kernel - Fix sack NULL pointer dereference
[dragonfly.git] / sys / dev / netif / iwn / if_iwn.c
1 /*-
2  * Copyright (c) 2007-2009 Damien Bergamini <damien.bergamini@free.fr>
3  * Copyright (c) 2008 Benjamin Close <benjsc@FreeBSD.org>
4  * Copyright (c) 2008 Sam Leffler, Errno Consulting
5  * Copyright (c) 2011 Intel Corporation
6  * Copyright (c) 2013 Cedric GROSS <c.gross@kreiz-it.fr>
7  * Copyright (c) 2013 Adrian Chadd <adrian@FreeBSD.org>
8  *
9  * Permission to use, copy, modify, and distribute this software for any
10  * purpose with or without fee is hereby granted, provided that the above
11  * copyright notice and this permission notice appear in all copies.
12  *
13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20  */
21
22 /*
23  * Driver for Intel WiFi Link 4965 and 1000/5000/6000 Series 802.11 network
24  * adapters.
25  */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29
30 #include "opt_wlan.h"
31 #include "opt_iwn.h"
32
33 #include <sys/param.h>
34 #include <sys/sockio.h>
35 #include <sys/sysctl.h>
36 #include <sys/mbuf.h>
37 #include <sys/kernel.h>
38 #include <sys/socket.h>
39 #include <sys/systm.h>
40 #include <sys/malloc.h>
41 #include <sys/bus.h>
42 #include <sys/conf.h>
43 #include <sys/rman.h>
44 #include <sys/endian.h>
45 #include <sys/firmware.h>
46 #include <sys/limits.h>
47 #include <sys/module.h>
48 #include <sys/priv.h>
49 #include <sys/queue.h>
50 #include <sys/taskqueue.h>
51 #if defined(__DragonFly__)
52 #include <sys/device.h>
53 #endif
54
55 #if defined(__DragonFly__)
56 /* empty */
57 #else
58 #include <machine/bus.h>
59 #include <machine/resource.h>
60 #include <machine/clock.h>
61 #endif
62
63 #if defined(__DragonFly__)
64 #include <bus/pci/pcireg.h>
65 #include <bus/pci/pcivar.h>
66 #else
67 #include <dev/pci/pcireg.h>
68 #include <dev/pci/pcivar.h>
69 #endif
70
71 #include <net/if.h>
72 #include <net/if_var.h>
73 #include <net/if_dl.h>
74 #include <net/if_media.h>
75
76 #include <netinet/in.h>
77 #include <netinet/if_ether.h>
78
79 #include <netproto/802_11/ieee80211_var.h>
80 #include <netproto/802_11/ieee80211_radiotap.h>
81 #include <netproto/802_11/ieee80211_regdomain.h>
82 #include <netproto/802_11/ieee80211_ratectl.h>
83
84 #include <dev/netif/iwn/if_iwnreg.h>
85 #include <dev/netif/iwn/if_iwnvar.h>
86 #include <dev/netif/iwn/if_iwn_devid.h>
87 #include <dev/netif/iwn/if_iwn_chip_cfg.h>
88 #include <dev/netif/iwn/if_iwn_debug.h>
89 #include <dev/netif/iwn/if_iwn_ioctl.h>
90
91 struct iwn_ident {
92         uint16_t        vendor;
93         uint16_t        device;
94         const char      *name;
95 };
96
97 static const struct iwn_ident iwn_ident_table[] = {
98         { 0x8086, IWN_DID_6x05_1, "Intel Centrino Advanced-N 6205"              },
99         { 0x8086, IWN_DID_1000_1, "Intel Centrino Wireless-N 1000"              },
100         { 0x8086, IWN_DID_1000_2, "Intel Centrino Wireless-N 1000"              },
101         { 0x8086, IWN_DID_6x05_2, "Intel Centrino Advanced-N 6205"              },
102         { 0x8086, IWN_DID_6050_1, "Intel Centrino Advanced-N + WiMAX 6250"      },
103         { 0x8086, IWN_DID_6050_2, "Intel Centrino Advanced-N + WiMAX 6250"      },
104         { 0x8086, IWN_DID_x030_1, "Intel Centrino Wireless-N 1030"              },
105         { 0x8086, IWN_DID_x030_2, "Intel Centrino Wireless-N 1030"              },
106         { 0x8086, IWN_DID_x030_3, "Intel Centrino Advanced-N 6230"              },
107         { 0x8086, IWN_DID_x030_4, "Intel Centrino Advanced-N 6230"              },
108         { 0x8086, IWN_DID_6150_1, "Intel Centrino Wireless-N + WiMAX 6150"      },
109         { 0x8086, IWN_DID_6150_2, "Intel Centrino Wireless-N + WiMAX 6150"      },
110         { 0x8086, IWN_DID_2x00_1, "Intel(R) Centrino(R) Wireless-N 2200 BGN"    },
111         { 0x8086, IWN_DID_2x00_2, "Intel(R) Centrino(R) Wireless-N 2200 BGN"    },
112         /* XXX 2200D is IWN_SDID_2x00_4; there's no way to express this here! */
113         { 0x8086, IWN_DID_2x30_1, "Intel Centrino Wireless-N 2230"              },
114         { 0x8086, IWN_DID_2x30_2, "Intel Centrino Wireless-N 2230"              },
115         { 0x8086, IWN_DID_130_1, "Intel Centrino Wireless-N 130"                },
116         { 0x8086, IWN_DID_130_2, "Intel Centrino Wireless-N 130"                },
117         { 0x8086, IWN_DID_100_1, "Intel Centrino Wireless-N 100"                },
118         { 0x8086, IWN_DID_100_2, "Intel Centrino Wireless-N 100"                },
119         { 0x8086, IWN_DID_105_1, "Intel Centrino Wireless-N 105"                },
120         { 0x8086, IWN_DID_105_2, "Intel Centrino Wireless-N 105"                },
121         { 0x8086, IWN_DID_135_1, "Intel Centrino Wireless-N 135"                },
122         { 0x8086, IWN_DID_135_2, "Intel Centrino Wireless-N 135"                },
123         { 0x8086, IWN_DID_4965_1, "Intel Wireless WiFi Link 4965"               },
124         { 0x8086, IWN_DID_6x00_1, "Intel Centrino Ultimate-N 6300"              },
125         { 0x8086, IWN_DID_6x00_2, "Intel Centrino Advanced-N 6200"              },
126         { 0x8086, IWN_DID_4965_2, "Intel Wireless WiFi Link 4965"               },
127         { 0x8086, IWN_DID_4965_3, "Intel Wireless WiFi Link 4965"               },
128         { 0x8086, IWN_DID_5x00_1, "Intel WiFi Link 5100"                        },
129         { 0x8086, IWN_DID_4965_4, "Intel Wireless WiFi Link 4965"               },
130         { 0x8086, IWN_DID_5x00_3, "Intel Ultimate N WiFi Link 5300"             },
131         { 0x8086, IWN_DID_5x00_4, "Intel Ultimate N WiFi Link 5300"             },
132         { 0x8086, IWN_DID_5x00_2, "Intel WiFi Link 5100"                        },
133         { 0x8086, IWN_DID_6x00_3, "Intel Centrino Ultimate-N 6300"              },
134         { 0x8086, IWN_DID_6x00_4, "Intel Centrino Advanced-N 6200"              },
135         { 0x8086, IWN_DID_5x50_1, "Intel WiMAX/WiFi Link 5350"                  },
136         { 0x8086, IWN_DID_5x50_2, "Intel WiMAX/WiFi Link 5350"                  },
137         { 0x8086, IWN_DID_5x50_3, "Intel WiMAX/WiFi Link 5150"                  },
138         { 0x8086, IWN_DID_5x50_4, "Intel WiMAX/WiFi Link 5150"                  },
139         { 0x8086, IWN_DID_6035_1, "Intel Centrino Advanced 6235"                },
140         { 0x8086, IWN_DID_6035_2, "Intel Centrino Advanced 6235"                },
141         { 0, 0, NULL }
142 };
143
144 static int      iwn_probe(device_t);
145 static int      iwn_attach(device_t);
146 static int      iwn4965_attach(struct iwn_softc *, uint16_t);
147 static int      iwn5000_attach(struct iwn_softc *, uint16_t);
148 static int      iwn_config_specific(struct iwn_softc *, uint16_t);
149 static void     iwn_radiotap_attach(struct iwn_softc *);
150 static void     iwn_sysctlattach(struct iwn_softc *);
151 static struct ieee80211vap *iwn_vap_create(struct ieee80211com *,
152                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
153                     const uint8_t [IEEE80211_ADDR_LEN],
154                     const uint8_t [IEEE80211_ADDR_LEN]);
155 static void     iwn_vap_delete(struct ieee80211vap *);
156 static int      iwn_detach(device_t);
157 static int      iwn_shutdown(device_t);
158 static int      iwn_suspend(device_t);
159 static int      iwn_resume(device_t);
160 static int      iwn_nic_lock(struct iwn_softc *);
161 static int      iwn_eeprom_lock(struct iwn_softc *);
162 static int      iwn_init_otprom(struct iwn_softc *);
163 static int      iwn_read_prom_data(struct iwn_softc *, uint32_t, void *, int);
164 static void     iwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
165 static int      iwn_dma_contig_alloc(struct iwn_softc *, struct iwn_dma_info *,
166                     void **, bus_size_t, bus_size_t);
167 static void     iwn_dma_contig_free(struct iwn_dma_info *);
168 static int      iwn_alloc_sched(struct iwn_softc *);
169 static void     iwn_free_sched(struct iwn_softc *);
170 static int      iwn_alloc_kw(struct iwn_softc *);
171 static void     iwn_free_kw(struct iwn_softc *);
172 static int      iwn_alloc_ict(struct iwn_softc *);
173 static void     iwn_free_ict(struct iwn_softc *);
174 static int      iwn_alloc_fwmem(struct iwn_softc *);
175 static void     iwn_free_fwmem(struct iwn_softc *);
176 static int      iwn_alloc_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
177 static void     iwn_reset_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
178 static void     iwn_free_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
179 static int      iwn_alloc_tx_ring(struct iwn_softc *, struct iwn_tx_ring *,
180                     int);
181 static void     iwn_reset_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
182 static void     iwn_free_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
183 static void     iwn5000_ict_reset(struct iwn_softc *);
184 static int      iwn_read_eeprom(struct iwn_softc *,
185                     uint8_t macaddr[IEEE80211_ADDR_LEN]);
186 static void     iwn4965_read_eeprom(struct iwn_softc *);
187 #ifdef  IWN_DEBUG
188 static void     iwn4965_print_power_group(struct iwn_softc *, int);
189 #endif
190 static void     iwn5000_read_eeprom(struct iwn_softc *);
191 static uint32_t iwn_eeprom_channel_flags(struct iwn_eeprom_chan *);
192 static void     iwn_read_eeprom_band(struct iwn_softc *, int, int, int *,
193                     struct ieee80211_channel[]);
194 static void     iwn_read_eeprom_ht40(struct iwn_softc *, int, int, int *,
195                     struct ieee80211_channel[]);
196 static void     iwn_read_eeprom_channels(struct iwn_softc *, int, uint32_t);
197 static struct iwn_eeprom_chan *iwn_find_eeprom_channel(struct iwn_softc *,
198                     struct ieee80211_channel *);
199 static void     iwn_getradiocaps(struct ieee80211com *, int, int *,
200                     struct ieee80211_channel[]);
201 static int      iwn_setregdomain(struct ieee80211com *,
202                     struct ieee80211_regdomain *, int,
203                     struct ieee80211_channel[]);
204 static void     iwn_read_eeprom_enhinfo(struct iwn_softc *);
205 static struct ieee80211_node *iwn_node_alloc(struct ieee80211vap *,
206                     const uint8_t mac[IEEE80211_ADDR_LEN]);
207 static void     iwn_newassoc(struct ieee80211_node *, int);
208 static int      iwn_media_change(struct ifnet *);
209 static int      iwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
210 static void     iwn_calib_timeout(void *);
211 static void     iwn_rx_phy(struct iwn_softc *, struct iwn_rx_desc *,
212                     struct iwn_rx_data *);
213 static void     iwn_rx_done(struct iwn_softc *, struct iwn_rx_desc *,
214                     struct iwn_rx_data *);
215 static void     iwn_rx_compressed_ba(struct iwn_softc *, struct iwn_rx_desc *,
216                     struct iwn_rx_data *);
217 static void     iwn5000_rx_calib_results(struct iwn_softc *,
218                     struct iwn_rx_desc *, struct iwn_rx_data *);
219 static void     iwn_rx_statistics(struct iwn_softc *, struct iwn_rx_desc *,
220                     struct iwn_rx_data *);
221 static void     iwn4965_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
222                     struct iwn_rx_data *);
223 static void     iwn5000_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
224                     struct iwn_rx_data *);
225 static void     iwn_tx_done(struct iwn_softc *, struct iwn_rx_desc *, int,
226                     uint8_t);
227 static void     iwn_ampdu_tx_done(struct iwn_softc *, int, int, int, int, void *);
228 static void     iwn_cmd_done(struct iwn_softc *, struct iwn_rx_desc *);
229 static void     iwn_notif_intr(struct iwn_softc *);
230 static void     iwn_wakeup_intr(struct iwn_softc *);
231 static void     iwn_rftoggle_intr(struct iwn_softc *);
232 static void     iwn_fatal_intr(struct iwn_softc *);
233 static void     iwn_intr(void *);
234 static void     iwn4965_update_sched(struct iwn_softc *, int, int, uint8_t,
235                     uint16_t);
236 static void     iwn5000_update_sched(struct iwn_softc *, int, int, uint8_t,
237                     uint16_t);
238 #ifdef notyet
239 static void     iwn5000_reset_sched(struct iwn_softc *, int, int);
240 #endif
241 static int      iwn_tx_data(struct iwn_softc *, struct mbuf *,
242                     struct ieee80211_node *);
243 static int      iwn_tx_data_raw(struct iwn_softc *, struct mbuf *,
244                     struct ieee80211_node *,
245                     const struct ieee80211_bpf_params *params);
246 static void     iwn_xmit_task(void *arg0, int pending);
247 static int      iwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
248                     const struct ieee80211_bpf_params *);
249 static int      iwn_transmit(struct ieee80211com *, struct mbuf *);
250 static void     iwn_watchdog(void *);
251 static int      iwn_ioctl(struct ieee80211com *, u_long , void *);
252 static void     iwn_parent(struct ieee80211com *);
253 static int      iwn_cmd(struct iwn_softc *, int, const void *, int, int);
254 static int      iwn4965_add_node(struct iwn_softc *, struct iwn_node_info *,
255                     int);
256 static int      iwn5000_add_node(struct iwn_softc *, struct iwn_node_info *,
257                     int);
258 static int      iwn_set_link_quality(struct iwn_softc *,
259                     struct ieee80211_node *);
260 static int      iwn_add_broadcast_node(struct iwn_softc *, int);
261 static int      iwn_updateedca(struct ieee80211com *);
262 static void     iwn_update_mcast(struct ieee80211com *);
263 static void     iwn_set_led(struct iwn_softc *, uint8_t, uint8_t, uint8_t);
264 static int      iwn_set_critical_temp(struct iwn_softc *);
265 static int      iwn_set_timing(struct iwn_softc *, struct ieee80211_node *);
266 static void     iwn4965_power_calibration(struct iwn_softc *, int);
267 static int      iwn4965_set_txpower(struct iwn_softc *,
268                     struct ieee80211_channel *, int);
269 static int      iwn5000_set_txpower(struct iwn_softc *,
270                     struct ieee80211_channel *, int);
271 static int      iwn4965_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
272 static int      iwn5000_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
273 static int      iwn_get_noise(const struct iwn_rx_general_stats *);
274 static int      iwn4965_get_temperature(struct iwn_softc *);
275 static int      iwn5000_get_temperature(struct iwn_softc *);
276 static int      iwn_init_sensitivity(struct iwn_softc *);
277 static void     iwn_collect_noise(struct iwn_softc *,
278                     const struct iwn_rx_general_stats *);
279 static int      iwn4965_init_gains(struct iwn_softc *);
280 static int      iwn5000_init_gains(struct iwn_softc *);
281 static int      iwn4965_set_gains(struct iwn_softc *);
282 static int      iwn5000_set_gains(struct iwn_softc *);
283 static void     iwn_tune_sensitivity(struct iwn_softc *,
284                     const struct iwn_rx_stats *);
285 static void     iwn_save_stats_counters(struct iwn_softc *,
286                     const struct iwn_stats *);
287 static int      iwn_send_sensitivity(struct iwn_softc *);
288 static void     iwn_check_rx_recovery(struct iwn_softc *, struct iwn_stats *);
289 static int      iwn_set_pslevel(struct iwn_softc *, int, int, int);
290 static int      iwn_send_btcoex(struct iwn_softc *);
291 static int      iwn_send_advanced_btcoex(struct iwn_softc *);
292 static int      iwn5000_runtime_calib(struct iwn_softc *);
293 static int      iwn_config(struct iwn_softc *);
294 static int      iwn_scan(struct iwn_softc *, struct ieee80211vap *,
295                     struct ieee80211_scan_state *, struct ieee80211_channel *);
296 static int      iwn_auth(struct iwn_softc *, struct ieee80211vap *vap);
297 static int      iwn_run(struct iwn_softc *, struct ieee80211vap *vap);
298 static int      iwn_ampdu_rx_start(struct ieee80211_node *,
299                     struct ieee80211_rx_ampdu *, int, int, int);
300 static void     iwn_ampdu_rx_stop(struct ieee80211_node *,
301                     struct ieee80211_rx_ampdu *);
302 static int      iwn_addba_request(struct ieee80211_node *,
303                     struct ieee80211_tx_ampdu *, int, int, int);
304 static int      iwn_addba_response(struct ieee80211_node *,
305                     struct ieee80211_tx_ampdu *, int, int, int);
306 static int      iwn_ampdu_tx_start(struct ieee80211com *,
307                     struct ieee80211_node *, uint8_t);
308 static void     iwn_ampdu_tx_stop(struct ieee80211_node *,
309                     struct ieee80211_tx_ampdu *);
310 static void     iwn4965_ampdu_tx_start(struct iwn_softc *,
311                     struct ieee80211_node *, int, uint8_t, uint16_t);
312 static void     iwn4965_ampdu_tx_stop(struct iwn_softc *, int,
313                     uint8_t, uint16_t);
314 static void     iwn5000_ampdu_tx_start(struct iwn_softc *,
315                     struct ieee80211_node *, int, uint8_t, uint16_t);
316 static void     iwn5000_ampdu_tx_stop(struct iwn_softc *, int,
317                     uint8_t, uint16_t);
318 static int      iwn5000_query_calibration(struct iwn_softc *);
319 static int      iwn5000_send_calibration(struct iwn_softc *);
320 static int      iwn5000_send_wimax_coex(struct iwn_softc *);
321 static int      iwn5000_crystal_calib(struct iwn_softc *);
322 static int      iwn5000_temp_offset_calib(struct iwn_softc *);
323 static int      iwn5000_temp_offset_calibv2(struct iwn_softc *);
324 static int      iwn4965_post_alive(struct iwn_softc *);
325 static int      iwn5000_post_alive(struct iwn_softc *);
326 static int      iwn4965_load_bootcode(struct iwn_softc *, const uint8_t *,
327                     int);
328 static int      iwn4965_load_firmware(struct iwn_softc *);
329 static int      iwn5000_load_firmware_section(struct iwn_softc *, uint32_t,
330                     const uint8_t *, int);
331 static int      iwn5000_load_firmware(struct iwn_softc *);
332 static int      iwn_read_firmware_leg(struct iwn_softc *,
333                     struct iwn_fw_info *);
334 static int      iwn_read_firmware_tlv(struct iwn_softc *,
335                     struct iwn_fw_info *, uint16_t);
336 static int      iwn_read_firmware(struct iwn_softc *);
337 static void     iwn_unload_firmware(struct iwn_softc *);
338 static int      iwn_clock_wait(struct iwn_softc *);
339 static int      iwn_apm_init(struct iwn_softc *);
340 static void     iwn_apm_stop_master(struct iwn_softc *);
341 static void     iwn_apm_stop(struct iwn_softc *);
342 static int      iwn4965_nic_config(struct iwn_softc *);
343 static int      iwn5000_nic_config(struct iwn_softc *);
344 static int      iwn_hw_prepare(struct iwn_softc *);
345 static int      iwn_hw_init(struct iwn_softc *);
346 static void     iwn_hw_stop(struct iwn_softc *);
347 static void     iwn_radio_on(void *, int);
348 static void     iwn_radio_off(void *, int);
349 static void     iwn_panicked(void *, int);
350 static void     iwn_init_locked(struct iwn_softc *);
351 static void     iwn_init(struct iwn_softc *);
352 static void     iwn_stop_locked(struct iwn_softc *);
353 static void     iwn_stop(struct iwn_softc *);
354 static void     iwn_scan_start(struct ieee80211com *);
355 static void     iwn_scan_end(struct ieee80211com *);
356 static void     iwn_set_channel(struct ieee80211com *);
357 static void     iwn_scan_curchan(struct ieee80211_scan_state *, unsigned long);
358 static void     iwn_scan_mindwell(struct ieee80211_scan_state *);
359 #ifdef  IWN_DEBUG
360 static char     *iwn_get_csr_string(int);
361 static void     iwn_debug_register(struct iwn_softc *);
362 #endif
363
364 static device_method_t iwn_methods[] = {
365         /* Device interface */
366         DEVMETHOD(device_probe,         iwn_probe),
367         DEVMETHOD(device_attach,        iwn_attach),
368         DEVMETHOD(device_detach,        iwn_detach),
369         DEVMETHOD(device_shutdown,      iwn_shutdown),
370         DEVMETHOD(device_suspend,       iwn_suspend),
371         DEVMETHOD(device_resume,        iwn_resume),
372
373         DEVMETHOD_END
374 };
375
376 static driver_t iwn_driver = {
377         "iwn",
378         iwn_methods,
379         sizeof(struct iwn_softc)
380 };
381 static devclass_t iwn_devclass;
382
383 DRIVER_MODULE(iwn, pci, iwn_driver, iwn_devclass, NULL, NULL);
384
385 MODULE_VERSION(iwn, 1);
386
387 MODULE_DEPEND(iwn, firmware, 1, 1, 1);
388 MODULE_DEPEND(iwn, pci, 1, 1, 1);
389 MODULE_DEPEND(iwn, wlan, 1, 1, 1);
390
391 static d_ioctl_t iwn_cdev_ioctl;
392 static d_open_t iwn_cdev_open;
393 static d_close_t iwn_cdev_close;
394
395 static struct dev_ops iwn_cdevsw = {
396 #if defined(__DragonFly__)
397         /* none */
398         { "iwn", 0, 0 },
399 #else
400         .d_version = D_VERSION,
401         .d_flags = 0,
402 #endif
403         .d_open = iwn_cdev_open,
404         .d_close = iwn_cdev_close,
405         .d_ioctl = iwn_cdev_ioctl,
406 #if defined(__DragonFly__)
407         /* none */
408 #else
409         .d_name = "iwn",
410 #endif
411 };
412
413 static int
414 iwn_probe(device_t dev)
415 {
416         const struct iwn_ident *ident;
417
418         for (ident = iwn_ident_table; ident->name != NULL; ident++) {
419                 if (pci_get_vendor(dev) == ident->vendor &&
420                     pci_get_device(dev) == ident->device) {
421                         device_set_desc(dev, ident->name);
422                         return (BUS_PROBE_DEFAULT);
423                 }
424         }
425         return ENXIO;
426 }
427
428 static int
429 iwn_is_3stream_device(struct iwn_softc *sc)
430 {
431         /* XXX for now only 5300, until the 5350 can be tested */
432         if (sc->hw_type == IWN_HW_REV_TYPE_5300)
433                 return (1);
434         return (0);
435 }
436
437 static int
438 iwn_attach(device_t dev)
439 {
440         struct iwn_softc *sc = device_get_softc(dev);
441         struct ieee80211com *ic;
442         int i, error, rid;
443 #if defined(__DragonFly__)
444         int irq_flags;
445 #endif
446
447         sc->sc_dev = dev;
448
449 #ifdef  IWN_DEBUG
450         error = resource_int_value(device_get_name(sc->sc_dev),
451             device_get_unit(sc->sc_dev), "debug", &(sc->sc_debug));
452         if (error != 0)
453                 sc->sc_debug = 0;
454 #else
455         sc->sc_debug = 0;
456 #endif
457
458         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: begin\n",__func__);
459
460         /*
461          * Get the offset of the PCI Express Capability Structure in PCI
462          * Configuration Space.
