xref: /freebsd/sys/dev/iwn/if_iwn.c (revision 718519f4efc71096422fc71dab90b2a3369871ff)
1 /*-
2  * Copyright (c) 2007-2009 Damien Bergamini <damien.bergamini@free.fr>
3  * Copyright (c) 2008 Benjamin Close <benjsc@FreeBSD.org>
4  * Copyright (c) 2008 Sam Leffler, Errno Consulting
5  * Copyright (c) 2011 Intel Corporation
6  * Copyright (c) 2013 Cedric GROSS <c.gross@kreiz-it.fr>
7  * Copyright (c) 2013 Adrian Chadd <adrian@FreeBSD.org>
8  *
9  * Permission to use, copy, modify, and distribute this software for any
10  * purpose with or without fee is hereby granted, provided that the above
11  * copyright notice and this permission notice appear in all copies.
12  *
13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20  */
21 
22 /*
23  * Driver for Intel WiFi Link 4965 and 1000/5000/6000 Series 802.11 network
24  * adapters.
25  */
26 
27 #include <sys/cdefs.h>
28 #include "opt_wlan.h"
29 #include "opt_iwn.h"
30 
31 #include <sys/param.h>
32 #include <sys/sockio.h>
33 #include <sys/sysctl.h>
34 #include <sys/mbuf.h>
35 #include <sys/kernel.h>
36 #include <sys/socket.h>
37 #include <sys/systm.h>
38 #include <sys/malloc.h>
39 #include <sys/bus.h>
40 #include <sys/conf.h>
41 #include <sys/rman.h>
42 #include <sys/endian.h>
43 #include <sys/firmware.h>
44 #include <sys/limits.h>
45 #include <sys/module.h>
46 #include <sys/priv.h>
47 #include <sys/queue.h>
48 #include <sys/taskqueue.h>
49 
50 #include <machine/bus.h>
51 #include <machine/resource.h>
52 #include <machine/clock.h>
53 
54 #include <dev/pci/pcireg.h>
55 #include <dev/pci/pcivar.h>
56 
57 #include <net/if.h>
58 #include <net/if_var.h>
59 #include <net/if_dl.h>
60 #include <net/if_media.h>
61 
62 #include <netinet/in.h>
63 #include <netinet/if_ether.h>
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_radiotap.h>
67 #include <net80211/ieee80211_regdomain.h>
68 #include <net80211/ieee80211_ratectl.h>
69 
70 #include <dev/iwn/if_iwnreg.h>
71 #include <dev/iwn/if_iwnvar.h>
72 #include <dev/iwn/if_iwn_devid.h>
73 #include <dev/iwn/if_iwn_chip_cfg.h>
74 #include <dev/iwn/if_iwn_debug.h>
75 #include <dev/iwn/if_iwn_ioctl.h>
76 
77 struct iwn_ident {
78 	uint16_t	vendor;
79 	uint16_t	device;
80 	const char	*name;
81 };
82 
83 static const struct iwn_ident iwn_ident_table[] = {
84 	{ 0x8086, IWN_DID_6x05_1, "Intel Centrino Advanced-N 6205"		},
85 	{ 0x8086, IWN_DID_1000_1, "Intel Centrino Wireless-N 1000"		},
86 	{ 0x8086, IWN_DID_1000_2, "Intel Centrino Wireless-N 1000"		},
87 	{ 0x8086, IWN_DID_6x05_2, "Intel Centrino Advanced-N 6205"		},
88 	{ 0x8086, IWN_DID_6050_1, "Intel Centrino Advanced-N + WiMAX 6250"	},
89 	{ 0x8086, IWN_DID_6050_2, "Intel Centrino Advanced-N + WiMAX 6250"	},
90 	{ 0x8086, IWN_DID_x030_1, "Intel Centrino Wireless-N 1030"		},
91 	{ 0x8086, IWN_DID_x030_2, "Intel Centrino Wireless-N 1030"		},
92 	{ 0x8086, IWN_DID_x030_3, "Intel Centrino Advanced-N 6230"		},
93 	{ 0x8086, IWN_DID_x030_4, "Intel Centrino Advanced-N 6230"		},
94 	{ 0x8086, IWN_DID_6150_1, "Intel Centrino Wireless-N + WiMAX 6150"	},
95 	{ 0x8086, IWN_DID_6150_2, "Intel Centrino Wireless-N + WiMAX 6150"	},
96 	{ 0x8086, IWN_DID_2x00_1, "Intel(R) Centrino(R) Wireless-N 2200 BGN"	},
97 	{ 0x8086, IWN_DID_2x00_2, "Intel(R) Centrino(R) Wireless-N 2200 BGN"	},
98 	/* XXX 2200D is IWN_SDID_2x00_4; there's no way to express this here! */
99 	{ 0x8086, IWN_DID_2x30_1, "Intel Centrino Wireless-N 2230"		},
100 	{ 0x8086, IWN_DID_2x30_2, "Intel Centrino Wireless-N 2230"		},
101 	{ 0x8086, IWN_DID_130_1, "Intel Centrino Wireless-N 130"		},
102 	{ 0x8086, IWN_DID_130_2, "Intel Centrino Wireless-N 130"		},
103 	{ 0x8086, IWN_DID_100_1, "Intel Centrino Wireless-N 100"		},
104 	{ 0x8086, IWN_DID_100_2, "Intel Centrino Wireless-N 100"		},
105 	{ 0x8086, IWN_DID_105_1, "Intel Centrino Wireless-N 105"		},
106 	{ 0x8086, IWN_DID_105_2, "Intel Centrino Wireless-N 105"		},
107 	{ 0x8086, IWN_DID_135_1, "Intel Centrino Wireless-N 135"		},
108 	{ 0x8086, IWN_DID_135_2, "Intel Centrino Wireless-N 135"		},
109 	{ 0x8086, IWN_DID_4965_1, "Intel Wireless WiFi Link 4965"		},
110 	{ 0x8086, IWN_DID_6x00_1, "Intel Centrino Ultimate-N 6300"		},
111 	{ 0x8086, IWN_DID_6x00_2, "Intel Centrino Advanced-N 6200"		},
112 	{ 0x8086, IWN_DID_4965_2, "Intel Wireless WiFi Link 4965"		},
113 	{ 0x8086, IWN_DID_4965_3, "Intel Wireless WiFi Link 4965"		},
114 	{ 0x8086, IWN_DID_5x00_1, "Intel WiFi Link 5100"			},
115 	{ 0x8086, IWN_DID_4965_4, "Intel Wireless WiFi Link 4965"		},
116 	{ 0x8086, IWN_DID_5x00_3, "Intel Ultimate N WiFi Link 5300"		},
117 	{ 0x8086, IWN_DID_5x00_4, "Intel Ultimate N WiFi Link 5300"		},
118 	{ 0x8086, IWN_DID_5x00_2, "Intel WiFi Link 5100"			},
119 	{ 0x8086, IWN_DID_6x00_3, "Intel Centrino Ultimate-N 6300"		},
120 	{ 0x8086, IWN_DID_6x00_4, "Intel Centrino Advanced-N 6200"		},
121 	{ 0x8086, IWN_DID_5x50_1, "Intel WiMAX/WiFi Link 5350"			},
122 	{ 0x8086, IWN_DID_5x50_2, "Intel WiMAX/WiFi Link 5350"			},
123 	{ 0x8086, IWN_DID_5x50_3, "Intel WiMAX/WiFi Link 5150"			},
124 	{ 0x8086, IWN_DID_5x50_4, "Intel WiMAX/WiFi Link 5150"			},
125 	{ 0x8086, IWN_DID_6035_1, "Intel Centrino Advanced 6235"		},
126 	{ 0x8086, IWN_DID_6035_2, "Intel Centrino Advanced 6235"		},
127 	{ 0, 0, NULL }
128 };
129 
130 static int	iwn_probe(device_t);
131 static int	iwn_attach(device_t);
132 static void	iwn4965_attach(struct iwn_softc *, uint16_t);
133 static void	iwn5000_attach(struct iwn_softc *, uint16_t);
134 static int	iwn_config_specific(struct iwn_softc *, uint16_t);
135 static void	iwn_radiotap_attach(struct iwn_softc *);
136 static void	iwn_sysctlattach(struct iwn_softc *);
137 static struct ieee80211vap *iwn_vap_create(struct ieee80211com *,
138 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
139 		    const uint8_t [IEEE80211_ADDR_LEN],
140 		    const uint8_t [IEEE80211_ADDR_LEN]);
141 static void	iwn_vap_delete(struct ieee80211vap *);
142 static int	iwn_detach(device_t);
143 static int	iwn_shutdown(device_t);
144 static int	iwn_suspend(device_t);
145 static int	iwn_resume(device_t);
146 static int	iwn_nic_lock(struct iwn_softc *);
147 static int	iwn_eeprom_lock(struct iwn_softc *);
148 static int	iwn_init_otprom(struct iwn_softc *);
149 static int	iwn_read_prom_data(struct iwn_softc *, uint32_t, void *, int);
150 static void	iwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
151 static int	iwn_dma_contig_alloc(struct iwn_softc *, struct iwn_dma_info *,
152 		    void **, bus_size_t, bus_size_t);
153 static void	iwn_dma_contig_free(struct iwn_dma_info *);
154 static int	iwn_alloc_sched(struct iwn_softc *);
155 static void	iwn_free_sched(struct iwn_softc *);
156 static int	iwn_alloc_kw(struct iwn_softc *);
157 static void	iwn_free_kw(struct iwn_softc *);
158 static int	iwn_alloc_ict(struct iwn_softc *);
159 static void	iwn_free_ict(struct iwn_softc *);
160 static int	iwn_alloc_fwmem(struct iwn_softc *);
161 static void	iwn_free_fwmem(struct iwn_softc *);
162 static int	iwn_alloc_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
163 static void	iwn_reset_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
164 static void	iwn_free_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
165 static int	iwn_alloc_tx_ring(struct iwn_softc *, struct iwn_tx_ring *,
166 		    int);
167 static void	iwn_reset_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
168 static void	iwn_free_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
169 static void	iwn_check_tx_ring(struct iwn_softc *, int);
170 static void	iwn5000_ict_reset(struct iwn_softc *);
171 static int	iwn_read_eeprom(struct iwn_softc *,
172 		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
173 static void	iwn4965_read_eeprom(struct iwn_softc *);
174 #ifdef	IWN_DEBUG
175 static void	iwn4965_print_power_group(struct iwn_softc *, int);
176 #endif
177 static void	iwn5000_read_eeprom(struct iwn_softc *);
178 static uint32_t	iwn_eeprom_channel_flags(struct iwn_eeprom_chan *);
179 static void	iwn_read_eeprom_band(struct iwn_softc *, int, int, int *,
180 		    struct ieee80211_channel[]);
181 static void	iwn_read_eeprom_ht40(struct iwn_softc *, int, int, int *,
182 		    struct ieee80211_channel[]);
183 static void	iwn_read_eeprom_channels(struct iwn_softc *, int, uint32_t);
184 static struct iwn_eeprom_chan *iwn_find_eeprom_channel(struct iwn_softc *,
185 		    struct ieee80211_channel *);
186 static void	iwn_getradiocaps(struct ieee80211com *, int, int *,
187 		    struct ieee80211_channel[]);
188 static int	iwn_setregdomain(struct ieee80211com *,
189 		    struct ieee80211_regdomain *, int,
190 		    struct ieee80211_channel[]);
191 static void	iwn_read_eeprom_enhinfo(struct iwn_softc *);
192 static struct ieee80211_node *iwn_node_alloc(struct ieee80211vap *,
193 		    const uint8_t mac[IEEE80211_ADDR_LEN]);
194 static void	iwn_newassoc(struct ieee80211_node *, int);
195 static int	iwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
196 static void	iwn_calib_timeout(void *);
197 static void	iwn_rx_phy(struct iwn_softc *, struct iwn_rx_desc *);
198 static void	iwn_rx_done(struct iwn_softc *, struct iwn_rx_desc *,
199 		    struct iwn_rx_data *);
200 static void	iwn_agg_tx_complete(struct iwn_softc *, struct iwn_tx_ring *,
201 		    int, int, int);
202 static void	iwn_rx_compressed_ba(struct iwn_softc *, struct iwn_rx_desc *);
203 static void	iwn5000_rx_calib_results(struct iwn_softc *,
204 		    struct iwn_rx_desc *);
205 static void	iwn_rx_statistics(struct iwn_softc *, struct iwn_rx_desc *);
206 static void	iwn4965_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
207 		    struct iwn_rx_data *);
208 static void	iwn5000_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
209 		    struct iwn_rx_data *);
210 static void	iwn_adj_ampdu_ptr(struct iwn_softc *, struct iwn_tx_ring *);
211 static void	iwn_tx_done(struct iwn_softc *, struct iwn_rx_desc *, int, int,
212 		    uint8_t);
213 static int	iwn_ampdu_check_bitmap(uint64_t, int, int);
214 static int	iwn_ampdu_index_check(struct iwn_softc *, struct iwn_tx_ring *,
215 		    uint64_t, int, int);
216 static void	iwn_ampdu_tx_done(struct iwn_softc *, int, int, int, void *);
217 static void	iwn_cmd_done(struct iwn_softc *, struct iwn_rx_desc *);
218 static void	iwn_notif_intr(struct iwn_softc *);
219 static void	iwn_wakeup_intr(struct iwn_softc *);
220 static void	iwn_rftoggle_task(void *, int);
221 static void	iwn_fatal_intr(struct iwn_softc *);
222 static void	iwn_intr(void *);
223 static void	iwn4965_update_sched(struct iwn_softc *, int, int, uint8_t,
224 		    uint16_t);
225 static void	iwn5000_update_sched(struct iwn_softc *, int, int, uint8_t,
226 		    uint16_t);
227 #ifdef notyet
228 static void	iwn5000_reset_sched(struct iwn_softc *, int, int);
229 #endif
230 static int	iwn_tx_data(struct iwn_softc *, struct mbuf *,
231 		    struct ieee80211_node *);
232 static int	iwn_tx_data_raw(struct iwn_softc *, struct mbuf *,
233 		    struct ieee80211_node *,
234 		    const struct ieee80211_bpf_params *params);
235 static int	iwn_tx_cmd(struct iwn_softc *, struct mbuf *,
236 		    struct ieee80211_node *, struct iwn_tx_ring *);
237 static void	iwn_xmit_task(void *arg0, int pending);
238 static int	iwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
239 		    const struct ieee80211_bpf_params *);
240 static int	iwn_transmit(struct ieee80211com *, struct mbuf *);
241 static void	iwn_scan_timeout(void *);
242 static void	iwn_watchdog(void *);
243 static int	iwn_ioctl(struct ieee80211com *, u_long , void *);
244 static void	iwn_parent(struct ieee80211com *);
245 static int	iwn_cmd(struct iwn_softc *, int, const void *, int, int);
246 static int	iwn4965_add_node(struct iwn_softc *, struct iwn_node_info *,
247 		    int);
248 static int	iwn5000_add_node(struct iwn_softc *, struct iwn_node_info *,
249 		    int);
250 static int	iwn_set_link_quality(struct iwn_softc *,
251 		    struct ieee80211_node *);
252 static int	iwn_add_broadcast_node(struct iwn_softc *, int);
253 static int	iwn_updateedca(struct ieee80211com *);
254 static void	iwn_set_promisc(struct iwn_softc *);
255 static void	iwn_update_promisc(struct ieee80211com *);
256 static void	iwn_update_mcast(struct ieee80211com *);
257 static void	iwn_set_led(struct iwn_softc *, uint8_t, uint8_t, uint8_t);
258 static int	iwn_set_critical_temp(struct iwn_softc *);
259 static int	iwn_set_timing(struct iwn_softc *, struct ieee80211_node *);
260 static void	iwn4965_power_calibration(struct iwn_softc *, int);
261 static int	iwn4965_set_txpower(struct iwn_softc *, int);
262 static int	iwn5000_set_txpower(struct iwn_softc *, int);
263 static int	iwn4965_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
264 static int	iwn5000_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
265 static int	iwn_get_noise(const struct iwn_rx_general_stats *);
266 static int	iwn4965_get_temperature(struct iwn_softc *);
267 static int	iwn5000_get_temperature(struct iwn_softc *);
268 static int	iwn_init_sensitivity(struct iwn_softc *);
269 static void	iwn_collect_noise(struct iwn_softc *,
270 		    const struct iwn_rx_general_stats *);
271 static int	iwn4965_init_gains(struct iwn_softc *);
272 static int	iwn5000_init_gains(struct iwn_softc *);
273 static int	iwn4965_set_gains(struct iwn_softc *);
274 static int	iwn5000_set_gains(struct iwn_softc *);
275 static void	iwn_tune_sensitivity(struct iwn_softc *,
276 		    const struct iwn_rx_stats *);
277 static void	iwn_save_stats_counters(struct iwn_softc *,
278 		    const struct iwn_stats *);
279 static int	iwn_send_sensitivity(struct iwn_softc *);
280 static void	iwn_check_rx_recovery(struct iwn_softc *, struct iwn_stats *);
281 static int	iwn_set_pslevel(struct iwn_softc *, int, int, int);
282 static int	iwn_send_btcoex(struct iwn_softc *);
283 static int	iwn_send_advanced_btcoex(struct iwn_softc *);
284 static int	iwn5000_runtime_calib(struct iwn_softc *);
285 static int	iwn_check_bss_filter(struct iwn_softc *);
286 static int	iwn4965_rxon_assoc(struct iwn_softc *, int);
287 static int	iwn5000_rxon_assoc(struct iwn_softc *, int);
288 static int	iwn_send_rxon(struct iwn_softc *, int, int);
289 static int	iwn_config(struct iwn_softc *);
290 static int	iwn_scan(struct iwn_softc *, struct ieee80211vap *,
291 		    struct ieee80211_scan_state *, struct ieee80211_channel *);
292 static int	iwn_auth(struct iwn_softc *, struct ieee80211vap *vap);
293 static int	iwn_run(struct iwn_softc *, struct ieee80211vap *vap);
294 static int	iwn_ampdu_rx_start(struct ieee80211_node *,
295 		    struct ieee80211_rx_ampdu *, int, int, int);
296 static void	iwn_ampdu_rx_stop(struct ieee80211_node *,
297 		    struct ieee80211_rx_ampdu *);
298 static int	iwn_addba_request(struct ieee80211_node *,
299 		    struct ieee80211_tx_ampdu *, int, int, int);
300 static int	iwn_addba_response(struct ieee80211_node *,
301 		    struct ieee80211_tx_ampdu *, int, int, int);
302 static int	iwn_ampdu_tx_start(struct ieee80211com *,
303 		    struct ieee80211_node *, uint8_t);
304 static void	iwn_ampdu_tx_stop(struct ieee80211_node *,
305 		    struct ieee80211_tx_ampdu *);
306 static void	iwn4965_ampdu_tx_start(struct iwn_softc *,
307 		    struct ieee80211_node *, int, uint8_t, uint16_t);
308 static void	iwn4965_ampdu_tx_stop(struct iwn_softc *, int,
309 		    uint8_t, uint16_t);
310 static void	iwn5000_ampdu_tx_start(struct iwn_softc *,
311 		    struct ieee80211_node *, int, uint8_t, uint16_t);
312 static void	iwn5000_ampdu_tx_stop(struct iwn_softc *, int,
313 		    uint8_t, uint16_t);
314 static int	iwn5000_query_calibration(struct iwn_softc *);
315 static int	iwn5000_send_calibration(struct iwn_softc *);
316 static int	iwn5000_send_wimax_coex(struct iwn_softc *);
317 static int	iwn5000_crystal_calib(struct iwn_softc *);
318 static int	iwn5000_temp_offset_calib(struct iwn_softc *);
319 static int	iwn5000_temp_offset_calibv2(struct iwn_softc *);
320 static int	iwn4965_post_alive(struct iwn_softc *);
321 static int	iwn5000_post_alive(struct iwn_softc *);
322 static int	iwn4965_load_bootcode(struct iwn_softc *, const uint8_t *,
323 		    int);
324 static int	iwn4965_load_firmware(struct iwn_softc *);
325 static int	iwn5000_load_firmware_section(struct iwn_softc *, uint32_t,
326 		    const uint8_t *, int);
327 static int	iwn5000_load_firmware(struct iwn_softc *);
328 static int	iwn_read_firmware_leg(struct iwn_softc *,
329 		    struct iwn_fw_info *);
330 static int	iwn_read_firmware_tlv(struct iwn_softc *,
331 		    struct iwn_fw_info *, uint16_t);
332 static int	iwn_read_firmware(struct iwn_softc *);
333 static void	iwn_unload_firmware(struct iwn_softc *);
334 static int	iwn_clock_wait(struct iwn_softc *);
335 static int	iwn_apm_init(struct iwn_softc *);
336 static void	iwn_apm_stop_master(struct iwn_softc *);
337 static void	iwn_apm_stop(struct iwn_softc *);
338 static int	iwn4965_nic_config(struct iwn_softc *);
339 static int	iwn5000_nic_config(struct iwn_softc *);
340 static int	iwn_hw_prepare(struct iwn_softc *);
341 static int	iwn_hw_init(struct iwn_softc *);
342 static void	iwn_hw_stop(struct iwn_softc *);
343 static void	iwn_panicked(void *, int);
344 static int	iwn_init_locked(struct iwn_softc *);
345 static int	iwn_init(struct iwn_softc *);
346 static void	iwn_stop_locked(struct iwn_softc *);
347 static void	iwn_stop(struct iwn_softc *);
348 static void	iwn_scan_start(struct ieee80211com *);
349 static void	iwn_scan_end(struct ieee80211com *);
350 static void	iwn_set_channel(struct ieee80211com *);
351 static void	iwn_scan_curchan(struct ieee80211_scan_state *, unsigned long);
352 static void	iwn_scan_mindwell(struct ieee80211_scan_state *);
353 #ifdef	IWN_DEBUG
354 static char	*iwn_get_csr_string(int);
355 static void	iwn_debug_register(struct iwn_softc *);
356 #endif
357 
358 static device_method_t iwn_methods[] = {
359 	/* Device interface */
360 	DEVMETHOD(device_probe,		iwn_probe),
361 	DEVMETHOD(device_attach,	iwn_attach),
362 	DEVMETHOD(device_detach,	iwn_detach),
363 	DEVMETHOD(device_shutdown,	iwn_shutdown),
364 	DEVMETHOD(device_suspend,	iwn_suspend),
365 	DEVMETHOD(device_resume,	iwn_resume),
366 
367 	DEVMETHOD_END
368 };
369 
370 static driver_t iwn_driver = {
371 	"iwn",
372 	iwn_methods,
373 	sizeof(struct iwn_softc)
374 };
375 
376 DRIVER_MODULE(iwn, pci, iwn_driver, NULL, NULL);
377 MODULE_PNP_INFO("U16:vendor;U16:device;D:#", pci, iwn, iwn_ident_table,
378     nitems(iwn_ident_table) - 1);
379 MODULE_VERSION(iwn, 1);
380 
381 MODULE_DEPEND(iwn, firmware, 1, 1, 1);
382 MODULE_DEPEND(iwn, pci, 1, 1, 1);
383 MODULE_DEPEND(iwn, wlan, 1, 1, 1);
384 
385 static d_ioctl_t iwn_cdev_ioctl;
386 static d_open_t iwn_cdev_open;
387 static d_close_t iwn_cdev_close;
388 
389 static struct cdevsw iwn_cdevsw = {
390 	.d_version = D_VERSION,
391 	.d_flags = 0,
392 	.d_open = iwn_cdev_open,
393 	.d_close = iwn_cdev_close,
394 	.d_ioctl = iwn_cdev_ioctl,
395 	.d_name = "iwn",
396 };
397 
398 static int
399 iwn_probe(device_t dev)
400 {
401 	const struct iwn_ident *ident;
402 
403 	for (ident = iwn_ident_table; ident->name != NULL; ident++) {
404 		if (pci_get_vendor(dev) == ident->vendor &&
405 		    pci_get_device(dev) == ident->device) {
406 			device_set_desc(dev, ident->name);
407 			return (BUS_PROBE_DEFAULT);
408 		}
409 	}
410 	return ENXIO;
411 }
412 
413 static int
414 iwn_is_3stream_device(struct iwn_softc *sc)
415 {
416 	/* XXX for now only 5300, until the 5350 can be tested */
417 	if (sc->hw_type == IWN_HW_REV_TYPE_5300)
418 		return (1);
419 	return (0);
420 }
421 
422 static int
423 iwn_attach(device_t dev)
424 {
425 	struct iwn_softc *sc = device_get_softc(dev);
426 	struct ieee80211com *ic;
427 	int i, error, rid;
428 
429 	sc->sc_dev = dev;
430 
431 #ifdef	IWN_DEBUG
432 	error = resource_int_value(device_get_name(sc->sc_dev),
433 	    device_get_unit(sc->sc_dev), "debug", &(sc->sc_debug));
434 	if (error != 0)
435 		sc->sc_debug = 0;
436 #else
437 	sc->sc_debug = 0;
438 #endif
439 
440 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: begin\n",__func__);
441 
442 	/*
443 	 * Get the offset of the PCI Express Capability Structure in PCI
444 	 * Configuration Space.
445 	 */
446 	error = pci_find_cap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
447 	if (error != 0) {
448 		device_printf(dev, "PCIe capability structure not found!\n");
449 		return error;
450 	}
451 
452 	/* Clear device-specific "PCI retry timeout" register (41h). */
453 	pci_write_config(dev, 0x41, 0, 1);
454 
455 	/* Enable bus-mastering. */
456 	pci_enable_busmaster(dev);
457 
458 	rid = PCIR_BAR(0);
459 	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
460 	    RF_ACTIVE);
461 	if (sc->mem == NULL) {
462 		device_printf(dev, "can't map mem space\n");
463 		error = ENOMEM;
464 		return error;
465 	}
466 	sc->sc_st = rman_get_bustag(sc->mem);
467 	sc->sc_sh = rman_get_bushandle(sc->mem);
468 
469 	i = 1;
470 	rid = 0;
471 	if (pci_alloc_msi(dev, &i) == 0)
472 		rid = 1;
473 	/* Install interrupt handler. */
474 	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
475 	    (rid != 0 ? 0 : RF_SHAREABLE));
476 	if (sc->irq == NULL) {
477 		device_printf(dev, "can't map interrupt\n");
478 		error = ENOMEM;
479 		goto fail;
480 	}
481 
482 	IWN_LOCK_INIT(sc);
483 
484 	/* Read hardware revision and attach. */
485 	sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> IWN_HW_REV_TYPE_SHIFT)
486 	    & IWN_HW_REV_TYPE_MASK;
487 	sc->subdevice_id = pci_get_subdevice(dev);
488 
489 	/*
490 	 * 4965 versus 5000 and later have different methods.
491 	 * Let's set those up first.
492 	 */
493 	if (sc->hw_type == IWN_HW_REV_TYPE_4965)
494 		iwn4965_attach(sc, pci_get_device(dev));
495 	else
496 		iwn5000_attach(sc, pci_get_device(dev));
497 
498 	/*
499 	 * Next, let's setup the various parameters of each NIC.
500 	 */
501 	error = iwn_config_specific(sc, pci_get_device(dev));
502 	if (error != 0) {
503 		device_printf(dev, "could not attach device, error %d\n",
504 		    error);
505 		goto fail;
506 	}
507 
508 	if ((error = iwn_hw_prepare(sc)) != 0) {
509 		device_printf(dev, "hardware not ready, error %d\n", error);
510 		goto fail;
511 	}
512 
513 	/* Allocate DMA memory for firmware transfers. */
514 	if ((error = iwn_alloc_fwmem(sc)) != 0) {
515 		device_printf(dev,
516 		    "could not allocate memory for firmware, error %d\n",
517 		    error);
518 		goto fail;
519 	}
520 
521 	/* Allocate "Keep Warm" page. */
522 	if ((error = iwn_alloc_kw(sc)) != 0) {
523 		device_printf(dev,
524 		    "could not allocate keep warm page, error %d\n", error);
525 		goto fail;
526 	}
527 
528 	/* Allocate ICT table for 5000 Series. */
529 	if (sc->hw_type != IWN_HW_REV_TYPE_4965 &&
530 	    (error = iwn_alloc_ict(sc)) != 0) {
531 		device_printf(dev, "could not allocate ICT table, error %d\n",
532 		    error);
533 		goto fail;
534 	}
535 
536 	/* Allocate TX scheduler "rings". */
537 	if ((error = iwn_alloc_sched(sc)) != 0) {
538 		device_printf(dev,
539 		    "could not allocate TX scheduler rings, error %d\n", error);
540 		goto fail;
541 	}
542 
543 	/* Allocate TX rings (16 on 4965AGN, 20 on >=5000). */
544 	for (i = 0; i < sc->ntxqs; i++) {
545 		if ((error = iwn_alloc_tx_ring(sc, &sc->txq[i], i)) != 0) {
546 			device_printf(dev,
547 			    "could not allocate TX ring %d, error %d\n", i,
548 			    error);
549 			goto fail;
550 		}
551 	}
552 
553 	/* Allocate RX ring. */
554 	if ((error = iwn_alloc_rx_ring(sc, &sc->rxq)) != 0) {
555 		device_printf(dev, "could not allocate RX ring, error %d\n",
556 		    error);
557 		goto fail;
558 	}
559 
560 	/* Clear pending interrupts. */
561 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
562 
563 	ic = &sc->sc_ic;
564 	ic->ic_softc = sc;
565 	ic->ic_name = device_get_nameunit(dev);
566 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
567 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
568 
569 	/* Set device capabilities. */
570 	ic->ic_caps =
571 		  IEEE80211_C_STA		/* station mode supported */
572 		| IEEE80211_C_MONITOR		/* monitor mode supported */
573 #if 0
574 		| IEEE80211_C_BGSCAN		/* background scanning */
575 #endif
576 		| IEEE80211_C_TXPMGT		/* tx power management */
577 		| IEEE80211_C_SHSLOT		/* short slot time supported */
578 		| IEEE80211_C_WPA
579 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
580 #if 0
581 		| IEEE80211_C_IBSS		/* ibss/adhoc mode */
582 #endif
583 		| IEEE80211_C_WME		/* WME */
584 		| IEEE80211_C_PMGT		/* Station-side power mgmt */
585 		;
586 
587 	/* Read MAC address, channels, etc from EEPROM. */
588 	if ((error = iwn_read_eeprom(sc, ic->ic_macaddr)) != 0) {
589 		device_printf(dev, "could not read EEPROM, error %d\n",
590 		    error);
591 		goto fail;
592 	}
593 
594 	/* Count the number of available chains. */
595 	sc->ntxchains =
596 	    ((sc->txchainmask >> 2) & 1) +
597 	    ((sc->txchainmask >> 1) & 1) +
598 	    ((sc->txchainmask >> 0) & 1);
599 	sc->nrxchains =
600 	    ((sc->rxchainmask >> 2) & 1) +
601 	    ((sc->rxchainmask >> 1) & 1) +
602 	    ((sc->rxchainmask >> 0) & 1);
603 	if (bootverbose) {
604 		device_printf(dev, "MIMO %dT%dR, %.4s, address %6D\n",
605 		    sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
606 		    ic->ic_macaddr, ":");
607 	}
608 
609 	if (sc->sc_flags & IWN_FLAG_HAS_11N) {
610 		ic->ic_rxstream = sc->nrxchains;
611 		ic->ic_txstream = sc->ntxchains;
612 
613 		/*
614 		 * Some of the 3 antenna devices (ie, the 4965) only supports
615 		 * 2x2 operation.  So correct the number of streams if
616 		 * it's not a 3-stream device.
617 		 */
618 		if (! iwn_is_3stream_device(sc)) {
619 			if (ic->ic_rxstream > 2)
620 				ic->ic_rxstream = 2;
621 			if (ic->ic_txstream > 2)
622 				ic->ic_txstream = 2;
623 		}
624 
625 		ic->ic_htcaps =
626 			  IEEE80211_HTCAP_SMPS_OFF	/* SMPS mode disabled */
627 			| IEEE80211_HTCAP_SHORTGI20	/* short GI in 20MHz */
628 			| IEEE80211_HTCAP_CHWIDTH40	/* 40MHz channel width*/
629 			| IEEE80211_HTCAP_SHORTGI40	/* short GI in 40MHz */
630 #ifdef notyet
631 			| IEEE80211_HTCAP_GREENFIELD
632 #if IWN_RBUF_SIZE == 8192
633 			| IEEE80211_HTCAP_MAXAMSDU_7935	/* max A-MSDU length */
634 #else
635 			| IEEE80211_HTCAP_MAXAMSDU_3839	/* max A-MSDU length */
636 #endif
637 #endif
638 			/* s/w capabilities */
639 			| IEEE80211_HTC_HT		/* HT operation */
640 			| IEEE80211_HTC_AMPDU		/* tx A-MPDU */
641 #ifdef notyet
642 			| IEEE80211_HTC_AMSDU		/* tx A-MSDU */
643 #endif
644 			;
645 	}
646 
647 	ieee80211_ifattach(ic);
648 	ic->ic_vap_create = iwn_vap_create;
649 	ic->ic_ioctl = iwn_ioctl;
650 	ic->ic_parent = iwn_parent;
651 	ic->ic_vap_delete = iwn_vap_delete;
652 	ic->ic_transmit = iwn_transmit;
653 	ic->ic_raw_xmit = iwn_raw_xmit;
654 	ic->ic_node_alloc = iwn_node_alloc;
655 	sc->sc_ampdu_rx_start = ic->ic_ampdu_rx_start;
656 	ic->ic_ampdu_rx_start = iwn_ampdu_rx_start;
657 	sc->sc_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
658 	ic->ic_ampdu_rx_stop = iwn_ampdu_rx_stop;
659 	sc->sc_addba_request = ic->ic_addba_request;
660 	ic->ic_addba_request = iwn_addba_request;
661 	sc->sc_addba_response = ic->ic_addba_response;
662 	ic->ic_addba_response = iwn_addba_response;
663 	sc->sc_addba_stop = ic->ic_addba_stop;
664 	ic->ic_addba_stop = iwn_ampdu_tx_stop;
665 	ic->ic_newassoc = iwn_newassoc;
666 	ic->ic_wme.wme_update = iwn_updateedca;
667 	ic->ic_update_promisc = iwn_update_promisc;
668 	ic->ic_update_mcast = iwn_update_mcast;
669 	ic->ic_scan_start = iwn_scan_start;
670 	ic->ic_scan_end = iwn_scan_end;
671 	ic->ic_set_channel = iwn_set_channel;
672 	ic->ic_scan_curchan = iwn_scan_curchan;
673 	ic->ic_scan_mindwell = iwn_scan_mindwell;
674 	ic->ic_getradiocaps = iwn_getradiocaps;
675 	ic->ic_setregdomain = iwn_setregdomain;
676 
677 	iwn_radiotap_attach(sc);
678 
679 	callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
680 	callout_init_mtx(&sc->scan_timeout, &sc->sc_mtx, 0);
681 	callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
682 	TASK_INIT(&sc->sc_rftoggle_task, 0, iwn_rftoggle_task, sc);
683 	TASK_INIT(&sc->sc_panic_task, 0, iwn_panicked, sc);
684 	TASK_INIT(&sc->sc_xmit_task, 0, iwn_xmit_task, sc);
685 
686 	mbufq_init(&sc->sc_xmit_queue, 1024);
687 
688 	sc->sc_tq = taskqueue_create("iwn_taskq", M_WAITOK,
689 	    taskqueue_thread_enqueue, &sc->sc_tq);
690 	error = taskqueue_start_threads(&sc->sc_tq, 1, 0, "iwn_taskq");
691 	if (error != 0) {
692 		device_printf(dev, "can't start threads, error %d\n", error);
693 		goto fail;
694 	}
695 
696 	iwn_sysctlattach(sc);
697 
698 	/*
699 	 * Hook our interrupt after all initialization is complete.
700 	 */
701 	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
702 	    NULL, iwn_intr, sc, &sc->sc_ih);
703 	if (error != 0) {
704 		device_printf(dev, "can't establish interrupt, error %d\n",
705 		    error);
706 		goto fail;
707 	}
708 
709 #if 0
710 	device_printf(sc->sc_dev, "%s: rx_stats=%d, rx_stats_bt=%d\n",
711 	    __func__,
712 	    sizeof(struct iwn_stats),
713 	    sizeof(struct iwn_stats_bt));
714 #endif
715 
716 	if (bootverbose)
717 		ieee80211_announce(ic);
718 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
719 
720 	/* Add debug ioctl right at the end */
721 	sc->sc_cdev = make_dev(&iwn_cdevsw, device_get_unit(dev),
722 	    UID_ROOT, GID_WHEEL, 0600, "%s", device_get_nameunit(dev));
723 	if (sc->sc_cdev == NULL) {
724 		device_printf(dev, "failed to create debug character device\n");
725 	} else {
726 		sc->sc_cdev->si_drv1 = sc;
727 	}
728 	return 0;
729 fail:
730 	iwn_detach(dev);
731 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
732 	return error;
733 }
734 
735 /*
736  * Define specific configuration based on device id and subdevice id
737  * pid : PCI device id
738  */
739 static int
740 iwn_config_specific(struct iwn_softc *sc, uint16_t pid)
741 {
742 
743 	switch (pid) {
744 /* 4965 series */
745 	case IWN_DID_4965_1:
746 	case IWN_DID_4965_2:
747 	case IWN_DID_4965_3:
748 	case IWN_DID_4965_4:
749 		sc->base_params = &iwn4965_base_params;
750 		sc->limits = &iwn4965_sensitivity_limits;
751 		sc->fwname = "iwn4965fw";
752 		/* Override chains masks, ROM is known to be broken. */
753 		sc->txchainmask = IWN_ANT_AB;
754 		sc->rxchainmask = IWN_ANT_ABC;
755 		/* Enable normal btcoex */
756 		sc->sc_flags |= IWN_FLAG_BTCOEX;
757 		break;
758 /* 1000 Series */
759 	case IWN_DID_1000_1:
760 	case IWN_DID_1000_2:
761 		switch(sc->subdevice_id) {
762 			case	IWN_SDID_1000_1:
763 			case	IWN_SDID_1000_2:
764 			case	IWN_SDID_1000_3:
765 			case	IWN_SDID_1000_4:
766 			case	IWN_SDID_1000_5:
767 			case	IWN_SDID_1000_6:
768 			case	IWN_SDID_1000_7:
769 			case	IWN_SDID_1000_8:
770 			case	IWN_SDID_1000_9:
771 			case	IWN_SDID_1000_10:
772 			case	IWN_SDID_1000_11:
773 			case	IWN_SDID_1000_12:
774 				sc->limits = &iwn1000_sensitivity_limits;
775 				sc->base_params = &iwn1000_base_params;
776 				sc->fwname = "iwn1000fw";
777 				break;
778 			default:
779 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
780 				    "0x%04x rev %d not supported (subdevice)\n", pid,
781 				    sc->subdevice_id,sc->hw_type);
782 				return ENOTSUP;
783 		}
784 		break;
785 /* 6x00 Series */
786 	case IWN_DID_6x00_2:
787 	case IWN_DID_6x00_4:
788 	case IWN_DID_6x00_1:
789 	case IWN_DID_6x00_3:
790 		sc->fwname = "iwn6000fw";
791 		sc->limits = &iwn6000_sensitivity_limits;
792 		switch(sc->subdevice_id) {
793 			case IWN_SDID_6x00_1:
794 			case IWN_SDID_6x00_2:
795 			case IWN_SDID_6x00_8:
796 				//iwl6000_3agn_cfg
797 				sc->base_params = &iwn_6000_base_params;
798 				break;
799 			case IWN_SDID_6x00_3:
800 			case IWN_SDID_6x00_6:
801 			case IWN_SDID_6x00_9:
802 				////iwl6000i_2agn
803 			case IWN_SDID_6x00_4:
804 			case IWN_SDID_6x00_7:
805 			case IWN_SDID_6x00_10:
806 				//iwl6000i_2abg_cfg
807 			case IWN_SDID_6x00_5:
808 				//iwl6000i_2bg_cfg
809 				sc->base_params = &iwn_6000i_base_params;
810 				sc->sc_flags |= IWN_FLAG_INTERNAL_PA;
811 				sc->txchainmask = IWN_ANT_BC;
812 				sc->rxchainmask = IWN_ANT_BC;
813 				break;
814 			default:
815 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
816 				    "0x%04x rev %d not supported (subdevice)\n", pid,
817 				    sc->subdevice_id,sc->hw_type);
818 				return ENOTSUP;
819 		}
820 		break;
821 /* 6x05 Series */
822 	case IWN_DID_6x05_1:
823 	case IWN_DID_6x05_2:
824 		switch(sc->subdevice_id) {
825 			case IWN_SDID_6x05_1:
826 			case IWN_SDID_6x05_4:
827 			case IWN_SDID_6x05_6:
828 				//iwl6005_2agn_cfg
829 			case IWN_SDID_6x05_2:
830 			case IWN_SDID_6x05_5:
831 			case IWN_SDID_6x05_7:
832 				//iwl6005_2abg_cfg
833 			case IWN_SDID_6x05_3:
834 				//iwl6005_2bg_cfg
835 			case IWN_SDID_6x05_8:
836 			case IWN_SDID_6x05_9:
837 				//iwl6005_2agn_sff_cfg
838 			case IWN_SDID_6x05_10:
839 				//iwl6005_2agn_d_cfg
840 			case IWN_SDID_6x05_11:
841 				//iwl6005_2agn_mow1_cfg
842 			case IWN_SDID_6x05_12:
843 				//iwl6005_2agn_mow2_cfg
844 				sc->fwname = "iwn6000g2afw";
845 				sc->limits = &iwn6000_sensitivity_limits;
846 				sc->base_params = &iwn_6000g2_base_params;
847 				break;
848 			default:
849 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
850 				    "0x%04x rev %d not supported (subdevice)\n", pid,
851 				    sc->subdevice_id,sc->hw_type);
852 				return ENOTSUP;
853 		}
854 		break;
855 /* 6x35 Series */
856 	case IWN_DID_6035_1:
857 	case IWN_DID_6035_2:
858 		switch(sc->subdevice_id) {
859 			case IWN_SDID_6035_1:
860 			case IWN_SDID_6035_2:
861 			case IWN_SDID_6035_3:
862 			case IWN_SDID_6035_4:
863 			case IWN_SDID_6035_5:
864 				sc->fwname = "iwn6000g2bfw";
865 				sc->limits = &iwn6235_sensitivity_limits;
866 				sc->base_params = &iwn_6235_base_params;
867 				break;
868 			default:
869 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
870 				    "0x%04x rev %d not supported (subdevice)\n", pid,
871 				    sc->subdevice_id,sc->hw_type);
872 				return ENOTSUP;
873 		}
874 		break;
875 /* 6x50 WiFi/WiMax Series */
876 	case IWN_DID_6050_1:
877 	case IWN_DID_6050_2:
878 		switch(sc->subdevice_id) {
879 			case IWN_SDID_6050_1:
880 			case IWN_SDID_6050_3:
881 			case IWN_SDID_6050_5:
882 				//iwl6050_2agn_cfg
883 			case IWN_SDID_6050_2:
884 			case IWN_SDID_6050_4:
885 			case IWN_SDID_6050_6:
886 				//iwl6050_2abg_cfg
887 				sc->fwname = "iwn6050fw";
888 				sc->txchainmask = IWN_ANT_AB;
889 				sc->rxchainmask = IWN_ANT_AB;
890 				sc->limits = &iwn6000_sensitivity_limits;
891 				sc->base_params = &iwn_6050_base_params;
892 				break;
893 			default:
894 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
895 				    "0x%04x rev %d not supported (subdevice)\n", pid,
896 				    sc->subdevice_id,sc->hw_type);
897 				return ENOTSUP;
898 		}
899 		break;
900 /* 6150 WiFi/WiMax Series */
901 	case IWN_DID_6150_1:
902 	case IWN_DID_6150_2:
903 		switch(sc->subdevice_id) {
904 			case IWN_SDID_6150_1:
905 			case IWN_SDID_6150_3:
906 			case IWN_SDID_6150_5:
907 				// iwl6150_bgn_cfg
908 			case IWN_SDID_6150_2:
909 			case IWN_SDID_6150_4:
910 			case IWN_SDID_6150_6:
911 				//iwl6150_bg_cfg
912 				sc->fwname = "iwn6050fw";
913 				sc->limits = &iwn6000_sensitivity_limits;
914 				sc->base_params = &iwn_6150_base_params;
915 				break;
916 			default:
917 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
918 				    "0x%04x rev %d not supported (subdevice)\n", pid,
919 				    sc->subdevice_id,sc->hw_type);
920 				return ENOTSUP;
921 		}
922 		break;
923 /* 6030 Series and 1030 Series */
924 	case IWN_DID_x030_1:
925 	case IWN_DID_x030_2:
926 	case IWN_DID_x030_3:
927 	case IWN_DID_x030_4:
928 		switch(sc->subdevice_id) {
929 			case IWN_SDID_x030_1:
930 			case IWN_SDID_x030_3:
931 			case IWN_SDID_x030_5:
932 			// iwl1030_bgn_cfg
933 			case IWN_SDID_x030_2:
934 			case IWN_SDID_x030_4:
935 			case IWN_SDID_x030_6:
936 			//iwl1030_bg_cfg
937 			case IWN_SDID_x030_7:
938 			case IWN_SDID_x030_10:
939 			case IWN_SDID_x030_14:
940 			//iwl6030_2agn_cfg
941 			case IWN_SDID_x030_8:
942 			case IWN_SDID_x030_11:
943 			case IWN_SDID_x030_15:
944 			// iwl6030_2bgn_cfg
945 			case IWN_SDID_x030_9:
946 			case IWN_SDID_x030_12:
947 			case IWN_SDID_x030_16:
948 			// iwl6030_2abg_cfg
949 			case IWN_SDID_x030_13:
950 			//iwl6030_2bg_cfg
951 				sc->fwname = "iwn6000g2bfw";
952 				sc->limits = &iwn6000_sensitivity_limits;
953 				sc->base_params = &iwn_6000g2b_base_params;
954 				break;
955 			default:
956 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
957 				    "0x%04x rev %d not supported (subdevice)\n", pid,
958 				    sc->subdevice_id,sc->hw_type);
959 				return ENOTSUP;
960 		}
961 		break;
962 /* 130 Series WiFi */
963 /* XXX: This series will need adjustment for rate.
964  * see rx_with_siso_diversity in linux kernel
965  */
966 	case IWN_DID_130_1:
967 	case IWN_DID_130_2:
968 		switch(sc->subdevice_id) {
969 			case IWN_SDID_130_1:
970 			case IWN_SDID_130_3:
971 			case IWN_SDID_130_5:
972 			//iwl130_bgn_cfg
973 			case IWN_SDID_130_2:
974 			case IWN_SDID_130_4:
975 			case IWN_SDID_130_6:
976 			//iwl130_bg_cfg
977 				sc->fwname = "iwn6000g2bfw";
978 				sc->limits = &iwn6000_sensitivity_limits;
979 				sc->base_params = &iwn_6000g2b_base_params;
980 				break;
981 			default:
982 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
983 				    "0x%04x rev %d not supported (subdevice)\n", pid,
984 				    sc->subdevice_id,sc->hw_type);
985 				return ENOTSUP;
986 		}
987 		break;
988 /* 100 Series WiFi */
989 	case IWN_DID_100_1:
990 	case IWN_DID_100_2:
991 		switch(sc->subdevice_id) {
992 			case IWN_SDID_100_1:
993 			case IWN_SDID_100_2:
994 			case IWN_SDID_100_3:
995 			case IWN_SDID_100_4:
996 			case IWN_SDID_100_5:
997 			case IWN_SDID_100_6:
998 				sc->limits = &iwn1000_sensitivity_limits;
999 				sc->base_params = &iwn1000_base_params;
1000 				sc->fwname = "iwn100fw";
1001 				break;
1002 			default:
1003 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1004 				    "0x%04x rev %d not supported (subdevice)\n", pid,
1005 				    sc->subdevice_id,sc->hw_type);
1006 				return ENOTSUP;
1007 		}
1008 		break;
1009 
1010 /* 105 Series */
1011 /* XXX: This series will need adjustment for rate.
