sys/dev/iwm/if_iwm.c

   1 /*      $OpenBSD: if_iwm.c,v 1.42 2015/05/30 02:49:23 deraadt Exp $     */
   2
   3 /*
   4  * Copyright (c) 2014 genua mbh <info@genua.de>
   5  * Copyright (c) 2014 Fixup Software Ltd.
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 /*-
  21  * Based on BSD-licensed source modules in the Linux iwlwifi driver,
  22  * which were used as the reference documentation for this implementation.
  23  *
  24  * Driver version we are currently based off of is
  25  * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd)
  26  *
  27  ***********************************************************************
  28  *
  29  * This file is provided under a dual BSD/GPLv2 license.  When using or
  30  * redistributing this file, you may do so under either license.
  31  *
  32  * GPL LICENSE SUMMARY
  33  *
  34  * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
  35  *
  36  * This program is free software; you can redistribute it and/or modify
  37  * it under the terms of version 2 of the GNU General Public License as
  38  * published by the Free Software Foundation.
  39  *
  40  * This program is distributed in the hope that it will be useful, but
  41  * WITHOUT ANY WARRANTY; without even the implied warranty of
  42  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  43  * General Public License for more details.
  44  *
  45  * You should have received a copy of the GNU General Public License
  46  * along with this program; if not, write to the Free Software
  47  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  48  * USA
  49  *
  50  * The full GNU General Public License is included in this distribution
  51  * in the file called COPYING.
  52  *
  53  * Contact Information:
  54  *  Intel Linux Wireless <ilw@linux.intel.com>
  55  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  56  *
  57  *
  58  * BSD LICENSE
  59  *
  60  * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
  61  * All rights reserved.
  62  *
  63  * Redistribution and use in source and binary forms, with or without
  64  * modification, are permitted provided that the following conditions
  65  * are met:
  66  *
  67  *  * Redistributions of source code must retain the above copyright
  68  *    notice, this list of conditions and the following disclaimer.
  69  *  * Redistributions in binary form must reproduce the above copyright
  70  *    notice, this list of conditions and the following disclaimer in
  71  *    the documentation and/or other materials provided with the
  72  *    distribution.
  73  *  * Neither the name Intel Corporation nor the names of its
  74  *    contributors may be used to endorse or promote products derived
  75  *    from this software without specific prior written permission.
  76  *
  77  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  78  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  79  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  80  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  81  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  82  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  83  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  84  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  85  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  86  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  87  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  88  */
  89
  90 /*-
  91  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
  92  *
  93  * Permission to use, copy, modify, and distribute this software for any
  94  * purpose with or without fee is hereby granted, provided that the above
  95  * copyright notice and this permission notice appear in all copies.
  96  *
  97  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  98  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  99  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 100  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 101  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 102  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 103  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 104  */
 105 #include <sys/cdefs.h>
 106 __FBSDID("$FreeBSD$");
 107
 108 #include "opt_wlan.h"
 109 #include "opt_iwm.h"
 110
 111 #include <sys/param.h>
 112 #include <sys/bus.h>
 113 #include <sys/conf.h>
 114 #include <sys/endian.h>
 115 #include <sys/firmware.h>
 116 #include <sys/kernel.h>
 117 #include <sys/malloc.h>
 118 #include <sys/mbuf.h>
 119 #include <sys/mutex.h>
 120 #include <sys/module.h>
 121 #include <sys/proc.h>
 122 #include <sys/rman.h>
 123 #include <sys/socket.h>
 124 #include <sys/sockio.h>
 125 #include <sys/sysctl.h>
 126 #include <sys/linker.h>
 127
 128 #include <machine/bus.h>
 129 #include <machine/endian.h>
 130 #include <machine/resource.h>
 131
 132 #include <dev/pci/pcivar.h>
 133 #include <dev/pci/pcireg.h>
 134
 135 #include <net/bpf.h>
 136
 137 #include <net/if.h>
 138 #include <net/if_var.h>
 139 #include <net/if_arp.h>
 140 #include <net/if_dl.h>
 141 #include <net/if_media.h>
 142 #include <net/if_types.h>
 143
 144 #include <netinet/in.h>
 145 #include <netinet/in_systm.h>
 146 #include <netinet/if_ether.h>
 147 #include <netinet/ip.h>
 148
 149 #include <net80211/ieee80211_var.h>
 150 #include <net80211/ieee80211_regdomain.h>
 151 #include <net80211/ieee80211_ratectl.h>
 152 #include <net80211/ieee80211_radiotap.h>
 153
 154 #include <dev/iwm/if_iwmreg.h>
 155 #include <dev/iwm/if_iwmvar.h>
 156 #include <dev/iwm/if_iwm_config.h>
 157 #include <dev/iwm/if_iwm_debug.h>
 158 #include <dev/iwm/if_iwm_notif_wait.h>
 159 #include <dev/iwm/if_iwm_util.h>
 160 #include <dev/iwm/if_iwm_binding.h>
 161 #include <dev/iwm/if_iwm_phy_db.h>
 162 #include <dev/iwm/if_iwm_mac_ctxt.h>
 163 #include <dev/iwm/if_iwm_phy_ctxt.h>
 164 #include <dev/iwm/if_iwm_time_event.h>
 165 #include <dev/iwm/if_iwm_power.h>
 166 #include <dev/iwm/if_iwm_scan.h>
 167
 168 #include <dev/iwm/if_iwm_pcie_trans.h>
 169 #include <dev/iwm/if_iwm_led.h>
 170 #include <dev/iwm/if_iwm_fw.h>
 171
 172 const uint8_t iwm_nvm_channels[] = {
 173         /* 2.4 GHz */
 174         1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
 175         /* 5 GHz */
 176         36, 40, 44, 48, 52, 56, 60, 64,
 177         100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
 178         149, 153, 157, 161, 165
 179 };
 180 _Static_assert(nitems(iwm_nvm_channels) <= IWM_NUM_CHANNELS,
 181     "IWM_NUM_CHANNELS is too small");
 182
 183 const uint8_t iwm_nvm_channels_8000[] = {
 184         /* 2.4 GHz */
 185         1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
 186         /* 5 GHz */
 187         36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
 188         96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
 189         149, 153, 157, 161, 165, 169, 173, 177, 181
 190 };
 191 _Static_assert(nitems(iwm_nvm_channels_8000) <= IWM_NUM_CHANNELS_8000,
 192     "IWM_NUM_CHANNELS_8000 is too small");
 193
 194 #define IWM_NUM_2GHZ_CHANNELS   14
 195 #define IWM_N_HW_ADDR_MASK      0xF
 196
 197 /*
 198  * XXX For now, there's simply a fixed set of rate table entries
 199  * that are populated.
 200  */
 201 const struct iwm_rate {
 202         uint8_t rate;
 203         uint8_t plcp;
 204 } iwm_rates[] = {
 205         {   2,  IWM_RATE_1M_PLCP  },
 206         {   4,  IWM_RATE_2M_PLCP  },
 207         {  11,  IWM_RATE_5M_PLCP  },
 208         {  22,  IWM_RATE_11M_PLCP },
 209         {  12,  IWM_RATE_6M_PLCP  },
 210         {  18,  IWM_RATE_9M_PLCP  },
 211         {  24,  IWM_RATE_12M_PLCP },
 212         {  36,  IWM_RATE_18M_PLCP },
 213         {  48,  IWM_RATE_24M_PLCP },
 214         {  72,  IWM_RATE_36M_PLCP },
 215         {  96,  IWM_RATE_48M_PLCP },
 216         { 108,  IWM_RATE_54M_PLCP },
 217 };
 218 #define IWM_RIDX_CCK    0
 219 #define IWM_RIDX_OFDM   4
 220 #define IWM_RIDX_MAX    (nitems(iwm_rates)-1)
 221 #define IWM_RIDX_IS_CCK(_i_) ((_i_) < IWM_RIDX_OFDM)
 222 #define IWM_RIDX_IS_OFDM(_i_) ((_i_) >= IWM_RIDX_OFDM)
 223
 224 struct iwm_nvm_section {
 225         uint16_t length;
 226         uint8_t *data;
 227 };
 228
 229 #define IWM_MVM_UCODE_ALIVE_TIMEOUT     hz
 230 #define IWM_MVM_UCODE_CALIB_TIMEOUT     (2*hz)
 231
 232 struct iwm_mvm_alive_data {
 233         int valid;
 234         uint32_t scd_base_addr;
 235 };
 236
 237 static int      iwm_store_cscheme(struct iwm_softc *, const uint8_t *, size_t);
 238 static int      iwm_firmware_store_section(struct iwm_softc *,
 239                                            enum iwm_ucode_type,
 240                                            const uint8_t *, size_t);
 241 static int      iwm_set_default_calib(struct iwm_softc *, const void *);
 242 static void     iwm_fw_info_free(struct iwm_fw_info *);
 243 static int      iwm_read_firmware(struct iwm_softc *, enum iwm_ucode_type);
 244 static int      iwm_alloc_fwmem(struct iwm_softc *);
 245 static int      iwm_alloc_sched(struct iwm_softc *);
 246 static int      iwm_alloc_kw(struct iwm_softc *);
 247 static int      iwm_alloc_ict(struct iwm_softc *);
 248 static int      iwm_alloc_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
 249 static void     iwm_reset_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
 250 static void     iwm_free_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
 251 static int      iwm_alloc_tx_ring(struct iwm_softc *, struct iwm_tx_ring *,
 252                                   int);
 253 static void     iwm_reset_tx_ring(struct iwm_softc *, struct iwm_tx_ring *);
 254 static void     iwm_free_tx_ring(struct iwm_softc *, struct iwm_tx_ring *);
 255 static void     iwm_enable_interrupts(struct iwm_softc *);
 256 static void     iwm_restore_interrupts(struct iwm_softc *);
 257 static void     iwm_disable_interrupts(struct iwm_softc *);
 258 static void     iwm_ict_reset(struct iwm_softc *);
 259 static int      iwm_allow_mcast(struct ieee80211vap *, struct iwm_softc *);
 260 static void     iwm_stop_device(struct iwm_softc *);
 261 static void     iwm_mvm_nic_config(struct iwm_softc *);
 262 static int      iwm_nic_rx_init(struct iwm_softc *);
 263 static int      iwm_nic_tx_init(struct iwm_softc *);
 264 static int      iwm_nic_init(struct iwm_softc *);
 265 static int      iwm_enable_txq(struct iwm_softc *, int, int, int);
 266 static int      iwm_trans_pcie_fw_alive(struct iwm_softc *, uint32_t);
 267 static int      iwm_nvm_read_chunk(struct iwm_softc *, uint16_t, uint16_t,
 268                                    uint16_t, uint8_t *, uint16_t *);
 269 static int      iwm_nvm_read_section(struct iwm_softc *, uint16_t, uint8_t *,
 270                                      uint16_t *, uint32_t);
 271 static uint32_t iwm_eeprom_channel_flags(uint16_t);
 272 static void     iwm_add_channel_band(struct iwm_softc *,
 273                     struct ieee80211_channel[], int, int *, int, size_t,
 274                     const uint8_t[]);
 275 static void     iwm_init_channel_map(struct ieee80211com *, int, int *,
 276                     struct ieee80211_channel[]);
 277 static struct iwm_nvm_data *
 278         iwm_parse_nvm_data(struct iwm_softc *, const uint16_t *,
 279                            const uint16_t *, const uint16_t *,
 280                            const uint16_t *, const uint16_t *,
 281                            const uint16_t *);
 282 static void     iwm_free_nvm_data(struct iwm_nvm_data *);
 283 static void     iwm_set_hw_address_family_8000(struct iwm_softc *,
 284                                                struct iwm_nvm_data *,
 285                                                const uint16_t *,
 286                                                const uint16_t *);
 287 static int      iwm_get_sku(const struct iwm_softc *, const uint16_t *,
 288                             const uint16_t *);
 289 static int      iwm_get_nvm_version(const struct iwm_softc *, const uint16_t *);
 290 static int      iwm_get_radio_cfg(const struct iwm_softc *, const uint16_t *,
 291                                   const uint16_t *);
 292 static int      iwm_get_n_hw_addrs(const struct iwm_softc *,
 293                                    const uint16_t *);
 294 static void     iwm_set_radio_cfg(const struct iwm_softc *,
 295                                   struct iwm_nvm_data *, uint32_t);
 296 static struct iwm_nvm_data *
 297         iwm_parse_nvm_sections(struct iwm_softc *, struct iwm_nvm_section *);
 298 static int      iwm_nvm_init(struct iwm_softc *);
 299 static int      iwm_pcie_load_section(struct iwm_softc *, uint8_t,
 300                                       const struct iwm_fw_desc *);
 301 static int      iwm_pcie_load_firmware_chunk(struct iwm_softc *, uint32_t,
 302                                              bus_addr_t, uint32_t);
 303 static int      iwm_pcie_load_cpu_sections_8000(struct iwm_softc *sc,
 304                                                 const struct iwm_fw_sects *,
 305                                                 int, int *);
 306 static int      iwm_pcie_load_cpu_sections(struct iwm_softc *,
 307                                            const struct iwm_fw_sects *,
 308                                            int, int *);
 309 static int      iwm_pcie_load_given_ucode_8000(struct iwm_softc *,
 310                                                const struct iwm_fw_sects *);
 311 static int      iwm_pcie_load_given_ucode(struct iwm_softc *,
 312                                           const struct iwm_fw_sects *);
 313 static int      iwm_start_fw(struct iwm_softc *, const struct iwm_fw_sects *);
 314 static int      iwm_send_tx_ant_cfg(struct iwm_softc *, uint8_t);
 315 static int      iwm_send_phy_cfg_cmd(struct iwm_softc *);
 316 static int      iwm_mvm_load_ucode_wait_alive(struct iwm_softc *,
 317                                               enum iwm_ucode_type);
 318 static int      iwm_run_init_mvm_ucode(struct iwm_softc *, int);
 319 static int      iwm_rx_addbuf(struct iwm_softc *, int, int);
 320 static int      iwm_mvm_get_signal_strength(struct iwm_softc *,
 321                                             struct iwm_rx_phy_info *);
 322 static void     iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *,
 323                                       struct iwm_rx_packet *,
 324                                       struct iwm_rx_data *);
 325 static int      iwm_get_noise(struct iwm_softc *sc,
 326                     const struct iwm_mvm_statistics_rx_non_phy *);
 327 static void     iwm_mvm_rx_rx_mpdu(struct iwm_softc *, struct mbuf *);
 328 static int      iwm_mvm_rx_tx_cmd_single(struct iwm_softc *,
 329                                          struct iwm_rx_packet *,
 330                                          struct iwm_node *);
 331 static void     iwm_mvm_rx_tx_cmd(struct iwm_softc *, struct iwm_rx_packet *,
 332                                   struct iwm_rx_data *);
 333 static void     iwm_cmd_done(struct iwm_softc *, struct iwm_rx_packet *);
 334 #if 0
 335 static void     iwm_update_sched(struct iwm_softc *, int, int, uint8_t,
 336                                  uint16_t);
 337 #endif
 338 static const struct iwm_rate *
 339         iwm_tx_fill_cmd(struct iwm_softc *, struct iwm_node *,
 340                         struct mbuf *, struct iwm_tx_cmd *);
 341 static int      iwm_tx(struct iwm_softc *, struct mbuf *,
 342                        struct ieee80211_node *, int);
 343 static int      iwm_raw_xmit(struct ieee80211_node *, struct mbuf *,
 344                              const struct ieee80211_bpf_params *);
 345 static int      iwm_mvm_flush_tx_path(struct iwm_softc *sc,
 346                                       uint32_t tfd_msk, uint32_t flags);
 347 static int      iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *,
 348                                                 struct iwm_mvm_add_sta_cmd *,
 349                                                 int *);
 350 static int      iwm_mvm_sta_send_to_fw(struct iwm_softc *, struct iwm_node *,
 351                                        int);
 352 static int      iwm_mvm_add_sta(struct iwm_softc *, struct iwm_node *);
 353 static int      iwm_mvm_update_sta(struct iwm_softc *, struct iwm_node *);
 354 static int      iwm_mvm_add_int_sta_common(struct iwm_softc *,
 355                                            struct iwm_int_sta *,
 356                                            const uint8_t *, uint16_t, uint16_t);
 357 static int      iwm_mvm_add_aux_sta(struct iwm_softc *);
 358 static int      iwm_mvm_update_quotas(struct iwm_softc *, struct iwm_node *);
 359 static int      iwm_auth(struct ieee80211vap *, struct iwm_softc *);
 360 static int      iwm_assoc(struct ieee80211vap *, struct iwm_softc *);
 361 static int      iwm_release(struct iwm_softc *, struct iwm_node *);
 362 static struct ieee80211_node *
 363                 iwm_node_alloc(struct ieee80211vap *,
 364                                const uint8_t[IEEE80211_ADDR_LEN]);
 365 static void     iwm_setrates(struct iwm_softc *, struct iwm_node *);
 366 static int      iwm_media_change(struct ifnet *);
 367 static int      iwm_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 368 static void     iwm_endscan_cb(void *, int);
 369 static void     iwm_mvm_fill_sf_command(struct iwm_softc *,
 370                                         struct iwm_sf_cfg_cmd *,
 371                                         struct ieee80211_node *);
 372 static int      iwm_mvm_sf_config(struct iwm_softc *, enum iwm_sf_state);
 373 static int      iwm_send_bt_init_conf(struct iwm_softc *);
 374 static int      iwm_send_update_mcc_cmd(struct iwm_softc *, const char *);
 375 static void     iwm_mvm_tt_tx_backoff(struct iwm_softc *, uint32_t);
 376 static int      iwm_init_hw(struct iwm_softc *);
 377 static void     iwm_init(struct iwm_softc *);
 378 static void     iwm_start(struct iwm_softc *);
 379 static void     iwm_stop(struct iwm_softc *);
 380 static void     iwm_watchdog(void *);
 381 static void     iwm_parent(struct ieee80211com *);
 382 #ifdef IWM_DEBUG
 383 static const char *
 384                 iwm_desc_lookup(uint32_t);
 385 static void     iwm_nic_error(struct iwm_softc *);
 386 static void     iwm_nic_umac_error(struct iwm_softc *);
 387 #endif
 388 static void     iwm_notif_intr(struct iwm_softc *);
 389 static void     iwm_intr(void *);
 390 static int      iwm_attach(device_t);
 391 static int      iwm_is_valid_ether_addr(uint8_t *);
 392 static void     iwm_preinit(void *);
 393 static int      iwm_detach_local(struct iwm_softc *sc, int);
 394 static void     iwm_init_task(void *);
 395 static void     iwm_radiotap_attach(struct iwm_softc *);
 396 static struct ieee80211vap *
 397                 iwm_vap_create(struct ieee80211com *,
 398                                const char [IFNAMSIZ], int,
 399                                enum ieee80211_opmode, int,
 400                                const uint8_t [IEEE80211_ADDR_LEN],
 401                                const uint8_t [IEEE80211_ADDR_LEN]);
 402 static void     iwm_vap_delete(struct ieee80211vap *);
 403 static void     iwm_scan_start(struct ieee80211com *);
 404 static void     iwm_scan_end(struct ieee80211com *);
 405 static void     iwm_update_mcast(struct ieee80211com *);
 406 static void     iwm_set_channel(struct ieee80211com *);
 407 static void     iwm_scan_curchan(struct ieee80211_scan_state *, unsigned long);
 408 static void     iwm_scan_mindwell(struct ieee80211_scan_state *);
 409 static int      iwm_detach(device_t);
 410
 411 /*
 412  * Firmware parser.
