PHY_DB_CMD, no idea why it's not in fw-api.h */
4222 			break;
4223 
4224 		case IWM_INIT_COMPLETE_NOTIF:
4225 			sc->sc_init_complete = 1;
4226 			wakeup(&sc->sc_init_complete);
4227 			break;
4228 
4229 		case IWM_SCAN_COMPLETE_NOTIFICATION: {
4230 			struct iwm_scan_complete_notif *notif;
4231 			SYNC_RESP_STRUCT(notif, pkt);
4232 			taskqueue_enqueue(sc->sc_tq, &sc->sc_es_task);
4233 			break; }
4234 
4235 		case IWM_REPLY_ERROR: {
4236 			struct iwm_error_resp *resp;
4237 			SYNC_RESP_STRUCT(resp, pkt);
4238 
4239 			device_printf(sc->sc_dev,
4240 			    "firmware error 0x%x, cmd 0x%x\n",
4241 			    le32toh(resp->error_type),
4242 			    resp->cmd_id);
4243 			break; }
4244 
4245 		case IWM_TIME_EVENT_NOTIFICATION: {
4246 			struct iwm_time_event_notif *notif;
4247 			SYNC_RESP_STRUCT(notif, pkt);
4248 
4249 			if (notif->status) {
4250 				if (le32toh(notif->action) &
4251 				    IWM_TE_V2_NOTIF_HOST_EVENT_START)
4252 					sc->sc_auth_prot = 2;
4253 				else
4254 					sc->sc_auth_prot = 0;
4255 			} else {
4256 				sc->sc_auth_prot = -1;
4257 			}
4258 			IWM_DPRINTF(sc, IWM_DEBUG_INTR,
4259 			    "%s: time event notification auth_prot=%d\n",
4260 				__func__, sc->sc_auth_prot);
4261 
4262 			wakeup(&sc->sc_auth_prot);
4263 			break; }
4264 
4265 		case IWM_MCAST_FILTER_CMD:
4266 			break;
4267 
4268 		default:
4269 			device_printf(sc->sc_dev,
4270 			    "frame %d/%d %x UNHANDLED (this should "
4271 			    "not happen)\n", qid, idx,
4272 			    pkt->len_n_flags);
4273 			break;
4274 		}
4275 
4276 		/*
4277 		 * Why test bit 0x80?  The Linux driver:
4278 		 *
4279 		 * There is one exception:  uCode sets bit 15 when it
4280 		 * originates the response/notification, i.e. when the
4281 		 * response/notification is not a direct response to a
4282 		 * command sent by the driver.  For example, uCode issues
4283 		 * IWM_REPLY_RX when it sends a received frame to the driver;
4284 		 * it is not a direct response to any driver command.
4285 		 *
4286 		 * Ok, so since when is 7 == 15?  Well, the Linux driver
4287 		 * uses a slightly different format for pkt->hdr, and "qid"
4288 		 * is actually the upper byte of a two-byte field.
4289 		 */
4290 		if (!(pkt->hdr.qid & (1 << 7))) {
4291 			iwm_cmd_done(sc, pkt);
4292 		}
4293 
4294 		ADVANCE_RXQ(sc);
4295 	}
4296 
4297 	IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL,
4298 	    IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
4299 
4300 	/*
4301 	 * Tell the firmware what we have processed.
4302 	 * Seems like the hardware gets upset unless we align
4303 	 * the write by 8??
4304 	 */
4305 	hw = (hw == 0) ? IWM_RX_RING_COUNT - 1 : hw - 1;
4306 	IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, hw & ~7);
4307 }
4308 
4309 static void
4310 iwm_intr(void *arg)
4311 {
4312 	struct iwm_softc *sc = arg;
4313 	int handled = 0;
4314 	int r1, r2, rv = 0;
4315 	int isperiodic = 0;
4316 
4317 	IWM_LOCK(sc);
4318 	IWM_WRITE(sc, IWM_CSR_INT_MASK, 0);
4319 
4320 	if (sc->sc_flags & IWM_FLAG_USE_ICT) {
4321 		uint32_t *ict = sc->ict_dma.vaddr;
4322 		int tmp;
4323 
4324 		tmp = htole32(ict[sc->ict_cur]);
4325 		if (!tmp)
4326 			goto out_ena;
4327 
4328 		/*
4329 		 * ok, there was something.  keep plowing until we have all.