1012  * see rx_with_siso_diversity in linux kernel
1013  */
1014 	case IWN_DID_105_1:
1015 	case IWN_DID_105_2:
1016 		switch(sc->subdevice_id) {
1017 			case IWN_SDID_105_1:
1018 			case IWN_SDID_105_2:
1019 			case IWN_SDID_105_3:
1020 			//iwl105_bgn_cfg
1021 			case IWN_SDID_105_4:
1022 			//iwl105_bgn_d_cfg
1023 				sc->limits = &iwn2030_sensitivity_limits;
1024 				sc->base_params = &iwn2000_base_params;
1025 				sc->fwname = "iwn105fw";
1026 				break;
1027 			default:
1028 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1029 				    "0x%04x rev %d not supported (subdevice)\n", pid,
1030 				    sc->subdevice_id,sc->hw_type);
1031 				return ENOTSUP;
1032 		}
1033 		break;
1034 
1035 /* 135 Series */
1036 /* XXX: This series will need adjustment for rate.
1037  * see rx_with_siso_diversity in linux kernel
1038  */
1039 	case IWN_DID_135_1:
1040 	case IWN_DID_135_2:
1041 		switch(sc->subdevice_id) {
1042 			case IWN_SDID_135_1:
1043 			case IWN_SDID_135_2:
1044 			case IWN_SDID_135_3:
1045 				sc->limits = &iwn2030_sensitivity_limits;
1046 				sc->base_params = &iwn2030_base_params;
1047 				sc->fwname = "iwn135fw";
1048 				break;
1049 			default:
1050 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1051 				    "0x%04x rev %d not supported (subdevice)\n", pid,
1052 				    sc->subdevice_id,sc->hw_type);
1053 				return ENOTSUP;
1054 		}
1055 		break;
1056 
1057 /* 2x00 Series */
1058 	case IWN_DID_2x00_1:
1059 	case IWN_DID_2x00_2:
1060 		switch(sc->subdevice_id) {
1061 			case IWN_SDID_2x00_1:
1062 			case IWN_SDID_2x00_2:
1063 			case IWN_SDID_2x00_3:
1064 			//iwl2000_2bgn_cfg
1065 			case IWN_SDID_2x00_4:
1066 			//iwl2000_2bgn_d_cfg
1067 				sc->limits = &iwn2030_sensitivity_limits;
1068 				sc->base_params = &iwn2000_base_params;
1069 				sc->fwname = "iwn2000fw";
1070 				break;
1071 			default:
1072 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1073 				    "0x%04x rev %d not supported (subdevice) \n",
1074 				    pid, sc->subdevice_id, sc->hw_type);
1075 				return ENOTSUP;
1076 		}
1077 		break;
1078 /* 2x30 Series */
1079 	case IWN_DID_2x30_1:
1080 	case IWN_DID_2x30_2:
1081 		switch(sc->subdevice_id) {
1082 			case IWN_SDID_2x30_1:
1083 			case IWN_SDID_2x30_3:
1084 			case IWN_SDID_2x30_5:
1085 			//iwl100_bgn_cfg
1086 			case IWN_SDID_2x30_2:
1087 			case IWN_SDID_2x30_4:
1088 			case IWN_SDID_2x30_6:
1089 			//iwl100_bg_cfg
1090 				sc->limits = &iwn2030_sensitivity_limits;
1091 				sc->base_params = &iwn2030_base_params;
1092 				sc->fwname = "iwn2030fw";
1093 				break;
1094 			default:
1095 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1096 				    "0x%04x rev %d not supported (subdevice)\n", pid,
1097 				    sc->subdevice_id,sc->hw_type);
1098 				return ENOTSUP;
1099 		}
1100 		break;
1101 /* 5x00 Series */
1102 	case IWN_DID_5x00_1:
1103 	case IWN_DID_5x00_2:
1104 	case IWN_DID_5x00_3:
1105 	case IWN_DID_5x00_4:
1106 		sc->limits = &iwn5000_sensitivity_limits;
1107 		sc->base_params = &iwn5000_base_params;
1108 		sc->fwname = "iwn5000fw";
1109 		switch(sc->subdevice_id) {
1110 			case IWN_SDID_5x00_1:
1111 			case IWN_SDID_5x00_2:
1112 			case IWN_SDID_5x00_3:
1113 			case IWN_SDID_5x00_4:
1114 			case IWN_SDID_5x00_9:
1115 			case IWN_SDID_5x00_10:
1116 			case IWN_SDID_5x00_11:
1117 			case IWN_SDID_5x00_12:
1118 			case IWN_SDID_5x00_17:
1119 			case IWN_SDID_5x00_18:
1120 			case IWN_SDID_5x00_19:
1121 			case IWN_SDID_5x00_20:
1122 			//iwl5100_agn_cfg
1123 				sc->txchainmask = IWN_ANT_B;
1124 				sc->rxchainmask = IWN_ANT_AB;
1125 				break;
1126 			case IWN_SDID_5x00_5:
1127 			case IWN_SDID_5x00_6:
1128 			case IWN_SDID_5x00_13:
1129 			case IWN_SDID_5x00_14:
1130 			case IWN_SDID_5x00_21:
1131 			case IWN_SDID_5x00_22:
1132 			//iwl5100_bgn_cfg
1133 				sc->txchainmask = IWN_ANT_B;
1134 				sc->rxchainmask = IWN_ANT_AB;
1135 				break;
1136 			case IWN_SDID_5x00_7:
1137 			case IWN_SDID_5x00_8:
1138 			case IWN_SDID_5x00_15:
1139 			case IWN_SDID_5x00_16:
1140 			case IWN_SDID_5x00_23:
1141 			case IWN_SDID_5x00_24:
1142 			//iwl5100_abg_cfg
1143 				sc->txchainmask = IWN_ANT_B;
1144 				sc->rxchainmask = IWN_ANT_AB;
1145 				break;
1146 			case IWN_SDID_5x00_25:
1147 			case IWN_SDID_5x00_26:
1148 			case IWN_SDID_5x00_27:
1149 			case IWN_SDID_5x00_28:
1150 			case IWN_SDID_5x00_29:
1151 			case IWN_SDID_5x00_30:
1152 			case IWN_SDID_5x00_31:
1153 			case IWN_SDID_5x00_32:
1154 			case IWN_SDID_5x00_33:
1155 			case IWN_SDID_5x00_34:
1156 			case IWN_SDID_5x00_35:
1157 			case IWN_SDID_5x00_36:
1158 			//iwl5300_agn_cfg
1159 				sc->txchainmask = IWN_ANT_ABC;
1160 				sc->rxchainmask = IWN_ANT_ABC;
1161 				break;
1162 			default:
1163 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1164 				    "0x%04x rev %d not supported (subdevice)\n", pid,
1165 				    sc->subdevice_id,sc->hw_type);
1166 				return ENOTSUP;
1167 		}
1168 		break;
1169 /* 5x50 Series */
1170 	case IWN_DID_5x50_1:
1171 	case IWN_DID_5x50_2:
1172 	case IWN_DID_5x50_3:
1173 	case IWN_DID_5x50_4:
1174 		sc->limits = &iwn5000_sensitivity_limits;
1175 		sc->base_params = &iwn5000_base_params;
1176 		sc->fwname = "iwn5000fw";
1177 		switch(sc->subdevice_id) {
1178 			case IWN_SDID_5x50_1:
1179 			case IWN_SDID_5x50_2:
1180 			case IWN_SDID_5x50_3:
1181 			//iwl5350_agn_cfg
1182 				sc->limits = &iwn5000_sensitivity_limits;
1183 				sc->base_params = &iwn5000_base_params;
1184 				sc->fwname = "iwn5000fw";
1185 				break;
1186 			case IWN_SDID_5x50_4:
1187 			case IWN_SDID_5x50_5:
1188 			case IWN_SDID_5x50_8:
1189 			case IWN_SDID_5x50_9:
1190 			case IWN_SDID_5x50_10:
1191 			case IWN_SDID_5x50_11:
1192 			//iwl5150_agn_cfg
1193 			case IWN_SDID_5x50_6:
1194 			case IWN_SDID_5x50_7:
1195 			case IWN_SDID_5x50_12:
1196 			case IWN_SDID_5x50_13:
1197 			//iwl5150_abg_cfg
1198 				sc->limits = &iwn5000_sensitivity_limits;
1199 				sc->fwname = "iwn5150fw";
1200 				sc->base_params = &iwn_5x50_base_params;
1201 				break;
1202 			default:
1203 				device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1204 				    "0x%04x rev %d not supported (subdevice)\n", pid,
1205 				    sc->subdevice_id,sc->hw_type);
1206 				return ENOTSUP;
1207 		}
1208 		break;
1209 	default:
1210 		device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id : 0x%04x"
1211 		    "rev 0x%08x not supported (device)\n", pid, sc->subdevice_id,
1212 		     sc->hw_type);
1213 		return ENOTSUP;
1214 	}
1215 	return 0;
1216 }
1217 
1218 static void
1219 iwn4965_attach(struct iwn_softc *sc, uint16_t pid)
1220 {
1221 	struct iwn_ops *ops = &sc->ops;
1222 
1223 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1224 
1225 	ops->load_firmware = iwn4965_load_firmware;
1226 	ops->read_eeprom = iwn4965_read_eeprom;
1227 	ops->post_alive = iwn4965_post_alive;
1228 	ops->nic_config = iwn4965_nic_config;
1229 	ops->update_sched = iwn4965_update_sched;
1230 	ops->get_temperature = iwn4965_get_temperature;
1231 	ops->get_rssi = iwn4965_get_rssi;
1232 	ops->set_txpower = iwn4965_set_txpower;
1233 	ops->init_gains = iwn4965_init_gains;
1234 	ops->set_gains = iwn4965_set_gains;
1235 	ops->rxon_assoc = iwn4965_rxon_assoc;
1236 	ops->add_node = iwn4965_add_node;
1237 	ops->tx_done = iwn4965_tx_done;
1238 	ops->ampdu_tx_start = iwn4965_ampdu_tx_start;
1239 	ops->ampdu_tx_stop = iwn4965_ampdu_tx_stop;
1240 	sc->ntxqs = IWN4965_NTXQUEUES;
1241 	sc->firstaggqueue = IWN4965_FIRSTAGGQUEUE;
1242 	sc->ndmachnls = IWN4965_NDMACHNLS;
1243 	sc->broadcast_id = IWN4965_ID_BROADCAST;
1244 	sc->rxonsz = IWN4965_RXONSZ;
1245 	sc->schedsz = IWN4965_SCHEDSZ;
1246 	sc->fw_text_maxsz = IWN4965_FW_TEXT_MAXSZ;
1247 	sc->fw_data_maxsz = IWN4965_FW_DATA_MAXSZ;
1248 	sc->fwsz = IWN4965_FWSZ;
1249 	sc->sched_txfact_addr = IWN4965_SCHED_TXFACT;
1250 	sc->limits = &iwn4965_sensitivity_limits;
1251 	sc->fwname = "iwn4965fw";
1252 	/* Override chains masks, ROM is known to be broken. */
1253 	sc->txchainmask = IWN_ANT_AB;
1254 	sc->rxchainmask = IWN_ANT_ABC;
1255 	/* Enable normal btcoex */
1256 	sc->sc_flags |= IWN_FLAG_BTCOEX;
1257 
1258 	DPRINTF(sc, IWN_DEBUG_TRACE, "%s: end\n",__func__);
1259 }
1260 
1261 static void
1262 iwn5000_attach(struct iwn_softc *sc, uint16_t pid)
1263 {
1264 	struct iwn_ops *ops = &sc->ops;
1265 
1266 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1267 
1268 	ops->load_firmware = iwn5000_load_firmware;
1269 	ops->read_eeprom = iwn5000_read_eeprom;
1270 	ops->post_alive = iwn5000_post_alive;
1271 	ops->nic_config = iwn5000_nic_config;
1272 	ops->update_sched = iwn5000_update_sched;
1273 	ops->get_temperature = iwn5000_get_temperature;
1274 	ops->get_rssi = iwn5000_get_rssi;
1275 	ops->set_txpower = iwn5000_set_txpower;
1276 	ops->init_gains = iwn5000_init_gains;
1277 	ops->set_gains = iwn5000_set_gains;
1278 	ops->rxon_assoc = iwn5000_rxon_assoc;
1279 	ops->add_node = iwn5000_add_node;
1280 	ops->tx_done = iwn5000_tx_done;
1281 	ops->ampdu_tx_start = iwn5000_ampdu_tx_start;
1282 	ops->ampdu_tx_stop = iwn5000_ampdu_tx_stop;
1283 	sc->ntxqs = IWN5000_NTXQUEUES;
1284 	sc->firstaggqueue = IWN5000_FIRSTAGGQUEUE;
1285 	sc->ndmachnls = IWN5000_NDMACHNLS;
1286 	sc->broadcast_id = IWN5000_ID_BROADCAST;
1287 	sc->rxonsz = IWN5000_RXONSZ;
1288 	sc->schedsz = IWN5000_SCHEDSZ;
1289 	sc->fw_text_maxsz = IWN5000_FW_TEXT_MAXSZ;
1290 	sc->fw_data_maxsz = IWN5000_FW_DATA_MAXSZ;
1291 	sc->fwsz = IWN5000_FWSZ;
1292 	sc->sched_txfact_addr = IWN5000_SCHED_TXFACT;
1293 	sc->reset_noise_gain = IWN5000_PHY_CALIB_RESET_NOISE_GAIN;
1294 	sc->noise_gain = IWN5000_PHY_CALIB_NOISE_GAIN;
1295 
1296 	DPRINTF(sc, IWN_DEBUG_TRACE, "%s: end\n",__func__);
1297 }
1298 
1299 /*
1300  * Attach the interface to 802.11 radiotap.
1301  */
1302 static void
1303 iwn_radiotap_attach(struct iwn_softc *sc)
1304 {
1305 
1306 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1307 	ieee80211_radiotap_attach(&sc->sc_ic,
1308 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
1309 		IWN_TX_RADIOTAP_PRESENT,
1310 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
1311 		IWN_RX_RADIOTAP_PRESENT);
1312 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1313 }
1314 
1315 static void
1316 iwn_sysctlattach(struct iwn_softc *sc)
1317 {
1318 #ifdef	IWN_DEBUG
1319 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
1320 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
1321 
1322 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1323 	    "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
1324 		"control debugging printfs");
1325 #endif
1326 }
1327 
1328 static struct ieee80211vap *
1329 iwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1330     enum ieee80211_opmode opmode, int flags,
1331     const uint8_t bssid[IEEE80211_ADDR_LEN],
1332     const uint8_t mac[IEEE80211_ADDR_LEN])
1333 {
1334 	struct iwn_softc *sc = ic->ic_softc;
1335 	struct iwn_vap *ivp;
1336 	struct ieee80211vap *vap;
1337 
1338 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
1339 		return NULL;
1340 
1341 	ivp = malloc(sizeof(struct iwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1342 	vap = &ivp->iv_vap;
1343 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1344 	ivp->ctx = IWN_RXON_BSS_CTX;
1345 	vap->iv_bmissthreshold = 10;		/* override default */
1346 	/* Override with driver methods. */
1347 	ivp->iv_newstate = vap->iv_newstate;
1348 	vap->iv_newstate = iwn_newstate;
1349 	sc->ivap[IWN_RXON_BSS_CTX] = vap;
1350 	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_64K;
1351 	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_4; /* 4uS */
1352 
1353 	ieee80211_ratectl_init(vap);
1354 	/* Complete setup. */
1355 	ieee80211_vap_attach(vap, ieee80211_media_change,
1356 	    ieee80211_media_status, mac);
1357 	ic->ic_opmode = opmode;
1358 	return vap;
1359 }
1360 
1361 static void
1362 iwn_vap_delete(struct ieee80211vap *vap)
1363 {
1364 	struct iwn_vap *ivp = IWN_VAP(vap);
1365 
1366 	ieee80211_ratectl_deinit(vap);
1367 	ieee80211_vap_detach(vap);
1368 	free(ivp, M_80211_VAP);
1369 }
1370 
1371 static void
1372 iwn_xmit_queue_drain(struct iwn_softc *sc)
1373 {
1374 	struct mbuf *m;
1375 	struct ieee80211_node *ni;
1376 
1377 	IWN_LOCK_ASSERT(sc);
1378 	while ((m = mbufq_dequeue(&sc->sc_xmit_queue)) != NULL) {
1379 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1380 		ieee80211_free_node(ni);
1381 		m_freem(m);
1382 	}
1383 }
1384 
1385 static int
1386 iwn_xmit_queue_enqueue(struct iwn_softc *sc, struct mbuf *m)
1387 {
1388 
1389 	IWN_LOCK_ASSERT(sc);
1390 	return (mbufq_enqueue(&sc->sc_xmit_queue, m));
1391 }
1392 
1393 static int
1394 iwn_detach(device_t dev)
1395 {
1396 	struct iwn_softc *sc = device_get_softc(dev);
1397 	int qid;
1398 
1399 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1400 
1401 	if (sc->sc_ic.ic_softc != NULL) {
1402 		/* Free the mbuf queue and node references */
1403 		IWN_LOCK(sc);
1404 		iwn_xmit_queue_drain(sc);
1405 		IWN_UNLOCK(sc);
1406 
1407 		iwn_stop(sc);
1408 
1409 		taskqueue_drain_all(sc->sc_tq);
1410 		taskqueue_free(sc->sc_tq);
1411 
1412 		callout_drain(&sc->watchdog_to);
1413 		callout_drain(&sc->scan_timeout);
1414 		callout_drain(&sc->calib_to);
1415 		ieee80211_ifdetach(&sc->sc_ic);
1416 	}
1417 
1418 	/* Uninstall interrupt handler. */
1419 	if (sc->irq != NULL) {
1420 		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
1421 		bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
1422 		    sc->irq);
1423 		pci_release_msi(dev);
1424 	}
1425 
1426 	/* Free DMA resources. */
1427 	iwn_free_rx_ring(sc, &sc->rxq);
1428 	for (qid = 0; qid < sc->ntxqs; qid++)
1429 		iwn_free_tx_ring(sc, &sc->txq[qid]);
1430 	iwn_free_sched(sc);
1431 	iwn_free_kw(sc);
1432 	if (sc->ict != NULL)
1433 		iwn_free_ict(sc);
1434 	iwn_free_fwmem(sc);
1435 
1436 	if (sc->mem != NULL)
1437 		bus_release_resource(dev, SYS_RES_MEMORY,
1438 		    rman_get_rid(sc->mem), sc->mem);
1439 
1440 	if (sc->sc_cdev) {
1441 		destroy_dev(sc->sc_cdev);
1442 		sc->sc_cdev = NULL;
1443 	}
1444 
1445 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n", __func__);
1446 	IWN_LOCK_DESTROY(sc);
1447 	return 0;
1448 }
1449 
1450 static int
1451 iwn_shutdown(device_t dev)
1452 {
1453 	struct iwn_softc *sc = device_get_softc(dev);
1454 
1455 	iwn_stop(sc);
1456 	return 0;
1457 }
1458 
1459 static int
1460 iwn_suspend(device_t dev)
1461 {
1462 	struct iwn_softc *sc = device_get_softc(dev);
1463 
1464 	ieee80211_suspend_all(&sc->sc_ic);
1465 	return 0;
1466 }
1467 
1468 static int
1469 iwn_resume(device_t dev)
1470 {
1471 	struct iwn_softc *sc = device_get_softc(dev);
1472 
1473 	/* Clear device-specific "PCI retry timeout" register (41h). */
1474 	pci_write_config(dev, 0x41, 0, 1);
1475 
1476 	ieee80211_resume_all(&sc->sc_ic);
1477 	return 0;
1478 }
1479 
1480 static int
1481 iwn_nic_lock(struct iwn_softc *sc)
1482 {
1483 	int ntries;
1484 
1485 	/* Request exclusive access to NIC. */
1486 	IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1487 
1488 	/* Spin until we actually get the lock. */
1489 	for (ntries = 0; ntries < 1000; ntries++) {
1490 		if ((IWN_READ(sc, IWN_GP_CNTRL) &
1491 		     (IWN_GP_CNTRL_MAC_ACCESS_ENA | IWN_GP_CNTRL_SLEEP)) ==
1492 		    IWN_GP_CNTRL_MAC_ACCESS_ENA)
1493 			return 0;
1494 		DELAY(10);
1495 	}
1496 	return ETIMEDOUT;
1497 }
1498 
1499 static __inline void
1500 iwn_nic_unlock(struct iwn_softc *sc)
1501 {
1502 	IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1503 }
1504 
1505 static __inline uint32_t
1506 iwn_prph_read(struct iwn_softc *sc, uint32_t addr)
1507 {
1508 	IWN_WRITE(sc, IWN_PRPH_RADDR, IWN_PRPH_DWORD | addr);
1509 	IWN_BARRIER_READ_WRITE(sc);
1510 	return IWN_READ(sc, IWN_PRPH_RDATA);
1511 }
1512 
1513 static __inline void
1514 iwn_prph_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1515 {
1516 	IWN_WRITE(sc, IWN_PRPH_WADDR, IWN_PRPH_DWORD | addr);
1517 	IWN_BARRIER_WRITE(sc);
1518 	IWN_WRITE(sc, IWN_PRPH_WDATA, data);
1519 }
1520 
1521 static __inline void
1522 iwn_prph_setbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1523 {
1524 	iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) | mask);
1525 }
1526 
1527 static __inline void
1528 iwn_prph_clrbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1529 {
1530 	iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) & ~mask);
1531 }
1532 
1533 static __inline void
1534 iwn_prph_write_region_4(struct iwn_softc *sc, uint32_t addr,
1535     const uint32_t *data, int count)
1536 {
1537 	for (; count > 0; count--, data++, addr += 4)
1538 		iwn_prph_write(sc, addr, *data);
1539 }
1540 
1541 static __inline uint32_t
1542 iwn_mem_read(struct iwn_softc *sc, uint32_t addr)
1543 {
1544 	IWN_WRITE(sc, IWN_MEM_RADDR, addr);
1545 	IWN_BARRIER_READ_WRITE(sc);
1546 	return IWN_READ(sc, IWN_MEM_RDATA);
1547 }
1548 
1549 static __inline void
1550 iwn_mem_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1551 {
1552 	IWN_WRITE(sc, IWN_MEM_WADDR, addr);
1553 	IWN_BARRIER_WRITE(sc);
1554 	IWN_WRITE(sc, IWN_MEM_WDATA, data);
1555 }
1556 
1557 static __inline void
1558 iwn_mem_write_2(struct iwn_softc *sc, uint32_t addr, uint16_t data)
1559 {
1560 	uint32_t tmp;
1561 
1562 	tmp = iwn_mem_read(sc, addr & ~3);
1563 	if (addr & 3)
1564 		tmp = (tmp & 0x0000ffff) | data << 16;
1565 	else
1566 		tmp = (tmp & 0xffff0000) | data;
1567 	iwn_mem_write(sc, addr & ~3, tmp);
1568 }
1569 
1570 static __inline void
1571 iwn_mem_read_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t *data,
1572     int count)
1573 {
1574 	for (; count > 0; count--, addr += 4)
1575 		*data++ = iwn_mem_read(sc, addr);
1576 }
1577 
1578 static __inline void
1579 iwn_mem_set_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t val,
1580     int count)
1581 {
1582 	for (; count > 0; count--, addr += 4)
1583 		iwn_mem_write(sc, addr, val);
1584 }
1585 
1586 static int
1587 iwn_eeprom_lock(struct iwn_softc *sc)
1588 {
1589 	int i, ntries;
1590 
1591 	for (i = 0; i < 100; i++) {
1592 		/* Request exclusive access to EEPROM. */
1593 		IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
1594 		    IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1595 
1596 		/* Spin until we actually get the lock. */
1597 		for (ntries = 0; ntries < 100; ntries++) {
1598 			if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
1599 			    IWN_HW_IF_CONFIG_EEPROM_LOCKED)
1600 				return 0;
1601 			DELAY(10);
1602 		}
1603 	}
1604 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end timeout\n", __func__);
1605 	return ETIMEDOUT;
1606 }
1607 
1608 static __inline void
1609 iwn_eeprom_unlock(struct iwn_softc *sc)
1610 {
1611 	IWN_CLRBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1612 }
1613 
1614 /*
1615  * Initialize access by host to One Time Programmable ROM.
1616  * NB: This kind of ROM can be found on 1000 or 6000 Series only.
1617  */
1618 static int
1619 iwn_init_otprom(struct iwn_softc *sc)
1620 {
1621 	uint16_t prev, base, next;
1622 	int count, error;
1623 
1624 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1625 
1626 	/* Wait for clock stabilization before accessing prph. */
1627 	if ((error = iwn_clock_wait(sc)) != 0)
1628 		return error;
1629 
1630 	if ((error = iwn_nic_lock(sc)) != 0)
1631 		return error;
1632 	iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1633 	DELAY(5);
1634 	iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1635 	iwn_nic_unlock(sc);
1636 
1637 	/* Set auto clock gate disable bit for HW with OTP shadow RAM. */
1638 	if (sc->base_params->shadow_ram_support) {
1639 		IWN_SETBITS(sc, IWN_DBG_LINK_PWR_MGMT,
1640 		    IWN_RESET_LINK_PWR_MGMT_DIS);
1641 	}
1642 	IWN_CLRBITS(sc, IWN_EEPROM_GP, IWN_EEPROM_GP_IF_OWNER);
1643 	/* Clear ECC status. */
1644 	IWN_SETBITS(sc, IWN_OTP_GP,
1645 	    IWN_OTP_GP_ECC_CORR_STTS | IWN_OTP_GP_ECC_UNCORR_STTS);
1646 
1647 	/*
1648 	 * Find the block before last block (contains the EEPROM image)
1649 	 * for HW without OTP shadow RAM.
1650 	 */
1651 	if (! sc->base_params->shadow_ram_support) {
1652 		/* Switch to absolute addressing mode. */
1653 		IWN_CLRBITS(sc, IWN_OTP_GP, IWN_OTP_GP_RELATIVE_ACCESS);
1654 		base = prev = 0;
1655 		for (count = 0; count < sc->base_params->max_ll_items;
1656 		    count++) {
1657 			error = iwn_read_prom_data(sc, base, &next, 2);
1658 			if (error != 0)
1659 				return error;
1660 			if (next == 0)	/* End of linked-list. */
1661 				break;
1662 			prev = base;
1663 			base = le16toh(next);
1664 		}
1665 		if (count == 0 || count == sc->base_params->max_ll_items)
1666 			return EIO;
1667 		/* Skip "next" word. */
1668 		sc->prom_base = prev + 1;
1669 	}
1670 
1671 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1672 
1673 	return 0;
1674 }
1675 
1676 static int
1677 iwn_read_prom_data(struct iwn_softc *sc, uint32_t addr, void *data, int count)
1678 {
1679 	uint8_t *out = data;
1680 	uint32_t val, tmp;
1681 	int ntries;
1682 
1683 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1684 
1685 	addr += sc->prom_base;
1686 	for (; count > 0; count -= 2, addr++) {
1687 		IWN_WRITE(sc, IWN_EEPROM, addr << 2);
1688 		for (ntries = 0; ntries < 20; ntries++) {
1689 			val = IWN_READ(sc, IWN_EEPROM);
1690 			if (val & IWN_EEPROM_READ_VALID)
1691 				break;
1692 			DELAY(5);
1693 		}
1694 		if (ntries == 20) {
1695 			device_printf(sc->sc_dev,
1696 			    "timeout reading ROM at 0x%x\n", addr);
1697 			return ETIMEDOUT;
1698 		}
1699 		if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
1700 			/* OTPROM, check for ECC errors. */
1701 			tmp = IWN_READ(sc, IWN_OTP_GP);
1702 			if (tmp & IWN_OTP_GP_ECC_UNCORR_STTS) {
1703 				device_printf(sc->sc_dev,
1704 				    "OTPROM ECC error at 0x%x\n", addr);
1705 				return EIO;
1706 			}
1707 			if (tmp & IWN_OTP_GP_ECC_CORR_STTS) {
1708 				/* Correctable ECC error, clear bit. */
1709 				IWN_SETBITS(sc, IWN_OTP_GP,
1710 				    IWN_OTP_GP_ECC_CORR_STTS);
1711 			}
1712 		}
1713 		*out++ = val >> 16;
1714 		if (count > 1)
1715 			*out++ = val >> 24;
1716 	}
1717 
1718 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1719 
1720 	return 0;
1721 }
1722 
1723 static void
1724 iwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1725 {
1726 	if (error != 0)
1727 		return;
1728 	KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
1729 	*(bus_addr_t *)arg = segs[0].ds_addr;
1730 }
1731 
1732 static int
1733 iwn_dma_contig_alloc(struct iwn_softc *sc, struct iwn_dma_info *dma,
1734     void **kvap, bus_size_t size, bus_size_t alignment)
1735 {
1736 	int error;
1737 
1738 	dma->tag = NULL;
1739 	dma->size = size;
1740 
1741 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), alignment,
1742 	    0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
1743 	    1, size, 0, NULL, NULL, &dma->tag);
1744 	if (error != 0)
1745 		goto fail;
1746 
1747 	error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr,
1748 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map);
1749 	if (error != 0)
1750 		goto fail;
1751 
1752 	error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size,
1753 	    iwn_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT);
1754 	if (error != 0)
1755 		goto fail;
1756 
1757 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
1758 
1759 	if (kvap != NULL)
1760 		*kvap = dma->vaddr;
1761 
1762 	return 0;
1763 
1764 fail:	iwn_dma_contig_free(dma);
1765 	return error;
1766 }
1767 
1768 static void
1769 iwn_dma_contig_free(struct iwn_dma_info *dma)
1770 {
1771 	if (dma->vaddr != NULL) {
1772 		bus_dmamap_sync(dma->tag, dma->map,
1773 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1774 		bus_dmamap_unload(dma->tag, dma->map);
1775 		bus_dmamem_free(dma->tag, dma->vaddr, dma->map);
1776 		dma->vaddr = NULL;
1777 	}
1778 	if (dma->tag != NULL) {
1779 		bus_dma_tag_destroy(dma->tag);
1780 		dma->tag = NULL;
1781 	}
1782 }
1783 
1784 static int
1785 iwn_alloc_sched(struct iwn_softc *sc)
1786 {
1787 	/* TX scheduler rings must be aligned on a 1KB boundary. */
1788 	return iwn_dma_contig_alloc(sc, &sc->sched_dma, (void **)&sc->sched,
1789 	    sc->schedsz, 1024);
1790 }
1791 
1792 static void
1793 iwn_free_sched(struct iwn_softc *sc)
1794 {
1795 	iwn_dma_contig_free(&sc->sched_dma);
1796 }
1797 
1798 static int
1799 iwn_alloc_kw(struct iwn_softc *sc)
1800 {
1801 	/* "Keep Warm" page must be aligned on a 4KB boundary. */
1802 	return iwn_dma_contig_alloc(sc, &sc->kw_dma, NULL, 4096, 4096);
1803 }
1804 
1805 static void
1806 iwn_free_kw(struct iwn_softc *sc)
1807 {
1808 	iwn_dma_contig_free(&sc->kw_dma);
1809 }
1810 
1811 static int
1812 iwn_alloc_ict(struct iwn_softc *sc)
1813 {
1814 	/* ICT table must be aligned on a 4KB boundary. */
1815 	return iwn_dma_contig_alloc(sc, &sc->ict_dma, (void **)&sc->ict,
1816 	    IWN_ICT_SIZE, 4096);
1817 }
1818 
1819 static void
1820 iwn_free_ict(struct iwn_softc *sc)
1821 {
1822 	iwn_dma_contig_free(&sc->ict_dma);
1823 }
1824 
1825 static int
1826 iwn_alloc_fwmem(struct iwn_softc *sc)
1827 {
1828 	/* Must be aligned on a 16-byte boundary. */
1829 	return iwn_dma_contig_alloc(sc, &sc->fw_dma, NULL, sc->fwsz, 16);
1830 }
1831 
1832 static void
1833 iwn_free_fwmem(struct iwn_softc *sc)
1834 {
1835 	iwn_dma_contig_free(&sc->fw_dma);
1836 }
1837 
1838 static int
1839 iwn_alloc_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1840 {
1841 	bus_size_t size;
1842 	int i, error;
1843 
1844 	ring->cur = 0;
1845 
1846 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1847 
1848 	/* Allocate RX descriptors (256-byte aligned). */
1849 	size = IWN_RX_RING_COUNT * sizeof (uint32_t);
1850 	error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
1851 	    size, 256);
1852 	if (error != 0) {
1853 		device_printf(sc->sc_dev,
1854 		    "%s: could not allocate RX ring DMA memory, error %d\n",
1855 		    __func__, error);
1856 		goto fail;
1857 	}
1858 
1859 	/* Allocate RX status area (16-byte aligned). */
1860 	error = iwn_dma_contig_alloc(sc, &ring->stat_dma, (void **)&ring->stat,
1861 	    sizeof (struct iwn_rx_status), 16);
1862 	if (error != 0) {
1863 		device_printf(sc->sc_dev,
1864 		    "%s: could not allocate RX status DMA memory, error %d\n",
1865 		    __func__, error);
1866 		goto fail;
1867 	}
1868 
1869 	/* Create RX buffer DMA tag. */
1870 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
1871 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
1872 	    IWN_RBUF_SIZE, 1, IWN_RBUF_SIZE, 0, NULL, NULL, &ring->data_dmat);
1873 	if (error != 0) {
1874 		device_printf(sc->sc_dev,
1875 		    "%s: could not create RX buf DMA tag, error %d\n",
1876 		    __func__, error);
1877 		goto fail;
1878 	}
1879 
1880 	/*
1881 	 * Allocate and map RX buffers.
1882 	 */
1883 	for (i = 0; i < IWN_RX_RING_COUNT; i++) {
1884 		struct iwn_rx_data *data = &ring->data[i];
1885 		bus_addr_t paddr;
1886 
1887 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
1888 		if (error != 0) {
1889 			device_printf(sc->sc_dev,
1890 			    "%s: could not create RX buf DMA map, error %d\n",
1891 			    __func__, error);
1892 			goto fail;
1893 		}
1894 
1895 		data->m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
1896 		    IWN_RBUF_SIZE);
1897 		if (data->m == NULL) {
1898 			device_printf(sc->sc_dev,
1899 			    "%s: could not allocate RX mbuf\n", __func__);
1900 			error = ENOBUFS;
1901 			goto fail;
1902 		}
1903 
1904 		error = bus_dmamap_load(ring->data_dmat, data->map,
1905 		    mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
1906 		    &paddr, BUS_DMA_NOWAIT);
1907 		if (error != 0 && error != EFBIG) {
1908 			device_printf(sc->sc_dev,
1909 			    "%s: can't map mbuf, error %d\n", __func__,
1910 			    error);
1911 			goto fail;
1912 		}
1913 
1914 		bus_dmamap_sync(ring->data_dmat, data->map,
1915 		    BUS_DMASYNC_PREREAD);
1916 
1917 		/* Set physical address of RX buffer (256-byte aligned). */
1918 		ring->desc[i] = htole32(paddr >> 8);
1919 	}
1920 
1921 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
1922 	    BUS_DMASYNC_PREWRITE);
1923 
1924 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
1925 
1926 	return 0;
1927 
1928 fail:	iwn_free_rx_ring(sc, ring);
1929 
1930 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
1931 
1932 	return error;
1933 }
1934 
1935 static void
1936 iwn_reset_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1937 {
1938 	int ntries;
1939 
1940 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
1941 
1942 	if (iwn_nic_lock(sc) == 0) {
1943 		IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
1944 		for (ntries = 0; ntries < 1000; ntries++) {
1945 			if (IWN_READ(sc, IWN_FH_RX_STATUS) &
1946 			    IWN_FH_RX_STATUS_IDLE)
1947 				break;
1948 			DELAY(10);
1949 		}
1950 		iwn_nic_unlock(sc);
1951 	}
1952 	ring->cur = 0;
1953 	sc->last_rx_valid = 0;
1954 }
1955 
1956 static void
1957 iwn_free_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1958 {
1959 	int i;
1960 
1961 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
1962 
1963 	iwn_dma_contig_free(&ring->desc_dma);
1964 	iwn_dma_contig_free(&ring->stat_dma);
1965 
1966 	for (i = 0; i < IWN_RX_RING_COUNT; i++) {
1967 		struct iwn_rx_data *data = &ring->data[i];
1968 
1969 		if (data->m != NULL) {
1970 			bus_dmamap_sync(ring->data_dmat, data->map,
1971 			    BUS_DMASYNC_POSTREAD);
1972 			bus_dmamap_unload(ring->data_dmat, data->map);
1973 			m_freem(data->m);
1974 			data->m = NULL;
1975 		}
1976 		if (data->map != NULL)
1977 			bus_dmamap_destroy(ring->data_dmat, data->map);
1978 	}
1979 	if (ring->data_dmat != NULL) {
1980 		bus_dma_tag_destroy(ring->data_dmat);
1981 		ring->data_dmat = NULL;
1982 	}
1983 }
1984 
1985 static int
1986 iwn_alloc_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring, int qid)
1987 {
1988 	bus_addr_t paddr;
1989 	bus_size_t size;
1990 	int i, error;
1991 
1992 	ring->qid = qid;
1993 	ring->queued = 0;
1994 	ring->cur = 0;
1995 
1996 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1997 
1998 	/* Allocate TX descriptors (256-byte aligned). */
1999 	size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_desc);
2000 	error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
2001 	    size, 256);
2002 	if (error != 0) {
2003 		device_printf(sc->sc_dev,
2004 		    "%s: could not allocate TX ring DMA memory, error %d\n",
2005 		    __func__, error);
2006 		goto fail;
2007 	}
2008 
2009 	size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_cmd);
2010 	error = iwn_dma_contig_alloc(sc, &ring->cmd_dma, (void **)&ring->cmd,
2011 	    size, 4);
2012 	if (error != 0) {
2013 		device_printf(sc->sc_dev,
2014 		    "%s: could not allocate TX cmd DMA memory, error %d\n",
2015 		    __func__, error);
2016 		goto fail;
2017 	}
2018 
2019 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
2020 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
2021 	    IWN_MAX_SCATTER - 1, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
2022 	if (error != 0) {
2023 		device_printf(sc->sc_dev,
2024 		    "%s: could not create TX buf DMA tag, error %d\n",
2025 		    __func__, error);
2026 		goto fail;
2027 	}
2028 
2029 	paddr = ring->cmd_dma.paddr;
2030 	for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2031 		struct iwn_tx_data *data = &ring->data[i];
2032 
2033 		data->cmd_paddr = paddr;
2034 		data->scratch_paddr = paddr + 12;
2035 		paddr += sizeof (struct iwn_tx_cmd);
2036 
2037 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
2038 		if (error != 0) {
2039 			device_printf(sc->sc_dev,
2040 			    "%s: could not create TX buf DMA map, error %d\n",
2041 			    __func__, error);
2042 			goto fail;
2043 		}
2044 	}
2045 
2046 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2047 
2048 	return 0;
2049 
2050 fail:	iwn_free_tx_ring(sc, ring);
2051 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
2052 	return error;
2053 }
2054 
2055 static void
2056 iwn_reset_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2057 {
2058 	int i;
2059 
2060 	DPRINTF(sc, IWN_DEBUG_TRACE, "->doing %s \n", __func__);
2061 
2062 	for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2063 		struct iwn_tx_data *data = &ring->data[i];
2064 
2065 		if (data->m != NULL) {
2066 			bus_dmamap_sync(ring->data_dmat, data->map,
2067 			    BUS_DMASYNC_POSTWRITE);
2068 			bus_dmamap_unload(ring->data_dmat, data->map);
2069 			m_freem(data->m);
2070 			data->m = NULL;
2071 		}
2072 		if (data->ni != NULL) {
2073 			ieee80211_free_node(data->ni);
2074 			data->ni = NULL;
2075 		}
2076 		data->remapped = 0;
2077 		data->long_retries = 0;
2078 	}
2079 	/* Clear TX descriptors. */
2080 	memset(ring->desc, 0, ring->desc_dma.size);
2081 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2082 	    BUS_DMASYNC_PREWRITE);
2083 	sc->qfullmsk &= ~(1 << ring->qid);
2084 	ring->queued = 0;
2085 	ring->cur = 0;
2086 }
2087 
2088 static void
2089 iwn_free_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2090 {
2091 	int i;
2092 
2093 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
2094 
2095 	iwn_dma_contig_free(&ring->desc_dma);
2096 	iwn_dma_contig_free(&ring->cmd_dma);
2097 
2098 	for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2099 		struct iwn_tx_data *data = &ring->data[i];
2100 
2101 		if (data->m != NULL) {
2102 			bus_dmamap_sync(ring->data_dmat, data->map,
2103 			    BUS_DMASYNC_POSTWRITE);
2104 			bus_dmamap_unload(ring->data_dmat, data->map);
2105 			m_freem(data->m);
2106 		}
2107 		if (data->map != NULL)
2108 			bus_dmamap_destroy(ring->data_dmat, data->map);
2109 	}
2110 	if (ring->data_dmat != NULL) {
2111 		bus_dma_tag_destroy(ring->data_dmat);
2112 		ring->data_dmat = NULL;
2113 	}
2114 }
2115 
2116 static void
2117 iwn_check_tx_ring(struct iwn_softc *sc, int qid)
2118 {
2119 	struct iwn_tx_ring *ring = &sc->txq[qid];
2120 
2121 	KASSERT(ring->queued >= 0, ("%s: ring->queued (%d) for queue %d < 0!",
2122 	    __func__, ring->queued, qid));
2123 
2124 	if (qid >= sc->firstaggqueue) {
2125 		struct iwn_ops *ops = &sc->ops;
2126 		struct ieee80211_tx_ampdu *tap = sc->qid2tap[qid];
2127 
2128 		if (ring->queued == 0 && !IEEE80211_AMPDU_RUNNING(tap)) {
2129 			uint16_t ssn = tap->txa_start & 0xfff;
2130 			uint8_t tid = tap->txa_tid;
2131 			int *res = tap->txa_private;
2132 
2133 			iwn_nic_lock(sc);
2134 			ops->ampdu_tx_stop(sc, qid, tid, ssn);
2135 			iwn_nic_unlock(sc);
2136 
2137 			sc->qid2tap[qid] = NULL;
2138 			free(res, M_DEVBUF);
2139 		}
2140 	}
2141 
2142 	if (ring->queued < IWN_TX_RING_LOMARK) {
2143 		sc->qfullmsk &= ~(1 << qid);
2144 
2145 		if (ring->queued == 0)
2146 			sc->sc_tx_timer = 0;
2147 		else
2148 			sc->sc_tx_timer = 5;
2149 	}
2150 }
2151 
2152 static void
2153 iwn5000_ict_reset(struct iwn_softc *sc)
2154 {
2155 	/* Disable interrupts. */
2156 	IWN_WRITE(sc, IWN_INT_MASK, 0);
2157 
2158 	/* Reset ICT table. */
2159 	memset(sc->ict, 0, IWN_ICT_SIZE);
2160 	sc->ict_cur = 0;
2161 
2162 	bus_dmamap_sync(sc->ict_dma.tag, sc->ict_dma.map,
2163 	    BUS_DMASYNC_PREWRITE);
2164 
2165 	/* Set physical address of ICT table (4KB aligned). */
2166 	DPRINTF(sc, IWN_DEBUG_RESET, "%s: enabling ICT\n", __func__);
2167 	IWN_WRITE(sc, IWN_DRAM_INT_TBL, IWN_DRAM_INT_TBL_ENABLE |
2168 	    IWN_DRAM_INT_TBL_WRAP_CHECK | sc->ict_dma.paddr >> 12);
2169 
2170 	/* Enable periodic RX interrupt. */
2171 	sc->int_mask |= IWN_INT_RX_PERIODIC;
2172 	/* Switch to ICT interrupt mode in driver. */
2173 	sc->sc_flags |= IWN_FLAG_USE_ICT;
2174 
2175 	/* Re-enable interrupts. */
2176 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
2177 	IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
2178 }
2179 
2180 static int
2181 iwn_read_eeprom(struct iwn_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
2182 {
2183 	struct iwn_ops *ops = &sc->ops;
2184 	uint16_t val;
2185 	int error;
2186 
2187 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2188 
2189 	/* Check whether adapter has an EEPROM or an OTPROM. */
2190 	if (sc->hw_type >= IWN_HW_REV_TYPE_1000 &&
2191 	    (IWN_READ(sc, IWN_OTP_GP) & IWN_OTP_GP_DEV_SEL_OTP))
2192 		sc->sc_flags |= IWN_FLAG_HAS_OTPROM;
2193 	DPRINTF(sc, IWN_DEBUG_RESET, "%s found\n",
2194 	    (sc->sc_flags & IWN_FLAG_HAS_OTPROM) ? "OTPROM" : "EEPROM");
2195 
2196 	/* Adapter has to be powered on for EEPROM access to work. */
2197 	if ((error = iwn_apm_init(sc)) != 0) {
2198 		device_printf(sc->sc_dev,
2199 		    "%s: could not power ON adapter, error %d\n", __func__,
2200 		    error);
2201 		return error;
2202 	}
2203 
2204 	if ((IWN_READ(sc, IWN_EEPROM_GP) & 0x7) == 0) {
2205 		device_printf(sc->sc_dev, "%s: bad ROM signature\n", __func__);
2206 		return EIO;
2207 	}
2208 	if ((error = iwn_eeprom_lock(sc)) != 0) {
2209 		device_printf(sc->sc_dev, "%s: could not lock ROM, error %d\n",
2210 		    __func__, error);
2211 		return error;
2212 	}
2213 	if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
2214 		if ((error = iwn_init_otprom(sc)) != 0) {
2215 			device_printf(sc->sc_dev,
2216 			    "%s: could not initialize OTPROM, error %d\n",
2217 			    __func__, error);
2218 			return error;
2219 		}
2220 	}
2221 
2222 	iwn_read_prom_data(sc, IWN_EEPROM_SKU_CAP, &val, 2);
2223 	DPRINTF(sc, IWN_DEBUG_RESET, "SKU capabilities=0x%04x\n", le16toh(val));
2224 	/* Check if HT support is bonded out. */
2225 	if (val & htole16(IWN_EEPROM_SKU_CAP_11N))
2226 		sc->sc_flags |= IWN_FLAG_HAS_11N;
2227 
2228 	iwn_read_prom_data(sc, IWN_EEPROM_RFCFG, &val, 2);
2229 	sc->rfcfg = le16toh(val);
2230 	DPRINTF(sc, IWN_DEBUG_RESET, "radio config=0x%04x\n", sc->rfcfg);
2231 	/* Read Tx/Rx chains from ROM unless it's known to be broken. */
2232 	if (sc->txchainmask == 0)
2233 		sc->txchainmask = IWN_RFCFG_TXANTMSK(sc->rfcfg);
2234 	if (sc->rxchainmask == 0)
2235 		sc->rxchainmask = IWN_RFCFG_RXANTMSK(sc->rfcfg);
2236 
2237 	/* Read MAC address. */
2238 	iwn_read_prom_data(sc, IWN_EEPROM_MAC, macaddr, 6);
2239 
2240 	/* Read adapter-specific information from EEPROM. */
2241 	ops->read_eeprom(sc);
2242 
2243 	iwn_apm_stop(sc);	/* Power OFF adapter. */
2244 
2245 	iwn_eeprom_unlock(sc);
2246 
2247 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2248 
2249 	return 0;
2250 }
2251 
2252 static void
2253 iwn4965_read_eeprom(struct iwn_softc *sc)
2254 {
2255 	uint32_t addr;
2256 	uint16_t val;
2257 	int i;
2258 
2259 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2260 
2261 	/* Read regulatory domain (4 ASCII characters). */
2262 	iwn_read_prom_data(sc, IWN4965_EEPROM_DOMAIN, sc->eeprom_domain, 4);
2263 
2264 	/* Read the list of authorized channels (20MHz & 40MHz). */
2265 	for (i = 0; i < IWN_NBANDS - 1; i++) {
2266 		addr = iwn4965_regulatory_bands[i];
2267 		iwn_read_eeprom_channels(sc, i, addr);
2268 	}
2269 
2270 	/* Read maximum allowed TX power for 2GHz and 5GHz bands. */
2271 	iwn_read_prom_data(sc, IWN4965_EEPROM_MAXPOW, &val, 2);
2272 	sc->maxpwr2GHz = val & 0xff;
2273 	sc->maxpwr5GHz = val >> 8;
2274 	/* Check that EEPROM values are within valid range. */
2275 	if (sc->maxpwr5GHz < 20 || sc->maxpwr5GHz > 50)
2276 		sc->maxpwr5GHz = 38;
2277 	if (sc->maxpwr2GHz < 20 || sc->maxpwr2GHz > 50)
2278 		sc->maxpwr2GHz = 38;
2279 	DPRINTF(sc, IWN_DEBUG_RESET, "maxpwr 2GHz=%d 5GHz=%d\n",
2280 	    sc->maxpwr2GHz, sc->maxpwr5GHz);
2281 
2282 	/* Read samples for each TX power group. */
2283 	iwn_read_prom_data(sc, IWN4965_EEPROM_BANDS, sc->bands,
2284 	    sizeof sc->bands);
2285 
2286 	/* Read voltage at which samples were taken. */
2287 	iwn_read_prom_data(sc, IWN4965_EEPROM_VOLTAGE, &val, 2);
2288 	sc->eeprom_voltage = (int16_t)le16toh(val);
2289 	DPRINTF(sc, IWN_DEBUG_RESET, "voltage=%d (in 0.3V)\n",
2290 	    sc->eeprom_voltage);
2291 
2292 #ifdef IWN_DEBUG
2293 	/* Print samples. */
2294 	if (sc->sc_debug & IWN_DEBUG_ANY) {
2295 		for (i = 0; i < IWN_NBANDS - 1; i++)
2296 			iwn4965_print_power_group(sc, i);
2297 	}
2298 #endif
2299 
2300 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2301 }
2302 
2303 #ifdef IWN_DEBUG
2304 static void
2305 iwn4965_print_power_group(struct iwn_softc *sc, int i)
2306 {
2307 	struct iwn4965_eeprom_band *band = &sc->bands[i];
2308 	struct iwn4965_eeprom_chan_samples *chans = band->chans;
2309 	int j, c;
2310 
2311 	printf("===band %d===\n", i);
2312 	printf("chan lo=%d, chan hi=%d\n", band->lo, band->hi);
2313 	printf("chan1 num=%d\n", chans[0].num);
2314 	for (c = 0; c < 2; c++) {
2315 		for (j = 0; j < IWN_NSAMPLES; j++) {
2316 			printf("chain %d, sample %d: temp=%d gain=%d "
2317 			    "power=%d pa_det=%d\n", c, j,
2318 			    chans[0].samples[c][j].temp,
2319 			    chans[0].samples[c][j].gain,
2320 			    chans[0].samples[c][j].power,
2321 			    chans[0].samples[c][j].pa_det);
2322 		}
2323 	}
2324 	printf("chan2 num=%d\n", chans[1].num);
2325 	for (c = 0; c < 2; c++) {
2326 		for (j = 0; j < IWN_NSAMPLES; j++) {
2327 			printf("chain %d, sample %d: temp=%d gain=%d "
2328 			    "power=%d pa_det=%d\n", c, j,
2329 			    chans[1].samples[c][j].temp,
2330 			    chans[1].samples[c][j].gain,
2331 			    chans[1].samples[c][j].power,
2332 			    chans[1].samples[c][j].pa_det);
2333 		}
2334 	}
2335 }
2336 #endif
2337 
2338 static void
2339 iwn5000_read_eeprom(struct iwn_softc *sc)
2340 {
2341 	struct iwn5000_eeprom_calib_hdr hdr;
2342 	int32_t volt;
2343 	uint32_t base, addr;
2344 	uint16_t val;
2345 	int i;
2346 
2347 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2348 
2349 	/* Read regulatory domain (4 ASCII characters). */
2350 	iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2351 	base = le16toh(val);
2352 	iwn_read_prom_data(sc, base + IWN5000_EEPROM_DOMAIN,
2353 	    sc->eeprom_domain, 4);
2354 
2355 	/* Read the list of authorized channels (20MHz & 40MHz). */
2356 	for (i = 0; i < IWN_NBANDS - 1; i++) {
2357 		addr =  base + sc->base_params->regulatory_bands[i];
2358 		iwn_read_eeprom_channels(sc, i, addr);
2359 	}
2360 
2361 	/* Read enhanced TX power information for 6000 Series. */
2362 	if (sc->base_params->enhanced_TX_power)
2363 		iwn_read_eeprom_enhinfo(sc);
2364 
2365 	iwn_read_prom_data(sc, IWN5000_EEPROM_CAL, &val, 2);
2366 	base = le16toh(val);
2367 	iwn_read_prom_data(sc, base, &hdr, sizeof hdr);
2368 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
2369 	    "%s: calib version=%u pa type=%u voltage=%u\n", __func__,
2370 	    hdr.version, hdr.pa_type, le16toh(hdr.volt));
2371 	sc->calib_ver = hdr.version;
2372 
2373 	if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2) {
2374 		sc->eeprom_voltage = le16toh(hdr.volt);
2375 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2376 		sc->eeprom_temp_high=le16toh(val);
2377 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
2378 		sc->eeprom_temp = le16toh(val);
2379 	}
2380 
2381 	if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
2382 		/* Compute temperature offset. */
2383 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2384 		sc->eeprom_temp = le16toh(val);
2385 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
2386 		volt = le16toh(val);
2387 		sc->temp_off = sc->eeprom_temp - (volt / -5);
2388 		DPRINTF(sc, IWN_DEBUG_CALIBRATE, "temp=%d volt=%d offset=%dK\n",
2389 		    sc->eeprom_temp, volt, sc->temp_off);
2390 	} else {
2391 		/* Read crystal calibration. */
2392 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_CRYSTAL,
2393 		    &sc->eeprom_crystal, sizeof (uint32_t));
2394 		DPRINTF(sc, IWN_DEBUG_CALIBRATE, "crystal calibration 0x%08x\n",
2395 		    le32toh(sc->eeprom_crystal));
2396 	}
2397 
2398 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2399 
2400 }
2401 
2402 /*
2403  * Translate EEPROM flags to net80211.