 413  */
 414
 415 static int
 416 iwm_store_cscheme(struct iwm_softc *sc, const uint8_t *data, size_t dlen)
 417 {
 418         const struct iwm_fw_cscheme_list *l = (const void *)data;
 419
 420         if (dlen < sizeof(*l) ||
 421             dlen < sizeof(l->size) + l->size * sizeof(*l->cs))
 422                 return EINVAL;
 423
 424         /* we don't actually store anything for now, always use s/w crypto */
 425
 426         return 0;
 427 }
 428
 429 static int
 430 iwm_firmware_store_section(struct iwm_softc *sc,
 431     enum iwm_ucode_type type, const uint8_t *data, size_t dlen)
 432 {
 433         struct iwm_fw_sects *fws;
 434         struct iwm_fw_desc *fwone;
 435
 436         if (type >= IWM_UCODE_TYPE_MAX)
 437                 return EINVAL;
 438         if (dlen < sizeof(uint32_t))
 439                 return EINVAL;
 440
 441         fws = &sc->sc_fw.fw_sects[type];
 442         if (fws->fw_count >= IWM_UCODE_SECTION_MAX)
 443                 return EINVAL;
 444
 445         fwone = &fws->fw_sect[fws->fw_count];
 446
 447         /* first 32bit are device load offset */
 448         memcpy(&fwone->offset, data, sizeof(uint32_t));
 449
 450         /* rest is data */
 451         fwone->data = data + sizeof(uint32_t);
 452         fwone->len = dlen - sizeof(uint32_t);
 453
 454         fws->fw_count++;
 455
 456         return 0;
 457 }
 458
 459 #define IWM_DEFAULT_SCAN_CHANNELS 40
 460
 461 /* iwlwifi: iwl-drv.c */
 462 struct iwm_tlv_calib_data {
 463         uint32_t ucode_type;
 464         struct iwm_tlv_calib_ctrl calib;
 465 } __packed;
 466
 467 static int
 468 iwm_set_default_calib(struct iwm_softc *sc, const void *data)
 469 {
 470         const struct iwm_tlv_calib_data *def_calib = data;
 471         uint32_t ucode_type = le32toh(def_calib->ucode_type);
 472
 473         if (ucode_type >= IWM_UCODE_TYPE_MAX) {
 474                 device_printf(sc->sc_dev,
 475                     "Wrong ucode_type %u for default "
 476                     "calibration.\n", ucode_type);
 477                 return EINVAL;
 478         }
 479
 480         sc->sc_default_calib[ucode_type].flow_trigger =
 481             def_calib->calib.flow_trigger;
 482         sc->sc_default_calib[ucode_type].event_trigger =
 483             def_calib->calib.event_trigger;
 484
 485         return 0;
 486 }
 487
 488 static int
 489 iwm_set_ucode_api_flags(struct iwm_softc *sc, const uint8_t *data,
 490                         struct iwm_ucode_capabilities *capa)
 491 {
 492         const struct iwm_ucode_api *ucode_api = (const void *)data;
 493         uint32_t api_index = le32toh(ucode_api->api_index);
 494         uint32_t api_flags = le32toh(ucode_api->api_flags);
 495         int i;
 496
 497         if (api_index >= howmany(IWM_NUM_UCODE_TLV_API, 32)) {
 498                 device_printf(sc->sc_dev,
 499                     "api flags index %d larger than supported by driver\n",
 500                     api_index);
 501                 /* don't return an error so we can load FW that has more bits */
 502                 return 0;
 503         }
 504
 505         for (i = 0; i < 32; i++) {
 506                 if (api_flags & (1U << i))
 507                         setbit(capa->enabled_api, i + 32 * api_index);
 508         }
 509
 510         return 0;
 511 }
 512
 513 static int
 514 iwm_set_ucode_capabilities(struct iwm_softc *sc, const uint8_t *data,
 515                            struct iwm_ucode_capabilities *capa)
 516 {
 517         const struct iwm_ucode_capa *ucode_capa = (const void *)data;
 518         uint32_t api_index = le32toh(ucode_capa->api_index);
 519         uint32_t api_flags = le32toh(ucode_capa->api_capa);
 520         int i;
 521
 522         if (api_index >= howmany(IWM_NUM_UCODE_TLV_CAPA, 32)) {
 523                 device_printf(sc->sc_dev,
 524                     "capa flags index %d larger than supported by driver\n",
 525                     api_index);
 526                 /* don't return an error so we can load FW that has more bits */
 527                 return 0;
 528         }
 529
 530         for (i = 0; i < 32; i++) {
 531                 if (api_flags & (1U << i))
 532                         setbit(capa->enabled_capa, i + 32 * api_index);
 533         }
 534
 535         return 0;
 536 }
 537
 538 static void
 539 iwm_fw_info_free(struct iwm_fw_info *fw)
 540 {
 541         firmware_put(fw->fw_fp, FIRMWARE_UNLOAD);
 542         fw->fw_fp = NULL;
 543         /* don't touch fw->fw_status */
 544         memset(fw->fw_sects, 0, sizeof(fw->fw_sects));
 545 }
 546
 547 static int
 548 iwm_read_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type)
 549 {
 550         struct iwm_fw_info *fw = &sc->sc_fw;
 551         const struct iwm_tlv_ucode_header *uhdr;
 552         struct iwm_ucode_tlv tlv;
 553         struct iwm_ucode_capabilities *capa = &sc->ucode_capa;
 554         enum iwm_ucode_tlv_type tlv_type;
 555         const struct firmware *fwp;
 556         const uint8_t *data;
 557         uint32_t usniffer_img;
 558         uint32_t paging_mem_size;
 559         int num_of_cpus;
 560         int error = 0;
 561         size_t len;
 562
 563         if (fw->fw_status == IWM_FW_STATUS_DONE &&
 564             ucode_type != IWM_UCODE_INIT)
 565                 return 0;
 566
 567         while (fw->fw_status == IWM_FW_STATUS_INPROGRESS)
 568                 msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfwp", 0);
 569         fw->fw_status = IWM_FW_STATUS_INPROGRESS;
 570
 571         if (fw->fw_fp != NULL)
 572                 iwm_fw_info_free(fw);
 573
 574         /*
 575          * Load firmware into driver memory.
 576          * fw_fp will be set.
 577          */
 578         IWM_UNLOCK(sc);
 579         fwp = firmware_get(sc->cfg->fw_name);
 580         IWM_LOCK(sc);
 581         if (fwp == NULL) {
 582                 device_printf(sc->sc_dev,
 583                     "could not read firmware %s (error %d)\n",
 584                     sc->cfg->fw_name, error);
 585                 goto out;
 586         }
 587         fw->fw_fp = fwp;
 588
 589         /* (Re-)Initialize default values. */
 590         capa->flags = 0;
 591         capa->max_probe_length = IWM_DEFAULT_MAX_PROBE_LENGTH;
 592         capa->n_scan_channels = IWM_DEFAULT_SCAN_CHANNELS;
 593         memset(capa->enabled_capa, 0, sizeof(capa->enabled_capa));
 594         memset(capa->enabled_api, 0, sizeof(capa->enabled_api));
 595         memset(sc->sc_fw_mcc, 0, sizeof(sc->sc_fw_mcc));
 596
 597         /*
 598          * Parse firmware contents
 599          */
 600
 601         uhdr = (const void *)fw->fw_fp->data;
 602         if (*(const uint32_t *)fw->fw_fp->data != 0
 603             || le32toh(uhdr->magic) != IWM_TLV_UCODE_MAGIC) {
 604                 device_printf(sc->sc_dev, "invalid firmware %s\n",
 605                     sc->cfg->fw_name);
 606                 error = EINVAL;
 607                 goto out;
 608         }
 609
 610         snprintf(sc->sc_fwver, sizeof(sc->sc_fwver), "%d.%d (API ver %d)",
 611             IWM_UCODE_MAJOR(le32toh(uhdr->ver)),
 612             IWM_UCODE_MINOR(le32toh(uhdr->ver)),
 613             IWM_UCODE_API(le32toh(uhdr->ver)));
 614         data = uhdr->data;
 615         len = fw->fw_fp->datasize - sizeof(*uhdr);
 616
 617         while (len >= sizeof(tlv)) {
 618                 size_t tlv_len;
 619                 const void *tlv_data;
 620
 621                 memcpy(&tlv, data, sizeof(tlv));
 622                 tlv_len = le32toh(tlv.length);
 623                 tlv_type = le32toh(tlv.type);
 624
 625                 len -= sizeof(tlv);
 626                 data += sizeof(tlv);
 627                 tlv_data = data;
 628
 629                 if (len < tlv_len) {
 630                         device_printf(sc->sc_dev,
 631                             "firmware too short: %zu bytes\n",
 632                             len);
 633                         error = EINVAL;
 634                         goto parse_out;
 635                 }
 636
 637                 switch ((int)tlv_type) {
 638                 case IWM_UCODE_TLV_PROBE_MAX_LEN:
 639                         if (tlv_len < sizeof(uint32_t)) {
 640                                 device_printf(sc->sc_dev,
 641                                     "%s: PROBE_MAX_LEN (%d) < sizeof(uint32_t)\n",
 642                                     __func__,
 643                                     (int) tlv_len);
 644                                 error = EINVAL;
 645                                 goto parse_out;
 646                         }
 647                         capa->max_probe_length =
 648                             le32toh(*(const uint32_t *)tlv_data);
 649                         /* limit it to something sensible */
 650                         if (capa->max_probe_length >
 651                             IWM_SCAN_OFFLOAD_PROBE_REQ_SIZE) {
 652                                 IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV,
 653                                     "%s: IWM_UCODE_TLV_PROBE_MAX_LEN "
 654                                     "ridiculous\n", __func__);
 655                                 error = EINVAL;
 656                                 goto parse_out;
 657                         }
 658                         break;
 659                 case IWM_UCODE_TLV_PAN:
 660                         if (tlv_len) {
 661                                 device_printf(sc->sc_dev,
 662                                     "%s: IWM_UCODE_TLV_PAN: tlv_len (%d) > 0\n",
 663                                     __func__,
 664                                     (int) tlv_len);
 665                                 error = EINVAL;
 666                                 goto parse_out;
 667                         }
 668                         capa->flags |= IWM_UCODE_TLV_FLAGS_PAN;
 669                         break;
 670                 case IWM_UCODE_TLV_FLAGS:
 671                         if (tlv_len < sizeof(uint32_t)) {
 672                                 device_printf(sc->sc_dev,
 673                                     "%s: IWM_UCODE_TLV_FLAGS: tlv_len (%d) < sizeof(uint32_t)\n",
 674                                     __func__,
 675                                     (int) tlv_len);
 676                                 error = EINVAL;
 677                                 goto parse_out;
 678                         }
 679                         /*
 680                          * Apparently there can be many flags, but Linux driver
 681                          * parses only the first one, and so do we.
 682                          *
 683                          * XXX: why does this override IWM_UCODE_TLV_PAN?
 684                          * Intentional or a bug?  Observations from
 685                          * current firmware file:
 686                          *  1) TLV_PAN is parsed first
 687                          *  2) TLV_FLAGS contains TLV_FLAGS_PAN
 688                          * ==> this resets TLV_PAN to itself... hnnnk
 689                          */
 690                         capa->flags = le32toh(*(const uint32_t *)tlv_data);
 691                         break;
 692                 case IWM_UCODE_TLV_CSCHEME:
 693                         if ((error = iwm_store_cscheme(sc,
 694                             tlv_data, tlv_len)) != 0) {
 695                                 device_printf(sc->sc_dev,
 696                                     "%s: iwm_store_cscheme(): returned %d\n",
 697                                     __func__,
 698                                     error);
 699                                 goto parse_out;
 700                         }
 701                         break;
 702                 case IWM_UCODE_TLV_NUM_OF_CPU:
 703                         if (tlv_len != sizeof(uint32_t)) {
 704                                 device_printf(sc->sc_dev,
 705                                     "%s: IWM_UCODE_TLV_NUM_OF_CPU: tlv_len (%d) != sizeof(uint32_t)\n",
 706                                     __func__,
 707                                     (int) tlv_len);
 708                                 error = EINVAL;
 709                                 goto parse_out;
 710                         }
 711                         num_of_cpus = le32toh(*(const uint32_t *)tlv_data);
 712                         if (num_of_cpus == 2) {
 713                                 fw->fw_sects[IWM_UCODE_REGULAR].is_dual_cpus =
 714                                         TRUE;
 715                                 fw->fw_sects[IWM_UCODE_INIT].is_dual_cpus =
 716                                         TRUE;
 717                                 fw->fw_sects[IWM_UCODE_WOWLAN].is_dual_cpus =
 718                                         TRUE;
 719                         } else if ((num_of_cpus > 2) || (num_of_cpus < 1)) {
 720                                 device_printf(sc->sc_dev,
 721                                     "%s: Driver supports only 1 or 2 CPUs\n",
 722                                     __func__);
 723                                 error = EINVAL;
 724                                 goto parse_out;
 725                         }
 726                         break;
 727                 case IWM_UCODE_TLV_SEC_RT:
 728                         if ((error = iwm_firmware_store_section(sc,
 729                             IWM_UCODE_REGULAR, tlv_data, tlv_len)) != 0) {
 730                                 device_printf(sc->sc_dev,
 731                                     "%s: IWM_UCODE_REGULAR: iwm_firmware_store_section() failed; %d\n",
 732                                     __func__,
 733                                     error);
 734                                 goto parse_out;
 735                         }
 736                         break;
 737                 case IWM_UCODE_TLV_SEC_INIT:
 738                         if ((error = iwm_firmware_store_section(sc,
 739                             IWM_UCODE_INIT, tlv_data, tlv_len)) != 0) {
 740                                 device_printf(sc->sc_dev,
 741                                     "%s: IWM_UCODE_INIT: iwm_firmware_store_section() failed; %d\n",
 742                                     __func__,
 743                                     error);
 744                                 goto parse_out;
 745                         }
 746                         break;
 747                 case IWM_UCODE_TLV_SEC_WOWLAN:
 748                         if ((error = iwm_firmware_store_section(sc,
 749                             IWM_UCODE_WOWLAN, tlv_data, tlv_len)) != 0) {
 750                                 device_printf(sc->sc_dev,
 751                                     "%s: IWM_UCODE_WOWLAN: iwm_firmware_store_section() failed; %d\n",
 752                                     __func__,
 753                                     error);
 754                                 goto parse_out;
 755                         }
 756                         break;
 757                 case IWM_UCODE_TLV_DEF_CALIB:
 758                         if (tlv_len != sizeof(struct iwm_tlv_calib_data)) {
 759                                 device_printf(sc->sc_dev,
 760                                     "%s: IWM_UCODE_TLV_DEV_CALIB: tlv_len (%d) < sizeof(iwm_tlv_calib_data) (%d)\n",
 761                                     __func__,
 762                                     (int) tlv_len,
 763                                     (int) sizeof(struct iwm_tlv_calib_data));
 764                                 error = EINVAL;
 765                                 goto parse_out;
 766                         }
 767                         if ((error = iwm_set_default_calib(sc, tlv_data)) != 0) {
 768                                 device_printf(sc->sc_dev,
 769                                     "%s: iwm_set_default_calib() failed: %d\n",
 770                                     __func__,
 771                                     error);
 772                                 goto parse_out;
 773                         }
 774                         break;
 775                 case IWM_UCODE_TLV_PHY_SKU:
 776                         if (tlv_len != sizeof(uint32_t)) {
 777                                 error = EINVAL;
 778                                 device_printf(sc->sc_dev,
 779                                     "%s: IWM_UCODE_TLV_PHY_SKU: tlv_len (%d) < sizeof(uint32_t)\n",
 780                                     __func__,
 781                                     (int) tlv_len);
 782                                 goto parse_out;
 783                         }
 784                         sc->sc_fw.phy_config =
 785                             le32toh(*(const uint32_t *)tlv_data);
 786                         sc->sc_fw.valid_tx_ant = (sc->sc_fw.phy_config &
 787                                                   IWM_FW_PHY_CFG_TX_CHAIN) >>
 788                                                   IWM_FW_PHY_CFG_TX_CHAIN_POS;
 789                         sc->sc_fw.valid_rx_ant = (sc->sc_fw.phy_config &
 790                                                   IWM_FW_PHY_CFG_RX_CHAIN) >>
 791                                                   IWM_FW_PHY_CFG_RX_CHAIN_POS;
 792                         break;
 793
 794                 case IWM_UCODE_TLV_API_CHANGES_SET: {
 795                         if (tlv_len != sizeof(struct iwm_ucode_api)) {
 796                                 error = EINVAL;
 797                                 goto parse_out;
 798                         }
 799                         if (iwm_set_ucode_api_flags(sc, tlv_data, capa)) {
 800                                 error = EINVAL;
 801                                 goto parse_out;
 802                         }
 803                         break;
 804                 }
 805
 806                 case IWM_UCODE_TLV_ENABLED_CAPABILITIES: {
 807                         if (tlv_len != sizeof(struct iwm_ucode_capa)) {
 808                                 error = EINVAL;
 809                                 goto parse_out;
 810                         }
 811                         if (iwm_set_ucode_capabilities(sc, tlv_data, capa)) {
 812                                 error = EINVAL;
 813                                 goto parse_out;
 814                         }
 815                         break;
 816                 }
 817
 818                 case 48: /* undocumented TLV */
 819                 case IWM_UCODE_TLV_SDIO_ADMA_ADDR:
 820                 case IWM_UCODE_TLV_FW_GSCAN_CAPA:
 821                         /* ignore, not used by current driver */
 822                         break;
 823
 824                 case IWM_UCODE_TLV_SEC_RT_USNIFFER:
 825                         if ((error = iwm_firmware_store_section(sc,
 826                             IWM_UCODE_REGULAR_USNIFFER, tlv_data,
 827                             tlv_len)) != 0)
 828                                 goto parse_out;
 829                         break;
 830
 831                 case IWM_UCODE_TLV_PAGING:
 832                         if (tlv_len != sizeof(uint32_t)) {
 833                                 error = EINVAL;
 834                                 goto parse_out;
 835                         }
 836                         paging_mem_size = le32toh(*(const uint32_t *)tlv_data);
 837
 838                         IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV,
 839                             "%s: Paging: paging enabled (size = %u bytes)\n",
 840                             __func__, paging_mem_size);
 841                         if (paging_mem_size > IWM_MAX_PAGING_IMAGE_SIZE) {
 842                                 device_printf(sc->sc_dev,
 843                                         "%s: Paging: driver supports up to %u bytes for paging image\n",
 844                                         __func__, IWM_MAX_PAGING_IMAGE_SIZE);
 845                                 error = EINVAL;
 846                                 goto out;
 847                         }
 848                         if (paging_mem_size & (IWM_FW_PAGING_SIZE - 1)) {
 849                                 device_printf(sc->sc_dev,
 850                                     "%s: Paging: image isn't multiple %u\n",
 851                                     __func__, IWM_FW_PAGING_SIZE);
 852                                 error = EINVAL;
 853                                 goto out;
 854                         }
 855
 856                         sc->sc_fw.fw_sects[IWM_UCODE_REGULAR].paging_mem_size =
 857                             paging_mem_size;
 858                         usniffer_img = IWM_UCODE_REGULAR_USNIFFER;
 859                         sc->sc_fw.fw_sects[usniffer_img].paging_mem_size =
 860                             paging_mem_size;
 861                         break;
 862
 863                 case IWM_UCODE_TLV_N_SCAN_CHANNELS:
 864                         if (tlv_len != sizeof(uint32_t)) {
 865                                 error = EINVAL;
 866                                 goto parse_out;
 867                         }
 868                         capa->n_scan_channels =
 869                             le32toh(*(const uint32_t *)tlv_data);
 870                         break;
 871
 872                 case IWM_UCODE_TLV_FW_VERSION:
 873                         if (tlv_len != sizeof(uint32_t) * 3) {
 874                                 error = EINVAL;
 875                                 goto parse_out;
 876                         }
 877                         snprintf(sc->sc_fwver, sizeof(sc->sc_fwver),
 878                             "%d.%d.%d",
 879                             le32toh(((const uint32_t *)tlv_data)[0]),
 880                             le32toh(((const uint32_t *)tlv_data)[1]),
 881                             le32toh(((const uint32_t *)tlv_data)[2]));
 882                         break;
 883
 884                 case IWM_UCODE_TLV_FW_MEM_SEG:
 885                         break;
 886
 887                 default:
 888                         device_printf(sc->sc_dev,
 889                             "%s: unknown firmware section %d, abort\n",
 890                             __func__, tlv_type);
 891                         error = EINVAL;
 892                         goto parse_out;
 893                 }
 894
 895                 len -= roundup(tlv_len, 4);
 896                 data += roundup(tlv_len, 4);
 897         }
 898
 899         KASSERT(error == 0, ("unhandled error"));
 900
 901  parse_out:
 902         if (error) {
 903                 device_printf(sc->sc_dev, "firmware parse error %d, "
 904                     "section type %d\n", error, tlv_type);
 905         }
 906
 907  out:
 908         if (error) {
 909                 fw->fw_status = IWM_FW_STATUS_NONE;
 910                 if (fw->fw_fp != NULL)
 911                         iwm_fw_info_free(fw);
 912         } else
 913                 fw->fw_status = IWM_FW_STATUS_DONE;
 914         wakeup(&sc->sc_fw);
 915
 916         return error;
 917 }
 918
 919 /*
 920  * DMA resource routines
 921  */
 922
 923 /* fwmem is used to load firmware onto the card */
 924 static int
 925 iwm_alloc_fwmem(struct iwm_softc *sc)
 926 {
 927         /* Must be aligned on a 16-byte boundary. */
 928         return iwm_dma_contig_alloc(sc->sc_dmat, &sc->fw_dma,
 929             IWM_FH_MEM_TB_MAX_LENGTH, 16);
 930 }
 931
 932 /* tx scheduler rings.  not used? */
 933 static int
 934 iwm_alloc_sched(struct iwm_softc *sc)
 935 {
 936         /* TX scheduler rings must be aligned on a 1KB boundary. */
 937         return iwm_dma_contig_alloc(sc->sc_dmat, &sc->sched_dma,
 938             nitems(sc->txq) * sizeof(struct iwm_agn_scd_bc_tbl), 1024);
 939 }
 940
 941 /* keep-warm page is used internally by the card.  see iwl-fh.h for more info */
 942 static int
 943 iwm_alloc_kw(struct iwm_softc *sc)
 944 {
 945         return iwm_dma_contig_alloc(sc->sc_dmat, &sc->kw_dma, 4096, 4096);
 946 }
 947
 948 /* interrupt cause table */
 949 static int
 950 iwm_alloc_ict(struct iwm_softc *sc)
 951 {
 952         return iwm_dma_contig_alloc(sc->sc_dmat, &sc->ict_dma,
 953             IWM_ICT_SIZE, 1<<IWM_ICT_PADDR_SHIFT);
 954 }
 955
 956 static int
 957 iwm_alloc_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
 958 {
 959         bus_size_t size;
 960         int i, error;
 961
 962         ring->cur = 0;
 963
 964         /* Allocate RX descriptors (256-byte aligned). */
 965         size = IWM_RX_RING_COUNT * sizeof(uint32_t);
 966         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256);
 967         if (error != 0) {
 968                 device_printf(sc->sc_dev,
 969                     "could not allocate RX ring DMA memory\n");
 970                 goto fail;
 971         }
 972         ring->desc = ring->desc_dma.vaddr;
 973
 974         /* Allocate RX status area (16-byte aligned). */
 975         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->stat_dma,
 976             sizeof(*ring->stat), 16);
 977         if (error != 0) {
 978                 device_printf(sc->sc_dev,
 979                     "could not allocate RX status DMA memory\n");
 980                 goto fail;
 981         }
 982         ring->stat = ring->stat_dma.vaddr;
 983
 984         /* Create RX buffer DMA tag. */
 985         error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
 986             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
 987             IWM_RBUF_SIZE, 1, IWM_RBUF_SIZE, 0, NULL, NULL, &ring->data_dmat);
 988         if (error != 0) {
 989                 device_printf(sc->sc_dev,
 990                     "%s: could not create RX buf DMA tag, error %d\n",
 991                     __func__, error);
 992                 goto fail;
 993         }
 994
 995         /* Allocate spare bus_dmamap_t for iwm_rx_addbuf() */
 996         error = bus_dmamap_create(ring->data_dmat, 0, &ring->spare_map);
 997         if (error != 0) {
 998                 device_printf(sc->sc_dev,
 999                     "%s: could not create RX buf DMA map, error %d\n",
1000                     __func__, error);
1001                 goto fail;
1002         }
1003         /*
1004          * Allocate and map RX buffers.