463          */
464 #if defined(__DragonFly__)
465         error = pci_find_extcap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
466 #else
467         error = pci_find_cap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
468 #endif
469         if (error != 0) {
470                 device_printf(dev, "PCIe capability structure not found!\n");
471                 return error;
472         }
473
474         /* Clear device-specific "PCI retry timeout" register (41h). */
475         pci_write_config(dev, 0x41, 0, 1);
476
477         /* Enable bus-mastering. */
478         pci_enable_busmaster(dev);
479
480         rid = PCIR_BAR(0);
481         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
482             RF_ACTIVE);
483         if (sc->mem == NULL) {
484                 device_printf(dev, "can't map mem space\n");
485                 error = ENOMEM;
486                 return error;
487         }
488         sc->sc_st = rman_get_bustag(sc->mem);
489         sc->sc_sh = rman_get_bushandle(sc->mem);
490
491 #if defined(__DragonFly__)
492         pci_alloc_1intr(dev, 1, &rid, &irq_flags);
493         /* Install interrupt handler. */
494         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, irq_flags);
495 #else
496         i = 1;
497         rid = 0;
498         if (pci_alloc_msi(dev, &i) == 0)
499                 rid = 1;
500         /* Install interrupt handler. */
501         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
502             (rid != 0 ? 0 : RF_SHAREABLE));
503 #endif
504         if (sc->irq == NULL) {
505                 device_printf(dev, "can't map interrupt\n");
506                 error = ENOMEM;
507                 goto fail;
508         }
509
510         IWN_LOCK_INIT(sc);
511
512         /* Read hardware revision and attach. */
513         sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> IWN_HW_REV_TYPE_SHIFT)
514             & IWN_HW_REV_TYPE_MASK;
515         sc->subdevice_id = pci_get_subdevice(dev);
516
517         /*
518          * 4965 versus 5000 and later have different methods.
519          * Let's set those up first.
520          */
521         if (sc->hw_type == IWN_HW_REV_TYPE_4965)
522                 error = iwn4965_attach(sc, pci_get_device(dev));
523         else
524                 error = iwn5000_attach(sc, pci_get_device(dev));
525         if (error != 0) {
526                 device_printf(dev, "could not attach device, error %d\n",
527                     error);
528                 goto fail;
529         }
530
531         /*
532          * Next, let's setup the various parameters of each NIC.
533          */
534         error = iwn_config_specific(sc, pci_get_device(dev));
535         if (error != 0) {
536                 device_printf(dev, "could not attach device, error %d\n",
537                     error);
538                 goto fail;
539         }
540
541         if ((error = iwn_hw_prepare(sc)) != 0) {
542                 device_printf(dev, "hardware not ready, error %d\n", error);
543                 goto fail;
544         }
545
546         /* Allocate DMA memory for firmware transfers. */
547         if ((error = iwn_alloc_fwmem(sc)) != 0) {
548                 device_printf(dev,
549                     "could not allocate memory for firmware, error %d\n",
550                     error);
551                 goto fail;
552         }
553
554         /* Allocate "Keep Warm" page. */
555         if ((error = iwn_alloc_kw(sc)) != 0) {
556                 device_printf(dev,
557                     "could not allocate keep warm page, error %d\n", error);
558                 goto fail;
559         }
560
561         /* Allocate ICT table for 5000 Series. */
562         if (sc->hw_type != IWN_HW_REV_TYPE_4965 &&
563             (error = iwn_alloc_ict(sc)) != 0) {
564                 device_printf(dev, "could not allocate ICT table, error %d\n",
565                     error);
566                 goto fail;
567         }
568
569         /* Allocate TX scheduler "rings". */
570         if ((error = iwn_alloc_sched(sc)) != 0) {
571                 device_printf(dev,
572                     "could not allocate TX scheduler rings, error %d\n", error);
573                 goto fail;
574         }
575
576         /* Allocate TX rings (16 on 4965AGN, 20 on >=5000). */
577         for (i = 0; i < sc->ntxqs; i++) {
578                 if ((error = iwn_alloc_tx_ring(sc, &sc->txq[i], i)) != 0) {
579                         device_printf(dev,
580                             "could not allocate TX ring %d, error %d\n", i,
581                             error);
582                         goto fail;
583                 }
584         }
585
586         /* Allocate RX ring. */
587         if ((error = iwn_alloc_rx_ring(sc, &sc->rxq)) != 0) {
588                 device_printf(dev, "could not allocate RX ring, error %d\n",
589                     error);
590                 goto fail;
591         }
592
593         /* Clear pending interrupts. */
594         IWN_WRITE(sc, IWN_INT, 0xffffffff);
595
596         ic = &sc->sc_ic;
597         ic->ic_softc = sc;
598         ic->ic_name = device_get_nameunit(dev);
599         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
600         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
601
602         /* Set device capabilities. */
603         ic->ic_caps =
604                   IEEE80211_C_STA               /* station mode supported */
605                 | IEEE80211_C_MONITOR           /* monitor mode supported */
606 #if 0
607                 | IEEE80211_C_BGSCAN            /* background scanning */
608 #endif
609                 | IEEE80211_C_TXPMGT            /* tx power management */
610                 | IEEE80211_C_SHSLOT            /* short slot time supported */
611                 | IEEE80211_C_WPA
612                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
613 #if 0
614                 | IEEE80211_C_IBSS              /* ibss/adhoc mode */
615 #endif
616                 | IEEE80211_C_WME               /* WME */
617                 | IEEE80211_C_PMGT              /* Station-side power mgmt */
618                 ;
619
620         /* Read MAC address, channels, etc from EEPROM. */
621         if ((error = iwn_read_eeprom(sc, ic->ic_macaddr)) != 0) {
622                 device_printf(dev, "could not read EEPROM, error %d\n",
623                     error);
624                 goto fail;
625         }
626
627         /* Count the number of available chains. */
628         sc->ntxchains =
629             ((sc->txchainmask >> 2) & 1) +
630             ((sc->txchainmask >> 1) & 1) +
631             ((sc->txchainmask >> 0) & 1);
632         sc->nrxchains =
633             ((sc->rxchainmask >> 2) & 1) +
634             ((sc->rxchainmask >> 1) & 1) +
635             ((sc->rxchainmask >> 0) & 1);
636         if (bootverbose) {
637 #if defined(__DragonFly__)
638                 char ethstr[ETHER_ADDRSTRLEN+1];
639                 device_printf(dev, "MIMO %dT%dR, %.4s, address %s\n",
640                     sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
641                     kether_ntoa(ic->ic_macaddr, ethstr));
642 #else
643                 device_printf(dev, "MIMO %dT%dR, %.4s, address %6D\n",
644                     sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
645                     ic->ic_macaddr, ":");
646 #endif
647         }
648
649         if (sc->sc_flags & IWN_FLAG_HAS_11N) {
650                 ic->ic_rxstream = sc->nrxchains;
651                 ic->ic_txstream = sc->ntxchains;
652
653                 /*
654                  * Some of the 3 antenna devices (ie, the 4965) only supports
655                  * 2x2 operation.  So correct the number of streams if
656                  * it's not a 3-stream device.
657                  */
658                 if (! iwn_is_3stream_device(sc)) {
659                         if (ic->ic_rxstream > 2)
660                                 ic->ic_rxstream = 2;
661                         if (ic->ic_txstream > 2)
662                                 ic->ic_txstream = 2;
663                 }
664
665                 ic->ic_htcaps =
666                           IEEE80211_HTCAP_SMPS_OFF      /* SMPS mode disabled */
667                         | IEEE80211_HTCAP_SHORTGI20     /* short GI in 20MHz */
668                         | IEEE80211_HTCAP_CHWIDTH40     /* 40MHz channel width*/
669                         | IEEE80211_HTCAP_SHORTGI40     /* short GI in 40MHz */
670 #ifdef notyet
671                         | IEEE80211_HTCAP_GREENFIELD
672 #if IWN_RBUF_SIZE == 8192
673                         | IEEE80211_HTCAP_MAXAMSDU_7935 /* max A-MSDU length */
674 #else
675                         | IEEE80211_HTCAP_MAXAMSDU_3839 /* max A-MSDU length */
676 #endif
677 #endif
678                         /* s/w capabilities */
679                         | IEEE80211_HTC_HT              /* HT operation */
680                         | IEEE80211_HTC_AMPDU           /* tx A-MPDU */
681 #ifdef notyet
682                         | IEEE80211_HTC_AMSDU           /* tx A-MSDU */
683 #endif
684                         ;
685         }
686
687         ieee80211_ifattach(ic);
688         ic->ic_vap_create = iwn_vap_create;
689         ic->ic_ioctl = iwn_ioctl;
690         ic->ic_parent = iwn_parent;
691         ic->ic_vap_delete = iwn_vap_delete;
692         ic->ic_transmit = iwn_transmit;
693         ic->ic_raw_xmit = iwn_raw_xmit;
694         ic->ic_node_alloc = iwn_node_alloc;
695         sc->sc_ampdu_rx_start = ic->ic_ampdu_rx_start;
696         ic->ic_ampdu_rx_start = iwn_ampdu_rx_start;
697         sc->sc_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
698         ic->ic_ampdu_rx_stop = iwn_ampdu_rx_stop;
699         sc->sc_addba_request = ic->ic_addba_request;
700         ic->ic_addba_request = iwn_addba_request;
701         sc->sc_addba_response = ic->ic_addba_response;
702         ic->ic_addba_response = iwn_addba_response;
703         sc->sc_addba_stop = ic->ic_addba_stop;
704         ic->ic_addba_stop = iwn_ampdu_tx_stop;
705         ic->ic_newassoc = iwn_newassoc;
706         ic->ic_wme.wme_update = iwn_updateedca;
707         ic->ic_update_mcast = iwn_update_mcast;
708         ic->ic_scan_start = iwn_scan_start;
709         ic->ic_scan_end = iwn_scan_end;
710         ic->ic_set_channel = iwn_set_channel;
711         ic->ic_scan_curchan = iwn_scan_curchan;
712         ic->ic_scan_mindwell = iwn_scan_mindwell;
713         ic->ic_getradiocaps = iwn_getradiocaps;
714         ic->ic_setregdomain = iwn_setregdomain;
715
716         iwn_radiotap_attach(sc);
717
718 #if defined(__DragonFly__)
719         callout_init_lk(&sc->calib_to, &sc->sc_lk);
720         callout_init_lk(&sc->watchdog_to, &sc->sc_lk);
721 #else
722         callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
723         callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
724 #endif
725         TASK_INIT(&sc->sc_radioon_task, 0, iwn_radio_on, sc);
726         TASK_INIT(&sc->sc_radiooff_task, 0, iwn_radio_off, sc);
727         TASK_INIT(&sc->sc_panic_task, 0, iwn_panicked, sc);
728         TASK_INIT(&sc->sc_xmit_task, 0, iwn_xmit_task, sc);
729
730         mbufq_init(&sc->sc_xmit_queue, 1024);
731
732         sc->sc_tq = taskqueue_create("iwn_taskq", M_WAITOK,
733             taskqueue_thread_enqueue, &sc->sc_tq);
734 #if defined(__DragonFly__)
735         error = taskqueue_start_threads(&sc->sc_tq, 1, TDPRI_KERN_DAEMON,
736                                         -1, "iwn_taskq");
737 #else
738         error = taskqueue_start_threads(&sc->sc_tq, 1, 0, "iwn_taskq");
739 #endif
740         if (error != 0) {
741                 device_printf(dev, "can't start threads, error %d\n", error);
742                 goto fail;
743         }
744
745         iwn_sysctlattach(sc);
746
747         /*
748          * Hook our interrupt after all initialization is complete.
749          */
750 #if defined(__DragonFly__)
751         error = bus_setup_intr(dev, sc->irq, INTR_MPSAFE,
752                                iwn_intr, sc, &sc->sc_ih,
753                                &wlan_global_serializer);
754 #else
755         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
756             NULL, iwn_intr, sc, &sc->sc_ih);
757 #endif
758         if (error != 0) {
759                 device_printf(dev, "can't establish interrupt, error %d\n",
760                     error);
761                 goto fail;
762         }
763
764 #if 0
765         device_printf(sc->sc_dev, "%s: rx_stats=%d, rx_stats_bt=%d\n",
766             __func__,
767             sizeof(struct iwn_stats),
768             sizeof(struct iwn_stats_bt));
769 #endif
770
771         if (bootverbose)
772                 ieee80211_announce(ic);
773         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
774
775         /* Add debug ioctl right at the end */
776         sc->sc_cdev = make_dev(&iwn_cdevsw, device_get_unit(dev),
777             UID_ROOT, GID_WHEEL, 0600, "%s", device_get_nameunit(dev));
778         if (sc->sc_cdev == NULL) {
779                 device_printf(dev, "failed to create debug character device\n");
780         } else {
781                 sc->sc_cdev->si_drv1 = sc;
782         }
783         return 0;
784 fail:
785         iwn_detach(dev);
786         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
787         return error;
788 }
789
790 /*
791  * Define specific configuration based on device id and subdevice id
792  * pid : PCI device id
793  */
794 static int
795 iwn_config_specific(struct iwn_softc *sc, uint16_t pid)
796 {
797
798         switch (pid) {
799 /* 4965 series */
800         case IWN_DID_4965_1:
801         case IWN_DID_4965_2:
802         case IWN_DID_4965_3:
803         case IWN_DID_4965_4:
804                 sc->base_params = &iwn4965_base_params;
805                 sc->limits = &iwn4965_sensitivity_limits;
806                 sc->fwname = "iwn4965fw";
807                 /* Override chains masks, ROM is known to be broken. */
808                 sc->txchainmask = IWN_ANT_AB;
809                 sc->rxchainmask = IWN_ANT_ABC;
810                 /* Enable normal btcoex */
811                 sc->sc_flags |= IWN_FLAG_BTCOEX;
812                 break;
813 /* 1000 Series */
814         case IWN_DID_1000_1:
815         case IWN_DID_1000_2:
816                 switch(sc->subdevice_id) {
817                         case    IWN_SDID_1000_1:
818                         case    IWN_SDID_1000_2:
819                         case    IWN_SDID_1000_3:
820                         case    IWN_SDID_1000_4:
821                         case    IWN_SDID_1000_5:
822                         case    IWN_SDID_1000_6:
823                         case    IWN_SDID_1000_7:
824                         case    IWN_SDID_1000_8:
825                         case    IWN_SDID_1000_9:
826                         case    IWN_SDID_1000_10:
827                         case    IWN_SDID_1000_11:
828                         case    IWN_SDID_1000_12:
829                                 sc->limits = &iwn1000_sensitivity_limits;
830                                 sc->base_params = &iwn1000_base_params;
831                                 sc->fwname = "iwn1000fw";
832                                 break;
833                         default:
834                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
835                                     "0x%04x rev %d not supported (subdevice)\n", pid,
836                                     sc->subdevice_id,sc->hw_type);
837                                 return ENOTSUP;
838                 }
839                 break;
840 /* 6x00 Series */
841         case IWN_DID_6x00_2:
842         case IWN_DID_6x00_4:
843         case IWN_DID_6x00_1:
844         case IWN_DID_6x00_3:
845                 sc->fwname = "iwn6000fw";
846                 sc->limits = &iwn6000_sensitivity_limits;
847                 switch(sc->subdevice_id) {
848                         case IWN_SDID_6x00_1:
849                         case IWN_SDID_6x00_2:
850                         case IWN_SDID_6x00_8:
851                                 //iwl6000_3agn_cfg
852                                 sc->base_params = &iwn_6000_base_params;
853                                 break;
854                         case IWN_SDID_6x00_3:
855                         case IWN_SDID_6x00_6:
856                         case IWN_SDID_6x00_9:
857                                 ////iwl6000i_2agn
858                         case IWN_SDID_6x00_4:
859                         case IWN_SDID_6x00_7:
860                         case IWN_SDID_6x00_10:
861                                 //iwl6000i_2abg_cfg
862                         case IWN_SDID_6x00_5:
863                                 //iwl6000i_2bg_cfg
864                                 sc->base_params = &iwn_6000i_base_params;
865                                 sc->sc_flags |= IWN_FLAG_INTERNAL_PA;
866                                 sc->txchainmask = IWN_ANT_BC;
867                                 sc->rxchainmask = IWN_ANT_BC;
868                                 break;
869                         default:
870                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
871                                     "0x%04x rev %d not supported (subdevice)\n", pid,
872                                     sc->subdevice_id,sc->hw_type);
873                                 return ENOTSUP;
874                 }
875                 break;
876 /* 6x05 Series */
877         case IWN_DID_6x05_1:
878         case IWN_DID_6x05_2:
879                 switch(sc->subdevice_id) {
880                         case IWN_SDID_6x05_1:
881                         case IWN_SDID_6x05_4:
882                         case IWN_SDID_6x05_6:
883                                 //iwl6005_2agn_cfg
884                         case IWN_SDID_6x05_2:
885                         case IWN_SDID_6x05_5:
886                         case IWN_SDID_6x05_7:
887                                 //iwl6005_2abg_cfg
888                         case IWN_SDID_6x05_3:
889                                 //iwl6005_2bg_cfg
890                         case IWN_SDID_6x05_8:
891                         case IWN_SDID_6x05_9:
892                                 //iwl6005_2agn_sff_cfg
893                         case IWN_SDID_6x05_10:
894                                 //iwl6005_2agn_d_cfg
895                         case IWN_SDID_6x05_11:
896                                 //iwl6005_2agn_mow1_cfg
897                         case IWN_SDID_6x05_12:
898                                 //iwl6005_2agn_mow2_cfg
899                                 sc->fwname = "iwn6000g2afw";
900                                 sc->limits = &iwn6000_sensitivity_limits;
901                                 sc->base_params = &iwn_6000g2_base_params;
902                                 break;
903                         default:
904                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
905                                     "0x%04x rev %d not supported (subdevice)\n", pid,
906                                     sc->subdevice_id,sc->hw_type);
907                                 return ENOTSUP;
908                 }
909                 break;
910 /* 6x35 Series */
911         case IWN_DID_6035_1:
912         case IWN_DID_6035_2:
913                 switch(sc->subdevice_id) {
914                         case IWN_SDID_6035_1:
915                         case IWN_SDID_6035_2:
916                         case IWN_SDID_6035_3:
917                         case IWN_SDID_6035_4:
918                                 sc->fwname = "iwn6000g2bfw";
919                                 sc->limits = &iwn6235_sensitivity_limits;
920                                 sc->base_params = &iwn_6235_base_params;
921                                 break;
922                         default:
923                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
924                                     "0x%04x rev %d not supported (subdevice)\n", pid,
925                                     sc->subdevice_id,sc->hw_type);
926                                 return ENOTSUP;
927                 }
928                 break;
929 /* 6x50 WiFi/WiMax Series */
930         case IWN_DID_6050_1:
931         case IWN_DID_6050_2:
932                 switch(sc->subdevice_id) {
933                         case IWN_SDID_6050_1:
934                         case IWN_SDID_6050_3:
935                         case IWN_SDID_6050_5:
936                                 //iwl6050_2agn_cfg
937                         case IWN_SDID_6050_2:
938                         case IWN_SDID_6050_4:
939                         case IWN_SDID_6050_6:
940                                 //iwl6050_2abg_cfg
941                                 sc->fwname = "iwn6050fw";
942                                 sc->txchainmask = IWN_ANT_AB;
943                                 sc->rxchainmask = IWN_ANT_AB;
944                                 sc->limits = &iwn6000_sensitivity_limits;
945                                 sc->base_params = &iwn_6050_base_params;
946                                 break;
947                         default:
948                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
949                                     "0x%04x rev %d not supported (subdevice)\n", pid,
950                                     sc->subdevice_id,sc->hw_type);
951                                 return ENOTSUP;
952                 }
953                 break;
954 /* 6150 WiFi/WiMax Series */
955         case IWN_DID_6150_1:
956         case IWN_DID_6150_2:
957                 switch(sc->subdevice_id) {
958                         case IWN_SDID_6150_1:
959                         case IWN_SDID_6150_3:
960                         case IWN_SDID_6150_5:
961                                 // iwl6150_bgn_cfg
962                         case IWN_SDID_6150_2:
963                         case IWN_SDID_6150_4:
964                         case IWN_SDID_6150_6:
965                                 //iwl6150_bg_cfg
966                                 sc->fwname = "iwn6050fw";
967                                 sc->limits = &iwn6000_sensitivity_limits;
968                                 sc->base_params = &iwn_6150_base_params;
969                                 break;
970                         default:
971                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
972                                     "0x%04x rev %d not supported (subdevice)\n", pid,
973                                     sc->subdevice_id,sc->hw_type);
974                                 return ENOTSUP;
975                 }
976                 break;
977 /* 6030 Series and 1030 Series */
978         case IWN_DID_x030_1:
979         case IWN_DID_x030_2:
980         case IWN_DID_x030_3:
981         case IWN_DID_x030_4:
982                 switch(sc->subdevice_id) {
983                         case IWN_SDID_x030_1:
984                         case IWN_SDID_x030_3:
985                         case IWN_SDID_x030_5:
986                         // iwl1030_bgn_cfg
987                         case IWN_SDID_x030_2:
988                         case IWN_SDID_x030_4:
989                         case IWN_SDID_x030_6:
990                         //iwl1030_bg_cfg
991                         case IWN_SDID_x030_7:
992                         case IWN_SDID_x030_10:
993                         case IWN_SDID_x030_14:
994                         //iwl6030_2agn_cfg
995                         case IWN_SDID_x030_8:
996                         case IWN_SDID_x030_11:
997                         case IWN_SDID_x030_15:
998                         // iwl6030_2bgn_cfg
999                         case IWN_SDID_x030_9:
1000                         case IWN_SDID_x030_12:
1001                         case IWN_SDID_x030_16:
1002                         // iwl6030_2abg_cfg
1003                         case IWN_SDID_x030_13:
1004                         //iwl6030_2bg_cfg
1005                                 sc->fwname = "iwn6000g2bfw";
1006                                 sc->limits = &iwn6000_sensitivity_limits;
1007                                 sc->base_params = &iwn_6000g2b_base_params;
1008                                 break;
1009                         default:
1010                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1011                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1012                                     sc->subdevice_id,sc->hw_type);
1013                                 return ENOTSUP;
1014                 }
1015                 break;
1016 /* 130 Series WiFi */
1017 /* XXX: This series will need adjustment for rate.