2404  */
2405 static uint32_t
2406 iwn_eeprom_channel_flags(struct iwn_eeprom_chan *channel)
2407 {
2408 	uint32_t nflags;
2409 
2410 	nflags = 0;
2411 	if ((channel->flags & IWN_EEPROM_CHAN_ACTIVE) == 0)
2412 		nflags |= IEEE80211_CHAN_PASSIVE;
2413 	if ((channel->flags & IWN_EEPROM_CHAN_IBSS) == 0)
2414 		nflags |= IEEE80211_CHAN_NOADHOC;
2415 	if (channel->flags & IWN_EEPROM_CHAN_RADAR) {
2416 		nflags |= IEEE80211_CHAN_DFS;
2417 		/* XXX apparently IBSS may still be marked */
2418 		nflags |= IEEE80211_CHAN_NOADHOC;
2419 	}
2420 
2421 	return nflags;
2422 }
2423 
2424 static void
2425 iwn_read_eeprom_band(struct iwn_softc *sc, int n, int maxchans, int *nchans,
2426     struct ieee80211_channel chans[])
2427 {
2428 	struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
2429 	const struct iwn_chan_band *band = &iwn_bands[n];
2430 	uint8_t bands[IEEE80211_MODE_BYTES];
2431 	uint8_t chan;
2432 	int i, error, nflags;
2433 
2434 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2435 
2436 	memset(bands, 0, sizeof(bands));
2437 	if (n == 0) {
2438 		setbit(bands, IEEE80211_MODE_11B);
2439 		setbit(bands, IEEE80211_MODE_11G);
2440 		if (sc->sc_flags & IWN_FLAG_HAS_11N)
2441 			setbit(bands, IEEE80211_MODE_11NG);
2442 	} else {
2443 		setbit(bands, IEEE80211_MODE_11A);
2444 		if (sc->sc_flags & IWN_FLAG_HAS_11N)
2445 			setbit(bands, IEEE80211_MODE_11NA);
2446 	}
2447 
2448 	for (i = 0; i < band->nchan; i++) {
2449 		if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
2450 			DPRINTF(sc, IWN_DEBUG_RESET,
2451 			    "skip chan %d flags 0x%x maxpwr %d\n",
2452 			    band->chan[i], channels[i].flags,
2453 			    channels[i].maxpwr);
2454 			continue;
2455 		}
2456 
2457 		chan = band->chan[i];
2458 		nflags = iwn_eeprom_channel_flags(&channels[i]);
2459 		error = ieee80211_add_channel(chans, maxchans, nchans,
2460 		    chan, 0, channels[i].maxpwr, nflags, bands);
2461 		if (error != 0)
2462 			break;
2463 
2464 		/* Save maximum allowed TX power for this channel. */
2465 		/* XXX wrong */
2466 		sc->maxpwr[chan] = channels[i].maxpwr;
2467 
2468 		DPRINTF(sc, IWN_DEBUG_RESET,
2469 		    "add chan %d flags 0x%x maxpwr %d\n", chan,
2470 		    channels[i].flags, channels[i].maxpwr);
2471 	}
2472 
2473 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2474 
2475 }
2476 
2477 static void
2478 iwn_read_eeprom_ht40(struct iwn_softc *sc, int n, int maxchans, int *nchans,
2479     struct ieee80211_channel chans[])
2480 {
2481 	struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
2482 	const struct iwn_chan_band *band = &iwn_bands[n];
2483 	uint8_t chan;
2484 	int i, error, nflags;
2485 
2486 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s start\n", __func__);
2487 
2488 	if (!(sc->sc_flags & IWN_FLAG_HAS_11N)) {
2489 		DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end no 11n\n", __func__);
2490 		return;
2491 	}
2492 
2493 	for (i = 0; i < band->nchan; i++) {
2494 		if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
2495 			DPRINTF(sc, IWN_DEBUG_RESET,
2496 			    "skip chan %d flags 0x%x maxpwr %d\n",
2497 			    band->chan[i], channels[i].flags,
2498 			    channels[i].maxpwr);
2499 			continue;
2500 		}
2501 
2502 		chan = band->chan[i];
2503 		nflags = iwn_eeprom_channel_flags(&channels[i]);
2504 		nflags |= (n == 5 ? IEEE80211_CHAN_G : IEEE80211_CHAN_A);
2505 		error = ieee80211_add_channel_ht40(chans, maxchans, nchans,
2506 		    chan, channels[i].maxpwr, nflags);
2507 		switch (error) {
2508 		case EINVAL:
2509 			device_printf(sc->sc_dev,
2510 			    "%s: no entry for channel %d\n", __func__, chan);
2511 			continue;
2512 		case ENOENT:
2513 			DPRINTF(sc, IWN_DEBUG_RESET,
2514 			    "%s: skip chan %d, extension channel not found\n",
2515 			    __func__, chan);
2516 			continue;
2517 		case ENOBUFS:
2518 			device_printf(sc->sc_dev,
2519 			    "%s: channel table is full!\n", __func__);
2520 			break;
2521 		case 0:
2522 			DPRINTF(sc, IWN_DEBUG_RESET,
2523 			    "add ht40 chan %d flags 0x%x maxpwr %d\n",
2524 			    chan, channels[i].flags, channels[i].maxpwr);
2525 			/* FALLTHROUGH */
2526 		default:
2527 			break;
2528 		}
2529 	}
2530 
2531 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2532 
2533 }
2534 
2535 static void
2536 iwn_read_eeprom_channels(struct iwn_softc *sc, int n, uint32_t addr)
2537 {
2538 	struct ieee80211com *ic = &sc->sc_ic;
2539 
2540 	iwn_read_prom_data(sc, addr, &sc->eeprom_channels[n],
2541 	    iwn_bands[n].nchan * sizeof (struct iwn_eeprom_chan));
2542 
2543 	if (n < 5) {
2544 		iwn_read_eeprom_band(sc, n, IEEE80211_CHAN_MAX, &ic->ic_nchans,
2545 		    ic->ic_channels);
2546 	} else {
2547 		iwn_read_eeprom_ht40(sc, n, IEEE80211_CHAN_MAX, &ic->ic_nchans,
2548 		    ic->ic_channels);
2549 	}
2550 	ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
2551 }
2552 
2553 static struct iwn_eeprom_chan *
2554 iwn_find_eeprom_channel(struct iwn_softc *sc, struct ieee80211_channel *c)
2555 {
2556 	int band, chan, i, j;
2557 
2558 	if (IEEE80211_IS_CHAN_HT40(c)) {
2559 		band = IEEE80211_IS_CHAN_5GHZ(c) ? 6 : 5;
2560 		if (IEEE80211_IS_CHAN_HT40D(c))
2561 			chan = c->ic_extieee;
2562 		else
2563 			chan = c->ic_ieee;
2564 		for (i = 0; i < iwn_bands[band].nchan; i++) {
2565 			if (iwn_bands[band].chan[i] == chan)
2566 				return &sc->eeprom_channels[band][i];
2567 		}
2568 	} else {
2569 		for (j = 0; j < 5; j++) {
2570 			for (i = 0; i < iwn_bands[j].nchan; i++) {
2571 				if (iwn_bands[j].chan[i] == c->ic_ieee &&
2572 				    ((j == 0) ^ IEEE80211_IS_CHAN_A(c)) == 1)
2573 					return &sc->eeprom_channels[j][i];
2574 			}
2575 		}
2576 	}
2577 	return NULL;
2578 }
2579 
2580 static void
2581 iwn_getradiocaps(struct ieee80211com *ic,
2582     int maxchans, int *nchans, struct ieee80211_channel chans[])
2583 {
2584 	struct iwn_softc *sc = ic->ic_softc;
2585 	int i;
2586 
2587 	/* Parse the list of authorized channels. */
2588 	for (i = 0; i < 5 && *nchans < maxchans; i++)
2589 		iwn_read_eeprom_band(sc, i, maxchans, nchans, chans);
2590 	for (i = 5; i < IWN_NBANDS - 1 && *nchans < maxchans; i++)
2591 		iwn_read_eeprom_ht40(sc, i, maxchans, nchans, chans);
2592 }
2593 
2594 /*
2595  * Enforce flags read from EEPROM.
2596  */
2597 static int
2598 iwn_setregdomain(struct ieee80211com *ic, struct ieee80211_regdomain *rd,
2599     int nchan, struct ieee80211_channel chans[])
2600 {
2601 	struct iwn_softc *sc = ic->ic_softc;
2602 	int i;
2603 
2604 	for (i = 0; i < nchan; i++) {
2605 		struct ieee80211_channel *c = &chans[i];
2606 		struct iwn_eeprom_chan *channel;
2607 
2608 		channel = iwn_find_eeprom_channel(sc, c);
2609 		if (channel == NULL) {
2610 			ic_printf(ic, "%s: invalid channel %u freq %u/0x%x\n",
2611 			    __func__, c->ic_ieee, c->ic_freq, c->ic_flags);
2612 			return EINVAL;
2613 		}
2614 		c->ic_flags |= iwn_eeprom_channel_flags(channel);
2615 	}
2616 
2617 	return 0;
2618 }
2619 
2620 static void
2621 iwn_read_eeprom_enhinfo(struct iwn_softc *sc)
2622 {
2623 	struct iwn_eeprom_enhinfo enhinfo[35];
2624 	struct ieee80211com *ic = &sc->sc_ic;
2625 	struct ieee80211_channel *c;
2626 	uint16_t val, base;
2627 	int8_t maxpwr;
2628 	uint8_t flags;
2629 	int i, j;
2630 
2631 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2632 
2633 	iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2634 	base = le16toh(val);
2635 	iwn_read_prom_data(sc, base + IWN6000_EEPROM_ENHINFO,
2636 	    enhinfo, sizeof enhinfo);
2637 
2638 	for (i = 0; i < nitems(enhinfo); i++) {
2639 		flags = enhinfo[i].flags;
2640 		if (!(flags & IWN_ENHINFO_VALID))
2641 			continue;	/* Skip invalid entries. */
2642 
2643 		maxpwr = 0;
2644 		if (sc->txchainmask & IWN_ANT_A)
2645 			maxpwr = MAX(maxpwr, enhinfo[i].chain[0]);
2646 		if (sc->txchainmask & IWN_ANT_B)
2647 			maxpwr = MAX(maxpwr, enhinfo[i].chain[1]);
2648 		if (sc->txchainmask & IWN_ANT_C)
2649 			maxpwr = MAX(maxpwr, enhinfo[i].chain[2]);
2650 		if (sc->ntxchains == 2)
2651 			maxpwr = MAX(maxpwr, enhinfo[i].mimo2);
2652 		else if (sc->ntxchains == 3)
2653 			maxpwr = MAX(maxpwr, enhinfo[i].mimo3);
2654 
2655 		for (j = 0; j < ic->ic_nchans; j++) {
2656 			c = &ic->ic_channels[j];
2657 			if ((flags & IWN_ENHINFO_5GHZ)) {
2658 				if (!IEEE80211_IS_CHAN_A(c))
2659 					continue;
2660 			} else if ((flags & IWN_ENHINFO_OFDM)) {
2661 				if (!IEEE80211_IS_CHAN_G(c))
2662 					continue;
2663 			} else if (!IEEE80211_IS_CHAN_B(c))
2664 				continue;
2665 			if ((flags & IWN_ENHINFO_HT40)) {
2666 				if (!IEEE80211_IS_CHAN_HT40(c))
2667 					continue;
2668 			} else {
2669 				if (IEEE80211_IS_CHAN_HT40(c))
2670 					continue;
2671 			}
2672 			if (enhinfo[i].chan != 0 &&
2673 			    enhinfo[i].chan != c->ic_ieee)
2674 				continue;
2675 
2676 			DPRINTF(sc, IWN_DEBUG_RESET,
2677 			    "channel %d(%x), maxpwr %d\n", c->ic_ieee,
2678 			    c->ic_flags, maxpwr / 2);
2679 			c->ic_maxregpower = maxpwr / 2;
2680 			c->ic_maxpower = maxpwr;
2681 		}
2682 	}
2683 
2684 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2685 
2686 }
2687 
2688 static struct ieee80211_node *
2689 iwn_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
2690 {
2691 	struct iwn_node *wn;
2692 
2693 	wn = malloc(sizeof (struct iwn_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2694 	if (wn == NULL)
2695 		return (NULL);
2696 
2697 	wn->id = IWN_ID_UNDEFINED;
2698 
2699 	return (&wn->ni);
2700 }
2701 
2702 static __inline int
2703 rate2plcp(int rate)
2704 {
2705 	switch (rate & 0xff) {
2706 	case 12:	return 0xd;
2707 	case 18:	return 0xf;
2708 	case 24:	return 0x5;
2709 	case 36:	return 0x7;
2710 	case 48:	return 0x9;
2711 	case 72:	return 0xb;
2712 	case 96:	return 0x1;
2713 	case 108:	return 0x3;
2714 	case 2:		return 10;
2715 	case 4:		return 20;
2716 	case 11:	return 55;
2717 	case 22:	return 110;
2718 	}
2719 	return 0;
2720 }
2721 
2722 static __inline uint8_t
2723 plcp2rate(const uint8_t rate_plcp)
2724 {
2725 	switch (rate_plcp) {
2726 	case 0xd:	return 12;
2727 	case 0xf:	return 18;
2728 	case 0x5:	return 24;
2729 	case 0x7:	return 36;
2730 	case 0x9:	return 48;
2731 	case 0xb:	return 72;
2732 	case 0x1:	return 96;
2733 	case 0x3:	return 108;
2734 	case 10:	return 2;
2735 	case 20:	return 4;
2736 	case 55:	return 11;
2737 	case 110:	return 22;
2738 	default:	return 0;
2739 	}
2740 }
2741 
2742 static int
2743 iwn_get_1stream_tx_antmask(struct iwn_softc *sc)
2744 {
2745 
2746 	return IWN_LSB(sc->txchainmask);
2747 }
2748 
2749 static int
2750 iwn_get_2stream_tx_antmask(struct iwn_softc *sc)
2751 {
2752 	int tx;
2753 
2754 	/*
2755 	 * The '2 stream' setup is a bit .. odd.
2756 	 *
2757 	 * For NICs that support only 1 antenna, default to IWN_ANT_AB or
2758 	 * the firmware panics (eg Intel 5100.)
2759 	 *
2760 	 * For NICs that support two antennas, we use ANT_AB.
2761 	 *
2762 	 * For NICs that support three antennas, we use the two that
2763 	 * wasn't the default one.
2764 	 *
2765 	 * XXX TODO: if bluetooth (full concurrent) is enabled, restrict
2766 	 * this to only one antenna.
2767 	 */
2768 
2769 	/* Default - transmit on the other antennas */
2770 	tx = (sc->txchainmask & ~IWN_LSB(sc->txchainmask));
2771 
2772 	/* Now, if it's zero, set it to IWN_ANT_AB, so to not panic firmware */
2773 	if (tx == 0)
2774 		tx = IWN_ANT_AB;
2775 
2776 	/*
2777 	 * If the NIC is a two-stream TX NIC, configure the TX mask to
2778 	 * the default chainmask
2779 	 */
2780 	else if (sc->ntxchains == 2)
2781 		tx = sc->txchainmask;
2782 
2783 	return (tx);
2784 }
2785 
2786 
2787 
2788 /*
2789  * Calculate the required PLCP value from the given rate,
2790  * to the given node.
2791  *
2792  * This will take the node configuration (eg 11n, rate table
2793  * setup, etc) into consideration.
2794  */
2795 static uint32_t
2796 iwn_rate_to_plcp(struct iwn_softc *sc, struct ieee80211_node *ni,
2797     uint8_t rate)
2798 {
2799 	struct ieee80211com *ic = ni->ni_ic;
2800 	uint32_t plcp = 0;
2801 	int ridx;
2802 
2803 	/*
2804 	 * If it's an MCS rate, let's set the plcp correctly
2805 	 * and set the relevant flags based on the node config.
2806 	 */
2807 	if (rate & IEEE80211_RATE_MCS) {
2808 		/*
2809 		 * Set the initial PLCP value to be between 0->31 for
2810 		 * MCS 0 -> MCS 31, then set the "I'm an MCS rate!"
2811 		 * flag.
2812 		 */
2813 		plcp = IEEE80211_RV(rate) | IWN_RFLAG_MCS;
2814 
2815 		/*
2816 		 * XXX the following should only occur if both
2817 		 * the local configuration _and_ the remote node
2818 		 * advertise these capabilities.  Thus this code
2819 		 * may need fixing!
2820 		 */
2821 
2822 		/*
2823 		 * Set the channel width and guard interval.
2824 		 */
2825 		if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
2826 			plcp |= IWN_RFLAG_HT40;
2827 			if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI40)
2828 				plcp |= IWN_RFLAG_SGI;
2829 		} else if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI20) {
2830 			plcp |= IWN_RFLAG_SGI;
2831 		}
2832 
2833 		/*
2834 		 * Ensure the selected rate matches the link quality
2835 		 * table entries being used.
2836 		 */
2837 		if (rate > 0x8f)
2838 			plcp |= IWN_RFLAG_ANT(sc->txchainmask);
2839 		else if (rate > 0x87)
2840 			plcp |= IWN_RFLAG_ANT(iwn_get_2stream_tx_antmask(sc));
2841 		else
2842 			plcp |= IWN_RFLAG_ANT(iwn_get_1stream_tx_antmask(sc));
2843 	} else {
2844 		/*
2845 		 * Set the initial PLCP - fine for both
2846 		 * OFDM and CCK rates.
2847 		 */
2848 		plcp = rate2plcp(rate);
2849 
2850 		/* Set CCK flag if it's CCK */
2851 
2852 		/* XXX It would be nice to have a method
2853 		 * to map the ridx -> phy table entry
2854 		 * so we could just query that, rather than
2855 		 * this hack to check against IWN_RIDX_OFDM6.
2856 		 */
2857 		ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
2858 		    rate & IEEE80211_RATE_VAL);
2859 		if (ridx < IWN_RIDX_OFDM6 &&
2860 		    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2861 			plcp |= IWN_RFLAG_CCK;
2862 
2863 		/* Set antenna configuration */
2864 		/* XXX TODO: is this the right antenna to use for legacy? */
2865 		plcp |= IWN_RFLAG_ANT(iwn_get_1stream_tx_antmask(sc));
2866 	}
2867 
2868 	DPRINTF(sc, IWN_DEBUG_TXRATE, "%s: rate=0x%02x, plcp=0x%08x\n",
2869 	    __func__,
2870 	    rate,
2871 	    plcp);
2872 
2873 	return (htole32(plcp));
2874 }
2875 
2876 static void
2877 iwn_newassoc(struct ieee80211_node *ni, int isnew)
2878 {
2879 	/* Doesn't do anything at the moment */
2880 }
2881 
2882 static int
2883 iwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2884 {
2885 	struct iwn_vap *ivp = IWN_VAP(vap);
2886 	struct ieee80211com *ic = vap->iv_ic;
2887 	struct iwn_softc *sc = ic->ic_softc;
2888 	int error = 0;
2889 
2890 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2891 
2892 	DPRINTF(sc, IWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
2893 	    ieee80211_state_name[vap->iv_state], ieee80211_state_name[nstate]);
2894 
2895 	IEEE80211_UNLOCK(ic);
2896 	IWN_LOCK(sc);
2897 	callout_stop(&sc->calib_to);
2898 
2899 	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
2900 
2901 	switch (nstate) {
2902 	case IEEE80211_S_ASSOC:
2903 		if (vap->iv_state != IEEE80211_S_RUN)
2904 			break;
2905 		/* FALLTHROUGH */
2906 	case IEEE80211_S_AUTH:
2907 		if (vap->iv_state == IEEE80211_S_AUTH)
2908 			break;
2909 
2910 		/*
2911 		 * !AUTH -> AUTH transition requires state reset to handle
2912 		 * reassociations correctly.
2913 		 */
2914 		sc->rxon->associd = 0;
2915 		sc->rxon->filter &= ~htole32(IWN_FILTER_BSS);
2916 		sc->calib.state = IWN_CALIB_STATE_INIT;
2917 
2918 		/* Wait until we hear a beacon before we transmit */
2919 		if (IEEE80211_IS_CHAN_PASSIVE(ic->ic_curchan))
2920 			sc->sc_beacon_wait = 1;
2921 
2922 		if ((error = iwn_auth(sc, vap)) != 0) {
2923 			device_printf(sc->sc_dev,
2924 			    "%s: could not move to auth state\n", __func__);
2925 		}
2926 		break;
2927 
2928 	case IEEE80211_S_RUN:
2929 		/*
2930 		 * RUN -> RUN transition; Just restart the timers.
2931 		 */
2932 		if (vap->iv_state == IEEE80211_S_RUN) {
2933 			sc->calib_cnt = 0;
2934 			break;
2935 		}
2936 
2937 		/* Wait until we hear a beacon before we transmit */
2938 		if (IEEE80211_IS_CHAN_PASSIVE(ic->ic_curchan))
2939 			sc->sc_beacon_wait = 1;
2940 
2941 		/*
2942 		 * !RUN -> RUN requires setting the association id
2943 		 * which is done with a firmware cmd.  We also defer
2944 		 * starting the timers until that work is done.
2945 		 */
2946 		if ((error = iwn_run(sc, vap)) != 0) {
2947 			device_printf(sc->sc_dev,
2948 			    "%s: could not move to run state\n", __func__);
2949 		}
2950 		break;
2951 
2952 	case IEEE80211_S_INIT:
2953 		sc->calib.state = IWN_CALIB_STATE_INIT;
2954 		/*
2955 		 * Purge the xmit queue so we don't have old frames
2956 		 * during a new association attempt.
2957 		 */
2958 		sc->sc_beacon_wait = 0;
2959 		iwn_xmit_queue_drain(sc);
2960 		break;
2961 
2962 	default:
2963 		break;
2964 	}
2965 	IWN_UNLOCK(sc);
2966 	IEEE80211_LOCK(ic);
2967 	if (error != 0){
2968 		DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
2969 		return error;
2970 	}
2971 
2972 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
2973 
2974 	return ivp->iv_newstate(vap, nstate, arg);
2975 }
2976 
2977 static void
2978 iwn_calib_timeout(void *arg)
2979 {
2980 	struct iwn_softc *sc = arg;
2981 
2982 	IWN_LOCK_ASSERT(sc);
2983 
2984 	/* Force automatic TX power calibration every 60 secs. */
2985 	if (++sc->calib_cnt >= 120) {
2986 		uint32_t flags = 0;
2987 
2988 		DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s\n",
2989 		    "sending request for statistics");
2990 		(void)iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags,
2991 		    sizeof flags, 1);
2992 		sc->calib_cnt = 0;
2993 	}
2994 	callout_reset(&sc->calib_to, msecs_to_ticks(500), iwn_calib_timeout,
2995 	    sc);
2996 }
2997 
2998 /*
2999  * Process an RX_PHY firmware notification.  This is usually immediately
3000  * followed by an MPDU_RX_DONE notification.
3001  */
3002 static void
3003 iwn_rx_phy(struct iwn_softc *sc, struct iwn_rx_desc *desc)
3004 {
3005 	struct iwn_rx_stat *stat = (struct iwn_rx_stat *)(desc + 1);
3006 
3007 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: received PHY stats\n", __func__);
3008 
3009 	/* Save RX statistics, they will be used on MPDU_RX_DONE. */
3010 	memcpy(&sc->last_rx_stat, stat, sizeof (*stat));
3011 	sc->last_rx_valid = 1;
3012 }
3013 
3014 /*
3015  * Process an RX_DONE (4965AGN only) or MPDU_RX_DONE firmware notification.
3016  * Each MPDU_RX_DONE notification must be preceded by an RX_PHY one.
3017  */
3018 static void
3019 iwn_rx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3020     struct iwn_rx_data *data)
3021 {
3022 	struct iwn_ops *ops = &sc->ops;
3023 	struct ieee80211com *ic = &sc->sc_ic;
3024 	struct iwn_rx_ring *ring = &sc->rxq;
3025 	struct ieee80211_frame_min *wh;
3026 	struct ieee80211_node *ni;
3027 	struct mbuf *m, *m1;
3028 	struct iwn_rx_stat *stat;
3029 	caddr_t head;
3030 	bus_addr_t paddr;
3031 	uint32_t flags;
3032 	int error, len, rssi, nf;
3033 
3034 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3035 
3036 	if (desc->type == IWN_MPDU_RX_DONE) {
3037 		/* Check for prior RX_PHY notification. */
3038 		if (!sc->last_rx_valid) {
3039 			DPRINTF(sc, IWN_DEBUG_ANY,
3040 			    "%s: missing RX_PHY\n", __func__);
3041 			return;
3042 		}
3043 		stat = &sc->last_rx_stat;
3044 	} else
3045 		stat = (struct iwn_rx_stat *)(desc + 1);
3046 
3047 	if (stat->cfg_phy_len > IWN_STAT_MAXLEN) {
3048 		device_printf(sc->sc_dev,
3049 		    "%s: invalid RX statistic header, len %d\n", __func__,
3050 		    stat->cfg_phy_len);
3051 		return;
3052 	}
3053 	if (desc->type == IWN_MPDU_RX_DONE) {
3054 		struct iwn_rx_mpdu *mpdu = (struct iwn_rx_mpdu *)(desc + 1);
3055 		head = (caddr_t)(mpdu + 1);
3056 		len = le16toh(mpdu->len);
3057 	} else {
3058 		head = (caddr_t)(stat + 1) + stat->cfg_phy_len;
3059 		len = le16toh(stat->len);
3060 	}
3061 
3062 	flags = le32toh(*(uint32_t *)(head + len));
3063 
3064 	/* Discard frames with a bad FCS early. */
3065 	if ((flags & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
3066 		DPRINTF(sc, IWN_DEBUG_RECV, "%s: RX flags error %x\n",
3067 		    __func__, flags);
3068 		counter_u64_add(ic->ic_ierrors, 1);
3069 		return;
3070 	}
3071 	/* Discard frames that are too short. */
3072 	if (len < sizeof (struct ieee80211_frame_ack)) {
3073 		DPRINTF(sc, IWN_DEBUG_RECV, "%s: frame too short: %d\n",
3074 		    __func__, len);
3075 		counter_u64_add(ic->ic_ierrors, 1);
3076 		return;
3077 	}
3078 
3079 	m1 = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWN_RBUF_SIZE);
3080 	if (m1 == NULL) {
3081 		DPRINTF(sc, IWN_DEBUG_ANY, "%s: no mbuf to restock ring\n",
3082 		    __func__);
3083 		counter_u64_add(ic->ic_ierrors, 1);
3084 		return;
3085 	}
3086 	bus_dmamap_unload(ring->data_dmat, data->map);
3087 
3088 	error = bus_dmamap_load(ring->data_dmat, data->map, mtod(m1, void *),
3089 	    IWN_RBUF_SIZE, iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
3090 	if (error != 0 && error != EFBIG) {
3091 		device_printf(sc->sc_dev,
3092 		    "%s: bus_dmamap_load failed, error %d\n", __func__, error);
3093 		m_freem(m1);
3094 
3095 		/* Try to reload the old mbuf. */
3096 		error = bus_dmamap_load(ring->data_dmat, data->map,
3097 		    mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
3098 		    &paddr, BUS_DMA_NOWAIT);
3099 		if (error != 0 && error != EFBIG) {
3100 			panic("%s: could not load old RX mbuf", __func__);
3101 		}
3102 		bus_dmamap_sync(ring->data_dmat, data->map,
3103 		    BUS_DMASYNC_PREREAD);
3104 		/* Physical address may have changed. */
3105 		ring->desc[ring->cur] = htole32(paddr >> 8);
3106 		bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
3107 		    BUS_DMASYNC_PREWRITE);
3108 		counter_u64_add(ic->ic_ierrors, 1);
3109 		return;
3110 	}
3111 
3112 	bus_dmamap_sync(ring->data_dmat, data->map,
3113 	    BUS_DMASYNC_PREREAD);
3114 
3115 	m = data->m;
3116 	data->m = m1;
3117 	/* Update RX descriptor. */
3118 	ring->desc[ring->cur] = htole32(paddr >> 8);
3119 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
3120 	    BUS_DMASYNC_PREWRITE);
3121 
3122 	/* Finalize mbuf. */
3123 	m->m_data = head;
3124 	m->m_pkthdr.len = m->m_len = len;
3125 
3126 	/* Grab a reference to the source node. */
3127 	wh = mtod(m, struct ieee80211_frame_min *);
3128 	if (len >= sizeof(struct ieee80211_frame_min))
3129 		ni = ieee80211_find_rxnode(ic, wh);
3130 	else
3131 		ni = NULL;
3132 	nf = (ni != NULL && ni->ni_vap->iv_state == IEEE80211_S_RUN &&
3133 	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) ? sc->noise : -95;
3134 
3135 	rssi = ops->get_rssi(sc, stat);
3136 
3137 	if (ieee80211_radiotap_active(ic)) {
3138 		struct iwn_rx_radiotap_header *tap = &sc->sc_rxtap;
3139 		uint32_t rate = le32toh(stat->rate);
3140 
3141 		tap->wr_flags = 0;
3142 		if (stat->flags & htole16(IWN_STAT_FLAG_SHPREAMBLE))
3143 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
3144 		tap->wr_dbm_antsignal = (int8_t)rssi;
3145 		tap->wr_dbm_antnoise = (int8_t)nf;
3146 		tap->wr_tsft = stat->tstamp;
3147 		if (rate & IWN_RFLAG_MCS) {
3148 			tap->wr_rate = rate & IWN_RFLAG_RATE_MCS;
3149 			tap->wr_rate |= IEEE80211_RATE_MCS;
3150 		} else
3151 			tap->wr_rate = plcp2rate(rate & IWN_RFLAG_RATE);
3152 	}
3153 
3154 	/*
3155 	 * If it's a beacon and we're waiting, then do the
3156 	 * wakeup.  This should unblock raw_xmit/start.
3157 	 */
3158 	if (sc->sc_beacon_wait) {
3159 		uint8_t type, subtype;
3160 		/* NB: Re-assign wh */
3161 		wh = mtod(m, struct ieee80211_frame_min *);
3162 		type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3163 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
3164 		/*
3165 		 * This assumes at this point we've received our own
3166 		 * beacon.
3167 		 */
3168 		DPRINTF(sc, IWN_DEBUG_TRACE,
3169 		    "%s: beacon_wait, type=%d, subtype=%d\n",
3170 		    __func__, type, subtype);
3171 		if (type == IEEE80211_FC0_TYPE_MGT &&
3172 		    subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
3173 			DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_XMIT,
3174 			    "%s: waking things up\n", __func__);
3175 			/* queue taskqueue to transmit! */
3176 			taskqueue_enqueue(sc->sc_tq, &sc->sc_xmit_task);
3177 		}
3178 	}
3179 
3180 	IWN_UNLOCK(sc);
3181 
3182 	/* Send the frame to the 802.11 layer. */
3183 	if (ni != NULL) {
3184 		if (ni->ni_flags & IEEE80211_NODE_HT)
3185 			m->m_flags |= M_AMPDU;
3186 		(void)ieee80211_input(ni, m, rssi - nf, nf);
3187 		/* Node is no longer needed. */
3188 		ieee80211_free_node(ni);
3189 	} else
3190 		(void)ieee80211_input_all(ic, m, rssi - nf, nf);
3191 
3192 	IWN_LOCK(sc);
3193 
3194 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3195 
3196 }
3197 
3198 static void
3199 iwn_agg_tx_complete(struct iwn_softc *sc, struct iwn_tx_ring *ring, int tid,
3200     int idx, int success)
3201 {
3202 	struct ieee80211_ratectl_tx_status *txs = &sc->sc_txs;
3203 	struct iwn_tx_data *data = &ring->data[idx];
3204 	struct iwn_node *wn;
3205 	struct mbuf *m;
3206 	struct ieee80211_node *ni;
3207 
3208 	KASSERT(data->ni != NULL, ("idx %d: no node", idx));
3209 	KASSERT(data->m != NULL, ("idx %d: no mbuf", idx));
3210 
3211 	/* Unmap and free mbuf. */
3212 	bus_dmamap_sync(ring->data_dmat, data->map,
3213 	    BUS_DMASYNC_POSTWRITE);
3214 	bus_dmamap_unload(ring->data_dmat, data->map);
3215 	m = data->m, data->m = NULL;
3216 	ni = data->ni, data->ni = NULL;
3217 	wn = (void *)ni;
3218 
3219 #if 0
3220 	/* XXX causes significant performance degradation. */
3221 	txs->flags = IEEE80211_RATECTL_STATUS_SHORT_RETRY |
3222 		     IEEE80211_RATECTL_STATUS_LONG_RETRY;
3223 	txs->long_retries = data->long_retries - 1;
3224 #else
3225 	txs->flags = IEEE80211_RATECTL_STATUS_SHORT_RETRY;
3226 #endif
3227 	txs->short_retries = wn->agg[tid].short_retries;
3228 	if (success)
3229 		txs->status = IEEE80211_RATECTL_TX_SUCCESS;
3230 	else
3231 		txs->status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
3232 
3233 	wn->agg[tid].short_retries = 0;
3234 	data->long_retries = 0;
3235 
3236 	DPRINTF(sc, IWN_DEBUG_AMPDU, "%s: freeing m %p ni %p idx %d qid %d\n",
3237 	    __func__, m, ni, idx, ring->qid);
3238 	ieee80211_ratectl_tx_complete(ni, txs);
3239 	ieee80211_tx_complete(ni, m, !success);
3240 }
3241 
3242 /* Process an incoming Compressed BlockAck. */
3243 static void
3244 iwn_rx_compressed_ba(struct iwn_softc *sc, struct iwn_rx_desc *desc)
3245 {
3246 	struct iwn_tx_ring *ring;
3247 	struct iwn_tx_data *data;
3248 	struct iwn_node *wn;
3249 	struct iwn_compressed_ba *ba = (struct iwn_compressed_ba *)(desc + 1);
3250 	struct ieee80211_tx_ampdu *tap;
3251 	uint64_t bitmap;
3252 	uint8_t tid;
3253 	int i, qid, shift;
3254 	int tx_ok = 0;
3255 
3256 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3257 
3258 	qid = le16toh(ba->qid);
3259 	tap = sc->qid2tap[qid];
3260 	ring = &sc->txq[qid];
3261 	tid = tap->txa_tid;
3262 	wn = (void *)tap->txa_ni;
3263 
3264 	DPRINTF(sc, IWN_DEBUG_AMPDU, "%s: qid %d tid %d seq %04X ssn %04X\n"
3265 	    "bitmap: ba %016jX wn %016jX, start %d\n",
3266 	    __func__, qid, tid, le16toh(ba->seq), le16toh(ba->ssn),
3267 	    (uintmax_t)le64toh(ba->bitmap), (uintmax_t)wn->agg[tid].bitmap,
3268 	    wn->agg[tid].startidx);
3269 
3270 	if (wn->agg[tid].bitmap == 0)
3271 		return;
3272 
3273 	shift = wn->agg[tid].startidx - ((le16toh(ba->seq) >> 4) & 0xff);
3274 	if (shift <= -64)
3275 		shift += 0x100;
3276 
3277 	/*
3278 	 * Walk the bitmap and calculate how many successful attempts
3279 	 * are made.
3280 	 *
3281 	 * Yes, the rate control code doesn't know these are A-MPDU
3282 	 * subframes; due to that long_retries stats are not used here.
3283 	 */
3284 	bitmap = le64toh(ba->bitmap);
3285 	if (shift >= 0)
3286 		bitmap >>= shift;
3287 	else
3288 		bitmap <<= -shift;
3289 	bitmap &= wn->agg[tid].bitmap;
3290 	wn->agg[tid].bitmap = 0;
3291 
3292 	for (i = wn->agg[tid].startidx;
3293 	     bitmap;
3294 	     bitmap >>= 1, i = (i + 1) % IWN_TX_RING_COUNT) {
3295 		if ((bitmap & 1) == 0)
3296 			continue;
3297 
3298 		data = &ring->data[i];
3299 		if (__predict_false(data->m == NULL)) {
3300 			/*
3301 			 * There is no frame; skip this entry.
3302 			 *
3303 			 * NB: it is "ok" to have both
3304 			 * 'tx done' + 'compressed BA' replies for frame
3305 			 * with STATE_SCD_QUERY status.
3306 			 */
3307 			DPRINTF(sc, IWN_DEBUG_AMPDU,
3308 			    "%s: ring %d: no entry %d\n", __func__, qid, i);
3309 			continue;
3310 		}
3311 
3312 		tx_ok++;
3313 		iwn_agg_tx_complete(sc, ring, tid, i, 1);
3314 	}
3315 
3316 	ring->queued -= tx_ok;
3317 	iwn_check_tx_ring(sc, qid);
3318 
3319 	DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_AMPDU,
3320 	    "->%s: end; %d ok\n",__func__, tx_ok);
3321 }
3322 
3323 /*
3324  * Process a CALIBRATION_RESULT notification sent by the initialization
3325  * firmware on response to a CMD_CALIB_CONFIG command (5000 only).
3326  */
3327 static void
3328 iwn5000_rx_calib_results(struct iwn_softc *sc, struct iwn_rx_desc *desc)
3329 {
3330 	struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
3331 	int len, idx = -1;
3332 
3333 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3334 
3335 	/* Runtime firmware should not send such a notification. */
3336 	if (sc->sc_flags & IWN_FLAG_CALIB_DONE){
3337 		DPRINTF(sc, IWN_DEBUG_TRACE,
3338 		    "->%s received after calib done\n", __func__);
3339 		return;
3340 	}
3341 	len = (le32toh(desc->len) & 0x3fff) - 4;
3342 
3343 	switch (calib->code) {
3344 	case IWN5000_PHY_CALIB_DC:
3345 		if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_DC)
3346 			idx = 0;
3347 		break;
3348 	case IWN5000_PHY_CALIB_LO:
3349 		if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_LO)
3350 			idx = 1;
3351 		break;
3352 	case IWN5000_PHY_CALIB_TX_IQ:
3353 		if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TX_IQ)
3354 			idx = 2;
3355 		break;
3356 	case IWN5000_PHY_CALIB_TX_IQ_PERIODIC:
3357 		if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TX_IQ_PERIODIC)
3358 			idx = 3;
3359 		break;
3360 	case IWN5000_PHY_CALIB_BASE_BAND:
3361 		if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_BASE_BAND)
3362 			idx = 4;
3363 		break;
3364 	}
3365 	if (idx == -1)	/* Ignore other results. */
3366 		return;
3367 
3368 	/* Save calibration result. */
3369 	if (sc->calibcmd[idx].buf != NULL)
3370 		free(sc->calibcmd[idx].buf, M_DEVBUF);
3371 	sc->calibcmd[idx].buf = malloc(len, M_DEVBUF, M_NOWAIT);
3372 	if (sc->calibcmd[idx].buf == NULL) {
3373 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
3374 		    "not enough memory for calibration result %d\n",
3375 		    calib->code);
3376 		return;
3377 	}
3378 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
3379 	    "saving calibration result idx=%d, code=%d len=%d\n", idx, calib->code, len);
3380 	sc->calibcmd[idx].len = len;
3381 	memcpy(sc->calibcmd[idx].buf, calib, len);
3382 }
3383 
3384 static void
3385 iwn_stats_update(struct iwn_softc *sc, struct iwn_calib_state *calib,
3386     struct iwn_stats *stats, int len)
3387 {
3388 	struct iwn_stats_bt *stats_bt;
3389 	struct iwn_stats *lstats;
3390 
3391 	/*
3392 	 * First - check whether the length is the bluetooth or normal.
3393 	 *
3394 	 * If it's normal - just copy it and bump out.
3395 	 * Otherwise we have to convert things.
3396 	 */
3397 
3398 	if (len == sizeof(struct iwn_stats) + 4) {
3399 		memcpy(&sc->last_stat, stats, sizeof(struct iwn_stats));
3400 		sc->last_stat_valid = 1;
3401 		return;
3402 	}
3403 
3404 	/*
3405 	 * If it's not the bluetooth size - log, then just copy.
3406 	 */
3407 	if (len != sizeof(struct iwn_stats_bt) + 4) {
3408 		DPRINTF(sc, IWN_DEBUG_STATS,
3409 		    "%s: size of rx statistics (%d) not an expected size!\n",
3410 		    __func__,
3411 		    len);
3412 		memcpy(&sc->last_stat, stats, sizeof(struct iwn_stats));
3413 		sc->last_stat_valid = 1;
3414 		return;
3415 	}
3416 
3417 	/*
3418 	 * Ok. Time to copy.
3419 	 */
3420 	stats_bt = (struct iwn_stats_bt *) stats;
3421 	lstats = &sc->last_stat;
3422 
3423 	/* flags */
3424 	lstats->flags = stats_bt->flags;
3425 	/* rx_bt */
3426 	memcpy(&lstats->rx.ofdm, &stats_bt->rx_bt.ofdm,
3427 	    sizeof(struct iwn_rx_phy_stats));
3428 	memcpy(&lstats->rx.cck, &stats_bt->rx_bt.cck,
3429 	    sizeof(struct iwn_rx_phy_stats));
3430 	memcpy(&lstats->rx.general, &stats_bt->rx_bt.general_bt.common,
3431 	    sizeof(struct iwn_rx_general_stats));
3432 	memcpy(&lstats->rx.ht, &stats_bt->rx_bt.ht,
3433 	    sizeof(struct iwn_rx_ht_phy_stats));
3434 	/* tx */
3435 	memcpy(&lstats->tx, &stats_bt->tx,
3436 	    sizeof(struct iwn_tx_stats));
3437 	/* general */
3438 	memcpy(&lstats->general, &stats_bt->general,
3439 	    sizeof(struct iwn_general_stats));
3440 
3441 	/* XXX TODO: Squirrel away the extra bluetooth stats somewhere */
3442 	sc->last_stat_valid = 1;
3443 }
3444 
3445 /*
3446  * Process an RX_STATISTICS or BEACON_STATISTICS firmware notification.