1005          */
1006         for (i = 0; i < IWM_RX_RING_COUNT; i++) {
1007                 struct iwm_rx_data *data = &ring->data[i];
1008                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
1009                 if (error != 0) {
1010                         device_printf(sc->sc_dev,
1011                             "%s: could not create RX buf DMA map, error %d\n",
1012                             __func__, error);
1013                         goto fail;
1014                 }
1015                 data->m = NULL;
1016
1017                 if ((error = iwm_rx_addbuf(sc, IWM_RBUF_SIZE, i)) != 0) {
1018                         goto fail;
1019                 }
1020         }
1021         return 0;
1022
1023 fail:   iwm_free_rx_ring(sc, ring);
1024         return error;
1025 }
1026
1027 static void
1028 iwm_reset_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
1029 {
1030         /* Reset the ring state */
1031         ring->cur = 0;
1032
1033         /*
1034          * The hw rx ring index in shared memory must also be cleared,
1035          * otherwise the discrepancy can cause reprocessing chaos.
1036          */
1037         memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat));
1038 }
1039
1040 static void
1041 iwm_free_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
1042 {
1043         int i;
1044
1045         iwm_dma_contig_free(&ring->desc_dma);
1046         iwm_dma_contig_free(&ring->stat_dma);
1047
1048         for (i = 0; i < IWM_RX_RING_COUNT; i++) {
1049                 struct iwm_rx_data *data = &ring->data[i];
1050
1051                 if (data->m != NULL) {
1052                         bus_dmamap_sync(ring->data_dmat, data->map,
1053                             BUS_DMASYNC_POSTREAD);
1054                         bus_dmamap_unload(ring->data_dmat, data->map);
1055                         m_freem(data->m);
1056                         data->m = NULL;
1057                 }
1058                 if (data->map != NULL) {
1059                         bus_dmamap_destroy(ring->data_dmat, data->map);
1060                         data->map = NULL;
1061                 }
1062         }
1063         if (ring->spare_map != NULL) {
1064                 bus_dmamap_destroy(ring->data_dmat, ring->spare_map);
1065                 ring->spare_map = NULL;
1066         }
1067         if (ring->data_dmat != NULL) {
1068                 bus_dma_tag_destroy(ring->data_dmat);
1069                 ring->data_dmat = NULL;
1070         }
1071 }
1072
1073 static int
1074 iwm_alloc_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring, int qid)
1075 {
1076         bus_addr_t paddr;
1077         bus_size_t size;
1078         size_t maxsize;
1079         int nsegments;
1080         int i, error;
1081
1082         ring->qid = qid;
1083         ring->queued = 0;
1084         ring->cur = 0;
1085
1086         /* Allocate TX descriptors (256-byte aligned). */
1087         size = IWM_TX_RING_COUNT * sizeof (struct iwm_tfd);
1088         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256);
1089         if (error != 0) {
1090                 device_printf(sc->sc_dev,
1091                     "could not allocate TX ring DMA memory\n");
1092                 goto fail;
1093         }
1094         ring->desc = ring->desc_dma.vaddr;
1095
1096         /*
1097          * We only use rings 0 through 9 (4 EDCA + cmd) so there is no need
1098          * to allocate commands space for other rings.
1099          */
1100         if (qid > IWM_MVM_CMD_QUEUE)
1101                 return 0;
1102
1103         size = IWM_TX_RING_COUNT * sizeof(struct iwm_device_cmd);
1104         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->cmd_dma, size, 4);
1105         if (error != 0) {
1106                 device_printf(sc->sc_dev,
1107                     "could not allocate TX cmd DMA memory\n");
1108                 goto fail;
1109         }
1110         ring->cmd = ring->cmd_dma.vaddr;
1111
1112         /* FW commands may require more mapped space than packets. */
1113         if (qid == IWM_MVM_CMD_QUEUE) {
1114                 maxsize = IWM_RBUF_SIZE;
1115                 nsegments = 1;
1116         } else {
1117                 maxsize = MCLBYTES;
1118                 nsegments = IWM_MAX_SCATTER - 2;
1119         }
1120
1121         error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
1122             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, maxsize,
1123             nsegments, maxsize, 0, NULL, NULL, &ring->data_dmat);
1124         if (error != 0) {
1125                 device_printf(sc->sc_dev, "could not create TX buf DMA tag\n");
1126                 goto fail;
1127         }
1128
1129         paddr = ring->cmd_dma.paddr;
1130         for (i = 0; i < IWM_TX_RING_COUNT; i++) {
1131                 struct iwm_tx_data *data = &ring->data[i];
1132
1133                 data->cmd_paddr = paddr;
1134                 data->scratch_paddr = paddr + sizeof(struct iwm_cmd_header)
1135                     + offsetof(struct iwm_tx_cmd, scratch);
1136                 paddr += sizeof(struct iwm_device_cmd);
1137
1138                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
1139                 if (error != 0) {
1140                         device_printf(sc->sc_dev,
1141                             "could not create TX buf DMA map\n");
1142                         goto fail;
1143                 }
1144         }
1145         KASSERT(paddr == ring->cmd_dma.paddr + size,
1146             ("invalid physical address"));
1147         return 0;
1148
1149 fail:   iwm_free_tx_ring(sc, ring);
1150         return error;
1151 }
1152
1153 static void
1154 iwm_reset_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring)
1155 {
1156         int i;
1157
1158         for (i = 0; i < IWM_TX_RING_COUNT; i++) {
1159                 struct iwm_tx_data *data = &ring->data[i];
1160
1161                 if (data->m != NULL) {
1162                         bus_dmamap_sync(ring->data_dmat, data->map,
1163                             BUS_DMASYNC_POSTWRITE);
1164                         bus_dmamap_unload(ring->data_dmat, data->map);
1165                         m_freem(data->m);
1166                         data->m = NULL;
1167                 }
1168         }
1169         /* Clear TX descriptors. */
1170         memset(ring->desc, 0, ring->desc_dma.size);
1171         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
1172             BUS_DMASYNC_PREWRITE);
1173         sc->qfullmsk &= ~(1 << ring->qid);
1174         ring->queued = 0;
1175         ring->cur = 0;
1176
1177         if (ring->qid == IWM_MVM_CMD_QUEUE && sc->cmd_hold_nic_awake)
1178                 iwm_pcie_clear_cmd_in_flight(sc);
1179 }
1180
1181 static void
1182 iwm_free_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring)
1183 {
1184         int i;
1185
1186         iwm_dma_contig_free(&ring->desc_dma);
1187         iwm_dma_contig_free(&ring->cmd_dma);
1188
1189         for (i = 0; i < IWM_TX_RING_COUNT; i++) {
1190                 struct iwm_tx_data *data = &ring->data[i];
1191
1192                 if (data->m != NULL) {
1193                         bus_dmamap_sync(ring->data_dmat, data->map,
1194                             BUS_DMASYNC_POSTWRITE);
1195                         bus_dmamap_unload(ring->data_dmat, data->map);
1196                         m_freem(data->m);
1197                         data->m = NULL;
1198                 }
1199                 if (data->map != NULL) {
1200                         bus_dmamap_destroy(ring->data_dmat, data->map);
1201                         data->map = NULL;
1202                 }
1203         }
1204         if (ring->data_dmat != NULL) {
1205                 bus_dma_tag_destroy(ring->data_dmat);
1206                 ring->data_dmat = NULL;
1207         }
1208 }
1209
1210 /*
1211  * High-level hardware frobbing routines
1212  */
1213
1214 static void
1215 iwm_enable_interrupts(struct iwm_softc *sc)
1216 {
1217         sc->sc_intmask = IWM_CSR_INI_SET_MASK;
1218         IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask);
1219 }
1220
1221 static void
1222 iwm_restore_interrupts(struct iwm_softc *sc)
1223 {
1224         IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask);
1225 }
1226
1227 static void
1228 iwm_disable_interrupts(struct iwm_softc *sc)
1229 {
1230         /* disable interrupts */
1231         IWM_WRITE(sc, IWM_CSR_INT_MASK, 0);
1232
1233         /* acknowledge all interrupts */
1234         IWM_WRITE(sc, IWM_CSR_INT, ~0);
1235         IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, ~0);
1236 }
1237
1238 static void
1239 iwm_ict_reset(struct iwm_softc *sc)
1240 {
1241         iwm_disable_interrupts(sc);
1242
1243         /* Reset ICT table. */
1244         memset(sc->ict_dma.vaddr, 0, IWM_ICT_SIZE);
1245         sc->ict_cur = 0;
1246
1247         /* Set physical address of ICT table (4KB aligned). */
1248         IWM_WRITE(sc, IWM_CSR_DRAM_INT_TBL_REG,
1249             IWM_CSR_DRAM_INT_TBL_ENABLE
1250             | IWM_CSR_DRAM_INIT_TBL_WRITE_POINTER
1251             | IWM_CSR_DRAM_INIT_TBL_WRAP_CHECK
1252             | sc->ict_dma.paddr >> IWM_ICT_PADDR_SHIFT);
1253
1254         /* Switch to ICT interrupt mode in driver. */
1255         sc->sc_flags |= IWM_FLAG_USE_ICT;
1256
1257         /* Re-enable interrupts. */
1258         IWM_WRITE(sc, IWM_CSR_INT, ~0);
1259         iwm_enable_interrupts(sc);
1260 }
1261
1262 /* iwlwifi pcie/trans.c */
1263
1264 /*
1265  * Since this .. hard-resets things, it's time to actually
1266  * mark the first vap (if any) as having no mac context.
1267  * It's annoying, but since the driver is potentially being
1268  * stop/start'ed whilst active (thanks openbsd port!) we
1269  * have to correctly track this.
1270  */
1271 static void
1272 iwm_stop_device(struct iwm_softc *sc)
1273 {
1274         struct ieee80211com *ic = &sc->sc_ic;
1275         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1276         int chnl, qid;
1277         uint32_t mask = 0;
1278
1279         /* tell the device to stop sending interrupts */
1280         iwm_disable_interrupts(sc);
1281
1282         /*
1283          * FreeBSD-local: mark the first vap as not-uploaded,
1284          * so the next transition through auth/assoc
1285          * will correctly populate the MAC context.
1286          */
1287         if (vap) {
1288                 struct iwm_vap *iv = IWM_VAP(vap);
1289                 iv->is_uploaded = 0;
1290         }
1291
1292         /* device going down, Stop using ICT table */
1293         sc->sc_flags &= ~IWM_FLAG_USE_ICT;
1294
1295         /* stop tx and rx.  tx and rx bits, as usual, are from if_iwn */
1296
1297         if (iwm_nic_lock(sc)) {
1298                 iwm_write_prph(sc, IWM_SCD_TXFACT, 0);
1299
1300                 /* Stop each Tx DMA channel */
1301                 for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) {
1302                         IWM_WRITE(sc,
1303                             IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl), 0);
1304                         mask |= IWM_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(chnl);
1305                 }
1306
1307                 /* Wait for DMA channels to be idle */
1308                 if (!iwm_poll_bit(sc, IWM_FH_TSSR_TX_STATUS_REG, mask, mask,
1309                     5000)) {
1310                         device_printf(sc->sc_dev,
1311                             "Failing on timeout while stopping DMA channel: [0x%08x]\n",
1312                             IWM_READ(sc, IWM_FH_TSSR_TX_STATUS_REG));
1313                 }
1314                 iwm_nic_unlock(sc);
1315         }
1316         iwm_pcie_rx_stop(sc);
1317
1318         /* Stop RX ring. */
1319         iwm_reset_rx_ring(sc, &sc->rxq);
1320
1321         /* Reset all TX rings. */
1322         for (qid = 0; qid < nitems(sc->txq); qid++)
1323                 iwm_reset_tx_ring(sc, &sc->txq[qid]);
1324
1325         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000) {
1326                 /* Power-down device's busmaster DMA clocks */
1327                 if (iwm_nic_lock(sc)) {
1328                         iwm_write_prph(sc, IWM_APMG_CLK_DIS_REG,
1329                             IWM_APMG_CLK_VAL_DMA_CLK_RQT);
1330                         iwm_nic_unlock(sc);
1331                 }
1332                 DELAY(5);
1333         }
1334
1335         /* Make sure (redundant) we've released our request to stay awake */
1336         IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL,
1337             IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
1338
1339         /* Stop the device, and put it in low power state */
1340         iwm_apm_stop(sc);
1341
1342         /* Upon stop, the APM issues an interrupt if HW RF kill is set.
1343          * Clean again the interrupt here
1344          */
1345         iwm_disable_interrupts(sc);
1346         /* stop and reset the on-board processor */
1347         IWM_WRITE(sc, IWM_CSR_RESET, IWM_CSR_RESET_REG_FLAG_SW_RESET);
1348
1349         /*
1350          * Even if we stop the HW, we still want the RF kill
1351          * interrupt
1352          */
1353         iwm_enable_rfkill_int(sc);
1354         iwm_check_rfkill(sc);
1355 }
1356
1357 /* iwlwifi: mvm/ops.c */
1358 static void
1359 iwm_mvm_nic_config(struct iwm_softc *sc)
1360 {
1361         uint8_t radio_cfg_type, radio_cfg_step, radio_cfg_dash;
1362         uint32_t reg_val = 0;
1363         uint32_t phy_config = iwm_mvm_get_phy_config(sc);
1364
1365         radio_cfg_type = (phy_config & IWM_FW_PHY_CFG_RADIO_TYPE) >>
1366             IWM_FW_PHY_CFG_RADIO_TYPE_POS;
1367         radio_cfg_step = (phy_config & IWM_FW_PHY_CFG_RADIO_STEP) >>
1368             IWM_FW_PHY_CFG_RADIO_STEP_POS;
1369         radio_cfg_dash = (phy_config & IWM_FW_PHY_CFG_RADIO_DASH) >>
1370             IWM_FW_PHY_CFG_RADIO_DASH_POS;
1371
1372         /* SKU control */
1373         reg_val |= IWM_CSR_HW_REV_STEP(sc->sc_hw_rev) <<
1374             IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_STEP;
1375         reg_val |= IWM_CSR_HW_REV_DASH(sc->sc_hw_rev) <<
1376             IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_DASH;
1377
1378         /* radio configuration */
1379         reg_val |= radio_cfg_type << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_TYPE;
1380         reg_val |= radio_cfg_step << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_STEP;
1381         reg_val |= radio_cfg_dash << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_DASH;
1382
1383         IWM_WRITE(sc, IWM_CSR_HW_IF_CONFIG_REG, reg_val);
1384
1385         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1386             "Radio type=0x%x-0x%x-0x%x\n", radio_cfg_type,
1387             radio_cfg_step, radio_cfg_dash);
1388
1389         /*
1390          * W/A : NIC is stuck in a reset state after Early PCIe power off
1391          * (PCIe power is lost before PERST# is asserted), causing ME FW
1392          * to lose ownership and not being able to obtain it back.
1393          */
1394         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000) {
1395                 iwm_set_bits_mask_prph(sc, IWM_APMG_PS_CTRL_REG,
1396                     IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS,
1397                     ~IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS);
1398         }
1399 }
1400
1401 static int
1402 iwm_nic_rx_init(struct iwm_softc *sc)
1403 {
1404         /*
1405          * Initialize RX ring.  This is from the iwn driver.