1018  * see rx_with_siso_diversity in linux kernel
1019  */
1020         case IWN_DID_130_1:
1021         case IWN_DID_130_2:
1022                 switch(sc->subdevice_id) {
1023                         case IWN_SDID_130_1:
1024                         case IWN_SDID_130_3:
1025                         case IWN_SDID_130_5:
1026                         //iwl130_bgn_cfg
1027                         case IWN_SDID_130_2:
1028                         case IWN_SDID_130_4:
1029                         case IWN_SDID_130_6:
1030                         //iwl130_bg_cfg
1031                                 sc->fwname = "iwn6000g2bfw";
1032                                 sc->limits = &iwn6000_sensitivity_limits;
1033                                 sc->base_params = &iwn_6000g2b_base_params;
1034                                 break;
1035                         default:
1036                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1037                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1038                                     sc->subdevice_id,sc->hw_type);
1039                                 return ENOTSUP;
1040                 }
1041                 break;
1042 /* 100 Series WiFi */
1043         case IWN_DID_100_1:
1044         case IWN_DID_100_2:
1045                 switch(sc->subdevice_id) {
1046                         case IWN_SDID_100_1:
1047                         case IWN_SDID_100_2:
1048                         case IWN_SDID_100_3:
1049                         case IWN_SDID_100_4:
1050                         case IWN_SDID_100_5:
1051                         case IWN_SDID_100_6:
1052                                 sc->limits = &iwn1000_sensitivity_limits;
1053                                 sc->base_params = &iwn1000_base_params;
1054                                 sc->fwname = "iwn100fw";
1055                                 break;
1056                         default:
1057                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1058                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1059                                     sc->subdevice_id,sc->hw_type);
1060                                 return ENOTSUP;
1061                 }
1062                 break;
1063
1064 /* 105 Series */
1065 /* XXX: This series will need adjustment for rate.
1066  * see rx_with_siso_diversity in linux kernel
1067  */
1068         case IWN_DID_105_1:
1069         case IWN_DID_105_2:
1070                 switch(sc->subdevice_id) {
1071                         case IWN_SDID_105_1:
1072                         case IWN_SDID_105_2:
1073                         case IWN_SDID_105_3:
1074                         //iwl105_bgn_cfg
1075                         case IWN_SDID_105_4:
1076                         //iwl105_bgn_d_cfg
1077                                 sc->limits = &iwn2030_sensitivity_limits;
1078                                 sc->base_params = &iwn2000_base_params;
1079                                 sc->fwname = "iwn105fw";
1080                                 break;
1081                         default:
1082                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1083                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1084                                     sc->subdevice_id,sc->hw_type);
1085                                 return ENOTSUP;
1086                 }
1087                 break;
1088
1089 /* 135 Series */
1090 /* XXX: This series will need adjustment for rate.
1091  * see rx_with_siso_diversity in linux kernel
1092  */
1093         case IWN_DID_135_1:
1094         case IWN_DID_135_2:
1095                 switch(sc->subdevice_id) {
1096                         case IWN_SDID_135_1:
1097                         case IWN_SDID_135_2:
1098                         case IWN_SDID_135_3:
1099                                 sc->limits = &iwn2030_sensitivity_limits;
1100                                 sc->base_params = &iwn2030_base_params;
1101                                 sc->fwname = "iwn135fw";
1102                                 break;
1103                         default:
1104                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1105                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1106                                     sc->subdevice_id,sc->hw_type);
1107                                 return ENOTSUP;
1108                 }
1109                 break;
1110
1111 /* 2x00 Series */
1112         case IWN_DID_2x00_1:
1113         case IWN_DID_2x00_2:
1114                 switch(sc->subdevice_id) {
1115                         case IWN_SDID_2x00_1:
1116                         case IWN_SDID_2x00_2:
1117                         case IWN_SDID_2x00_3:
1118                         //iwl2000_2bgn_cfg
1119                         case IWN_SDID_2x00_4:
1120                         //iwl2000_2bgn_d_cfg
1121                                 sc->limits = &iwn2030_sensitivity_limits;
1122                                 sc->base_params = &iwn2000_base_params;
1123                                 sc->fwname = "iwn2000fw";
1124                                 break;
1125                         default:
1126                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1127                                     "0x%04x rev %d not supported (subdevice) \n",
1128                                     pid, sc->subdevice_id, sc->hw_type);
1129                                 return ENOTSUP;
1130                 }
1131                 break;
1132 /* 2x30 Series */
1133         case IWN_DID_2x30_1:
1134         case IWN_DID_2x30_2:
1135                 switch(sc->subdevice_id) {
1136                         case IWN_SDID_2x30_1:
1137                         case IWN_SDID_2x30_3:
1138                         case IWN_SDID_2x30_5:
1139                         //iwl100_bgn_cfg
1140                         case IWN_SDID_2x30_2:
1141                         case IWN_SDID_2x30_4:
1142                         case IWN_SDID_2x30_6:
1143                         //iwl100_bg_cfg
1144                                 sc->limits = &iwn2030_sensitivity_limits;
1145                                 sc->base_params = &iwn2030_base_params;
1146                                 sc->fwname = "iwn2030fw";
1147                                 break;
1148                         default:
1149                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1150                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1151                                     sc->subdevice_id,sc->hw_type);
1152                                 return ENOTSUP;
1153                 }
1154                 break;
1155 /* 5x00 Series */
1156         case IWN_DID_5x00_1:
1157         case IWN_DID_5x00_2:
1158         case IWN_DID_5x00_3:
1159         case IWN_DID_5x00_4:
1160                 sc->limits = &iwn5000_sensitivity_limits;
1161                 sc->base_params = &iwn5000_base_params;
1162                 sc->fwname = "iwn5000fw";
1163                 switch(sc->subdevice_id) {
1164                         case IWN_SDID_5x00_1:
1165                         case IWN_SDID_5x00_2:
1166                         case IWN_SDID_5x00_3:
1167                         case IWN_SDID_5x00_4:
1168                         case IWN_SDID_5x00_9:
1169                         case IWN_SDID_5x00_10:
1170                         case IWN_SDID_5x00_11:
1171                         case IWN_SDID_5x00_12:
1172                         case IWN_SDID_5x00_17:
1173                         case IWN_SDID_5x00_18:
1174                         case IWN_SDID_5x00_19:
1175                         case IWN_SDID_5x00_20:
1176                         //iwl5100_agn_cfg
1177                                 sc->txchainmask = IWN_ANT_B;
1178                                 sc->rxchainmask = IWN_ANT_AB;
1179                                 break;
1180                         case IWN_SDID_5x00_5:
1181                         case IWN_SDID_5x00_6:
1182                         case IWN_SDID_5x00_13:
1183                         case IWN_SDID_5x00_14:
1184                         case IWN_SDID_5x00_21:
1185                         case IWN_SDID_5x00_22:
1186                         //iwl5100_bgn_cfg
1187                                 sc->txchainmask = IWN_ANT_B;
1188                                 sc->rxchainmask = IWN_ANT_AB;
1189                                 break;
1190                         case IWN_SDID_5x00_7:
1191                         case IWN_SDID_5x00_8:
1192                         case IWN_SDID_5x00_15:
1193                         case IWN_SDID_5x00_16:
1194                         case IWN_SDID_5x00_23:
1195                         case IWN_SDID_5x00_24:
1196                         //iwl5100_abg_cfg
1197                                 sc->txchainmask = IWN_ANT_B;
1198                                 sc->rxchainmask = IWN_ANT_AB;
1199                                 break;
1200                         case IWN_SDID_5x00_25:
1201                         case IWN_SDID_5x00_26:
1202                         case IWN_SDID_5x00_27:
1203                         case IWN_SDID_5x00_28:
1204                         case IWN_SDID_5x00_29:
1205                         case IWN_SDID_5x00_30:
1206                         case IWN_SDID_5x00_31:
1207                         case IWN_SDID_5x00_32:
1208                         case IWN_SDID_5x00_33:
1209                         case IWN_SDID_5x00_34:
1210                         case IWN_SDID_5x00_35:
1211                         case IWN_SDID_5x00_36:
1212                         //iwl5300_agn_cfg
1213                                 sc->txchainmask = IWN_ANT_ABC;
1214                                 sc->rxchainmask = IWN_ANT_ABC;
1215                                 break;
1216                         default:
1217                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1218                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1219                                     sc->subdevice_id,sc->hw_type);
1220                                 return ENOTSUP;
1221                 }
1222                 break;
1223 /* 5x50 Series */
1224         case IWN_DID_5x50_1:
1225         case IWN_DID_5x50_2:
1226         case IWN_DID_5x50_3:
1227         case IWN_DID_5x50_4:
1228                 sc->limits = &iwn5000_sensitivity_limits;
1229                 sc->base_params = &iwn5000_base_params;
1230                 sc->fwname = "iwn5000fw";
1231                 switch(sc->subdevice_id) {
1232                         case IWN_SDID_5x50_1:
1233                         case IWN_SDID_5x50_2:
1234                         case IWN_SDID_5x50_3:
1235                         //iwl5350_agn_cfg
1236                                 sc->limits = &iwn5000_sensitivity_limits;
1237                                 sc->base_params = &iwn5000_base_params;
1238                                 sc->fwname = "iwn5000fw";
1239                                 break;
1240                         case IWN_SDID_5x50_4:
1241                         case IWN_SDID_5x50_5:
1242                         case IWN_SDID_5x50_8:
1243                         case IWN_SDID_5x50_9:
1244                         case IWN_SDID_5x50_10:
1245                         case IWN_SDID_5x50_11:
1246                         //iwl5150_agn_cfg
1247                         case IWN_SDID_5x50_6:
1248                         case IWN_SDID_5x50_7:
1249                         case IWN_SDID_5x50_12:
1250                         case IWN_SDID_5x50_13:
1251                         //iwl5150_abg_cfg
1252                                 sc->limits = &iwn5000_sensitivity_limits;
1253                                 sc->fwname = "iwn5150fw";
1254                                 sc->base_params = &iwn_5x50_base_params;
1255                                 break;
1256                         default:
1257                                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1258                                     "0x%04x rev %d not supported (subdevice)\n", pid,
1259                                     sc->subdevice_id,sc->hw_type);
1260                                 return ENOTSUP;
1261                 }
1262                 break;
1263         default:
1264                 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id : 0x%04x"
1265                     "rev 0x%08x not supported (device)\n", pid, sc->subdevice_id,
1266                      sc->hw_type);
1267                 return ENOTSUP;
1268         }
1269         return 0;
1270 }
1271
1272 static int
1273 iwn4965_attach(struct iwn_softc *sc, uint16_t pid)
1274 {
1275         struct iwn_ops *ops = &sc->ops;
1276
1277         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1278         ops->load_firmware = iwn4965_load_firmware;
1279         ops->read_eeprom = iwn4965_read_eeprom;
1280         ops->post_alive = iwn4965_post_alive;
1281         ops->nic_config = iwn4965_nic_config;
1282         ops->update_sched = iwn4965_update_sched;
1283         ops->get_temperature = iwn4965_get_temperature;
1284         ops->get_rssi = iwn4965_get_rssi;
1285         ops->set_txpower = iwn4965_set_txpower;
1286         ops->init_gains = iwn4965_init_gains;
1287         ops->set_gains = iwn4965_set_gains;
1288         ops->add_node = iwn4965_add_node;
1289         ops->tx_done = iwn4965_tx_done;
1290         ops->ampdu_tx_start = iwn4965_ampdu_tx_start;
1291         ops->ampdu_tx_stop = iwn4965_ampdu_tx_stop;
1292         sc->ntxqs = IWN4965_NTXQUEUES;
1293         sc->firstaggqueue = IWN4965_FIRSTAGGQUEUE;
1294         sc->ndmachnls = IWN4965_NDMACHNLS;
1295         sc->broadcast_id = IWN4965_ID_BROADCAST;
1296         sc->rxonsz = IWN4965_RXONSZ;
1297         sc->schedsz = IWN4965_SCHEDSZ;
1298         sc->fw_text_maxsz = IWN4965_FW_TEXT_MAXSZ;
1299         sc->fw_data_maxsz = IWN4965_FW_DATA_MAXSZ;
1300         sc->fwsz = IWN4965_FWSZ;
1301         sc->sched_txfact_addr = IWN4965_SCHED_TXFACT;
1302         sc->limits = &iwn4965_sensitivity_limits;
1303         sc->fwname = "iwn4965fw";
1304         /* Override chains masks, ROM is known to be broken. */
1305         sc->txchainmask = IWN_ANT_AB;
1306         sc->rxchainmask = IWN_ANT_ABC;
1307         /* Enable normal btcoex */
1308         sc->sc_flags |= IWN_FLAG_BTCOEX;
1309
1310         DPRINTF(sc, IWN_DEBUG_TRACE, "%s: end\n",__func__);
1311
1312         return 0;
1313 }
1314
1315 static int
1316 iwn5000_attach(struct iwn_softc *sc, uint16_t pid)
1317 {
1318         struct iwn_ops *ops = &sc->ops;
1319
1320         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1321
1322         ops->load_firmware = iwn5000_load_firmware;
1323         ops->read_eeprom = iwn5000_read_eeprom;
1324         ops->post_alive = iwn5000_post_alive;
1325         ops->nic_config = iwn5000_nic_config;
1326         ops->update_sched = iwn5000_update_sched;
1327         ops->get_temperature = iwn5000_get_temperature;
1328         ops->get_rssi = iwn5000_get_rssi;
1329         ops->set_txpower = iwn5000_set_txpower;
1330         ops->init_gains = iwn5000_init_gains;
1331         ops->set_gains = iwn5000_set_gains;
1332         ops->add_node = iwn5000_add_node;
1333         ops->tx_done = iwn5000_tx_done;
1334         ops->ampdu_tx_start = iwn5000_ampdu_tx_start;
1335         ops->ampdu_tx_stop = iwn5000_ampdu_tx_stop;
1336         sc->ntxqs = IWN5000_NTXQUEUES;
1337         sc->firstaggqueue = IWN5000_FIRSTAGGQUEUE;
1338         sc->ndmachnls = IWN5000_NDMACHNLS;
1339         sc->broadcast_id = IWN5000_ID_BROADCAST;
1340         sc->rxonsz = IWN5000_RXONSZ;
1341         sc->schedsz = IWN5000_SCHEDSZ;
1342         sc->fw_text_maxsz = IWN5000_FW_TEXT_MAXSZ;
1343         sc->fw_data_maxsz = IWN5000_FW_DATA_MAXSZ;
1344         sc->fwsz = IWN5000_FWSZ;
1345         sc->sched_txfact_addr = IWN5000_SCHED_TXFACT;
1346         sc->reset_noise_gain = IWN5000_PHY_CALIB_RESET_NOISE_GAIN;
1347         sc->noise_gain = IWN5000_PHY_CALIB_NOISE_GAIN;
1348
1349         return 0;
1350 }
1351
1352 /*
1353  * Attach the interface to 802.11 radiotap.
1354  */
1355 static void
1356 iwn_radiotap_attach(struct iwn_softc *sc)
1357 {
1358
1359         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1360         ieee80211_radiotap_attach(&sc->sc_ic,
1361             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
1362                 IWN_TX_RADIOTAP_PRESENT,
1363             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
1364                 IWN_RX_RADIOTAP_PRESENT);
1365         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1366 }
1367
1368 static void
1369 iwn_sysctlattach(struct iwn_softc *sc)
1370 {
1371 #ifdef  IWN_DEBUG
1372         struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
1373         struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
1374
1375         SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1376             "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
1377                 "control debugging printfs");
1378 #endif
1379 }
1380
1381 static struct ieee80211vap *
1382 iwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1383     enum ieee80211_opmode opmode, int flags,
1384     const uint8_t bssid[IEEE80211_ADDR_LEN],
1385     const uint8_t mac[IEEE80211_ADDR_LEN])
1386 {
1387         struct iwn_softc *sc = ic->ic_softc;
1388         struct iwn_vap *ivp;
1389         struct ieee80211vap *vap;
1390
1391         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
1392                 return NULL;
1393
1394         ivp = kmalloc(sizeof(struct iwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1395         vap = &ivp->iv_vap;
1396         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1397         ivp->ctx = IWN_RXON_BSS_CTX;
1398         vap->iv_bmissthreshold = 10;            /* override default */
1399         /* Override with driver methods. */
1400         ivp->iv_newstate = vap->iv_newstate;
1401         vap->iv_newstate = iwn_newstate;
1402         sc->ivap[IWN_RXON_BSS_CTX] = vap;
1403
1404         ieee80211_ratectl_init(vap);
1405         /* Complete setup. */
1406         ieee80211_vap_attach(vap, iwn_media_change, ieee80211_media_status,
1407             mac);
1408         ic->ic_opmode = opmode;
1409         return vap;
1410 }
1411
1412 static void
1413 iwn_vap_delete(struct ieee80211vap *vap)
1414 {
1415         struct iwn_vap *ivp = IWN_VAP(vap);
1416
1417         ieee80211_ratectl_deinit(vap);
1418         ieee80211_vap_detach(vap);
1419         kfree(ivp, M_80211_VAP);
1420 }
1421
1422 static void
1423 iwn_xmit_queue_drain(struct iwn_softc *sc)
1424 {
1425         struct mbuf *m;
1426         struct ieee80211_node *ni;
1427
1428         IWN_LOCK_ASSERT(sc);
1429         while ((m = mbufq_dequeue(&sc->sc_xmit_queue)) != NULL) {
1430                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1431                 ieee80211_free_node(ni);
1432                 m_freem(m);
1433         }
1434 }
1435
1436 static int
1437 iwn_xmit_queue_enqueue(struct iwn_softc *sc, struct mbuf *m)
1438 {
1439
1440         IWN_LOCK_ASSERT(sc);
1441         return (mbufq_enqueue(&sc->sc_xmit_queue, m));
1442 }
1443
1444 static int
1445 iwn_detach(device_t dev)
1446 {
1447         struct iwn_softc *sc = device_get_softc(dev);
1448         int qid;
1449
1450         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1451
1452         if (sc->sc_ic.ic_softc != NULL) {
1453                 /* Free the mbuf queue and node references */
1454                 IWN_LOCK(sc);
1455                 iwn_xmit_queue_drain(sc);
1456                 IWN_UNLOCK(sc);
1457
1458                 ieee80211_draintask(&sc->sc_ic, &sc->sc_radioon_task);
1459                 ieee80211_draintask(&sc->sc_ic, &sc->sc_radiooff_task);
1460                 iwn_stop(sc);
1461
1462 #if defined(__DragonFly__)
1463                 /* doesn't exist for DFly, DFly drains tasks on free */
1464 #else
1465                 taskqueue_drain_all(sc->sc_tq);
1466 #endif
1467                 taskqueue_free(sc->sc_tq);
1468
1469                 callout_drain(&sc->watchdog_to);
1470                 callout_drain(&sc->calib_to);
1471                 ieee80211_ifdetach(&sc->sc_ic);
1472         }
1473
1474         /* Uninstall interrupt handler. */
1475         if (sc->irq != NULL) {
1476                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
1477                 bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
1478                     sc->irq);
1479                 pci_release_msi(dev);
1480         }
1481
1482         /* Free DMA resources. */
1483         iwn_free_rx_ring(sc, &sc->rxq);
1484         for (qid = 0; qid < sc->ntxqs; qid++)
1485                 iwn_free_tx_ring(sc, &sc->txq[qid]);
1486         iwn_free_sched(sc);
1487         iwn_free_kw(sc);
1488         if (sc->ict != NULL)
1489                 iwn_free_ict(sc);
1490         iwn_free_fwmem(sc);
1491
1492         if (sc->mem != NULL)
1493                 bus_release_resource(dev, SYS_RES_MEMORY,
1494                     rman_get_rid(sc->mem), sc->mem);
1495
1496         if (sc->sc_cdev) {
1497                 destroy_dev(sc->sc_cdev);
1498                 sc->sc_cdev = NULL;
1499         }
1500
1501         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n", __func__);
1502         IWN_LOCK_DESTROY(sc);
1503         return 0;
1504 }
1505
1506 static int
1507 iwn_shutdown(device_t dev)
1508 {
1509         struct iwn_softc *sc = device_get_softc(dev);
1510
1511         iwn_stop(sc);
1512         return 0;
1513 }
1514
1515 static int
1516 iwn_suspend(device_t dev)
1517 {
1518         struct iwn_softc *sc = device_get_softc(dev);
1519
1520         ieee80211_suspend_all(&sc->sc_ic);
1521         return 0;
1522 }
1523
1524 static int
1525 iwn_resume(device_t dev)
1526 {
1527         struct iwn_softc *sc = device_get_softc(dev);
1528
1529         /* Clear device-specific "PCI retry timeout" register (41h). */
1530         pci_write_config(dev, 0x41, 0, 1);
1531
1532         ieee80211_resume_all(&sc->sc_ic);
1533         return 0;
1534 }
1535
1536 static int
1537 iwn_nic_lock(struct iwn_softc *sc)
1538 {
1539         int ntries;
1540
1541         /* Request exclusive access to NIC. */
1542         IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1543
1544         /* Spin until we actually get the lock. */
1545         for (ntries = 0; ntries < 1000; ntries++) {
1546                 if ((IWN_READ(sc, IWN_GP_CNTRL) &
1547                      (IWN_GP_CNTRL_MAC_ACCESS_ENA | IWN_GP_CNTRL_SLEEP)) ==
1548                     IWN_GP_CNTRL_MAC_ACCESS_ENA)
1549                         return 0;
1550                 DELAY(10);
1551         }
1552         return ETIMEDOUT;
1553 }
1554
1555 static __inline void
1556 iwn_nic_unlock(struct iwn_softc *sc)
1557 {
1558         IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1559 }
1560
1561 static __inline uint32_t
1562 iwn_prph_read(struct iwn_softc *sc, uint32_t addr)
1563 {
1564         IWN_WRITE(sc, IWN_PRPH_RADDR, IWN_PRPH_DWORD | addr);
1565         IWN_BARRIER_READ_WRITE(sc);
1566         return IWN_READ(sc, IWN_PRPH_RDATA);
1567 }
1568
1569 static __inline void
1570 iwn_prph_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1571 {
1572         IWN_WRITE(sc, IWN_PRPH_WADDR, IWN_PRPH_DWORD | addr);
1573         IWN_BARRIER_WRITE(sc);
1574         IWN_WRITE(sc, IWN_PRPH_WDATA, data);
1575 }
1576
1577 static __inline void
1578 iwn_prph_setbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1579 {
1580         iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) | mask);
1581 }
1582
1583 static __inline void
1584 iwn_prph_clrbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1585 {
1586         iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) & ~mask);
1587 }
1588
1589 static __inline void
1590 iwn_prph_write_region_4(struct iwn_softc *sc, uint32_t addr,
1591     const uint32_t *data, int count)
1592 {
1593         for (; count > 0; count--, data++, addr += 4)
1594                 iwn_prph_write(sc, addr, *data);
1595 }
1596
1597 static __inline uint32_t
1598 iwn_mem_read(struct iwn_softc *sc, uint32_t addr)
1599 {
1600         IWN_WRITE(sc, IWN_MEM_RADDR, addr);
1601         IWN_BARRIER_READ_WRITE(sc);
1602         return IWN_READ(sc, IWN_MEM_RDATA);
1603 }
1604
1605 static __inline void
1606 iwn_mem_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1607 {
1608         IWN_WRITE(sc, IWN_MEM_WADDR, addr);
1609         IWN_BARRIER_WRITE(sc);
1610         IWN_WRITE(sc, IWN_MEM_WDATA, data);
1611 }
1612
1613 static __inline void
1614 iwn_mem_write_2(struct iwn_softc *sc, uint32_t addr, uint16_t data)
1615 {
1616         uint32_t tmp;
1617
1618         tmp = iwn_mem_read(sc, addr & ~3);
1619         if (addr & 3)
1620                 tmp = (tmp & 0x0000ffff) | data << 16;
1621         else
1622                 tmp = (tmp & 0xffff0000) | data;
1623         iwn_mem_write(sc, addr & ~3, tmp);
1624 }
1625
1626 static __inline void
1627 iwn_mem_read_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t *data,
1628     int count)
1629 {
1630         for (; count > 0; count--, addr += 4)
1631                 *data++ = iwn_mem_read(sc, addr);
1632 }
1633
1634 static __inline void
1635 iwn_mem_set_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t val,
1636     int count)
1637 {
1638         for (; count > 0; count--, addr += 4)
1639                 iwn_mem_write(sc, addr, val);
1640 }
1641
1642 static int
1643 iwn_eeprom_lock(struct iwn_softc *sc)
1644 {
1645         int i, ntries;
1646
1647         for (i = 0; i < 100; i++) {
1648                 /* Request exclusive access to EEPROM. */
1649                 IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
1650                     IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1651
1652                 /* Spin until we actually get the lock. */
1653                 for (ntries = 0; ntries < 100; ntries++) {
1654                         if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
1655                             IWN_HW_IF_CONFIG_EEPROM_LOCKED)
1656                                 return 0;
1657                         DELAY(10);
1658                 }
1659         }
1660         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end timeout\n", __func__);
1661         return ETIMEDOUT;
1662 }
1663
1664 static __inline void
1665 iwn_eeprom_unlock(struct iwn_softc *sc)
1666 {
1667         IWN_CLRBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1668 }
1669
1670 /*
1671  * Initialize access by host to One Time Programmable ROM.