3447  * The latter is sent by the firmware after each received beacon.
3448  */
3449 static void
3450 iwn_rx_statistics(struct iwn_softc *sc, struct iwn_rx_desc *desc)
3451 {
3452 	struct iwn_ops *ops = &sc->ops;
3453 	struct ieee80211com *ic = &sc->sc_ic;
3454 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3455 	struct iwn_calib_state *calib = &sc->calib;
3456 	struct iwn_stats *stats = (struct iwn_stats *)(desc + 1);
3457 	struct iwn_stats *lstats;
3458 	int temp;
3459 
3460 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3461 
3462 	/* Ignore statistics received during a scan. */
3463 	if (vap->iv_state != IEEE80211_S_RUN ||
3464 	    (ic->ic_flags & IEEE80211_F_SCAN)){
3465 		DPRINTF(sc, IWN_DEBUG_TRACE, "->%s received during calib\n",
3466 	    __func__);
3467 		return;
3468 	}
3469 
3470 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_STATS,
3471 	    "%s: received statistics, cmd %d, len %d\n",
3472 	    __func__, desc->type, le16toh(desc->len));
3473 	sc->calib_cnt = 0;	/* Reset TX power calibration timeout. */
3474 
3475 	/*
3476 	 * Collect/track general statistics for reporting.
3477 	 *
3478 	 * This takes care of ensuring that the bluetooth sized message
3479 	 * will be correctly converted to the legacy sized message.
3480 	 */
3481 	iwn_stats_update(sc, calib, stats, le16toh(desc->len));
3482 
3483 	/*
3484 	 * And now, let's take a reference of it to use!
3485 	 */
3486 	lstats = &sc->last_stat;
3487 
3488 	/* Test if temperature has changed. */
3489 	if (lstats->general.temp != sc->rawtemp) {
3490 		/* Convert "raw" temperature to degC. */
3491 		sc->rawtemp = stats->general.temp;
3492 		temp = ops->get_temperature(sc);
3493 		DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d\n",
3494 		    __func__, temp);
3495 
3496 		/* Update TX power if need be (4965AGN only). */
3497 		if (sc->hw_type == IWN_HW_REV_TYPE_4965)
3498 			iwn4965_power_calibration(sc, temp);
3499 	}
3500 
3501 	if (desc->type != IWN_BEACON_STATISTICS)
3502 		return;	/* Reply to a statistics request. */
3503 
3504 	sc->noise = iwn_get_noise(&lstats->rx.general);
3505 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: noise %d\n", __func__, sc->noise);
3506 
3507 	/* Test that RSSI and noise are present in stats report. */
3508 	if (le32toh(lstats->rx.general.flags) != 1) {
3509 		DPRINTF(sc, IWN_DEBUG_ANY, "%s\n",
3510 		    "received statistics without RSSI");
3511 		return;
3512 	}
3513 
3514 	if (calib->state == IWN_CALIB_STATE_ASSOC)
3515 		iwn_collect_noise(sc, &lstats->rx.general);
3516 	else if (calib->state == IWN_CALIB_STATE_RUN) {
3517 		iwn_tune_sensitivity(sc, &lstats->rx);
3518 		/*
3519 		 * XXX TODO: Only run the RX recovery if we're associated!
3520 		 */
3521 		iwn_check_rx_recovery(sc, lstats);
3522 		iwn_save_stats_counters(sc, lstats);
3523 	}
3524 
3525 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3526 }
3527 
3528 /*
3529  * Save the relevant statistic counters for the next calibration
3530  * pass.
3531  */
3532 static void
3533 iwn_save_stats_counters(struct iwn_softc *sc, const struct iwn_stats *rs)
3534 {
3535 	struct iwn_calib_state *calib = &sc->calib;
3536 
3537 	/* Save counters values for next call. */
3538 	calib->bad_plcp_cck = le32toh(rs->rx.cck.bad_plcp);
3539 	calib->fa_cck = le32toh(rs->rx.cck.fa);
3540 	calib->bad_plcp_ht = le32toh(rs->rx.ht.bad_plcp);
3541 	calib->bad_plcp_ofdm = le32toh(rs->rx.ofdm.bad_plcp);
3542 	calib->fa_ofdm = le32toh(rs->rx.ofdm.fa);
3543 
3544 	/* Last time we received these tick values */
3545 	sc->last_calib_ticks = ticks;
3546 }
3547 
3548 /*
3549  * Process a TX_DONE firmware notification.  Unfortunately, the 4965AGN
3550  * and 5000 adapters have different incompatible TX status formats.
3551  */
3552 static void
3553 iwn4965_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3554     struct iwn_rx_data *data)
3555 {
3556 	struct iwn4965_tx_stat *stat = (struct iwn4965_tx_stat *)(desc + 1);
3557 	int qid = desc->qid & IWN_RX_DESC_QID_MSK;
3558 
3559 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
3560 	    "qid %d idx %d RTS retries %d ACK retries %d nkill %d rate %x duration %d status %x\n",
3561 	    __func__, desc->qid, desc->idx,
3562 	    stat->rtsfailcnt,
3563 	    stat->ackfailcnt,
3564 	    stat->btkillcnt,
3565 	    stat->rate, le16toh(stat->duration),
3566 	    le32toh(stat->status));
3567 
3568 	if (qid >= sc->firstaggqueue && stat->nframes != 1) {
3569 		iwn_ampdu_tx_done(sc, qid, stat->nframes, stat->rtsfailcnt,
3570 		    &stat->status);
3571 	} else {
3572 		iwn_tx_done(sc, desc, stat->rtsfailcnt, stat->ackfailcnt,
3573 		    le32toh(stat->status) & 0xff);
3574 	}
3575 }
3576 
3577 static void
3578 iwn5000_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3579     struct iwn_rx_data *data)
3580 {
3581 	struct iwn5000_tx_stat *stat = (struct iwn5000_tx_stat *)(desc + 1);
3582 	int qid = desc->qid & IWN_RX_DESC_QID_MSK;
3583 
3584 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
3585 	    "qid %d idx %d RTS retries %d ACK retries %d nkill %d rate %x duration %d status %x\n",
3586 	    __func__, desc->qid, desc->idx,
3587 	    stat->rtsfailcnt,
3588 	    stat->ackfailcnt,
3589 	    stat->btkillcnt,
3590 	    stat->rate, le16toh(stat->duration),
3591 	    le32toh(stat->status));
3592 
3593 #ifdef notyet
3594 	/* Reset TX scheduler slot. */
3595 	iwn5000_reset_sched(sc, qid, desc->idx);
3596 #endif
3597 
3598 	if (qid >= sc->firstaggqueue && stat->nframes != 1) {
3599 		iwn_ampdu_tx_done(sc, qid, stat->nframes, stat->rtsfailcnt,
3600 		    &stat->status);
3601 	} else {
3602 		iwn_tx_done(sc, desc, stat->rtsfailcnt, stat->ackfailcnt,
3603 		    le16toh(stat->status) & 0xff);
3604 	}
3605 }
3606 
3607 static void
3608 iwn_adj_ampdu_ptr(struct iwn_softc *sc, struct iwn_tx_ring *ring)
3609 {
3610 	int i;
3611 
3612 	for (i = ring->read; i != ring->cur; i = (i + 1) % IWN_TX_RING_COUNT) {
3613 		struct iwn_tx_data *data = &ring->data[i];
3614 
3615 		if (data->m != NULL)
3616 			break;
3617 
3618 		data->remapped = 0;
3619 	}
3620 
3621 	ring->read = i;
3622 }
3623 
3624 /*
3625  * Adapter-independent backend for TX_DONE firmware notifications.
3626  */
3627 static void
3628 iwn_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc, int rtsfailcnt,
3629     int ackfailcnt, uint8_t status)
3630 {
3631 	struct ieee80211_ratectl_tx_status *txs = &sc->sc_txs;
3632 	struct iwn_tx_ring *ring = &sc->txq[desc->qid & IWN_RX_DESC_QID_MSK];
3633 	struct iwn_tx_data *data = &ring->data[desc->idx];
3634 	struct mbuf *m;
3635 	struct ieee80211_node *ni;
3636 
3637 	if (__predict_false(data->m == NULL &&
3638 	    ring->qid >= sc->firstaggqueue)) {
3639 		/*
3640 		 * There is no frame; skip this entry.
3641 		 */
3642 		DPRINTF(sc, IWN_DEBUG_AMPDU, "%s: ring %d: no entry %d\n",
3643 		    __func__, ring->qid, desc->idx);
3644 		return;
3645 	}
3646 
3647 	KASSERT(data->ni != NULL, ("no node"));
3648 	KASSERT(data->m != NULL, ("no mbuf"));
3649 
3650 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3651 
3652 	/* Unmap and free mbuf. */
3653 	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
3654 	bus_dmamap_unload(ring->data_dmat, data->map);
3655 	m = data->m, data->m = NULL;
3656 	ni = data->ni, data->ni = NULL;
3657 
3658 	data->long_retries = 0;
3659 
3660 	if (ring->qid >= sc->firstaggqueue)
3661 		iwn_adj_ampdu_ptr(sc, ring);
3662 
3663 	/*
3664 	 * XXX f/w may hang (device timeout) when desc->idx - ring->read == 64
3665 	 * (aggregation queues only).
3666 	 */
3667 
3668 	ring->queued--;
3669 	iwn_check_tx_ring(sc, ring->qid);
3670 
3671 	/*
3672 	 * Update rate control statistics for the node.
3673 	 */
3674 	txs->flags = IEEE80211_RATECTL_STATUS_SHORT_RETRY |
3675 		     IEEE80211_RATECTL_STATUS_LONG_RETRY;
3676 	txs->short_retries = rtsfailcnt;
3677 	txs->long_retries = ackfailcnt;
3678 	if (!(status & IWN_TX_FAIL))
3679 		txs->status = IEEE80211_RATECTL_TX_SUCCESS;
3680 	else {
3681 		switch (status) {
3682 		case IWN_TX_FAIL_SHORT_LIMIT:
3683 			txs->status = IEEE80211_RATECTL_TX_FAIL_SHORT;
3684 			break;
3685 		case IWN_TX_FAIL_LONG_LIMIT:
3686 			txs->status = IEEE80211_RATECTL_TX_FAIL_LONG;
3687 			break;
3688 		case IWN_TX_STATUS_FAIL_LIFE_EXPIRE:
3689 			txs->status = IEEE80211_RATECTL_TX_FAIL_EXPIRED;
3690 			break;
3691 		default:
3692 			txs->status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
3693 			break;
3694 		}
3695 	}
3696 	ieee80211_ratectl_tx_complete(ni, txs);
3697 
3698 	/*
3699 	 * Channels marked for "radar" require traffic to be received
3700 	 * to unlock before we can transmit.  Until traffic is seen
3701 	 * any attempt to transmit is returned immediately with status
3702 	 * set to IWN_TX_FAIL_TX_LOCKED.  Unfortunately this can easily
3703 	 * happen on first authenticate after scanning.  To workaround
3704 	 * this we ignore a failure of this sort in AUTH state so the
3705 	 * 802.11 layer will fall back to using a timeout to wait for
3706 	 * the AUTH reply.  This allows the firmware time to see
3707 	 * traffic so a subsequent retry of AUTH succeeds.  It's
3708 	 * unclear why the firmware does not maintain state for
3709 	 * channels recently visited as this would allow immediate
3710 	 * use of the channel after a scan (where we see traffic).
3711 	 */
3712 	if (status == IWN_TX_FAIL_TX_LOCKED &&
3713 	    ni->ni_vap->iv_state == IEEE80211_S_AUTH)
3714 		ieee80211_tx_complete(ni, m, 0);
3715 	else
3716 		ieee80211_tx_complete(ni, m,
3717 		    (status & IWN_TX_FAIL) != 0);
3718 
3719 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3720 }
3721 
3722 /*
3723  * Process a "command done" firmware notification.  This is where we wakeup
3724  * processes waiting for a synchronous command completion.
3725  */
3726 static void
3727 iwn_cmd_done(struct iwn_softc *sc, struct iwn_rx_desc *desc)
3728 {
3729 	struct iwn_tx_ring *ring;
3730 	struct iwn_tx_data *data;
3731 	int cmd_queue_num;
3732 
3733 	if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT)
3734 		cmd_queue_num = IWN_PAN_CMD_QUEUE;
3735 	else
3736 		cmd_queue_num = IWN_CMD_QUEUE_NUM;
3737 
3738 	if ((desc->qid & IWN_RX_DESC_QID_MSK) != cmd_queue_num)
3739 		return;	/* Not a command ack. */
3740 
3741 	ring = &sc->txq[cmd_queue_num];
3742 	data = &ring->data[desc->idx];
3743 
3744 	/* If the command was mapped in an mbuf, free it. */
3745 	if (data->m != NULL) {
3746 		bus_dmamap_sync(ring->data_dmat, data->map,
3747 		    BUS_DMASYNC_POSTWRITE);
3748 		bus_dmamap_unload(ring->data_dmat, data->map);
3749 		m_freem(data->m);
3750 		data->m = NULL;
3751 	}
3752 	wakeup(&ring->desc[desc->idx]);
3753 }
3754 
3755 static int
3756 iwn_ampdu_check_bitmap(uint64_t bitmap, int start, int idx)
3757 {
3758 	int bit, shift;
3759 
3760 	bit = idx - start;
3761 	shift = 0;
3762 	if (bit >= 64) {
3763 		shift = 0x100 - bit;
3764 		bit = 0;
3765 	} else if (bit <= -64)
3766 		bit = 0x100 + bit;
3767 	else if (bit < 0) {
3768 		shift = -bit;
3769 		bit = 0;
3770 	}
3771 
3772 	if (bit - shift >= 64)
3773 		return (0);
3774 
3775 	return ((bitmap & (1ULL << (bit - shift))) != 0);
3776 }
3777 
3778 /*
3779  * Firmware bug workaround: in case if 'retries' counter
3780  * overflows 'seqno' field will be incremented:
3781  *    status|sequence|status|sequence|status|sequence
3782  *     0000    0A48    0001    0A49    0000    0A6A
3783  *     1000    0A48    1000    0A49    1000    0A6A
3784  *     2000    0A48    2000    0A49    2000    0A6A
3785  * ...
3786  *     E000    0A48    E000    0A49    E000    0A6A
3787  *     F000    0A48    F000    0A49    F000    0A6A
3788  *     0000    0A49    0000    0A49    0000    0A6B
3789  *     1000    0A49    1000    0A49    1000    0A6B
3790  * ...
3791  *     D000    0A49    D000    0A49    D000    0A6B
3792  *     E000    0A49    E001    0A49    E000    0A6B
3793  *     F000    0A49    F001    0A49    F000    0A6B
3794  *     0000    0A4A    0000    0A4B    0000    0A6A
3795  *     1000    0A4A    1000    0A4B    1000    0A6A
3796  * ...
3797  *
3798  * Odd 'seqno' numbers are incremened by 2 every 2 overflows.
3799  * For even 'seqno' % 4 != 0 overflow is cyclic (0 -> +1 -> 0).
3800  * Not checked with nretries >= 64.
3801  *
3802  */
3803 static int
3804 iwn_ampdu_index_check(struct iwn_softc *sc, struct iwn_tx_ring *ring,
3805     uint64_t bitmap, int start, int idx)
3806 {
3807 	struct ieee80211com *ic = &sc->sc_ic;
3808 	struct iwn_tx_data *data;
3809 	int diff, min_retries, max_retries, new_idx, loop_end;
3810 
3811 	new_idx = idx - IWN_LONG_RETRY_LIMIT_LOG;
3812 	if (new_idx < 0)
3813 		new_idx += IWN_TX_RING_COUNT;
3814 
3815 	/*
3816 	 * Corner case: check if retry count is not too big;
3817 	 * reset device otherwise.
3818 	 */
3819 	if (!iwn_ampdu_check_bitmap(bitmap, start, new_idx)) {
3820 		data = &ring->data[new_idx];
3821 		if (data->long_retries > IWN_LONG_RETRY_LIMIT) {
3822 			device_printf(sc->sc_dev,
3823 			    "%s: retry count (%d) for idx %d/%d overflow, "
3824 			    "resetting...\n", __func__, data->long_retries,
3825 			    ring->qid, new_idx);
3826 			ieee80211_restart_all(ic);
3827 			return (-1);
3828 		}
3829 	}
3830 
3831 	/* Correct index if needed. */
3832 	loop_end = idx;
3833 	do {
3834 		data = &ring->data[new_idx];
3835 		diff = idx - new_idx;
3836 		if (diff < 0)
3837 			diff += IWN_TX_RING_COUNT;
3838 
3839 		min_retries = IWN_LONG_RETRY_FW_OVERFLOW * diff;
3840 		if ((new_idx % 2) == 0)
3841 			max_retries = IWN_LONG_RETRY_FW_OVERFLOW * (diff + 1);
3842 		else
3843 			max_retries = IWN_LONG_RETRY_FW_OVERFLOW * (diff + 2);
3844 
3845 		if (!iwn_ampdu_check_bitmap(bitmap, start, new_idx) &&
3846 		    ((data->long_retries >= min_retries &&
3847 		      data->long_retries < max_retries) ||
3848 		     (diff == 1 &&
3849 		      (new_idx & 0x03) == 0x02 &&
3850 		      data->long_retries >= IWN_LONG_RETRY_FW_OVERFLOW))) {
3851 			DPRINTF(sc, IWN_DEBUG_AMPDU,
3852 			    "%s: correcting index %d -> %d in queue %d"
3853 			    " (retries %d)\n", __func__, idx, new_idx,
3854 			    ring->qid, data->long_retries);
3855 			return (new_idx);
3856 		}
3857 
3858 		new_idx = (new_idx + 1) % IWN_TX_RING_COUNT;
3859 	} while (new_idx != loop_end);
3860 
3861 	return (idx);
3862 }
3863 
3864 static void
3865 iwn_ampdu_tx_done(struct iwn_softc *sc, int qid, int nframes, int rtsfailcnt,
3866     void *stat)
3867 {
3868 	struct iwn_tx_ring *ring = &sc->txq[qid];
3869 	struct ieee80211_tx_ampdu *tap = sc->qid2tap[qid];
3870 	struct iwn_node *wn = (void *)tap->txa_ni;
3871 	struct iwn_tx_data *data;
3872 	uint64_t bitmap = 0;
3873 	uint16_t *aggstatus = stat;
3874 	uint8_t tid = tap->txa_tid;
3875 	int bit, i, idx, shift, start, tx_err;
3876 
3877 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3878 
3879 	start = le16toh(*(aggstatus + nframes * 2)) & 0xff;
3880 
3881 	for (i = 0; i < nframes; i++) {
3882 		uint16_t status = le16toh(aggstatus[i * 2]);
3883 
3884 		if (status & IWN_AGG_TX_STATE_IGNORE_MASK)
3885 			continue;
3886 
3887 		idx = le16toh(aggstatus[i * 2 + 1]) & 0xff;
3888 		data = &ring->data[idx];
3889 		if (data->remapped) {
3890 			idx = iwn_ampdu_index_check(sc, ring, bitmap, start, idx);
3891 			if (idx == -1) {
3892 				/* skip error (device will be restarted anyway). */
3893 				continue;
3894 			}
3895 
3896 			/* Index may have changed. */
3897 			data = &ring->data[idx];
3898 		}
3899 
3900 		/*
3901 		 * XXX Sometimes (rarely) some frames are excluded from events.
3902 		 * XXX Due to that long_retries counter may be wrong.
3903 		 */
3904 		data->long_retries &= ~0x0f;
3905 		data->long_retries += IWN_AGG_TX_TRY_COUNT(status) + 1;
3906 
3907 		if (data->long_retries >= IWN_LONG_RETRY_FW_OVERFLOW) {
3908 			int diff, wrong_idx;
3909 
3910 			diff = data->long_retries / IWN_LONG_RETRY_FW_OVERFLOW;
3911 			wrong_idx = (idx + diff) % IWN_TX_RING_COUNT;
3912 
3913 			/*
3914 			 * Mark the entry so the above code will check it
3915 			 * next time.
3916 			 */
3917 			ring->data[wrong_idx].remapped = 1;
3918 		}
3919 
3920 		if (status & IWN_AGG_TX_STATE_UNDERRUN_MSK) {
3921 			/*
3922 			 * NB: count retries but postpone - it was not
3923 			 * transmitted.
3924 			 */
3925 			continue;
3926 		}
3927 
3928 		bit = idx - start;
3929 		shift = 0;
3930 		if (bit >= 64) {
3931 			shift = 0x100 - bit;
3932 			bit = 0;
3933 		} else if (bit <= -64)
3934 			bit = 0x100 + bit;
3935 		else if (bit < 0) {
3936 			shift = -bit;
3937 			bit = 0;
3938 		}
3939 		bitmap = bitmap << shift;
3940 		bitmap |= 1ULL << bit;
3941 	}
3942 	wn->agg[tid].startidx = start;
3943 	wn->agg[tid].bitmap = bitmap;
3944 	wn->agg[tid].short_retries = rtsfailcnt;
3945 
3946 	DPRINTF(sc, IWN_DEBUG_AMPDU, "%s: nframes %d start %d bitmap %016jX\n",
3947 	    __func__, nframes, start, (uintmax_t)bitmap);
3948 
3949 	i = ring->read;
3950 
3951 	for (tx_err = 0;
3952 	     i != wn->agg[tid].startidx;
3953 	     i = (i + 1) % IWN_TX_RING_COUNT) {
3954 		data = &ring->data[i];
3955 		data->remapped = 0;
3956 		if (data->m == NULL)
3957 			continue;
3958 
3959 		tx_err++;
3960 		iwn_agg_tx_complete(sc, ring, tid, i, 0);
3961 	}
3962 
3963 	ring->read = wn->agg[tid].startidx;
3964 	ring->queued -= tx_err;
3965 
3966 	iwn_check_tx_ring(sc, qid);
3967 
3968 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3969 }
3970 
3971 /*
3972  * Process an INT_FH_RX or INT_SW_RX interrupt.
3973  */
3974 static void
3975 iwn_notif_intr(struct iwn_softc *sc)
3976 {
3977 	struct iwn_ops *ops = &sc->ops;
3978 	struct ieee80211com *ic = &sc->sc_ic;
3979 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3980 	uint16_t hw;
3981 	int is_stopped;
3982 
3983 	bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
3984 	    BUS_DMASYNC_POSTREAD);
3985 
3986 	hw = le16toh(sc->rxq.stat->closed_count) & 0xfff;
3987 	while (sc->rxq.cur != hw) {
3988 		struct iwn_rx_data *data = &sc->rxq.data[sc->rxq.cur];
3989 		struct iwn_rx_desc *desc;
3990 
3991 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3992 		    BUS_DMASYNC_POSTREAD);
3993 		desc = mtod(data->m, struct iwn_rx_desc *);
3994 
3995 		DPRINTF(sc, IWN_DEBUG_RECV,
3996 		    "%s: cur=%d; qid %x idx %d flags %x type %d(%s) len %d\n",
3997 		    __func__, sc->rxq.cur, desc->qid & IWN_RX_DESC_QID_MSK,
3998 		    desc->idx, desc->flags, desc->type,
3999 		    iwn_intr_str(desc->type), le16toh(desc->len));
4000 
4001 		if (!(desc->qid & IWN_UNSOLICITED_RX_NOTIF))	/* Reply to a command. */
4002 			iwn_cmd_done(sc, desc);
4003 
4004 		switch (desc->type) {
4005 		case IWN_RX_PHY:
4006 			iwn_rx_phy(sc, desc);
4007 			break;
4008 
4009 		case IWN_RX_DONE:		/* 4965AGN only. */
4010 		case IWN_MPDU_RX_DONE:
4011 			/* An 802.11 frame has been received. */
4012 			iwn_rx_done(sc, desc, data);
4013 
4014 			is_stopped = (sc->sc_flags & IWN_FLAG_RUNNING) == 0;
4015 			if (__predict_false(is_stopped))
4016 				return;
4017 
4018 			break;
4019 
4020 		case IWN_RX_COMPRESSED_BA:
4021 			/* A Compressed BlockAck has been received. */
4022 			iwn_rx_compressed_ba(sc, desc);
4023 			break;
4024 
4025 		case IWN_TX_DONE:
4026 			/* An 802.11 frame has been transmitted. */
4027 			ops->tx_done(sc, desc, data);
4028 			break;
4029 
4030 		case IWN_RX_STATISTICS:
4031 		case IWN_BEACON_STATISTICS:
4032 			iwn_rx_statistics(sc, desc);
4033 			break;
4034 
4035 		case IWN_BEACON_MISSED:
4036 		{
4037 			struct iwn_beacon_missed *miss =
4038 			    (struct iwn_beacon_missed *)(desc + 1);
4039 			int misses;
4040 
4041 			misses = le32toh(miss->consecutive);
4042 
4043 			DPRINTF(sc, IWN_DEBUG_STATE,
4044 			    "%s: beacons missed %d/%d\n", __func__,
4045 			    misses, le32toh(miss->total));
4046 			/*
4047 			 * If more than 5 consecutive beacons are missed,
4048 			 * reinitialize the sensitivity state machine.
4049 			 */
4050 			if (vap->iv_state == IEEE80211_S_RUN &&
4051 			    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
4052 				if (misses > 5)
4053 					(void)iwn_init_sensitivity(sc);
4054 				if (misses >= vap->iv_bmissthreshold) {
4055 					IWN_UNLOCK(sc);
4056 					ieee80211_beacon_miss(ic);
4057 					IWN_LOCK(sc);
4058 
4059 					is_stopped = (sc->sc_flags &
4060 					    IWN_FLAG_RUNNING) == 0;
4061 					if (__predict_false(is_stopped))
4062 						return;
4063 				}
4064 			}
4065 			break;
4066 		}
4067 		case IWN_UC_READY:
4068 		{
4069 			struct iwn_ucode_info *uc =
4070 			    (struct iwn_ucode_info *)(desc + 1);
4071 
4072 			/* The microcontroller is ready. */
4073 			DPRINTF(sc, IWN_DEBUG_RESET,
4074 			    "microcode alive notification version=%d.%d "
4075 			    "subtype=%x alive=%x\n", uc->major, uc->minor,
4076 			    uc->subtype, le32toh(uc->valid));
4077 
4078 			if (le32toh(uc->valid) != 1) {
4079 				device_printf(sc->sc_dev,
4080 				    "microcontroller initialization failed");
4081 				break;
4082 			}
4083 			if (uc->subtype == IWN_UCODE_INIT) {
4084 				/* Save microcontroller report. */
4085 				memcpy(&sc->ucode_info, uc, sizeof (*uc));
4086 			}
4087 			/* Save the address of the error log in SRAM. */
4088 			sc->errptr = le32toh(uc->errptr);
4089 			break;
4090 		}
4091 #ifdef IWN_DEBUG
4092 		case IWN_STATE_CHANGED:
4093 		{
4094 			/*
4095 			 * State change allows hardware switch change to be
4096 			 * noted. However, we handle this in iwn_intr as we
4097 			 * get both the enable/disble intr.
4098 			 */
4099 			uint32_t *status = (uint32_t *)(desc + 1);
4100 			DPRINTF(sc, IWN_DEBUG_INTR | IWN_DEBUG_STATE,
4101 			    "state changed to %x\n",
4102 			    le32toh(*status));
4103 			break;
4104 		}
4105 		case IWN_START_SCAN:
4106 		{
4107 			struct iwn_start_scan *scan =
4108 			    (struct iwn_start_scan *)(desc + 1);
4109 			DPRINTF(sc, IWN_DEBUG_ANY,
4110 			    "%s: scanning channel %d status %x\n",
4111 			    __func__, scan->chan, le32toh(scan->status));
4112 			break;
4113 		}
4114 #endif
4115 		case IWN_STOP_SCAN:
4116 		{
4117 #ifdef	IWN_DEBUG
4118 			struct iwn_stop_scan *scan =
4119 			    (struct iwn_stop_scan *)(desc + 1);
4120 			DPRINTF(sc, IWN_DEBUG_STATE | IWN_DEBUG_SCAN,
4121 			    "scan finished nchan=%d status=%d chan=%d\n",
4122 			    scan->nchan, scan->status, scan->chan);
4123 #endif
4124 			sc->sc_is_scanning = 0;
4125 			callout_stop(&sc->scan_timeout);
4126 			IWN_UNLOCK(sc);
4127 			ieee80211_scan_next(vap);
4128 			IWN_LOCK(sc);
4129 
4130 			is_stopped = (sc->sc_flags & IWN_FLAG_RUNNING) == 0;
4131 			if (__predict_false(is_stopped))
4132 				return;
4133 
4134 			break;
4135 		}
4136 		case IWN5000_CALIBRATION_RESULT:
4137 			iwn5000_rx_calib_results(sc, desc);
4138 			break;
4139 
4140 		case IWN5000_CALIBRATION_DONE:
4141 			sc->sc_flags |= IWN_FLAG_CALIB_DONE;
4142 			wakeup(sc);
4143 			break;
4144 		}
4145 
4146 		sc->rxq.cur = (sc->rxq.cur + 1) % IWN_RX_RING_COUNT;
4147 	}
4148 
4149 	/* Tell the firmware what we have processed. */
4150 	hw = (hw == 0) ? IWN_RX_RING_COUNT - 1 : hw - 1;
4151 	IWN_WRITE(sc, IWN_FH_RX_WPTR, hw & ~7);
4152 }
4153 
4154 /*
4155  * Process an INT_WAKEUP interrupt raised when the microcontroller wakes up
4156  * from power-down sleep mode.
4157  */
4158 static void
4159 iwn_wakeup_intr(struct iwn_softc *sc)
4160 {
4161 	int qid;
4162 
4163 	DPRINTF(sc, IWN_DEBUG_RESET, "%s: ucode wakeup from power-down sleep\n",
4164 	    __func__);
4165 
4166 	/* Wakeup RX and TX rings. */
4167 	IWN_WRITE(sc, IWN_FH_RX_WPTR, sc->rxq.cur & ~7);
4168 	for (qid = 0; qid < sc->ntxqs; qid++) {
4169 		struct iwn_tx_ring *ring = &sc->txq[qid];
4170 		IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | ring->cur);
4171 	}
4172 }
4173 
4174 static void
4175 iwn_rftoggle_task(void *arg, int npending)
4176 {
4177 	struct iwn_softc *sc = arg;
4178 	struct ieee80211com *ic = &sc->sc_ic;
4179 	uint32_t tmp;
4180 
4181 	IWN_LOCK(sc);
4182 	tmp = IWN_READ(sc, IWN_GP_CNTRL);
4183 	IWN_UNLOCK(sc);
4184 
4185 	device_printf(sc->sc_dev, "RF switch: radio %s\n",
4186 	    (tmp & IWN_GP_CNTRL_RFKILL) ? "enabled" : "disabled");
4187 	if (!(tmp & IWN_GP_CNTRL_RFKILL)) {
4188 		ieee80211_suspend_all(ic);
4189 
4190 		/* Enable interrupts to get RF toggle notification. */
4191 		IWN_LOCK(sc);
4192 		IWN_WRITE(sc, IWN_INT, 0xffffffff);
4193 		IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
4194 		IWN_UNLOCK(sc);
4195 	} else
4196 		ieee80211_resume_all(ic);
4197 }
4198 
4199 /*
4200  * Dump the error log of the firmware when a firmware panic occurs.  Although
4201  * we can't debug the firmware because it is neither open source nor free, it
4202  * can help us to identify certain classes of problems.
4203  */
4204 static void
4205 iwn_fatal_intr(struct iwn_softc *sc)
4206 {
4207 	struct iwn_fw_dump dump;
4208 	int i;
4209 
4210 	IWN_LOCK_ASSERT(sc);
4211 
4212 	/* Force a complete recalibration on next init. */
4213 	sc->sc_flags &= ~IWN_FLAG_CALIB_DONE;
4214 
4215 	/* Check that the error log address is valid. */
4216 	if (sc->errptr < IWN_FW_DATA_BASE ||
4217 	    sc->errptr + sizeof (dump) >
4218 	    IWN_FW_DATA_BASE + sc->fw_data_maxsz) {
4219 		printf("%s: bad firmware error log address 0x%08x\n", __func__,
4220 		    sc->errptr);
4221 		return;
4222 	}
4223 	if (iwn_nic_lock(sc) != 0) {
4224 		printf("%s: could not read firmware error log\n", __func__);
4225 		return;
4226 	}
4227 	/* Read firmware error log from SRAM. */
4228 	iwn_mem_read_region_4(sc, sc->errptr, (uint32_t *)&dump,
4229 	    sizeof (dump) / sizeof (uint32_t));
4230 	iwn_nic_unlock(sc);
4231 
4232 	if (dump.valid == 0) {
4233 		printf("%s: firmware error log is empty\n", __func__);
4234 		return;
4235 	}
4236 	printf("firmware error log:\n");
4237 	printf("  error type      = \"%s\" (0x%08X)\n",
4238 	    (dump.id < nitems(iwn_fw_errmsg)) ?
4239 		iwn_fw_errmsg[dump.id] : "UNKNOWN",
4240 	    dump.id);
4241 	printf("  program counter = 0x%08X\n", dump.pc);
4242 	printf("  source line     = 0x%08X\n", dump.src_line);
4243 	printf("  error data      = 0x%08X%08X\n",
4244 	    dump.error_data[0], dump.error_data[1]);
4245 	printf("  branch link     = 0x%08X%08X\n",
4246 	    dump.branch_link[0], dump.branch_link[1]);
4247 	printf("  interrupt link  = 0x%08X%08X\n",
4248 	    dump.interrupt_link[0], dump.interrupt_link[1]);
4249 	printf("  time            = %u\n", dump.time[0]);
4250 
4251 	/* Dump driver status (TX and RX rings) while we're here. */
4252 	printf("driver status:\n");
4253 	for (i = 0; i < sc->ntxqs; i++) {
4254 		struct iwn_tx_ring *ring = &sc->txq[i];
4255 		printf("  tx ring %2d: qid=%-2d cur=%-3d queued=%-3d\n",
4256 		    i, ring->qid, ring->cur, ring->queued);
4257 	}
4258 	printf("  rx ring: cur=%d\n", sc->rxq.cur);
4259 }
4260 
4261 static void
4262 iwn_intr(void *arg)
4263 {
4264 	struct iwn_softc *sc = arg;
4265 	uint32_t r1, r2, tmp;
4266 
4267 	IWN_LOCK(sc);
4268 
4269 	/* Disable interrupts. */
4270 	IWN_WRITE(sc, IWN_INT_MASK, 0);
4271 
4272 	/* Read interrupts from ICT (fast) or from registers (slow). */
4273 	if (sc->sc_flags & IWN_FLAG_USE_ICT) {
4274 		bus_dmamap_sync(sc->ict_dma.tag, sc->ict_dma.map,
4275 		    BUS_DMASYNC_POSTREAD);
4276 		tmp = 0;
4277 		while (sc->ict[sc->ict_cur] != 0) {
4278 			tmp |= sc->ict[sc->ict_cur];
4279 			sc->ict[sc->ict_cur] = 0;	/* Acknowledge. */
4280 			sc->ict_cur = (sc->ict_cur + 1) % IWN_ICT_COUNT;
4281 		}
4282 		tmp = le32toh(tmp);
4283 		if (tmp == 0xffffffff)	/* Shouldn't happen. */
4284 			tmp = 0;
4285 		else if (tmp & 0xc0000)	/* Workaround a HW bug. */
4286 			tmp |= 0x8000;
4287 		r1 = (tmp & 0xff00) << 16 | (tmp & 0xff);
4288 		r2 = 0;	/* Unused. */
4289 	} else {
4290 		r1 = IWN_READ(sc, IWN_INT);
4291 		if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0) {
4292 			IWN_UNLOCK(sc);
4293 			return;	/* Hardware gone! */
4294 		}
4295 		r2 = IWN_READ(sc, IWN_FH_INT);
4296 	}
4297 
4298 	DPRINTF(sc, IWN_DEBUG_INTR, "interrupt reg1=0x%08x reg2=0x%08x\n"
4299     , r1, r2);
4300 
4301 	if (r1 == 0 && r2 == 0)
4302 		goto done;	/* Interrupt not for us. */
4303 
4304 	/* Acknowledge interrupts. */
4305 	IWN_WRITE(sc, IWN_INT, r1);
4306 	if (!(sc->sc_flags & IWN_FLAG_USE_ICT))
4307 		IWN_WRITE(sc, IWN_FH_INT, r2);
4308 
4309 	if (r1 & IWN_INT_RF_TOGGLED) {
4310 		taskqueue_enqueue(sc->sc_tq, &sc->sc_rftoggle_task);
4311 		goto done;
4312 	}
4313 	if (r1 & IWN_INT_CT_REACHED) {
4314 		device_printf(sc->sc_dev, "%s: critical temperature reached!\n",
4315 		    __func__);
4316 	}
4317 	if (r1 & (IWN_INT_SW_ERR | IWN_INT_HW_ERR)) {
4318 		device_printf(sc->sc_dev, "%s: fatal firmware error\n",
4319 		    __func__);
4320 #ifdef	IWN_DEBUG
4321 		iwn_debug_register(sc);
4322 #endif
4323 		/* Dump firmware error log and stop. */
4324 		iwn_fatal_intr(sc);
4325 
4326 		taskqueue_enqueue(sc->sc_tq, &sc->sc_panic_task);
4327 		goto done;
4328 	}
4329 	if ((r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX | IWN_INT_RX_PERIODIC)) ||
4330 	    (r2 & IWN_FH_INT_RX)) {
4331 		if (sc->sc_flags & IWN_FLAG_USE_ICT) {
4332 			if (r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX))
4333 				IWN_WRITE(sc, IWN_FH_INT, IWN_FH_INT_RX);
4334 			IWN_WRITE_1(sc, IWN_INT_PERIODIC,
4335 			    IWN_INT_PERIODIC_DIS);
4336 			iwn_notif_intr(sc);
4337 			if (r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX)) {
4338 				IWN_WRITE_1(sc, IWN_INT_PERIODIC,
4339 				    IWN_INT_PERIODIC_ENA);
4340 			}
4341 		} else
4342 			iwn_notif_intr(sc);
4343 	}
4344 
4345 	if ((r1 & IWN_INT_FH_TX) || (r2 & IWN_FH_INT_TX)) {
4346 		if (sc->sc_flags & IWN_FLAG_USE_ICT)
4347 			IWN_WRITE(sc, IWN_FH_INT, IWN_FH_INT_TX);
4348 		wakeup(sc);	/* FH DMA transfer completed. */
4349 	}
4350 
4351 	if (r1 & IWN_INT_ALIVE)
4352 		wakeup(sc);	/* Firmware is alive. */
4353 
4354 	if (r1 & IWN_INT_WAKEUP)
4355 		iwn_wakeup_intr(sc);
4356 
4357 done:
4358 	/* Re-enable interrupts. */
4359 	if (sc->sc_flags & IWN_FLAG_RUNNING)
4360 		IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
4361 
4362 	IWN_UNLOCK(sc);
4363 }
4364 
4365 /*
4366  * Update TX scheduler ring when transmitting an 802.11 frame (4965AGN and
4367  * 5000 adapters use a slightly different format).
4368  */
4369 static void
4370 iwn4965_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
4371     uint16_t len)
4372 {
4373 	uint16_t *w = &sc->sched[qid * IWN4965_SCHED_COUNT + idx];
4374 
4375 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4376 
4377 	*w = htole16(len + 8);
4378 	bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4379 	    BUS_DMASYNC_PREWRITE);
4380 	if (idx < IWN_SCHED_WINSZ) {
4381 		*(w + IWN_TX_RING_COUNT) = *w;
4382 		bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4383 		    BUS_DMASYNC_PREWRITE);
4384 	}
4385 }
4386 
4387 static void
4388 iwn5000_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
4389     uint16_t len)
4390 {
4391 	uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
4392 
4393 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4394 
4395 	*w = htole16(id << 12 | (len + 8));
4396 	bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4397 	    BUS_DMASYNC_PREWRITE);
4398 	if (idx < IWN_SCHED_WINSZ) {
4399 		*(w + IWN_TX_RING_COUNT) = *w;
4400 		bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4401 		    BUS_DMASYNC_PREWRITE);
4402 	}
4403 }
4404 
4405 #ifdef notyet
4406 static void
4407 iwn5000_reset_sched(struct iwn_softc *sc, int qid, int idx)
4408 {
4409 	uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
4410 
4411 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4412 
4413 	*w = (*w & htole16(0xf000)) | htole16(1);
4414 	bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4415 	    BUS_DMASYNC_PREWRITE);
4416 	if (idx < IWN_SCHED_WINSZ) {
4417 		*(w + IWN_TX_RING_COUNT) = *w;
4418 		bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4419 		    BUS_DMASYNC_PREWRITE);
4420 	}
4421 }
4422 #endif
4423 
4424 /*
4425  * Check whether OFDM 11g protection will be enabled for the given rate.
4426  *
4427  * The original driver code only enabled protection for OFDM rates.
4428  * It didn't check to see whether it was operating in 11a or 11bg mode.
4429  */
4430 static int
4431 iwn_check_rate_needs_protection(struct iwn_softc *sc,
4432     struct ieee80211vap *vap, uint8_t rate)
4433 {
4434 	struct ieee80211com *ic = vap->iv_ic;
4435 
4436 	/*
4437 	 * Not in 2GHz mode? Then there's no need to enable OFDM
4438 	 * 11bg protection.
4439 	 */
4440 	if (! IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
4441 		return (0);
4442 	}
4443 
4444 	/*
4445 	 * 11bg protection not enabled? Then don't use it.
4446 	 */
4447 	if ((vap->iv_flags & IEEE80211_F_USEPROT) == 0)
4448 		return (0);
4449 
4450 	/*
4451 	 * If it's an 11n rate - no protection.
4452 	 * We'll do it via a specific 11n check.
4453 	 */
4454 	if (rate & IEEE80211_RATE_MCS) {
4455 		return (0);
4456 	}
4457 
4458 	/*
4459 	 * Do a rate table lookup.  If the PHY is CCK,
4460 	 * don't do protection.
4461 	 */
4462 	if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_CCK)
4463 		return (0);
4464 
4465 	/*
4466 	 * Yup, enable protection.
4467 	 */
4468 	return (1);
4469 }
4470 
4471 /*
4472  * return a value between 0 and IWN_MAX_TX_RETRIES-1 as an index into
4473  * the link quality table that reflects this particular entry.
4474  */
4475 static int
4476 iwn_tx_rate_to_linkq_offset(struct iwn_softc *sc, struct ieee80211_node *ni,
4477     uint8_t rate)
4478 {
4479 	struct ieee80211_rateset *rs;
4480 	int is_11n;
4481 	int nr;
4482 	int i;
4483 	uint8_t cmp_rate;
4484 
4485 	/*
4486 	 * Figure out if we're using 11n or not here.
4487 	 */
4488 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && ni->ni_htrates.rs_nrates > 0)
4489 		is_11n = 1;
4490 	else
4491 		is_11n = 0;
4492 
4493 	/*
4494 	 * Use the correct rate table.
4495 	 */
4496 	if (is_11n) {
4497 		rs = (struct ieee80211_rateset *) &ni->ni_htrates;
4498 		nr = ni->ni_htrates.rs_nrates;
4499 	} else {
4500 		rs = &ni->ni_rates;
4501 		nr = rs->rs_nrates;
4502 	}
4503 
4504 	/*
4505 	 * Find the relevant link quality entry in the table.
4506 	 */
4507 	for (i = 0; i < nr && i < IWN_MAX_TX_RETRIES - 1 ; i++) {
4508 		/*
4509 		 * The link quality table index starts at 0 == highest
4510 		 * rate, so we walk the rate table backwards.
4511 		 */
4512 		cmp_rate = rs->rs_rates[(nr - 1) - i];
4513 		if (rate & IEEE80211_RATE_MCS)
4514 			cmp_rate |= IEEE80211_RATE_MCS;
4515 
4516 #if 0
4517 		DPRINTF(sc, IWN_DEBUG_XMIT, "%s: idx %d: nr=%d, rate=0x%02x, rateentry=0x%02x\n",
4518 		    __func__,
4519 		    i,
4520 		    nr,
4521 		    rate,
4522 		    cmp_rate);
4523 #endif
4524 
4525 		if (cmp_rate == rate)
4526 			return (i);
4527 	}
4528 
4529 	/* Failed? Start at the end */
4530 	return (IWN_MAX_TX_RETRIES - 1);
4531 }
4532 
4533 static int
4534 iwn_tx_data(struct iwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
4535 {
4536 	const struct ieee80211_txparam *tp = ni->ni_txparms;
4537 	struct ieee80211vap *vap = ni->ni_vap;
4538 	struct ieee80211com *ic = ni->ni_ic;
4539 	struct iwn_node *wn = (void *)ni;
4540 	struct iwn_tx_ring *ring;
4541 	struct iwn_tx_cmd *cmd;
4542 	struct iwn_cmd_data *tx;
4543 	struct ieee80211_frame *wh;
4544 	struct ieee80211_key *k = NULL;
4545 	uint32_t flags;
4546 	uint16_t qos;
4547 	uint8_t tid, type;
4548 	int ac, totlen, rate;
4549 
4550 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
4551 
4552 	IWN_LOCK_ASSERT(sc);
4553 
4554 	wh = mtod(m, struct ieee80211_frame *);
4555 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
4556 
4557 	/* Select EDCA Access Category and TX ring for this frame. */
4558 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
4559 		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
4560 		tid = qos & IEEE80211_QOS_TID;
4561 	} else {
4562 		qos = 0;
4563 		tid = 0;
4564 	}
4565 
4566 	/* Choose a TX rate index. */
4567 	if (type == IEEE80211_FC0_TYPE_MGT ||
4568 	    type == IEEE80211_FC0_TYPE_CTL ||
4569 	    (m->m_flags & M_EAPOL) != 0)
4570 		rate = tp->mgmtrate;
4571 	else if (IEEE80211_IS_MULTICAST(wh->i_addr1))
4572 		rate = tp->mcastrate;
4573 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
4574 		rate = tp->ucastrate;
4575 	else {
4576 		/* XXX pass pktlen */
4577 		(void) ieee80211_ratectl_rate(ni, NULL, 0);
4578 		rate = ni->ni_txrate;
4579 	}
4580 
4581 	/*
4582 	 * XXX TODO: Group addressed frames aren't aggregated and must
4583 	 * go to the normal non-aggregation queue, and have a NONQOS TID
4584 	 * assigned from net80211.