1406          */
1407         memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat));
1408
1409         /* Stop Rx DMA */
1410         iwm_pcie_rx_stop(sc);
1411
1412         if (!iwm_nic_lock(sc))
1413                 return EBUSY;
1414
1415         /* reset and flush pointers */
1416         IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_RBDCB_WPTR, 0);
1417         IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_FLUSH_RB_REQ, 0);
1418         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RDPTR, 0);
1419         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
1420
1421         /* Set physical address of RX ring (256-byte aligned). */
1422         IWM_WRITE(sc,
1423             IWM_FH_RSCSR_CHNL0_RBDCB_BASE_REG, sc->rxq.desc_dma.paddr >> 8);
1424
1425         /* Set physical address of RX status (16-byte aligned). */
1426         IWM_WRITE(sc,
1427             IWM_FH_RSCSR_CHNL0_STTS_WPTR_REG, sc->rxq.stat_dma.paddr >> 4);
1428
1429         /* Enable RX. */
1430         IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG,
1431             IWM_FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL            |
1432             IWM_FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY               |  /* HW bug */
1433             IWM_FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL   |
1434             IWM_FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK        |
1435             (IWM_RX_RB_TIMEOUT << IWM_FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS) |
1436             IWM_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K            |
1437             IWM_RX_QUEUE_SIZE_LOG << IWM_FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS);
1438
1439         IWM_WRITE_1(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_TIMEOUT_DEF);
1440
1441         /* W/A for interrupt coalescing bug in 7260 and 3160 */
1442         if (sc->cfg->host_interrupt_operation_mode)
1443                 IWM_SETBITS(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_OPER_MODE);
1444
1445         /*
1446          * Thus sayeth el jefe (iwlwifi) via a comment:
1447          *
1448          * This value should initially be 0 (before preparing any
1449          * RBs), should be 8 after preparing the first 8 RBs (for example)
1450          */
1451         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, 8);
1452
1453         iwm_nic_unlock(sc);
1454
1455         return 0;
1456 }
1457
1458 static int
1459 iwm_nic_tx_init(struct iwm_softc *sc)
1460 {
1461         int qid;
1462
1463         if (!iwm_nic_lock(sc))
1464                 return EBUSY;
1465
1466         /* Deactivate TX scheduler. */
1467         iwm_write_prph(sc, IWM_SCD_TXFACT, 0);
1468
1469         /* Set physical address of "keep warm" page (16-byte aligned). */
1470         IWM_WRITE(sc, IWM_FH_KW_MEM_ADDR_REG, sc->kw_dma.paddr >> 4);
1471
1472         /* Initialize TX rings. */
1473         for (qid = 0; qid < nitems(sc->txq); qid++) {
1474                 struct iwm_tx_ring *txq = &sc->txq[qid];
1475
1476                 /* Set physical address of TX ring (256-byte aligned). */
1477                 IWM_WRITE(sc, IWM_FH_MEM_CBBC_QUEUE(qid),
1478                     txq->desc_dma.paddr >> 8);
1479                 IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
1480                     "%s: loading ring %d descriptors (%p) at %lx\n",
1481                     __func__,
1482                     qid, txq->desc,
1483                     (unsigned long) (txq->desc_dma.paddr >> 8));
1484         }
1485
1486         iwm_write_prph(sc, IWM_SCD_GP_CTRL, IWM_SCD_GP_CTRL_AUTO_ACTIVE_MODE);
1487
1488         iwm_nic_unlock(sc);
1489
1490         return 0;
1491 }
1492
1493 static int
1494 iwm_nic_init(struct iwm_softc *sc)
1495 {
1496         int error;
1497
1498         iwm_apm_init(sc);
1499         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000)
1500                 iwm_set_pwr(sc);
1501
1502         iwm_mvm_nic_config(sc);
1503
1504         if ((error = iwm_nic_rx_init(sc)) != 0)
1505                 return error;
1506
1507         /*
1508          * Ditto for TX, from iwn
1509          */
1510         if ((error = iwm_nic_tx_init(sc)) != 0)
1511                 return error;
1512
1513         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1514             "%s: shadow registers enabled\n", __func__);
1515         IWM_SETBITS(sc, IWM_CSR_MAC_SHADOW_REG_CTRL, 0x800fffff);
1516
1517         return 0;
1518 }
1519
1520 const uint8_t iwm_mvm_ac_to_tx_fifo[] = {
1521         IWM_MVM_TX_FIFO_VO,
1522         IWM_MVM_TX_FIFO_VI,
1523         IWM_MVM_TX_FIFO_BE,
1524         IWM_MVM_TX_FIFO_BK,
1525 };
1526
1527 static int
1528 iwm_enable_txq(struct iwm_softc *sc, int sta_id, int qid, int fifo)
1529 {
1530         if (!iwm_nic_lock(sc)) {
1531                 device_printf(sc->sc_dev,
1532                     "%s: cannot enable txq %d\n",
1533                     __func__,
1534                     qid);
1535                 return EBUSY;
1536         }
1537
1538         IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, qid << 8 | 0);
1539
1540         if (qid == IWM_MVM_CMD_QUEUE) {
1541                 /* unactivate before configuration */
1542                 iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid),
1543                     (0 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE)
1544                     | (1 << IWM_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
1545
1546                 iwm_nic_unlock(sc);
1547
1548                 iwm_clear_bits_prph(sc, IWM_SCD_AGGR_SEL, (1 << qid));
1549
1550                 if (!iwm_nic_lock(sc)) {
1551                         device_printf(sc->sc_dev,
1552                             "%s: cannot enable txq %d\n", __func__, qid);
1553                         return EBUSY;
1554                 }
1555                 iwm_write_prph(sc, IWM_SCD_QUEUE_RDPTR(qid), 0);
1556                 iwm_nic_unlock(sc);
1557
1558                 iwm_write_mem32(sc, sc->scd_base_addr + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid), 0);
1559                 /* Set scheduler window size and frame limit. */
1560                 iwm_write_mem32(sc,
1561                     sc->scd_base_addr + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid) +
1562                     sizeof(uint32_t),
1563                     ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
1564                     IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
1565                     ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
1566                     IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
1567
1568                 if (!iwm_nic_lock(sc)) {
1569                         device_printf(sc->sc_dev,
1570                             "%s: cannot enable txq %d\n", __func__, qid);
1571                         return EBUSY;
1572                 }
1573                 iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid),
1574                     (1 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
1575                     (fifo << IWM_SCD_QUEUE_STTS_REG_POS_TXF) |
1576                     (1 << IWM_SCD_QUEUE_STTS_REG_POS_WSL) |
1577                     IWM_SCD_QUEUE_STTS_REG_MSK);
1578         } else {
1579                 struct iwm_scd_txq_cfg_cmd cmd;
1580                 int error;
1581
1582                 iwm_nic_unlock(sc);
1583
1584                 memset(&cmd, 0, sizeof(cmd));
1585                 cmd.scd_queue = qid;
1586                 cmd.enable = 1;
1587                 cmd.sta_id = sta_id;
1588                 cmd.tx_fifo = fifo;
1589                 cmd.aggregate = 0;
1590                 cmd.window = IWM_FRAME_LIMIT;
1591
1592                 error = iwm_mvm_send_cmd_pdu(sc, IWM_SCD_QUEUE_CFG, IWM_CMD_SYNC,
1593                     sizeof(cmd), &cmd);
1594                 if (error) {
1595                         device_printf(sc->sc_dev,
1596                             "cannot enable txq %d\n", qid);
1597                         return error;
1598                 }
1599
1600                 if (!iwm_nic_lock(sc))
1601                         return EBUSY;
1602         }
1603
1604         iwm_write_prph(sc, IWM_SCD_EN_CTRL,
1605             iwm_read_prph(sc, IWM_SCD_EN_CTRL) | qid);
1606
1607         iwm_nic_unlock(sc);
1608
1609         IWM_DPRINTF(sc, IWM_DEBUG_XMIT, "%s: enabled txq %d FIFO %d\n",
1610             __func__, qid, fifo);
1611
1612         return 0;
1613 }
1614
1615 static int
1616 iwm_trans_pcie_fw_alive(struct iwm_softc *sc, uint32_t scd_base_addr)
1617 {
1618         int error, chnl;
1619
1620         int clear_dwords = (IWM_SCD_TRANS_TBL_MEM_UPPER_BOUND -
1621             IWM_SCD_CONTEXT_MEM_LOWER_BOUND) / sizeof(uint32_t);
1622
1623         if (!iwm_nic_lock(sc))
1624                 return EBUSY;
1625
1626         iwm_ict_reset(sc);
1627
1628         sc->scd_base_addr = iwm_read_prph(sc, IWM_SCD_SRAM_BASE_ADDR);
1629         if (scd_base_addr != 0 &&
1630             scd_base_addr != sc->scd_base_addr) {
1631                 device_printf(sc->sc_dev,
1632                     "%s: sched addr mismatch: alive: 0x%x prph: 0x%x\n",
1633                     __func__, sc->scd_base_addr, scd_base_addr);
1634         }
1635
1636         iwm_nic_unlock(sc);
1637
1638         /* reset context data, TX status and translation data */
1639         error = iwm_write_mem(sc,
1640             sc->scd_base_addr + IWM_SCD_CONTEXT_MEM_LOWER_BOUND,
1641             NULL, clear_dwords);
1642         if (error)
1643                 return EBUSY;
1644
1645         if (!iwm_nic_lock(sc))
1646                 return EBUSY;
1647
1648         /* Set physical address of TX scheduler rings (1KB aligned). */
1649         iwm_write_prph(sc, IWM_SCD_DRAM_BASE_ADDR, sc->sched_dma.paddr >> 10);
1650
1651         iwm_write_prph(sc, IWM_SCD_CHAINEXT_EN, 0);
1652
1653         iwm_nic_unlock(sc);
1654
1655         /* enable command channel */
1656         error = iwm_enable_txq(sc, 0 /* unused */, IWM_MVM_CMD_QUEUE, 7);
1657         if (error)
1658                 return error;
1659
1660         if (!iwm_nic_lock(sc))
1661                 return EBUSY;
1662
1663         iwm_write_prph(sc, IWM_SCD_TXFACT, 0xff);
1664
1665         /* Enable DMA channels. */
1666         for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) {
1667                 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl),
1668                     IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
1669                     IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
1670         }
1671
1672         IWM_SETBITS(sc, IWM_FH_TX_CHICKEN_BITS_REG,
1673             IWM_FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
1674
1675         iwm_nic_unlock(sc);
1676
1677         /* Enable L1-Active */
1678         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000) {
1679                 iwm_clear_bits_prph(sc, IWM_APMG_PCIDEV_STT_REG,
1680                     IWM_APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
1681         }
1682
1683         return error;
1684 }
1685
1686 /*
1687  * NVM read access and content parsing.  We do not support
1688  * external NVM or writing NVM.
1689  * iwlwifi/mvm/nvm.c
1690  */
1691
1692 /* Default NVM size to read */
1693 #define IWM_NVM_DEFAULT_CHUNK_SIZE      (2*1024)
1694
1695 #define IWM_NVM_WRITE_OPCODE 1
1696 #define IWM_NVM_READ_OPCODE 0
1697
1698 /* load nvm chunk response */
1699 enum {
1700         IWM_READ_NVM_CHUNK_SUCCEED = 0,
1701         IWM_READ_NVM_CHUNK_NOT_VALID_ADDRESS = 1
1702 };
1703
1704 static int
1705 iwm_nvm_read_chunk(struct iwm_softc *sc, uint16_t section,
1706         uint16_t offset, uint16_t length, uint8_t *data, uint16_t *len)
1707 {
1708         struct iwm_nvm_access_cmd nvm_access_cmd = {
1709                 .offset = htole16(offset),
1710                 .length = htole16(length),
1711                 .type = htole16(section),
1712                 .op_code = IWM_NVM_READ_OPCODE,
1713         };
1714         struct iwm_nvm_access_resp *nvm_resp;
1715         struct iwm_rx_packet *pkt;
1716         struct iwm_host_cmd cmd = {
1717                 .id = IWM_NVM_ACCESS_CMD,
1718                 .flags = IWM_CMD_WANT_SKB | IWM_CMD_SEND_IN_RFKILL,
1719                 .data = { &nvm_access_cmd, },
1720         };
1721         int ret, bytes_read, offset_read;
1722         uint8_t *resp_data;
1723
1724         cmd.len[0] = sizeof(struct iwm_nvm_access_cmd);
1725
1726         ret = iwm_send_cmd(sc, &cmd);
1727         if (ret) {
1728                 device_printf(sc->sc_dev,
1729                     "Could not send NVM_ACCESS command (error=%d)\n", ret);
1730                 return ret;
1731         }
1732
1733         pkt = cmd.resp_pkt;
1734
1735         /* Extract NVM response */
1736         nvm_resp = (void *)pkt->data;
1737         ret = le16toh(nvm_resp->status);
1738         bytes_read = le16toh(nvm_resp->length);
1739         offset_read = le16toh(nvm_resp->offset);
1740         resp_data = nvm_resp->data;
1741         if (ret) {
1742                 if ((offset != 0) &&
1743                     (ret == IWM_READ_NVM_CHUNK_NOT_VALID_ADDRESS)) {
1744                         /*
1745                          * meaning of NOT_VALID_ADDRESS:
1746                          * driver try to read chunk from address that is
1747                          * multiple of 2K and got an error since addr is empty.
1748                          * meaning of (offset != 0): driver already
1749                          * read valid data from another chunk so this case
1750                          * is not an error.
1751                          */
1752                         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM | IWM_DEBUG_RESET,
1753                                     "NVM access command failed on offset 0x%x since that section size is multiple 2K\n",
1754                                     offset);
1755                         *len = 0;
1756                         ret = 0;
1757                 } else {
1758                         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM | IWM_DEBUG_RESET,
1759                                     "NVM access command failed with status %d\n", ret);
1760                         ret = EIO;
1761                 }
1762                 goto exit;
1763         }
1764
1765         if (offset_read != offset) {
1766                 device_printf(sc->sc_dev,
1767                     "NVM ACCESS response with invalid offset %d\n",
1768                     offset_read);
1769                 ret = EINVAL;
1770                 goto exit;
1771         }
1772
1773         if (bytes_read > length) {
1774                 device_printf(sc->sc_dev,
1775                     "NVM ACCESS response with too much data "
1776                     "(%d bytes requested, %d bytes received)\n",
1777                     length, bytes_read);
1778                 ret = EINVAL;
1779                 goto exit;
1780         }
1781
1782         /* Write data to NVM */
1783         memcpy(data + offset, resp_data, bytes_read);
1784         *len = bytes_read;
1785
1786  exit:
1787         iwm_free_resp(sc, &cmd);
1788         return ret;
1789 }
1790
1791 /*
1792  * Reads an NVM section completely.
1793  * NICs prior to 7000 family don't have a real NVM, but just read
1794  * section 0 which is the EEPROM. Because the EEPROM reading is unlimited
1795  * by uCode, we need to manually check in this case that we don't
1796  * overflow and try to read more than the EEPROM size.
1797  * For 7000 family NICs, we supply the maximal size we can read, and
1798  * the uCode fills the response with as much data as we can,
1799  * without overflowing, so no check is needed.
1800  */
1801 static int
1802 iwm_nvm_read_section(struct iwm_softc *sc,
1803         uint16_t section, uint8_t *data, uint16_t *len, uint32_t size_read)
1804 {
1805         uint16_t seglen, length, offset = 0;
1806         int ret;
1807
1808         /* Set nvm section read length */
1809         length = IWM_NVM_DEFAULT_CHUNK_SIZE;
1810
1811         seglen = length;
1812
1813         /* Read the NVM until exhausted (reading less than requested) */
1814         while (seglen == length) {
1815                 /* Check no memory assumptions fail and cause an overflow */
1816                 if ((size_read + offset + length) >
1817                     sc->cfg->eeprom_size) {
1818                         device_printf(sc->sc_dev,
1819                             "EEPROM size is too small for NVM\n");
1820                         return ENOBUFS;
1821                 }
1822
1823                 ret = iwm_nvm_read_chunk(sc, section, offset, length, data, &seglen);
1824                 if (ret) {
1825                         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM | IWM_DEBUG_RESET,
1826                                     "Cannot read NVM from section %d offset %d, length %d\n",
1827                                     section, offset, length);
1828                         return ret;
1829                 }
1830                 offset += seglen;
1831         }
1832
1833         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM | IWM_DEBUG_RESET,
1834                     "NVM section %d read completed\n", section);
1835         *len = offset;
1836         return 0;
1837 }
1838
1839 /*
1840  * BEGIN IWM_NVM_PARSE
1841  */
1842
1843 /* iwlwifi/iwl-nvm-parse.c */
1844
1845 /* NVM offsets (in words) definitions */
1846 enum iwm_nvm_offsets {
1847         /* NVM HW-Section offset (in words) definitions */
1848         IWM_HW_ADDR = 0x15,
1849
1850 /* NVM SW-Section offset (in words) definitions */
1851         IWM_NVM_SW_SECTION = 0x1C0,
1852         IWM_NVM_VERSION = 0,
1853         IWM_RADIO_CFG = 1,
1854         IWM_SKU = 2,
1855         IWM_N_HW_ADDRS = 3,
1856         IWM_NVM_CHANNELS = 0x1E0 - IWM_NVM_SW_SECTION,
1857
1858 /* NVM calibration section offset (in words) definitions */
1859         IWM_NVM_CALIB_SECTION = 0x2B8,
1860         IWM_XTAL_CALIB = 0x316 - IWM_NVM_CALIB_SECTION
1861 };
1862
1863 enum iwm_8000_nvm_offsets {
1864         /* NVM HW-Section offset (in words) definitions */
1865         IWM_HW_ADDR0_WFPM_8000 = 0x12,
1866         IWM_HW_ADDR1_WFPM_8000 = 0x16,
1867         IWM_HW_ADDR0_PCIE_8000 = 0x8A,
1868         IWM_HW_ADDR1_PCIE_8000 = 0x8E,
1869         IWM_MAC_ADDRESS_OVERRIDE_8000 = 1,
1870
1871         /* NVM SW-Section offset (in words) definitions */
1872         IWM_NVM_SW_SECTION_8000 = 0x1C0,
1873         IWM_NVM_VERSION_8000 = 0,
1874         IWM_RADIO_CFG_8000 = 0,
1875         IWM_SKU_8000 = 2,
1876         IWM_N_HW_ADDRS_8000 = 3,
1877
1878         /* NVM REGULATORY -Section offset (in words) definitions */
1879         IWM_NVM_CHANNELS_8000 = 0,
1880         IWM_NVM_LAR_OFFSET_8000_OLD = 0x4C7,
1881         IWM_NVM_LAR_OFFSET_8000 = 0x507,
1882         IWM_NVM_LAR_ENABLED_8000 = 0x7,
1883
1884         /* NVM calibration section offset (in words) definitions */
1885         IWM_NVM_CALIB_SECTION_8000 = 0x2B8,
1886         IWM_XTAL_CALIB_8000 = 0x316 - IWM_NVM_CALIB_SECTION_8000
1887 };
1888
1889 /* SKU Capabilities (actual values from NVM definition) */
1890 enum nvm_sku_bits {
1891         IWM_NVM_SKU_CAP_BAND_24GHZ      = (1 << 0),
1892         IWM_NVM_SKU_CAP_BAND_52GHZ      = (1 << 1),
1893         IWM_NVM_SKU_CAP_11N_ENABLE      = (1 << 2),
1894         IWM_NVM_SKU_CAP_11AC_ENABLE     = (1 << 3),
1895 };
1896
1897 /* radio config bits (actual values from NVM definition) */
1898 #define IWM_NVM_RF_CFG_DASH_MSK(x)   (x & 0x3)         /* bits 0-1   */
1899 #define IWM_NVM_RF_CFG_STEP_MSK(x)   ((x >> 2)  & 0x3) /* bits 2-3   */
1900 #define IWM_NVM_RF_CFG_TYPE_MSK(x)   ((x >> 4)  & 0x3) /* bits 4-5   */
1901 #define IWM_NVM_RF_CFG_PNUM_MSK(x)   ((x >> 6)  & 0x3) /* bits 6-7   */
1902 #define IWM_NVM_RF_CFG_TX_ANT_MSK(x) ((x >> 8)  & 0xF) /* bits 8-11  */
1903 #define IWM_NVM_RF_CFG_RX_ANT_MSK(x) ((x >> 12) & 0xF) /* bits 12-15 */
1904
1905 #define IWM_NVM_RF_CFG_FLAVOR_MSK_8000(x)       (x & 0xF)
1906 #define IWM_NVM_RF_CFG_DASH_MSK_8000(x)         ((x >> 4) & 0xF)
1907 #define IWM_NVM_RF_CFG_STEP_MSK_8000(x)         ((x >> 8) & 0xF)
1908 #define IWM_NVM_RF_CFG_TYPE_MSK_8000(x)         ((x >> 12) & 0xFFF)
1909 #define IWM_NVM_RF_CFG_TX_ANT_MSK_8000(x)       ((x >> 24) & 0xF)
1910 #define IWM_NVM_RF_CFG_RX_ANT_MSK_8000(x)       ((x >> 28) & 0xF)
1911
1912 #define DEFAULT_MAX_TX_POWER 16
1913
1914 /**
1915  * enum iwm_nvm_channel_flags - channel flags in NVM
1916  * @IWM_NVM_CHANNEL_VALID: channel is usable for this SKU/geo
1917  * @IWM_NVM_CHANNEL_IBSS: usable as an IBSS channel
1918  * @IWM_NVM_CHANNEL_ACTIVE: active scanning allowed
1919  * @IWM_NVM_CHANNEL_RADAR: radar detection required
1920  * XXX cannot find this (DFS) flag in iwm-nvm-parse.c
1921  * @IWM_NVM_CHANNEL_DFS: dynamic freq selection candidate
1922  * @IWM_NVM_CHANNEL_WIDE: 20 MHz channel okay (?)
1923  * @IWM_NVM_CHANNEL_40MHZ: 40 MHz channel okay (?)
1924  * @IWM_NVM_CHANNEL_80MHZ: 80 MHz channel okay (?)
1925  * @IWM_NVM_CHANNEL_160MHZ: 160 MHz channel okay (?)
1926  */
1927 enum iwm_nvm_channel_flags {
1928         IWM_NVM_CHANNEL_VALID = (1 << 0),
1929         IWM_NVM_CHANNEL_IBSS = (1 << 1),
1930         IWM_NVM_CHANNEL_ACTIVE = (1 << 3),
1931         IWM_NVM_CHANNEL_RADAR = (1 << 4),
1932         IWM_NVM_CHANNEL_DFS = (1 << 7),
1933         IWM_NVM_CHANNEL_WIDE = (1 << 8),
1934         IWM_NVM_CHANNEL_40MHZ = (1 << 9),
1935         IWM_NVM_CHANNEL_80MHZ = (1 << 10),
1936         IWM_NVM_CHANNEL_160MHZ = (1 << 11),
1937 };
1938
1939 /*
1940  * Translate EEPROM flags to net80211.
1941  */
1942 static uint32_t
1943 iwm_eeprom_channel_flags(uint16_t ch_flags)
1944 {
1945         uint32_t nflags;
1946
1947         nflags = 0;
1948         if ((ch_flags & IWM_NVM_CHANNEL_ACTIVE) == 0)
1949                 nflags |= IEEE80211_CHAN_PASSIVE;
1950         if ((ch_flags & IWM_NVM_CHANNEL_IBSS) == 0)
1951                 nflags |= IEEE80211_CHAN_NOADHOC;
1952         if (ch_flags & IWM_NVM_CHANNEL_RADAR) {
1953                 nflags |= IEEE80211_CHAN_DFS;
1954                 /* Just in case. */
1955                 nflags |= IEEE80211_CHAN_NOADHOC;
1956         }
1957
1958         return (nflags);
1959 }
1960
1961 static void
1962 iwm_add_channel_band(struct iwm_softc *sc, struct ieee80211_channel chans[],
1963     int maxchans, int *nchans, int ch_idx, size_t ch_num,
1964     const uint8_t bands[])
1965 {
1966         const uint16_t * const nvm_ch_flags = sc->nvm_data->nvm_ch_flags;
1967         uint32_t nflags;
1968         uint16_t ch_flags;
1969         uint8_t ieee;
1970         int error;
1971
1972         for (; ch_idx < ch_num; ch_idx++) {
1973                 ch_flags = le16_to_cpup(nvm_ch_flags + ch_idx);
1974                 if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000)
1975                         ieee = iwm_nvm_channels[ch_idx];
1976                 else
1977                         ieee = iwm_nvm_channels_8000[ch_idx];
1978
1979                 if (!(ch_flags & IWM_NVM_CHANNEL_VALID)) {
1980                         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1981                             "Ch. %d Flags %x [%sGHz] - No traffic\n",
1982                             ieee, ch_flags,
1983                             (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ?