4330 		 */
4331 		r1 = r2 = 0;
4332 		while (tmp) {
4333 			r1 |= tmp;
4334 			ict[sc->ict_cur] = 0;
4335 			sc->ict_cur = (sc->ict_cur+1) % IWM_ICT_COUNT;
4336 			tmp = htole32(ict[sc->ict_cur]);
4337 		}
4338 
4339 		/* this is where the fun begins.  don't ask */
4340 		if (r1 == 0xffffffff)
4341 			r1 = 0;
4342 
4343 		/* i am not expected to understand this */
4344 		if (r1 & 0xc0000)
4345 			r1 |= 0x8000;
4346 		r1 = (0xff & r1) | ((0xff00 & r1) << 16);
4347 	} else {
4348 		r1 = IWM_READ(sc, IWM_CSR_INT);
4349 		/* "hardware gone" (where, fishing?) */
4350 		if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0)
4351 			goto out;
4352 		r2 = IWM_READ(sc, IWM_CSR_FH_INT_STATUS);
4353 	}
4354 	if (r1 == 0 && r2 == 0) {
4355 		goto out_ena;
4356 	}
4357 
4358 	IWM_WRITE(sc, IWM_CSR_INT, r1 | ~sc->sc_intmask);
4359 
4360 	/* ignored */
4361 	handled |= (r1 & (IWM_CSR_INT_BIT_ALIVE /*| IWM_CSR_INT_BIT_SCD*/));
4362 
4363 	if (r1 & IWM_CSR_INT_BIT_SW_ERR) {
4364 #ifdef IWM_DEBUG
4365 		int i;
4366 		struct ieee80211com *ic = &sc->sc_ic;
4367 		struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4368 
4369 		iwm_nic_error(sc);
4370 
4371 		/* Dump driver status (TX and RX rings) while we're here. */
4372 		device_printf(sc->sc_dev, "driver status:\n");
4373 		for (i = 0; i < IWM_MVM_MAX_QUEUES; i++) {
4374 			struct iwm_tx_ring *ring = &sc->txq[i];
4375 			device_printf(sc->sc_dev,
4376 			    "  tx ring %2d: qid=%-2d cur=%-3d "
4377 			    "queued=%-3d\n",
4378 			    i, ring->qid, ring->cur, ring->queued);
4379 		}
4380 		device_printf(sc->sc_dev,
4381 		    "  rx ring: cur=%d\n", sc->rxq.cur);
4382 		device_printf(sc->sc_dev,
4383 		    "  802.11 state %d\n", vap->iv_state);
4384 #endif
4385 
4386 		device_printf(sc->sc_dev, "fatal firmware error\n");
4387 		iwm_stop(sc);
4388 		rv = 1;
4389 		goto out;
4390 
4391 	}
4392 
4393 	if (r1 & IWM_CSR_INT_BIT_HW_ERR) {
4394 		handled |= IWM_CSR_INT_BIT_HW_ERR;
4395 		device_printf(sc->sc_dev, "hardware error, stopping device\n");
4396 		iwm_stop(sc);
4397 		rv = 1;
4398 		goto out;
4399 	}
4400 
4401 	/* firmware chunk loaded */
4402 	if (r1 & IWM_CSR_INT_BIT_FH_TX) {
4403 		IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_TX_MASK);
4404 		handled |= IWM_CSR_INT_BIT_FH_TX;
4405 		sc->sc_fw_chunk_done = 1;
4406 		wakeup(&sc->sc_fw);
4407 	}
4408 
4409 	if (r1 & IWM_CSR_INT_BIT_RF_KILL) {
4410 		handled |= IWM_CSR_INT_BIT_RF_KILL;
4411 		if (iwm_check_rfkill(sc)) {
4412 			device_printf(sc->sc_dev,
4413 			    "%s: rfkill switch, disabling interface\n",
4414 			    __func__);
4415 			iwm_stop(sc);
4416 		}
4417 	}
4418 
4419 	/*
4420 	 * The Linux driver uses periodic interrupts to avoid races.