4585 	 */
4586 
4587 	ac = M_WME_GETAC(m);
4588 	if (m->m_flags & M_AMPDU_MPDU) {
4589 		struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[ac];
4590 
4591 		if (!IEEE80211_AMPDU_RUNNING(tap))
4592 			return (EINVAL);
4593 
4594 		ac = *(int *)tap->txa_private;
4595 	}
4596 
4597 	/* Encrypt the frame if need be. */
4598 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
4599 		/* Retrieve key for TX. */
4600 		k = ieee80211_crypto_encap(ni, m);
4601 		if (k == NULL) {
4602 			return ENOBUFS;
4603 		}
4604 		/* 802.11 header may have moved. */
4605 		wh = mtod(m, struct ieee80211_frame *);
4606 	}
4607 	totlen = m->m_pkthdr.len;
4608 
4609 	if (ieee80211_radiotap_active_vap(vap)) {
4610 		struct iwn_tx_radiotap_header *tap = &sc->sc_txtap;
4611 
4612 		tap->wt_flags = 0;
4613 		tap->wt_rate = rate;
4614 		if (k != NULL)
4615 			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
4616 
4617 		ieee80211_radiotap_tx(vap, m);
4618 	}
4619 
4620 	flags = 0;
4621 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
4622 		/* Unicast frame, check if an ACK is expected. */
4623 		if (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
4624 		    IEEE80211_QOS_ACKPOLICY_NOACK)
4625 			flags |= IWN_TX_NEED_ACK;
4626 	}
4627 	if (IEEE80211_IS_CTL_BAR(wh))
4628 		flags |= IWN_TX_IMM_BA;		/* Cannot happen yet. */
4629 
4630 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
4631 		flags |= IWN_TX_MORE_FRAG;	/* Cannot happen yet. */
4632 
4633 	/* Check if frame must be protected using RTS/CTS or CTS-to-self. */
4634 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
4635 		/* NB: Group frames are sent using CCK in 802.11b/g. */
4636 		if (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold) {
4637 			flags |= IWN_TX_NEED_RTS;
4638 		} else if (iwn_check_rate_needs_protection(sc, vap, rate)) {
4639 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
4640 				flags |= IWN_TX_NEED_CTS;
4641 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
4642 				flags |= IWN_TX_NEED_RTS;
4643 		} else if ((rate & IEEE80211_RATE_MCS) &&
4644 			(ic->ic_htprotmode == IEEE80211_PROT_RTSCTS)) {
4645 			flags |= IWN_TX_NEED_RTS;
4646 		}
4647 
4648 		/* XXX HT protection? */
4649 
4650 		if (flags & (IWN_TX_NEED_RTS | IWN_TX_NEED_CTS)) {
4651 			if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
4652 				/* 5000 autoselects RTS/CTS or CTS-to-self. */
4653 				flags &= ~(IWN_TX_NEED_RTS | IWN_TX_NEED_CTS);
4654 				flags |= IWN_TX_NEED_PROTECTION;
4655 			} else
4656 				flags |= IWN_TX_FULL_TXOP;
4657 		}
4658 	}
4659 
4660 	ring = &sc->txq[ac];
4661 	if (m->m_flags & M_AMPDU_MPDU) {
4662 		uint16_t seqno = ni->ni_txseqs[tid];
4663 
4664 		if (ring->queued > IWN_TX_RING_COUNT / 2 &&
4665 		    (ring->cur + 1) % IWN_TX_RING_COUNT == ring->read) {
4666 			DPRINTF(sc, IWN_DEBUG_AMPDU, "%s: no more space "
4667 			    "(queued %d) left in %d queue!\n",
4668 			    __func__, ring->queued, ac);
4669 			return (ENOBUFS);
4670 		}
4671 
4672 		/*
4673 		 * Queue this frame to the hardware ring that we've
4674 		 * negotiated AMPDU TX on.
4675 		 *
4676 		 * Note that the sequence number must match the TX slot
4677 		 * being used!
4678 		 */
4679 		if ((seqno % 256) != ring->cur) {
4680 			device_printf(sc->sc_dev,
4681 			    "%s: m=%p: seqno (%d) (%d) != ring index (%d) !\n",
4682 			    __func__,
4683 			    m,
4684 			    seqno,
4685 			    seqno % 256,
4686 			    ring->cur);
4687 
4688 			/* XXX until D9195 will not be committed */
4689 			ni->ni_txseqs[tid] &= ~0xff;
4690 			ni->ni_txseqs[tid] += ring->cur;
4691 			seqno = ni->ni_txseqs[tid];
4692 		}
4693 
4694 		*(uint16_t *)wh->i_seq =
4695 		    htole16(seqno << IEEE80211_SEQ_SEQ_SHIFT);
4696 		ni->ni_txseqs[tid]++;
4697 	}
4698 
4699 	/* Prepare TX firmware command. */
4700 	cmd = &ring->cmd[ring->cur];
4701 	tx = (struct iwn_cmd_data *)cmd->data;
4702 
4703 	/* NB: No need to clear tx, all fields are reinitialized here. */
4704 	tx->scratch = 0;	/* clear "scratch" area */
4705 
4706 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
4707 	    type != IEEE80211_FC0_TYPE_DATA)
4708 		tx->id = sc->broadcast_id;
4709 	else
4710 		tx->id = wn->id;
4711 
4712 	if (type == IEEE80211_FC0_TYPE_MGT) {
4713 		uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
4714 
4715 		/* Tell HW to set timestamp in probe responses. */
4716 		if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
4717 			flags |= IWN_TX_INSERT_TSTAMP;
4718 		if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
4719 		    subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
4720 			tx->timeout = htole16(3);
4721 		else
4722 			tx->timeout = htole16(2);
4723 	} else
4724 		tx->timeout = htole16(0);
4725 
4726 	if (tx->id == sc->broadcast_id) {
4727 		/* Group or management frame. */
4728 		tx->linkq = 0;
4729 	} else {
4730 		tx->linkq = iwn_tx_rate_to_linkq_offset(sc, ni, rate);
4731 		flags |= IWN_TX_LINKQ;	/* enable MRR */
4732 	}
4733 
4734 	tx->tid = tid;
4735 	tx->rts_ntries = 60;
4736 	tx->data_ntries = 15;
4737 	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
4738 	tx->rate = iwn_rate_to_plcp(sc, ni, rate);
4739 	tx->security = 0;
4740 	tx->flags = htole32(flags);
4741 
4742 	return (iwn_tx_cmd(sc, m, ni, ring));
4743 }
4744 
4745 static int
4746 iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m,
4747     struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
4748 {
4749 	struct ieee80211vap *vap = ni->ni_vap;
4750 	struct iwn_tx_cmd *cmd;
4751 	struct iwn_cmd_data *tx;
4752 	struct ieee80211_frame *wh;
4753 	struct iwn_tx_ring *ring;
4754 	uint32_t flags;
4755 	int ac, rate;
4756 	uint8_t type;
4757 
4758 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
4759 
4760 	IWN_LOCK_ASSERT(sc);
4761 
4762 	wh = mtod(m, struct ieee80211_frame *);
4763 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
4764 
4765 	ac = params->ibp_pri & 3;
4766 
4767 	/* Choose a TX rate. */
4768 	rate = params->ibp_rate0;
4769 
4770 	flags = 0;
4771 	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
4772 		flags |= IWN_TX_NEED_ACK;
4773 	if (params->ibp_flags & IEEE80211_BPF_RTS) {
4774 		if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
4775 			/* 5000 autoselects RTS/CTS or CTS-to-self. */
4776 			flags &= ~IWN_TX_NEED_RTS;
4777 			flags |= IWN_TX_NEED_PROTECTION;
4778 		} else
4779 			flags |= IWN_TX_NEED_RTS | IWN_TX_FULL_TXOP;
4780 	}
4781 	if (params->ibp_flags & IEEE80211_BPF_CTS) {
4782 		if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
4783 			/* 5000 autoselects RTS/CTS or CTS-to-self. */
4784 			flags &= ~IWN_TX_NEED_CTS;
4785 			flags |= IWN_TX_NEED_PROTECTION;
4786 		} else
4787 			flags |= IWN_TX_NEED_CTS | IWN_TX_FULL_TXOP;
4788 	}
4789 
4790 	if (ieee80211_radiotap_active_vap(vap)) {
4791 		struct iwn_tx_radiotap_header *tap = &sc->sc_txtap;
4792 
4793 		tap->wt_flags = 0;
4794 		tap->wt_rate = rate;
4795 
4796 		ieee80211_radiotap_tx(vap, m);
4797 	}
4798 
4799 	ring = &sc->txq[ac];
4800 	cmd = &ring->cmd[ring->cur];
4801 
4802 	tx = (struct iwn_cmd_data *)cmd->data;
4803 	/* NB: No need to clear tx, all fields are reinitialized here. */
4804 	tx->scratch = 0;	/* clear "scratch" area */
4805 
4806 	if (type == IEEE80211_FC0_TYPE_MGT) {
4807 		uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
4808 
4809 		/* Tell HW to set timestamp in probe responses. */
4810 		if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
4811 			flags |= IWN_TX_INSERT_TSTAMP;
4812 
4813 		if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
4814 		    subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
4815 			tx->timeout = htole16(3);
4816 		else
4817 			tx->timeout = htole16(2);
4818 	} else
4819 		tx->timeout = htole16(0);
4820 
4821 	tx->tid = 0;
4822 	tx->id = sc->broadcast_id;
4823 	tx->rts_ntries = params->ibp_try1;
4824 	tx->data_ntries = params->ibp_try0;
4825 	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
4826 	tx->rate = iwn_rate_to_plcp(sc, ni, rate);
4827 	tx->security = 0;
4828 	tx->flags = htole32(flags);
4829 
4830 	/* Group or management frame. */
4831 	tx->linkq = 0;
4832 
4833 	return (iwn_tx_cmd(sc, m, ni, ring));
4834 }
4835 
4836 static int
4837 iwn_tx_cmd(struct iwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
4838     struct iwn_tx_ring *ring)
4839 {
4840 	struct iwn_ops *ops = &sc->ops;
4841 	struct iwn_tx_cmd *cmd;
4842 	struct iwn_cmd_data *tx;
4843 	struct ieee80211_frame *wh;
4844 	struct iwn_tx_desc *desc;
4845 	struct iwn_tx_data *data;
4846 	bus_dma_segment_t *seg, segs[IWN_MAX_SCATTER];
4847 	struct mbuf *m1;
4848 	u_int hdrlen;
4849 	int totlen, error, pad, nsegs = 0, i;
4850 
4851 	wh = mtod(m, struct ieee80211_frame *);
4852 	hdrlen = ieee80211_anyhdrsize(wh);
4853 	totlen = m->m_pkthdr.len;
4854 
4855 	desc = &ring->desc[ring->cur];
4856 	data = &ring->data[ring->cur];
4857 
4858 	if (__predict_false(data->m != NULL || data->ni != NULL)) {
4859 		device_printf(sc->sc_dev, "%s: ni (%p) or m (%p) for idx %d "
4860 		    "in queue %d is not NULL!\n", __func__, data->ni, data->m,
4861 		    ring->cur, ring->qid);
4862 		return EIO;
4863 	}
4864 
4865 	/* Prepare TX firmware command. */
4866 	cmd = &ring->cmd[ring->cur];
4867 	cmd->code = IWN_CMD_TX_DATA;
4868 	cmd->flags = 0;
4869 	cmd->qid = ring->qid;
4870 	cmd->idx = ring->cur;
4871 
4872 	tx = (struct iwn_cmd_data *)cmd->data;
4873 	tx->len = htole16(totlen);
4874 
4875 	/* Set physical address of "scratch area". */
4876 	tx->loaddr = htole32(IWN_LOADDR(data->scratch_paddr));
4877 	tx->hiaddr = IWN_HIADDR(data->scratch_paddr);
4878 	if (hdrlen & 3) {
4879 		/* First segment length must be a multiple of 4. */
4880 		tx->flags |= htole32(IWN_TX_NEED_PADDING);
4881 		pad = 4 - (hdrlen & 3);
4882 	} else
4883 		pad = 0;
4884 
4885 	/* Copy 802.11 header in TX command. */
4886 	memcpy((uint8_t *)(tx + 1), wh, hdrlen);
4887 
4888 	/* Trim 802.11 header. */
4889 	m_adj(m, hdrlen);
4890 
4891 	error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m, segs,
4892 	    &nsegs, BUS_DMA_NOWAIT);
4893 	if (error != 0) {
4894 		if (error != EFBIG) {
4895 			device_printf(sc->sc_dev,
4896 			    "%s: can't map mbuf (error %d)\n", __func__, error);
4897 			return error;
4898 		}
4899 		/* Too many DMA segments, linearize mbuf. */
4900 		m1 = m_collapse(m, M_NOWAIT, IWN_MAX_SCATTER - 1);
4901 		if (m1 == NULL) {
4902 			device_printf(sc->sc_dev,
4903 			    "%s: could not defrag mbuf\n", __func__);
4904 			return ENOBUFS;
4905 		}
4906 		m = m1;
4907 
4908 		error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
4909 		    segs, &nsegs, BUS_DMA_NOWAIT);
4910 		if (error != 0) {
4911 			/* XXX fix this */
4912 			/*
4913 			 * NB: Do not return error;
4914 			 * original mbuf does not exist anymore.
4915 			 */
4916 			device_printf(sc->sc_dev,
4917 			    "%s: can't map mbuf (error %d)\n",
4918 			    __func__, error);
4919 			if_inc_counter(ni->ni_vap->iv_ifp,
4920 			    IFCOUNTER_OERRORS, 1);
4921 			ieee80211_free_node(ni);
4922 			m_freem(m);
4923 			return 0;
4924 		}
4925 	}
4926 
4927 	data->m = m;
4928 	data->ni = ni;
4929 
4930 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: qid %d idx %d len %d nsegs %d "
4931 	    "plcp 0x%x\n",
4932 	    __func__, ring->qid, ring->cur, totlen, nsegs, tx->rate);
4933 
4934 	/* Fill TX descriptor. */
4935 	desc->nsegs = 1;
4936 	if (m->m_len != 0)
4937 		desc->nsegs += nsegs;
4938 	/* First DMA segment is used by the TX command. */
4939 	desc->segs[0].addr = htole32(IWN_LOADDR(data->cmd_paddr));
4940 	desc->segs[0].len  = htole16(IWN_HIADDR(data->cmd_paddr) |
4941 	    (4 + sizeof (*tx) + hdrlen + pad) << 4);
4942 	/* Other DMA segments are for data payload. */
4943 	seg = &segs[0];
4944 	for (i = 1; i <= nsegs; i++) {
4945 		desc->segs[i].addr = htole32(IWN_LOADDR(seg->ds_addr));
4946 		desc->segs[i].len  = htole16(IWN_HIADDR(seg->ds_addr) |
4947 		    seg->ds_len << 4);
4948 		seg++;
4949 	}
4950 
4951 	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
4952 	bus_dmamap_sync(ring->cmd_dma.tag, ring->cmd_dma.map,
4953 	    BUS_DMASYNC_PREWRITE);
4954 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
4955 	    BUS_DMASYNC_PREWRITE);
4956 
4957 	/* Update TX scheduler. */
4958 	if (ring->qid >= sc->firstaggqueue)
4959 		ops->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
4960 
4961 	/* Kick TX ring. */
4962 	ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
4963 	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
4964 
4965 	/* Mark TX ring as full if we reach a certain threshold. */
4966 	if (++ring->queued > IWN_TX_RING_HIMARK)
4967 		sc->qfullmsk |= 1 << ring->qid;
4968 
4969 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
4970 
4971 	return 0;
4972 }
4973 
4974 static void
4975 iwn_xmit_task(void *arg0, int pending)
4976 {
4977 	struct iwn_softc *sc = arg0;
4978 	struct ieee80211_node *ni;
4979 	struct mbuf *m;
4980 	int error;
4981 	struct ieee80211_bpf_params p;
4982 	int have_p;
4983 
4984 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: called\n", __func__);
4985 
4986 	IWN_LOCK(sc);
4987 	/*
4988 	 * Dequeue frames, attempt to transmit,
4989 	 * then disable beaconwait when we're done.
4990 	 */
4991 	while ((m = mbufq_dequeue(&sc->sc_xmit_queue)) != NULL) {
4992 		have_p = 0;
4993 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
4994 
4995 		/* Get xmit params if appropriate */
4996 		if (ieee80211_get_xmit_params(m, &p) == 0)
4997 			have_p = 1;
4998 
4999 		DPRINTF(sc, IWN_DEBUG_XMIT, "%s: m=%p, have_p=%d\n",
5000 		    __func__, m, have_p);
5001 
5002 		/* If we have xmit params, use them */
5003 		if (have_p)
5004 			error = iwn_tx_data_raw(sc, m, ni, &p);
5005 		else
5006 			error = iwn_tx_data(sc, m, ni);
5007 
5008 		if (error != 0) {
5009 			if_inc_counter(ni->ni_vap->iv_ifp,
5010 			    IFCOUNTER_OERRORS, 1);
5011 			ieee80211_free_node(ni);
5012 			m_freem(m);
5013 		}
5014 	}
5015 
5016 	sc->sc_beacon_wait = 0;
5017 	IWN_UNLOCK(sc);
5018 }
5019 
5020 /*
5021  * raw frame xmit - free node/reference if failed.
5022  */
5023 static int
5024 iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5025     const struct ieee80211_bpf_params *params)
5026 {
5027 	struct ieee80211com *ic = ni->ni_ic;
5028 	struct iwn_softc *sc = ic->ic_softc;
5029 	int error = 0;
5030 
5031 	DPRINTF(sc, IWN_DEBUG_XMIT | IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5032 
5033 	IWN_LOCK(sc);
5034 	if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0) {
5035 		m_freem(m);
5036 		IWN_UNLOCK(sc);
5037 		return (ENETDOWN);
5038 	}
5039 
5040 	/* queue frame if we have to */
5041 	if (sc->sc_beacon_wait) {
5042 		if (iwn_xmit_queue_enqueue(sc, m) != 0) {
5043 			m_freem(m);
5044 			IWN_UNLOCK(sc);
5045 			return (ENOBUFS);
5046 		}
5047 		/* Queued, so just return OK */
5048 		IWN_UNLOCK(sc);
5049 		return (0);
5050 	}
5051 
5052 	if (params == NULL) {
5053 		/*
5054 		 * Legacy path; interpret frame contents to decide
5055 		 * precisely how to send the frame.
5056 		 */
5057 		error = iwn_tx_data(sc, m, ni);
5058 	} else {
5059 		/*
5060 		 * Caller supplied explicit parameters to use in
5061 		 * sending the frame.
5062 		 */
5063 		error = iwn_tx_data_raw(sc, m, ni, params);
5064 	}
5065 	if (error == 0)
5066 		sc->sc_tx_timer = 5;
5067 	else
5068 		m_freem(m);
5069 
5070 	IWN_UNLOCK(sc);
5071 
5072 	DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_XMIT, "->%s: end\n",__func__);
5073 
5074 	return (error);
5075 }
5076 
5077 /*
5078  * transmit - don't free mbuf if failed; don't free node ref if failed.
5079  */
5080 static int
5081 iwn_transmit(struct ieee80211com *ic, struct mbuf *m)
5082 {
5083 	struct iwn_softc *sc = ic->ic_softc;
5084 	struct ieee80211_node *ni;
5085 	int error;
5086 
5087 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
5088 
5089 	IWN_LOCK(sc);
5090 	if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0 || sc->sc_beacon_wait) {
5091 		IWN_UNLOCK(sc);
5092 		return (ENXIO);
5093 	}
5094 
5095 	if (sc->qfullmsk) {
5096 		IWN_UNLOCK(sc);
5097 		return (ENOBUFS);
5098 	}
5099 
5100 	error = iwn_tx_data(sc, m, ni);
5101 	if (!error)
5102 		sc->sc_tx_timer = 5;
5103 	IWN_UNLOCK(sc);
5104 	return (error);
5105 }
5106 
5107 static void
5108 iwn_scan_timeout(void *arg)
5109 {
5110 	struct iwn_softc *sc = arg;
5111 	struct ieee80211com *ic = &sc->sc_ic;
5112 
5113 	ic_printf(ic, "scan timeout\n");
5114 	ieee80211_restart_all(ic);
5115 }
5116 
5117 static void
5118 iwn_watchdog(void *arg)
5119 {
5120 	struct iwn_softc *sc = arg;
5121 	struct ieee80211com *ic = &sc->sc_ic;
5122 
5123 	IWN_LOCK_ASSERT(sc);
5124 
5125 	KASSERT(sc->sc_flags & IWN_FLAG_RUNNING, ("not running"));
5126 
5127 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5128 
5129 	if (sc->sc_tx_timer > 0) {
5130 		if (--sc->sc_tx_timer == 0) {
5131 			ic_printf(ic, "device timeout\n");
5132 			ieee80211_restart_all(ic);
5133 			return;
5134 		}
5135 	}
5136 	callout_reset(&sc->watchdog_to, hz, iwn_watchdog, sc);
5137 }
5138 
5139 static int
5140 iwn_cdev_open(struct cdev *dev, int flags, int type, struct thread *td)
5141 {
5142 
5143 	return (0);
5144 }
5145 
5146 static int
5147 iwn_cdev_close(struct cdev *dev, int flags, int type, struct thread *td)
5148 {
5149 
5150 	return (0);
5151 }
5152 
5153 static int
5154 iwn_cdev_ioctl(struct cdev *dev, unsigned long cmd, caddr_t data, int fflag,
5155     struct thread *td)
5156 {
5157 	int rc;
5158 	struct iwn_softc *sc = dev->si_drv1;
5159 	struct iwn_ioctl_data *d;
5160 
5161 	rc = priv_check(td, PRIV_DRIVER);
5162 	if (rc != 0)
5163 		return (0);
5164 
5165 	switch (cmd) {
5166 	case SIOCGIWNSTATS:
5167 		d = (struct iwn_ioctl_data *) data;
5168 		IWN_LOCK(sc);
5169 		/* XXX validate permissions/memory/etc? */
5170 		rc = copyout(&sc->last_stat, d->dst_addr, sizeof(struct iwn_stats));
5171 		IWN_UNLOCK(sc);
5172 		break;
5173 	case SIOCZIWNSTATS:
5174 		IWN_LOCK(sc);
5175 		memset(&sc->last_stat, 0, sizeof(struct iwn_stats));
5176 		IWN_UNLOCK(sc);
5177 		break;
5178 	default:
5179 		rc = EINVAL;
5180 		break;
5181 	}
5182 	return (rc);
5183 }
5184 
5185 static int
5186 iwn_ioctl(struct ieee80211com *ic, u_long cmd, void *data)
5187 {
5188 
5189 	return (ENOTTY);
5190 }
5191 
5192 static void
5193 iwn_parent(struct ieee80211com *ic)
5194 {
5195 	struct iwn_softc *sc = ic->ic_softc;
5196 	struct ieee80211vap *vap;
5197 	int error;
5198 
5199 	if (ic->ic_nrunning > 0) {
5200 		error = iwn_init(sc);
5201 
5202 		switch (error) {
5203 		case 0:
5204 			ieee80211_start_all(ic);
5205 			break;
5206 		case 1:
5207 			/* radio is disabled via RFkill switch */
5208 			taskqueue_enqueue(sc->sc_tq, &sc->sc_rftoggle_task);
5209 			break;
5210 		default:
5211 			vap = TAILQ_FIRST(&ic->ic_vaps);
5212 			if (vap != NULL)
5213 				ieee80211_stop(vap);
5214 			break;
5215 		}
5216 	} else
5217 		iwn_stop(sc);
5218 }
5219 
5220 /*
5221  * Send a command to the firmware.
5222  */
5223 static int
5224 iwn_cmd(struct iwn_softc *sc, int code, const void *buf, int size, int async)
5225 {
5226 	struct iwn_tx_ring *ring;
5227 	struct iwn_tx_desc *desc;
5228 	struct iwn_tx_data *data;
5229 	struct iwn_tx_cmd *cmd;
5230 	struct mbuf *m;
5231 	bus_addr_t paddr;
5232 	int totlen, error;
5233 	int cmd_queue_num;
5234 
5235 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5236 
5237 	if (async == 0)
5238 		IWN_LOCK_ASSERT(sc);
5239 
5240 	if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT)
5241 		cmd_queue_num = IWN_PAN_CMD_QUEUE;
5242 	else
5243 		cmd_queue_num = IWN_CMD_QUEUE_NUM;
5244 
5245 	ring = &sc->txq[cmd_queue_num];
5246 	desc = &ring->desc[ring->cur];
5247 	data = &ring->data[ring->cur];
5248 	totlen = 4 + size;
5249 
5250 	if (size > sizeof cmd->data) {
5251 		/* Command is too large to fit in a descriptor. */
5252 		if (totlen > MCLBYTES)
5253 			return EINVAL;
5254 		m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
5255 		if (m == NULL)
5256 			return ENOMEM;
5257 		cmd = mtod(m, struct iwn_tx_cmd *);
5258 		error = bus_dmamap_load(ring->data_dmat, data->map, cmd,
5259 		    totlen, iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
5260 		if (error != 0) {
5261 			m_freem(m);
5262 			return error;
5263 		}
5264 		data->m = m;
5265 	} else {
5266 		cmd = &ring->cmd[ring->cur];
5267 		paddr = data->cmd_paddr;
5268 	}
5269 
5270 	cmd->code = code;
5271 	cmd->flags = 0;
5272 	cmd->qid = ring->qid;
5273 	cmd->idx = ring->cur;
5274 	memcpy(cmd->data, buf, size);
5275 
5276 	desc->nsegs = 1;
5277 	desc->segs[0].addr = htole32(IWN_LOADDR(paddr));
5278 	desc->segs[0].len  = htole16(IWN_HIADDR(paddr) | totlen << 4);
5279 
5280 	DPRINTF(sc, IWN_DEBUG_CMD, "%s: %s (0x%x) flags %d qid %d idx %d\n",
5281 	    __func__, iwn_intr_str(cmd->code), cmd->code,
5282 	    cmd->flags, cmd->qid, cmd->idx);
5283 
5284 	if (size > sizeof cmd->data) {
5285 		bus_dmamap_sync(ring->data_dmat, data->map,
5286 		    BUS_DMASYNC_PREWRITE);
5287 	} else {
5288 		bus_dmamap_sync(ring->cmd_dma.tag, ring->cmd_dma.map,
5289 		    BUS_DMASYNC_PREWRITE);
5290 	}
5291 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
5292 	    BUS_DMASYNC_PREWRITE);
5293 
5294 	/* Kick command ring. */
5295 	ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
5296 	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
5297 
5298 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5299 
5300 	return async ? 0 : msleep(desc, &sc->sc_mtx, PCATCH, "iwncmd", hz);
5301 }
5302 
5303 static int
5304 iwn4965_add_node(struct iwn_softc *sc, struct iwn_node_info *node, int async)
5305 {
5306 	struct iwn4965_node_info hnode;
5307 	caddr_t src, dst;
5308 
5309 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5310 
5311 	/*
5312 	 * We use the node structure for 5000 Series internally (it is
5313 	 * a superset of the one for 4965AGN). We thus copy the common
5314 	 * fields before sending the command.
5315 	 */
5316 	src = (caddr_t)node;
5317 	dst = (caddr_t)&hnode;
5318 	memcpy(dst, src, 48);
5319 	/* Skip TSC, RX MIC and TX MIC fields from ``src''. */
5320 	memcpy(dst + 48, src + 72, 20);
5321 	return iwn_cmd(sc, IWN_CMD_ADD_NODE, &hnode, sizeof hnode, async);
5322 }
5323 
5324 static int
5325 iwn5000_add_node(struct iwn_softc *sc, struct iwn_node_info *node, int async)
5326 {
5327 
5328 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5329 
5330 	/* Direct mapping. */
5331 	return iwn_cmd(sc, IWN_CMD_ADD_NODE, node, sizeof (*node), async);
5332 }
5333 
5334 static int
5335 iwn_set_link_quality(struct iwn_softc *sc, struct ieee80211_node *ni)
5336 {
5337 	struct iwn_node *wn = (void *)ni;
5338 	struct ieee80211_rateset *rs;
5339 	struct iwn_cmd_link_quality linkq;
5340 	int i, rate, txrate;
5341 	int is_11n;
5342 
5343 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5344 
5345 	memset(&linkq, 0, sizeof linkq);
5346 	linkq.id = wn->id;
5347 	linkq.antmsk_1stream = iwn_get_1stream_tx_antmask(sc);
5348 	linkq.antmsk_2stream = iwn_get_2stream_tx_antmask(sc);
5349 
5350 	linkq.ampdu_max = 32;		/* XXX negotiated? */
5351 	linkq.ampdu_threshold = 3;
5352 	linkq.ampdu_limit = htole16(4000);	/* 4ms */
5353 
5354 	DPRINTF(sc, IWN_DEBUG_XMIT,
5355 	    "%s: 1stream antenna=0x%02x, 2stream antenna=0x%02x, ntxstreams=%d\n",
5356 	    __func__,
5357 	    linkq.antmsk_1stream,
5358 	    linkq.antmsk_2stream,
5359 	    sc->ntxchains);
5360 
5361 	/*
5362 	 * Are we using 11n rates? Ensure the channel is
5363 	 * 11n _and_ we have some 11n rates, or don't
5364 	 * try.
5365 	 */
5366 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && ni->ni_htrates.rs_nrates > 0) {
5367 		rs = (struct ieee80211_rateset *) &ni->ni_htrates;
5368 		is_11n = 1;
5369 	} else {
5370 		rs = &ni->ni_rates;
5371 		is_11n = 0;
5372 	}
5373 
5374 	/* Start at highest available bit-rate. */
5375 	/*
5376 	 * XXX this is all very dirty!
5377 	 */
5378 	if (is_11n)
5379 		txrate = ni->ni_htrates.rs_nrates - 1;
5380 	else
5381 		txrate = rs->rs_nrates - 1;
5382 	for (i = 0; i < IWN_MAX_TX_RETRIES; i++) {
5383 		uint32_t plcp;
5384 
5385 		/*
5386 		 * XXX TODO: ensure the last two slots are the two lowest
5387 		 * rate entries, just for now.
5388 		 */
5389 		if (i == 14 || i == 15)
5390 			txrate = 0;
5391 
5392 		if (is_11n)
5393 			rate = IEEE80211_RATE_MCS | rs->rs_rates[txrate];
5394 		else
5395 			rate = IEEE80211_RV(rs->rs_rates[txrate]);
5396 
5397 		/* Do rate -> PLCP config mapping */
5398 		plcp = iwn_rate_to_plcp(sc, ni, rate);
5399 		linkq.retry[i] = plcp;
5400 		DPRINTF(sc, IWN_DEBUG_XMIT,
5401 		    "%s: i=%d, txrate=%d, rate=0x%02x, plcp=0x%08x\n",
5402 		    __func__,
5403 		    i,
5404 		    txrate,
5405 		    rate,
5406 		    le32toh(plcp));
5407 
5408 		/*
5409 		 * The mimo field is an index into the table which
5410 		 * indicates the first index where it and subsequent entries
5411 		 * will not be using MIMO.
5412 		 *
5413 		 * Since we're filling linkq from 0..15 and we're filling
5414 		 * from the highest MCS rates to the lowest rates, if we
5415 		 * _are_ doing a dual-stream rate, set mimo to idx+1 (ie,
5416 		 * the next entry.)  That way if the next entry is a non-MIMO
5417 		 * entry, we're already pointing at it.
5418 		 */
5419 		if ((le32toh(plcp) & IWN_RFLAG_MCS) &&
5420 		    IEEE80211_RV(le32toh(plcp)) > 7)
5421 			linkq.mimo = i + 1;
5422 
5423 		/* Next retry at immediate lower bit-rate. */
5424 		if (txrate > 0)
5425 			txrate--;
5426 	}
5427 	/*
5428 	 * If we reached the end of the list and indeed we hit
5429 	 * all MIMO rates (eg 5300 doing MCS23-15) then yes,
5430 	 * set mimo to 15.  Setting it to 16 panics the firmware.
5431 	 */
5432 	if (linkq.mimo > 15)
5433 		linkq.mimo = 15;
5434 
5435 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: mimo = %d\n", __func__, linkq.mimo);
5436 
5437 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5438 
5439 	return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, 1);
5440 }
5441 
5442 /*
5443  * Broadcast node is used to send group-addressed and management frames.
5444  */
5445 static int
5446 iwn_add_broadcast_node(struct iwn_softc *sc, int async)
5447 {
5448 	struct iwn_ops *ops = &sc->ops;
5449 	struct ieee80211com *ic = &sc->sc_ic;
5450 	struct iwn_node_info node;
5451 	struct iwn_cmd_link_quality linkq;
5452 	uint8_t txant;
5453 	int i, error;
5454 
5455 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5456 
5457 	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
5458 
5459 	memset(&node, 0, sizeof node);
5460 	IEEE80211_ADDR_COPY(node.macaddr, ieee80211broadcastaddr);
5461 	node.id = sc->broadcast_id;
5462 	DPRINTF(sc, IWN_DEBUG_RESET, "%s: adding broadcast node\n", __func__);
5463 	if ((error = ops->add_node(sc, &node, async)) != 0)
5464 		return error;
5465 
5466 	/* Use the first valid TX antenna. */
5467 	txant = IWN_LSB(sc->txchainmask);
5468 
5469 	memset(&linkq, 0, sizeof linkq);
5470 	linkq.id = sc->broadcast_id;
5471 	linkq.antmsk_1stream = iwn_get_1stream_tx_antmask(sc);
5472 	linkq.antmsk_2stream = iwn_get_2stream_tx_antmask(sc);
5473 	linkq.ampdu_max = 64;
5474 	linkq.ampdu_threshold = 3;
5475 	linkq.ampdu_limit = htole16(4000);	/* 4ms */
5476 
5477 	/* Use lowest mandatory bit-rate. */
5478 	/* XXX rate table lookup? */
5479 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
5480 		linkq.retry[0] = htole32(0xd);
5481 	else
5482 		linkq.retry[0] = htole32(10 | IWN_RFLAG_CCK);
5483 	linkq.retry[0] |= htole32(IWN_RFLAG_ANT(txant));
5484 	/* Use same bit-rate for all TX retries. */
5485 	for (i = 1; i < IWN_MAX_TX_RETRIES; i++) {
5486 		linkq.retry[i] = linkq.retry[0];
5487 	}
5488 
5489 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5490 
5491 	return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, async);
5492 }
5493 
5494 static int
5495 iwn_updateedca(struct ieee80211com *ic)
5496 {
5497 #define IWN_EXP2(x)	((1 << (x)) - 1)	/* CWmin = 2^ECWmin - 1 */
5498 	struct iwn_softc *sc = ic->ic_softc;
5499 	struct iwn_edca_params cmd;
5500 	struct chanAccParams chp;
5501 	int aci;
5502 
5503 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5504 
5505 	ieee80211_wme_ic_getparams(ic, &chp);
5506 
5507 	memset(&cmd, 0, sizeof cmd);
5508 	cmd.flags = htole32(IWN_EDCA_UPDATE);
5509 
5510 	IEEE80211_LOCK(ic);
5511 	for (aci = 0; aci < WME_NUM_AC; aci++) {
5512 		const struct wmeParams *ac = &chp.cap_wmeParams[aci];
5513 		cmd.ac[aci].aifsn = ac->wmep_aifsn;
5514 		cmd.ac[aci].cwmin = htole16(IWN_EXP2(ac->wmep_logcwmin));
5515 		cmd.ac[aci].cwmax = htole16(IWN_EXP2(ac->wmep_logcwmax));
5516 		cmd.ac[aci].txoplimit =
5517 		    htole16(IEEE80211_TXOP_TO_US(ac->wmep_txopLimit));
5518 	}
5519 	IEEE80211_UNLOCK(ic);
5520 
5521 	IWN_LOCK(sc);
5522 	(void)iwn_cmd(sc, IWN_CMD_EDCA_PARAMS, &cmd, sizeof cmd, 1);
5523 	IWN_UNLOCK(sc);
5524 
5525 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5526 
5527 	return 0;
5528 #undef IWN_EXP2
5529 }
5530 
5531 static void
5532 iwn_set_promisc(struct iwn_softc *sc)
5533 {
5534 	struct ieee80211com *ic = &sc->sc_ic;
5535 	uint32_t promisc_filter;
5536 
5537 	promisc_filter = IWN_FILTER_CTL | IWN_FILTER_PROMISC;
5538 	if (ic->ic_promisc > 0 || ic->ic_opmode == IEEE80211_M_MONITOR)
5539 		sc->rxon->filter |= htole32(promisc_filter);
5540 	else
5541 		sc->rxon->filter &= ~htole32(promisc_filter);
5542 }
5543 
5544 static void
5545 iwn_update_promisc(struct ieee80211com *ic)
5546 {
5547 	struct iwn_softc *sc = ic->ic_softc;
5548 	int error;
5549 
5550 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
5551 		return;		/* nothing to do */
5552 
5553 	IWN_LOCK(sc);
5554 	if (!(sc->sc_flags & IWN_FLAG_RUNNING)) {
5555 		IWN_UNLOCK(sc);
5556 		return;
5557 	}
5558 
5559 	iwn_set_promisc(sc);
5560 	if ((error = iwn_send_rxon(sc, 1, 1)) != 0) {
5561 		device_printf(sc->sc_dev,
5562 		    "%s: could not send RXON, error %d\n",
5563 		    __func__, error);
5564 	}
5565 	IWN_UNLOCK(sc);
5566 }
5567 
5568 static void
5569 iwn_update_mcast(struct ieee80211com *ic)
5570 {
5571 	/* Ignore */
5572 }
5573 
5574 static void
5575 iwn_set_led(struct iwn_softc *sc, uint8_t which, uint8_t off, uint8_t on)
5576 {
5577 	struct iwn_cmd_led led;
5578 
5579 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5580 
5581 #if 0
5582 	/* XXX don't set LEDs during scan? */
5583 	if (sc->sc_is_scanning)
5584 		return;
5585 #endif
5586 
5587 	/* Clear microcode LED ownership. */
5588 	IWN_CLRBITS(sc, IWN_LED, IWN_LED_BSM_CTRL);
5589 
5590 	led.which = which;
5591 	led.unit = htole32(10000);	/* on/off in unit of 100ms */
5592 	led.off = off;
5593 	led.on = on;
5594 	(void)iwn_cmd(sc, IWN_CMD_SET_LED, &led, sizeof led, 1);
5595 }
5596 
5597 /*
5598  * Set the critical temperature at which the firmware will stop the radio
5599  * and notify us.
5600  */
5601 static int
5602 iwn_set_critical_temp(struct iwn_softc *sc)
5603 {
5604 	struct iwn_critical_temp crit;
5605 	int32_t temp;
5606 
5607 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5608 
5609 	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_CTEMP_STOP_RF);
5610 
5611 	if (sc->hw_type == IWN_HW_REV_TYPE_5150)
5612 		temp = (IWN_CTOK(110) - sc->temp_off) * -5;
5613 	else if (sc->hw_type == IWN_HW_REV_TYPE_4965)
5614 		temp = IWN_CTOK(110);
5615 	else
5616 		temp = 110;
5617 	memset(&crit, 0, sizeof crit);
5618 	crit.tempR = htole32(temp);
5619 	DPRINTF(sc, IWN_DEBUG_RESET, "setting critical temp to %d\n", temp);
5620 	return iwn_cmd(sc, IWN_CMD_SET_CRITICAL_TEMP, &crit, sizeof crit, 0);
5621 }
5622 
5623 static int
5624 iwn_set_timing(struct iwn_softc *sc, struct ieee80211_node *ni)
5625 {
5626 	struct iwn_cmd_timing cmd;
5627 	uint64_t val, mod;
5628 
5629 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5630 
5631 	memset(&cmd, 0, sizeof cmd);
5632 	memcpy(&cmd.tstamp, ni->ni_tstamp.data, sizeof (uint64_t));
5633 	cmd.bintval = htole16(ni->ni_intval);
5634 	cmd.lintval = htole16(10);
5635 
5636 	/* Compute remaining time until next beacon. */
5637 	val = (uint64_t)ni->ni_intval * IEEE80211_DUR_TU;
5638 	mod = le64toh(cmd.tstamp) % val;
5639 	cmd.binitval = htole32((uint32_t)(val - mod));
5640 
5641 	DPRINTF(sc, IWN_DEBUG_RESET, "timing bintval=%u tstamp=%ju, init=%u\n",
5642 	    ni->ni_intval, le64toh(cmd.tstamp), (uint32_t)(val - mod));
5643 
5644 	return iwn_cmd(sc, IWN_CMD_TIMING, &cmd, sizeof cmd, 1);
5645 }
5646 
5647 static void
5648 iwn4965_power_calibration(struct iwn_softc *sc, int temp)
5649 {
5650 
5651 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5652 
5653 	/* Adjust TX power if need be (delta >= 3 degC). */
5654 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d->%d\n",
5655 	    __func__, sc->temp, temp);
5656 	if (abs(temp - sc->temp) >= 3) {
5657 		/* Record temperature of last calibration. */
5658 		sc->temp = temp;
5659 		(void)iwn4965_set_txpower(sc, 1);
5660 	}
5661 }
5662 
5663 /*
5664  * Set TX power for current channel (each rate has its own power settings).
5665  * This function takes into account the regulatory information from EEPROM,
5666  * the current temperature and the current voltage.
5667  */
5668 static int
5669 iwn4965_set_txpower(struct iwn_softc *sc, int async)
5670 {
5671 /* Fixed-point arithmetic division using a n-bit fractional part. */
5672 #define fdivround(a, b, n)	\
5673 	((((1 << n) * (a)) / (b) + (1 << n) / 2) / (1 << n))
5674 /* Linear interpolation. */
5675 #define interpolate(x, x1, y1, x2, y2, n)	\
5676 	((y1) + fdivround(((int)(x) - (x1)) * ((y2) - (y1)), (x2) - (x1), n))
5677 
5678 	static const int tdiv[IWN_NATTEN_GROUPS] = { 9, 8, 8, 8, 6 };
5679 	struct iwn_ucode_info *uc = &sc->ucode_info;
5680 	struct iwn4965_cmd_txpower cmd;
5681 	struct iwn4965_eeprom_chan_samples *chans;
5682 	const uint8_t *rf_gain, *dsp_gain;
5683 	int32_t vdiff, tdiff;
5684 	int i, is_chan_5ghz, c, grp, maxpwr;
5685 	uint8_t chan;
5686 
5687 	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
5688 	/* Retrieve current channel from last RXON. */
5689 	chan = sc->rxon->chan;
5690 	is_chan_5ghz = (sc->rxon->flags & htole32(IWN_RXON_24GHZ)) == 0;
5691 	DPRINTF(sc, IWN_DEBUG_RESET, "setting TX power for channel %d\n",
5692 	    chan);
5693 
5694 	memset(&cmd, 0, sizeof cmd);
5695 	cmd.band = is_chan_5ghz ? 0 : 1;
5696 	cmd.chan = chan;
5697 
5698 	if (is_chan_5ghz) {
5699 		maxpwr   = sc->maxpwr5GHz;
5700 		rf_gain  = iwn4965_rf_gain_5ghz;
5701 		dsp_gain = iwn4965_dsp_gain_5ghz;
5702 	} else {
5703 		maxpwr   = sc->maxpwr2GHz;
5704 		rf_gain  = iwn4965_rf_gain_2ghz;
5705 		dsp_gain = iwn4965_dsp_gain_2ghz;
5706 	}
5707 
5708 	/* Compute voltage compensation. */
5709 	vdiff = ((int32_t)le32toh(uc->volt) - sc->eeprom_voltage) / 7;
5710 	if (vdiff > 0)
5711 		vdiff *= 2;
5712 	if (abs(vdiff) > 2)
5713 		vdiff = 0;
5714 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5715 	    "%s: voltage compensation=%d (UCODE=%d, EEPROM=%d)\n",
5716 	    __func__, vdiff, le32toh(uc->volt), sc->eeprom_voltage);
5717 
5718 	/* Get channel attenuation group. */
5719 	if (chan <= 20)		/* 1-20 */
5720 		grp = 4;
5721 	else if (chan <= 43)	/* 34-43 */
5722 		grp = 0;
5723 	else if (chan <= 70)	/* 44-70 */
5724 		grp = 1;
5725 	else if (chan <= 124)	/* 71-124 */
5726 		grp = 2;
5727 	else			/* 125-200 */
5728 		grp = 3;
5729 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5730 	    "%s: chan %d, attenuation group=%d\n", __func__, chan, grp);
5731 
5732 	/* Get channel sub-band. */
5733 	for (i = 0; i < IWN_NBANDS; i++)
5734 		if (sc->bands[i].lo != 0 &&
5735 		    sc->bands[i].lo <= chan && chan <= sc->bands[i].hi)
5736 			break;
5737 	if (i == IWN_NBANDS)	/* Can't happen in real-life. */
5738 		return EINVAL;
5739 	chans = sc->bands[i].chans;
5740 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5741 	    "%s: chan %d sub-band=%d\n", __func__, chan, i);
5742 
5743 	for (c = 0; c < 2; c++) {
5744 		uint8_t power, gain, temp;
5745 		int maxchpwr, pwr, ridx, idx;
5746 
5747 		power = interpolate(chan,
5748 		    chans[0].num, chans[0].samples[c][1].power,
5749 		    chans[1].num, chans[1].samples[c][1].power, 1);
5750 		gain  = interpolate(chan,
5751 		    chans[0].num, chans[0].samples[c][1].gain,
5752 		    chans[1].num, chans[1].samples[c][1].gain, 1);
5753 		temp  = interpolate(chan,
5754 		    chans[0].num, chans[0].samples[c][1].temp,
5755 		    chans[1].num, chans[1].samples[c][1].temp, 1);
5756 		DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5757 		    "%s: Tx chain %d: power=%d gain=%d temp=%d\n",
5758 		    __func__, c, power, gain, temp);
5759 
5760 		/* Compute temperature compensation. */
5761 		tdiff = ((sc->temp - temp) * 2) / tdiv[grp];
5762 		DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5763 		    "%s: temperature compensation=%d (current=%d, EEPROM=%d)\n",
5764 		    __func__, tdiff, sc->temp, temp);
5765 
5766 		for (ridx = 0; ridx <= IWN_RIDX_MAX; ridx++) {
5767 			/* Convert dBm to half-dBm. */
5768 			maxchpwr = sc->maxpwr[chan] * 2;
5769 			if ((ridx / 8) & 1)
5770 				maxchpwr -= 6;	/* MIMO 2T: -3dB */
5771 
5772 			pwr = maxpwr;
5773 
5774 			/* Adjust TX power based on rate. */
5775 			if ((ridx % 8) == 5)
5776 				pwr -= 15;	/* OFDM48: -7.5dB */
5777 			else if ((ridx % 8) == 6)
5778 				pwr -= 17;	/* OFDM54: -8.5dB */
5779 			else if ((ridx % 8) == 7)
5780 				pwr -= 20;	/* OFDM60: -10dB */
5781 			else
5782 				pwr -= 10;	/* Others: -5dB */
5783 
5784 			/* Do not exceed channel max TX power. */
5785 			if (pwr > maxchpwr)
5786 				pwr = maxchpwr;
5787 
5788 			idx = gain - (pwr - power) - tdiff - vdiff;
5789 			if ((ridx / 8) & 1)	/* MIMO */
5790 				idx += (int32_t)le32toh(uc->atten[grp][c]);
5791 
5792 			if (cmd.band == 0)
5793 				idx += 9;	/* 5GHz */
5794 			if (ridx == IWN_RIDX_MAX)
5795 				idx += 5;	/* CCK */
5796 
5797 			/* Make sure idx stays in a valid range. */
5798 			if (idx < 0)
5799 				idx = 0;
5800 			else if (idx > IWN4965_MAX_PWR_INDEX)
5801 				idx = IWN4965_MAX_PWR_INDEX;
5802 
5803 			DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5804 			    "%s: Tx chain %d, rate idx %d: power=%d\n",
5805 			    __func__, c, ridx, idx);
5806 			cmd.power[ridx].rf_gain[c] = rf_gain[idx];
5807 			cmd.power[ridx].dsp_gain[c] = dsp_gain[idx];
5808 		}
5809 	}
5810 
5811 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5812 	    "%s: set tx power for chan %d\n", __func__, chan);
5813 	return iwn_cmd(sc, IWN_CMD_TXPOWER, &cmd, sizeof cmd, async);
5814 
5815 #undef interpolate
5816 #undef fdivround
5817 }
5818 
5819 static int
5820 iwn5000_set_txpower(struct iwn_softc *sc, int async)
5821 {
5822 	struct iwn5000_cmd_txpower cmd;
5823 	int cmdid;
5824 
5825 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5826 
5827 	/*
5828 	 * TX power calibration is handled automatically by the firmware
5829 	 * for 5000 Series.
5830 	 */
5831 	memset(&cmd, 0, sizeof cmd);
5832 	cmd.global_limit = 2 * IWN5000_TXPOWER_MAX_DBM;	/* 16 dBm */
5833 	cmd.flags = IWN5000_TXPOWER_NO_CLOSED;
5834 	cmd.srv_limit = IWN5000_TXPOWER_AUTO;
5835 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_XMIT,
5836 	    "%s: setting TX power; rev=%d\n",
5837 	    __func__,
5838 	    IWN_UCODE_API(sc->ucode_rev));
5839 	if (IWN_UCODE_API(sc->ucode_rev) == 1)
5840 		cmdid = IWN_CMD_TXPOWER_DBM_V1;
5841 	else
5842 		cmdid = IWN_CMD_TXPOWER_DBM;
5843 	return iwn_cmd(sc, cmdid, &cmd, sizeof cmd, async);
5844 }
5845 
5846 /*
5847  * Retrieve the maximum RSSI (in dBm) among receivers.