1984                             "5.2" : "2.4");
1985                         continue;
1986                 }
1987
1988                 nflags = iwm_eeprom_channel_flags(ch_flags);
1989                 error = ieee80211_add_channel(chans, maxchans, nchans,
1990                     ieee, 0, 0, nflags, bands);
1991                 if (error != 0)
1992                         break;
1993
1994                 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1995                     "Ch. %d Flags %x [%sGHz] - Added\n",
1996                     ieee, ch_flags,
1997                     (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ?
1998                     "5.2" : "2.4");
1999         }
2000 }
2001
2002 static void
2003 iwm_init_channel_map(struct ieee80211com *ic, int maxchans, int *nchans,
2004     struct ieee80211_channel chans[])
2005 {
2006         struct iwm_softc *sc = ic->ic_softc;
2007         struct iwm_nvm_data *data = sc->nvm_data;
2008         uint8_t bands[IEEE80211_MODE_BYTES];
2009         size_t ch_num;
2010
2011         memset(bands, 0, sizeof(bands));
2012         /* 1-13: 11b/g channels. */
2013         setbit(bands, IEEE80211_MODE_11B);
2014         setbit(bands, IEEE80211_MODE_11G);
2015         iwm_add_channel_band(sc, chans, maxchans, nchans, 0,
2016             IWM_NUM_2GHZ_CHANNELS - 1, bands);
2017
2018         /* 14: 11b channel only. */
2019         clrbit(bands, IEEE80211_MODE_11G);
2020         iwm_add_channel_band(sc, chans, maxchans, nchans,
2021             IWM_NUM_2GHZ_CHANNELS - 1, IWM_NUM_2GHZ_CHANNELS, bands);
2022
2023         if (data->sku_cap_band_52GHz_enable) {
2024                 if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000)
2025                         ch_num = nitems(iwm_nvm_channels);
2026                 else
2027                         ch_num = nitems(iwm_nvm_channels_8000);
2028                 memset(bands, 0, sizeof(bands));
2029                 setbit(bands, IEEE80211_MODE_11A);
2030                 iwm_add_channel_band(sc, chans, maxchans, nchans,
2031                     IWM_NUM_2GHZ_CHANNELS, ch_num, bands);
2032         }
2033 }
2034
2035 static void
2036 iwm_set_hw_address_family_8000(struct iwm_softc *sc, struct iwm_nvm_data *data,
2037         const uint16_t *mac_override, const uint16_t *nvm_hw)
2038 {
2039         const uint8_t *hw_addr;
2040
2041         if (mac_override) {
2042                 static const uint8_t reserved_mac[] = {
2043                         0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
2044                 };
2045
2046                 hw_addr = (const uint8_t *)(mac_override +
2047                                  IWM_MAC_ADDRESS_OVERRIDE_8000);
2048
2049                 /*
2050                  * Store the MAC address from MAO section.
2051                  * No byte swapping is required in MAO section
2052                  */
2053                 IEEE80211_ADDR_COPY(data->hw_addr, hw_addr);
2054
2055                 /*
2056                  * Force the use of the OTP MAC address in case of reserved MAC
2057                  * address in the NVM, or if address is given but invalid.
2058                  */
2059                 if (!IEEE80211_ADDR_EQ(reserved_mac, hw_addr) &&
2060                     !IEEE80211_ADDR_EQ(ieee80211broadcastaddr, data->hw_addr) &&
2061                     iwm_is_valid_ether_addr(data->hw_addr) &&
2062                     !IEEE80211_IS_MULTICAST(data->hw_addr))
2063                         return;
2064
2065                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2066                     "%s: mac address from nvm override section invalid\n",
2067                     __func__);
2068         }
2069
2070         if (nvm_hw) {
2071                 /* read the mac address from WFMP registers */
2072                 uint32_t mac_addr0 =
2073                     htole32(iwm_read_prph(sc, IWM_WFMP_MAC_ADDR_0));
2074                 uint32_t mac_addr1 =
2075                     htole32(iwm_read_prph(sc, IWM_WFMP_MAC_ADDR_1));
2076
2077                 hw_addr = (const uint8_t *)&mac_addr0;
2078                 data->hw_addr[0] = hw_addr[3];
2079                 data->hw_addr[1] = hw_addr[2];
2080                 data->hw_addr[2] = hw_addr[1];
2081                 data->hw_addr[3] = hw_addr[0];
2082
2083                 hw_addr = (const uint8_t *)&mac_addr1;
2084                 data->hw_addr[4] = hw_addr[1];
2085                 data->hw_addr[5] = hw_addr[0];
2086
2087                 return;
2088         }
2089
2090         device_printf(sc->sc_dev, "%s: mac address not found\n", __func__);
2091         memset(data->hw_addr, 0, sizeof(data->hw_addr));
2092 }
2093
2094 static int
2095 iwm_get_sku(const struct iwm_softc *sc, const uint16_t *nvm_sw,
2096             const uint16_t *phy_sku)
2097 {
2098         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000)
2099                 return le16_to_cpup(nvm_sw + IWM_SKU);
2100
2101         return le32_to_cpup((const uint32_t *)(phy_sku + IWM_SKU_8000));
2102 }
2103
2104 static int
2105 iwm_get_nvm_version(const struct iwm_softc *sc, const uint16_t *nvm_sw)
2106 {
2107         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000)
2108                 return le16_to_cpup(nvm_sw + IWM_NVM_VERSION);
2109         else
2110                 return le32_to_cpup((const uint32_t *)(nvm_sw +
2111                                                 IWM_NVM_VERSION_8000));
2112 }
2113
2114 static int
2115 iwm_get_radio_cfg(const struct iwm_softc *sc, const uint16_t *nvm_sw,
2116                   const uint16_t *phy_sku)
2117 {
2118         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000)
2119                 return le16_to_cpup(nvm_sw + IWM_RADIO_CFG);
2120
2121         return le32_to_cpup((const uint32_t *)(phy_sku + IWM_RADIO_CFG_8000));
2122 }
2123
2124 static int
2125 iwm_get_n_hw_addrs(const struct iwm_softc *sc, const uint16_t *nvm_sw)
2126 {
2127         int n_hw_addr;
2128
2129         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000)
2130                 return le16_to_cpup(nvm_sw + IWM_N_HW_ADDRS);
2131
2132         n_hw_addr = le32_to_cpup((const uint32_t *)(nvm_sw + IWM_N_HW_ADDRS_8000));
2133
2134         return n_hw_addr & IWM_N_HW_ADDR_MASK;
2135 }
2136
2137 static void
2138 iwm_set_radio_cfg(const struct iwm_softc *sc, struct iwm_nvm_data *data,
2139                   uint32_t radio_cfg)
2140 {
2141         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000) {
2142                 data->radio_cfg_type = IWM_NVM_RF_CFG_TYPE_MSK(radio_cfg);
2143                 data->radio_cfg_step = IWM_NVM_RF_CFG_STEP_MSK(radio_cfg);
2144                 data->radio_cfg_dash = IWM_NVM_RF_CFG_DASH_MSK(radio_cfg);
2145                 data->radio_cfg_pnum = IWM_NVM_RF_CFG_PNUM_MSK(radio_cfg);
2146                 return;
2147         }
2148
2149         /* set the radio configuration for family 8000 */
2150         data->radio_cfg_type = IWM_NVM_RF_CFG_TYPE_MSK_8000(radio_cfg);
2151         data->radio_cfg_step = IWM_NVM_RF_CFG_STEP_MSK_8000(radio_cfg);
2152         data->radio_cfg_dash = IWM_NVM_RF_CFG_DASH_MSK_8000(radio_cfg);
2153         data->radio_cfg_pnum = IWM_NVM_RF_CFG_FLAVOR_MSK_8000(radio_cfg);
2154         data->valid_tx_ant = IWM_NVM_RF_CFG_TX_ANT_MSK_8000(radio_cfg);
2155         data->valid_rx_ant = IWM_NVM_RF_CFG_RX_ANT_MSK_8000(radio_cfg);
2156 }
2157
2158 static int
2159 iwm_set_hw_address(struct iwm_softc *sc, struct iwm_nvm_data *data,
2160                    const uint16_t *nvm_hw, const uint16_t *mac_override)
2161 {
2162 #ifdef notyet /* for FAMILY 9000 */
2163         if (cfg->mac_addr_from_csr) {
2164                 iwm_set_hw_address_from_csr(sc, data);
2165         } else
2166 #endif
2167         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000) {
2168                 const uint8_t *hw_addr = (const uint8_t *)(nvm_hw + IWM_HW_ADDR);
2169
2170                 /* The byte order is little endian 16 bit, meaning 214365 */
2171                 data->hw_addr[0] = hw_addr[1];
2172                 data->hw_addr[1] = hw_addr[0];
2173                 data->hw_addr[2] = hw_addr[3];
2174                 data->hw_addr[3] = hw_addr[2];
2175                 data->hw_addr[4] = hw_addr[5];
2176                 data->hw_addr[5] = hw_addr[4];
2177         } else {
2178                 iwm_set_hw_address_family_8000(sc, data, mac_override, nvm_hw);
2179         }
2180
2181         if (!iwm_is_valid_ether_addr(data->hw_addr)) {
2182                 device_printf(sc->sc_dev, "no valid mac address was found\n");
2183                 return EINVAL;
2184         }
2185
2186         return 0;
2187 }
2188
2189 static struct iwm_nvm_data *
2190 iwm_parse_nvm_data(struct iwm_softc *sc,
2191                    const uint16_t *nvm_hw, const uint16_t *nvm_sw,
2192                    const uint16_t *nvm_calib, const uint16_t *mac_override,
2193                    const uint16_t *phy_sku, const uint16_t *regulatory)
2194 {
2195         struct iwm_nvm_data *data;
2196         uint32_t sku, radio_cfg;
2197
2198         if (sc->cfg->device_family != IWM_DEVICE_FAMILY_8000) {
2199                 data = malloc(sizeof(*data) +
2200                     IWM_NUM_CHANNELS * sizeof(uint16_t),
2201                     M_DEVBUF, M_NOWAIT | M_ZERO);
2202         } else {
2203                 data = malloc(sizeof(*data) +
2204                     IWM_NUM_CHANNELS_8000 * sizeof(uint16_t),
2205                     M_DEVBUF, M_NOWAIT | M_ZERO);
2206         }
2207         if (!data)
2208                 return NULL;
2209
2210         data->nvm_version = iwm_get_nvm_version(sc, nvm_sw);
2211
2212         radio_cfg = iwm_get_radio_cfg(sc, nvm_sw, phy_sku);
2213         iwm_set_radio_cfg(sc, data, radio_cfg);
2214
2215         sku = iwm_get_sku(sc, nvm_sw, phy_sku);
2216         data->sku_cap_band_24GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_24GHZ;
2217         data->sku_cap_band_52GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_52GHZ;
2218         data->sku_cap_11n_enable = 0;
2219
2220         data->n_hw_addrs = iwm_get_n_hw_addrs(sc, nvm_sw);
2221
2222         /* If no valid mac address was found - bail out */
2223         if (iwm_set_hw_address(sc, data, nvm_hw, mac_override)) {
2224                 free(data, M_DEVBUF);
2225                 return NULL;
2226         }
2227
2228         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000) {
2229                 memcpy(data->nvm_ch_flags, &nvm_sw[IWM_NVM_CHANNELS],
2230                     IWM_NUM_CHANNELS * sizeof(uint16_t));
2231         } else {
2232                 memcpy(data->nvm_ch_flags, &regulatory[IWM_NVM_CHANNELS_8000],
2233                     IWM_NUM_CHANNELS_8000 * sizeof(uint16_t));
2234         }
2235
2236         return data;
2237 }
2238
2239 static void
2240 iwm_free_nvm_data(struct iwm_nvm_data *data)
2241 {
2242         if (data != NULL)
2243                 free(data, M_DEVBUF);
2244 }
2245
2246 static struct iwm_nvm_data *
2247 iwm_parse_nvm_sections(struct iwm_softc *sc, struct iwm_nvm_section *sections)
2248 {
2249         const uint16_t *hw, *sw, *calib, *regulatory, *mac_override, *phy_sku;
2250
2251         /* Checking for required sections */
2252         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000) {
2253                 if (!sections[IWM_NVM_SECTION_TYPE_SW].data ||
2254                     !sections[sc->cfg->nvm_hw_section_num].data) {
2255                         device_printf(sc->sc_dev,
2256                             "Can't parse empty OTP/NVM sections\n");
2257                         return NULL;
2258                 }
2259         } else if (sc->cfg->device_family == IWM_DEVICE_FAMILY_8000) {
2260                 /* SW and REGULATORY sections are mandatory */
2261                 if (!sections[IWM_NVM_SECTION_TYPE_SW].data ||
2262                     !sections[IWM_NVM_SECTION_TYPE_REGULATORY].data) {
2263                         device_printf(sc->sc_dev,
2264                             "Can't parse empty OTP/NVM sections\n");
2265                         return NULL;
2266                 }
2267                 /* MAC_OVERRIDE or at least HW section must exist */
2268                 if (!sections[sc->cfg->nvm_hw_section_num].data &&
2269                     !sections[IWM_NVM_SECTION_TYPE_MAC_OVERRIDE].data) {
2270                         device_printf(sc->sc_dev,
2271                             "Can't parse mac_address, empty sections\n");
2272                         return NULL;
2273                 }
2274
2275                 /* PHY_SKU section is mandatory in B0 */
2276                 if (!sections[IWM_NVM_SECTION_TYPE_PHY_SKU].data) {
2277                         device_printf(sc->sc_dev,
2278                             "Can't parse phy_sku in B0, empty sections\n");
2279                         return NULL;
2280                 }
2281         } else {
2282                 panic("unknown device family %d\n", sc->cfg->device_family);
2283         }
2284
2285         hw = (const uint16_t *) sections[sc->cfg->nvm_hw_section_num].data;
2286         sw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_SW].data;
2287         calib = (const uint16_t *)
2288             sections[IWM_NVM_SECTION_TYPE_CALIBRATION].data;
2289         regulatory = (const uint16_t *)
2290             sections[IWM_NVM_SECTION_TYPE_REGULATORY].data;
2291         mac_override = (const uint16_t *)
2292             sections[IWM_NVM_SECTION_TYPE_MAC_OVERRIDE].data;
2293         phy_sku = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_PHY_SKU].data;
2294
2295         return iwm_parse_nvm_data(sc, hw, sw, calib, mac_override,
2296             phy_sku, regulatory);
2297 }
2298
2299 static int
2300 iwm_nvm_init(struct iwm_softc *sc)
2301 {
2302         struct iwm_nvm_section nvm_sections[IWM_NVM_MAX_NUM_SECTIONS];
2303         int i, ret, section;
2304         uint32_t size_read = 0;
2305         uint8_t *nvm_buffer, *temp;
2306         uint16_t len;
2307
2308         memset(nvm_sections, 0, sizeof(nvm_sections));
2309
2310         if (sc->cfg->nvm_hw_section_num >= IWM_NVM_MAX_NUM_SECTIONS)
2311                 return EINVAL;
2312
2313         /* load NVM values from nic */
2314         /* Read From FW NVM */
2315         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM, "Read from NVM\n");
2316
2317         nvm_buffer = malloc(sc->cfg->eeprom_size, M_DEVBUF, M_NOWAIT | M_ZERO);
2318         if (!nvm_buffer)
2319                 return ENOMEM;
2320         for (section = 0; section < IWM_NVM_MAX_NUM_SECTIONS; section++) {
2321                 /* we override the constness for initial read */
2322                 ret = iwm_nvm_read_section(sc, section, nvm_buffer,
2323                                            &len, size_read);
2324                 if (ret)
2325                         continue;
2326                 size_read += len;
2327                 temp = malloc(len, M_DEVBUF, M_NOWAIT);
2328                 if (!temp) {
2329                         ret = ENOMEM;
2330                         break;
2331                 }
2332                 memcpy(temp, nvm_buffer, len);
2333
2334                 nvm_sections[section].data = temp;
2335                 nvm_sections[section].length = len;
2336         }
2337         if (!size_read)
2338                 device_printf(sc->sc_dev, "OTP is blank\n");
2339         free(nvm_buffer, M_DEVBUF);
2340
2341         sc->nvm_data = iwm_parse_nvm_sections(sc, nvm_sections);
2342         if (!sc->nvm_data)
2343                 return EINVAL;
2344         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM | IWM_DEBUG_RESET,
2345                     "nvm version = %x\n", sc->nvm_data->nvm_version);
2346
2347         for (i = 0; i < IWM_NVM_MAX_NUM_SECTIONS; i++) {
2348                 if (nvm_sections[i].data != NULL)
2349                         free(nvm_sections[i].data, M_DEVBUF);
2350         }
2351
2352         return 0;
2353 }
2354
2355 static int
2356 iwm_pcie_load_section(struct iwm_softc *sc, uint8_t section_num,
2357         const struct iwm_fw_desc *section)
2358 {
2359         struct iwm_dma_info *dma = &sc->fw_dma;
2360         uint8_t *v_addr;
2361         bus_addr_t p_addr;
2362         uint32_t offset, chunk_sz = MIN(IWM_FH_MEM_TB_MAX_LENGTH, section->len);
2363         int ret = 0;
2364
2365         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2366                     "%s: [%d] uCode section being loaded...\n",
2367                     __func__, section_num);
2368
2369         v_addr = dma->vaddr;
2370         p_addr = dma->paddr;
2371
2372         for (offset = 0; offset < section->len; offset += chunk_sz) {
2373                 uint32_t copy_size, dst_addr;
2374                 int extended_addr = FALSE;
2375
2376                 copy_size = MIN(chunk_sz, section->len - offset);
2377                 dst_addr = section->offset + offset;
2378
2379                 if (dst_addr >= IWM_FW_MEM_EXTENDED_START &&
2380                     dst_addr <= IWM_FW_MEM_EXTENDED_END)
2381                         extended_addr = TRUE;
2382
2383                 if (extended_addr)
2384                         iwm_set_bits_prph(sc, IWM_LMPM_CHICK,
2385                                           IWM_LMPM_CHICK_EXTENDED_ADDR_SPACE);
2386
2387                 memcpy(v_addr, (const uint8_t *)section->data + offset,
2388                     copy_size);
2389                 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
2390                 ret = iwm_pcie_load_firmware_chunk(sc, dst_addr, p_addr,
2391                                                    copy_size);
2392
2393                 if (extended_addr)
2394                         iwm_clear_bits_prph(sc, IWM_LMPM_CHICK,
2395                                             IWM_LMPM_CHICK_EXTENDED_ADDR_SPACE);
2396
2397                 if (ret) {
2398                         device_printf(sc->sc_dev,
2399                             "%s: Could not load the [%d] uCode section\n",
2400                             __func__, section_num);
2401                         break;
2402                 }
2403         }
2404
2405         return ret;
2406 }
2407
2408 /*
2409  * ucode
2410  */
2411 static int
2412 iwm_pcie_load_firmware_chunk(struct iwm_softc *sc, uint32_t dst_addr,
2413                              bus_addr_t phy_addr, uint32_t byte_cnt)
2414 {
2415         int ret;
2416
2417         sc->sc_fw_chunk_done = 0;
2418
2419         if (!iwm_nic_lock(sc))
2420                 return EBUSY;
2421
2422         IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL),
2423             IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
2424
2425         IWM_WRITE(sc, IWM_FH_SRVC_CHNL_SRAM_ADDR_REG(IWM_FH_SRVC_CHNL),
2426             dst_addr);
2427
2428         IWM_WRITE(sc, IWM_FH_TFDIB_CTRL0_REG(IWM_FH_SRVC_CHNL),
2429             phy_addr & IWM_FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
2430
2431         IWM_WRITE(sc, IWM_FH_TFDIB_CTRL1_REG(IWM_FH_SRVC_CHNL),
2432             (iwm_get_dma_hi_addr(phy_addr)
2433              << IWM_FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
2434
2435         IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_BUF_STS_REG(IWM_FH_SRVC_CHNL),
2436             1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
2437             1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
2438             IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
2439
2440         IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL),
2441             IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE    |
2442             IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE |
2443             IWM_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
2444
2445         iwm_nic_unlock(sc);
2446
2447         /* wait up to 5s for this segment to load */
2448         ret = 0;
2449         while (!sc->sc_fw_chunk_done) {
2450                 ret = msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfw", hz);
2451                 if (ret)
2452                         break;
2453         }
2454
2455         if (ret != 0) {
2456                 device_printf(sc->sc_dev,
2457                     "fw chunk addr 0x%x len %d failed to load\n",
2458                     dst_addr, byte_cnt);
2459                 return ETIMEDOUT;
2460         }
2461
2462         return 0;
2463 }
2464
2465 static int
2466 iwm_pcie_load_cpu_sections_8000(struct iwm_softc *sc,
2467         const struct iwm_fw_sects *image, int cpu, int *first_ucode_section)
2468 {
2469         int shift_param;
2470         int i, ret = 0, sec_num = 0x1;
2471         uint32_t val, last_read_idx = 0;
2472
2473         if (cpu == 1) {
2474                 shift_param = 0;
2475                 *first_ucode_section = 0;
2476         } else {
2477                 shift_param = 16;
2478                 (*first_ucode_section)++;
2479         }
2480
2481         for (i = *first_ucode_section; i < IWM_UCODE_SECTION_MAX; i++) {
2482                 last_read_idx = i;
2483
2484                 /*
2485                  * CPU1_CPU2_SEPARATOR_SECTION delimiter - separate between
2486                  * CPU1 to CPU2.