4421 	 * We cargo-cult like it's going out of fashion.
4422 	 */
4423 	if (r1 & IWM_CSR_INT_BIT_RX_PERIODIC) {
4424 		handled |= IWM_CSR_INT_BIT_RX_PERIODIC;
4425 		IWM_WRITE(sc, IWM_CSR_INT, IWM_CSR_INT_BIT_RX_PERIODIC);
4426 		if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) == 0)
4427 			IWM_WRITE_1(sc,
4428 			    IWM_CSR_INT_PERIODIC_REG, IWM_CSR_INT_PERIODIC_DIS);
4429 		isperiodic = 1;
4430 	}
4431 
4432 	if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) || isperiodic) {
4433 		handled |= (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX);
4434 		IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_RX_MASK);
4435 
4436 		iwm_notif_intr(sc);
4437 
4438 		/* enable periodic interrupt, see above */
4439 		if (r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX) && !isperiodic)
4440 			IWM_WRITE_1(sc, IWM_CSR_INT_PERIODIC_REG,
4441 			    IWM_CSR_INT_PERIODIC_ENA);
4442 	}
4443 
4444 	if (__predict_false(r1 & ~handled))
4445 		IWM_DPRINTF(sc, IWM_DEBUG_INTR,
4446 		    "%s: unhandled interrupts: %x\n", __func__, r1);
4447 	rv = 1;
4448 
4449  out_ena:
4450 	iwm_restore_interrupts(sc);
4451  out:
4452 	IWM_UNLOCK(sc);
4453 	return;
4454 }
4455 
4456 /*
4457  * Autoconf glue-sniffing
4458  */
4459 #define	PCI_VENDOR_INTEL		0x8086
4460 #define	PCI_PRODUCT_INTEL_WL_3160_1	0x08b3
4461 #define	PCI_PRODUCT_INTEL_WL_3160_2	0x08b4
4462 #define	PCI_PRODUCT_INTEL_WL_7260_1	0x08b1
4463 #define	PCI_PRODUCT_INTEL_WL_7260_2	0x08b2
4464 #define	PCI_PRODUCT_INTEL_WL_7265_1	0x095a
4465 #define	PCI_PRODUCT_INTEL_WL_7265_2	0x095b
4466 
4467 static const struct iwm_devices {
4468 	uint16_t	device;
4469 	const char	*name;
4470 } iwm_devices[] = {
4471 	{ PCI_PRODUCT_INTEL_WL_3160_1, "Intel Dual Band Wireless AC 3160" },
4472 	{ PCI_PRODUCT_INTEL_WL_3160_2, "Intel Dual Band Wireless AC 3160" },
4473 	{ PCI_PRODUCT_INTEL_WL_7260_1, "Intel Dual Band Wireless AC 7260" },
4474 	{ PCI_PRODUCT_INTEL_WL_7260_2, "Intel Dual Band Wireless AC 7260" },
4475 	{ PCI_PRODUCT_INTEL_WL_7265_1, "Intel Dual Band Wireless AC 7265" },
4476 	{ PCI_PRODUCT_INTEL_WL_7265_2, "Intel Dual Band Wireless AC 7265" },
4477 };
4478 
4479 static int
4480 iwm_probe(device_t dev)
4481 {
4482 	int i;
4483 
4484 	for (i = 0; i < nitems(iwm_devices); i++)
4485 		if (pci_get_vendor(dev) == PCI_VENDOR_INTEL &&
4486 		    pci_get_device(dev) == iwm_devices[i].device) {
4487 			device_set_desc(dev, iwm_devices[i].name);
4488 			return (BUS_PROBE_DEFAULT);
4489 		}
4490 
4491 	return (ENXIO);
4492 }
4493 
4494 static int
4495 iwm_dev_check(device_t dev)
4496 {
4497 	struct iwm_softc *sc;
4498 
4499 	sc = device_get_softc(dev);
4500 
4501 	switch (pci_get_device(dev)) {
4502 	case PCI_PRODUCT_INTEL_WL_3160_1:
4503 	case PCI_PRODUCT_INTEL_WL_3160_2:
4504 		sc->sc_fwname = "iwm3160fw";
4505 		sc->host_interrupt_operation_mode = 1;
4506 		return (0);
4507 	case PCI_PRODUCT_INTEL_WL_7260_1:
4508 	case PCI_PRODUCT_INTEL_WL_7260_2:
4509 		sc->sc_fwname = "iwm7260fw";
4510 		sc->host_interrupt_operation_mode = 1;
4511 		return (0);
4512 	case PCI_PRODUCT_INTEL_WL_7265_1:
4513 	case PCI_PRODUCT_INTEL_WL_7265_2:
4514 		sc->sc_fwname = "iwm7265fw";
4515 		sc->host_interrupt_operation_mode = 0;
4516 		return (0);
4517 	default:
4518 		device_printf(dev, "unknown adapter type\n");
4519 		return ENXIO;
4520 	}
4521 }
4522 
4523 static int
4524 iwm_pci_attach(device_t dev)
4525 {
4526 	struct iwm_softc *sc;
4527 	int count, error, rid;
4528 	uint16_t reg;
4529 
4530 	sc = device_get_softc(dev);
4531 
4532 	/* Clear device-specific "PCI retry timeout" register (41h). */
4533 	reg = pci_read_config(dev, 0x40, sizeof(reg));
4534 	pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg));
4535 
4536 	/* Enable bus-mastering and hardware bug workaround. */
4537 	pci_enable_busmaster(dev);
4538 	reg = pci_read_config(dev, PCIR_STATUS, sizeof(reg));
4539 	/* if !MSI */
4540 	if (reg & PCIM_STATUS_INTxSTATE) {
4541 		reg &= ~PCIM_STATUS_INTxSTATE;
4542 	}
4543 	pci_write_config(dev, PCIR_STATUS, reg, sizeof(reg));
4544 
4545 	rid = PCIR_BAR(0);
4546 	sc->sc_mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
4547 	    RF_ACTIVE);
4548 	if (sc->sc_mem == NULL) {
4549 		device_printf(sc->sc_dev, "can't map mem space\n");
4550 		return (ENXIO);
4551 	}
4552 	sc->sc_st = rman_get_bustag(sc->sc_mem);
4553 	sc->sc_sh = rman_get_bushandle(sc->sc_mem);
4554 
4555 	/* Install interrupt handler. */
4556 	count = 1;
4557 	rid = 0;
4558 	if (pci_alloc_msi(dev, &count) == 0)
4559 		rid = 1;
4560 	sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
4561 	    (rid != 0 ? 0 : RF_SHAREABLE));
4562 	if (sc->sc_irq == NULL) {
4563 		device_printf(dev, "can't map interrupt\n");
4564 			return (ENXIO);
4565 	}
4566 	error = bus_setup_intr(dev, sc->sc_irq, INTR_TYPE_NET | INTR_MPSAFE,
4567 	    NULL, iwm_intr, sc, &sc->sc_ih);
4568 	if (sc->sc_ih == NULL) {
4569 		device_printf(dev, "can't establish interrupt");
4570 			return (ENXIO);
4571 	}
4572 	sc->sc_dmat = bus_get_dma_tag(sc->sc_dev);
4573 
4574 	return (0);
4575 }
4576 
4577 static void
4578 iwm_pci_detach(device_t dev)
4579 {
4580 	struct iwm_softc *sc = device_get_softc(dev);
4581 
4582 	if (sc->sc_irq != NULL) {
4583 		bus_teardown_intr(dev, sc->sc_irq, sc->sc_ih);
4584 		bus_release_resource(dev, SYS_RES_IRQ,
4585 		    rman_get_rid(sc->sc_irq), sc->sc_irq);
4586 		pci_release_msi(dev);
4587         }
4588 	if (sc->sc_mem != NULL)
4589 		bus_release_resource(dev, SYS_RES_MEMORY,
4590 		    rman_get_rid(sc->sc_mem), sc->sc_mem);
4591 }
4592 
4593 
4594 
4595 static int
4596 iwm_attach(device_t dev)
4597 {
4598 	struct iwm_softc *sc = device_get_softc(dev);
4599 	struct ieee80211com *ic = &sc->sc_ic;
4600 	int error;
4601 	int txq_i, i;
4602 
4603 	sc->sc_dev = dev;
4604 	mtx_init(&sc->sc_mtx, "iwm_mtx", MTX_DEF, 0);
4605 	mbufq_init(&sc->sc_snd, ifqmaxlen);
4606 	callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0);
4607 	TASK_INIT(&sc->sc_es_task, 0, iwm_endscan_cb, sc);
4608 	sc->sc_tq = taskqueue_create("iwm_taskq", M_WAITOK,
4609             taskqueue_thread_enqueue, &sc->sc_tq);
4610         error = taskqueue_start_threads(&sc->sc_tq, 1, 0, "iwm_taskq");