1672  * NB: This kind of ROM can be found on 1000 or 6000 Series only.
1673  */
1674 static int
1675 iwn_init_otprom(struct iwn_softc *sc)
1676 {
1677         uint16_t prev, base, next;
1678         int count, error;
1679
1680         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1681
1682         /* Wait for clock stabilization before accessing prph. */
1683         if ((error = iwn_clock_wait(sc)) != 0)
1684                 return error;
1685
1686         if ((error = iwn_nic_lock(sc)) != 0)
1687                 return error;
1688         iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1689         DELAY(5);
1690         iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1691         iwn_nic_unlock(sc);
1692
1693         /* Set auto clock gate disable bit for HW with OTP shadow RAM. */
1694         if (sc->base_params->shadow_ram_support) {
1695                 IWN_SETBITS(sc, IWN_DBG_LINK_PWR_MGMT,
1696                     IWN_RESET_LINK_PWR_MGMT_DIS);
1697         }
1698         IWN_CLRBITS(sc, IWN_EEPROM_GP, IWN_EEPROM_GP_IF_OWNER);
1699         /* Clear ECC status. */
1700         IWN_SETBITS(sc, IWN_OTP_GP,
1701             IWN_OTP_GP_ECC_CORR_STTS | IWN_OTP_GP_ECC_UNCORR_STTS);
1702
1703         /*
1704          * Find the block before last block (contains the EEPROM image)
1705          * for HW without OTP shadow RAM.
1706          */
1707         if (! sc->base_params->shadow_ram_support) {
1708                 /* Switch to absolute addressing mode. */
1709                 IWN_CLRBITS(sc, IWN_OTP_GP, IWN_OTP_GP_RELATIVE_ACCESS);
1710                 base = prev = 0;
1711                 for (count = 0; count < sc->base_params->max_ll_items;
1712                     count++) {
1713                         error = iwn_read_prom_data(sc, base, &next, 2);
1714                         if (error != 0)
1715                                 return error;
1716                         if (next == 0)  /* End of linked-list. */
1717                                 break;
1718                         prev = base;
1719                         base = le16toh(next);
1720                 }
1721                 if (count == 0 || count == sc->base_params->max_ll_items)
1722                         return EIO;
1723                 /* Skip "next" word. */
1724                 sc->prom_base = prev + 1;
1725         }
1726
1727         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1728
1729         return 0;
1730 }
1731
1732 static int
1733 iwn_read_prom_data(struct iwn_softc *sc, uint32_t addr, void *data, int count)
1734 {
1735         uint8_t *out = data;
1736         uint32_t val, tmp;
1737         int ntries;
1738
1739         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1740
1741         addr += sc->prom_base;
1742         for (; count > 0; count -= 2, addr++) {
1743                 IWN_WRITE(sc, IWN_EEPROM, addr << 2);
1744                 for (ntries = 0; ntries < 10; ntries++) {
1745                         val = IWN_READ(sc, IWN_EEPROM);
1746                         if (val & IWN_EEPROM_READ_VALID)
1747                                 break;
1748                         DELAY(5);
1749                 }
1750                 if (ntries == 10) {
1751                         device_printf(sc->sc_dev,
1752                             "timeout reading ROM at 0x%x\n", addr);
1753                         return ETIMEDOUT;
1754                 }
1755                 if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
1756                         /* OTPROM, check for ECC errors. */
1757                         tmp = IWN_READ(sc, IWN_OTP_GP);
1758                         if (tmp & IWN_OTP_GP_ECC_UNCORR_STTS) {
1759                                 device_printf(sc->sc_dev,
1760                                     "OTPROM ECC error at 0x%x\n", addr);
1761                                 return EIO;
1762                         }
1763                         if (tmp & IWN_OTP_GP_ECC_CORR_STTS) {
1764                                 /* Correctable ECC error, clear bit. */
1765                                 IWN_SETBITS(sc, IWN_OTP_GP,
1766                                     IWN_OTP_GP_ECC_CORR_STTS);
1767                         }
1768                 }
1769                 *out++ = val >> 16;
1770                 if (count > 1)
1771                         *out++ = val >> 24;
1772         }
1773
1774         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1775
1776         return 0;
1777 }
1778
1779 static void
1780 iwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1781 {
1782         if (error != 0)
1783                 return;
1784         KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
1785         *(bus_addr_t *)arg = segs[0].ds_addr;
1786 }
1787
1788 static int
1789 iwn_dma_contig_alloc(struct iwn_softc *sc, struct iwn_dma_info *dma,
1790     void **kvap, bus_size_t size, bus_size_t alignment)
1791 {
1792         int error;
1793
1794         dma->tag = NULL;
1795         dma->size = size;
1796
1797 #if defined(__DragonFly__)
1798         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), alignment,
1799             0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
1800             1, size, 0, &dma->tag);
1801 #else
1802         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), alignment,
1803             0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
1804             1, size, 0, NULL, NULL, &dma->tag);
1805 #endif
1806         if (error != 0)
1807                 goto fail;
1808
1809         error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr,
1810             BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map);
1811         if (error != 0)
1812                 goto fail;
1813
1814         error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size,
1815             iwn_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT);
1816         if (error != 0)
1817                 goto fail;
1818
1819         bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
1820
1821         if (kvap != NULL)
1822                 *kvap = dma->vaddr;
1823
1824         return 0;
1825
1826 fail:   iwn_dma_contig_free(dma);
1827         return error;
1828 }
1829
1830 static void
1831 iwn_dma_contig_free(struct iwn_dma_info *dma)
1832 {
1833         if (dma->vaddr != NULL) {
1834                 bus_dmamap_sync(dma->tag, dma->map,
1835                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1836                 bus_dmamap_unload(dma->tag, dma->map);
1837                 bus_dmamem_free(dma->tag, dma->vaddr, dma->map);
1838                 dma->vaddr = NULL;
1839         }
1840         if (dma->tag != NULL) {
1841                 bus_dma_tag_destroy(dma->tag);
1842                 dma->tag = NULL;
1843         }
1844 }
1845
1846 static int
1847 iwn_alloc_sched(struct iwn_softc *sc)
1848 {
1849         /* TX scheduler rings must be aligned on a 1KB boundary. */
1850         return iwn_dma_contig_alloc(sc, &sc->sched_dma, (void **)&sc->sched,
1851             sc->schedsz, 1024);
1852 }
1853
1854 static void
1855 iwn_free_sched(struct iwn_softc *sc)
1856 {
1857         iwn_dma_contig_free(&sc->sched_dma);
1858 }
1859
1860 static int
1861 iwn_alloc_kw(struct iwn_softc *sc)
1862 {
1863         /* "Keep Warm" page must be aligned on a 4KB boundary. */
1864         return iwn_dma_contig_alloc(sc, &sc->kw_dma, NULL, 4096, 4096);
1865 }
1866
1867 static void
1868 iwn_free_kw(struct iwn_softc *sc)
1869 {
1870         iwn_dma_contig_free(&sc->kw_dma);
1871 }
1872
1873 static int
1874 iwn_alloc_ict(struct iwn_softc *sc)
1875 {
1876         /* ICT table must be aligned on a 4KB boundary. */
1877         return iwn_dma_contig_alloc(sc, &sc->ict_dma, (void **)&sc->ict,
1878             IWN_ICT_SIZE, 4096);
1879 }
1880
1881 static void
1882 iwn_free_ict(struct iwn_softc *sc)
1883 {
1884         iwn_dma_contig_free(&sc->ict_dma);
1885 }
1886
1887 static int
1888 iwn_alloc_fwmem(struct iwn_softc *sc)
1889 {
1890         /* Must be aligned on a 16-byte boundary. */
1891         return iwn_dma_contig_alloc(sc, &sc->fw_dma, NULL, sc->fwsz, 16);
1892 }
1893
1894 static void
1895 iwn_free_fwmem(struct iwn_softc *sc)
1896 {
1897         iwn_dma_contig_free(&sc->fw_dma);
1898 }
1899
1900 static int
1901 iwn_alloc_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1902 {
1903         bus_size_t size;
1904         int i, error;
1905
1906         ring->cur = 0;
1907
1908         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1909
1910         /* Allocate RX descriptors (256-byte aligned). */
1911         size = IWN_RX_RING_COUNT * sizeof (uint32_t);
1912         error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
1913             size, 256);
1914         if (error != 0) {
1915                 device_printf(sc->sc_dev,
1916                     "%s: could not allocate RX ring DMA memory, error %d\n",
1917                     __func__, error);
1918                 goto fail;
1919         }
1920
1921         /* Allocate RX status area (16-byte aligned). */
1922         error = iwn_dma_contig_alloc(sc, &ring->stat_dma, (void **)&ring->stat,
1923             sizeof (struct iwn_rx_status), 16);
1924         if (error != 0) {
1925                 device_printf(sc->sc_dev,
1926                     "%s: could not allocate RX status DMA memory, error %d\n",
1927                     __func__, error);
1928                 goto fail;
1929         }
1930
1931         /* Create RX buffer DMA tag. */
1932 #if defined(__DragonFly__)
1933         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
1934             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
1935             IWN_RBUF_SIZE, 1, IWN_RBUF_SIZE, 0, &ring->data_dmat);
1936 #else
1937         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
1938             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
1939             IWN_RBUF_SIZE, 1, IWN_RBUF_SIZE, 0, NULL, NULL, &ring->data_dmat);
1940 #endif
1941         if (error != 0) {
1942                 device_printf(sc->sc_dev,
1943                     "%s: could not create RX buf DMA tag, error %d\n",
1944                     __func__, error);
1945                 goto fail;
1946         }
1947
1948         /*
1949          * Allocate and map RX buffers.
1950          */
1951         for (i = 0; i < IWN_RX_RING_COUNT; i++) {
1952                 struct iwn_rx_data *data = &ring->data[i];
1953                 bus_addr_t paddr;
1954
1955                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
1956                 if (error != 0) {
1957                         device_printf(sc->sc_dev,
1958                             "%s: could not create RX buf DMA map, error %d\n",
1959                             __func__, error);
1960                         goto fail;
1961                 }
1962
1963                 data->m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
1964                     IWN_RBUF_SIZE);
1965                 if (data->m == NULL) {
1966                         device_printf(sc->sc_dev,
1967                             "%s: could not allocate RX mbuf\n", __func__);
1968                         error = ENOBUFS;
1969                         goto fail;
1970                 }
1971
1972                 error = bus_dmamap_load(ring->data_dmat, data->map,
1973                     mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
1974                     &paddr, BUS_DMA_NOWAIT);
1975                 if (error != 0 && error != EFBIG) {
1976                         device_printf(sc->sc_dev,
1977                             "%s: can't map mbuf, error %d\n", __func__,
1978                             error);
1979                         goto fail;
1980                 }
1981
1982                 /* Set physical address of RX buffer (256-byte aligned). */
1983                 ring->desc[i] = htole32(paddr >> 8);
1984         }
1985
1986         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
1987             BUS_DMASYNC_PREWRITE);
1988
1989         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
1990
1991         return 0;
1992
1993 fail:   iwn_free_rx_ring(sc, ring);
1994
1995         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
1996
1997         return error;
1998 }
1999
2000 static void
2001 iwn_reset_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
2002 {
2003         int ntries;
2004
2005         DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
2006
2007         if (iwn_nic_lock(sc) == 0) {
2008                 IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
2009                 for (ntries = 0; ntries < 1000; ntries++) {
2010                         if (IWN_READ(sc, IWN_FH_RX_STATUS) &
2011                             IWN_FH_RX_STATUS_IDLE)
2012                                 break;
2013                         DELAY(10);
2014                 }
2015                 iwn_nic_unlock(sc);
2016         }
2017         ring->cur = 0;
2018         sc->last_rx_valid = 0;
2019 }
2020
2021 static void
2022 iwn_free_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
2023 {
2024         int i;
2025
2026         DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
2027
2028         iwn_dma_contig_free(&ring->desc_dma);
2029         iwn_dma_contig_free(&ring->stat_dma);
2030
2031         for (i = 0; i < IWN_RX_RING_COUNT; i++) {
2032                 struct iwn_rx_data *data = &ring->data[i];
2033
2034                 if (data->m != NULL) {
2035                         bus_dmamap_sync(ring->data_dmat, data->map,
2036                             BUS_DMASYNC_POSTREAD);
2037                         bus_dmamap_unload(ring->data_dmat, data->map);
2038                         m_freem(data->m);
2039                         data->m = NULL;
2040                 }
2041                 if (data->map != NULL)
2042                         bus_dmamap_destroy(ring->data_dmat, data->map);
2043         }
2044         if (ring->data_dmat != NULL) {
2045                 bus_dma_tag_destroy(ring->data_dmat);
2046                 ring->data_dmat = NULL;
2047         }
2048 }
2049
2050 static int
2051 iwn_alloc_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring, int qid)
2052 {
2053         bus_addr_t paddr;
2054         bus_size_t size;
2055         int i, error;
2056
2057         ring->qid = qid;
2058         ring->queued = 0;
2059         ring->cur = 0;
2060
2061         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2062
2063         /* Allocate TX descriptors (256-byte aligned). */
2064         size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_desc);
2065         error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
2066             size, 256);
2067         if (error != 0) {
2068                 device_printf(sc->sc_dev,
2069                     "%s: could not allocate TX ring DMA memory, error %d\n",
2070                     __func__, error);
2071                 goto fail;
2072         }
2073
2074         size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_cmd);
2075         error = iwn_dma_contig_alloc(sc, &ring->cmd_dma, (void **)&ring->cmd,
2076             size, 4);
2077         if (error != 0) {
2078                 device_printf(sc->sc_dev,
2079                     "%s: could not allocate TX cmd DMA memory, error %d\n",
2080                     __func__, error);
2081                 goto fail;
2082         }
2083
2084 #if defined(__DragonFly__)
2085         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
2086             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
2087             IWN_MAX_SCATTER - 1, MCLBYTES, 0, &ring->data_dmat);
2088 #else
2089         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
2090             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
2091             IWN_MAX_SCATTER - 1, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
2092 #endif
2093         if (error != 0) {
2094                 device_printf(sc->sc_dev,
2095                     "%s: could not create TX buf DMA tag, error %d\n",
2096                     __func__, error);
2097                 goto fail;
2098         }
2099
2100         paddr = ring->cmd_dma.paddr;
2101         for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2102                 struct iwn_tx_data *data = &ring->data[i];
2103
2104                 data->cmd_paddr = paddr;
2105                 data->scratch_paddr = paddr + 12;
2106                 paddr += sizeof (struct iwn_tx_cmd);
2107
2108                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
2109                 if (error != 0) {
2110                         device_printf(sc->sc_dev,
2111                             "%s: could not create TX buf DMA map, error %d\n",
2112                             __func__, error);
2113                         goto fail;
2114                 }
2115         }
2116
2117         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2118
2119         return 0;
2120
2121 fail:   iwn_free_tx_ring(sc, ring);
2122         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
2123         return error;
2124 }
2125
2126 static void
2127 iwn_reset_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2128 {
2129         int i;
2130
2131         DPRINTF(sc, IWN_DEBUG_TRACE, "->doing %s \n", __func__);
2132
2133         for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2134                 struct iwn_tx_data *data = &ring->data[i];
2135
2136                 if (data->m != NULL) {
2137                         bus_dmamap_sync(ring->data_dmat, data->map,
2138                             BUS_DMASYNC_POSTWRITE);
2139                         bus_dmamap_unload(ring->data_dmat, data->map);
2140                         m_freem(data->m);
2141                         data->m = NULL;
2142                 }
2143                 if (data->ni != NULL) {
2144                         ieee80211_free_node(data->ni);
2145                         data->ni = NULL;
2146                 }
2147         }
2148         /* Clear TX descriptors. */
2149         memset(ring->desc, 0, ring->desc_dma.size);
2150         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2151             BUS_DMASYNC_PREWRITE);
2152         sc->qfullmsk &= ~(1 << ring->qid);
2153         ring->queued = 0;
2154         ring->cur = 0;
2155 }
2156
2157 static void
2158 iwn_free_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2159 {
2160         int i;
2161
2162         DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
2163
2164         iwn_dma_contig_free(&ring->desc_dma);
2165         iwn_dma_contig_free(&ring->cmd_dma);
2166
2167         for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2168                 struct iwn_tx_data *data = &ring->data[i];
2169
2170                 if (data->m != NULL) {
2171                         bus_dmamap_sync(ring->data_dmat, data->map,
2172                             BUS_DMASYNC_POSTWRITE);
2173                         bus_dmamap_unload(ring->data_dmat, data->map);
2174                         m_freem(data->m);
2175                 }
2176                 if (data->map != NULL)
2177                         bus_dmamap_destroy(ring->data_dmat, data->map);
2178         }
2179         if (ring->data_dmat != NULL) {
2180                 bus_dma_tag_destroy(ring->data_dmat);
2181                 ring->data_dmat = NULL;
2182         }
2183 }
2184
2185 static void
2186 iwn5000_ict_reset(struct iwn_softc *sc)
2187 {
2188         /* Disable interrupts. */
2189         IWN_WRITE(sc, IWN_INT_MASK, 0);
2190
2191         /* Reset ICT table. */
2192         memset(sc->ict, 0, IWN_ICT_SIZE);
2193         sc->ict_cur = 0;
2194
2195         /* Set physical address of ICT table (4KB aligned). */
2196         DPRINTF(sc, IWN_DEBUG_RESET, "%s: enabling ICT\n", __func__);
2197         IWN_WRITE(sc, IWN_DRAM_INT_TBL, IWN_DRAM_INT_TBL_ENABLE |
2198             IWN_DRAM_INT_TBL_WRAP_CHECK | sc->ict_dma.paddr >> 12);
2199
2200         /* Enable periodic RX interrupt. */
2201         sc->int_mask |= IWN_INT_RX_PERIODIC;
2202         /* Switch to ICT interrupt mode in driver. */
2203         sc->sc_flags |= IWN_FLAG_USE_ICT;
2204
2205         /* Re-enable interrupts. */
2206         IWN_WRITE(sc, IWN_INT, 0xffffffff);
2207         IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
2208 }
2209
2210 static int
2211 iwn_read_eeprom(struct iwn_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
2212 {
2213         struct iwn_ops *ops = &sc->ops;
2214         uint16_t val;
2215         int error;
2216
2217         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2218
2219         /* Check whether adapter has an EEPROM or an OTPROM. */
2220         if (sc->hw_type >= IWN_HW_REV_TYPE_1000 &&
2221             (IWN_READ(sc, IWN_OTP_GP) & IWN_OTP_GP_DEV_SEL_OTP))
2222                 sc->sc_flags |= IWN_FLAG_HAS_OTPROM;
2223         DPRINTF(sc, IWN_DEBUG_RESET, "%s found\n",
2224             (sc->sc_flags & IWN_FLAG_HAS_OTPROM) ? "OTPROM" : "EEPROM");
2225
2226         /* Adapter has to be powered on for EEPROM access to work. */
2227         if ((error = iwn_apm_init(sc)) != 0) {
2228                 device_printf(sc->sc_dev,
2229                     "%s: could not power ON adapter, error %d\n", __func__,
2230                     error);
2231                 return error;
2232         }
2233
2234         if ((IWN_READ(sc, IWN_EEPROM_GP) & 0x7) == 0) {
2235                 device_printf(sc->sc_dev, "%s: bad ROM signature\n", __func__);
2236                 return EIO;
2237         }
2238         if ((error = iwn_eeprom_lock(sc)) != 0) {