2487                  * PAGING_SEPARATOR_SECTION delimiter - separate between
2488                  * CPU2 non paged to CPU2 paging sec.
2489                  */
2490                 if (!image->fw_sect[i].data ||
2491                     image->fw_sect[i].offset == IWM_CPU1_CPU2_SEPARATOR_SECTION ||
2492                     image->fw_sect[i].offset == IWM_PAGING_SEPARATOR_SECTION) {
2493                         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2494                                     "Break since Data not valid or Empty section, sec = %d\n",
2495                                     i);
2496                         break;
2497                 }
2498                 ret = iwm_pcie_load_section(sc, i, &image->fw_sect[i]);
2499                 if (ret)
2500                         return ret;
2501
2502                 /* Notify the ucode of the loaded section number and status */
2503                 if (iwm_nic_lock(sc)) {
2504                         val = IWM_READ(sc, IWM_FH_UCODE_LOAD_STATUS);
2505                         val = val | (sec_num << shift_param);
2506                         IWM_WRITE(sc, IWM_FH_UCODE_LOAD_STATUS, val);
2507                         sec_num = (sec_num << 1) | 0x1;
2508                         iwm_nic_unlock(sc);
2509                 }
2510         }
2511
2512         *first_ucode_section = last_read_idx;
2513
2514         iwm_enable_interrupts(sc);
2515
2516         if (iwm_nic_lock(sc)) {
2517                 if (cpu == 1)
2518                         IWM_WRITE(sc, IWM_FH_UCODE_LOAD_STATUS, 0xFFFF);
2519                 else
2520                         IWM_WRITE(sc, IWM_FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
2521                 iwm_nic_unlock(sc);
2522         }
2523
2524         return 0;
2525 }
2526
2527 static int
2528 iwm_pcie_load_cpu_sections(struct iwm_softc *sc,
2529         const struct iwm_fw_sects *image, int cpu, int *first_ucode_section)
2530 {
2531         int shift_param;
2532         int i, ret = 0;
2533         uint32_t last_read_idx = 0;
2534
2535         if (cpu == 1) {
2536                 shift_param = 0;
2537                 *first_ucode_section = 0;
2538         } else {
2539                 shift_param = 16;
2540                 (*first_ucode_section)++;
2541         }
2542
2543         for (i = *first_ucode_section; i < IWM_UCODE_SECTION_MAX; i++) {
2544                 last_read_idx = i;
2545
2546                 /*
2547                  * CPU1_CPU2_SEPARATOR_SECTION delimiter - separate between
2548                  * CPU1 to CPU2.
2549                  * PAGING_SEPARATOR_SECTION delimiter - separate between
2550                  * CPU2 non paged to CPU2 paging sec.
2551                  */
2552                 if (!image->fw_sect[i].data ||
2553                     image->fw_sect[i].offset == IWM_CPU1_CPU2_SEPARATOR_SECTION ||
2554                     image->fw_sect[i].offset == IWM_PAGING_SEPARATOR_SECTION) {
2555                         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2556                                     "Break since Data not valid or Empty section, sec = %d\n",
2557                                      i);
2558                         break;
2559                 }
2560
2561                 ret = iwm_pcie_load_section(sc, i, &image->fw_sect[i]);
2562                 if (ret)
2563                         return ret;
2564         }
2565
2566         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_8000)
2567                 iwm_set_bits_prph(sc,
2568                                   IWM_CSR_UCODE_LOAD_STATUS_ADDR,
2569                                   (IWM_LMPM_CPU_UCODE_LOADING_COMPLETED |
2570                                    IWM_LMPM_CPU_HDRS_LOADING_COMPLETED |
2571                                    IWM_LMPM_CPU_UCODE_LOADING_STARTED) <<
2572                                         shift_param);
2573
2574         *first_ucode_section = last_read_idx;
2575
2576         return 0;
2577
2578 }
2579
2580 static int
2581 iwm_pcie_load_given_ucode(struct iwm_softc *sc,
2582         const struct iwm_fw_sects *image)
2583 {
2584         int ret = 0;
2585         int first_ucode_section;
2586
2587         IWM_DPRINTF(sc, IWM_DEBUG_RESET, "working with %s CPU\n",
2588                      image->is_dual_cpus ? "Dual" : "Single");
2589
2590         /* load to FW the binary non secured sections of CPU1 */
2591         ret = iwm_pcie_load_cpu_sections(sc, image, 1, &first_ucode_section);
2592         if (ret)
2593                 return ret;
2594
2595         if (image->is_dual_cpus) {
2596                 /* set CPU2 header address */
2597                 if (iwm_nic_lock(sc)) {
2598                         iwm_write_prph(sc,
2599                                        IWM_LMPM_SECURE_UCODE_LOAD_CPU2_HDR_ADDR,
2600                                        IWM_LMPM_SECURE_CPU2_HDR_MEM_SPACE);
2601                         iwm_nic_unlock(sc);
2602                 }
2603
2604                 /* load to FW the binary sections of CPU2 */
2605                 ret = iwm_pcie_load_cpu_sections(sc, image, 2,
2606                                                  &first_ucode_section);
2607                 if (ret)
2608                         return ret;
2609         }
2610
2611         iwm_enable_interrupts(sc);
2612
2613         /* release CPU reset */
2614         IWM_WRITE(sc, IWM_CSR_RESET, 0);
2615
2616         return 0;
2617 }
2618
2619 int
2620 iwm_pcie_load_given_ucode_8000(struct iwm_softc *sc,
2621         const struct iwm_fw_sects *image)
2622 {
2623         int ret = 0;
2624         int first_ucode_section;
2625
2626         IWM_DPRINTF(sc, IWM_DEBUG_RESET, "working with %s CPU\n",
2627                     image->is_dual_cpus ? "Dual" : "Single");
2628
2629         /* configure the ucode to be ready to get the secured image */
2630         /* release CPU reset */
2631         if (iwm_nic_lock(sc)) {
2632                 iwm_write_prph(sc, IWM_RELEASE_CPU_RESET,
2633                     IWM_RELEASE_CPU_RESET_BIT);
2634                 iwm_nic_unlock(sc);
2635         }
2636
2637         /* load to FW the binary Secured sections of CPU1 */
2638         ret = iwm_pcie_load_cpu_sections_8000(sc, image, 1,
2639             &first_ucode_section);
2640         if (ret)
2641                 return ret;
2642
2643         /* load to FW the binary sections of CPU2 */
2644         return iwm_pcie_load_cpu_sections_8000(sc, image, 2,
2645             &first_ucode_section);
2646 }
2647
2648 /* XXX Get rid of this definition */
2649 static inline void
2650 iwm_enable_fw_load_int(struct iwm_softc *sc)
2651 {
2652         IWM_DPRINTF(sc, IWM_DEBUG_INTR, "Enabling FW load interrupt\n");
2653         sc->sc_intmask = IWM_CSR_INT_BIT_FH_TX;
2654         IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask);
2655 }
2656
2657 /* XXX Add proper rfkill support code */
2658 static int
2659 iwm_start_fw(struct iwm_softc *sc,
2660         const struct iwm_fw_sects *fw)
2661 {
2662         int ret;
2663
2664         /* This may fail if AMT took ownership of the device */
2665         if (iwm_prepare_card_hw(sc)) {
2666                 device_printf(sc->sc_dev,
2667                     "%s: Exit HW not ready\n", __func__);
2668                 ret = EIO;
2669                 goto out;
2670         }
2671
2672         IWM_WRITE(sc, IWM_CSR_INT, 0xFFFFFFFF);
2673
2674         iwm_disable_interrupts(sc);
2675
2676         /* make sure rfkill handshake bits are cleared */
2677         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
2678         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR,
2679             IWM_CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
2680
2681         /* clear (again), then enable host interrupts */
2682         IWM_WRITE(sc, IWM_CSR_INT, 0xFFFFFFFF);
2683
2684         ret = iwm_nic_init(sc);
2685         if (ret) {
2686                 device_printf(sc->sc_dev, "%s: Unable to init nic\n", __func__);
2687                 goto out;
2688         }
2689
2690         /*
2691          * Now, we load the firmware and don't want to be interrupted, even
2692          * by the RF-Kill interrupt (hence mask all the interrupt besides the
2693          * FH_TX interrupt which is needed to load the firmware). If the
2694          * RF-Kill switch is toggled, we will find out after having loaded
2695          * the firmware and return the proper value to the caller.
2696          */
2697         iwm_enable_fw_load_int(sc);
2698
2699         /* really make sure rfkill handshake bits are cleared */
2700         /* maybe we should write a few times more?  just to make sure */
2701         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
2702         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
2703
2704         /* Load the given image to the HW */
2705         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_8000)
2706                 ret = iwm_pcie_load_given_ucode_8000(sc, fw);
2707         else
2708                 ret = iwm_pcie_load_given_ucode(sc, fw);
2709
2710         /* XXX re-check RF-Kill state */
2711
2712 out:
2713         return ret;
2714 }
2715
2716 static int
2717 iwm_send_tx_ant_cfg(struct iwm_softc *sc, uint8_t valid_tx_ant)
2718 {
2719         struct iwm_tx_ant_cfg_cmd tx_ant_cmd = {
2720                 .valid = htole32(valid_tx_ant),
2721         };
2722
2723         return iwm_mvm_send_cmd_pdu(sc, IWM_TX_ANT_CONFIGURATION_CMD,
2724             IWM_CMD_SYNC, sizeof(tx_ant_cmd), &tx_ant_cmd);
2725 }
2726
2727 /* iwlwifi: mvm/fw.c */
2728 static int
2729 iwm_send_phy_cfg_cmd(struct iwm_softc *sc)
2730 {
2731         struct iwm_phy_cfg_cmd phy_cfg_cmd;
2732         enum iwm_ucode_type ucode_type = sc->cur_ucode;
2733
2734         /* Set parameters */
2735         phy_cfg_cmd.phy_cfg = htole32(iwm_mvm_get_phy_config(sc));
2736         phy_cfg_cmd.calib_control.event_trigger =
2737             sc->sc_default_calib[ucode_type].event_trigger;
2738         phy_cfg_cmd.calib_control.flow_trigger =
2739             sc->sc_default_calib[ucode_type].flow_trigger;
2740
2741         IWM_DPRINTF(sc, IWM_DEBUG_CMD | IWM_DEBUG_RESET,
2742             "Sending Phy CFG command: 0x%x\n", phy_cfg_cmd.phy_cfg);
2743         return iwm_mvm_send_cmd_pdu(sc, IWM_PHY_CONFIGURATION_CMD, IWM_CMD_SYNC,
2744             sizeof(phy_cfg_cmd), &phy_cfg_cmd);
2745 }
2746
2747 static int
2748 iwm_alive_fn(struct iwm_softc *sc, struct iwm_rx_packet *pkt, void *data)
2749 {
2750         struct iwm_mvm_alive_data *alive_data = data;
2751         struct iwm_mvm_alive_resp_ver1 *palive1;
2752         struct iwm_mvm_alive_resp_ver2 *palive2;
2753         struct iwm_mvm_alive_resp *palive;
2754
2755         if (iwm_rx_packet_payload_len(pkt) == sizeof(*palive1)) {
2756                 palive1 = (void *)pkt->data;
2757
2758                 sc->support_umac_log = FALSE;
2759                 sc->error_event_table =
2760                         le32toh(palive1->error_event_table_ptr);
2761                 sc->log_event_table =
2762                         le32toh(palive1->log_event_table_ptr);
2763                 alive_data->scd_base_addr = le32toh(palive1->scd_base_ptr);
2764
2765                 alive_data->valid = le16toh(palive1->status) ==
2766                                     IWM_ALIVE_STATUS_OK;
2767                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2768                             "Alive VER1 ucode status 0x%04x revision 0x%01X 0x%01X flags 0x%01X\n",
2769                              le16toh(palive1->status), palive1->ver_type,
2770                              palive1->ver_subtype, palive1->flags);
2771         } else if (iwm_rx_packet_payload_len(pkt) == sizeof(*palive2)) {
2772                 palive2 = (void *)pkt->data;
2773                 sc->error_event_table =
2774                         le32toh(palive2->error_event_table_ptr);
2775                 sc->log_event_table =
2776                         le32toh(palive2->log_event_table_ptr);
2777                 alive_data->scd_base_addr = le32toh(palive2->scd_base_ptr);
2778                 sc->umac_error_event_table =
2779                         le32toh(palive2->error_info_addr);
2780
2781                 alive_data->valid = le16toh(palive2->status) ==
2782                                     IWM_ALIVE_STATUS_OK;
2783                 if (sc->umac_error_event_table)
2784                         sc->support_umac_log = TRUE;
2785
2786                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2787                             "Alive VER2 ucode status 0x%04x revision 0x%01X 0x%01X flags 0x%01X\n",
2788                             le16toh(palive2->status), palive2->ver_type,
2789                             palive2->ver_subtype, palive2->flags);
2790
2791                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2792                             "UMAC version: Major - 0x%x, Minor - 0x%x\n",
2793                             palive2->umac_major, palive2->umac_minor);
2794         } else if (iwm_rx_packet_payload_len(pkt) == sizeof(*palive)) {
2795                 palive = (void *)pkt->data;
2796
2797                 sc->error_event_table =
2798                         le32toh(palive->error_event_table_ptr);
2799                 sc->log_event_table =
2800                         le32toh(palive->log_event_table_ptr);
2801                 alive_data->scd_base_addr = le32toh(palive->scd_base_ptr);
2802                 sc->umac_error_event_table =
2803                         le32toh(palive->error_info_addr);
2804
2805                 alive_data->valid = le16toh(palive->status) ==
2806                                     IWM_ALIVE_STATUS_OK;
2807                 if (sc->umac_error_event_table)
2808                         sc->support_umac_log = TRUE;
2809
2810                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2811                             "Alive VER3 ucode status 0x%04x revision 0x%01X 0x%01X flags 0x%01X\n",
2812                             le16toh(palive->status), palive->ver_type,
2813                             palive->ver_subtype, palive->flags);
2814
2815                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
2816                             "UMAC version: Major - 0x%x, Minor - 0x%x\n",
2817                             le32toh(palive->umac_major),
2818                             le32toh(palive->umac_minor));
2819         }
2820
2821         return TRUE;
2822 }
2823
2824 static int
2825 iwm_wait_phy_db_entry(struct iwm_softc *sc,
2826         struct iwm_rx_packet *pkt, void *data)
2827 {
2828         struct iwm_phy_db *phy_db = data;
2829
2830         if (pkt->hdr.code != IWM_CALIB_RES_NOTIF_PHY_DB) {
2831                 if(pkt->hdr.code != IWM_INIT_COMPLETE_NOTIF) {
2832                         device_printf(sc->sc_dev, "%s: Unexpected cmd: %d\n",
2833                             __func__, pkt->hdr.code);
2834                 }
2835                 return TRUE;
2836         }
2837
2838         if (iwm_phy_db_set_section(phy_db, pkt)) {
2839                 device_printf(sc->sc_dev,
2840                     "%s: iwm_phy_db_set_section failed\n", __func__);
2841         }
2842
2843         return FALSE;
2844 }
2845
2846 static int
2847 iwm_mvm_load_ucode_wait_alive(struct iwm_softc *sc,
2848         enum iwm_ucode_type ucode_type)
2849 {
2850         struct iwm_notification_wait alive_wait;
2851         struct iwm_mvm_alive_data alive_data;
2852         const struct iwm_fw_sects *fw;
2853         enum iwm_ucode_type old_type = sc->cur_ucode;
2854         int error;
2855         static const uint16_t alive_cmd[] = { IWM_MVM_ALIVE };
2856
2857         if ((error = iwm_read_firmware(sc, ucode_type)) != 0) {
2858                 device_printf(sc->sc_dev, "iwm_read_firmware: failed %d\n",
2859                         error);
2860                 return error;
2861         }
2862         fw = &sc->sc_fw.fw_sects[ucode_type];
2863         sc->cur_ucode = ucode_type;
2864         sc->ucode_loaded = FALSE;
2865
2866         memset(&alive_data, 0, sizeof(alive_data));
2867         iwm_init_notification_wait(sc->sc_notif_wait, &alive_wait,
2868                                    alive_cmd, nitems(alive_cmd),
2869                                    iwm_alive_fn, &alive_data);
2870
2871         error = iwm_start_fw(sc, fw);
2872         if (error) {
2873                 device_printf(sc->sc_dev, "iwm_start_fw: failed %d\n", error);
2874                 sc->cur_ucode = old_type;
2875                 iwm_remove_notification(sc->sc_notif_wait, &alive_wait);
2876                 return error;
2877         }
2878
2879         /*
2880          * Some things may run in the background now, but we
2881          * just wait for the ALIVE notification here.
2882          */
2883         IWM_UNLOCK(sc);
2884         error = iwm_wait_notification(sc->sc_notif_wait, &alive_wait,
2885                                       IWM_MVM_UCODE_ALIVE_TIMEOUT);
2886         IWM_LOCK(sc);
2887         if (error) {
2888                 if (sc->cfg->device_family == IWM_DEVICE_FAMILY_8000) {
2889                         uint32_t a = 0x5a5a5a5a, b = 0x5a5a5a5a;
2890                         if (iwm_nic_lock(sc)) {
2891                                 a = iwm_read_prph(sc, IWM_SB_CPU_1_STATUS);
2892                                 b = iwm_read_prph(sc, IWM_SB_CPU_2_STATUS);
2893                                 iwm_nic_unlock(sc);
2894                         }
2895                         device_printf(sc->sc_dev,
2896                             "SecBoot CPU1 Status: 0x%x, CPU2 Status: 0x%x\n",
2897                             a, b);
2898                 }
2899                 sc->cur_ucode = old_type;
2900                 return error;
2901         }
2902
2903         if (!alive_data.valid) {
2904                 device_printf(sc->sc_dev, "%s: Loaded ucode is not valid\n",
2905                     __func__);
2906                 sc->cur_ucode = old_type;
2907                 return EIO;
2908         }
2909
2910         iwm_trans_pcie_fw_alive(sc, alive_data.scd_base_addr);
2911
2912         /*
2913          * configure and operate fw paging mechanism.
2914          * driver configures the paging flow only once, CPU2 paging image
2915          * included in the IWM_UCODE_INIT image.
2916          */
2917         if (fw->paging_mem_size) {
2918                 error = iwm_save_fw_paging(sc, fw);
2919                 if (error) {
2920                         device_printf(sc->sc_dev,
2921                             "%s: failed to save the FW paging image\n",
2922                             __func__);
2923                         return error;
2924                 }
2925
2926                 error = iwm_send_paging_cmd(sc, fw);
2927                 if (error) {
2928                         device_printf(sc->sc_dev,
2929                             "%s: failed to send the paging cmd\n", __func__);
2930                         iwm_free_fw_paging(sc);
2931                         return error;
2932                 }
2933         }
2934
2935         if (!error)
2936                 sc->ucode_loaded = TRUE;
2937         return error;
2938 }
2939
2940 /*
2941  * mvm misc bits
2942  */
2943
2944 /*
2945  * follows iwlwifi/fw.c
2946  */
2947 static int
2948 iwm_run_init_mvm_ucode(struct iwm_softc *sc, int justnvm)
2949 {
2950         struct iwm_notification_wait calib_wait;
2951         static const uint16_t init_complete[] = {
2952                 IWM_INIT_COMPLETE_NOTIF,
2953                 IWM_CALIB_RES_NOTIF_PHY_DB
2954         };
2955         int ret;
2956
2957         /* do not operate with rfkill switch turned on */
2958         if ((sc->sc_flags & IWM_FLAG_RFKILL) && !justnvm) {
2959                 device_printf(sc->sc_dev,
2960                     "radio is disabled by hardware switch\n");
2961                 return EPERM;
2962         }
2963
2964         iwm_init_notification_wait(sc->sc_notif_wait,
2965                                    &calib_wait,
2966                                    init_complete,
2967                                    nitems(init_complete),
2968                                    iwm_wait_phy_db_entry,
2969                                    sc->sc_phy_db);
2970
2971         /* Will also start the device */
2972         ret = iwm_mvm_load_ucode_wait_alive(sc, IWM_UCODE_INIT);
2973         if (ret) {
2974                 device_printf(sc->sc_dev, "Failed to start INIT ucode: %d\n",
2975                     ret);
2976                 goto error;
2977         }
2978
2979         if (justnvm) {
2980                 /* Read nvm */
2981                 ret = iwm_nvm_init(sc);
2982                 if (ret) {
2983                         device_printf(sc->sc_dev, "failed to read nvm\n");
2984                         goto error;
2985                 }
2986                 IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, sc->nvm_data->hw_addr);
2987                 goto error;
2988         }
2989
2990         ret = iwm_send_bt_init_conf(sc);
2991         if (ret) {
2992                 device_printf(sc->sc_dev,
2993                     "failed to send bt coex configuration: %d\n", ret);
2994                 goto error;
2995         }
2996
2997         /* Init Smart FIFO. */
2998         ret = iwm_mvm_sf_config(sc, IWM_SF_INIT_OFF);
2999         if (ret)
3000                 goto error;
3001
3002         /* Send TX valid antennas before triggering calibrations */
3003         ret = iwm_send_tx_ant_cfg(sc, iwm_mvm_get_valid_tx_ant(sc));
3004         if (ret) {
3005                 device_printf(sc->sc_dev,
3006                     "failed to send antennas before calibration: %d\n", ret);
3007                 goto error;
3008         }
3009
3010         /*
3011          * Send phy configurations command to init uCode
3012          * to start the 16.0 uCode init image internal calibrations.