4611         if (error != 0) {
4612                 device_printf(dev, "can't start threads, error %d\n",
4613 		    error);
4614 		goto fail;
4615         }
4616 
4617 	/* PCI attach */
4618 	error = iwm_pci_attach(dev);
4619 	if (error != 0)
4620 		goto fail;
4621 
4622 	sc->sc_wantresp = -1;
4623 
4624 	/* Check device type */
4625 	error = iwm_dev_check(dev);
4626 	if (error != 0)
4627 		goto fail;
4628 
4629 	sc->sc_fwdmasegsz = IWM_FWDMASEGSZ;
4630 
4631 	/*
4632 	 * We now start fiddling with the hardware
4633 	 */
4634 	sc->sc_hw_rev = IWM_READ(sc, IWM_CSR_HW_REV);
4635 	if (iwm_prepare_card_hw(sc) != 0) {
4636 		device_printf(dev, "could not initialize hardware\n");
4637 		goto fail;
4638 	}
4639 
4640 	/* Allocate DMA memory for firmware transfers. */
4641 	if ((error = iwm_alloc_fwmem(sc)) != 0) {
4642 		device_printf(dev, "could not allocate memory for firmware\n");
4643 		goto fail;
4644 	}
4645 
4646 	/* Allocate "Keep Warm" page. */
4647 	if ((error = iwm_alloc_kw(sc)) != 0) {
4648 		device_printf(dev, "could not allocate keep warm page\n");
4649 		goto fail;
4650 	}
4651 
4652 	/* We use ICT interrupts */
4653 	if ((error = iwm_alloc_ict(sc)) != 0) {
4654 		device_printf(dev, "could not allocate ICT table\n");
4655 		goto fail;
4656 	}
4657 
4658 	/* Allocate TX scheduler "rings". */
4659 	if ((error = iwm_alloc_sched(sc)) != 0) {
4660 		device_printf(dev, "could not allocate TX scheduler rings\n");
4661 		goto fail;
4662 	}
4663 
4664 	/* Allocate TX rings */
4665 	for (txq_i = 0; txq_i < nitems(sc->txq); txq_i++) {
4666 		if ((error = iwm_alloc_tx_ring(sc,
4667 		    &sc->txq[txq_i], txq_i)) != 0) {
4668 			device_printf(dev,
4669 			    "could not allocate TX ring %d\n",
4670 			    txq_i);
4671 			goto fail;
4672 		}
4673 	}
4674 
4675 	/* Allocate RX ring. */
4676 	if ((error = iwm_alloc_rx_ring(sc, &sc->rxq)) != 0) {
4677 		device_printf(dev, "could not allocate RX ring\n");
4678 		goto fail;
4679 	}
4680 
4681 	/* Clear pending interrupts. */
4682 	IWM_WRITE(sc, IWM_CSR_INT, 0xffffffff);
4683 
4684 	ic->ic_softc = sc;
4685 	ic->ic_name = device_get_nameunit(sc->sc_dev);
4686 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
4687 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
4688 
4689 	/* Set device capabilities. */
4690 	ic->ic_caps =
4691 	    IEEE80211_C_STA |
4692 	    IEEE80211_C_WPA |		/* WPA/RSN */
4693 	    IEEE80211_C_WME |
4694 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
4695 	    IEEE80211_C_SHPREAMBLE	/* short preamble supported */
4696 //	    IEEE80211_C_BGSCAN		/* capable of bg scanning */
4697 	    ;
4698 	for (i = 0; i < nitems(sc->sc_phyctxt); i++) {
4699 		sc->sc_phyctxt[i].id = i;
4700 		sc->sc_phyctxt[i].color = 0;
4701 		sc->sc_phyctxt[i].ref = 0;
4702 		sc->sc_phyctxt[i].channel = NULL;
4703 	}
4704 
4705 	/* Max RSSI */
4706 	sc->sc_max_rssi = IWM_MAX_DBM - IWM_MIN_DBM;
4707 	sc->sc_preinit_hook.ich_func = iwm_preinit;
4708 	sc->sc_preinit_hook.ich_arg = sc;
4709 	if (config_intrhook_establish(&sc->sc_preinit_hook) != 0) {