2239                 device_printf(sc->sc_dev, "%s: could not lock ROM, error %d\n",
2240                     __func__, error);
2241                 return error;
2242         }
2243         if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
2244                 if ((error = iwn_init_otprom(sc)) != 0) {
2245                         device_printf(sc->sc_dev,
2246                             "%s: could not initialize OTPROM, error %d\n",
2247                             __func__, error);
2248                         return error;
2249                 }
2250         }
2251
2252         iwn_read_prom_data(sc, IWN_EEPROM_SKU_CAP, &val, 2);
2253         DPRINTF(sc, IWN_DEBUG_RESET, "SKU capabilities=0x%04x\n", le16toh(val));
2254         /* Check if HT support is bonded out. */
2255         if (val & htole16(IWN_EEPROM_SKU_CAP_11N))
2256                 sc->sc_flags |= IWN_FLAG_HAS_11N;
2257
2258         iwn_read_prom_data(sc, IWN_EEPROM_RFCFG, &val, 2);
2259         sc->rfcfg = le16toh(val);
2260         DPRINTF(sc, IWN_DEBUG_RESET, "radio config=0x%04x\n", sc->rfcfg);
2261         /* Read Tx/Rx chains from ROM unless it's known to be broken. */
2262         if (sc->txchainmask == 0)
2263                 sc->txchainmask = IWN_RFCFG_TXANTMSK(sc->rfcfg);
2264         if (sc->rxchainmask == 0)
2265                 sc->rxchainmask = IWN_RFCFG_RXANTMSK(sc->rfcfg);
2266
2267         /* Read MAC address. */
2268         iwn_read_prom_data(sc, IWN_EEPROM_MAC, macaddr, 6);
2269
2270         /* Read adapter-specific information from EEPROM. */
2271         ops->read_eeprom(sc);
2272
2273         iwn_apm_stop(sc);       /* Power OFF adapter. */
2274
2275         iwn_eeprom_unlock(sc);
2276
2277         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2278
2279         return 0;
2280 }
2281
2282 static void
2283 iwn4965_read_eeprom(struct iwn_softc *sc)
2284 {
2285         uint32_t addr;
2286         uint16_t val;
2287         int i;
2288
2289         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2290
2291         /* Read regulatory domain (4 ASCII characters). */
2292         iwn_read_prom_data(sc, IWN4965_EEPROM_DOMAIN, sc->eeprom_domain, 4);
2293
2294         /* Read the list of authorized channels (20MHz & 40MHz). */
2295         for (i = 0; i < IWN_NBANDS - 1; i++) {
2296                 addr = iwn4965_regulatory_bands[i];
2297                 iwn_read_eeprom_channels(sc, i, addr);
2298         }
2299
2300         /* Read maximum allowed TX power for 2GHz and 5GHz bands. */
2301         iwn_read_prom_data(sc, IWN4965_EEPROM_MAXPOW, &val, 2);
2302         sc->maxpwr2GHz = val & 0xff;
2303         sc->maxpwr5GHz = val >> 8;
2304         /* Check that EEPROM values are within valid range. */
2305         if (sc->maxpwr5GHz < 20 || sc->maxpwr5GHz > 50)
2306                 sc->maxpwr5GHz = 38;
2307         if (sc->maxpwr2GHz < 20 || sc->maxpwr2GHz > 50)
2308                 sc->maxpwr2GHz = 38;
2309         DPRINTF(sc, IWN_DEBUG_RESET, "maxpwr 2GHz=%d 5GHz=%d\n",
2310             sc->maxpwr2GHz, sc->maxpwr5GHz);
2311
2312         /* Read samples for each TX power group. */
2313         iwn_read_prom_data(sc, IWN4965_EEPROM_BANDS, sc->bands,
2314             sizeof sc->bands);
2315
2316         /* Read voltage at which samples were taken. */
2317         iwn_read_prom_data(sc, IWN4965_EEPROM_VOLTAGE, &val, 2);
2318         sc->eeprom_voltage = (int16_t)le16toh(val);
2319         DPRINTF(sc, IWN_DEBUG_RESET, "voltage=%d (in 0.3V)\n",
2320             sc->eeprom_voltage);
2321
2322 #ifdef IWN_DEBUG
2323         /* Print samples. */
2324         if (sc->sc_debug & IWN_DEBUG_ANY) {
2325                 for (i = 0; i < IWN_NBANDS - 1; i++)
2326                         iwn4965_print_power_group(sc, i);
2327         }
2328 #endif
2329
2330         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2331 }
2332
2333 #ifdef IWN_DEBUG
2334 static void
2335 iwn4965_print_power_group(struct iwn_softc *sc, int i)
2336 {
2337         struct iwn4965_eeprom_band *band = &sc->bands[i];
2338         struct iwn4965_eeprom_chan_samples *chans = band->chans;
2339         int j, c;
2340
2341         kprintf("===band %d===\n", i);
2342         kprintf("chan lo=%d, chan hi=%d\n", band->lo, band->hi);
2343         kprintf("chan1 num=%d\n", chans[0].num);
2344         for (c = 0; c < 2; c++) {
2345                 for (j = 0; j < IWN_NSAMPLES; j++) {
2346                         kprintf("chain %d, sample %d: temp=%d gain=%d "
2347                             "power=%d pa_det=%d\n", c, j,
2348                             chans[0].samples[c][j].temp,
2349                             chans[0].samples[c][j].gain,
2350                             chans[0].samples[c][j].power,
2351                             chans[0].samples[c][j].pa_det);
2352                 }
2353         }
2354         kprintf("chan2 num=%d\n", chans[1].num);
2355         for (c = 0; c < 2; c++) {
2356                 for (j = 0; j < IWN_NSAMPLES; j++) {
2357                         kprintf("chain %d, sample %d: temp=%d gain=%d "
2358                             "power=%d pa_det=%d\n", c, j,
2359                             chans[1].samples[c][j].temp,
2360                             chans[1].samples[c][j].gain,
2361                             chans[1].samples[c][j].power,
2362                             chans[1].samples[c][j].pa_det);
2363                 }
2364         }
2365 }
2366 #endif
2367
2368 static void
2369 iwn5000_read_eeprom(struct iwn_softc *sc)
2370 {
2371         struct iwn5000_eeprom_calib_hdr hdr;
2372         int32_t volt;
2373         uint32_t base, addr;
2374         uint16_t val;
2375         int i;
2376
2377         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2378
2379         /* Read regulatory domain (4 ASCII characters). */
2380         iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2381         base = le16toh(val);
2382         iwn_read_prom_data(sc, base + IWN5000_EEPROM_DOMAIN,
2383             sc->eeprom_domain, 4);
2384
2385         /* Read the list of authorized channels (20MHz & 40MHz). */
2386         for (i = 0; i < IWN_NBANDS - 1; i++) {
2387                 addr =  base + sc->base_params->regulatory_bands[i];
2388                 iwn_read_eeprom_channels(sc, i, addr);
2389         }
2390
2391         /* Read enhanced TX power information for 6000 Series. */
2392         if (sc->base_params->enhanced_TX_power)
2393                 iwn_read_eeprom_enhinfo(sc);
2394
2395         iwn_read_prom_data(sc, IWN5000_EEPROM_CAL, &val, 2);
2396         base = le16toh(val);
2397         iwn_read_prom_data(sc, base, &hdr, sizeof hdr);
2398         DPRINTF(sc, IWN_DEBUG_CALIBRATE,
2399             "%s: calib version=%u pa type=%u voltage=%u\n", __func__,
2400             hdr.version, hdr.pa_type, le16toh(hdr.volt));
2401         sc->calib_ver = hdr.version;
2402
2403         if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2) {
2404                 sc->eeprom_voltage = le16toh(hdr.volt);
2405                 iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2406                 sc->eeprom_temp_high=le16toh(val);
2407                 iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
2408                 sc->eeprom_temp = le16toh(val);
2409         }
2410
2411         if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
2412                 /* Compute temperature offset. */
2413                 iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2414                 sc->eeprom_temp = le16toh(val);
2415                 iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
2416                 volt = le16toh(val);
2417                 sc->temp_off = sc->eeprom_temp - (volt / -5);
2418                 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "temp=%d volt=%d offset=%dK\n",
2419                     sc->eeprom_temp, volt, sc->temp_off);
2420         } else {
2421                 /* Read crystal calibration. */
2422                 iwn_read_prom_data(sc, base + IWN5000_EEPROM_CRYSTAL,
2423                     &sc->eeprom_crystal, sizeof (uint32_t));
2424                 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "crystal calibration 0x%08x\n",
2425                     le32toh(sc->eeprom_crystal));
2426         }
2427
2428         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2429
2430 }
2431
2432 /*
2433  * Translate EEPROM flags to net80211.
2434  */
2435 static uint32_t
2436 iwn_eeprom_channel_flags(struct iwn_eeprom_chan *channel)
2437 {
2438         uint32_t nflags;
2439
2440         nflags = 0;
2441         if ((channel->flags & IWN_EEPROM_CHAN_ACTIVE) == 0)
2442                 nflags |= IEEE80211_CHAN_PASSIVE;
2443         if ((channel->flags & IWN_EEPROM_CHAN_IBSS) == 0)
2444                 nflags |= IEEE80211_CHAN_NOADHOC;
2445         if (channel->flags & IWN_EEPROM_CHAN_RADAR) {
2446                 nflags |= IEEE80211_CHAN_DFS;
2447                 /* XXX apparently IBSS may still be marked */
2448                 nflags |= IEEE80211_CHAN_NOADHOC;
2449         }
2450
2451         return nflags;
2452 }
2453
2454 static void
2455 iwn_read_eeprom_band(struct iwn_softc *sc, int n, int maxchans, int *nchans,
2456     struct ieee80211_channel chans[])
2457 {
2458         struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
2459         const struct iwn_chan_band *band = &iwn_bands[n];
2460         uint8_t bands[IEEE80211_MODE_BYTES];
2461         uint8_t chan;
2462         int i, error, nflags;
2463
2464         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2465
2466         memset(bands, 0, sizeof(bands));
2467         if (n == 0) {
2468                 setbit(bands, IEEE80211_MODE_11B);
2469                 setbit(bands, IEEE80211_MODE_11G);
2470                 if (sc->sc_flags & IWN_FLAG_HAS_11N)
2471                         setbit(bands, IEEE80211_MODE_11NG);
2472         } else {
2473                 setbit(bands, IEEE80211_MODE_11A);
2474                 if (sc->sc_flags & IWN_FLAG_HAS_11N)
2475                         setbit(bands, IEEE80211_MODE_11NA);
2476         }
2477
2478         for (i = 0; i < band->nchan; i++) {
2479                 if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
2480                         DPRINTF(sc, IWN_DEBUG_RESET,
2481                             "skip chan %d flags 0x%x maxpwr %d\n",
2482                             band->chan[i], channels[i].flags,
2483                             channels[i].maxpwr);
2484                         continue;
2485                 }
2486
2487                 chan = band->chan[i];
2488                 nflags = iwn_eeprom_channel_flags(&channels[i]);
2489                 error = ieee80211_add_channel(chans, maxchans, nchans,
2490                     chan, 0, channels[i].maxpwr, nflags, bands);
2491                 if (error != 0)
2492                         break;
2493
2494                 /* Save maximum allowed TX power for this channel. */
2495                 /* XXX wrong */
2496                 sc->maxpwr[chan] = channels[i].maxpwr;
2497
2498                 DPRINTF(sc, IWN_DEBUG_RESET,
2499                     "add chan %d flags 0x%x maxpwr %d\n", chan,
2500                     channels[i].flags, channels[i].maxpwr);
2501         }
2502
2503         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2504
2505 }
2506
2507 static void
2508 iwn_read_eeprom_ht40(struct iwn_softc *sc, int n, int maxchans, int *nchans,
2509     struct ieee80211_channel chans[])
2510 {
2511         struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
2512         const struct iwn_chan_band *band = &iwn_bands[n];
2513         uint8_t chan;
2514         int i, error, nflags;
2515
2516         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s start\n", __func__);
2517
2518         if (!(sc->sc_flags & IWN_FLAG_HAS_11N)) {
2519                 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end no 11n\n", __func__);
2520                 return;
2521         }
2522
2523         for (i = 0; i < band->nchan; i++) {
2524                 if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
2525                         DPRINTF(sc, IWN_DEBUG_RESET,
2526                             "skip chan %d flags 0x%x maxpwr %d\n",
2527                             band->chan[i], channels[i].flags,
2528                             channels[i].maxpwr);
2529                         continue;
2530                 }
2531
2532                 chan = band->chan[i];
2533                 nflags = iwn_eeprom_channel_flags(&channels[i]);
2534                 nflags |= (n == 5 ? IEEE80211_CHAN_G : IEEE80211_CHAN_A);
2535                 error = ieee80211_add_channel_ht40(chans, maxchans, nchans,
2536                     chan, channels[i].maxpwr, nflags);
2537                 switch (error) {
2538                 case EINVAL:
2539                         device_printf(sc->sc_dev,
2540                             "%s: no entry for channel %d\n", __func__, chan);
2541                         continue;
2542                 case ENOENT:
2543                         DPRINTF(sc, IWN_DEBUG_RESET,
2544                             "%s: skip chan %d, extension channel not found\n",
2545                             __func__, chan);
2546                         continue;
2547                 case ENOBUFS:
2548                         device_printf(sc->sc_dev,
2549                             "%s: channel table is full!\n", __func__);
2550                         break;
2551                 case 0:
2552                         DPRINTF(sc, IWN_DEBUG_RESET,
2553                             "add ht40 chan %d flags 0x%x maxpwr %d\n",
2554                             chan, channels[i].flags, channels[i].maxpwr);
2555                         /* FALLTHROUGH */
2556                 default:
2557                         break;
2558                 }
2559         }
2560
2561         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2562
2563 }
2564
2565 static void
2566 iwn_read_eeprom_channels(struct iwn_softc *sc, int n, uint32_t addr)
2567 {
2568         struct ieee80211com *ic = &sc->sc_ic;
2569
2570         iwn_read_prom_data(sc, addr, &sc->eeprom_channels[n],
2571             iwn_bands[n].nchan * sizeof (struct iwn_eeprom_chan));
2572
2573         if (n < 5) {
2574                 iwn_read_eeprom_band(sc, n, IEEE80211_CHAN_MAX, &ic->ic_nchans,
2575                     ic->ic_channels);
2576         } else {
2577                 iwn_read_eeprom_ht40(sc, n, IEEE80211_CHAN_MAX, &ic->ic_nchans,
2578                     ic->ic_channels);
2579         }
2580         ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
2581 }
2582
2583 static struct iwn_eeprom_chan *
2584 iwn_find_eeprom_channel(struct iwn_softc *sc, struct ieee80211_channel *c)
2585 {
2586         int band, chan, i, j;
2587
2588         if (IEEE80211_IS_CHAN_HT40(c)) {
2589                 band = IEEE80211_IS_CHAN_5GHZ(c) ? 6 : 5;
2590                 if (IEEE80211_IS_CHAN_HT40D(c))
2591                         chan = c->ic_extieee;
2592                 else
2593                         chan = c->ic_ieee;
2594                 for (i = 0; i < iwn_bands[band].nchan; i++) {
2595                         if (iwn_bands[band].chan[i] == chan)
2596                                 return &sc->eeprom_channels[band][i];
2597                 }
2598         } else {
2599                 for (j = 0; j < 5; j++) {
2600                         for (i = 0; i < iwn_bands[j].nchan; i++) {
2601                                 if (iwn_bands[j].chan[i] == c->ic_ieee &&
2602                                     ((j == 0) ^ IEEE80211_IS_CHAN_A(c)) == 1)
2603                                         return &sc->eeprom_channels[j][i];
2604                         }
2605                 }
2606         }
2607         return NULL;
2608 }
2609
2610 static void
2611 iwn_getradiocaps(struct ieee80211com *ic,
2612     int maxchans, int *nchans, struct ieee80211_channel chans[])
2613 {
2614         struct iwn_softc *sc = ic->ic_softc;
2615         int i;
2616
2617         /* Parse the list of authorized channels. */
2618         for (i = 0; i < 5 && *nchans < maxchans; i++)
2619                 iwn_read_eeprom_band(sc, i, maxchans, nchans, chans);
2620         for (i = 5; i < IWN_NBANDS - 1 && *nchans < maxchans; i++)
2621                 iwn_read_eeprom_ht40(sc, i, maxchans, nchans, chans);
2622 }
2623
2624 /*
2625  * Enforce flags read from EEPROM.
2626  */
2627 static int
2628 iwn_setregdomain(struct ieee80211com *ic, struct ieee80211_regdomain *rd,
2629     int nchan, struct ieee80211_channel chans[])
2630 {
2631         struct iwn_softc *sc = ic->ic_softc;
2632         int i;
2633
2634         for (i = 0; i < nchan; i++) {
2635                 struct ieee80211_channel *c = &chans[i];
2636                 struct iwn_eeprom_chan *channel;
2637
2638                 channel = iwn_find_eeprom_channel(sc, c);
2639                 if (channel == NULL) {
2640                         ic_printf(ic, "%s: invalid channel %u freq %u/0x%x\n",
2641                             __func__, c->ic_ieee, c->ic_freq, c->ic_flags);
2642                         return EINVAL;
2643                 }
2644                 c->ic_flags |= iwn_eeprom_channel_flags(channel);
2645         }
2646
2647         return 0;
2648 }
2649
2650 static void
2651 iwn_read_eeprom_enhinfo(struct iwn_softc *sc)
2652 {
2653         struct iwn_eeprom_enhinfo enhinfo[35];
2654         struct ieee80211com *ic = &sc->sc_ic;
2655         struct ieee80211_channel *c;
2656         uint16_t val, base;
2657         int8_t maxpwr;
2658         uint8_t flags;
2659         int i, j;
2660
2661         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2662
2663         iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2664         base = le16toh(val);
2665         iwn_read_prom_data(sc, base + IWN6000_EEPROM_ENHINFO,
2666             enhinfo, sizeof enhinfo);
2667
2668         for (i = 0; i < nitems(enhinfo); i++) {
2669                 flags = enhinfo[i].flags;
2670                 if (!(flags & IWN_ENHINFO_VALID))
2671                         continue;       /* Skip invalid entries. */
2672
2673                 maxpwr = 0;
2674                 if (sc->txchainmask & IWN_ANT_A)
2675                         maxpwr = MAX(maxpwr, enhinfo[i].chain[0]);
2676                 if (sc->txchainmask & IWN_ANT_B)
2677                         maxpwr = MAX(maxpwr, enhinfo[i].chain[1]);
2678                 if (sc->txchainmask & IWN_ANT_C)
2679                         maxpwr = MAX(maxpwr, enhinfo[i].chain[2]);
2680                 if (sc->ntxchains == 2)
2681                         maxpwr = MAX(maxpwr, enhinfo[i].mimo2);
2682                 else if (sc->ntxchains == 3)
2683                         maxpwr = MAX(maxpwr, enhinfo[i].mimo3);
2684
2685                 for (j = 0; j < ic->ic_nchans; j++) {
2686                         c = &ic->ic_channels[j];
2687                         if ((flags & IWN_ENHINFO_5GHZ)) {
2688                                 if (!IEEE80211_IS_CHAN_A(c))
2689                                         continue;
2690                         } else if ((flags & IWN_ENHINFO_OFDM)) {
2691                                 if (!IEEE80211_IS_CHAN_G(c))
2692                                         continue;
2693                         } else if (!IEEE80211_IS_CHAN_B(c))
2694                                 continue;
2695                         if ((flags & IWN_ENHINFO_HT40)) {
2696                                 if (!IEEE80211_IS_CHAN_HT40(c))
2697                                         continue;
2698                         } else {
2699                                 if (IEEE80211_IS_CHAN_HT40(c))
2700                                         continue;
2701                         }
2702                         if (enhinfo[i].chan != 0 &&
2703                             enhinfo[i].chan != c->ic_ieee)
2704                                 continue;
2705
2706                         DPRINTF(sc, IWN_DEBUG_RESET,
2707                             "channel %d(%x), maxpwr %d\n", c->ic_ieee,
2708                             c->ic_flags, maxpwr / 2);
2709                         c->ic_maxregpower = maxpwr / 2;
2710                         c->ic_maxpower = maxpwr;
2711                 }
2712         }
2713
2714         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2715
2716 }
2717
2718 static struct ieee80211_node *
2719 iwn_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
2720 {
2721         return kmalloc(sizeof (struct iwn_node), M_80211_NODE,
2722                        M_INTWAIT | M_ZERO);
2723 }
2724
2725 static __inline int
2726 rate2plcp(int rate)
2727 {
2728         switch (rate & 0xff) {
2729         case 12:        return 0xd;
2730         case 18:        return 0xf;
2731         case 24:        return 0x5;
2732         case 36:        return 0x7;
2733         case 48:        return 0x9;
2734         case 72:        return 0xb;
2735         case 96:        return 0x1;
2736         case 108:       return 0x3;
2737         case 2:         return 10;
2738         case 4:         return 20;
2739         case 11:        return 55;
2740         case 22:        return 110;
2741         }
2742         return 0;
2743 }
2744
2745 static int
2746 iwn_get_1stream_tx_antmask(struct iwn_softc *sc)
2747 {
2748
2749         return IWN_LSB(sc->txchainmask);
2750 }
2751
2752 static int
2753 iwn_get_2stream_tx_antmask(struct iwn_softc *sc)
2754 {
2755         int tx;
2756
2757         /*
2758          * The '2 stream' setup is a bit .. odd.