5848  */
5849 static int
5850 iwn4965_get_rssi(struct iwn_softc *sc, struct iwn_rx_stat *stat)
5851 {
5852 	struct iwn4965_rx_phystat *phy = (void *)stat->phybuf;
5853 	uint8_t mask, agc;
5854 	int rssi;
5855 
5856 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5857 
5858 	mask = (le16toh(phy->antenna) >> 4) & IWN_ANT_ABC;
5859 	agc  = (le16toh(phy->agc) >> 7) & 0x7f;
5860 
5861 	rssi = 0;
5862 	if (mask & IWN_ANT_A)
5863 		rssi = MAX(rssi, phy->rssi[0]);
5864 	if (mask & IWN_ANT_B)
5865 		rssi = MAX(rssi, phy->rssi[2]);
5866 	if (mask & IWN_ANT_C)
5867 		rssi = MAX(rssi, phy->rssi[4]);
5868 
5869 	DPRINTF(sc, IWN_DEBUG_RECV,
5870 	    "%s: agc %d mask 0x%x rssi %d %d %d result %d\n", __func__, agc,
5871 	    mask, phy->rssi[0], phy->rssi[2], phy->rssi[4],
5872 	    rssi - agc - IWN_RSSI_TO_DBM);
5873 	return rssi - agc - IWN_RSSI_TO_DBM;
5874 }
5875 
5876 static int
5877 iwn5000_get_rssi(struct iwn_softc *sc, struct iwn_rx_stat *stat)
5878 {
5879 	struct iwn5000_rx_phystat *phy = (void *)stat->phybuf;
5880 	uint8_t agc;
5881 	int rssi;
5882 
5883 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5884 
5885 	agc = (le32toh(phy->agc) >> 9) & 0x7f;
5886 
5887 	rssi = MAX(le16toh(phy->rssi[0]) & 0xff,
5888 		   le16toh(phy->rssi[1]) & 0xff);
5889 	rssi = MAX(le16toh(phy->rssi[2]) & 0xff, rssi);
5890 
5891 	DPRINTF(sc, IWN_DEBUG_RECV,
5892 	    "%s: agc %d rssi %d %d %d result %d\n", __func__, agc,
5893 	    phy->rssi[0], phy->rssi[1], phy->rssi[2],
5894 	    rssi - agc - IWN_RSSI_TO_DBM);
5895 	return rssi - agc - IWN_RSSI_TO_DBM;
5896 }
5897 
5898 /*
5899  * Retrieve the average noise (in dBm) among receivers.
5900  */
5901 static int
5902 iwn_get_noise(const struct iwn_rx_general_stats *stats)
5903 {
5904 	int i, total, nbant, noise;
5905 
5906 	total = nbant = 0;
5907 	for (i = 0; i < 3; i++) {
5908 		if ((noise = le32toh(stats->noise[i]) & 0xff) == 0)
5909 			continue;
5910 		total += noise;
5911 		nbant++;
5912 	}
5913 	/* There should be at least one antenna but check anyway. */
5914 	return (nbant == 0) ? -127 : (total / nbant) - 107;
5915 }
5916 
5917 /*
5918  * Compute temperature (in degC) from last received statistics.
5919  */
5920 static int
5921 iwn4965_get_temperature(struct iwn_softc *sc)
5922 {
5923 	struct iwn_ucode_info *uc = &sc->ucode_info;
5924 	int32_t r1, r2, r3, r4, temp;
5925 
5926 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5927 
5928 	r1 = le32toh(uc->temp[0].chan20MHz);
5929 	r2 = le32toh(uc->temp[1].chan20MHz);
5930 	r3 = le32toh(uc->temp[2].chan20MHz);
5931 	r4 = le32toh(sc->rawtemp);
5932 
5933 	if (r1 == r3)	/* Prevents division by 0 (should not happen). */
5934 		return 0;
5935 
5936 	/* Sign-extend 23-bit R4 value to 32-bit. */
5937 	r4 = ((r4 & 0xffffff) ^ 0x800000) - 0x800000;
5938 	/* Compute temperature in Kelvin. */
5939 	temp = (259 * (r4 - r2)) / (r3 - r1);
5940 	temp = (temp * 97) / 100 + 8;
5941 
5942 	DPRINTF(sc, IWN_DEBUG_ANY, "temperature %dK/%dC\n", temp,
5943 	    IWN_KTOC(temp));
5944 	return IWN_KTOC(temp);
5945 }
5946 
5947 static int
5948 iwn5000_get_temperature(struct iwn_softc *sc)
5949 {
5950 	int32_t temp;
5951 
5952 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5953 
5954 	/*
5955 	 * Temperature is not used by the driver for 5000 Series because
5956 	 * TX power calibration is handled by firmware.
5957 	 */
5958 	temp = le32toh(sc->rawtemp);
5959 	if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
5960 		temp = (temp / -5) + sc->temp_off;
5961 		temp = IWN_KTOC(temp);
5962 	}
5963 	return temp;
5964 }
5965 
5966 /*
5967  * Initialize sensitivity calibration state machine.
5968  */
5969 static int
5970 iwn_init_sensitivity(struct iwn_softc *sc)
5971 {
5972 	struct iwn_ops *ops = &sc->ops;
5973 	struct iwn_calib_state *calib = &sc->calib;
5974 	uint32_t flags;
5975 	int error;
5976 
5977 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5978 
5979 	/* Reset calibration state machine. */
5980 	memset(calib, 0, sizeof (*calib));
5981 	calib->state = IWN_CALIB_STATE_INIT;
5982 	calib->cck_state = IWN_CCK_STATE_HIFA;
5983 	/* Set initial correlation values. */
5984 	calib->ofdm_x1     = sc->limits->min_ofdm_x1;
5985 	calib->ofdm_mrc_x1 = sc->limits->min_ofdm_mrc_x1;
5986 	calib->ofdm_x4     = sc->limits->min_ofdm_x4;
5987 	calib->ofdm_mrc_x4 = sc->limits->min_ofdm_mrc_x4;
5988 	calib->cck_x4      = 125;
5989 	calib->cck_mrc_x4  = sc->limits->min_cck_mrc_x4;
5990 	calib->energy_cck  = sc->limits->energy_cck;
5991 
5992 	/* Write initial sensitivity. */
5993 	if ((error = iwn_send_sensitivity(sc)) != 0)
5994 		return error;
5995 
5996 	/* Write initial gains. */
5997 	if ((error = ops->init_gains(sc)) != 0)
5998 		return error;
5999 
6000 	/* Request statistics at each beacon interval. */
6001 	flags = 0;
6002 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: sending request for statistics\n",
6003 	    __func__);
6004 	return iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags, sizeof flags, 1);
6005 }
6006 
6007 /*
6008  * Collect noise and RSSI statistics for the first 20 beacons received
6009  * after association and use them to determine connected antennas and
6010  * to set differential gains.
6011  */
6012 static void
6013 iwn_collect_noise(struct iwn_softc *sc,
6014     const struct iwn_rx_general_stats *stats)
6015 {
6016 	struct iwn_ops *ops = &sc->ops;
6017 	struct iwn_calib_state *calib = &sc->calib;
6018 	struct ieee80211com *ic = &sc->sc_ic;
6019 	uint32_t val;
6020 	int i;
6021 
6022 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
6023 
6024 	/* Accumulate RSSI and noise for all 3 antennas. */
6025 	for (i = 0; i < 3; i++) {
6026 		calib->rssi[i] += le32toh(stats->rssi[i]) & 0xff;
6027 		calib->noise[i] += le32toh(stats->noise[i]) & 0xff;
6028 	}
6029 	/* NB: We update differential gains only once after 20 beacons. */
6030 	if (++calib->nbeacons < 20)
6031 		return;
6032 
6033 	/* Determine highest average RSSI. */
6034 	val = MAX(calib->rssi[0], calib->rssi[1]);
6035 	val = MAX(calib->rssi[2], val);
6036 
6037 	/* Determine which antennas are connected. */
6038 	sc->chainmask = sc->rxchainmask;
6039 	for (i = 0; i < 3; i++)
6040 		if (val - calib->rssi[i] > 15 * 20)
6041 			sc->chainmask &= ~(1 << i);
6042 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_XMIT,
6043 	    "%s: RX chains mask: theoretical=0x%x, actual=0x%x\n",
6044 	    __func__, sc->rxchainmask, sc->chainmask);
6045 
6046 	/* If none of the TX antennas are connected, keep at least one. */
6047 	if ((sc->chainmask & sc->txchainmask) == 0)
6048 		sc->chainmask |= IWN_LSB(sc->txchainmask);
6049 
6050 	(void)ops->set_gains(sc);
6051 	calib->state = IWN_CALIB_STATE_RUN;
6052 
6053 #ifdef notyet
6054 	/* XXX Disable RX chains with no antennas connected. */
6055 	sc->rxon->rxchain = htole16(IWN_RXCHAIN_SEL(sc->chainmask));
6056 	if (sc->sc_is_scanning)
6057 		device_printf(sc->sc_dev,
6058 		    "%s: is_scanning set, before RXON\n",
6059 		    __func__);
6060 	(void)iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 1);
6061 #endif
6062 
6063 	/* Enable power-saving mode if requested by user. */
6064 	if (ic->ic_flags & IEEE80211_F_PMGTON)
6065 		(void)iwn_set_pslevel(sc, 0, 3, 1);
6066 
6067 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
6068 
6069 }
6070 
6071 static int
6072 iwn4965_init_gains(struct iwn_softc *sc)
6073 {
6074 	struct iwn_phy_calib_gain cmd;
6075 
6076 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
6077 
6078 	memset(&cmd, 0, sizeof cmd);
6079 	cmd.code = IWN4965_PHY_CALIB_DIFF_GAIN;
6080 	/* Differential gains initially set to 0 for all 3 antennas. */
6081 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6082 	    "%s: setting initial differential gains\n", __func__);
6083 	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
6084 }
6085 
6086 static int
6087 iwn5000_init_gains(struct iwn_softc *sc)
6088 {
6089 	struct iwn_phy_calib cmd;
6090 
6091 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
6092 
6093 	memset(&cmd, 0, sizeof cmd);
6094 	cmd.code = sc->reset_noise_gain;
6095 	cmd.ngroups = 1;
6096 	cmd.isvalid = 1;
6097 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6098 	    "%s: setting initial differential gains\n", __func__);
6099 	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
6100 }
6101 
6102 static int
6103 iwn4965_set_gains(struct iwn_softc *sc)
6104 {
6105 	struct iwn_calib_state *calib = &sc->calib;
6106 	struct iwn_phy_calib_gain cmd;
6107 	int i, delta, noise;
6108 
6109 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
6110 
6111 	/* Get minimal noise among connected antennas. */
6112 	noise = INT_MAX;	/* NB: There's at least one antenna. */
6113 	for (i = 0; i < 3; i++)
6114 		if (sc->chainmask & (1 << i))
6115 			noise = MIN(calib->noise[i], noise);
6116 
6117 	memset(&cmd, 0, sizeof cmd);
6118 	cmd.code = IWN4965_PHY_CALIB_DIFF_GAIN;
6119 	/* Set differential gains for connected antennas. */
6120 	for (i = 0; i < 3; i++) {
6121 		if (sc->chainmask & (1 << i)) {
6122 			/* Compute attenuation (in unit of 1.5dB). */
6123 			delta = (noise - (int32_t)calib->noise[i]) / 30;
6124 			/* NB: delta <= 0 */
6125 			/* Limit to [-4.5dB,0]. */
6126 			cmd.gain[i] = MIN(abs(delta), 3);
6127 			if (delta < 0)
6128 				cmd.gain[i] |= 1 << 2;	/* sign bit */
6129 		}
6130 	}
6131 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6132 	    "setting differential gains Ant A/B/C: %x/%x/%x (%x)\n",
6133 	    cmd.gain[0], cmd.gain[1], cmd.gain[2], sc->chainmask);
6134 	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
6135 }
6136 
6137 static int
6138 iwn5000_set_gains(struct iwn_softc *sc)
6139 {
6140 	struct iwn_calib_state *calib = &sc->calib;
6141 	struct iwn_phy_calib_gain cmd;
6142 	int i, ant, div, delta;
6143 
6144 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
6145 
6146 	/* We collected 20 beacons and !=6050 need a 1.5 factor. */
6147 	div = (sc->hw_type == IWN_HW_REV_TYPE_6050) ? 20 : 30;
6148 
6149 	memset(&cmd, 0, sizeof cmd);
6150 	cmd.code = sc->noise_gain;
6151 	cmd.ngroups = 1;
6152 	cmd.isvalid = 1;
6153 	/* Get first available RX antenna as referential. */
6154 	ant = IWN_LSB(sc->rxchainmask);
6155 	/* Set differential gains for other antennas. */
6156 	for (i = ant + 1; i < 3; i++) {
6157 		if (sc->chainmask & (1 << i)) {
6158 			/* The delta is relative to antenna "ant". */
6159 			delta = ((int32_t)calib->noise[ant] -
6160 			    (int32_t)calib->noise[i]) / div;
6161 			/* Limit to [-4.5dB,+4.5dB]. */
6162 			cmd.gain[i - 1] = MIN(abs(delta), 3);
6163 			if (delta < 0)
6164 				cmd.gain[i - 1] |= 1 << 2;	/* sign bit */
6165 		}
6166 	}
6167 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_XMIT,
6168 	    "setting differential gains Ant B/C: %x/%x (%x)\n",
6169 	    cmd.gain[0], cmd.gain[1], sc->chainmask);
6170 	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
6171 }
6172 
6173 /*
6174  * Tune RF RX sensitivity based on the number of false alarms detected
6175  * during the last beacon period.
6176  */
6177 static void
6178 iwn_tune_sensitivity(struct iwn_softc *sc, const struct iwn_rx_stats *stats)
6179 {
6180 #define inc(val, inc, max)			\
6181 	if ((val) < (max)) {			\
6182 		if ((val) < (max) - (inc))	\
6183 			(val) += (inc);		\
6184 		else				\
6185 			(val) = (max);		\
6186 		needs_update = 1;		\
6187 	}
6188 #define dec(val, dec, min)			\
6189 	if ((val) > (min)) {			\
6190 		if ((val) > (min) + (dec))	\
6191 			(val) -= (dec);		\
6192 		else				\
6193 			(val) = (min);		\
6194 		needs_update = 1;		\
6195 	}
6196 
6197 	const struct iwn_sensitivity_limits *limits = sc->limits;
6198 	struct iwn_calib_state *calib = &sc->calib;
6199 	uint32_t val, rxena, fa;
6200 	uint32_t energy[3], energy_min;
6201 	uint8_t noise[3], noise_ref;
6202 	int i, needs_update = 0;
6203 
6204 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
6205 
6206 	/* Check that we've been enabled long enough. */
6207 	if ((rxena = le32toh(stats->general.load)) == 0){
6208 		DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end not so long\n", __func__);
6209 		return;
6210 	}
6211 
6212 	/* Compute number of false alarms since last call for OFDM. */
6213 	fa  = le32toh(stats->ofdm.bad_plcp) - calib->bad_plcp_ofdm;
6214 	fa += le32toh(stats->ofdm.fa) - calib->fa_ofdm;
6215 	fa *= 200 * IEEE80211_DUR_TU;	/* 200TU */
6216 
6217 	if (fa > 50 * rxena) {
6218 		/* High false alarm count, decrease sensitivity. */
6219 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6220 		    "%s: OFDM high false alarm count: %u\n", __func__, fa);
6221 		inc(calib->ofdm_x1,     1, limits->max_ofdm_x1);
6222 		inc(calib->ofdm_mrc_x1, 1, limits->max_ofdm_mrc_x1);
6223 		inc(calib->ofdm_x4,     1, limits->max_ofdm_x4);
6224 		inc(calib->ofdm_mrc_x4, 1, limits->max_ofdm_mrc_x4);
6225 
6226 	} else if (fa < 5 * rxena) {
6227 		/* Low false alarm count, increase sensitivity. */
6228 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6229 		    "%s: OFDM low false alarm count: %u\n", __func__, fa);
6230 		dec(calib->ofdm_x1,     1, limits->min_ofdm_x1);
6231 		dec(calib->ofdm_mrc_x1, 1, limits->min_ofdm_mrc_x1);
6232 		dec(calib->ofdm_x4,     1, limits->min_ofdm_x4);
6233 		dec(calib->ofdm_mrc_x4, 1, limits->min_ofdm_mrc_x4);
6234 	}
6235 
6236 	/* Compute maximum noise among 3 receivers. */
6237 	for (i = 0; i < 3; i++)
6238 		noise[i] = (le32toh(stats->general.noise[i]) >> 8) & 0xff;
6239 	val = MAX(noise[0], noise[1]);
6240 	val = MAX(noise[2], val);
6241 	/* Insert it into our samples table. */
6242 	calib->noise_samples[calib->cur_noise_sample] = val;
6243 	calib->cur_noise_sample = (calib->cur_noise_sample + 1) % 20;
6244 
6245 	/* Compute maximum noise among last 20 samples. */
6246 	noise_ref = calib->noise_samples[0];
6247 	for (i = 1; i < 20; i++)
6248 		noise_ref = MAX(noise_ref, calib->noise_samples[i]);
6249 
6250 	/* Compute maximum energy among 3 receivers. */
6251 	for (i = 0; i < 3; i++)
6252 		energy[i] = le32toh(stats->general.energy[i]);
6253 	val = MIN(energy[0], energy[1]);
6254 	val = MIN(energy[2], val);
6255 	/* Insert it into our samples table. */
6256 	calib->energy_samples[calib->cur_energy_sample] = val;
6257 	calib->cur_energy_sample = (calib->cur_energy_sample + 1) % 10;
6258 
6259 	/* Compute minimum energy among last 10 samples. */
6260 	energy_min = calib->energy_samples[0];
6261 	for (i = 1; i < 10; i++)
6262 		energy_min = MAX(energy_min, calib->energy_samples[i]);
6263 	energy_min += 6;
6264 
6265 	/* Compute number of false alarms since last call for CCK. */
6266 	fa  = le32toh(stats->cck.bad_plcp) - calib->bad_plcp_cck;
6267 	fa += le32toh(stats->cck.fa) - calib->fa_cck;
6268 	fa *= 200 * IEEE80211_DUR_TU;	/* 200TU */
6269 
6270 	if (fa > 50 * rxena) {
6271 		/* High false alarm count, decrease sensitivity. */
6272 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6273 		    "%s: CCK high false alarm count: %u\n", __func__, fa);
6274 		calib->cck_state = IWN_CCK_STATE_HIFA;
6275 		calib->low_fa = 0;
6276 
6277 		if (calib->cck_x4 > 160) {
6278 			calib->noise_ref = noise_ref;
6279 			if (calib->energy_cck > 2)
6280 				dec(calib->energy_cck, 2, energy_min);
6281 		}
6282 		if (calib->cck_x4 < 160) {
6283 			calib->cck_x4 = 161;
6284 			needs_update = 1;
6285 		} else
6286 			inc(calib->cck_x4, 3, limits->max_cck_x4);
6287 
6288 		inc(calib->cck_mrc_x4, 3, limits->max_cck_mrc_x4);
6289 
6290 	} else if (fa < 5 * rxena) {
6291 		/* Low false alarm count, increase sensitivity. */
6292 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6293 		    "%s: CCK low false alarm count: %u\n", __func__, fa);
6294 		calib->cck_state = IWN_CCK_STATE_LOFA;
6295 		calib->low_fa++;
6296 
6297 		if (calib->cck_state != IWN_CCK_STATE_INIT &&
6298 		    (((int32_t)calib->noise_ref - (int32_t)noise_ref) > 2 ||
6299 		     calib->low_fa > 100)) {
6300 			inc(calib->energy_cck, 2, limits->min_energy_cck);
6301 			dec(calib->cck_x4,     3, limits->min_cck_x4);
6302 			dec(calib->cck_mrc_x4, 3, limits->min_cck_mrc_x4);
6303 		}
6304 	} else {
6305 		/* Not worth to increase or decrease sensitivity. */
6306 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6307 		    "%s: CCK normal false alarm count: %u\n", __func__, fa);
6308 		calib->low_fa = 0;
6309 		calib->noise_ref = noise_ref;
6310 
6311 		if (calib->cck_state == IWN_CCK_STATE_HIFA) {
6312 			/* Previous interval had many false alarms. */
6313 			dec(calib->energy_cck, 8, energy_min);
6314 		}
6315 		calib->cck_state = IWN_CCK_STATE_INIT;
6316 	}
6317 
6318 	if (needs_update)
6319 		(void)iwn_send_sensitivity(sc);
6320 
6321 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
6322 
6323 #undef dec
6324 #undef inc
6325 }
6326 
6327 static int
6328 iwn_send_sensitivity(struct iwn_softc *sc)
6329 {
6330 	struct iwn_calib_state *calib = &sc->calib;
6331 	struct iwn_enhanced_sensitivity_cmd cmd;
6332 	int len;
6333 
6334 	memset(&cmd, 0, sizeof cmd);
6335 	len = sizeof (struct iwn_sensitivity_cmd);
6336 	cmd.which = IWN_SENSITIVITY_WORKTBL;
6337 	/* OFDM modulation. */
6338 	cmd.corr_ofdm_x1       = htole16(calib->ofdm_x1);
6339 	cmd.corr_ofdm_mrc_x1   = htole16(calib->ofdm_mrc_x1);
6340 	cmd.corr_ofdm_x4       = htole16(calib->ofdm_x4);
6341 	cmd.corr_ofdm_mrc_x4   = htole16(calib->ofdm_mrc_x4);
6342 	cmd.energy_ofdm        = htole16(sc->limits->energy_ofdm);
6343 	cmd.energy_ofdm_th     = htole16(62);
6344 	/* CCK modulation. */
6345 	cmd.corr_cck_x4        = htole16(calib->cck_x4);
6346 	cmd.corr_cck_mrc_x4    = htole16(calib->cck_mrc_x4);
6347 	cmd.energy_cck         = htole16(calib->energy_cck);
6348 	/* Barker modulation: use default values. */
6349 	cmd.corr_barker        = htole16(190);
6350 	cmd.corr_barker_mrc    = htole16(sc->limits->barker_mrc);
6351 
6352 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6353 	    "%s: set sensitivity %d/%d/%d/%d/%d/%d/%d\n", __func__,
6354 	    calib->ofdm_x1, calib->ofdm_mrc_x1, calib->ofdm_x4,
6355 	    calib->ofdm_mrc_x4, calib->cck_x4,
6356 	    calib->cck_mrc_x4, calib->energy_cck);
6357 
6358 	if (!(sc->sc_flags & IWN_FLAG_ENH_SENS))
6359 		goto send;
6360 	/* Enhanced sensitivity settings. */
6361 	len = sizeof (struct iwn_enhanced_sensitivity_cmd);
6362 	cmd.ofdm_det_slope_mrc = htole16(668);
6363 	cmd.ofdm_det_icept_mrc = htole16(4);
6364 	cmd.ofdm_det_slope     = htole16(486);
6365 	cmd.ofdm_det_icept     = htole16(37);
6366 	cmd.cck_det_slope_mrc  = htole16(853);
6367 	cmd.cck_det_icept_mrc  = htole16(4);
6368 	cmd.cck_det_slope      = htole16(476);
6369 	cmd.cck_det_icept      = htole16(99);
6370 send:
6371 	return iwn_cmd(sc, IWN_CMD_SET_SENSITIVITY, &cmd, len, 1);
6372 }
6373 
6374 /*
6375  * Look at the increase of PLCP errors over time; if it exceeds
6376  * a programmed threshold then trigger an RF retune.
6377  */
6378 static void
6379 iwn_check_rx_recovery(struct iwn_softc *sc, struct iwn_stats *rs)
6380 {
6381 	int32_t delta_ofdm, delta_ht, delta_cck;
6382 	struct iwn_calib_state *calib = &sc->calib;
6383 	int delta_ticks, cur_ticks;
6384 	int delta_msec;
6385 	int thresh;
6386 
6387 	/*
6388 	 * Calculate the difference between the current and
6389 	 * previous statistics.
6390 	 */
6391 	delta_cck = le32toh(rs->rx.cck.bad_plcp) - calib->bad_plcp_cck;
6392 	delta_ofdm = le32toh(rs->rx.ofdm.bad_plcp) - calib->bad_plcp_ofdm;
6393 	delta_ht = le32toh(rs->rx.ht.bad_plcp) - calib->bad_plcp_ht;
6394 
6395 	/*
6396 	 * Calculate the delta in time between successive statistics
6397 	 * messages.  Yes, it can roll over; so we make sure that
6398 	 * this doesn't happen.
6399 	 *
6400 	 * XXX go figure out what to do about rollover
6401 	 * XXX go figure out what to do if ticks rolls over to -ve instead!
6402 	 * XXX go stab signed integer overflow undefined-ness in the face.
6403 	 */
6404 	cur_ticks = ticks;
6405 	delta_ticks = cur_ticks - sc->last_calib_ticks;
6406 
6407 	/*
6408 	 * If any are negative, then the firmware likely reset; so just
6409 	 * bail.  We'll pick this up next time.
6410 	 */
6411 	if (delta_cck < 0 || delta_ofdm < 0 || delta_ht < 0 || delta_ticks < 0)
6412 		return;
6413 
6414 	/*
6415 	 * delta_ticks is in ticks; we need to convert it up to milliseconds
6416 	 * so we can do some useful math with it.
6417 	 */
6418 	delta_msec = ticks_to_msecs(delta_ticks);
6419 
6420 	/*
6421 	 * Calculate what our threshold is given the current delta_msec.
6422 	 */
6423 	thresh = sc->base_params->plcp_err_threshold * delta_msec;
6424 
6425 	DPRINTF(sc, IWN_DEBUG_STATE,
6426 	    "%s: time delta: %d; cck=%d, ofdm=%d, ht=%d, total=%d, thresh=%d\n",
6427 	    __func__,
6428 	    delta_msec,
6429 	    delta_cck,
6430 	    delta_ofdm,
6431 	    delta_ht,
6432 	    (delta_msec + delta_cck + delta_ofdm + delta_ht),
6433 	    thresh);
6434 
6435 	/*
6436 	 * If we need a retune, then schedule a single channel scan
6437 	 * to a channel that isn't the currently active one!
6438 	 *
6439 	 * The math from linux iwlwifi:
6440 	 *
6441 	 * if ((delta * 100 / msecs) > threshold)
6442 	 */
6443 	if (thresh > 0 && (delta_cck + delta_ofdm + delta_ht) * 100 > thresh) {
6444 		DPRINTF(sc, IWN_DEBUG_ANY,
6445 		    "%s: PLCP error threshold raw (%d) comparison (%d) "
6446 		    "over limit (%d); retune!\n",
6447 		    __func__,
6448 		    (delta_cck + delta_ofdm + delta_ht),
6449 		    (delta_cck + delta_ofdm + delta_ht) * 100,
6450 		    thresh);
6451 	}
6452 }
6453 
6454 /*
6455  * Set STA mode power saving level (between 0 and 5).
6456  * Level 0 is CAM (Continuously Aware Mode), 5 is for maximum power saving.
6457  */
6458 static int
6459 iwn_set_pslevel(struct iwn_softc *sc, int dtim, int level, int async)
6460 {
6461 	struct iwn_pmgt_cmd cmd;
6462 	const struct iwn_pmgt *pmgt;
6463 	uint32_t max, skip_dtim;
6464 	uint32_t reg;
6465 	int i;
6466 
6467 	DPRINTF(sc, IWN_DEBUG_PWRSAVE,
6468 	    "%s: dtim=%d, level=%d, async=%d\n",
6469 	    __func__,
6470 	    dtim,
6471 	    level,
6472 	    async);
6473 
6474 	/* Select which PS parameters to use. */
6475 	if (dtim <= 2)
6476 		pmgt = &iwn_pmgt[0][level];
6477 	else if (dtim <= 10)
6478 		pmgt = &iwn_pmgt[1][level];
6479 	else
6480 		pmgt = &iwn_pmgt[2][level];
6481 
6482 	memset(&cmd, 0, sizeof cmd);
6483 	if (level != 0)	/* not CAM */
6484 		cmd.flags |= htole16(IWN_PS_ALLOW_SLEEP);
6485 	if (level == 5)
6486 		cmd.flags |= htole16(IWN_PS_FAST_PD);
6487 	/* Retrieve PCIe Active State Power Management (ASPM). */
6488 	reg = pci_read_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, 4);
6489 	if (!(reg & PCIEM_LINK_CTL_ASPMC_L0S))	/* L0s Entry disabled. */
6490 		cmd.flags |= htole16(IWN_PS_PCI_PMGT);
6491 	cmd.rxtimeout = htole32(pmgt->rxtimeout * 1024);
6492 	cmd.txtimeout = htole32(pmgt->txtimeout * 1024);
6493 
6494 	if (dtim == 0) {
6495 		dtim = 1;
6496 		skip_dtim = 0;
6497 	} else
6498 		skip_dtim = pmgt->skip_dtim;
6499 	if (skip_dtim != 0) {
6500 		cmd.flags |= htole16(IWN_PS_SLEEP_OVER_DTIM);
6501 		max = pmgt->intval[4];
6502 		if (max == (uint32_t)-1)
6503 			max = dtim * (skip_dtim + 1);
6504 		else if (max > dtim)
6505 			max = rounddown(max, dtim);
6506 	} else
6507 		max = dtim;
6508 	for (i = 0; i < 5; i++)
6509 		cmd.intval[i] = htole32(MIN(max, pmgt->intval[i]));
6510 
6511 	DPRINTF(sc, IWN_DEBUG_RESET, "setting power saving level to %d\n",
6512 	    level);
6513 	return iwn_cmd(sc, IWN_CMD_SET_POWER_MODE, &cmd, sizeof cmd, async);
6514 }
6515 
6516 static int
6517 iwn_send_btcoex(struct iwn_softc *sc)
6518 {
6519 	struct iwn_bluetooth cmd;
6520 
6521 	memset(&cmd, 0, sizeof cmd);
6522 	cmd.flags = IWN_BT_COEX_CHAN_ANN | IWN_BT_COEX_BT_PRIO;
6523 	cmd.lead_time = IWN_BT_LEAD_TIME_DEF;
6524 	cmd.max_kill = IWN_BT_MAX_KILL_DEF;
6525 	DPRINTF(sc, IWN_DEBUG_RESET, "%s: configuring bluetooth coexistence\n",
6526 	    __func__);
6527 	return iwn_cmd(sc, IWN_CMD_BT_COEX, &cmd, sizeof(cmd), 0);
6528 }
6529 
6530 static int
6531 iwn_send_advanced_btcoex(struct iwn_softc *sc)
6532 {
6533 	static const uint32_t btcoex_3wire[12] = {
6534 		0xaaaaaaaa, 0xaaaaaaaa, 0xaeaaaaaa, 0xaaaaaaaa,
6535 		0xcc00ff28, 0x0000aaaa, 0xcc00aaaa, 0x0000aaaa,
6536 		0xc0004000, 0x00004000, 0xf0005000, 0xf0005000,
6537 	};
6538 	struct iwn6000_btcoex_config btconfig;
6539 	struct iwn2000_btcoex_config btconfig2k;
6540 	struct iwn_btcoex_priotable btprio;
6541 	struct iwn_btcoex_prot btprot;
6542 	int error, i;
6543 	uint8_t flags;
6544 
6545 	memset(&btconfig, 0, sizeof btconfig);
6546 	memset(&btconfig2k, 0, sizeof btconfig2k);
6547 
6548 	flags = IWN_BT_FLAG_COEX6000_MODE_3W <<
6549 	    IWN_BT_FLAG_COEX6000_MODE_SHIFT; // Done as is in linux kernel 3.2
6550 
6551 	if (sc->base_params->bt_sco_disable)
6552 		flags &= ~IWN_BT_FLAG_SYNC_2_BT_DISABLE;
6553 	else
6554 		flags |= IWN_BT_FLAG_SYNC_2_BT_DISABLE;
6555 
6556 	flags |= IWN_BT_FLAG_COEX6000_CHAN_INHIBITION;
6557 
6558 	/* Default flags result is 145 as old value */
6559 
6560 	/*
6561 	 * Flags value has to be review. Values must change if we
6562 	 * which to disable it
6563 	 */
6564 	if (sc->base_params->bt_session_2) {
6565 		btconfig2k.flags = flags;
6566 		btconfig2k.max_kill = 5;
6567 		btconfig2k.bt3_t7_timer = 1;
6568 		btconfig2k.kill_ack = htole32(0xffff0000);
6569 		btconfig2k.kill_cts = htole32(0xffff0000);
6570 		btconfig2k.sample_time = 2;
6571 		btconfig2k.bt3_t2_timer = 0xc;
6572 
6573 		for (i = 0; i < 12; i++)
6574 			btconfig2k.lookup_table[i] = htole32(btcoex_3wire[i]);
6575 		btconfig2k.valid = htole16(0xff);
6576 		btconfig2k.prio_boost = htole32(0xf0);
6577 		DPRINTF(sc, IWN_DEBUG_RESET,
6578 		    "%s: configuring advanced bluetooth coexistence"
6579 		    " session 2, flags : 0x%x\n",
6580 		    __func__,
6581 		    flags);
6582 		error = iwn_cmd(sc, IWN_CMD_BT_COEX, &btconfig2k,
6583 		    sizeof(btconfig2k), 1);
6584 	} else {
6585 		btconfig.flags = flags;
6586 		btconfig.max_kill = 5;
6587 		btconfig.bt3_t7_timer = 1;
6588 		btconfig.kill_ack = htole32(0xffff0000);
6589 		btconfig.kill_cts = htole32(0xffff0000);
6590 		btconfig.sample_time = 2;
6591 		btconfig.bt3_t2_timer = 0xc;
6592 
6593 		for (i = 0; i < 12; i++)
6594 			btconfig.lookup_table[i] = htole32(btcoex_3wire[i]);
6595 		btconfig.valid = htole16(0xff);
6596 		btconfig.prio_boost = 0xf0;
6597 		DPRINTF(sc, IWN_DEBUG_RESET,
6598 		    "%s: configuring advanced bluetooth coexistence,"
6599 		    " flags : 0x%x\n",
6600 		    __func__,
6601 		    flags);
6602 		error = iwn_cmd(sc, IWN_CMD_BT_COEX, &btconfig,
6603 		    sizeof(btconfig), 1);
6604 	}
6605 
6606 	if (error != 0)
6607 		return error;
6608 
6609 	memset(&btprio, 0, sizeof btprio);
6610 	btprio.calib_init1 = 0x6;
6611 	btprio.calib_init2 = 0x7;
6612 	btprio.calib_periodic_low1 = 0x2;
6613 	btprio.calib_periodic_low2 = 0x3;
6614 	btprio.calib_periodic_high1 = 0x4;
6615 	btprio.calib_periodic_high2 = 0x5;
6616 	btprio.dtim = 0x6;
6617 	btprio.scan52 = 0x8;
6618 	btprio.scan24 = 0xa;
6619 	error = iwn_cmd(sc, IWN_CMD_BT_COEX_PRIOTABLE, &btprio, sizeof(btprio),
6620 	    1);
6621 	if (error != 0)
6622 		return error;
6623 
6624 	/* Force BT state machine change. */
6625 	memset(&btprot, 0, sizeof btprot);
6626 	btprot.open = 1;
6627 	btprot.type = 1;
6628 	error = iwn_cmd(sc, IWN_CMD_BT_COEX_PROT, &btprot, sizeof(btprot), 1);
6629 	if (error != 0)
6630 		return error;
6631 	btprot.open = 0;
6632 	return iwn_cmd(sc, IWN_CMD_BT_COEX_PROT, &btprot, sizeof(btprot), 1);
6633 }
6634 
6635 static int
6636 iwn5000_runtime_calib(struct iwn_softc *sc)
6637 {
6638 	struct iwn5000_calib_config cmd;
6639 
6640 	memset(&cmd, 0, sizeof cmd);
6641 	cmd.ucode.once.enable = 0xffffffff;
6642 	cmd.ucode.once.start = IWN5000_CALIB_DC;
6643 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6644 	    "%s: configuring runtime calibration\n", __func__);
6645 	return iwn_cmd(sc, IWN5000_CMD_CALIB_CONFIG, &cmd, sizeof(cmd), 0);
6646 }
6647 
6648 static uint32_t
6649 iwn_get_rxon_ht_flags(struct iwn_softc *sc, struct ieee80211vap *vap,
6650     struct ieee80211_channel *c)
6651 {
6652 	uint32_t htflags = 0;
6653 
6654 	if (! IEEE80211_IS_CHAN_HT(c))
6655 		return (0);
6656 
6657 	htflags |= IWN_RXON_HT_PROTMODE(vap->iv_curhtprotmode);
6658 
6659 	if (IEEE80211_IS_CHAN_HT40(c)) {
6660 		switch (vap->iv_curhtprotmode) {
6661 		case IEEE80211_HTINFO_OPMODE_HT20PR:
6662 			htflags |= IWN_RXON_HT_MODEPURE40;
6663 			break;
6664 		default:
6665 			htflags |= IWN_RXON_HT_MODEMIXED;
6666 			break;
6667 		}
6668 	}
6669 	if (IEEE80211_IS_CHAN_HT40D(c))
6670 		htflags |= IWN_RXON_HT_HT40MINUS;
6671 
6672 	return (htflags);
6673 }
6674 
6675 static int
6676 iwn_check_bss_filter(struct iwn_softc *sc)
6677 {
6678 	return ((sc->rxon->filter & htole32(IWN_FILTER_BSS)) != 0);
6679 }
6680 
6681 static int
6682 iwn4965_rxon_assoc(struct iwn_softc *sc, int async)
6683 {
6684 	struct iwn4965_rxon_assoc cmd;
6685 	struct iwn_rxon *rxon = sc->rxon;
6686 
6687 	cmd.flags = rxon->flags;
6688 	cmd.filter = rxon->filter;
6689 	cmd.ofdm_mask = rxon->ofdm_mask;
6690 	cmd.cck_mask = rxon->cck_mask;
6691 	cmd.ht_single_mask = rxon->ht_single_mask;
6692 	cmd.ht_dual_mask = rxon->ht_dual_mask;
6693 	cmd.rxchain = rxon->rxchain;
6694 	cmd.reserved = 0;
6695 
6696 	return (iwn_cmd(sc, IWN_CMD_RXON_ASSOC, &cmd, sizeof(cmd), async));
6697 }
6698 
6699 static int
6700 iwn5000_rxon_assoc(struct iwn_softc *sc, int async)
6701 {
6702 	struct iwn5000_rxon_assoc cmd;
6703 	struct iwn_rxon *rxon = sc->rxon;
6704 
6705 	cmd.flags = rxon->flags;
6706 	cmd.filter = rxon->filter;
6707 	cmd.ofdm_mask = rxon->ofdm_mask;
6708 	cmd.cck_mask = rxon->cck_mask;
6709 	cmd.reserved1 = 0;
6710 	cmd.ht_single_mask = rxon->ht_single_mask;
6711 	cmd.ht_dual_mask = rxon->ht_dual_mask;
6712 	cmd.ht_triple_mask = rxon->ht_triple_mask;
6713 	cmd.reserved2 = 0;
6714 	cmd.rxchain = rxon->rxchain;
6715 	cmd.acquisition = rxon->acquisition;
6716 	cmd.reserved3 = 0;
6717 
6718 	return (iwn_cmd(sc, IWN_CMD_RXON_ASSOC, &cmd, sizeof(cmd), async));
6719 }
6720 
6721 static int
6722 iwn_send_rxon(struct iwn_softc *sc, int assoc, int async)
6723 {
6724 	struct iwn_ops *ops = &sc->ops;
6725 	int error;
6726 
6727 	IWN_LOCK_ASSERT(sc);
6728 
6729 	if (assoc && iwn_check_bss_filter(sc) != 0) {
6730 		error = ops->rxon_assoc(sc, async);
6731 		if (error != 0) {
6732 			device_printf(sc->sc_dev,
6733 			    "%s: RXON_ASSOC command failed, error %d\n",
6734 			    __func__, error);
6735 			return (error);
6736 		}
6737 	} else {
6738 		if (sc->sc_is_scanning)
6739 			device_printf(sc->sc_dev,
6740 			    "%s: is_scanning set, before RXON\n",
6741 			    __func__);
6742 
6743 		error = iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, async);
6744 		if (error != 0) {
6745 			device_printf(sc->sc_dev,
6746 			    "%s: RXON command failed, error %d\n",
6747 			    __func__, error);
6748 			return (error);
6749 		}
6750 
6751 		/*
6752 		 * Reconfiguring RXON clears the firmware nodes table so
6753 		 * we must add the broadcast node again.
6754 		 */
6755 		if (iwn_check_bss_filter(sc) == 0 &&
6756 		    (error = iwn_add_broadcast_node(sc, async)) != 0) {
6757 			device_printf(sc->sc_dev,
6758 			    "%s: could not add broadcast node, error %d\n",
6759 			    __func__, error);
6760 			return (error);
6761 		}
6762 	}
6763 
6764 	/* Configuration has changed, set TX power accordingly. */
6765 	if ((error = ops->set_txpower(sc, async)) != 0) {
6766 		device_printf(sc->sc_dev,
6767 		    "%s: could not set TX power, error %d\n",
6768 		    __func__, error);
6769 		return (error);
6770 	}
6771 
6772 	return (0);
6773 }
6774 
6775 static int
6776 iwn_config(struct iwn_softc *sc)
6777 {
6778 	struct ieee80211com *ic = &sc->sc_ic;
6779 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
6780 	const uint8_t *macaddr;
6781 	uint32_t txmask;
6782 	uint16_t rxchain;
6783 	int error;
6784 
6785 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
6786 
6787 	if ((sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSET)
6788 	    && (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2)) {
6789 		device_printf(sc->sc_dev,"%s: temp_offset and temp_offsetv2 are"
6790 		    " exclusive each together. Review NIC config file. Conf"
6791 		    " :  0x%08x Flags :  0x%08x  \n", __func__,
6792 		    sc->base_params->calib_need,
6793 		    (IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSET |
6794 		    IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2));
6795 		return (EINVAL);
6796 	}
6797 
6798 	/* Compute temperature calib if needed. Will be send by send calib */
6799 	if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSET) {
6800 		error = iwn5000_temp_offset_calib(sc);
6801 		if (error != 0) {
6802 			device_printf(sc->sc_dev,
6803 			    "%s: could not set temperature offset\n", __func__);
6804 			return (error);
6805 		}
6806 	} else if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2) {
6807 		error = iwn5000_temp_offset_calibv2(sc);
6808 		if (error != 0) {
6809 			device_printf(sc->sc_dev,
6810 			    "%s: could not compute temperature offset v2\n",
6811 			    __func__);
6812 			return (error);
6813 		}
6814 	}
6815 
6816 	if (sc->hw_type == IWN_HW_REV_TYPE_6050) {
6817 		/* Configure runtime DC calibration. */
6818 		error = iwn5000_runtime_calib(sc);
6819 		if (error != 0) {
6820 			device_printf(sc->sc_dev,
6821 			    "%s: could not configure runtime calibration\n",
6822 			    __func__);
6823 			return error;
6824 		}
6825 	}
6826 
6827 	/* Configure valid TX chains for >=5000 Series. */
6828 	if (sc->hw_type != IWN_HW_REV_TYPE_4965 &&
6829 	    IWN_UCODE_API(sc->ucode_rev) > 1) {
6830 		txmask = htole32(sc->txchainmask);
6831 		DPRINTF(sc, IWN_DEBUG_RESET | IWN_DEBUG_XMIT,
6832 		    "%s: configuring valid TX chains 0x%x\n", __func__, txmask);
6833 		error = iwn_cmd(sc, IWN5000_CMD_TX_ANT_CONFIG, &txmask,
6834 		    sizeof txmask, 0);
6835 		if (error != 0) {
6836 			device_printf(sc->sc_dev,
6837 			    "%s: could not configure valid TX chains, "
6838 			    "error %d\n", __func__, error);
6839 			return error;
6840 		}
6841 	}
6842 
6843 	/* Configure bluetooth coexistence. */
6844 	error = 0;
6845 
6846 	/* Configure bluetooth coexistence if needed. */
6847 	if (sc->base_params->bt_mode == IWN_BT_ADVANCED)
6848 		error = iwn_send_advanced_btcoex(sc);
6849 	if (sc->base_params->bt_mode == IWN_BT_SIMPLE)
6850 		error = iwn_send_btcoex(sc);
6851 
6852 	if (error != 0) {
6853 		device_printf(sc->sc_dev,
6854 		    "%s: could not configure bluetooth coexistence, error %d\n",
6855 		    __func__, error);
6856 		return error;
6857 	}
6858 
6859 	/* Set mode, channel, RX filter and enable RX. */
6860 	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
6861 	memset(sc->rxon, 0, sizeof (struct iwn_rxon));
6862 	macaddr = vap ? vap->iv_myaddr : ic->ic_macaddr;
6863 	IEEE80211_ADDR_COPY(sc->rxon->myaddr, macaddr);
6864 	IEEE80211_ADDR_COPY(sc->rxon->wlap, macaddr);
6865 	sc->rxon->chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
6866 	sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
6867 	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
6868 		sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
6869 
6870 	sc->rxon->filter = htole32(IWN_FILTER_MULTICAST);
6871 	switch (ic->ic_opmode) {
6872 	case IEEE80211_M_STA:
6873 		sc->rxon->mode = IWN_MODE_STA;
6874 		break;
6875 	case IEEE80211_M_MONITOR:
6876 		sc->rxon->mode = IWN_MODE_MONITOR;
6877 		break;
6878 	default:
6879 		/* Should not get there. */
6880 		break;
6881 	}
6882 	iwn_set_promisc(sc);
6883 	sc->rxon->cck_mask  = 0x0f;	/* not yet negotiated */
6884 	sc->rxon->ofdm_mask = 0xff;	/* not yet negotiated */
6885 	sc->rxon->ht_single_mask = 0xff;
6886 	sc->rxon->ht_dual_mask = 0xff;
6887 	sc->rxon->ht_triple_mask = 0xff;
6888 	/*
6889 	 * In active association mode, ensure that
6890 	 * all the receive chains are enabled.
6891 	 *
6892 	 * Since we're not yet doing SMPS, don't allow the
6893 	 * number of idle RX chains to be less than the active
6894 	 * number.
6895 	 */
6896 	rxchain =
6897 	    IWN_RXCHAIN_VALID(sc->rxchainmask) |
6898 	    IWN_RXCHAIN_MIMO_COUNT(sc->nrxchains) |
6899 	    IWN_RXCHAIN_IDLE_COUNT(sc->nrxchains);
6900 	sc->rxon->rxchain = htole16(rxchain);
6901 	DPRINTF(sc, IWN_DEBUG_RESET | IWN_DEBUG_XMIT,
6902 	    "%s: rxchainmask=0x%x, nrxchains=%d\n",
6903 	    __func__,
6904 	    sc->rxchainmask,
6905 	    sc->nrxchains);
6906 
6907 	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, vap, ic->ic_curchan));
6908 
6909 	DPRINTF(sc, IWN_DEBUG_RESET,
6910 	    "%s: setting configuration; flags=0x%08x\n",
6911 	    __func__, le32toh(sc->rxon->flags));
6912 	if ((error = iwn_send_rxon(sc, 0, 0)) != 0) {
6913 		device_printf(sc->sc_dev, "%s: could not send RXON\n",
6914 		    __func__);
6915 		return error;
6916 	}
6917 
6918 	if ((error = iwn_set_critical_temp(sc)) != 0) {
6919 		device_printf(sc->sc_dev,
6920 		    "%s: could not set critical temperature\n", __func__);
6921 		return error;
6922 	}
6923 
6924 	/* Set power saving level to CAM during initialization. */
6925 	if ((error = iwn_set_pslevel(sc, 0, 0, 0)) != 0) {
6926 		device_printf(sc->sc_dev,
6927 		    "%s: could not set power saving level\n", __func__);
6928 		return error;
6929 	}
6930 
6931 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
6932 
6933 	return 0;
6934 }
6935 
6936 static uint16_t
6937 iwn_get_active_dwell_time(struct iwn_softc *sc,
6938     struct ieee80211_channel *c, uint8_t n_probes)
6939 {
6940 	/* No channel? Default to 2GHz settings */
6941 	if (c == NULL || IEEE80211_IS_CHAN_2GHZ(c)) {
6942 		return (IWN_ACTIVE_DWELL_TIME_2GHZ +
6943 		IWN_ACTIVE_DWELL_FACTOR_2GHZ * (n_probes + 1));
6944 	}
6945 
6946 	/* 5GHz dwell time */
6947 	return (IWN_ACTIVE_DWELL_TIME_5GHZ +
6948 	    IWN_ACTIVE_DWELL_FACTOR_5GHZ * (n_probes + 1));
6949 }
6950 
6951 /*
6952  * Limit the total dwell time to 85% of the beacon interval.