4710 		device_printf(dev, "config_intrhook_establish failed\n");
4711 		goto fail;
4712 	}
4713 
4714 #ifdef IWM_DEBUG
4715 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
4716 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "debug",
4717 	    CTLFLAG_RW, &sc->sc_debug, 0, "control debugging");
4718 #endif
4719 
4720 	IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4721 	    "<-%s\n", __func__);
4722 
4723 	return 0;
4724 
4725 	/* Free allocated memory if something failed during attachment. */
4726 fail:
4727 	iwm_detach_local(sc, 0);
4728 
4729 	return ENXIO;
4730 }
4731 
4732 static int
4733 iwm_update_edca(struct ieee80211com *ic)
4734 {
4735 	struct iwm_softc *sc = ic->ic_softc;
4736 
4737 	device_printf(sc->sc_dev, "%s: called\n", __func__);
4738 	return (0);
4739 }
4740 
4741 static void
4742 iwm_preinit(void *arg)
4743 {
4744 	struct iwm_softc *sc = arg;
4745 	device_t dev = sc->sc_dev;
4746 	struct ieee80211com *ic = &sc->sc_ic;
4747 	int error;
4748 
4749 	IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4750 	    "->%s\n", __func__);
4751 
4752 	IWM_LOCK(sc);
4753 	if ((error = iwm_start_hw(sc)) != 0) {
4754 		device_printf(dev, "could not initialize hardware\n");
4755 		IWM_UNLOCK(sc);
4756 		goto fail;
4757 	}
4758 
4759 	error = iwm_run_init_mvm_ucode(sc, 1);
4760 	iwm_stop_device(sc);
4761 	if (error) {
4762 		IWM_UNLOCK(sc);
4763 		goto fail;
4764 	}
4765 	device_printf(dev,
4766 	    "revision: 0x%x, firmware %d.%d (API ver. %d)\n",
4767 	    sc->sc_hw_rev & IWM_CSR_HW_REV_TYPE_MSK,
4768 	    IWM_UCODE_MAJOR(sc->sc_fwver),
4769 	    IWM_UCODE_MINOR(sc->sc_fwver),
4770 	    IWM_UCODE_API(sc->sc_fwver));
4771 
4772 	/* not all hardware can do 5GHz band */
4773 	if (!sc->sc_nvm.sku_cap_band_52GHz_enable)
4774 		memset(&ic->ic_sup_rates[IEEE80211_MODE_11A], 0,
4775 		    sizeof(ic->ic_sup_rates[IEEE80211_MODE_11A]));
4776 	IWM_UNLOCK(sc);
4777 
4778 	/*
4779 	 * At this point we've committed - if we fail to do setup,
4780 	 * we now also have to tear down the net80211 state.
4781 	 */
4782 	ieee80211_ifattach(ic);
4783 	ic->ic_vap_create = iwm_vap_create;
4784 	ic->ic_vap_delete = iwm_vap_delete;
4785 	ic->ic_raw_xmit = iwm_raw_xmit;
4786 	ic->ic_node_alloc = iwm_node_alloc;
4787 	ic->ic_scan_start = iwm_scan_start;
4788 	ic->ic_scan_end = iwm_scan_end;
4789 	ic->ic_update_mcast = iwm_update_mcast;
4790 	ic->ic_set_channel = iwm_set_channel;
4791 	ic->ic_scan_curchan = iwm_scan_curchan;
4792 	ic->ic_scan_mindwell = iwm_scan_mindwell;
4793 	ic->ic_wme.wme_update = iwm_update_edca;
4794 	ic->ic_parent = iwm_parent;
4795 	ic->ic_transmit = iwm_transmit;
4796 	iwm_radiotap_attach(sc);
4797 	if (bootverbose)
4798 		ieee80211_announce(ic);
4799 
4800 	IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4801 	    "<-%s\n", __func__);
4802 	config_intrhook_disestablish(&sc->sc_preinit_hook);
4803 
4804 	return;
4805 fail:
4806 	config_intrhook_disestablish(&sc->sc_preinit_hook);
4807 	iwm_detach_local(sc, 0);
4808 }
4809 
4810 /*
4811  * Attach the interface to 802.11 radiotap.