2759          *
2760          * For NICs that support only 1 antenna, default to IWN_ANT_AB or
2761          * the firmware panics (eg Intel 5100.)
2762          *
2763          * For NICs that support two antennas, we use ANT_AB.
2764          *
2765          * For NICs that support three antennas, we use the two that
2766          * wasn't the default one.
2767          *
2768          * XXX TODO: if bluetooth (full concurrent) is enabled, restrict
2769          * this to only one antenna.
2770          */
2771
2772         /* Default - transmit on the other antennas */
2773         tx = (sc->txchainmask & ~IWN_LSB(sc->txchainmask));
2774
2775         /* Now, if it's zero, set it to IWN_ANT_AB, so to not panic firmware */
2776         if (tx == 0)
2777                 tx = IWN_ANT_AB;
2778
2779         /*
2780          * If the NIC is a two-stream TX NIC, configure the TX mask to
2781          * the default chainmask
2782          */
2783         else if (sc->ntxchains == 2)
2784                 tx = sc->txchainmask;
2785
2786         return (tx);
2787 }
2788
2789
2790
2791 /*
2792  * Calculate the required PLCP value from the given rate,
2793  * to the given node.
2794  *
2795  * This will take the node configuration (eg 11n, rate table
2796  * setup, etc) into consideration.
2797  */
2798 static uint32_t
2799 iwn_rate_to_plcp(struct iwn_softc *sc, struct ieee80211_node *ni,
2800     uint8_t rate)
2801 {
2802         struct ieee80211com *ic = ni->ni_ic;
2803         uint32_t plcp = 0;
2804         int ridx;
2805
2806         /*
2807          * If it's an MCS rate, let's set the plcp correctly
2808          * and set the relevant flags based on the node config.
2809          */
2810         if (rate & IEEE80211_RATE_MCS) {
2811                 /*
2812                  * Set the initial PLCP value to be between 0->31 for
2813                  * MCS 0 -> MCS 31, then set the "I'm an MCS rate!"
2814                  * flag.
2815                  */
2816                 plcp = IEEE80211_RV(rate) | IWN_RFLAG_MCS;
2817
2818                 /*
2819                  * XXX the following should only occur if both
2820                  * the local configuration _and_ the remote node
2821                  * advertise these capabilities.  Thus this code
2822                  * may need fixing!
2823                  */
2824
2825                 /*
2826                  * Set the channel width and guard interval.
2827                  */
2828                 if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
2829                         plcp |= IWN_RFLAG_HT40;
2830                         if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI40)
2831                                 plcp |= IWN_RFLAG_SGI;
2832                 } else if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI20) {
2833                         plcp |= IWN_RFLAG_SGI;
2834                 }
2835
2836                 /*
2837                  * Ensure the selected rate matches the link quality
2838                  * table entries being used.
2839                  */
2840                 if (rate > 0x8f)
2841                         plcp |= IWN_RFLAG_ANT(sc->txchainmask);
2842                 else if (rate > 0x87)
2843                         plcp |= IWN_RFLAG_ANT(iwn_get_2stream_tx_antmask(sc));
2844                 else
2845                         plcp |= IWN_RFLAG_ANT(iwn_get_1stream_tx_antmask(sc));
2846         } else {
2847                 /*
2848                  * Set the initial PLCP - fine for both
2849                  * OFDM and CCK rates.
2850                  */
2851                 plcp = rate2plcp(rate);
2852
2853                 /* Set CCK flag if it's CCK */
2854
2855                 /* XXX It would be nice to have a method
2856                  * to map the ridx -> phy table entry
2857                  * so we could just query that, rather than
2858                  * this hack to check against IWN_RIDX_OFDM6.
2859                  */
2860                 ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
2861                     rate & IEEE80211_RATE_VAL);
2862                 if (ridx < IWN_RIDX_OFDM6 &&
2863                     IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2864                         plcp |= IWN_RFLAG_CCK;
2865
2866                 /* Set antenna configuration */
2867                 /* XXX TODO: is this the right antenna to use for legacy? */
2868                 plcp |= IWN_RFLAG_ANT(iwn_get_1stream_tx_antmask(sc));
2869         }
2870
2871         DPRINTF(sc, IWN_DEBUG_TXRATE, "%s: rate=0x%02x, plcp=0x%08x\n",
2872             __func__,
2873             rate,
2874             plcp);
2875
2876         return (htole32(plcp));
2877 }
2878
2879 static void
2880 iwn_newassoc(struct ieee80211_node *ni, int isnew)
2881 {
2882         /* Doesn't do anything at the moment */
2883 }
2884
2885 static int
2886 iwn_media_change(struct ifnet *ifp)
2887 {
2888         int error;
2889
2890         error = ieee80211_media_change(ifp);
2891         /* NB: only the fixed rate can change and that doesn't need a reset */
2892         return (error == ENETRESET ? 0 : error);
2893 }
2894
2895 static int
2896 iwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2897 {
2898         struct iwn_vap *ivp = IWN_VAP(vap);
2899         struct ieee80211com *ic = vap->iv_ic;
2900         struct iwn_softc *sc = ic->ic_softc;
2901         int error = 0;
2902
2903         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2904
2905         DPRINTF(sc, IWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
2906             ieee80211_state_name[vap->iv_state], ieee80211_state_name[nstate]);
2907
2908         IEEE80211_UNLOCK(ic);
2909         IWN_LOCK(sc);
2910 #if defined(__DragonFly__)
2911         callout_stop_sync(&sc->calib_to);
2912 #else
2913         callout_stop(&sc->calib_to);
2914 #endif
2915
2916         sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
2917
2918         switch (nstate) {
2919         case IEEE80211_S_ASSOC:
2920                 if (vap->iv_state != IEEE80211_S_RUN)
2921                         break;
2922                 /* FALLTHROUGH */
2923         case IEEE80211_S_AUTH:
2924                 if (vap->iv_state == IEEE80211_S_AUTH)
2925                         break;
2926
2927                 /*
2928                  * !AUTH -> AUTH transition requires state reset to handle
2929                  * reassociations correctly.
2930                  */
2931                 sc->rxon->associd = 0;
2932                 sc->rxon->filter &= ~htole32(IWN_FILTER_BSS);
2933                 sc->calib.state = IWN_CALIB_STATE_INIT;
2934
2935                 /* Wait until we hear a beacon before we transmit */
2936                 if (IEEE80211_IS_CHAN_PASSIVE(ic->ic_curchan))
2937                         sc->sc_beacon_wait = 1;
2938
2939                 if ((error = iwn_auth(sc, vap)) != 0) {
2940                         device_printf(sc->sc_dev,
2941                             "%s: could not move to auth state\n", __func__);
2942                 }
2943                 break;
2944
2945         case IEEE80211_S_RUN:
2946                 /*
2947                  * RUN -> RUN transition; Just restart the timers.
2948                  */
2949                 if (vap->iv_state == IEEE80211_S_RUN) {
2950                         sc->calib_cnt = 0;
2951                         break;
2952                 }
2953
2954                 /* Wait until we hear a beacon before we transmit */
2955                 if (IEEE80211_IS_CHAN_PASSIVE(ic->ic_curchan))
2956                         sc->sc_beacon_wait = 1;
2957
2958                 /*
2959                  * !RUN -> RUN requires setting the association id
2960                  * which is done with a firmware cmd.  We also defer
2961                  * starting the timers until that work is done.
2962                  */
2963                 if ((error = iwn_run(sc, vap)) != 0) {
2964                         device_printf(sc->sc_dev,
2965                             "%s: could not move to run state\n", __func__);
2966                 }
2967                 break;
2968
2969         case IEEE80211_S_INIT:
2970                 sc->calib.state = IWN_CALIB_STATE_INIT;
2971                 /*
2972                  * Purge the xmit queue so we don't have old frames
2973                  * during a new association attempt.
2974                  */
2975                 sc->sc_beacon_wait = 0;
2976                 iwn_xmit_queue_drain(sc);
2977                 break;
2978
2979         default:
2980                 break;
2981         }
2982         IWN_UNLOCK(sc);
2983         IEEE80211_LOCK(ic);
2984         if (error != 0){
2985                 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
2986                 return error;
2987         }
2988
2989         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
2990
2991         return ivp->iv_newstate(vap, nstate, arg);
2992 }
2993
2994 static void
2995 iwn_calib_timeout(void *arg)
2996 {
2997         struct iwn_softc *sc = arg;
2998
2999         IWN_LOCK_ASSERT(sc);
3000
3001         /* Force automatic TX power calibration every 60 secs. */
3002         if (++sc->calib_cnt >= 120) {
3003                 uint32_t flags = 0;
3004
3005                 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s\n",
3006                     "sending request for statistics");
3007                 (void)iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags,
3008                     sizeof flags, 1);
3009                 sc->calib_cnt = 0;
3010         }
3011         callout_reset(&sc->calib_to, msecs_to_ticks(500), iwn_calib_timeout,
3012             sc);
3013 }
3014
3015 /*
3016  * Process an RX_PHY firmware notification.  This is usually immediately
3017  * followed by an MPDU_RX_DONE notification.
3018  */
3019 static void
3020 iwn_rx_phy(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3021     struct iwn_rx_data *data)
3022 {
3023         struct iwn_rx_stat *stat = (struct iwn_rx_stat *)(desc + 1);
3024
3025         DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: received PHY stats\n", __func__);
3026         bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3027
3028         /* Save RX statistics, they will be used on MPDU_RX_DONE. */
3029         memcpy(&sc->last_rx_stat, stat, sizeof (*stat));
3030         sc->last_rx_valid = 1;
3031 }
3032
3033 /*
3034  * Process an RX_DONE (4965AGN only) or MPDU_RX_DONE firmware notification.
3035  * Each MPDU_RX_DONE notification must be preceded by an RX_PHY one.
3036  */
3037 static void
3038 iwn_rx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3039     struct iwn_rx_data *data)
3040 {
3041         struct iwn_ops *ops = &sc->ops;
3042         struct ieee80211com *ic = &sc->sc_ic;
3043         struct iwn_rx_ring *ring = &sc->rxq;
3044         struct ieee80211_frame *wh;
3045         struct ieee80211_node *ni;
3046         struct mbuf *m, *m1;
3047         struct iwn_rx_stat *stat;
3048         caddr_t head;
3049         bus_addr_t paddr;
3050         uint32_t flags;
3051         int error, len, rssi, nf;
3052
3053         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3054
3055         if (desc->type == IWN_MPDU_RX_DONE) {
3056                 /* Check for prior RX_PHY notification. */
3057                 if (!sc->last_rx_valid) {
3058                         DPRINTF(sc, IWN_DEBUG_ANY,
3059                             "%s: missing RX_PHY\n", __func__);
3060                         return;
3061                 }
3062                 stat = &sc->last_rx_stat;
3063         } else
3064                 stat = (struct iwn_rx_stat *)(desc + 1);
3065
3066         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3067
3068         if (stat->cfg_phy_len > IWN_STAT_MAXLEN) {
3069                 device_printf(sc->sc_dev,
3070                     "%s: invalid RX statistic header, len %d\n", __func__,
3071                     stat->cfg_phy_len);
3072                 return;
3073         }
3074         if (desc->type == IWN_MPDU_RX_DONE) {
3075                 struct iwn_rx_mpdu *mpdu = (struct iwn_rx_mpdu *)(desc + 1);
3076                 head = (caddr_t)(mpdu + 1);
3077                 len = le16toh(mpdu->len);
3078         } else {
3079                 head = (caddr_t)(stat + 1) + stat->cfg_phy_len;
3080                 len = le16toh(stat->len);
3081         }
3082
3083         flags = le32toh(*(uint32_t *)(head + len));
3084
3085         /* Discard frames with a bad FCS early. */
3086         if ((flags & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
3087                 DPRINTF(sc, IWN_DEBUG_RECV, "%s: RX flags error %x\n",
3088                     __func__, flags);
3089 #if defined(__DragonFly__)
3090                 ++ic->ic_ierrors;
3091 #else
3092                 counter_u64_add(ic->ic_ierrors, 1);
3093 #endif
3094                 return;
3095         }
3096         /* Discard frames that are too short. */
3097         if (len < sizeof (struct ieee80211_frame_ack)) {
3098                 DPRINTF(sc, IWN_DEBUG_RECV, "%s: frame too short: %d\n",
3099                     __func__, len);
3100 #if defined(__DragonFly__)
3101                 ++ic->ic_ierrors;
3102 #else
3103                 counter_u64_add(ic->ic_ierrors, 1);
3104 #endif
3105                 return;
3106         }
3107
3108         m1 = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWN_RBUF_SIZE);
3109         if (m1 == NULL) {
3110                 DPRINTF(sc, IWN_DEBUG_ANY, "%s: no mbuf to restock ring\n",
3111                     __func__);
3112 #if defined(__DragonFly__)
3113                 ++ic->ic_ierrors;
3114 #else
3115                 counter_u64_add(ic->ic_ierrors, 1);
3116 #endif
3117                 return;
3118         }
3119         bus_dmamap_unload(ring->data_dmat, data->map);
3120
3121         error = bus_dmamap_load(ring->data_dmat, data->map, mtod(m1, void *),
3122             IWN_RBUF_SIZE, iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
3123         if (error != 0 && error != EFBIG) {
3124                 device_printf(sc->sc_dev,
3125                     "%s: bus_dmamap_load failed, error %d\n", __func__, error);
3126                 m_freem(m1);
3127
3128                 /* Try to reload the old mbuf. */
3129                 error = bus_dmamap_load(ring->data_dmat, data->map,
3130                     mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
3131                     &paddr, BUS_DMA_NOWAIT);
3132                 if (error != 0 && error != EFBIG) {
3133                         panic("%s: could not load old RX mbuf", __func__);
3134                 }
3135                 /* Physical address may have changed. */
3136                 ring->desc[ring->cur] = htole32(paddr >> 8);
3137                 bus_dmamap_sync(ring->data_dmat, ring->desc_dma.map,
3138                     BUS_DMASYNC_PREWRITE);
3139 #if defined(__DragonFly__)
3140                 ++ic->ic_ierrors;
3141 #else
3142                 counter_u64_add(ic->ic_ierrors, 1);
3143 #endif
3144                 return;
3145         }
3146
3147         m = data->m;
3148         data->m = m1;
3149         /* Update RX descriptor. */
3150         ring->desc[ring->cur] = htole32(paddr >> 8);
3151         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
3152             BUS_DMASYNC_PREWRITE);
3153
3154         /* Finalize mbuf. */
3155         m->m_data = head;
3156         m->m_pkthdr.len = m->m_len = len;
3157
3158         /* Grab a reference to the source node. */
3159         wh = mtod(m, struct ieee80211_frame *);
3160         if (len >= sizeof(struct ieee80211_frame_min))
3161                 ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3162         else
3163                 ni = NULL;
3164         nf = (ni != NULL && ni->ni_vap->iv_state == IEEE80211_S_RUN &&
3165             (ic->ic_flags & IEEE80211_F_SCAN) == 0) ? sc->noise : -95;
3166
3167         rssi = ops->get_rssi(sc, stat);
3168
3169         if (ieee80211_radiotap_active(ic)) {
3170                 struct iwn_rx_radiotap_header *tap = &sc->sc_rxtap;
3171
3172                 tap->wr_flags = 0;
3173                 if (stat->flags & htole16(IWN_STAT_FLAG_SHPREAMBLE))
3174                         tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
3175                 tap->wr_dbm_antsignal = (int8_t)rssi;
3176                 tap->wr_dbm_antnoise = (int8_t)nf;
3177                 tap->wr_tsft = stat->tstamp;
3178                 switch (stat->rate) {
3179                 /* CCK rates. */
3180                 case  10: tap->wr_rate =   2; break;
3181                 case  20: tap->wr_rate =   4; break;
3182                 case  55: tap->wr_rate =  11; break;
3183                 case 110: tap->wr_rate =  22; break;
3184                 /* OFDM rates. */
3185                 case 0xd: tap->wr_rate =  12; break;
3186                 case 0xf: tap->wr_rate =  18; break;
3187                 case 0x5: tap->wr_rate =  24; break;
3188                 case 0x7: tap->wr_rate =  36; break;
3189                 case 0x9: tap->wr_rate =  48; break;
3190                 case 0xb: tap->wr_rate =  72; break;
3191                 case 0x1: tap->wr_rate =  96; break;
3192                 case 0x3: tap->wr_rate = 108; break;
3193                 /* Unknown rate: should not happen. */
3194                 default:  tap->wr_rate =   0;
3195                 }
3196         }
3197
3198         /*
3199          * If it's a beacon and we're waiting, then do the
3200          * wakeup.  This should unblock raw_xmit/start.
3201          */
3202         if (sc->sc_beacon_wait) {
3203                 uint8_t type, subtype;
3204                 /* NB: Re-assign wh */
3205                 wh = mtod(m, struct ieee80211_frame *);
3206                 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3207                 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
3208                 /*
3209                  * This assumes at this point we've received our own
3210                  * beacon.
3211                  */
3212                 DPRINTF(sc, IWN_DEBUG_TRACE,
3213                     "%s: beacon_wait, type=%d, subtype=%d\n",
3214                     __func__, type, subtype);
3215                 if (type == IEEE80211_FC0_TYPE_MGT &&
3216                     subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
3217                         DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_XMIT,
3218                             "%s: waking things up\n", __func__);
3219                         /* queue taskqueue to transmit! */
3220                         taskqueue_enqueue(sc->sc_tq, &sc->sc_xmit_task);
3221                 }
3222         }
3223
3224         IWN_UNLOCK(sc);
3225
3226         /* Send the frame to the 802.11 layer. */
3227         if (ni != NULL) {
3228                 if (ni->ni_flags & IEEE80211_NODE_HT)
3229                         m->m_flags |= M_AMPDU;
3230                 (void)ieee80211_input(ni, m, rssi - nf, nf);
3231                 /* Node is no longer needed. */
3232                 ieee80211_free_node(ni);
3233         } else
3234                 (void)ieee80211_input_all(ic, m, rssi - nf, nf);
3235
3236         IWN_LOCK(sc);
3237
3238         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3239
3240 }
3241
3242 /* Process an incoming Compressed BlockAck. */
3243 static void
3244 iwn_rx_compressed_ba(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3245     struct iwn_rx_data *data)
3246 {
3247         struct iwn_ops *ops = &sc->ops;
3248         struct iwn_node *wn;
3249         struct ieee80211_node *ni;
3250         struct iwn_compressed_ba *ba = (struct iwn_compressed_ba *)(desc + 1);
3251         struct iwn_tx_ring *txq;
3252         struct iwn_tx_data *txdata;
3253         struct ieee80211_tx_ampdu *tap;
3254         struct mbuf *m;
3255         uint64_t bitmap;
3256         uint16_t ssn;
3257         uint8_t tid;
3258         int ackfailcnt = 0, i, lastidx, qid, *res, shift;
3259         int tx_ok = 0, tx_err = 0;
3260
3261         DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_XMIT, "->%s begin\n", __func__);
3262
3263         bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3264
3265         qid = le16toh(ba->qid);
3266         txq = &sc->txq[ba->qid];
3267         tap = sc->qid2tap[ba->qid];
3268         tid = tap->txa_tid;
3269         wn = (void *)tap->txa_ni;
3270
3271         res = NULL;
3272         ssn = 0;
3273         if (!IEEE80211_AMPDU_RUNNING(tap)) {
3274                 res = tap->txa_private;
3275                 ssn = tap->txa_start & 0xfff;
3276         }
3277
3278         for (lastidx = le16toh(ba->ssn) & 0xff; txq->read != lastidx;) {
3279                 txdata = &txq->data[txq->read];
3280
3281                 /* Unmap and free mbuf. */
3282                 bus_dmamap_sync(txq->data_dmat, txdata->map,
3283                     BUS_DMASYNC_POSTWRITE);
3284                 bus_dmamap_unload(txq->data_dmat, txdata->map);
3285                 m = txdata->m, txdata->m = NULL;
3286                 ni = txdata->ni, txdata->ni = NULL;
3287
3288                 KASSERT(ni != NULL, ("no node"));
3289                 KASSERT(m != NULL, ("no mbuf"));
3290
3291                 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: freeing m=%p\n", __func__, m);
3292                 ieee80211_tx_complete(ni, m, 1);
3293
3294                 txq->queued--;
3295                 txq->read = (txq->read + 1) % IWN_TX_RING_COUNT;
3296         }
3297
3298         if (txq->queued == 0 && res != NULL) {
3299                 iwn_nic_lock(sc);
3300                 ops->ampdu_tx_stop(sc, qid, tid, ssn);
3301                 iwn_nic_unlock(sc);
3302                 sc->qid2tap[qid] = NULL;
3303                 kfree(res, M_DEVBUF);
3304                 return;
3305         }
3306
3307         if (wn->agg[tid].bitmap == 0)
3308                 return;
3309
3310         shift = wn->agg[tid].startidx - ((le16toh(ba->seq) >> 4) & 0xff);
3311         if (shift < 0)
3312                 shift += 0x100;
3313
3314         if (wn->agg[tid].nframes > (64 - shift))
3315                 return;
3316
3317         /*
3318          * Walk the bitmap and calculate how many successful and failed
3319          * attempts are made.
3320          *
3321          * Yes, the rate control code doesn't know these are A-MPDU
3322          * subframes and that it's okay to fail some of these.
3323          */
3324         ni = tap->txa_ni;
3325         bitmap = (le64toh(ba->bitmap) >> shift) & wn->agg[tid].bitmap;
3326         for (i = 0; bitmap; i++) {
3327                 if ((bitmap & 1) == 0) {
3328                         tx_err ++;
3329                         ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
3330                             IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
3331                 } else {
3332                         tx_ok ++;
3333                         ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
3334                             IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
3335                 }
3336                 bitmap >>= 1;
3337         }
3338
3339         DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_XMIT,
3340             "->%s: end; %d ok; %d err\n",__func__, tx_ok, tx_err);
3341
3342 }
3343
3344 /*
3345  * Process a CALIBRATION_RESULT notification sent by the initialization
3346  * firmware on response to a CMD_CALIB_CONFIG command (5000 only).