3013          */
3014         ret = iwm_send_phy_cfg_cmd(sc);
3015         if (ret) {
3016                 device_printf(sc->sc_dev,
3017                     "%s: Failed to run INIT calibrations: %d\n",
3018                     __func__, ret);
3019                 goto error;
3020         }
3021
3022         /*
3023          * Nothing to do but wait for the init complete notification
3024          * from the firmware.
3025          */
3026         IWM_UNLOCK(sc);
3027         ret = iwm_wait_notification(sc->sc_notif_wait, &calib_wait,
3028             IWM_MVM_UCODE_CALIB_TIMEOUT);
3029         IWM_LOCK(sc);
3030
3031
3032         goto out;
3033
3034 error:
3035         iwm_remove_notification(sc->sc_notif_wait, &calib_wait);
3036 out:
3037         return ret;
3038 }
3039
3040 /*
3041  * receive side
3042  */
3043
3044 /* (re)stock rx ring, called at init-time and at runtime */
3045 static int
3046 iwm_rx_addbuf(struct iwm_softc *sc, int size, int idx)
3047 {
3048         struct iwm_rx_ring *ring = &sc->rxq;
3049         struct iwm_rx_data *data = &ring->data[idx];
3050         struct mbuf *m;
3051         bus_dmamap_t dmamap;
3052         bus_dma_segment_t seg;
3053         int nsegs, error;
3054
3055         m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWM_RBUF_SIZE);
3056         if (m == NULL)
3057                 return ENOBUFS;
3058
3059         m->m_len = m->m_pkthdr.len = m->m_ext.ext_size;
3060         error = bus_dmamap_load_mbuf_sg(ring->data_dmat, ring->spare_map, m,
3061             &seg, &nsegs, BUS_DMA_NOWAIT);
3062         if (error != 0) {
3063                 device_printf(sc->sc_dev,
3064                     "%s: can't map mbuf, error %d\n", __func__, error);
3065                 m_freem(m);
3066                 return error;
3067         }
3068
3069         if (data->m != NULL)
3070                 bus_dmamap_unload(ring->data_dmat, data->map);
3071
3072         /* Swap ring->spare_map with data->map */
3073         dmamap = data->map;
3074         data->map = ring->spare_map;
3075         ring->spare_map = dmamap;
3076
3077         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREREAD);
3078         data->m = m;
3079
3080         /* Update RX descriptor. */
3081         KASSERT((seg.ds_addr & 255) == 0, ("seg.ds_addr not aligned"));
3082         ring->desc[idx] = htole32(seg.ds_addr >> 8);
3083         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
3084             BUS_DMASYNC_PREWRITE);
3085
3086         return 0;
3087 }
3088
3089 /* iwlwifi: mvm/rx.c */
3090 /*
3091  * iwm_mvm_get_signal_strength - use new rx PHY INFO API
3092  * values are reported by the fw as positive values - need to negate
3093  * to obtain their dBM.  Account for missing antennas by replacing 0
3094  * values by -256dBm: practically 0 power and a non-feasible 8 bit value.
3095  */
3096 static int
3097 iwm_mvm_get_signal_strength(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info)
3098 {
3099         int energy_a, energy_b, energy_c, max_energy;
3100         uint32_t val;
3101
3102         val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_ENERGY_ANT_ABC_IDX]);
3103         energy_a = (val & IWM_RX_INFO_ENERGY_ANT_A_MSK) >>
3104             IWM_RX_INFO_ENERGY_ANT_A_POS;
3105         energy_a = energy_a ? -energy_a : -256;
3106         energy_b = (val & IWM_RX_INFO_ENERGY_ANT_B_MSK) >>
3107             IWM_RX_INFO_ENERGY_ANT_B_POS;
3108         energy_b = energy_b ? -energy_b : -256;
3109         energy_c = (val & IWM_RX_INFO_ENERGY_ANT_C_MSK) >>
3110             IWM_RX_INFO_ENERGY_ANT_C_POS;
3111         energy_c = energy_c ? -energy_c : -256;
3112         max_energy = MAX(energy_a, energy_b);
3113         max_energy = MAX(max_energy, energy_c);
3114
3115         IWM_DPRINTF(sc, IWM_DEBUG_RECV,
3116             "energy In A %d B %d C %d , and max %d\n",
3117             energy_a, energy_b, energy_c, max_energy);
3118
3119         return max_energy;
3120 }
3121
3122 static void
3123 iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *sc,
3124         struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
3125 {
3126         struct iwm_rx_phy_info *phy_info = (void *)pkt->data;
3127
3128         IWM_DPRINTF(sc, IWM_DEBUG_RECV, "received PHY stats\n");
3129         bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3130
3131         memcpy(&sc->sc_last_phy_info, phy_info, sizeof(sc->sc_last_phy_info));
3132 }
3133
3134 /*
3135  * Retrieve the average noise (in dBm) among receivers.
3136  */
3137 static int
3138 iwm_get_noise(struct iwm_softc *sc,
3139     const struct iwm_mvm_statistics_rx_non_phy *stats)
3140 {
3141         int i, total, nbant, noise;
3142
3143         total = nbant = noise = 0;
3144         for (i = 0; i < 3; i++) {
3145                 noise = le32toh(stats->beacon_silence_rssi[i]) & 0xff;
3146                 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "%s: i=%d, noise=%d\n",
3147                     __func__,
3148                     i,
3149                     noise);
3150
3151                 if (noise) {
3152                         total += noise;
3153                         nbant++;
3154                 }
3155         }
3156
3157         IWM_DPRINTF(sc, IWM_DEBUG_RECV, "%s: nbant=%d, total=%d\n",
3158             __func__, nbant, total);
3159 #if 0
3160         /* There should be at least one antenna but check anyway. */
3161         return (nbant == 0) ? -127 : (total / nbant) - 107;
3162 #else
3163         /* For now, just hard-code it to -96 to be safe */
3164         return (-96);
3165 #endif
3166 }
3167
3168 /*
3169  * iwm_mvm_rx_rx_mpdu - IWM_REPLY_RX_MPDU_CMD handler
3170  *
3171  * Handles the actual data of the Rx packet from the fw
3172  */
3173 static void
3174 iwm_mvm_rx_rx_mpdu(struct iwm_softc *sc, struct mbuf *m)
3175 {
3176         struct ieee80211com *ic = &sc->sc_ic;
3177         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3178         struct ieee80211_frame *wh;
3179         struct ieee80211_node *ni;
3180         struct ieee80211_rx_stats rxs;
3181         struct iwm_rx_phy_info *phy_info;
3182         struct iwm_rx_mpdu_res_start *rx_res;
3183         struct iwm_rx_packet *pkt = mtod(m, struct iwm_rx_packet *);
3184         uint32_t len;
3185         uint32_t rx_pkt_status;
3186         int rssi;
3187
3188         phy_info = &sc->sc_last_phy_info;
3189         rx_res = (struct iwm_rx_mpdu_res_start *)pkt->data;
3190         wh = (struct ieee80211_frame *)(pkt->data + sizeof(*rx_res));
3191         len = le16toh(rx_res->byte_count);
3192         rx_pkt_status = le32toh(*(uint32_t *)(pkt->data + sizeof(*rx_res) + len));
3193
3194         if (__predict_false(phy_info->cfg_phy_cnt > 20)) {
3195                 device_printf(sc->sc_dev,
3196                     "dsp size out of range [0,20]: %d\n",
3197                     phy_info->cfg_phy_cnt);
3198                 goto fail;
3199         }
3200
3201         if (!(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_CRC_OK) ||
3202             !(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_OVERRUN_OK)) {
3203                 IWM_DPRINTF(sc, IWM_DEBUG_RECV,
3204                     "Bad CRC or FIFO: 0x%08X.\n", rx_pkt_status);
3205                 goto fail;
3206         }
3207
3208         rssi = iwm_mvm_get_signal_strength(sc, phy_info);
3209
3210         /* Map it to relative value */
3211         rssi = rssi - sc->sc_noise;
3212
3213         /* replenish ring for the buffer we're going to feed to the sharks */
3214         if (iwm_rx_addbuf(sc, IWM_RBUF_SIZE, sc->rxq.cur) != 0) {
3215                 device_printf(sc->sc_dev, "%s: unable to add more buffers\n",
3216                     __func__);
3217                 goto fail;
3218         }
3219
3220         m->m_data = pkt->data + sizeof(*rx_res);
3221         m->m_pkthdr.len = m->m_len = len;
3222
3223         IWM_DPRINTF(sc, IWM_DEBUG_RECV,
3224             "%s: rssi=%d, noise=%d\n", __func__, rssi, sc->sc_noise);
3225
3226         ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3227
3228         IWM_DPRINTF(sc, IWM_DEBUG_RECV,
3229             "%s: phy_info: channel=%d, flags=0x%08x\n",
3230             __func__,
3231             le16toh(phy_info->channel),
3232             le16toh(phy_info->phy_flags));
3233
3234         /*
3235          * Populate an RX state struct with the provided information.
3236          */
3237         bzero(&rxs, sizeof(rxs));
3238         rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ;
3239         rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
3240         rxs.c_ieee = le16toh(phy_info->channel);
3241         if (le16toh(phy_info->phy_flags & IWM_RX_RES_PHY_FLAGS_BAND_24)) {
3242                 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ);
3243         } else {
3244                 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_5GHZ);
3245         }
3246
3247         /* rssi is in 1/2db units */
3248         rxs.c_rssi = rssi * 2;
3249         rxs.c_nf = sc->sc_noise;
3250         if (ieee80211_add_rx_params(m, &rxs) == 0) {
3251                 if (ni)
3252                         ieee80211_free_node(ni);
3253                 goto fail;
3254         }
3255
3256         if (ieee80211_radiotap_active_vap(vap)) {
3257                 struct iwm_rx_radiotap_header *tap = &sc->sc_rxtap;
3258
3259                 tap->wr_flags = 0;
3260                 if (phy_info->phy_flags & htole16(IWM_PHY_INFO_FLAG_SHPREAMBLE))
3261                         tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
3262                 tap->wr_chan_freq = htole16(rxs.c_freq);
3263                 /* XXX only if ic->ic_curchan->ic_ieee == rxs.c_ieee */
3264                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
3265                 tap->wr_dbm_antsignal = (int8_t)rssi;
3266                 tap->wr_dbm_antnoise = (int8_t)sc->sc_noise;
3267                 tap->wr_tsft = phy_info->system_timestamp;
3268                 switch (phy_info->rate) {
3269                 /* CCK rates. */
3270                 case  10: tap->wr_rate =   2; break;
3271                 case  20: tap->wr_rate =   4; break;
3272                 case  55: tap->wr_rate =  11; break;
3273                 case 110: tap->wr_rate =  22; break;
3274                 /* OFDM rates. */
3275                 case 0xd: tap->wr_rate =  12; break;
3276                 case 0xf: tap->wr_rate =  18; break;
3277                 case 0x5: tap->wr_rate =  24; break;
3278                 case 0x7: tap->wr_rate =  36; break;
3279                 case 0x9: tap->wr_rate =  48; break;
3280                 case 0xb: tap->wr_rate =  72; break;
3281                 case 0x1: tap->wr_rate =  96; break;
3282                 case 0x3: tap->wr_rate = 108; break;
3283                 /* Unknown rate: should not happen. */
3284                 default:  tap->wr_rate =   0;
3285                 }
3286         }
3287
3288         IWM_UNLOCK(sc);
3289         if (ni != NULL) {
3290                 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "input m %p\n", m);
3291                 ieee80211_input_mimo(ni, m);
3292                 ieee80211_free_node(ni);
3293         } else {
3294                 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "inputall m %p\n", m);
3295                 ieee80211_input_mimo_all(ic, m);
3296         }
3297         IWM_LOCK(sc);
3298
3299         return;
3300
3301 fail:
3302         counter_u64_add(ic->ic_ierrors, 1);
3303 }
3304
3305 static int
3306 iwm_mvm_rx_tx_cmd_single(struct iwm_softc *sc, struct iwm_rx_packet *pkt,
3307         struct iwm_node *in)
3308 {
3309         struct iwm_mvm_tx_resp *tx_resp = (void *)pkt->data;
3310         struct ieee80211_ratectl_tx_status *txs = &sc->sc_txs;
3311         struct ieee80211_node *ni = &in->in_ni;
3312         int status = le16toh(tx_resp->status.status) & IWM_TX_STATUS_MSK;
3313
3314         KASSERT(tx_resp->frame_count == 1, ("too many frames"));
3315
3316         /* Update rate control statistics. */
3317         IWM_DPRINTF(sc, IWM_DEBUG_XMIT, "%s: status=0x%04x, seq=%d, fc=%d, btc=%d, frts=%d, ff=%d, irate=%08x, wmt=%d\n",
3318             __func__,
3319             (int) le16toh(tx_resp->status.status),
3320             (int) le16toh(tx_resp->status.sequence),
3321             tx_resp->frame_count,
3322             tx_resp->bt_kill_count,
3323             tx_resp->failure_rts,
3324             tx_resp->failure_frame,
3325             le32toh(tx_resp->initial_rate),
3326             (int) le16toh(tx_resp->wireless_media_time));
3327
3328         txs->flags = IEEE80211_RATECTL_STATUS_SHORT_RETRY |
3329                      IEEE80211_RATECTL_STATUS_LONG_RETRY;
3330         txs->short_retries = tx_resp->failure_rts;
3331         txs->long_retries = tx_resp->failure_frame;
3332         if (status != IWM_TX_STATUS_SUCCESS &&
3333             status != IWM_TX_STATUS_DIRECT_DONE) {
3334                 switch (status) {
3335                 case IWM_TX_STATUS_FAIL_SHORT_LIMIT:
3336                         txs->status = IEEE80211_RATECTL_TX_FAIL_SHORT;
3337                         break;
3338                 case IWM_TX_STATUS_FAIL_LONG_LIMIT:
3339                         txs->status = IEEE80211_RATECTL_TX_FAIL_LONG;
3340                         break;
3341                 case IWM_TX_STATUS_FAIL_LIFE_EXPIRE:
3342                         txs->status = IEEE80211_RATECTL_TX_FAIL_EXPIRED;
3343                         break;
3344                 default:
3345                         txs->status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
3346                         break;
3347                 }
3348         } else {
3349                 txs->status = IEEE80211_RATECTL_TX_SUCCESS;
3350         }
3351         ieee80211_ratectl_tx_complete(ni, txs);
3352
3353         return (txs->status != IEEE80211_RATECTL_TX_SUCCESS);
3354 }
3355
3356 static void
3357 iwm_mvm_rx_tx_cmd(struct iwm_softc *sc,
3358         struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
3359 {
3360         struct iwm_cmd_header *cmd_hdr = &pkt->hdr;
3361         int idx = cmd_hdr->idx;
3362         int qid = cmd_hdr->qid;
3363         struct iwm_tx_ring *ring = &sc->txq[qid];
3364         struct iwm_tx_data *txd = &ring->data[idx];
3365         struct iwm_node *in = txd->in;
3366         struct mbuf *m = txd->m;
3367         int status;
3368
3369         KASSERT(txd->done == 0, ("txd not done"));
3370         KASSERT(txd->in != NULL, ("txd without node"));
3371         KASSERT(txd->m != NULL, ("txd without mbuf"));
3372
3373         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3374
3375         sc->sc_tx_timer = 0;
3376
3377         status = iwm_mvm_rx_tx_cmd_single(sc, pkt, in);
3378
3379         /* Unmap and free mbuf. */
3380         bus_dmamap_sync(ring->data_dmat, txd->map, BUS_DMASYNC_POSTWRITE);
3381         bus_dmamap_unload(ring->data_dmat, txd->map);
3382
3383         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
3384             "free txd %p, in %p\n", txd, txd->in);
3385         txd->done = 1;
3386         txd->m = NULL;
3387         txd->in = NULL;
3388
3389         ieee80211_tx_complete(&in->in_ni, m, status);
3390
3391         if (--ring->queued < IWM_TX_RING_LOMARK) {
3392                 sc->qfullmsk &= ~(1 << ring->qid);
3393                 if (sc->qfullmsk == 0) {
3394                         iwm_start(sc);
3395                 }
3396         }
3397 }
3398
3399 /*
3400  * transmit side
3401  */
3402
3403 /*
3404  * Process a "command done" firmware notification.  This is where we wakeup
3405  * processes waiting for a synchronous command completion.
3406  * from if_iwn
3407  */
3408 static void
3409 iwm_cmd_done(struct iwm_softc *sc, struct iwm_rx_packet *pkt)
3410 {
3411         struct iwm_tx_ring *ring = &sc->txq[IWM_MVM_CMD_QUEUE];
3412         struct iwm_tx_data *data;
3413
3414         if (pkt->hdr.qid != IWM_MVM_CMD_QUEUE) {
3415                 return; /* Not a command ack. */
3416         }
3417
3418         /* XXX wide commands? */
3419         IWM_DPRINTF(sc, IWM_DEBUG_CMD,
3420             "cmd notification type 0x%x qid %d idx %d\n",
3421             pkt->hdr.code, pkt->hdr.qid, pkt->hdr.idx);
3422
3423         data = &ring->data[pkt->hdr.idx];
3424
3425         /* If the command was mapped in an mbuf, free it. */
3426         if (data->m != NULL) {
3427                 bus_dmamap_sync(ring->data_dmat, data->map,
3428                     BUS_DMASYNC_POSTWRITE);
3429                 bus_dmamap_unload(ring->data_dmat, data->map);
3430                 m_freem(data->m);
3431                 data->m = NULL;
3432         }
3433         wakeup(&ring->desc[pkt->hdr.idx]);
3434
3435         if (((pkt->hdr.idx + ring->queued) % IWM_TX_RING_COUNT) != ring->cur) {
3436                 device_printf(sc->sc_dev,
3437                     "%s: Some HCMDs skipped?: idx=%d queued=%d cur=%d\n",
3438                     __func__, pkt->hdr.idx, ring->queued, ring->cur);
3439                 /* XXX call iwm_force_nmi() */
3440         }
3441
3442         KASSERT(ring->queued > 0, ("ring->queued is empty?"));
3443         ring->queued--;
3444         if (ring->queued == 0)
3445                 iwm_pcie_clear_cmd_in_flight(sc);
3446 }
3447
3448 #if 0
3449 /*
3450  * necessary only for block ack mode
3451  */
3452 void
3453 iwm_update_sched(struct iwm_softc *sc, int qid, int idx, uint8_t sta_id,
3454         uint16_t len)
3455 {
3456         struct iwm_agn_scd_bc_tbl *scd_bc_tbl;
3457         uint16_t w_val;
3458
3459         scd_bc_tbl = sc->sched_dma.vaddr;
3460
3461         len += 8; /* magic numbers came naturally from paris */
3462         if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_DW_BC_TABLE)
3463                 len = roundup(len, 4) / 4;
3464
3465         w_val = htole16(sta_id << 12 | len);
3466
3467         /* Update TX scheduler. */
3468         scd_bc_tbl[qid].tfd_offset[idx] = w_val;
3469         bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
3470             BUS_DMASYNC_PREWRITE);
3471
3472         /* I really wonder what this is ?!? */
3473         if (idx < IWM_TFD_QUEUE_SIZE_BC_DUP) {
3474                 scd_bc_tbl[qid].tfd_offset[IWM_TFD_QUEUE_SIZE_MAX + idx] = w_val;
3475                 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
3476                     BUS_DMASYNC_PREWRITE);
3477         }
3478 }
3479 #endif
3480
3481 /*
3482  * Take an 802.11 (non-n) rate, find the relevant rate
3483  * table entry.  return the index into in_ridx[].