4812  */
4813 static void
4814 iwm_radiotap_attach(struct iwm_softc *sc)
4815 {
4816         struct ieee80211com *ic = &sc->sc_ic;
4817 
4818 	IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4819 	    "->%s begin\n", __func__);
4820         ieee80211_radiotap_attach(ic,
4821             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
4822                 IWM_TX_RADIOTAP_PRESENT,
4823             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
4824                 IWM_RX_RADIOTAP_PRESENT);
4825 	IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4826 	    "->%s end\n", __func__);
4827 }
4828 
4829 static struct ieee80211vap *
4830 iwm_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
4831     enum ieee80211_opmode opmode, int flags,
4832     const uint8_t bssid[IEEE80211_ADDR_LEN],
4833     const uint8_t mac[IEEE80211_ADDR_LEN])
4834 {
4835 	struct iwm_vap *ivp;
4836 	struct ieee80211vap *vap;
4837 
4838 	if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
4839 		return NULL;
4840 	ivp = malloc(sizeof(struct iwm_vap), M_80211_VAP, M_WAITOK | M_ZERO);
4841 	vap = &ivp->iv_vap;
4842 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
4843 	vap->iv_bmissthreshold = 10;            /* override default */
4844 	/* Override with driver methods. */
4845 	ivp->iv_newstate = vap->iv_newstate;
4846 	vap->iv_newstate = iwm_newstate;
4847 
4848 	ieee80211_ratectl_init(vap);
4849 	/* Complete setup. */
4850 	ieee80211_vap_attach(vap, iwm_media_change, ieee80211_media_status,
4851 	    mac);
4852 	ic->ic_opmode = opmode;
4853 
4854 	return vap;
4855 }
4856 
4857 static void
4858 iwm_vap_delete(struct ieee80211vap *vap)
4859 {
4860 	struct iwm_vap *ivp = IWM_VAP(vap);
4861 
4862 	ieee80211_ratectl_deinit(vap);
4863 	ieee80211_vap_detach(vap);
4864 	free(ivp, M_80211_VAP);
4865 }
4866 
4867 static void
4868 iwm_scan_start(struct ieee80211com *ic)
4869 {
4870 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4871         struct iwm_softc *sc = ic->ic_softc;
4872 	int error;
4873 
4874 	if (sc->sc_scanband)
4875 		return;
4876 	IWM_LOCK(sc);
4877 	error = iwm_mvm_scan_request(sc, IEEE80211_CHAN_2GHZ, 0, NULL, 0);
4878 	if (error) {
4879 		device_printf(sc->sc_dev, "could not initiate scan\n");
4880 		IWM_UNLOCK(sc);
4881 		ieee80211_cancel_scan(vap);
4882 	} else
4883 		IWM_UNLOCK(sc);
4884 }
4885 
4886 static void
4887 iwm_scan_end(struct ieee80211com *ic)
4888 {
4889 }
4890 
4891 static void
4892 iwm_update_mcast(struct ieee80211com *ic)
4893 {
4894 }
4895 
4896 static void
4897 iwm_set_channel(struct ieee80211com *ic)
4898 {
4899 }
4900 
4901 static void
4902 iwm_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
4903 {
4904 }
4905 
4906 static void
4907 iwm_scan_mindwell(struct ieee80211_scan_state *ss)
4908 {
4909 	return;
4910 }
4911 
4912 void
4913 iwm_init_task(void *arg1)
4914 {
4915 	struct iwm_softc *sc = arg1;
4916 
4917 	IWM_LOCK(sc);
4918 	while (sc->sc_flags & IWM_FLAG_BUSY)