3347  */
3348 static void
3349 iwn5000_rx_calib_results(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3350     struct iwn_rx_data *data)
3351 {
3352         struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
3353         int len, idx = -1;
3354
3355         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3356
3357         /* Runtime firmware should not send such a notification. */
3358         if (sc->sc_flags & IWN_FLAG_CALIB_DONE){
3359                 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s received after clib done\n",
3360             __func__);
3361                 return;
3362         }
3363         len = (le32toh(desc->len) & 0x3fff) - 4;
3364         bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3365
3366         switch (calib->code) {
3367         case IWN5000_PHY_CALIB_DC:
3368                 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_DC)
3369                         idx = 0;
3370                 break;
3371         case IWN5000_PHY_CALIB_LO:
3372                 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_LO)
3373                         idx = 1;
3374                 break;
3375         case IWN5000_PHY_CALIB_TX_IQ:
3376                 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TX_IQ)
3377                         idx = 2;
3378                 break;
3379         case IWN5000_PHY_CALIB_TX_IQ_PERIODIC:
3380                 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TX_IQ_PERIODIC)
3381                         idx = 3;
3382                 break;
3383         case IWN5000_PHY_CALIB_BASE_BAND:
3384                 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_BASE_BAND)
3385                         idx = 4;
3386                 break;
3387         }
3388         if (idx == -1)  /* Ignore other results. */
3389                 return;
3390
3391         /* Save calibration result. */
3392         if (sc->calibcmd[idx].buf != NULL)
3393                 kfree(sc->calibcmd[idx].buf, M_DEVBUF);
3394         sc->calibcmd[idx].buf = kmalloc(len, M_DEVBUF, M_INTWAIT);
3395         if (sc->calibcmd[idx].buf == NULL) {
3396                 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
3397                     "not enough memory for calibration result %d\n",
3398                     calib->code);
3399                 return;
3400         }
3401         DPRINTF(sc, IWN_DEBUG_CALIBRATE,
3402             "saving calibration result idx=%d, code=%d len=%d\n", idx, calib->code, len);
3403         sc->calibcmd[idx].len = len;
3404         memcpy(sc->calibcmd[idx].buf, calib, len);
3405 }
3406
3407 static void
3408 iwn_stats_update(struct iwn_softc *sc, struct iwn_calib_state *calib,
3409     struct iwn_stats *stats, int len)
3410 {
3411         struct iwn_stats_bt *stats_bt;
3412         struct iwn_stats *lstats;
3413
3414         /*
3415          * First - check whether the length is the bluetooth or normal.
3416          *
3417          * If it's normal - just copy it and bump out.
3418          * Otherwise we have to convert things.
3419          */
3420
3421         if (len == sizeof(struct iwn_stats) + 4) {
3422                 memcpy(&sc->last_stat, stats, sizeof(struct iwn_stats));
3423                 sc->last_stat_valid = 1;
3424                 return;
3425         }
3426
3427         /*
3428          * If it's not the bluetooth size - log, then just copy.
3429          */
3430         if (len != sizeof(struct iwn_stats_bt) + 4) {
3431                 DPRINTF(sc, IWN_DEBUG_STATS,
3432                     "%s: size of rx statistics (%d) not an expected size!\n",
3433                     __func__,
3434                     len);
3435                 memcpy(&sc->last_stat, stats, sizeof(struct iwn_stats));
3436                 sc->last_stat_valid = 1;
3437                 return;
3438         }
3439
3440         /*
3441          * Ok. Time to copy.
3442          */
3443         stats_bt = (struct iwn_stats_bt *) stats;
3444         lstats = &sc->last_stat;
3445
3446         /* flags */
3447         lstats->flags = stats_bt->flags;
3448         /* rx_bt */
3449         memcpy(&lstats->rx.ofdm, &stats_bt->rx_bt.ofdm,
3450             sizeof(struct iwn_rx_phy_stats));
3451         memcpy(&lstats->rx.cck, &stats_bt->rx_bt.cck,
3452             sizeof(struct iwn_rx_phy_stats));
3453         memcpy(&lstats->rx.general, &stats_bt->rx_bt.general_bt.common,
3454             sizeof(struct iwn_rx_general_stats));
3455         memcpy(&lstats->rx.ht, &stats_bt->rx_bt.ht,
3456             sizeof(struct iwn_rx_ht_phy_stats));
3457         /* tx */
3458         memcpy(&lstats->tx, &stats_bt->tx,
3459             sizeof(struct iwn_tx_stats));
3460         /* general */
3461         memcpy(&lstats->general, &stats_bt->general,
3462             sizeof(struct iwn_general_stats));
3463
3464         /* XXX TODO: Squirrel away the extra bluetooth stats somewhere */
3465         sc->last_stat_valid = 1;
3466 }
3467
3468 /*
3469  * Process an RX_STATISTICS or BEACON_STATISTICS firmware notification.
3470  * The latter is sent by the firmware after each received beacon.
3471  */
3472 static void
3473 iwn_rx_statistics(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3474     struct iwn_rx_data *data)
3475 {
3476         struct iwn_ops *ops = &sc->ops;
3477         struct ieee80211com *ic = &sc->sc_ic;
3478         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3479         struct iwn_calib_state *calib = &sc->calib;
3480         struct iwn_stats *stats = (struct iwn_stats *)(desc + 1);
3481         struct iwn_stats *lstats;
3482         int temp;
3483
3484         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3485
3486         /* Ignore statistics received during a scan. */
3487         if (vap->iv_state != IEEE80211_S_RUN ||
3488             (ic->ic_flags & IEEE80211_F_SCAN)){
3489                 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s received during calib\n",
3490             __func__);
3491                 return;
3492         }
3493
3494         bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3495
3496         DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_STATS,
3497             "%s: received statistics, cmd %d, len %d\n",
3498             __func__, desc->type, le16toh(desc->len));
3499         sc->calib_cnt = 0;      /* Reset TX power calibration timeout. */
3500
3501         /*
3502          * Collect/track general statistics for reporting.
3503          *
3504          * This takes care of ensuring that the bluetooth sized message
3505          * will be correctly converted to the legacy sized message.
3506          */
3507         iwn_stats_update(sc, calib, stats, le16toh(desc->len));
3508
3509         /*
3510          * And now, let's take a reference of it to use!
3511          */
3512         lstats = &sc->last_stat;
3513
3514         /* Test if temperature has changed. */
3515         if (lstats->general.temp != sc->rawtemp) {
3516                 /* Convert "raw" temperature to degC. */
3517                 sc->rawtemp = stats->general.temp;
3518                 temp = ops->get_temperature(sc);
3519                 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d\n",
3520                     __func__, temp);
3521
3522                 /* Update TX power if need be (4965AGN only). */
3523                 if (sc->hw_type == IWN_HW_REV_TYPE_4965)
3524                         iwn4965_power_calibration(sc, temp);
3525         }
3526
3527         if (desc->type != IWN_BEACON_STATISTICS)
3528                 return; /* Reply to a statistics request. */
3529
3530         sc->noise = iwn_get_noise(&lstats->rx.general);
3531         DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: noise %d\n", __func__, sc->noise);
3532
3533         /* Test that RSSI and noise are present in stats report. */
3534         if (le32toh(lstats->rx.general.flags) != 1) {
3535                 DPRINTF(sc, IWN_DEBUG_ANY, "%s\n",
3536                     "received statistics without RSSI");
3537                 return;
3538         }
3539
3540         if (calib->state == IWN_CALIB_STATE_ASSOC)
3541                 iwn_collect_noise(sc, &lstats->rx.general);
3542         else if (calib->state == IWN_CALIB_STATE_RUN) {
3543                 iwn_tune_sensitivity(sc, &lstats->rx);
3544                 /*
3545                  * XXX TODO: Only run the RX recovery if we're associated!
3546                  */
3547                 iwn_check_rx_recovery(sc, lstats);
3548                 iwn_save_stats_counters(sc, lstats);
3549         }
3550
3551         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3552 }
3553
3554 /*
3555  * Save the relevant statistic counters for the next calibration
3556  * pass.
3557  */
3558 static void
3559 iwn_save_stats_counters(struct iwn_softc *sc, const struct iwn_stats *rs)
3560 {
3561         struct iwn_calib_state *calib = &sc->calib;
3562
3563         /* Save counters values for next call. */
3564         calib->bad_plcp_cck = le32toh(rs->rx.cck.bad_plcp);
3565         calib->fa_cck = le32toh(rs->rx.cck.fa);
3566         calib->bad_plcp_ht = le32toh(rs->rx.ht.bad_plcp);
3567         calib->bad_plcp_ofdm = le32toh(rs->rx.ofdm.bad_plcp);
3568         calib->fa_ofdm = le32toh(rs->rx.ofdm.fa);
3569
3570         /* Last time we received these tick values */
3571         sc->last_calib_ticks = ticks;
3572 }
3573
3574 /*
3575  * Process a TX_DONE firmware notification.  Unfortunately, the 4965AGN
3576  * and 5000 adapters have different incompatible TX status formats.
3577  */
3578 static void
3579 iwn4965_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3580     struct iwn_rx_data *data)
3581 {
3582         struct iwn4965_tx_stat *stat = (struct iwn4965_tx_stat *)(desc + 1);
3583         struct iwn_tx_ring *ring;
3584         int qid;
3585
3586         qid = desc->qid & 0xf;
3587         ring = &sc->txq[qid];
3588
3589         DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
3590             "qid %d idx %d RTS retries %d ACK retries %d nkill %d rate %x duration %d status %x\n",
3591             __func__, desc->qid, desc->idx,
3592             stat->rtsfailcnt,
3593             stat->ackfailcnt,
3594             stat->btkillcnt,
3595             stat->rate, le16toh(stat->duration),
3596             le32toh(stat->status));
3597
3598         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3599         if (qid >= sc->firstaggqueue) {
3600                 iwn_ampdu_tx_done(sc, qid, desc->idx, stat->nframes,
3601                     stat->ackfailcnt, &stat->status);
3602         } else {
3603                 iwn_tx_done(sc, desc, stat->ackfailcnt,
3604                     le32toh(stat->status) & 0xff);
3605         }
3606 }
3607
3608 static void
3609 iwn5000_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3610     struct iwn_rx_data *data)
3611 {
3612         struct iwn5000_tx_stat *stat = (struct iwn5000_tx_stat *)(desc + 1);
3613         struct iwn_tx_ring *ring;
3614         int qid;
3615
3616         qid = desc->qid & 0xf;
3617         ring = &sc->txq[qid];
3618
3619         DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
3620             "qid %d idx %d RTS retries %d ACK retries %d nkill %d rate %x duration %d status %x\n",
3621             __func__, desc->qid, desc->idx,
3622             stat->rtsfailcnt,
3623             stat->ackfailcnt,
3624             stat->btkillcnt,
3625             stat->rate, le16toh(stat->duration),
3626             le32toh(stat->status));
3627
3628 #ifdef notyet
3629         /* Reset TX scheduler slot. */
3630         iwn5000_reset_sched(sc, desc->qid & 0xf, desc->idx);
3631 #endif
3632
3633         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3634         if (qid >= sc->firstaggqueue) {
3635                 iwn_ampdu_tx_done(sc, qid, desc->idx, stat->nframes,
3636                     stat->ackfailcnt, &stat->status);
3637         } else {
3638                 iwn_tx_done(sc, desc, stat->ackfailcnt,
3639                     le16toh(stat->status) & 0xff);
3640         }
3641 }
3642
3643 /*
3644  * Adapter-independent backend for TX_DONE firmware notifications.
3645  */
3646 static void
3647 iwn_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc, int ackfailcnt,
3648     uint8_t status)
3649 {
3650         struct iwn_tx_ring *ring = &sc->txq[desc->qid & 0xf];
3651         struct iwn_tx_data *data = &ring->data[desc->idx];
3652         struct mbuf *m;
3653         struct ieee80211_node *ni;
3654         struct ieee80211vap *vap;
3655
3656         KASSERT(data->ni != NULL, ("no node"));
3657
3658         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3659
3660         /* Unmap and free mbuf. */
3661         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
3662         bus_dmamap_unload(ring->data_dmat, data->map);
3663         m = data->m, data->m = NULL;
3664         ni = data->ni, data->ni = NULL;
3665         vap = ni->ni_vap;
3666
3667         /*
3668          * Update rate control statistics for the node.
3669          */
3670         if (status & IWN_TX_FAIL)
3671                 ieee80211_ratectl_tx_complete(vap, ni,
3672                     IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
3673         else
3674                 ieee80211_ratectl_tx_complete(vap, ni,
3675                     IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
3676
3677         /*
3678          * Channels marked for "radar" require traffic to be received
3679          * to unlock before we can transmit.  Until traffic is seen
3680          * any attempt to transmit is returned immediately with status
3681          * set to IWN_TX_FAIL_TX_LOCKED.  Unfortunately this can easily
3682          * happen on first authenticate after scanning.  To workaround
3683          * this we ignore a failure of this sort in AUTH state so the
3684          * 802.11 layer will fall back to using a timeout to wait for
3685          * the AUTH reply.  This allows the firmware time to see
3686          * traffic so a subsequent retry of AUTH succeeds.  It's
3687          * unclear why the firmware does not maintain state for
3688          * channels recently visited as this would allow immediate
3689          * use of the channel after a scan (where we see traffic).
3690          */
3691         if (status == IWN_TX_FAIL_TX_LOCKED &&
3692             ni->ni_vap->iv_state == IEEE80211_S_AUTH)
3693                 ieee80211_tx_complete(ni, m, 0);
3694         else
3695                 ieee80211_tx_complete(ni, m,
3696                     (status & IWN_TX_FAIL) != 0);
3697
3698         sc->sc_tx_timer = 0;
3699         if (--ring->queued < IWN_TX_RING_LOMARK)
3700                 sc->qfullmsk &= ~(1 << ring->qid);
3701
3702         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3703 }
3704
3705 /*
3706  * Process a "command done" firmware notification.  This is where we wakeup
3707  * processes waiting for a synchronous command completion.
3708  */
3709 static void
3710 iwn_cmd_done(struct iwn_softc *sc, struct iwn_rx_desc *desc)
3711 {
3712         struct iwn_tx_ring *ring;
3713         struct iwn_tx_data *data;
3714         int cmd_queue_num;
3715
3716         if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT)
3717                 cmd_queue_num = IWN_PAN_CMD_QUEUE;
3718         else
3719                 cmd_queue_num = IWN_CMD_QUEUE_NUM;
3720
3721         if ((desc->qid & IWN_RX_DESC_QID_MSK) != cmd_queue_num)
3722                 return; /* Not a command ack. */
3723
3724         ring = &sc->txq[cmd_queue_num];
3725         data = &ring->data[desc->idx];
3726
3727         /* If the command was mapped in an mbuf, free it. */
3728         if (data->m != NULL) {
3729                 bus_dmamap_sync(ring->data_dmat, data->map,
3730                     BUS_DMASYNC_POSTWRITE);
3731                 bus_dmamap_unload(ring->data_dmat, data->map);
3732                 m_freem(data->m);
3733                 data->m = NULL;
3734         }
3735         wakeup(&ring->desc[desc->idx]);
3736 }
3737
3738 static void
3739 iwn_ampdu_tx_done(struct iwn_softc *sc, int qid, int idx, int nframes,
3740     int ackfailcnt, void *stat)
3741 {
3742         struct iwn_ops *ops = &sc->ops;
3743         struct iwn_tx_ring *ring = &sc->txq[qid];
3744         struct iwn_tx_data *data;
3745         struct mbuf *m;
3746         struct iwn_node *wn;
3747         struct ieee80211_node *ni;
3748         struct ieee80211_tx_ampdu *tap;
3749         uint64_t bitmap;
3750         uint32_t *status = stat;
3751         uint16_t *aggstatus = stat;
3752         uint16_t ssn;
3753         uint8_t tid;
3754         int bit, i, lastidx, *res, seqno, shift, start;
3755
3756         /* XXX TODO: status is le16 field! Grr */
3757
3758         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3759         DPRINTF(sc, IWN_DEBUG_XMIT, "%s: nframes=%d, status=0x%08x\n",
3760             __func__,
3761             nframes,
3762             *status);
3763
3764         tap = sc->qid2tap[qid];
3765         tid = tap->txa_tid;
3766         wn = (void *)tap->txa_ni;
3767         ni = tap->txa_ni;
3768
3769         /*
3770          * XXX TODO: ACK and RTS failures would be nice here!
3771          */
3772
3773         /*
3774          * A-MPDU single frame status - if we failed to transmit it
3775          * in A-MPDU, then it may be a permanent failure.
3776          *
3777          * XXX TODO: check what the Linux iwlwifi driver does here;
3778          * there's some permanent and temporary failures that may be
3779          * handled differently.
3780          */
3781         if (nframes == 1) {
3782                 if ((*status & 0xff) != 1 && (*status & 0xff) != 2) {
3783 #ifdef  NOT_YET
3784                         kprintf("ieee80211_send_bar()\n");
3785 #endif
3786                         /*
3787                          * If we completely fail a transmit, make sure a
3788                          * notification is pushed up to the rate control
3789                          * layer.
3790                          */
3791                         ieee80211_ratectl_tx_complete(ni->ni_vap,
3792                             ni,
3793                             IEEE80211_RATECTL_TX_FAILURE,
3794                             &ackfailcnt,
3795                             NULL);
3796                 } else {
3797                         /*
3798                          * If nframes=1, then we won't be getting a BA for
3799                          * this frame.  Ensure that we correctly update the
3800                          * rate control code with how many retries were
3801                          * needed to send it.
3802                          */
3803                         ieee80211_ratectl_tx_complete(ni->ni_vap,
3804                             ni,
3805                             IEEE80211_RATECTL_TX_SUCCESS,
3806                             &ackfailcnt,
3807                             NULL);
3808                 }
3809         }
3810
3811         bitmap = 0;
3812         start = idx;
3813         for (i = 0; i < nframes; i++) {
3814                 if (le16toh(aggstatus[i * 2]) & 0xc)
3815                         continue;
3816
3817                 idx = le16toh(aggstatus[2*i + 1]) & 0xff;
3818                 bit = idx - start;
3819                 shift = 0;
3820                 if (bit >= 64) {
3821                         shift = 0x100 - idx + start;
3822                         bit = 0;
3823                         start = idx;
3824                 } else if (bit <= -64)
3825                         bit = 0x100 - start + idx;
3826                 else if (bit < 0) {
3827                         shift = start - idx;
3828                         start = idx;
3829                         bit = 0;
3830                 }
3831                 bitmap = bitmap << shift;
3832                 bitmap |= 1ULL << bit;
3833         }
3834         tap = sc->qid2tap[qid];
3835         tid = tap->txa_tid;
3836         wn = (void *)tap->txa_ni;
3837         wn->agg[tid].bitmap = bitmap;
3838         wn->agg[tid].startidx = start;
3839         wn->agg[tid].nframes = nframes;
3840
3841         res = NULL;
3842         ssn = 0;
3843         if (!IEEE80211_AMPDU_RUNNING(tap)) {
3844                 res = tap->txa_private;
3845                 ssn = tap->txa_start & 0xfff;
3846         }
3847
3848         /* This is going nframes DWORDS into the descriptor? */
3849         seqno = le32toh(*(status + nframes)) & 0xfff;
3850         for (lastidx = (seqno & 0xff); ring->read != lastidx;) {
3851                 data = &ring->data[ring->read];
3852
3853                 /* Unmap and free mbuf. */
3854                 bus_dmamap_sync(ring->data_dmat, data->map,
3855                     BUS_DMASYNC_POSTWRITE);
3856                 bus_dmamap_unload(ring->data_dmat, data->map);
3857                 m = data->m, data->m = NULL;
3858                 ni = data->ni, data->ni = NULL;
3859
3860                 KASSERT(ni != NULL, ("no node"));
3861                 KASSERT(m != NULL, ("no mbuf"));
3862                 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: freeing m=%p\n", __func__, m);
3863                 ieee80211_tx_complete(ni, m, 1);
3864
3865                 ring->queued--;
3866                 ring->read = (ring->read + 1) % IWN_TX_RING_COUNT;
3867         }
3868
3869         if (ring->queued == 0 && res != NULL) {
3870                 iwn_nic_lock(sc);
3871                 ops->ampdu_tx_stop(sc, qid, tid, ssn);
3872                 iwn_nic_unlock(sc);
3873                 sc->qid2tap[qid] = NULL;
3874                 kfree(res, M_DEVBUF);
3875                 return;
3876         }
3877
3878         sc->sc_tx_timer = 0;
3879         if (ring->queued < IWN_TX_RING_LOMARK)
3880                 sc->qfullmsk &= ~(1 << ring->qid);
3881
3882         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3883 }
3884
3885 /*
3886  * Process an INT_FH_RX or INT_SW_RX interrupt.
3887  */
3888 static void
3889 iwn_notif_intr(struct iwn_softc *sc)
3890 {
3891         struct iwn_ops *ops = &sc->ops;
3892         struct ieee80211com *ic = &sc->sc_ic;
3893         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3894         uint16_t hw;
3895
3896         bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
3897             BUS_DMASYNC_POSTREAD);
3898
3899         hw = le16toh(sc->rxq.stat->closed_count) & 0xfff;
3900         while (sc->rxq.cur != hw) {
3901                 struct iwn_rx_data *data = &sc->rxq.data[sc->rxq.cur];
3902                 struct iwn_rx_desc *desc;
3903
3904                 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3905                     BUS_DMASYNC_POSTREAD);
3906                 desc = mtod(data->m, struct iwn_rx_desc *);
3907
3908                 DPRINTF(sc, IWN_DEBUG_RECV,
3909                     "%s: cur=%d; qid %x idx %d flags %x type %d(%s) len %d\n",
3910                     __func__, sc->rxq.cur, desc->qid & 0xf, desc->idx, desc->flags,
3911                     desc->type, iwn_intr_str(desc->type),
3912                     le16toh(desc->len));
3913
3914                 if (!(desc->qid & IWN_UNSOLICITED_RX_NOTIF))    /* Reply to a command. */
3915                         iwn_cmd_done(sc, desc);
3916
3917                 switch (desc->type) {
3918                 case IWN_RX_PHY:
3919                         iwn_rx_phy(sc, desc, data);
3920                         break;
3921
3922                 case IWN_RX_DONE:               /* 4965AGN only. */
3923                 case IWN_MPDU_RX_DONE:
3924                         /* An 802.11 frame has been received. */
3925                         iwn_rx_done(sc, desc, data);
3926                         break;
3927
3928                 case IWN_RX_COMPRESSED_BA:
3929                         /* A Compressed BlockAck has been received. */
3930                         iwn_rx_compressed_ba(sc, desc, data);
3931                         break;
3932
3933                 case IWN_TX_DONE:
3934                         /* An 802.11 frame has been transmitted. */
3935                         ops->tx_done(sc, desc, data);
3936                         break;
3937
3938                 case IWN_RX_STATISTICS:
3939                 case IWN_BEACON_STATISTICS:
3940                         iwn_rx_statistics(sc, desc, data);
3941                         break;
3942
3943                 case IWN_BEACON_MISSED:
3944                 {
3945                         struct iwn_beacon_missed *miss =
3946                             (struct iwn_beacon_missed *)(desc + 1);
3947                         int misses;
3948
3949                         bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3950                             BUS_DMASYNC_POSTREAD);
3951                         misses = le32toh(miss->consecutive);
3952
3953                         DPRINTF(sc, IWN_DEBUG_STATE,
3954                             "%s: beacons missed %d/%d\n", __func__,
3955                             misses, le32toh(miss->total));
3956                         /*
3957                          * If more than 5 consecutive beacons are missed,
3958                          * reinitialize the sensitivity state machine.