6953  *
6954  * Returns the dwell time in milliseconds.
6955  */
6956 static uint16_t
6957 iwn_limit_dwell(struct iwn_softc *sc, uint16_t dwell_time)
6958 {
6959 	struct ieee80211com *ic = &sc->sc_ic;
6960 	struct ieee80211vap *vap = NULL;
6961 	int bintval = 0;
6962 
6963 	/* bintval is in TU (1.024mS) */
6964 	if (! TAILQ_EMPTY(&ic->ic_vaps)) {
6965 		vap = TAILQ_FIRST(&ic->ic_vaps);
6966 		bintval = vap->iv_bss->ni_intval;
6967 	}
6968 
6969 	/*
6970 	 * If it's non-zero, we should calculate the minimum of
6971 	 * it and the DWELL_BASE.
6972 	 *
6973 	 * XXX Yes, the math should take into account that bintval
6974 	 * is 1.024mS, not 1mS..
6975 	 */
6976 	if (bintval > 0) {
6977 		DPRINTF(sc, IWN_DEBUG_SCAN,
6978 		    "%s: bintval=%d\n",
6979 		    __func__,
6980 		    bintval);
6981 		return (MIN(IWN_PASSIVE_DWELL_BASE, ((bintval * 85) / 100)));
6982 	}
6983 
6984 	/* No association context? Default */
6985 	return (IWN_PASSIVE_DWELL_BASE);
6986 }
6987 
6988 static uint16_t
6989 iwn_get_passive_dwell_time(struct iwn_softc *sc, struct ieee80211_channel *c)
6990 {
6991 	uint16_t passive;
6992 
6993 	if (c == NULL || IEEE80211_IS_CHAN_2GHZ(c)) {
6994 		passive = IWN_PASSIVE_DWELL_BASE + IWN_PASSIVE_DWELL_TIME_2GHZ;
6995 	} else {
6996 		passive = IWN_PASSIVE_DWELL_BASE + IWN_PASSIVE_DWELL_TIME_5GHZ;
6997 	}
6998 
6999 	/* Clamp to the beacon interval if we're associated */
7000 	return (iwn_limit_dwell(sc, passive));
7001 }
7002 
7003 static int
7004 iwn_scan(struct iwn_softc *sc, struct ieee80211vap *vap,
7005     struct ieee80211_scan_state *ss, struct ieee80211_channel *c)
7006 {
7007 	struct ieee80211com *ic = &sc->sc_ic;
7008 	struct ieee80211_node *ni = vap->iv_bss;
7009 	struct iwn_scan_hdr *hdr;
7010 	struct iwn_cmd_data *tx;
7011 	struct iwn_scan_essid *essid;
7012 	struct iwn_scan_chan *chan;
7013 	struct ieee80211_frame *wh;
7014 	struct ieee80211_rateset *rs;
7015 	uint8_t *buf, *frm;
7016 	uint16_t rxchain;
7017 	uint8_t txant;
7018 	int buflen, error;
7019 	int is_active;
7020 	uint16_t dwell_active, dwell_passive;
7021 	uint32_t scan_service_time;
7022 
7023 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
7024 
7025 	/*
7026 	 * We are absolutely not allowed to send a scan command when another
7027 	 * scan command is pending.
7028 	 */
7029 	if (sc->sc_is_scanning) {
7030 		device_printf(sc->sc_dev, "%s: called whilst scanning!\n",
7031 		    __func__);
7032 		return (EAGAIN);
7033 	}
7034 
7035 	/* Assign the scan channel */
7036 	c = ic->ic_curchan;
7037 
7038 	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
7039 	buf = malloc(IWN_SCAN_MAXSZ, M_DEVBUF, M_NOWAIT | M_ZERO);
7040 	if (buf == NULL) {
7041 		device_printf(sc->sc_dev,
7042 		    "%s: could not allocate buffer for scan command\n",
7043 		    __func__);
7044 		return ENOMEM;
7045 	}
7046 	hdr = (struct iwn_scan_hdr *)buf;
7047 	/*
7048 	 * Move to the next channel if no frames are received within 10ms
7049 	 * after sending the probe request.
7050 	 */
7051 	hdr->quiet_time = htole16(10);		/* timeout in milliseconds */
7052 	hdr->quiet_threshold = htole16(1);	/* min # of packets */
7053 	/*
7054 	 * Max needs to be greater than active and passive and quiet!
7055 	 * It's also in microseconds!
7056 	 */
7057 	hdr->max_svc = htole32(250 * 1024);
7058 
7059 	/*
7060 	 * Reset scan: interval=100
7061 	 * Normal scan: interval=becaon interval
7062 	 * suspend_time: 100 (TU)
7063 	 *
7064 	 */
7065 #if 0
7066 	extra = (100 /* suspend_time */ / 100 /* beacon interval */) << 22;
7067 	scan_service_time = extra | ((100 /* susp */ % 100 /* int */) * 1024);
7068 #else
7069 	scan_service_time = (4 << 22) | (100 * 1024);	/* Hardcode for now! */
7070 #endif
7071 	hdr->pause_svc = htole32(scan_service_time);
7072 
7073 	/* Select antennas for scanning. */
7074 	rxchain =
7075 	    IWN_RXCHAIN_VALID(sc->rxchainmask) |
7076 	    IWN_RXCHAIN_FORCE_MIMO_SEL(sc->rxchainmask) |
7077 	    IWN_RXCHAIN_DRIVER_FORCE;
7078 	if (IEEE80211_IS_CHAN_A(c) &&
7079 	    sc->hw_type == IWN_HW_REV_TYPE_4965) {
7080 		/* Ant A must be avoided in 5GHz because of an HW bug. */
7081 		rxchain |= IWN_RXCHAIN_FORCE_SEL(IWN_ANT_B);
7082 	} else	/* Use all available RX antennas. */
7083 		rxchain |= IWN_RXCHAIN_FORCE_SEL(sc->rxchainmask);
7084 	hdr->rxchain = htole16(rxchain);
7085 	hdr->filter = htole32(IWN_FILTER_MULTICAST | IWN_FILTER_BEACON);
7086 
7087 	tx = (struct iwn_cmd_data *)(hdr + 1);
7088 	tx->flags = htole32(IWN_TX_AUTO_SEQ);
7089 	tx->id = sc->broadcast_id;
7090 	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
7091 
7092 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
7093 		/* Send probe requests at 6Mbps. */
7094 		tx->rate = htole32(0xd);
7095 		rs = &ic->ic_sup_rates[IEEE80211_MODE_11A];
7096 	} else {
7097 		hdr->flags = htole32(IWN_RXON_24GHZ | IWN_RXON_AUTO);
7098 		if (sc->hw_type == IWN_HW_REV_TYPE_4965 &&
7099 		    sc->rxon->associd && sc->rxon->chan > 14)
7100 			tx->rate = htole32(0xd);
7101 		else {
7102 			/* Send probe requests at 1Mbps. */
7103 			tx->rate = htole32(10 | IWN_RFLAG_CCK);
7104 		}
7105 		rs = &ic->ic_sup_rates[IEEE80211_MODE_11G];
7106 	}
7107 	/* Use the first valid TX antenna. */
7108 	txant = IWN_LSB(sc->txchainmask);
7109 	tx->rate |= htole32(IWN_RFLAG_ANT(txant));
7110 
7111 	/*
7112 	 * Only do active scanning if we're announcing a probe request
7113 	 * for a given SSID (or more, if we ever add it to the driver.)
7114 	 */
7115 	is_active = 0;
7116 
7117 	/*
7118 	 * If we're scanning for a specific SSID, add it to the command.
7119 	 *
7120 	 * XXX maybe look at adding support for scanning multiple SSIDs?
7121 	 */
7122 	essid = (struct iwn_scan_essid *)(tx + 1);
7123 	if (ss != NULL) {
7124 		if (ss->ss_ssid[0].len != 0) {
7125 			essid[0].id = IEEE80211_ELEMID_SSID;
7126 			essid[0].len = ss->ss_ssid[0].len;
7127 			memcpy(essid[0].data, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
7128 		}
7129 
7130 		DPRINTF(sc, IWN_DEBUG_SCAN, "%s: ssid_len=%d, ssid=%*s\n",
7131 		    __func__,
7132 		    ss->ss_ssid[0].len,
7133 		    ss->ss_ssid[0].len,
7134 		    ss->ss_ssid[0].ssid);
7135 
7136 		if (ss->ss_nssid > 0)
7137 			is_active = 1;
7138 	}
7139 
7140 	/*
7141 	 * Build a probe request frame.  Most of the following code is a
7142 	 * copy & paste of what is done in net80211.
7143 	 */
7144 	wh = (struct ieee80211_frame *)(essid + 20);
7145 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
7146 	    IEEE80211_FC0_SUBTYPE_PROBE_REQ;
7147 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
7148 	IEEE80211_ADDR_COPY(wh->i_addr1, if_getbroadcastaddr(vap->iv_ifp));
7149 	IEEE80211_ADDR_COPY(wh->i_addr2, if_getlladdr(vap->iv_ifp));
7150 	IEEE80211_ADDR_COPY(wh->i_addr3, if_getbroadcastaddr(vap->iv_ifp));
7151 	*(uint16_t *)&wh->i_dur[0] = 0;	/* filled by HW */
7152 	*(uint16_t *)&wh->i_seq[0] = 0;	/* filled by HW */
7153 
7154 	frm = (uint8_t *)(wh + 1);
7155 	frm = ieee80211_add_ssid(frm, NULL, 0);
7156 	frm = ieee80211_add_rates(frm, rs);
7157 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
7158 		frm = ieee80211_add_xrates(frm, rs);
7159 	if (ic->ic_htcaps & IEEE80211_HTC_HT)
7160 		frm = ieee80211_add_htcap(frm, ni);
7161 
7162 	/* Set length of probe request. */
7163 	tx->len = htole16(frm - (uint8_t *)wh);
7164 
7165 	/*
7166 	 * If active scanning is requested but a certain channel is
7167 	 * marked passive, we can do active scanning if we detect
7168 	 * transmissions.
7169 	 *
7170 	 * There is an issue with some firmware versions that triggers
7171 	 * a sysassert on a "good CRC threshold" of zero (== disabled),
7172 	 * on a radar channel even though this means that we should NOT
7173 	 * send probes.
7174 	 *
7175 	 * The "good CRC threshold" is the number of frames that we
7176 	 * need to receive during our dwell time on a channel before
7177 	 * sending out probes -- setting this to a huge value will
7178 	 * mean we never reach it, but at the same time work around
7179 	 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
7180 	 * here instead of IWL_GOOD_CRC_TH_DISABLED.
7181 	 *
7182 	 * This was fixed in later versions along with some other
7183 	 * scan changes, and the threshold behaves as a flag in those
7184 	 * versions.
7185 	 */
7186 
7187 	/*
7188 	 * If we're doing active scanning, set the crc_threshold
7189 	 * to a suitable value.  This is different to active veruss
7190 	 * passive scanning depending upon the channel flags; the
7191 	 * firmware will obey that particular check for us.
7192 	 */
7193 	if (sc->tlv_feature_flags & IWN_UCODE_TLV_FLAGS_NEWSCAN)
7194 		hdr->crc_threshold = is_active ?
7195 		    IWN_GOOD_CRC_TH_DEFAULT : IWN_GOOD_CRC_TH_DISABLED;
7196 	else
7197 		hdr->crc_threshold = is_active ?
7198 		    IWN_GOOD_CRC_TH_DEFAULT : IWN_GOOD_CRC_TH_NEVER;
7199 
7200 	chan = (struct iwn_scan_chan *)frm;
7201 	chan->chan = htole16(ieee80211_chan2ieee(ic, c));
7202 	chan->flags = 0;
7203 	if (ss->ss_nssid > 0)
7204 		chan->flags |= htole32(IWN_CHAN_NPBREQS(1));
7205 	chan->dsp_gain = 0x6e;
7206 
7207 	/*
7208 	 * Set the passive/active flag depending upon the channel mode.
7209 	 * XXX TODO: take the is_active flag into account as well?
7210 	 */
7211 	if (c->ic_flags & IEEE80211_CHAN_PASSIVE)
7212 		chan->flags |= htole32(IWN_CHAN_PASSIVE);
7213 	else
7214 		chan->flags |= htole32(IWN_CHAN_ACTIVE);
7215 
7216 	/*
7217 	 * Calculate the active/passive dwell times.
7218 	 */
7219 
7220 	dwell_active = iwn_get_active_dwell_time(sc, c, ss->ss_nssid);
7221 	dwell_passive = iwn_get_passive_dwell_time(sc, c);
7222 
7223 	/* Make sure they're valid */
7224 	if (dwell_passive <= dwell_active)
7225 		dwell_passive = dwell_active + 1;
7226 
7227 	chan->active = htole16(dwell_active);
7228 	chan->passive = htole16(dwell_passive);
7229 
7230 	if (IEEE80211_IS_CHAN_5GHZ(c))
7231 		chan->rf_gain = 0x3b;
7232 	else
7233 		chan->rf_gain = 0x28;
7234 
7235 	DPRINTF(sc, IWN_DEBUG_STATE,
7236 	    "%s: chan %u flags 0x%x rf_gain 0x%x "
7237 	    "dsp_gain 0x%x active %d passive %d scan_svc_time %d crc 0x%x "
7238 	    "isactive=%d numssid=%d\n", __func__,
7239 	    chan->chan, chan->flags, chan->rf_gain, chan->dsp_gain,
7240 	    dwell_active, dwell_passive, scan_service_time,
7241 	    hdr->crc_threshold, is_active, ss->ss_nssid);
7242 
7243 	hdr->nchan++;
7244 	chan++;
7245 	buflen = (uint8_t *)chan - buf;
7246 	hdr->len = htole16(buflen);
7247 
7248 	if (sc->sc_is_scanning) {
7249 		device_printf(sc->sc_dev,
7250 		    "%s: called with is_scanning set!\n",
7251 		    __func__);
7252 	}
7253 	sc->sc_is_scanning = 1;
7254 
7255 	DPRINTF(sc, IWN_DEBUG_STATE, "sending scan command nchan=%d\n",
7256 	    hdr->nchan);
7257 	error = iwn_cmd(sc, IWN_CMD_SCAN, buf, buflen, 1);
7258 	free(buf, M_DEVBUF);
7259 	if (error == 0)
7260 		callout_reset(&sc->scan_timeout, 5*hz, iwn_scan_timeout, sc);
7261 
7262 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
7263 
7264 	return error;
7265 }
7266 
7267 static int
7268 iwn_auth(struct iwn_softc *sc, struct ieee80211vap *vap)
7269 {
7270 	struct ieee80211com *ic = &sc->sc_ic;
7271 	struct ieee80211_node *ni = vap->iv_bss;
7272 	int error;
7273 
7274 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
7275 
7276 	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
7277 	/* Update adapter configuration. */
7278 	IEEE80211_ADDR_COPY(sc->rxon->bssid, ni->ni_bssid);
7279 	sc->rxon->chan = ieee80211_chan2ieee(ic, ni->ni_chan);
7280 	sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
7281 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
7282 		sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
7283 
7284 	/*
7285 	 * We always set short slot on 5GHz channels.
7286 	 * We optionally set it for 2.4GHz channels.
7287 	 */
7288 	if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan))
7289 		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
7290 	else if (vap->iv_flags & IEEE80211_F_SHSLOT)
7291 		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
7292 
7293 	if (vap->iv_flags & IEEE80211_F_SHPREAMBLE)
7294 		sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
7295 	if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
7296 		sc->rxon->cck_mask  = 0;
7297 		sc->rxon->ofdm_mask = 0x15;
7298 	} else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
7299 		sc->rxon->cck_mask  = 0x03;
7300 		sc->rxon->ofdm_mask = 0;
7301 	} else {
7302 		/* Assume 802.11b/g. */
7303 		sc->rxon->cck_mask  = 0x03;
7304 		sc->rxon->ofdm_mask = 0x15;
7305 	}
7306 
7307 	/* try HT */
7308 	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, vap, ic->ic_curchan));
7309 
7310 	DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x cck %x ofdm %x\n",
7311 	    sc->rxon->chan, sc->rxon->flags, sc->rxon->cck_mask,
7312 	    sc->rxon->ofdm_mask);
7313 
7314 	if ((error = iwn_send_rxon(sc, 0, 1)) != 0) {
7315 		device_printf(sc->sc_dev, "%s: could not send RXON\n",
7316 		    __func__);
7317 		return (error);
7318 	}
7319 
7320 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
7321 
7322 	return (0);
7323 }
7324 
7325 static int
7326 iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
7327 {
7328 	struct iwn_ops *ops = &sc->ops;
7329 	struct ieee80211com *ic = &sc->sc_ic;
7330 	struct ieee80211_node *ni = vap->iv_bss;
7331 	struct iwn_node_info node;
7332 	int error;
7333 
7334 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
7335 
7336 	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
7337 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
7338 		/* Link LED blinks while monitoring. */
7339 		iwn_set_led(sc, IWN_LED_LINK, 5, 5);
7340 		return 0;
7341 	}
7342 	if ((error = iwn_set_timing(sc, ni)) != 0) {
7343 		device_printf(sc->sc_dev,
7344 		    "%s: could not set timing, error %d\n", __func__, error);
7345 		return error;
7346 	}
7347 
7348 	/* Update adapter configuration. */
7349 	IEEE80211_ADDR_COPY(sc->rxon->bssid, ni->ni_bssid);
7350 	sc->rxon->associd = htole16(IEEE80211_AID(ni->ni_associd));
7351 	sc->rxon->chan = ieee80211_chan2ieee(ic, ni->ni_chan);
7352 	sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
7353 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
7354 		sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
7355 
7356 	/* As previously - short slot only on 5GHz */
7357 	if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan))
7358 		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
7359 	else if (vap->iv_flags & IEEE80211_F_SHSLOT)
7360 		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
7361 
7362 	if (vap->iv_flags & IEEE80211_F_SHPREAMBLE)
7363 		sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
7364 	if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
7365 		sc->rxon->cck_mask  = 0;
7366 		sc->rxon->ofdm_mask = 0x15;
7367 	} else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
7368 		sc->rxon->cck_mask  = 0x03;
7369 		sc->rxon->ofdm_mask = 0;
7370 	} else {
7371 		/* Assume 802.11b/g. */
7372 		sc->rxon->cck_mask  = 0x0f;
7373 		sc->rxon->ofdm_mask = 0x15;
7374 	}
7375 	/* try HT */
7376 	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, vap, ni->ni_chan));
7377 	sc->rxon->filter |= htole32(IWN_FILTER_BSS);
7378 	DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x, curhtprotmode=%d\n",
7379 	    sc->rxon->chan, le32toh(sc->rxon->flags), vap->iv_curhtprotmode);
7380 
7381 	if ((error = iwn_send_rxon(sc, 0, 1)) != 0) {
7382 		device_printf(sc->sc_dev, "%s: could not send RXON\n",
7383 		    __func__);
7384 		return error;
7385 	}
7386 
7387 	/* Fake a join to initialize the TX rate. */
7388 	((struct iwn_node *)ni)->id = IWN_ID_BSS;
7389 	iwn_newassoc(ni, 1);
7390 
7391 	/* Add BSS node. */
7392 	memset(&node, 0, sizeof node);
7393 	IEEE80211_ADDR_COPY(node.macaddr, ni->ni_macaddr);
7394 	node.id = IWN_ID_BSS;
7395 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
7396 		switch (ni->ni_htcap & IEEE80211_HTCAP_SMPS) {
7397 		case IEEE80211_HTCAP_SMPS_ENA:
7398 			node.htflags |= htole32(IWN_SMPS_MIMO_DIS);
7399 			break;
7400 		case IEEE80211_HTCAP_SMPS_DYNAMIC:
7401 			node.htflags |= htole32(IWN_SMPS_MIMO_PROT);
7402 			break;
7403 		}
7404 		node.htflags |= htole32(IWN_AMDPU_SIZE_FACTOR(3) |
7405 		    IWN_AMDPU_DENSITY(5));	/* 4us */
7406 		if (IEEE80211_IS_CHAN_HT40(ni->ni_chan))
7407 			node.htflags |= htole32(IWN_NODE_HT40);
7408 	}
7409 	DPRINTF(sc, IWN_DEBUG_STATE, "%s: adding BSS node\n", __func__);
7410 	error = ops->add_node(sc, &node, 1);
7411 	if (error != 0) {
7412 		device_printf(sc->sc_dev,
7413 		    "%s: could not add BSS node, error %d\n", __func__, error);
7414 		return error;
7415 	}
7416 	DPRINTF(sc, IWN_DEBUG_STATE, "%s: setting link quality for node %d\n",
7417 	    __func__, node.id);
7418 	if ((error = iwn_set_link_quality(sc, ni)) != 0) {
7419 		device_printf(sc->sc_dev,
7420 		    "%s: could not setup link quality for node %d, error %d\n",
7421 		    __func__, node.id, error);
7422 		return error;
7423 	}
7424 
7425 	if ((error = iwn_init_sensitivity(sc)) != 0) {
7426 		device_printf(sc->sc_dev,
7427 		    "%s: could not set sensitivity, error %d\n", __func__,
7428 		    error);
7429 		return error;
7430 	}
7431 	/* Start periodic calibration timer. */
7432 	sc->calib.state = IWN_CALIB_STATE_ASSOC;
7433 	sc->calib_cnt = 0;
7434 	callout_reset(&sc->calib_to, msecs_to_ticks(500), iwn_calib_timeout,
7435 	    sc);
7436 
7437 	/* Link LED always on while associated. */
7438 	iwn_set_led(sc, IWN_LED_LINK, 0, 1);
7439 
7440 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
7441 
7442 	return 0;
7443 }
7444 
7445 /*
7446  * This function is called by upper layer when an ADDBA request is received
7447  * from another STA and before the ADDBA response is sent.
7448  */
7449 static int
7450 iwn_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
7451     int baparamset, int batimeout, int baseqctl)
7452 {
7453 	struct iwn_softc *sc = ni->ni_ic->ic_softc;
7454 	struct iwn_ops *ops = &sc->ops;
7455 	struct iwn_node *wn = (void *)ni;
7456 	struct iwn_node_info node;
7457 	uint16_t ssn;
7458 	uint8_t tid;
7459 	int error;
7460 
7461 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7462 
7463 	tid = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_TID);
7464 	ssn = _IEEE80211_MASKSHIFT(le16toh(baseqctl), IEEE80211_BASEQ_START);
7465 
7466 	if (wn->id == IWN_ID_UNDEFINED)
7467 		return (ENOENT);
7468 
7469 	memset(&node, 0, sizeof node);
7470 	node.id = wn->id;
7471 	node.control = IWN_NODE_UPDATE;
7472 	node.flags = IWN_FLAG_SET_ADDBA;
7473 	node.addba_tid = tid;
7474 	node.addba_ssn = htole16(ssn);
7475 	DPRINTF(sc, IWN_DEBUG_RECV, "ADDBA RA=%d TID=%d SSN=%d\n",
7476 	    wn->id, tid, ssn);
7477 	error = ops->add_node(sc, &node, 1);
7478 	if (error != 0)
7479 		return error;
7480 	return sc->sc_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
7481 }
7482 
7483 /*
7484  * This function is called by upper layer on teardown of an HT-immediate
7485  * Block Ack agreement (eg. uppon receipt of a DELBA frame).
7486  */
7487 static void
7488 iwn_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
7489 {
7490 	struct ieee80211com *ic = ni->ni_ic;
7491 	struct iwn_softc *sc = ic->ic_softc;
7492 	struct iwn_ops *ops = &sc->ops;
7493 	struct iwn_node *wn = (void *)ni;
7494 	struct iwn_node_info node;
7495 	uint8_t tid;
7496 
7497 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7498 
7499 	if (wn->id == IWN_ID_UNDEFINED)
7500 		goto end;
7501 
7502 	/* XXX: tid as an argument */
7503 	for (tid = 0; tid < WME_NUM_TID; tid++) {
7504 		if (&ni->ni_rx_ampdu[tid] == rap)
7505 			break;
7506 	}
7507 
7508 	memset(&node, 0, sizeof node);
7509 	node.id = wn->id;
7510 	node.control = IWN_NODE_UPDATE;
7511 	node.flags = IWN_FLAG_SET_DELBA;
7512 	node.delba_tid = tid;
7513 	DPRINTF(sc, IWN_DEBUG_RECV, "DELBA RA=%d TID=%d\n", wn->id, tid);
7514 	(void)ops->add_node(sc, &node, 1);
7515 end:
7516 	sc->sc_ampdu_rx_stop(ni, rap);
7517 }
7518 
7519 static int
7520 iwn_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
7521     int dialogtoken, int baparamset, int batimeout)
7522 {
7523 	struct iwn_softc *sc = ni->ni_ic->ic_softc;
7524 	int qid;
7525 
7526 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7527 
7528 	for (qid = sc->firstaggqueue; qid < sc->ntxqs; qid++) {
7529 		if (sc->qid2tap[qid] == NULL)
7530 			break;
7531 	}
7532 	if (qid == sc->ntxqs) {
7533 		DPRINTF(sc, IWN_DEBUG_XMIT, "%s: no free aggregation queue\n",
7534 		    __func__);
7535 		return 0;
7536 	}
7537 	tap->txa_private = malloc(sizeof(int), M_DEVBUF, M_NOWAIT);
7538 	if (tap->txa_private == NULL) {
7539 		device_printf(sc->sc_dev,
7540 		    "%s: failed to alloc TX aggregation structure\n", __func__);
7541 		return 0;
7542 	}
7543 	sc->qid2tap[qid] = tap;
7544 	*(int *)tap->txa_private = qid;
7545 	return sc->sc_addba_request(ni, tap, dialogtoken, baparamset,
7546 	    batimeout);
7547 }
7548 
7549 static int
7550 iwn_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
7551     int code, int baparamset, int batimeout)
7552 {
7553 	struct iwn_softc *sc = ni->ni_ic->ic_softc;
7554 	int qid = *(int *)tap->txa_private;
7555 	uint8_t tid = tap->txa_tid;
7556 	int ret;
7557 
7558 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7559 
7560 	if (code == IEEE80211_STATUS_SUCCESS) {
7561 		ni->ni_txseqs[tid] = tap->txa_start & 0xfff;
7562 		ret = iwn_ampdu_tx_start(ni->ni_ic, ni, tid);
7563 		if (ret != 1)
7564 			return ret;
7565 	} else {
7566 		sc->qid2tap[qid] = NULL;
7567 		free(tap->txa_private, M_DEVBUF);
7568 		tap->txa_private = NULL;
7569 	}
7570 	return sc->sc_addba_response(ni, tap, code, baparamset, batimeout);
7571 }
7572 
7573 /*
7574  * This function is called by upper layer when an ADDBA response is received
7575  * from another STA.
7576  */
7577 static int
7578 iwn_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
7579     uint8_t tid)
7580 {
7581 	struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[tid];
7582 	struct iwn_softc *sc = ni->ni_ic->ic_softc;
7583 	struct iwn_ops *ops = &sc->ops;
7584 	struct iwn_node *wn = (void *)ni;
7585 	struct iwn_node_info node;
7586 	int error, qid;
7587 
7588 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7589 
7590 	if (wn->id == IWN_ID_UNDEFINED)
7591 		return (0);
7592 
7593 	/* Enable TX for the specified RA/TID. */
7594 	wn->disable_tid &= ~(1 << tid);
7595 	memset(&node, 0, sizeof node);
7596 	node.id = wn->id;
7597 	node.control = IWN_NODE_UPDATE;
7598 	node.flags = IWN_FLAG_SET_DISABLE_TID;
7599 	node.disable_tid = htole16(wn->disable_tid);
7600 	error = ops->add_node(sc, &node, 1);
7601 	if (error != 0)
7602 		return 0;
7603 
7604 	if ((error = iwn_nic_lock(sc)) != 0)
7605 		return 0;
7606 	qid = *(int *)tap->txa_private;
7607 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: ra=%d tid=%d ssn=%d qid=%d\n",
7608 	    __func__, wn->id, tid, tap->txa_start, qid);
7609 	ops->ampdu_tx_start(sc, ni, qid, tid, tap->txa_start & 0xfff);
7610 	iwn_nic_unlock(sc);
7611 
7612 	iwn_set_link_quality(sc, ni);
7613 	return 1;
7614 }
7615 
7616 static void
7617 iwn_ampdu_tx_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
7618 {
7619 	struct iwn_softc *sc = ni->ni_ic->ic_softc;
7620 	struct iwn_ops *ops = &sc->ops;
7621 	uint8_t tid = tap->txa_tid;
7622 	int qid;
7623 
7624 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7625 
7626 	sc->sc_addba_stop(ni, tap);
7627 
7628 	if (tap->txa_private == NULL)
7629 		return;
7630 
7631 	qid = *(int *)tap->txa_private;
7632 	if (sc->txq[qid].queued != 0)
7633 		return;
7634 	if (iwn_nic_lock(sc) != 0)
7635 		return;
7636 	ops->ampdu_tx_stop(sc, qid, tid, tap->txa_start & 0xfff);
7637 	iwn_nic_unlock(sc);
7638 	sc->qid2tap[qid] = NULL;
7639 	free(tap->txa_private, M_DEVBUF);
7640 	tap->txa_private = NULL;
7641 }
7642 
7643 static void
7644 iwn4965_ampdu_tx_start(struct iwn_softc *sc, struct ieee80211_node *ni,
7645     int qid, uint8_t tid, uint16_t ssn)
7646 {
7647 	struct iwn_node *wn = (void *)ni;
7648 
7649 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7650 
7651 	/* Stop TX scheduler while we're changing its configuration. */
7652 	iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7653 	    IWN4965_TXQ_STATUS_CHGACT);
7654 
7655 	/* Assign RA/TID translation to the queue. */
7656 	iwn_mem_write_2(sc, sc->sched_base + IWN4965_SCHED_TRANS_TBL(qid),
7657 	    wn->id << 4 | tid);
7658 
7659 	/* Enable chain-building mode for the queue. */
7660 	iwn_prph_setbits(sc, IWN4965_SCHED_QCHAIN_SEL, 1 << qid);
7661 
7662 	/* Set starting sequence number from the ADDBA request. */
7663 	sc->txq[qid].cur = sc->txq[qid].read = (ssn & 0xff);
7664 	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7665 	iwn_prph_write(sc, IWN4965_SCHED_QUEUE_RDPTR(qid), ssn);
7666 
7667 	/* Set scheduler window size. */
7668 	iwn_mem_write(sc, sc->sched_base + IWN4965_SCHED_QUEUE_OFFSET(qid),
7669 	    IWN_SCHED_WINSZ);
7670 	/* Set scheduler frame limit. */
7671 	iwn_mem_write(sc, sc->sched_base + IWN4965_SCHED_QUEUE_OFFSET(qid) + 4,
7672 	    IWN_SCHED_LIMIT << 16);
7673 
7674 	/* Enable interrupts for the queue. */
7675 	iwn_prph_setbits(sc, IWN4965_SCHED_INTR_MASK, 1 << qid);
7676 
7677 	/* Mark the queue as active. */
7678 	iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7679 	    IWN4965_TXQ_STATUS_ACTIVE | IWN4965_TXQ_STATUS_AGGR_ENA |
7680 	    iwn_tid2fifo[tid] << 1);
7681 }
7682 
7683 static void
7684 iwn4965_ampdu_tx_stop(struct iwn_softc *sc, int qid, uint8_t tid, uint16_t ssn)
7685 {
7686 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7687 
7688 	/* Stop TX scheduler while we're changing its configuration. */
7689 	iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7690 	    IWN4965_TXQ_STATUS_CHGACT);
7691 
7692 	/* Set starting sequence number from the ADDBA request. */
7693 	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7694 	iwn_prph_write(sc, IWN4965_SCHED_QUEUE_RDPTR(qid), ssn);
7695 
7696 	/* Disable interrupts for the queue. */
7697 	iwn_prph_clrbits(sc, IWN4965_SCHED_INTR_MASK, 1 << qid);
7698 
7699 	/* Mark the queue as inactive. */
7700 	iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7701 	    IWN4965_TXQ_STATUS_INACTIVE | iwn_tid2fifo[tid] << 1);
7702 }
7703 
7704 static void
7705 iwn5000_ampdu_tx_start(struct iwn_softc *sc, struct ieee80211_node *ni,
7706     int qid, uint8_t tid, uint16_t ssn)
7707 {
7708 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7709 
7710 	struct iwn_node *wn = (void *)ni;
7711 
7712 	/* Stop TX scheduler while we're changing its configuration. */
7713 	iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7714 	    IWN5000_TXQ_STATUS_CHGACT);
7715 
7716 	/* Assign RA/TID translation to the queue. */
7717 	iwn_mem_write_2(sc, sc->sched_base + IWN5000_SCHED_TRANS_TBL(qid),
7718 	    wn->id << 4 | tid);
7719 
7720 	/* Enable chain-building mode for the queue. */
7721 	iwn_prph_setbits(sc, IWN5000_SCHED_QCHAIN_SEL, 1 << qid);
7722 
7723 	/* Enable aggregation for the queue. */
7724 	iwn_prph_setbits(sc, IWN5000_SCHED_AGGR_SEL, 1 << qid);
7725 
7726 	/* Set starting sequence number from the ADDBA request. */
7727 	sc->txq[qid].cur = sc->txq[qid].read = (ssn & 0xff);
7728 	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7729 	iwn_prph_write(sc, IWN5000_SCHED_QUEUE_RDPTR(qid), ssn);
7730 
7731 	/* Set scheduler window size and frame limit. */
7732 	iwn_mem_write(sc, sc->sched_base + IWN5000_SCHED_QUEUE_OFFSET(qid) + 4,
7733 	    IWN_SCHED_LIMIT << 16 | IWN_SCHED_WINSZ);
7734 
7735 	/* Enable interrupts for the queue. */
7736 	iwn_prph_setbits(sc, IWN5000_SCHED_INTR_MASK, 1 << qid);
7737 
7738 	/* Mark the queue as active. */
7739 	iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7740 	    IWN5000_TXQ_STATUS_ACTIVE | iwn_tid2fifo[tid]);
7741 }
7742 
7743 static void
7744 iwn5000_ampdu_tx_stop(struct iwn_softc *sc, int qid, uint8_t tid, uint16_t ssn)
7745 {
7746 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7747 
7748 	/* Stop TX scheduler while we're changing its configuration. */
7749 	iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7750 	    IWN5000_TXQ_STATUS_CHGACT);
7751 
7752 	/* Disable aggregation for the queue. */
7753 	iwn_prph_clrbits(sc, IWN5000_SCHED_AGGR_SEL, 1 << qid);
7754 
7755 	/* Set starting sequence number from the ADDBA request. */
7756 	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7757 	iwn_prph_write(sc, IWN5000_SCHED_QUEUE_RDPTR(qid), ssn);
7758 
7759 	/* Disable interrupts for the queue. */
7760 	iwn_prph_clrbits(sc, IWN5000_SCHED_INTR_MASK, 1 << qid);
7761 
7762 	/* Mark the queue as inactive. */
7763 	iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7764 	    IWN5000_TXQ_STATUS_INACTIVE | iwn_tid2fifo[tid]);
7765 }
7766 
7767 /*
7768  * Query calibration tables from the initialization firmware.  We do this
7769  * only once at first boot.  Called from a process context.
7770  */
7771 static int
7772 iwn5000_query_calibration(struct iwn_softc *sc)
7773 {
7774 	struct iwn5000_calib_config cmd;
7775 	int error;
7776 
7777 	memset(&cmd, 0, sizeof cmd);
7778 	cmd.ucode.once.enable = htole32(0xffffffff);
7779 	cmd.ucode.once.start  = htole32(0xffffffff);
7780 	cmd.ucode.once.send   = htole32(0xffffffff);
7781 	cmd.ucode.flags       = htole32(0xffffffff);
7782 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: sending calibration query\n",
7783 	    __func__);
7784 	error = iwn_cmd(sc, IWN5000_CMD_CALIB_CONFIG, &cmd, sizeof cmd, 0);
7785 	if (error != 0)
7786 		return error;
7787 
7788 	/* Wait at most two seconds for calibration to complete. */
7789 	if (!(sc->sc_flags & IWN_FLAG_CALIB_DONE))
7790 		error = msleep(sc, &sc->sc_mtx, PCATCH, "iwncal", 2 * hz);
7791 	return error;
7792 }
7793 
7794 /*
7795  * Send calibration results to the runtime firmware.  These results were
7796  * obtained on first boot from the initialization firmware.
7797  */
7798 static int
7799 iwn5000_send_calibration(struct iwn_softc *sc)
7800 {
7801 	int idx, error;
7802 
7803 	for (idx = 0; idx < IWN5000_PHY_CALIB_MAX_RESULT; idx++) {
7804 		if (!(sc->base_params->calib_need & (1<<idx))) {
7805 			DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7806 			    "No need of calib %d\n",
7807 			    idx);
7808 			continue; /* no need for this calib */
7809 		}
7810 		if (sc->calibcmd[idx].buf == NULL) {
7811 			DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7812 			    "Need calib idx : %d but no available data\n",
7813 			    idx);
7814 			continue;
7815 		}
7816 
7817 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7818 		    "send calibration result idx=%d len=%d\n", idx,
7819 		    sc->calibcmd[idx].len);
7820 		error = iwn_cmd(sc, IWN_CMD_PHY_CALIB, sc->calibcmd[idx].buf,
7821 		    sc->calibcmd[idx].len, 0);
7822 		if (error != 0) {
7823 			device_printf(sc->sc_dev,
7824 			    "%s: could not send calibration result, error %d\n",
7825 			    __func__, error);
7826 			return error;
7827 		}
7828 	}
7829 	return 0;
7830 }
7831 
7832 static int
7833 iwn5000_send_wimax_coex(struct iwn_softc *sc)
7834 {
7835 	struct iwn5000_wimax_coex wimax;
7836 
7837 #if 0
7838 	if (sc->hw_type == IWN_HW_REV_TYPE_6050) {
7839 		/* Enable WiMAX coexistence for combo adapters. */
7840 		wimax.flags =
7841 		    IWN_WIMAX_COEX_ASSOC_WA_UNMASK |
7842 		    IWN_WIMAX_COEX_UNASSOC_WA_UNMASK |
7843 		    IWN_WIMAX_COEX_STA_TABLE_VALID |
7844 		    IWN_WIMAX_COEX_ENABLE;
7845 		memcpy(wimax.events, iwn6050_wimax_events,
7846 		    sizeof iwn6050_wimax_events);
7847 	} else
7848 #endif
7849 	{
7850 		/* Disable WiMAX coexistence. */
7851 		wimax.flags = 0;
7852 		memset(wimax.events, 0, sizeof wimax.events);
7853 	}
7854 	DPRINTF(sc, IWN_DEBUG_RESET, "%s: Configuring WiMAX coexistence\n",
7855 	    __func__);
7856 	return iwn_cmd(sc, IWN5000_CMD_WIMAX_COEX, &wimax, sizeof wimax, 0);
7857 }
7858 
7859 static int
7860 iwn5000_crystal_calib(struct iwn_softc *sc)
7861 {
7862 	struct iwn5000_phy_calib_crystal cmd;
7863 
7864 	memset(&cmd, 0, sizeof cmd);
7865 	cmd.code = IWN5000_PHY_CALIB_CRYSTAL;
7866 	cmd.ngroups = 1;
7867 	cmd.isvalid = 1;
7868 	cmd.cap_pin[0] = le32toh(sc->eeprom_crystal) & 0xff;
7869 	cmd.cap_pin[1] = (le32toh(sc->eeprom_crystal) >> 16) & 0xff;
7870 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "sending crystal calibration %d, %d\n",
7871 	    cmd.cap_pin[0], cmd.cap_pin[1]);
7872 	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
7873 }
7874 
7875 static int
7876 iwn5000_temp_offset_calib(struct iwn_softc *sc)
7877 {
7878 	struct iwn5000_phy_calib_temp_offset cmd;
7879 
7880 	memset(&cmd, 0, sizeof cmd);
7881 	cmd.code = IWN5000_PHY_CALIB_TEMP_OFFSET;
7882 	cmd.ngroups = 1;
7883 	cmd.isvalid = 1;
7884 	if (sc->eeprom_temp != 0)
7885 		cmd.offset = htole16(sc->eeprom_temp);
7886 	else
7887 		cmd.offset = htole16(IWN_DEFAULT_TEMP_OFFSET);
7888 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "setting radio sensor offset to %d\n",
7889 	    le16toh(cmd.offset));
7890 	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
7891 }
7892 
7893 static int
7894 iwn5000_temp_offset_calibv2(struct iwn_softc *sc)
7895 {
7896 	struct iwn5000_phy_calib_temp_offsetv2 cmd;
7897 
7898 	memset(&cmd, 0, sizeof cmd);
7899 	cmd.code = IWN5000_PHY_CALIB_TEMP_OFFSET;
7900 	cmd.ngroups = 1;
7901 	cmd.isvalid = 1;
7902 	if (sc->eeprom_temp != 0) {
7903 		cmd.offset_low = htole16(sc->eeprom_temp);
7904 		cmd.offset_high = htole16(sc->eeprom_temp_high);
7905 	} else {
7906 		cmd.offset_low = htole16(IWN_DEFAULT_TEMP_OFFSET);
7907 		cmd.offset_high = htole16(IWN_DEFAULT_TEMP_OFFSET);
7908 	}
7909 	cmd.burnt_voltage_ref = htole16(sc->eeprom_voltage);
7910 
7911 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7912 	    "setting radio sensor low offset to %d, high offset to %d, voltage to %d\n",
7913 	    le16toh(cmd.offset_low),
7914 	    le16toh(cmd.offset_high),
7915 	    le16toh(cmd.burnt_voltage_ref));
7916 
7917 	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
7918 }
7919 
7920 /*
7921  * This function is called after the runtime firmware notifies us of its
7922  * readiness (called in a process context).
7923  */
7924 static int
7925 iwn4965_post_alive(struct iwn_softc *sc)
7926 {
7927 	int error, qid;
7928 
7929 	if ((error = iwn_nic_lock(sc)) != 0)
7930 		return error;
7931 
7932 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7933 
7934 	/* Clear TX scheduler state in SRAM. */
7935 	sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
7936 	iwn_mem_set_region_4(sc, sc->sched_base + IWN4965_SCHED_CTX_OFF, 0,
7937 	    IWN4965_SCHED_CTX_LEN / sizeof (uint32_t));
7938 
7939 	/* Set physical address of TX scheduler rings (1KB aligned). */
7940 	iwn_prph_write(sc, IWN4965_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
7941 
7942 	IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
7943 
7944 	/* Disable chain mode for all our 16 queues. */
7945 	iwn_prph_write(sc, IWN4965_SCHED_QCHAIN_SEL, 0);
7946 
7947 	for (qid = 0; qid < IWN4965_NTXQUEUES; qid++) {
7948 		iwn_prph_write(sc, IWN4965_SCHED_QUEUE_RDPTR(qid), 0);
7949 		IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | 0);
7950 
7951 		/* Set scheduler window size. */
7952 		iwn_mem_write(sc, sc->sched_base +
7953 		    IWN4965_SCHED_QUEUE_OFFSET(qid), IWN_SCHED_WINSZ);
7954 		/* Set scheduler frame limit. */
7955 		iwn_mem_write(sc, sc->sched_base +
7956 		    IWN4965_SCHED_QUEUE_OFFSET(qid) + 4,
7957 		    IWN_SCHED_LIMIT << 16);
7958 	}
7959 
7960 	/* Enable interrupts for all our 16 queues. */
7961 	iwn_prph_write(sc, IWN4965_SCHED_INTR_MASK, 0xffff);
7962 	/* Identify TX FIFO rings (0-7). */
7963 	iwn_prph_write(sc, IWN4965_SCHED_TXFACT, 0xff);
7964 
7965 	/* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
7966 	for (qid = 0; qid < 7; qid++) {
7967 		static uint8_t qid2fifo[] = { 3, 2, 1, 0, 4, 5, 6 };
7968 		iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7969 		    IWN4965_TXQ_STATUS_ACTIVE | qid2fifo[qid] << 1);
7970 	}
7971 	iwn_nic_unlock(sc);
7972 	return 0;
7973 }
7974 
7975 /*
7976  * This function is called after the initialization or runtime firmware
7977  * notifies us of its readiness (called in a process context).
7978  */
7979 static int
7980 iwn5000_post_alive(struct iwn_softc *sc)
7981 {
7982 	int error, qid;
7983 
7984 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
7985 
7986 	/* Switch to using ICT interrupt mode. */
7987 	iwn5000_ict_reset(sc);
7988 
7989 	if ((error = iwn_nic_lock(sc)) != 0){
7990 		DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
7991 		return error;
7992 	}
7993 
7994 	/* Clear TX scheduler state in SRAM. */
7995 	sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
7996 	iwn_mem_set_region_4(sc, sc->sched_base + IWN5000_SCHED_CTX_OFF, 0,
7997 	    IWN5000_SCHED_CTX_LEN / sizeof (uint32_t));
7998 
7999 	/* Set physical address of TX scheduler rings (1KB aligned). */
8000 	iwn_prph_write(sc, IWN5000_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
8001 
8002 	IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
8003 
8004 	/* Enable chain mode for all queues, except command queue. */
8005 	if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT)
8006 		iwn_prph_write(sc, IWN5000_SCHED_QCHAIN_SEL, 0xfffdf);
8007 	else
8008 		iwn_prph_write(sc, IWN5000_SCHED_QCHAIN_SEL, 0xfffef);
8009 	iwn_prph_write(sc, IWN5000_SCHED_AGGR_SEL, 0);
8010 
8011 	for (qid = 0; qid < IWN5000_NTXQUEUES; qid++) {
8012 		iwn_prph_write(sc, IWN5000_SCHED_QUEUE_RDPTR(qid), 0);
8013 		IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | 0);
8014 
8015 		iwn_mem_write(sc, sc->sched_base +
8016 		    IWN5000_SCHED_QUEUE_OFFSET(qid), 0);
8017 		/* Set scheduler window size and frame limit. */
8018 		iwn_mem_write(sc, sc->sched_base +
8019 		    IWN5000_SCHED_QUEUE_OFFSET(qid) + 4,
8020 		    IWN_SCHED_LIMIT << 16 | IWN_SCHED_WINSZ);
8021 	}
8022 
8023 	/* Enable interrupts for all our 20 queues. */
8024 	iwn_prph_write(sc, IWN5000_SCHED_INTR_MASK, 0xfffff);
8025 	/* Identify TX FIFO rings (0-7). */
8026 	iwn_prph_write(sc, IWN5000_SCHED_TXFACT, 0xff);
8027 
8028 	/* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
8029 	if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT) {
8030 		/* Mark TX rings as active. */
8031 		for (qid = 0; qid < 11; qid++) {
8032 			static uint8_t qid2fifo[] = { 3, 2, 1, 0, 0, 4, 2, 5, 4, 7, 5 };
8033 			iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
8034 			    IWN5000_TXQ_STATUS_ACTIVE | qid2fifo[qid]);
8035 		}
8036 	} else {
8037 		/* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
8038 		for (qid = 0; qid < 7; qid++) {
8039 			static uint8_t qid2fifo[] = { 3, 2, 1, 0, 7, 5, 6 };
8040 			iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
8041 			    IWN5000_TXQ_STATUS_ACTIVE | qid2fifo[qid]);
8042 		}
8043 	}
8044 	iwn_nic_unlock(sc);
8045 
8046 	/* Configure WiMAX coexistence for combo adapters. */
8047 	error = iwn5000_send_wimax_coex(sc);
8048 	if (error != 0) {
8049 		device_printf(sc->sc_dev,
8050 		    "%s: could not configure WiMAX coexistence, error %d\n",
8051 		    __func__, error);
8052 		return error;
8053 	}
8054 	if (sc->hw_type != IWN_HW_REV_TYPE_5150) {
8055 		/* Perform crystal calibration. */
8056 		error = iwn5000_crystal_calib(sc);
8057 		if (error != 0) {
8058 			device_printf(sc->sc_dev,
8059 			    "%s: crystal calibration failed, error %d\n",
8060 			    __func__, error);
8061 			return error;
8062 		}
8063 	}
8064 	if (!(sc->sc_flags & IWN_FLAG_CALIB_DONE)) {
8065 		/* Query calibration from the initialization firmware. */
8066 		if ((error = iwn5000_query_calibration(sc)) != 0) {
8067 			device_printf(sc->sc_dev,
8068 			    "%s: could not query calibration, error %d\n",
8069 			    __func__, error);
8070 			return error;
8071 		}
8072 		/*
8073 		 * We have the calibration results now, reboot with the
8074 		 * runtime firmware (call ourselves recursively!)