4919 		msleep(&sc->sc_flags, &sc->sc_mtx, 0, "iwmpwr", 0);
4920 	sc->sc_flags |= IWM_FLAG_BUSY;
4921 	iwm_stop(sc);
4922 	if (sc->sc_ic.ic_nrunning > 0)
4923 		iwm_init(sc);
4924 	sc->sc_flags &= ~IWM_FLAG_BUSY;
4925 	wakeup(&sc->sc_flags);
4926 	IWM_UNLOCK(sc);
4927 }
4928 
4929 static int
4930 iwm_resume(device_t dev)
4931 {
4932 	uint16_t reg;
4933 
4934 	/* Clear device-specific "PCI retry timeout" register (41h). */
4935 	reg = pci_read_config(dev, 0x40, sizeof(reg));
4936 	pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg));
4937 	iwm_init_task(device_get_softc(dev));
4938 
4939 	return 0;
4940 }
4941 
4942 static int
4943 iwm_suspend(device_t dev)
4944 {
4945 	struct iwm_softc *sc = device_get_softc(dev);
4946 
4947 	if (sc->sc_ic.ic_nrunning > 0) {
4948 		IWM_LOCK(sc);
4949 		iwm_stop(sc);
4950 		IWM_UNLOCK(sc);
4951 	}
4952 
4953 	return (0);
4954 }
4955 
4956 static int
4957 iwm_detach_local(struct iwm_softc *sc, int do_net80211)
4958 {
4959 	struct iwm_fw_info *fw = &sc->sc_fw;
4960 	device_t dev = sc->sc_dev;
4961 	int i;
4962 
4963 	if (sc->sc_tq) {
4964 		taskqueue_drain_all(sc->sc_tq);
4965 		taskqueue_free(sc->sc_tq);
4966 	}
4967 	callout_drain(&sc->sc_watchdog_to);
4968 	iwm_stop_device(sc);
4969 	if (do_net80211)
4970 		ieee80211_ifdetach(&sc->sc_ic);
4971 
4972 	/* Free descriptor rings */
4973 	for (i = 0; i < nitems(sc->txq); i++)
4974 		iwm_free_tx_ring(sc, &sc->txq[i]);
4975 
4976 	/* Free firmware */
4977 	if (fw->fw_rawdata != NULL)
4978 		iwm_fw_info_free(fw);
4979 
4980 	/* free scheduler */
4981 	iwm_free_sched(sc);
4982 	if (sc->ict_dma.vaddr != NULL)
4983 		iwm_free_ict(sc);
4984 	if (sc->kw_dma.vaddr != NULL)
4985 		iwm_free_kw(sc);
4986 	if (sc->fw_dma.vaddr != NULL)
4987 		iwm_free_fwmem(sc);
4988 
4989 	/* Finished with the hardware - detach things */
4990 	iwm_pci_detach(dev);
4991 
4992 	mbufq_drain(&sc->sc_snd);
4993 	mtx_destroy(&sc->sc_mtx);
4994 
4995 	return (0);
4996 }
4997 
4998 static int
4999 iwm_detach(device_t dev)
5000 {
5001 	struct iwm_softc *sc = device_get_softc(dev);
5002 
5003 	return (iwm_detach_local(sc, 1));
5004 }
5005 
5006 static device_method_t iwm_pci_methods[] = {
5007         /* Device interface */
5008         DEVMETHOD(device_probe,         iwm_probe),
5009         DEVMETHOD(device_attach,        iwm_attach),
5010         DEVMETHOD(device_detach,        iwm_detach),
5011         DEVMETHOD(device_suspend,       iwm_suspend),
5012         DEVMETHOD(device_resume,        iwm_resume),
5013 
5014         DEVMETHOD_END
5015 };
5016 
5017 static driver_t iwm_pci_driver = {
5018         "iwm",
5019         iwm_pci_methods,
5020         sizeof (struct iwm_softc)
5021 };
5022 
5023 static devclass_t iwm_devclass;
5024 
5025 DRIVER_MODULE(iwm, pci, iwm_pci_driver, iwm_devclass, NULL, NULL);
5026 MODULE_DEPEND(iwm, firmware, 1, 1, 1);
5027 MODULE_DEPEND(iwm, pci, 1, 1, 1);
5028 MODULE_DEPEND(iwm, wlan, 1, 1, 1);
5029