3959                          */
3960                         if (vap->iv_state == IEEE80211_S_RUN &&
3961                             (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
3962                                 if (misses > 5)
3963                                         (void)iwn_init_sensitivity(sc);
3964                                 if (misses >= vap->iv_bmissthreshold) {
3965                                         IWN_UNLOCK(sc);
3966                                         ieee80211_beacon_miss(ic);
3967                                         IWN_LOCK(sc);
3968                                 }
3969                         }
3970                         break;
3971                 }
3972                 case IWN_UC_READY:
3973                 {
3974                         struct iwn_ucode_info *uc =
3975                             (struct iwn_ucode_info *)(desc + 1);
3976
3977                         /* The microcontroller is ready. */
3978                         bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3979                             BUS_DMASYNC_POSTREAD);
3980                         DPRINTF(sc, IWN_DEBUG_RESET,
3981                             "microcode alive notification version=%d.%d "
3982                             "subtype=%x alive=%x\n", uc->major, uc->minor,
3983                             uc->subtype, le32toh(uc->valid));
3984
3985                         if (le32toh(uc->valid) != 1) {
3986                                 device_printf(sc->sc_dev,
3987                                     "microcontroller initialization failed");
3988                                 break;
3989                         }
3990                         if (uc->subtype == IWN_UCODE_INIT) {
3991                                 /* Save microcontroller report. */
3992                                 memcpy(&sc->ucode_info, uc, sizeof (*uc));
3993                         }
3994                         /* Save the address of the error log in SRAM. */
3995                         sc->errptr = le32toh(uc->errptr);
3996                         break;
3997                 }
3998                 case IWN_STATE_CHANGED:
3999                 {
4000                         /*
4001                          * State change allows hardware switch change to be
4002                          * noted. However, we handle this in iwn_intr as we
4003                          * get both the enable/disble intr.
4004                          */
4005                         bus_dmamap_sync(sc->rxq.data_dmat, data->map,
4006                             BUS_DMASYNC_POSTREAD);
4007 #ifdef  IWN_DEBUG
4008                         uint32_t *status = (uint32_t *)(desc + 1);
4009                         DPRINTF(sc, IWN_DEBUG_INTR | IWN_DEBUG_STATE,
4010                             "state changed to %x\n",
4011                             le32toh(*status));
4012 #endif
4013                         break;
4014                 }
4015                 case IWN_START_SCAN:
4016                 {
4017                         bus_dmamap_sync(sc->rxq.data_dmat, data->map,
4018                             BUS_DMASYNC_POSTREAD);
4019 #ifdef  IWN_DEBUG
4020                         struct iwn_start_scan *scan =
4021                             (struct iwn_start_scan *)(desc + 1);
4022                         DPRINTF(sc, IWN_DEBUG_ANY,
4023                             "%s: scanning channel %d status %x\n",
4024                             __func__, scan->chan, le32toh(scan->status));
4025 #endif
4026                         break;
4027                 }
4028                 case IWN_STOP_SCAN:
4029                 {
4030                         bus_dmamap_sync(sc->rxq.data_dmat, data->map,
4031                             BUS_DMASYNC_POSTREAD);
4032 #ifdef  IWN_DEBUG
4033                         struct iwn_stop_scan *scan =
4034                             (struct iwn_stop_scan *)(desc + 1);
4035                         DPRINTF(sc, IWN_DEBUG_STATE | IWN_DEBUG_SCAN,
4036                             "scan finished nchan=%d status=%d chan=%d\n",
4037                             scan->nchan, scan->status, scan->chan);
4038 #endif
4039                         sc->sc_is_scanning = 0;
4040                         IWN_UNLOCK(sc);
4041                         ieee80211_scan_next(vap);
4042                         IWN_LOCK(sc);
4043                         break;
4044                 }
4045                 case IWN5000_CALIBRATION_RESULT:
4046                         iwn5000_rx_calib_results(sc, desc, data);
4047                         break;
4048
4049                 case IWN5000_CALIBRATION_DONE:
4050                         sc->sc_flags |= IWN_FLAG_CALIB_DONE;
4051                         wakeup(sc);
4052                         break;
4053                 }
4054
4055                 sc->rxq.cur = (sc->rxq.cur + 1) % IWN_RX_RING_COUNT;
4056         }
4057
4058         /* Tell the firmware what we have processed. */
4059         hw = (hw == 0) ? IWN_RX_RING_COUNT - 1 : hw - 1;
4060         IWN_WRITE(sc, IWN_FH_RX_WPTR, hw & ~7);
4061 }
4062
4063 /*
4064  * Process an INT_WAKEUP interrupt raised when the microcontroller wakes up
4065  * from power-down sleep mode.
4066  */
4067 static void
4068 iwn_wakeup_intr(struct iwn_softc *sc)
4069 {
4070         int qid;
4071
4072         DPRINTF(sc, IWN_DEBUG_RESET, "%s: ucode wakeup from power-down sleep\n",
4073             __func__);
4074
4075         /* Wakeup RX and TX rings. */
4076         IWN_WRITE(sc, IWN_FH_RX_WPTR, sc->rxq.cur & ~7);
4077         for (qid = 0; qid < sc->ntxqs; qid++) {
4078                 struct iwn_tx_ring *ring = &sc->txq[qid];
4079                 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | ring->cur);
4080         }
4081 }
4082
4083 static void
4084 iwn_rftoggle_intr(struct iwn_softc *sc)
4085 {
4086         struct ieee80211com *ic = &sc->sc_ic;
4087         uint32_t tmp = IWN_READ(sc, IWN_GP_CNTRL);
4088
4089         IWN_LOCK_ASSERT(sc);
4090
4091         device_printf(sc->sc_dev, "RF switch: radio %s\n",
4092             (tmp & IWN_GP_CNTRL_RFKILL) ? "enabled" : "disabled");
4093         if (tmp & IWN_GP_CNTRL_RFKILL)
4094                 ieee80211_runtask(ic, &sc->sc_radioon_task);
4095         else
4096                 ieee80211_runtask(ic, &sc->sc_radiooff_task);
4097 }
4098
4099 /*
4100  * Dump the error log of the firmware when a firmware panic occurs.  Although
4101  * we can't debug the firmware because it is neither open source nor free, it
4102  * can help us to identify certain classes of problems.
4103  */
4104 static void
4105 iwn_fatal_intr(struct iwn_softc *sc)
4106 {
4107         struct iwn_fw_dump dump;
4108         int i;
4109
4110         IWN_LOCK_ASSERT(sc);
4111
4112         /* Force a complete recalibration on next init. */
4113         sc->sc_flags &= ~IWN_FLAG_CALIB_DONE;
4114
4115         /* Check that the error log address is valid. */
4116         if (sc->errptr < IWN_FW_DATA_BASE ||
4117             sc->errptr + sizeof (dump) >
4118             IWN_FW_DATA_BASE + sc->fw_data_maxsz) {
4119                 kprintf("%s: bad firmware error log address 0x%08x\n", __func__,
4120                     sc->errptr);
4121                 return;
4122         }
4123         if (iwn_nic_lock(sc) != 0) {
4124                 kprintf("%s: could not read firmware error log\n", __func__);
4125                 return;
4126         }
4127         /* Read firmware error log from SRAM. */
4128         iwn_mem_read_region_4(sc, sc->errptr, (uint32_t *)&dump,
4129             sizeof (dump) / sizeof (uint32_t));
4130         iwn_nic_unlock(sc);
4131
4132         if (dump.valid == 0) {
4133                 kprintf("%s: firmware error log is empty\n", __func__);
4134                 return;
4135         }
4136         kprintf("firmware error log:\n");
4137         kprintf("  error type      = \"%s\" (0x%08X)\n",
4138             (dump.id < nitems(iwn_fw_errmsg)) ?
4139                 iwn_fw_errmsg[dump.id] : "UNKNOWN",
4140             dump.id);
4141         kprintf("  program counter = 0x%08X\n", dump.pc);
4142         kprintf("  source line     = 0x%08X\n", dump.src_line);
4143         kprintf("  error data      = 0x%08X%08X\n",
4144             dump.error_data[0], dump.error_data[1]);
4145         kprintf("  branch link     = 0x%08X%08X\n",
4146             dump.branch_link[0], dump.branch_link[1]);
4147         kprintf("  interrupt link  = 0x%08X%08X\n",
4148             dump.interrupt_link[0], dump.interrupt_link[1]);
4149         kprintf("  time            = %u\n", dump.time[0]);
4150
4151         /* Dump driver status (TX and RX rings) while we're here. */
4152         kprintf("driver status:\n");
4153         for (i = 0; i < sc->ntxqs; i++) {
4154                 struct iwn_tx_ring *ring = &sc->txq[i];
4155                 kprintf("  tx ring %2d: qid=%-2d cur=%-3d queued=%-3d\n",
4156                     i, ring->qid, ring->cur, ring->queued);
4157         }
4158         kprintf("  rx ring: cur=%d\n", sc->rxq.cur);
4159 }
4160
4161 static void
4162 iwn_intr(void *arg)
4163 {
4164         struct iwn_softc *sc = arg;
4165         uint32_t r1, r2, tmp;
4166
4167         IWN_LOCK(sc);
4168
4169         /* Disable interrupts. */
4170         IWN_WRITE(sc, IWN_INT_MASK, 0);
4171
4172         /* Read interrupts from ICT (fast) or from registers (slow). */
4173         if (sc->sc_flags & IWN_FLAG_USE_ICT) {
4174                 tmp = 0;
4175                 while (sc->ict[sc->ict_cur] != 0) {
4176                         tmp |= sc->ict[sc->ict_cur];
4177                         sc->ict[sc->ict_cur] = 0;       /* Acknowledge. */
4178                         sc->ict_cur = (sc->ict_cur + 1) % IWN_ICT_COUNT;
4179                 }
4180                 tmp = le32toh(tmp);
4181                 if (tmp == 0xffffffff)  /* Shouldn't happen. */
4182                         tmp = 0;
4183                 else if (tmp & 0xc0000) /* Workaround a HW bug. */
4184                         tmp |= 0x8000;
4185                 r1 = (tmp & 0xff00) << 16 | (tmp & 0xff);
4186                 r2 = 0; /* Unused. */
4187         } else {
4188                 r1 = IWN_READ(sc, IWN_INT);
4189                 if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0) {
4190                         IWN_UNLOCK(sc);
4191                         return; /* Hardware gone! */
4192                 }
4193                 r2 = IWN_READ(sc, IWN_FH_INT);
4194         }
4195
4196         DPRINTF(sc, IWN_DEBUG_INTR, "interrupt reg1=0x%08x reg2=0x%08x\n"
4197     , r1, r2);
4198
4199         if (r1 == 0 && r2 == 0)
4200                 goto done;      /* Interrupt not for us. */
4201
4202         /* Acknowledge interrupts. */
4203         IWN_WRITE(sc, IWN_INT, r1);
4204         if (!(sc->sc_flags & IWN_FLAG_USE_ICT))
4205                 IWN_WRITE(sc, IWN_FH_INT, r2);
4206
4207         if (r1 & IWN_INT_RF_TOGGLED) {
4208                 iwn_rftoggle_intr(sc);
4209                 goto done;
4210         }
4211         if (r1 & IWN_INT_CT_REACHED) {
4212                 device_printf(sc->sc_dev, "%s: critical temperature reached!\n",
4213                     __func__);
4214         }
4215         if (r1 & (IWN_INT_SW_ERR | IWN_INT_HW_ERR)) {
4216                 device_printf(sc->sc_dev, "%s: fatal firmware error\n",
4217                     __func__);
4218 #ifdef  IWN_DEBUG
4219                 iwn_debug_register(sc);
4220 #endif
4221                 /* Dump firmware error log and stop. */
4222                 iwn_fatal_intr(sc);
4223
4224                 taskqueue_enqueue(sc->sc_tq, &sc->sc_panic_task);
4225                 goto done;
4226         }
4227         if ((r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX | IWN_INT_RX_PERIODIC)) ||
4228             (r2 & IWN_FH_INT_RX)) {
4229                 if (sc->sc_flags & IWN_FLAG_USE_ICT) {
4230                         if (r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX))
4231                                 IWN_WRITE(sc, IWN_FH_INT, IWN_FH_INT_RX);
4232                         IWN_WRITE_1(sc, IWN_INT_PERIODIC,
4233                             IWN_INT_PERIODIC_DIS);
4234                         iwn_notif_intr(sc);
4235                         if (r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX)) {
4236                                 IWN_WRITE_1(sc, IWN_INT_PERIODIC,
4237                                     IWN_INT_PERIODIC_ENA);
4238                         }
4239                 } else
4240                         iwn_notif_intr(sc);
4241         }
4242
4243         if ((r1 & IWN_INT_FH_TX) || (r2 & IWN_FH_INT_TX)) {
4244                 if (sc->sc_flags & IWN_FLAG_USE_ICT)
4245                         IWN_WRITE(sc, IWN_FH_INT, IWN_FH_INT_TX);
4246                 wakeup(sc);     /* FH DMA transfer completed. */
4247         }
4248
4249         if (r1 & IWN_INT_ALIVE)
4250                 wakeup(sc);     /* Firmware is alive. */
4251
4252         if (r1 & IWN_INT_WAKEUP)
4253                 iwn_wakeup_intr(sc);
4254
4255 done:
4256         /* Re-enable interrupts. */
4257         if (sc->sc_flags & IWN_FLAG_RUNNING)
4258                 IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
4259
4260         IWN_UNLOCK(sc);
4261 }
4262
4263 /*
4264  * Update TX scheduler ring when transmitting an 802.11 frame (4965AGN and
4265  * 5000 adapters use a slightly different format).
4266  */
4267 static void
4268 iwn4965_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
4269     uint16_t len)
4270 {
4271         uint16_t *w = &sc->sched[qid * IWN4965_SCHED_COUNT + idx];
4272
4273         DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4274
4275         *w = htole16(len + 8);
4276         bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4277             BUS_DMASYNC_PREWRITE);
4278         if (idx < IWN_SCHED_WINSZ) {
4279                 *(w + IWN_TX_RING_COUNT) = *w;
4280                 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4281                     BUS_DMASYNC_PREWRITE);
4282         }
4283 }
4284
4285 static void
4286 iwn5000_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
4287     uint16_t len)
4288 {
4289         uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
4290
4291         DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4292
4293         *w = htole16(id << 12 | (len + 8));
4294         bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4295             BUS_DMASYNC_PREWRITE);
4296         if (idx < IWN_SCHED_WINSZ) {
4297                 *(w + IWN_TX_RING_COUNT) = *w;
4298                 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4299                     BUS_DMASYNC_PREWRITE);
4300         }
4301 }
4302
4303 #ifdef notyet
4304 static void
4305 iwn5000_reset_sched(struct iwn_softc *sc, int qid, int idx)
4306 {
4307         uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
4308
4309         DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4310
4311         *w = (*w & htole16(0xf000)) | htole16(1);
4312         bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4313             BUS_DMASYNC_PREWRITE);
4314         if (idx < IWN_SCHED_WINSZ) {
4315                 *(w + IWN_TX_RING_COUNT) = *w;
4316                 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4317                     BUS_DMASYNC_PREWRITE);
4318         }
4319 }
4320 #endif
4321
4322 /*
4323  * Check whether OFDM 11g protection will be enabled for the given rate.
4324  *
4325  * The original driver code only enabled protection for OFDM rates.
4326  * It didn't check to see whether it was operating in 11a or 11bg mode.
4327  */
4328 static int
4329 iwn_check_rate_needs_protection(struct iwn_softc *sc,
4330     struct ieee80211vap *vap, uint8_t rate)
4331 {
4332         struct ieee80211com *ic = vap->iv_ic;
4333
4334         /*
4335          * Not in 2GHz mode? Then there's no need to enable OFDM
4336          * 11bg protection.
4337          */
4338         if (! IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
4339                 return (0);
4340         }
4341
4342         /*
4343          * 11bg protection not enabled? Then don't use it.
4344          */
4345         if ((ic->ic_flags & IEEE80211_F_USEPROT) == 0)
4346                 return (0);
4347
4348         /*
4349          * If it's an 11n rate - no protection.
4350          * We'll do it via a specific 11n check.
4351          */
4352         if (rate & IEEE80211_RATE_MCS) {
4353                 return (0);
4354         }
4355
4356         /*
4357          * Do a rate table lookup.  If the PHY is CCK,
4358          * don't do protection.
4359          */
4360         if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_CCK)
4361                 return (0);
4362
4363         /*
4364          * Yup, enable protection.
4365          */
4366         return (1);
4367 }
4368
4369 /*
4370  * return a value between 0 and IWN_MAX_TX_RETRIES-1 as an index into
4371  * the link quality table that reflects this particular entry.
4372  */
4373 static int
4374 iwn_tx_rate_to_linkq_offset(struct iwn_softc *sc, struct ieee80211_node *ni,
4375     uint8_t rate)
4376 {
4377         struct ieee80211_rateset *rs;
4378         int is_11n;
4379         int nr;
4380         int i;
4381         uint8_t cmp_rate;
4382
4383         /*
4384          * Figure out if we're using 11n or not here.
4385          */
4386         if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && ni->ni_htrates.rs_nrates > 0)
4387                 is_11n = 1;
4388         else
4389                 is_11n = 0;
4390
4391         /*
4392          * Use the correct rate table.
4393          */
4394         if (is_11n) {
4395                 rs = (struct ieee80211_rateset *) &ni->ni_htrates;
4396                 nr = ni->ni_htrates.rs_nrates;
4397         } else {
4398                 rs = &ni->ni_rates;
4399                 nr = rs->rs_nrates;
4400         }
4401
4402         /*
4403          * Find the relevant link quality entry in the table.
4404          */
4405         for (i = 0; i < nr && i < IWN_MAX_TX_RETRIES - 1 ; i++) {
4406                 /*
4407                  * The link quality table index starts at 0 == highest
4408                  * rate, so we walk the rate table backwards.
4409                  */
4410                 cmp_rate = rs->rs_rates[(nr - 1) - i];
4411                 if (rate & IEEE80211_RATE_MCS)
4412                         cmp_rate |= IEEE80211_RATE_MCS;
4413
4414 #if 0
4415                 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: idx %d: nr=%d, rate=0x%02x, rateentry=0x%02x\n",
4416                     __func__,
4417                     i,
4418                     nr,
4419                     rate,
4420                     cmp_rate);
4421 #endif
4422
4423                 if (cmp_rate == rate)
4424                         return (i);
4425         }
4426
4427         /* Failed? Start at the end */
4428         return (IWN_MAX_TX_RETRIES - 1);
4429 }
4430
4431 static int
4432 iwn_tx_data(struct iwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
4433 {
4434         struct iwn_ops *ops = &sc->ops;
4435         const struct ieee80211_txparam *tp;
4436         struct ieee80211vap *vap = ni->ni_vap;
4437         struct ieee80211com *ic = ni->ni_ic;
4438         struct iwn_node *wn = (void *)ni;
4439         struct iwn_tx_ring *ring;
4440         struct iwn_tx_desc *desc;
4441         struct iwn_tx_data *data;
4442         struct iwn_tx_cmd *cmd;
4443         struct iwn_cmd_data *tx;
4444         struct ieee80211_frame *wh;
4445         struct ieee80211_key *k = NULL;
4446         struct mbuf *m1;
4447         uint32_t flags;
4448         uint16_t qos;
4449         u_int hdrlen;
4450         bus_dma_segment_t *seg, segs[IWN_MAX_SCATTER];
4451         uint8_t tid, type;
4452         int ac, i, totlen, error, pad, nsegs = 0, rate;
4453
4454         DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
4455
4456         IWN_LOCK_ASSERT(sc);
4457
4458         wh = mtod(m, struct ieee80211_frame *);
4459         hdrlen = ieee80211_anyhdrsize(wh);
4460         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
4461
4462         /* Select EDCA Access Category and TX ring for this frame. */
4463         if (IEEE80211_QOS_HAS_SEQ(wh)) {
4464                 qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
4465                 tid = qos & IEEE80211_QOS_TID;
4466         } else {
4467                 qos = 0;
4468                 tid = 0;
4469         }
4470         ac = M_WME_GETAC(m);
4471         if (m->m_flags & M_AMPDU_MPDU) {
4472                 uint16_t seqno;
4473                 struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[ac];
4474
4475                 if (!IEEE80211_AMPDU_RUNNING(tap)) {
4476                         return EINVAL;
4477                 }
4478
4479                 /*
4480                  * Queue this frame to the hardware ring that we've
4481                  * negotiated AMPDU TX on.
4482                  *
4483                  * Note that the sequence number must match the TX slot
4484                  * being used!
4485                  */
4486                 ac = *(int *)tap->txa_private;
4487                 seqno = ni->ni_txseqs[tid];
4488                 *(uint16_t *)wh->i_seq =
4489                     htole16(seqno << IEEE80211_SEQ_SEQ_SHIFT);
4490                 ring = &sc->txq[ac];
4491                 if ((seqno % 256) != ring->cur) {
4492                         device_printf(sc->sc_dev,
4493                             "%s: m=%p: seqno (%d) (%d) != ring index (%d) !\n",
4494                             __func__,
4495                             m,
4496                             seqno,
4497                             seqno % 256,
4498                             ring->cur);
4499                 }
4500                 ni->ni_txseqs[tid]++;
4501         }
4502         ring = &sc->txq[ac];
4503         desc = &ring->desc[ring->cur];
4504         data = &ring->data[ring->cur];
4505
4506         /* Choose a TX rate index. */
4507         tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];