8075 		 */
8076 		iwn_hw_stop(sc);
8077 		error = iwn_hw_init(sc);
8078 	} else {
8079 		/* Send calibration results to runtime firmware. */
8080 		error = iwn5000_send_calibration(sc);
8081 	}
8082 
8083 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
8084 
8085 	return error;
8086 }
8087 
8088 /*
8089  * The firmware boot code is small and is intended to be copied directly into
8090  * the NIC internal memory (no DMA transfer).
8091  */
8092 static int
8093 iwn4965_load_bootcode(struct iwn_softc *sc, const uint8_t *ucode, int size)
8094 {
8095 	int error, ntries;
8096 
8097 	size /= sizeof (uint32_t);
8098 
8099 	if ((error = iwn_nic_lock(sc)) != 0)
8100 		return error;
8101 
8102 	/* Copy microcode image into NIC memory. */
8103 	iwn_prph_write_region_4(sc, IWN_BSM_SRAM_BASE,
8104 	    (const uint32_t *)ucode, size);
8105 
8106 	iwn_prph_write(sc, IWN_BSM_WR_MEM_SRC, 0);
8107 	iwn_prph_write(sc, IWN_BSM_WR_MEM_DST, IWN_FW_TEXT_BASE);
8108 	iwn_prph_write(sc, IWN_BSM_WR_DWCOUNT, size);
8109 
8110 	/* Start boot load now. */
8111 	iwn_prph_write(sc, IWN_BSM_WR_CTRL, IWN_BSM_WR_CTRL_START);
8112 
8113 	/* Wait for transfer to complete. */
8114 	for (ntries = 0; ntries < 1000; ntries++) {
8115 		if (!(iwn_prph_read(sc, IWN_BSM_WR_CTRL) &
8116 		    IWN_BSM_WR_CTRL_START))
8117 			break;
8118 		DELAY(10);
8119 	}
8120 	if (ntries == 1000) {
8121 		device_printf(sc->sc_dev, "%s: could not load boot firmware\n",
8122 		    __func__);
8123 		iwn_nic_unlock(sc);
8124 		return ETIMEDOUT;
8125 	}
8126 
8127 	/* Enable boot after power up. */
8128 	iwn_prph_write(sc, IWN_BSM_WR_CTRL, IWN_BSM_WR_CTRL_START_EN);
8129 
8130 	iwn_nic_unlock(sc);
8131 	return 0;
8132 }
8133 
8134 static int
8135 iwn4965_load_firmware(struct iwn_softc *sc)
8136 {
8137 	struct iwn_fw_info *fw = &sc->fw;
8138 	struct iwn_dma_info *dma = &sc->fw_dma;
8139 	int error;
8140 
8141 	/* Copy initialization sections into pre-allocated DMA-safe memory. */
8142 	memcpy(dma->vaddr, fw->init.data, fw->init.datasz);
8143 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
8144 	memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
8145 	    fw->init.text, fw->init.textsz);
8146 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
8147 
8148 	/* Tell adapter where to find initialization sections. */
8149 	if ((error = iwn_nic_lock(sc)) != 0)
8150 		return error;
8151 	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
8152 	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->init.datasz);
8153 	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_ADDR,
8154 	    (dma->paddr + IWN4965_FW_DATA_MAXSZ) >> 4);
8155 	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_SIZE, fw->init.textsz);
8156 	iwn_nic_unlock(sc);
8157 
8158 	/* Load firmware boot code. */
8159 	error = iwn4965_load_bootcode(sc, fw->boot.text, fw->boot.textsz);
8160 	if (error != 0) {
8161 		device_printf(sc->sc_dev, "%s: could not load boot firmware\n",
8162 		    __func__);
8163 		return error;
8164 	}
8165 	/* Now press "execute". */
8166 	IWN_WRITE(sc, IWN_RESET, 0);
8167 
8168 	/* Wait at most one second for first alive notification. */
8169 	if ((error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz)) != 0) {
8170 		device_printf(sc->sc_dev,
8171 		    "%s: timeout waiting for adapter to initialize, error %d\n",
8172 		    __func__, error);
8173 		return error;
8174 	}
8175 
8176 	/* Retrieve current temperature for initial TX power calibration. */
8177 	sc->rawtemp = sc->ucode_info.temp[3].chan20MHz;
8178 	sc->temp = iwn4965_get_temperature(sc);
8179 
8180 	/* Copy runtime sections into pre-allocated DMA-safe memory. */
8181 	memcpy(dma->vaddr, fw->main.data, fw->main.datasz);
8182 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
8183 	memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
8184 	    fw->main.text, fw->main.textsz);
8185 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
8186 
8187 	/* Tell adapter where to find runtime sections. */
8188 	if ((error = iwn_nic_lock(sc)) != 0)
8189 		return error;
8190 	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
8191 	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->main.datasz);
8192 	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_ADDR,
8193 	    (dma->paddr + IWN4965_FW_DATA_MAXSZ) >> 4);
8194 	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_SIZE,
8195 	    IWN_FW_UPDATED | fw->main.textsz);
8196 	iwn_nic_unlock(sc);
8197 
8198 	return 0;
8199 }
8200 
8201 static int
8202 iwn5000_load_firmware_section(struct iwn_softc *sc, uint32_t dst,
8203     const uint8_t *section, int size)
8204 {
8205 	struct iwn_dma_info *dma = &sc->fw_dma;
8206 	int error;
8207 
8208 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8209 
8210 	/* Copy firmware section into pre-allocated DMA-safe memory. */
8211 	memcpy(dma->vaddr, section, size);
8212 	bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
8213 
8214 	if ((error = iwn_nic_lock(sc)) != 0)
8215 		return error;
8216 
8217 	IWN_WRITE(sc, IWN_FH_TX_CONFIG(IWN_SRVC_DMACHNL),
8218 	    IWN_FH_TX_CONFIG_DMA_PAUSE);
8219 
8220 	IWN_WRITE(sc, IWN_FH_SRAM_ADDR(IWN_SRVC_DMACHNL), dst);
8221 	IWN_WRITE(sc, IWN_FH_TFBD_CTRL0(IWN_SRVC_DMACHNL),
8222 	    IWN_LOADDR(dma->paddr));
8223 	IWN_WRITE(sc, IWN_FH_TFBD_CTRL1(IWN_SRVC_DMACHNL),
8224 	    IWN_HIADDR(dma->paddr) << 28 | size);
8225 	IWN_WRITE(sc, IWN_FH_TXBUF_STATUS(IWN_SRVC_DMACHNL),
8226 	    IWN_FH_TXBUF_STATUS_TBNUM(1) |
8227 	    IWN_FH_TXBUF_STATUS_TBIDX(1) |
8228 	    IWN_FH_TXBUF_STATUS_TFBD_VALID);
8229 
8230 	/* Kick Flow Handler to start DMA transfer. */
8231 	IWN_WRITE(sc, IWN_FH_TX_CONFIG(IWN_SRVC_DMACHNL),
8232 	    IWN_FH_TX_CONFIG_DMA_ENA | IWN_FH_TX_CONFIG_CIRQ_HOST_ENDTFD);
8233 
8234 	iwn_nic_unlock(sc);
8235 
8236 	/* Wait at most five seconds for FH DMA transfer to complete. */
8237 	return msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", 5 * hz);
8238 }
8239 
8240 static int
8241 iwn5000_load_firmware(struct iwn_softc *sc)
8242 {
8243 	struct iwn_fw_part *fw;
8244 	int error;
8245 
8246 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8247 
8248 	/* Load the initialization firmware on first boot only. */
8249 	fw = (sc->sc_flags & IWN_FLAG_CALIB_DONE) ?
8250 	    &sc->fw.main : &sc->fw.init;
8251 
8252 	error = iwn5000_load_firmware_section(sc, IWN_FW_TEXT_BASE,
8253 	    fw->text, fw->textsz);
8254 	if (error != 0) {
8255 		device_printf(sc->sc_dev,
8256 		    "%s: could not load firmware %s section, error %d\n",
8257 		    __func__, ".text", error);
8258 		return error;
8259 	}
8260 	error = iwn5000_load_firmware_section(sc, IWN_FW_DATA_BASE,
8261 	    fw->data, fw->datasz);
8262 	if (error != 0) {
8263 		device_printf(sc->sc_dev,
8264 		    "%s: could not load firmware %s section, error %d\n",
8265 		    __func__, ".data", error);
8266 		return error;
8267 	}
8268 
8269 	/* Now press "execute". */
8270 	IWN_WRITE(sc, IWN_RESET, 0);
8271 	return 0;
8272 }
8273 
8274 /*
8275  * Extract text and data sections from a legacy firmware image.
8276  */
8277 static int
8278 iwn_read_firmware_leg(struct iwn_softc *sc, struct iwn_fw_info *fw)
8279 {
8280 	const uint32_t *ptr;
8281 	size_t hdrlen = 24;
8282 	uint32_t rev;
8283 
8284 	ptr = (const uint32_t *)fw->data;
8285 	rev = le32toh(*ptr++);
8286 
8287 	sc->ucode_rev = rev;
8288 
8289 	/* Check firmware API version. */
8290 	if (IWN_FW_API(rev) <= 1) {
8291 		device_printf(sc->sc_dev,
8292 		    "%s: bad firmware, need API version >=2\n", __func__);
8293 		return EINVAL;
8294 	}
8295 	if (IWN_FW_API(rev) >= 3) {
8296 		/* Skip build number (version 2 header). */
8297 		hdrlen += 4;
8298 		ptr++;
8299 	}
8300 	if (fw->size < hdrlen) {
8301 		device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
8302 		    __func__, fw->size);
8303 		return EINVAL;
8304 	}
8305 	fw->main.textsz = le32toh(*ptr++);
8306 	fw->main.datasz = le32toh(*ptr++);
8307 	fw->init.textsz = le32toh(*ptr++);
8308 	fw->init.datasz = le32toh(*ptr++);
8309 	fw->boot.textsz = le32toh(*ptr++);
8310 
8311 	/* Check that all firmware sections fit. */
8312 	if (fw->size < hdrlen + fw->main.textsz + fw->main.datasz +
8313 	    fw->init.textsz + fw->init.datasz + fw->boot.textsz) {
8314 		device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
8315 		    __func__, fw->size);
8316 		return EINVAL;
8317 	}
8318 
8319 	/* Get pointers to firmware sections. */
8320 	fw->main.text = (const uint8_t *)ptr;
8321 	fw->main.data = fw->main.text + fw->main.textsz;
8322 	fw->init.text = fw->main.data + fw->main.datasz;
8323 	fw->init.data = fw->init.text + fw->init.textsz;
8324 	fw->boot.text = fw->init.data + fw->init.datasz;
8325 	return 0;
8326 }
8327 
8328 /*
8329  * Extract text and data sections from a TLV firmware image.
8330  */
8331 static int
8332 iwn_read_firmware_tlv(struct iwn_softc *sc, struct iwn_fw_info *fw,
8333     uint16_t alt)
8334 {
8335 	const struct iwn_fw_tlv_hdr *hdr;
8336 	const struct iwn_fw_tlv *tlv;
8337 	const uint8_t *ptr, *end;
8338 	uint64_t altmask;
8339 	uint32_t len, tmp;
8340 
8341 	if (fw->size < sizeof (*hdr)) {
8342 		device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
8343 		    __func__, fw->size);
8344 		return EINVAL;
8345 	}
8346 	hdr = (const struct iwn_fw_tlv_hdr *)fw->data;
8347 	if (hdr->signature != htole32(IWN_FW_SIGNATURE)) {
8348 		device_printf(sc->sc_dev, "%s: bad firmware signature 0x%08x\n",
8349 		    __func__, le32toh(hdr->signature));
8350 		return EINVAL;
8351 	}
8352 	DPRINTF(sc, IWN_DEBUG_RESET, "FW: \"%.64s\", build 0x%x\n", hdr->descr,
8353 	    le32toh(hdr->build));
8354 	sc->ucode_rev = le32toh(hdr->rev);
8355 
8356 	/*
8357 	 * Select the closest supported alternative that is less than
8358 	 * or equal to the specified one.
8359 	 */
8360 	altmask = le64toh(hdr->altmask);
8361 	while (alt > 0 && !(altmask & (1ULL << alt)))
8362 		alt--;	/* Downgrade. */
8363 	DPRINTF(sc, IWN_DEBUG_RESET, "using alternative %d\n", alt);
8364 
8365 	ptr = (const uint8_t *)(hdr + 1);
8366 	end = (const uint8_t *)(fw->data + fw->size);
8367 
8368 	/* Parse type-length-value fields. */
8369 	while (ptr + sizeof (*tlv) <= end) {
8370 		tlv = (const struct iwn_fw_tlv *)ptr;
8371 		len = le32toh(tlv->len);
8372 
8373 		ptr += sizeof (*tlv);
8374 		if (ptr + len > end) {
8375 			device_printf(sc->sc_dev,
8376 			    "%s: firmware too short: %zu bytes\n", __func__,
8377 			    fw->size);
8378 			return EINVAL;
8379 		}
8380 		/* Skip other alternatives. */
8381 		if (tlv->alt != 0 && tlv->alt != htole16(alt))
8382 			goto next;
8383 
8384 		switch (le16toh(tlv->type)) {
8385 		case IWN_FW_TLV_MAIN_TEXT:
8386 			fw->main.text = ptr;
8387 			fw->main.textsz = len;
8388 			break;
8389 		case IWN_FW_TLV_MAIN_DATA:
8390 			fw->main.data = ptr;
8391 			fw->main.datasz = len;
8392 			break;
8393 		case IWN_FW_TLV_INIT_TEXT:
8394 			fw->init.text = ptr;
8395 			fw->init.textsz = len;
8396 			break;
8397 		case IWN_FW_TLV_INIT_DATA:
8398 			fw->init.data = ptr;
8399 			fw->init.datasz = len;
8400 			break;
8401 		case IWN_FW_TLV_BOOT_TEXT:
8402 			fw->boot.text = ptr;
8403 			fw->boot.textsz = len;
8404 			break;
8405 		case IWN_FW_TLV_ENH_SENS:
8406 			if (!len)
8407 				sc->sc_flags |= IWN_FLAG_ENH_SENS;
8408 			break;
8409 		case IWN_FW_TLV_PHY_CALIB:
8410 			tmp = le32toh(*ptr);
8411 			if (tmp < 253) {
8412 				sc->reset_noise_gain = tmp;
8413 				sc->noise_gain = tmp + 1;
8414 			}
8415 			break;
8416 		case IWN_FW_TLV_PAN:
8417 			sc->sc_flags |= IWN_FLAG_PAN_SUPPORT;
8418 			DPRINTF(sc, IWN_DEBUG_RESET,
8419 			    "PAN Support found: %d\n", 1);
8420 			break;
8421 		case IWN_FW_TLV_FLAGS:
8422 			if (len < sizeof(uint32_t))
8423 				break;
8424 			if (len % sizeof(uint32_t))
8425 				break;
8426 			sc->tlv_feature_flags = le32toh(*ptr);
8427 			DPRINTF(sc, IWN_DEBUG_RESET,
8428 			    "%s: feature: 0x%08x\n",
8429 			    __func__,
8430 			    sc->tlv_feature_flags);
8431 			break;
8432 		case IWN_FW_TLV_PBREQ_MAXLEN:
8433 		case IWN_FW_TLV_RUNT_EVTLOG_PTR:
8434 		case IWN_FW_TLV_RUNT_EVTLOG_SIZE:
8435 		case IWN_FW_TLV_RUNT_ERRLOG_PTR:
8436 		case IWN_FW_TLV_INIT_EVTLOG_PTR:
8437 		case IWN_FW_TLV_INIT_EVTLOG_SIZE:
8438 		case IWN_FW_TLV_INIT_ERRLOG_PTR:
8439 		case IWN_FW_TLV_WOWLAN_INST:
8440 		case IWN_FW_TLV_WOWLAN_DATA:
8441 			DPRINTF(sc, IWN_DEBUG_RESET,
8442 			    "TLV type %d recognized but not handled\n",
8443 			    le16toh(tlv->type));
8444 			break;
8445 		default:
8446 			DPRINTF(sc, IWN_DEBUG_RESET,
8447 			    "TLV type %d not handled\n", le16toh(tlv->type));
8448 			break;
8449 		}
8450  next:		/* TLV fields are 32-bit aligned. */
8451 		ptr += (len + 3) & ~3;
8452 	}
8453 	return 0;
8454 }
8455 
8456 static int
8457 iwn_read_firmware(struct iwn_softc *sc)
8458 {
8459 	struct iwn_fw_info *fw = &sc->fw;
8460 	int error;
8461 
8462 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8463 
8464 	IWN_UNLOCK(sc);
8465 
8466 	memset(fw, 0, sizeof (*fw));
8467 
8468 	/* Read firmware image from filesystem. */
8469 	sc->fw_fp = firmware_get(sc->fwname);
8470 	if (sc->fw_fp == NULL) {
8471 		device_printf(sc->sc_dev, "%s: could not read firmware %s\n",
8472 		    __func__, sc->fwname);
8473 		IWN_LOCK(sc);
8474 		return EINVAL;
8475 	}
8476 	IWN_LOCK(sc);
8477 
8478 	fw->size = sc->fw_fp->datasize;
8479 	fw->data = (const uint8_t *)sc->fw_fp->data;
8480 	if (fw->size < sizeof (uint32_t)) {
8481 		device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
8482 		    __func__, fw->size);
8483 		error = EINVAL;
8484 		goto fail;
8485 	}
8486 
8487 	/* Retrieve text and data sections. */
8488 	if (*(const uint32_t *)fw->data != 0)	/* Legacy image. */
8489 		error = iwn_read_firmware_leg(sc, fw);
8490 	else
8491 		error = iwn_read_firmware_tlv(sc, fw, 1);
8492 	if (error != 0) {
8493 		device_printf(sc->sc_dev,
8494 		    "%s: could not read firmware sections, error %d\n",
8495 		    __func__, error);
8496 		goto fail;
8497 	}
8498 
8499 	device_printf(sc->sc_dev, "%s: ucode rev=0x%08x\n", __func__, sc->ucode_rev);
8500 
8501 	/* Make sure text and data sections fit in hardware memory. */
8502 	if (fw->main.textsz > sc->fw_text_maxsz ||
8503 	    fw->main.datasz > sc->fw_data_maxsz ||
8504 	    fw->init.textsz > sc->fw_text_maxsz ||
8505 	    fw->init.datasz > sc->fw_data_maxsz ||
8506 	    fw->boot.textsz > IWN_FW_BOOT_TEXT_MAXSZ ||
8507 	    (fw->boot.textsz & 3) != 0) {
8508 		device_printf(sc->sc_dev, "%s: firmware sections too large\n",
8509 		    __func__);
8510 		error = EINVAL;
8511 		goto fail;
8512 	}
8513 
8514 	/* We can proceed with loading the firmware. */
8515 	return 0;
8516 
8517 fail:	iwn_unload_firmware(sc);
8518 	return error;
8519 }
8520 
8521 static void
8522 iwn_unload_firmware(struct iwn_softc *sc)
8523 {
8524 	firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
8525 	sc->fw_fp = NULL;
8526 }
8527 
8528 static int
8529 iwn_clock_wait(struct iwn_softc *sc)
8530 {
8531 	int ntries;
8532 
8533 	/* Set "initialization complete" bit. */
8534 	IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_INIT_DONE);
8535 
8536 	/* Wait for clock stabilization. */
8537 	for (ntries = 0; ntries < 2500; ntries++) {
8538 		if (IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_MAC_CLOCK_READY)
8539 			return 0;
8540 		DELAY(10);
8541 	}
8542 	device_printf(sc->sc_dev,
8543 	    "%s: timeout waiting for clock stabilization\n", __func__);
8544 	return ETIMEDOUT;
8545 }
8546 
8547 static int
8548 iwn_apm_init(struct iwn_softc *sc)
8549 {
8550 	uint32_t reg;
8551 	int error;
8552 
8553 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8554 
8555 	/* Disable L0s exit timer (NMI bug workaround). */
8556 	IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_DIS_L0S_TIMER);
8557 	/* Don't wait for ICH L0s (ICH bug workaround). */
8558 	IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_L1A_NO_L0S_RX);
8559 
8560 	/* Set FH wait threshold to max (HW bug under stress workaround). */
8561 	IWN_SETBITS(sc, IWN_DBG_HPET_MEM, 0xffff0000);
8562 
8563 	/* Enable HAP INTA to move adapter from L1a to L0s. */
8564 	IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_HAP_WAKE_L1A);
8565 
8566 	/* Retrieve PCIe Active State Power Management (ASPM). */
8567 	reg = pci_read_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, 4);
8568 	/* Workaround for HW instability in PCIe L0->L0s->L1 transition. */
8569 	if (reg & PCIEM_LINK_CTL_ASPMC_L1)	/* L1 Entry enabled. */
8570 		IWN_SETBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
8571 	else
8572 		IWN_CLRBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
8573 
8574 	if (sc->base_params->pll_cfg_val)
8575 		IWN_SETBITS(sc, IWN_ANA_PLL, sc->base_params->pll_cfg_val);
8576 
8577 	/* Wait for clock stabilization before accessing prph. */
8578 	if ((error = iwn_clock_wait(sc)) != 0)
8579 		return error;
8580 
8581 	if ((error = iwn_nic_lock(sc)) != 0)
8582 		return error;
8583 	if (sc->hw_type == IWN_HW_REV_TYPE_4965) {
8584 		/* Enable DMA and BSM (Bootstrap State Machine). */
8585 		iwn_prph_write(sc, IWN_APMG_CLK_EN,
8586 		    IWN_APMG_CLK_CTRL_DMA_CLK_RQT |
8587 		    IWN_APMG_CLK_CTRL_BSM_CLK_RQT);
8588 	} else {
8589 		/* Enable DMA. */
8590 		iwn_prph_write(sc, IWN_APMG_CLK_EN,
8591 		    IWN_APMG_CLK_CTRL_DMA_CLK_RQT);
8592 	}
8593 	DELAY(20);
8594 	/* Disable L1-Active. */
8595 	iwn_prph_setbits(sc, IWN_APMG_PCI_STT, IWN_APMG_PCI_STT_L1A_DIS);
8596 	iwn_nic_unlock(sc);
8597 
8598 	return 0;
8599 }
8600 
8601 static void
8602 iwn_apm_stop_master(struct iwn_softc *sc)
8603 {
8604 	int ntries;
8605 
8606 	/* Stop busmaster DMA activity. */
8607 	IWN_SETBITS(sc, IWN_RESET, IWN_RESET_STOP_MASTER);
8608 	for (ntries = 0; ntries < 100; ntries++) {
8609 		if (IWN_READ(sc, IWN_RESET) & IWN_RESET_MASTER_DISABLED)
8610 			return;
8611 		DELAY(10);
8612 	}
8613 	device_printf(sc->sc_dev, "%s: timeout waiting for master\n", __func__);
8614 }
8615 
8616 static void
8617 iwn_apm_stop(struct iwn_softc *sc)
8618 {
8619 	iwn_apm_stop_master(sc);
8620 
8621 	/* Reset the entire device. */
8622 	IWN_SETBITS(sc, IWN_RESET, IWN_RESET_SW);
8623 	DELAY(10);
8624 	/* Clear "initialization complete" bit. */
8625 	IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_INIT_DONE);
8626 }
8627 
8628 static int
8629 iwn4965_nic_config(struct iwn_softc *sc)
8630 {
8631 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8632 
8633 	if (IWN_RFCFG_TYPE(sc->rfcfg) == 1) {
8634 		/*
8635 		 * I don't believe this to be correct but this is what the
8636 		 * vendor driver is doing. Probably the bits should not be
8637 		 * shifted in IWN_RFCFG_*.
8638 		 */
8639 		IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8640 		    IWN_RFCFG_TYPE(sc->rfcfg) |
8641 		    IWN_RFCFG_STEP(sc->rfcfg) |
8642 		    IWN_RFCFG_DASH(sc->rfcfg));
8643 	}
8644 	IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8645 	    IWN_HW_IF_CONFIG_RADIO_SI | IWN_HW_IF_CONFIG_MAC_SI);
8646 	return 0;
8647 }
8648 
8649 static int
8650 iwn5000_nic_config(struct iwn_softc *sc)
8651 {
8652 	uint32_t tmp;
8653 	int error;
8654 
8655 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8656 
8657 	if (IWN_RFCFG_TYPE(sc->rfcfg) < 3) {
8658 		IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8659 		    IWN_RFCFG_TYPE(sc->rfcfg) |
8660 		    IWN_RFCFG_STEP(sc->rfcfg) |
8661 		    IWN_RFCFG_DASH(sc->rfcfg));
8662 	}
8663 	IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8664 	    IWN_HW_IF_CONFIG_RADIO_SI | IWN_HW_IF_CONFIG_MAC_SI);
8665 
8666 	if ((error = iwn_nic_lock(sc)) != 0)
8667 		return error;
8668 	iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_EARLY_PWROFF_DIS);
8669 
8670 	if (sc->hw_type == IWN_HW_REV_TYPE_1000) {
8671 		/*
8672 		 * Select first Switching Voltage Regulator (1.32V) to
8673 		 * solve a stability issue related to noisy DC2DC line
8674 		 * in the silicon of 1000 Series.
8675 		 */
8676 		tmp = iwn_prph_read(sc, IWN_APMG_DIGITAL_SVR);
8677 		tmp &= ~IWN_APMG_DIGITAL_SVR_VOLTAGE_MASK;
8678 		tmp |= IWN_APMG_DIGITAL_SVR_VOLTAGE_1_32;
8679 		iwn_prph_write(sc, IWN_APMG_DIGITAL_SVR, tmp);
8680 	}
8681 	iwn_nic_unlock(sc);
8682 
8683 	if (sc->sc_flags & IWN_FLAG_INTERNAL_PA) {
8684 		/* Use internal power amplifier only. */
8685 		IWN_WRITE(sc, IWN_GP_DRIVER, IWN_GP_DRIVER_RADIO_2X2_IPA);
8686 	}
8687 	if (sc->base_params->additional_nic_config && sc->calib_ver >= 6) {
8688 		/* Indicate that ROM calibration version is >=6. */
8689 		IWN_SETBITS(sc, IWN_GP_DRIVER, IWN_GP_DRIVER_CALIB_VER6);
8690 	}
8691 	if (sc->base_params->additional_gp_drv_bit)
8692 		IWN_SETBITS(sc, IWN_GP_DRIVER,
8693 		    sc->base_params->additional_gp_drv_bit);
8694 	return 0;
8695 }
8696 
8697 /*
8698  * Take NIC ownership over Intel Active Management Technology (AMT).
8699  */
8700 static int
8701 iwn_hw_prepare(struct iwn_softc *sc)
8702 {
8703 	int ntries;
8704 
8705 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8706 
8707 	/* Check if hardware is ready. */
8708 	IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_NIC_READY);
8709 	for (ntries = 0; ntries < 5; ntries++) {
8710 		if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
8711 		    IWN_HW_IF_CONFIG_NIC_READY)
8712 			return 0;
8713 		DELAY(10);
8714 	}
8715 
8716 	/* Hardware not ready, force into ready state. */
8717 	IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_PREPARE);
8718 	for (ntries = 0; ntries < 15000; ntries++) {
8719 		if (!(IWN_READ(sc, IWN_HW_IF_CONFIG) &
8720 		    IWN_HW_IF_CONFIG_PREPARE_DONE))
8721 			break;
8722 		DELAY(10);
8723 	}
8724 	if (ntries == 15000)
8725 		return ETIMEDOUT;
8726 
8727 	/* Hardware should be ready now. */
8728 	IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_NIC_READY);
8729 	for (ntries = 0; ntries < 5; ntries++) {
8730 		if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
8731 		    IWN_HW_IF_CONFIG_NIC_READY)
8732 			return 0;
8733 		DELAY(10);
8734 	}
8735 	return ETIMEDOUT;
8736 }
8737 
8738 static int
8739 iwn_hw_init(struct iwn_softc *sc)
8740 {
8741 	struct iwn_ops *ops = &sc->ops;
8742 	int error, chnl, qid;
8743 
8744 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
8745 
8746 	/* Clear pending interrupts. */
8747 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
8748 
8749 	if ((error = iwn_apm_init(sc)) != 0) {
8750 		device_printf(sc->sc_dev,
8751 		    "%s: could not power ON adapter, error %d\n", __func__,
8752 		    error);
8753 		return error;
8754 	}
8755 
8756 	/* Select VMAIN power source. */
8757 	if ((error = iwn_nic_lock(sc)) != 0)
8758 		return error;
8759 	iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_PWR_SRC_MASK);
8760 	iwn_nic_unlock(sc);
8761 
8762 	/* Perform adapter-specific initialization. */
8763 	if ((error = ops->nic_config(sc)) != 0)
8764 		return error;
8765 
8766 	/* Initialize RX ring. */
8767 	if ((error = iwn_nic_lock(sc)) != 0)
8768 		return error;
8769 	IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
8770 	IWN_WRITE(sc, IWN_FH_RX_WPTR, 0);
8771 	/* Set physical address of RX ring (256-byte aligned). */
8772 	IWN_WRITE(sc, IWN_FH_RX_BASE, sc->rxq.desc_dma.paddr >> 8);
8773 	/* Set physical address of RX status (16-byte aligned). */
8774 	IWN_WRITE(sc, IWN_FH_STATUS_WPTR, sc->rxq.stat_dma.paddr >> 4);
8775 	/* Enable RX. */
8776 	IWN_WRITE(sc, IWN_FH_RX_CONFIG,
8777 	    IWN_FH_RX_CONFIG_ENA           |
8778 	    IWN_FH_RX_CONFIG_IGN_RXF_EMPTY |	/* HW bug workaround */
8779 	    IWN_FH_RX_CONFIG_IRQ_DST_HOST  |
8780 	    IWN_FH_RX_CONFIG_SINGLE_FRAME  |
8781 	    IWN_FH_RX_CONFIG_RB_TIMEOUT(0) |
8782 	    IWN_FH_RX_CONFIG_NRBD(IWN_RX_RING_COUNT_LOG));
8783 	iwn_nic_unlock(sc);
8784 	IWN_WRITE(sc, IWN_FH_RX_WPTR, (IWN_RX_RING_COUNT - 1) & ~7);
8785 
8786 	if ((error = iwn_nic_lock(sc)) != 0)
8787 		return error;
8788 
8789 	/* Initialize TX scheduler. */
8790 	iwn_prph_write(sc, sc->sched_txfact_addr, 0);
8791 
8792 	/* Set physical address of "keep warm" page (16-byte aligned). */
8793 	IWN_WRITE(sc, IWN_FH_KW_ADDR, sc->kw_dma.paddr >> 4);
8794 
8795 	/* Initialize TX rings. */
8796 	for (qid = 0; qid < sc->ntxqs; qid++) {
8797 		struct iwn_tx_ring *txq = &sc->txq[qid];
8798 
8799 		/* Set physical address of TX ring (256-byte aligned). */
8800 		IWN_WRITE(sc, IWN_FH_CBBC_QUEUE(qid),
8801 		    txq->desc_dma.paddr >> 8);
8802 	}
8803 	iwn_nic_unlock(sc);
8804 
8805 	/* Enable DMA channels. */
8806 	for (chnl = 0; chnl < sc->ndmachnls; chnl++) {
8807 		IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl),
8808 		    IWN_FH_TX_CONFIG_DMA_ENA |
8809 		    IWN_FH_TX_CONFIG_DMA_CREDIT_ENA);
8810 	}
8811 
8812 	/* Clear "radio off" and "commands blocked" bits. */
8813 	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
8814 	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_CMD_BLOCKED);
8815 
8816 	/* Clear pending interrupts. */
8817 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
8818 	/* Enable interrupt coalescing. */
8819 	IWN_WRITE(sc, IWN_INT_COALESCING, 512 / 8);
8820 	/* Enable interrupts. */
8821 	IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
8822 
8823 	/* _Really_ make sure "radio off" bit is cleared! */
8824 	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
8825 	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
8826 
8827 	/* Enable shadow registers. */
8828 	if (sc->base_params->shadow_reg_enable)
8829 		IWN_SETBITS(sc, IWN_SHADOW_REG_CTRL, 0x800fffff);
8830 
8831 	if ((error = ops->load_firmware(sc)) != 0) {
8832 		device_printf(sc->sc_dev,
8833 		    "%s: could not load firmware, error %d\n", __func__,
8834 		    error);
8835 		return error;
8836 	}
8837 	/* Wait at most one second for firmware alive notification. */
8838 	if ((error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz)) != 0) {
8839 		device_printf(sc->sc_dev,
8840 		    "%s: timeout waiting for adapter to initialize, error %d\n",
8841 		    __func__, error);
8842 		return error;
8843 	}
8844 	/* Do post-firmware initialization. */
8845 
8846 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
8847 
8848 	return ops->post_alive(sc);
8849 }
8850 
8851 static void
8852 iwn_hw_stop(struct iwn_softc *sc)
8853 {
8854 	int chnl, qid, ntries;
8855 
8856 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8857 
8858 	IWN_WRITE(sc, IWN_RESET, IWN_RESET_NEVO);
8859 
8860 	/* Disable interrupts. */
8861 	IWN_WRITE(sc, IWN_INT_MASK, 0);
8862 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
8863 	IWN_WRITE(sc, IWN_FH_INT, 0xffffffff);
8864 	sc->sc_flags &= ~IWN_FLAG_USE_ICT;
8865 
8866 	/* Make sure we no longer hold the NIC lock. */
8867 	iwn_nic_unlock(sc);
8868 
8869 	/* Stop TX scheduler. */
8870 	iwn_prph_write(sc, sc->sched_txfact_addr, 0);
8871 
8872 	/* Stop all DMA channels. */
8873 	if (iwn_nic_lock(sc) == 0) {
8874 		for (chnl = 0; chnl < sc->ndmachnls; chnl++) {
8875 			IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl), 0);
8876 			for (ntries = 0; ntries < 200; ntries++) {
8877 				if (IWN_READ(sc, IWN_FH_TX_STATUS) &
8878 				    IWN_FH_TX_STATUS_IDLE(chnl))
8879 					break;
8880 				DELAY(10);
8881 			}
8882 		}
8883 		iwn_nic_unlock(sc);
8884 	}
8885 
8886 	/* Stop RX ring. */
8887 	iwn_reset_rx_ring(sc, &sc->rxq);
8888 
8889 	/* Reset all TX rings. */
8890 	for (qid = 0; qid < sc->ntxqs; qid++)
8891 		iwn_reset_tx_ring(sc, &sc->txq[qid]);
8892 
8893 	if (iwn_nic_lock(sc) == 0) {
8894 		iwn_prph_write(sc, IWN_APMG_CLK_DIS,
8895 		    IWN_APMG_CLK_CTRL_DMA_CLK_RQT);
8896 		iwn_nic_unlock(sc);
8897 	}
8898 	DELAY(5);
8899 	/* Power OFF adapter. */
8900 	iwn_apm_stop(sc);
8901 }
8902 
8903 static void
8904 iwn_panicked(void *arg0, int pending)
8905 {
8906 	struct iwn_softc *sc = arg0;
8907 	struct ieee80211com *ic = &sc->sc_ic;
8908 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
8909 #if 0
8910 	int error;
8911 #endif
8912 
8913 	if (vap == NULL) {
8914 		printf("%s: null vap\n", __func__);
8915 		return;
8916 	}
8917 
8918 	device_printf(sc->sc_dev, "%s: controller panicked, iv_state = %d; "
8919 	    "restarting\n", __func__, vap->iv_state);
8920 
8921 	/*
8922 	 * This is not enough work. We need to also reinitialise
8923 	 * the correct transmit state for aggregation enabled queues,
8924 	 * which has a very specific requirement of
8925 	 * ring index = 802.11 seqno % 256.  If we don't do this (which
8926 	 * we definitely don't!) then the firmware will just panic again.
8927 	 */
8928 #if 1
8929 	ieee80211_restart_all(ic);
8930 #else
8931 	IWN_LOCK(sc);
8932 
8933 	iwn_stop_locked(sc);
8934 	if ((error = iwn_init_locked(sc)) != 0) {
8935 		device_printf(sc->sc_dev,
8936 		    "%s: could not init hardware\n", __func__);
8937 		goto unlock;
8938 	}
8939 	if (vap->iv_state >= IEEE80211_S_AUTH &&
8940 	    (error = iwn_auth(sc, vap)) != 0) {
8941 		device_printf(sc->sc_dev,
8942 		    "%s: could not move to auth state\n", __func__);
8943 	}
8944 	if (vap->iv_state >= IEEE80211_S_RUN &&
8945 	    (error = iwn_run(sc, vap)) != 0) {
8946 		device_printf(sc->sc_dev,
8947 		    "%s: could not move to run state\n", __func__);
8948 	}
8949 
8950 unlock:
8951 	IWN_UNLOCK(sc);
8952 #endif
8953 }
8954 
8955 static int
8956 iwn_init_locked(struct iwn_softc *sc)
8957 {
8958 	int error;
8959 
8960 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
8961 
8962 	IWN_LOCK_ASSERT(sc);
8963 
8964 	if (sc->sc_flags & IWN_FLAG_RUNNING)
8965 		goto end;
8966 
8967 	sc->sc_flags |= IWN_FLAG_RUNNING;
8968 
8969 	if ((error = iwn_hw_prepare(sc)) != 0) {
8970 		device_printf(sc->sc_dev, "%s: hardware not ready, error %d\n",
8971 		    __func__, error);
8972 		goto fail;
8973 	}
8974 
8975 	/* Initialize interrupt mask to default value. */
8976 	sc->int_mask = IWN_INT_MASK_DEF;
8977 	sc->sc_flags &= ~IWN_FLAG_USE_ICT;
8978 
8979 	/* Check that the radio is not disabled by hardware switch. */
8980 	if (!(IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_RFKILL)) {
8981 		iwn_stop_locked(sc);
8982 		DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
8983 
8984 		return (1);
8985 	}
8986 
8987 	/* Read firmware images from the filesystem. */
8988 	if ((error = iwn_read_firmware(sc)) != 0) {
8989 		device_printf(sc->sc_dev,
8990 		    "%s: could not read firmware, error %d\n", __func__,
8991 		    error);
8992 		goto fail;
8993 	}
8994 
8995 	/* Initialize hardware and upload firmware. */
8996 	error = iwn_hw_init(sc);
8997 	iwn_unload_firmware(sc);
8998 	if (error != 0) {
8999 		device_printf(sc->sc_dev,
9000 		    "%s: could not initialize hardware, error %d\n", __func__,
9001 		    error);
9002 		goto fail;
9003 	}
9004 
9005 	/* Configure adapter now that it is ready. */
9006 	if ((error = iwn_config(sc)) != 0) {
9007 		device_printf(sc->sc_dev,
9008 		    "%s: could not configure device, error %d\n", __func__,
9009 		    error);
9010 		goto fail;
9011 	}
9012 
9013 	callout_reset(&sc->watchdog_to, hz, iwn_watchdog, sc);
9014 
9015 end:
9016 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
9017 
9018 	return (0);
9019 
9020 fail:
9021 	iwn_stop_locked(sc);
9022 
9023 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
9024 
9025 	return (-1);
9026 }
9027 
9028 static int
9029 iwn_init(struct iwn_softc *sc)
9030 {
9031 	int error;
9032 
9033 	IWN_LOCK(sc);
9034 	error = iwn_init_locked(sc);
9035 	IWN_UNLOCK(sc);
9036 
9037 	return (error);
9038 }
9039 
9040 static void
9041 iwn_stop_locked(struct iwn_softc *sc)
9042 {
9043 
9044 	IWN_LOCK_ASSERT(sc);
9045 
9046 	if (!(sc->sc_flags & IWN_FLAG_RUNNING))
9047 		return;
9048 
9049 	sc->sc_is_scanning = 0;
9050 	sc->sc_tx_timer = 0;
9051 	callout_stop(&sc->watchdog_to);
9052 	callout_stop(&sc->scan_timeout);
9053 	callout_stop(&sc->calib_to);
9054 	sc->sc_flags &= ~IWN_FLAG_RUNNING;
9055 
9056 	/* Power OFF hardware. */
9057 	iwn_hw_stop(sc);
9058 }
9059 
9060 static void
9061 iwn_stop(struct iwn_softc *sc)
9062 {
9063 	IWN_LOCK(sc);
9064 	iwn_stop_locked(sc);
9065 	IWN_UNLOCK(sc);
9066 }
9067 
9068 /*
9069  * Callback from net80211 to start a scan.
9070  */
9071 static void
9072 iwn_scan_start(struct ieee80211com *ic)
9073 {
9074 	struct iwn_softc *sc = ic->ic_softc;
9075 
9076 	IWN_LOCK(sc);
9077 	/* make the link LED blink while we're scanning */
9078 	iwn_set_led(sc, IWN_LED_LINK, 20, 2);
9079 	IWN_UNLOCK(sc);
9080 }
9081 
9082 /*
9083  * Callback from net80211 to terminate a scan.
9084  */
9085 static void
9086 iwn_scan_end(struct ieee80211com *ic)
9087 {
9088 	struct iwn_softc *sc = ic->ic_softc;
9089 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
9090 
9091 	IWN_LOCK(sc);
9092 	if (vap->iv_state == IEEE80211_S_RUN) {
9093 		/* Set link LED to ON status if we are associated */
9094 		iwn_set_led(sc, IWN_LED_LINK, 0, 1);
9095 	}
9096 	IWN_UNLOCK(sc);
9097 }
9098 
9099 /*
9100  * Callback from net80211 to force a channel change.
9101  */
9102 static void
9103 iwn_set_channel(struct ieee80211com *ic)
9104 {
9105 	struct iwn_softc *sc = ic->ic_softc;
9106 	int error;
9107 
9108 	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
9109 
9110 	IWN_LOCK(sc);
9111 	/*
9112 	 * Only need to set the channel in Monitor mode. AP scanning and auth
9113 	 * are already taken care of by their respective firmware commands.
9114 	 */
9115 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
9116 		error = iwn_config(sc);
9117 		if (error != 0)
9118 		device_printf(sc->sc_dev,
9119 		    "%s: error %d setting channel\n", __func__, error);
9120 	}
9121 	IWN_UNLOCK(sc);
9122 }
9123 
9124 /*
9125  * Callback from net80211 to start scanning of the current channel.
9126  */
9127 static void
9128 iwn_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
9129 {
9130 	struct ieee80211vap *vap = ss->ss_vap;
9131 	struct ieee80211com *ic = vap->iv_ic;
9132 	struct iwn_softc *sc = ic->ic_softc;
9133 	int error;
9134 
9135 	IWN_LOCK(sc);
9136 	error = iwn_scan(sc, vap, ss, ic->ic_curchan);
9137 	IWN_UNLOCK(sc);
9138 	if (error != 0)
9139 		ieee80211_cancel_scan(vap);
9140 }
9141 
9142 /*
9143  * Callback from net80211 to handle the minimum dwell time being met.
9144  * The intent is to terminate the scan but we just let the firmware
9145  * notify us when it's finished as we have no safe way to abort it.
9146  */
9147 static void
9148 iwn_scan_mindwell(struct ieee80211_scan_state *ss)
9149 {
9150 	/* NB: don't try to abort scan; wait for firmware to finish */
9151 }
9152 #ifdef	IWN_DEBUG
9153 #define	IWN_DESC(x) case x:	return #x
9154 
9155 /*
9156  * Translate CSR code to string
9157  */
9158 static char *iwn_get_csr_string(int csr)
9159 {
9160 	switch (csr) {
9161 		IWN_DESC(IWN_HW_IF_CONFIG);
9162 		IWN_DESC(IWN_INT_COALESCING);
9163 		IWN_DESC(IWN_INT);
9164 		IWN_DESC(IWN_INT_MASK);
9165 		IWN_DESC(IWN_FH_INT);
9166 		IWN_DESC(IWN_GPIO_IN);
9167 		IWN_DESC(IWN_RESET);
9168 		IWN_DESC(IWN_GP_CNTRL);
9169 		IWN_DESC(IWN_HW_REV);
9170 		IWN_DESC(IWN_EEPROM);
9171 		IWN_DESC(IWN_EEPROM_GP);
9172 		IWN_DESC(IWN_OTP_GP);
9173 		IWN_DESC(IWN_GIO);
9174 		IWN_DESC(IWN_GP_UCODE);
9175 		IWN_DESC(IWN_GP_DRIVER);
9176 		IWN_DESC(IWN_UCODE_GP1);
9177 		IWN_DESC(IWN_UCODE_GP2);
9178 		IWN_DESC(IWN_LED);
9179 		IWN_DESC(IWN_DRAM_INT_TBL);
9180 		IWN_DESC(IWN_GIO_CHICKEN);
9181 		IWN_DESC(IWN_ANA_PLL);
9182 		IWN_DESC(IWN_HW_REV_WA);
9183 		IWN_DESC(IWN_DBG_HPET_MEM);
9184 	default:
9185 		return "UNKNOWN CSR";
9186 	}
9187 }
9188 
9189 /*
9190  * This function print firmware register
9191  */
9192 static void
9193 iwn_debug_register(struct iwn_softc *sc)
9194 {
9195 	int i;
9196 	static const uint32_t csr_tbl[] = {
9197 		IWN_HW_IF_CONFIG,
9198 		IWN_INT_COALESCING,
9199 		IWN_INT,
9200 		IWN_INT_MASK,
9201 		IWN_FH_INT,
9202 		IWN_GPIO_IN,
9203 		IWN_RESET,
9204 		IWN_GP_CNTRL,
9205 		IWN_HW_REV,
9206 		IWN_EEPROM,
9207 		IWN_EEPROM_GP,
9208 		IWN_OTP_GP,
9209 		IWN_GIO,
9210 		IWN_GP_UCODE,
9211 		IWN_GP_DRIVER,
9212 		IWN_UCODE_GP1,
9213 		IWN_UCODE_GP2,
9214 		IWN_LED,
9215 		IWN_DRAM_INT_TBL,
9216 		IWN_GIO_CHICKEN,
9217 		IWN_ANA_PLL,
9218 		IWN_HW_REV_WA,
9219 		IWN_DBG_HPET_MEM,
9220 	};
9221 	DPRINTF(sc, IWN_DEBUG_REGISTER,
9222 	    "CSR values: (2nd byte of IWN_INT_COALESCING is IWN_INT_PERIODIC)%s",
9223 	    "\n");
9224 	for (i = 0; i <  nitems(csr_tbl); i++){
9225 		DPRINTF(sc, IWN_DEBUG_REGISTER,"  %10s: 0x%08x ",
9226 			iwn_get_csr_string(csr_tbl[i]), IWN_READ(sc, csr_tbl[i]));
9227 		if ((i+1) % 3 == 0)
9228 			DPRINTF(sc, IWN_DEBUG_REGISTER,"%s","\n");
9229 	}
9230 	DPRINTF(sc, IWN_DEBUG_REGISTER,"%s","\n");
9231 }
9232 #endif
9233 
9234 
9235