3484  *
3485  * The caller then uses that index back into in_ridx
3486  * to figure out the rate index programmed /into/
3487  * the firmware for this given node.
3488  */
3489 static int
3490 iwm_tx_rateidx_lookup(struct iwm_softc *sc, struct iwm_node *in,
3491     uint8_t rate)
3492 {
3493         int i;
3494         uint8_t r;
3495
3496         for (i = 0; i < nitems(in->in_ridx); i++) {
3497                 r = iwm_rates[in->in_ridx[i]].rate;
3498                 if (rate == r)
3499                         return (i);
3500         }
3501
3502         IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE,
3503             "%s: couldn't find an entry for rate=%d\n",
3504             __func__,
3505             rate);
3506
3507         /* XXX Return the first */
3508         /* XXX TODO: have it return the /lowest/ */
3509         return (0);
3510 }
3511
3512 static int
3513 iwm_tx_rateidx_global_lookup(struct iwm_softc *sc, uint8_t rate)
3514 {
3515         int i;
3516
3517         for (i = 0; i < nitems(iwm_rates); i++) {
3518                 if (iwm_rates[i].rate == rate)
3519                         return (i);
3520         }
3521         /* XXX error? */
3522         IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE,
3523             "%s: couldn't find an entry for rate=%d\n",
3524             __func__,
3525             rate);
3526         return (0);
3527 }
3528
3529 /*
3530  * Fill in the rate related information for a transmit command.
3531  */
3532 static const struct iwm_rate *
3533 iwm_tx_fill_cmd(struct iwm_softc *sc, struct iwm_node *in,
3534         struct mbuf *m, struct iwm_tx_cmd *tx)
3535 {
3536         struct ieee80211_node *ni = &in->in_ni;
3537         struct ieee80211_frame *wh;
3538         const struct ieee80211_txparam *tp = ni->ni_txparms;
3539         const struct iwm_rate *rinfo;
3540         int type;
3541         int ridx, rate_flags;
3542
3543         wh = mtod(m, struct ieee80211_frame *);
3544         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3545
3546         tx->rts_retry_limit = IWM_RTS_DFAULT_RETRY_LIMIT;
3547         tx->data_retry_limit = IWM_DEFAULT_TX_RETRY;
3548
3549         if (type == IEEE80211_FC0_TYPE_MGT ||
3550             type == IEEE80211_FC0_TYPE_CTL ||
3551             (m->m_flags & M_EAPOL) != 0) {
3552                 ridx = iwm_tx_rateidx_global_lookup(sc, tp->mgmtrate);
3553                 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3554                     "%s: MGT (%d)\n", __func__, tp->mgmtrate);
3555         } else if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
3556                 ridx = iwm_tx_rateidx_global_lookup(sc, tp->mcastrate);
3557                 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3558                     "%s: MCAST (%d)\n", __func__, tp->mcastrate);
3559         } else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
3560                 ridx = iwm_tx_rateidx_global_lookup(sc, tp->ucastrate);
3561                 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3562                     "%s: FIXED_RATE (%d)\n", __func__, tp->ucastrate);
3563         } else {
3564                 int i;
3565
3566                 /* for data frames, use RS table */
3567                 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, "%s: DATA\n", __func__);
3568                 /* XXX pass pktlen */
3569                 (void) ieee80211_ratectl_rate(ni, NULL, 0);
3570                 i = iwm_tx_rateidx_lookup(sc, in, ni->ni_txrate);
3571                 ridx = in->in_ridx[i];
3572
3573                 /* This is the index into the programmed table */
3574                 tx->initial_rate_index = i;
3575                 tx->tx_flags |= htole32(IWM_TX_CMD_FLG_STA_RATE);
3576
3577                 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE,
3578                     "%s: start with i=%d, txrate %d\n",
3579                     __func__, i, iwm_rates[ridx].rate);
3580         }
3581
3582         IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE,
3583             "%s: frame type=%d txrate %d\n",
3584                 __func__, type, iwm_rates[ridx].rate);
3585
3586         rinfo = &iwm_rates[ridx];
3587
3588         IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, "%s: ridx=%d; rate=%d, CCK=%d\n",
3589             __func__, ridx,
3590             rinfo->rate,
3591             !! (IWM_RIDX_IS_CCK(ridx))
3592             );
3593
3594         /* XXX TODO: hard-coded TX antenna? */
3595         rate_flags = 1 << IWM_RATE_MCS_ANT_POS;
3596         if (IWM_RIDX_IS_CCK(ridx))
3597                 rate_flags |= IWM_RATE_MCS_CCK_MSK;
3598         tx->rate_n_flags = htole32(rate_flags | rinfo->plcp);
3599
3600         return rinfo;
3601 }
3602
3603 #define TB0_SIZE 16
3604 static int
3605 iwm_tx(struct iwm_softc *sc, struct mbuf *m, struct ieee80211_node *ni, int ac)
3606 {
3607         struct ieee80211com *ic = &sc->sc_ic;
3608         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3609         struct iwm_node *in = IWM_NODE(ni);
3610         struct iwm_tx_ring *ring;
3611         struct iwm_tx_data *data;
3612         struct iwm_tfd *desc;
3613         struct iwm_device_cmd *cmd;
3614         struct iwm_tx_cmd *tx;
3615         struct ieee80211_frame *wh;
3616         struct ieee80211_key *k = NULL;
3617         struct mbuf *m1;
3618         const struct iwm_rate *rinfo;
3619         uint32_t flags;
3620         u_int hdrlen;
3621         bus_dma_segment_t *seg, segs[IWM_MAX_SCATTER];
3622         int nsegs;
3623         uint8_t tid, type;
3624         int i, totlen, error, pad;
3625
3626         wh = mtod(m, struct ieee80211_frame *);
3627         hdrlen = ieee80211_anyhdrsize(wh);
3628         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3629         tid = 0;
3630         ring = &sc->txq[ac];
3631         desc = &ring->desc[ring->cur];
3632         memset(desc, 0, sizeof(*desc));
3633         data = &ring->data[ring->cur];
3634
3635         /* Fill out iwm_tx_cmd to send to the firmware */
3636         cmd = &ring->cmd[ring->cur];
3637         cmd->hdr.code = IWM_TX_CMD;
3638         cmd->hdr.flags = 0;
3639         cmd->hdr.qid = ring->qid;
3640         cmd->hdr.idx = ring->cur;
3641
3642         tx = (void *)cmd->data;
3643         memset(tx, 0, sizeof(*tx));
3644
3645         rinfo = iwm_tx_fill_cmd(sc, in, m, tx);
3646
3647         /* Encrypt the frame if need be. */
3648         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
3649                 /* Retrieve key for TX && do software encryption. */
3650                 k = ieee80211_crypto_encap(ni, m);
3651                 if (k == NULL) {
3652                         m_freem(m);
3653                         return (ENOBUFS);
3654                 }
3655                 /* 802.11 header may have moved. */
3656                 wh = mtod(m, struct ieee80211_frame *);
3657         }
3658
3659         if (ieee80211_radiotap_active_vap(vap)) {
3660                 struct iwm_tx_radiotap_header *tap = &sc->sc_txtap;
3661
3662                 tap->wt_flags = 0;
3663                 tap->wt_chan_freq = htole16(ni->ni_chan->ic_freq);
3664                 tap->wt_chan_flags = htole16(ni->ni_chan->ic_flags);
3665                 tap->wt_rate = rinfo->rate;
3666                 if (k != NULL)
3667                         tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3668                 ieee80211_radiotap_tx(vap, m);
3669         }
3670
3671
3672         totlen = m->m_pkthdr.len;
3673
3674         flags = 0;
3675         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
3676                 flags |= IWM_TX_CMD_FLG_ACK;
3677         }
3678
3679         if (type == IEEE80211_FC0_TYPE_DATA
3680             && (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
3681             && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
3682                 flags |= IWM_TX_CMD_FLG_PROT_REQUIRE;
3683         }
3684
3685         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
3686             type != IEEE80211_FC0_TYPE_DATA)
3687                 tx->sta_id = sc->sc_aux_sta.sta_id;
3688         else
3689                 tx->sta_id = IWM_STATION_ID;
3690
3691         if (type == IEEE80211_FC0_TYPE_MGT) {
3692                 uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
3693
3694                 if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
3695                     subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
3696                         tx->pm_frame_timeout = htole16(IWM_PM_FRAME_ASSOC);
3697                 } else if (subtype == IEEE80211_FC0_SUBTYPE_ACTION) {
3698                         tx->pm_frame_timeout = htole16(IWM_PM_FRAME_NONE);
3699                 } else {
3700                         tx->pm_frame_timeout = htole16(IWM_PM_FRAME_MGMT);
3701                 }
3702         } else {
3703                 tx->pm_frame_timeout = htole16(IWM_PM_FRAME_NONE);
3704         }
3705
3706         if (hdrlen & 3) {
3707                 /* First segment length must be a multiple of 4. */
3708                 flags |= IWM_TX_CMD_FLG_MH_PAD;
3709                 pad = 4 - (hdrlen & 3);
3710         } else
3711                 pad = 0;
3712
3713         tx->driver_txop = 0;
3714         tx->next_frame_len = 0;
3715
3716         tx->len = htole16(totlen);
3717         tx->tid_tspec = tid;
3718         tx->life_time = htole32(IWM_TX_CMD_LIFE_TIME_INFINITE);
3719
3720         /* Set physical address of "scratch area". */
3721         tx->dram_lsb_ptr = htole32(data->scratch_paddr);
3722         tx->dram_msb_ptr = iwm_get_dma_hi_addr(data->scratch_paddr);
3723
3724         /* Copy 802.11 header in TX command. */
3725         memcpy(((uint8_t *)tx) + sizeof(*tx), wh, hdrlen);
3726
3727         flags |= IWM_TX_CMD_FLG_BT_DIS | IWM_TX_CMD_FLG_SEQ_CTL;
3728
3729         tx->sec_ctl = 0;
3730         tx->tx_flags |= htole32(flags);
3731
3732         /* Trim 802.11 header. */
3733         m_adj(m, hdrlen);
3734         error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
3735             segs, &nsegs, BUS_DMA_NOWAIT);
3736         if (error != 0) {
3737                 if (error != EFBIG) {
3738                         device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
3739                             error);
3740                         m_freem(m);
3741                         return error;
3742                 }
3743                 /* Too many DMA segments, linearize mbuf. */
3744                 m1 = m_collapse(m, M_NOWAIT, IWM_MAX_SCATTER - 2);
3745                 if (m1 == NULL) {
3746                         device_printf(sc->sc_dev,
3747                             "%s: could not defrag mbuf\n", __func__);
3748                         m_freem(m);
3749                         return (ENOBUFS);
3750                 }
3751                 m = m1;
3752
3753                 error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
3754                     segs, &nsegs, BUS_DMA_NOWAIT);
3755                 if (error != 0) {
3756                         device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
3757                             error);
3758                         m_freem(m);
3759                         return error;
3760                 }
3761         }
3762         data->m = m;
3763         data->in = in;
3764         data->done = 0;
3765
3766         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
3767             "sending txd %p, in %p\n", data, data->in);
3768         KASSERT(data->in != NULL, ("node is NULL"));
3769
3770         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
3771             "sending data: qid=%d idx=%d len=%d nsegs=%d txflags=0x%08x rate_n_flags=0x%08x rateidx=%u\n",
3772             ring->qid, ring->cur, totlen, nsegs,
3773             le32toh(tx->tx_flags),
3774             le32toh(tx->rate_n_flags),
3775             tx->initial_rate_index
3776             );
3777
3778         /* Fill TX descriptor. */
3779         desc->num_tbs = 2 + nsegs;
3780
3781         desc->tbs[0].lo = htole32(data->cmd_paddr);
3782         desc->tbs[0].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) |
3783             (TB0_SIZE << 4);
3784         desc->tbs[1].lo = htole32(data->cmd_paddr + TB0_SIZE);
3785         desc->tbs[1].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) |
3786             ((sizeof(struct iwm_cmd_header) + sizeof(*tx)
3787               + hdrlen + pad - TB0_SIZE) << 4);
3788
3789         /* Other DMA segments are for data payload. */
3790         for (i = 0; i < nsegs; i++) {
3791                 seg = &segs[i];
3792                 desc->tbs[i+2].lo = htole32(seg->ds_addr);
3793                 desc->tbs[i+2].hi_n_len = \
3794                     htole16(iwm_get_dma_hi_addr(seg->ds_addr))
3795                     | ((seg->ds_len) << 4);
3796         }
3797
3798         bus_dmamap_sync(ring->data_dmat, data->map,
3799             BUS_DMASYNC_PREWRITE);
3800         bus_dmamap_sync(ring->cmd_dma.tag, ring->cmd_dma.map,
3801             BUS_DMASYNC_PREWRITE);
3802         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
3803             BUS_DMASYNC_PREWRITE);
3804
3805 #if 0
3806         iwm_update_sched(sc, ring->qid, ring->cur, tx->sta_id, le16toh(tx->len));
3807 #endif
3808
3809         /* Kick TX ring. */
3810         ring->cur = (ring->cur + 1) % IWM_TX_RING_COUNT;
3811         IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
3812
3813         /* Mark TX ring as full if we reach a certain threshold. */
3814         if (++ring->queued > IWM_TX_RING_HIMARK) {
3815                 sc->qfullmsk |= 1 << ring->qid;
3816         }
3817
3818         return 0;
3819 }
3820
3821 static int
3822 iwm_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3823     const struct ieee80211_bpf_params *params)
3824 {
3825         struct ieee80211com *ic = ni->ni_ic;
3826         struct iwm_softc *sc = ic->ic_softc;
3827         int error = 0;
3828
3829         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
3830             "->%s begin\n", __func__);
3831
3832         if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
3833                 m_freem(m);
3834                 IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
3835                     "<-%s not RUNNING\n", __func__);
3836                 return (ENETDOWN);
3837         }
3838
3839         IWM_LOCK(sc);
3840         /* XXX fix this */
3841         if (params == NULL) {
3842                 error = iwm_tx(sc, m, ni, 0);
3843         } else {
3844                 error = iwm_tx(sc, m, ni, 0);
3845         }
3846         sc->sc_tx_timer = 5;
3847         IWM_UNLOCK(sc);
3848
3849         return (error);
3850 }
3851
3852 /*
3853  * mvm/tx.c
3854  */
3855
3856 /*
3857  * Note that there are transports that buffer frames before they reach
3858  * the firmware. This means that after flush_tx_path is called, the
3859  * queue might not be empty. The race-free way to handle this is to:
3860  * 1) set the station as draining
3861  * 2) flush the Tx path
3862  * 3) wait for the transport queues to be empty
3863  */
3864 int
3865 iwm_mvm_flush_tx_path(struct iwm_softc *sc, uint32_t tfd_msk, uint32_t flags)
3866 {
3867         int ret;
3868         struct iwm_tx_path_flush_cmd flush_cmd = {
3869                 .queues_ctl = htole32(tfd_msk),
3870                 .flush_ctl = htole16(IWM_DUMP_TX_FIFO_FLUSH),
3871         };
3872
3873         ret = iwm_mvm_send_cmd_pdu(sc, IWM_TXPATH_FLUSH, flags,
3874             sizeof(flush_cmd), &flush_cmd);
3875         if (ret)
3876                 device_printf(sc->sc_dev,
3877                     "Flushing tx queue failed: %d\n", ret);
3878         return ret;
3879 }
3880
3881 /*
3882  * BEGIN mvm/sta.c
3883  */
3884
3885 static int
3886 iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *sc,
3887         struct iwm_mvm_add_sta_cmd *cmd, int *status)
3888 {
3889         return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA, sizeof(*cmd),
3890             cmd, status);
3891 }
3892
3893 /* send station add/update command to firmware */
3894 static int
3895 iwm_mvm_sta_send_to_fw(struct iwm_softc *sc, struct iwm_node *in, int update)
3896 {
3897         struct iwm_mvm_add_sta_cmd add_sta_cmd;
3898         int ret;
3899         uint32_t status;
3900
3901         memset(&add_sta_cmd, 0, sizeof(add_sta_cmd));
3902
3903         add_sta_cmd.sta_id = IWM_STATION_ID;
3904         add_sta_cmd.mac_id_n_color
3905             = htole32(IWM_FW_CMD_ID_AND_COLOR(IWM_DEFAULT_MACID,
3906                 IWM_DEFAULT_COLOR));
3907         if (!update) {
3908                 int ac;
3909                 for (ac = 0; ac < WME_NUM_AC; ac++) {
3910                         add_sta_cmd.tfd_queue_msk |=
3911                             htole32(1 << iwm_mvm_ac_to_tx_fifo[ac]);
3912                 }
3913                 IEEE80211_ADDR_COPY(&add_sta_cmd.addr, in->in_ni.ni_bssid);
3914         }
3915         add_sta_cmd.add_modify = update ? 1 : 0;
3916         add_sta_cmd.station_flags_msk
3917             |= htole32(IWM_STA_FLG_FAT_EN_MSK | IWM_STA_FLG_MIMO_EN_MSK);
3918         add_sta_cmd.tid_disable_tx = htole16(0xffff);
3919         if (update)
3920                 add_sta_cmd.modify_mask |= (IWM_STA_MODIFY_TID_DISABLE_TX);
3921
3922         status = IWM_ADD_STA_SUCCESS;
3923         ret = iwm_mvm_send_add_sta_cmd_status(sc, &add_sta_cmd, &status);
3924         if (ret)
3925                 return ret;
3926
3927         switch (status) {
3928         case IWM_ADD_STA_SUCCESS:
3929                 break;
3930         default:
3931                 ret = EIO;
3932                 device_printf(sc->sc_dev, "IWM_ADD_STA failed\n");
3933                 break;
3934         }
3935
3936         return ret;
3937 }
3938
3939 static int
3940 iwm_mvm_add_sta(struct iwm_softc *sc, struct iwm_node *in)
3941 {
3942         return iwm_mvm_sta_send_to_fw(sc, in, 0);
3943 }
3944
3945 static int
3946 iwm_mvm_update_sta(struct iwm_softc *sc, struct iwm_node *in)
3947 {
3948         return iwm_mvm_sta_send_to_fw(sc, in, 1);
3949 }
3950
3951 static int
3952 iwm_mvm_add_int_sta_common(struct iwm_softc *sc, struct iwm_int_sta *sta,
3953         const uint8_t *addr, uint16_t mac_id, uint16_t color)
3954 {
3955         struct iwm_mvm_add_sta_cmd cmd;
3956         int ret;
3957         uint32_t status;
3958
3959         memset(&cmd, 0, sizeof(cmd));
3960         cmd.sta_id = sta->sta_id;
3961         cmd.mac_id_n_color = htole32(IWM_FW_CMD_ID_AND_COLOR(mac_id, color));
3962
3963         cmd.tfd_queue_msk = htole32(sta->tfd_queue_msk);
3964         cmd.tid_disable_tx = htole16(0xffff);
3965
3966         if (addr)
3967                 IEEE80211_ADDR_COPY(cmd.addr, addr);
3968
3969         ret = iwm_mvm_send_add_sta_cmd_status(sc, &cmd, &status);
3970         if (ret)
3971                 return ret;
3972
3973         switch (status) {
3974         case IWM_ADD_STA_SUCCESS:
3975                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
3976                     "%s: Internal station added.\n", __func__);
3977                 return 0;
3978         default:
3979                 device_printf(sc->sc_dev,
3980                     "%s: Add internal station failed, status=0x%x\n",
3981                     __func__, status);
3982                 ret = EIO;
3983                 break;
3984         }
3985         return ret;
3986 }
3987
3988 static int
3989 iwm_mvm_add_aux_sta(struct iwm_softc *sc)
3990 {
3991         int ret;
3992
3993         sc->sc_aux_sta.sta_id = IWM_AUX_STA_ID;
3994         sc->sc_aux_sta.tfd_queue_msk = (1 << IWM_MVM_AUX_QUEUE);
3995
3996         ret = iwm_enable_txq(sc, 0, IWM_MVM_AUX_QUEUE, IWM_MVM_TX_FIFO_MCAST);
3997         if (ret)
3998                 return ret;
3999
4000         ret = iwm_mvm_add_int_sta_common(sc,
4001             &sc->sc_aux_sta, NULL, IWM_MAC_INDEX_AUX, 0);
4002
4003         if (ret)
4004                 memset(&sc->sc_aux_sta, 0, sizeof(sc->sc_aux_sta));
4005         return ret;
4006 }
4007
4008 /*
4009  * END mvm/sta.c
4010  */
4011
4012 /*
4013  * BEGIN mvm/quota.c
4014  */
4015
4016 static int
4017 iwm_mvm_update_quotas(struct iwm_softc *sc, struct iwm_node *in)
4018 {
4019         struct iwm_time_quota_cmd cmd;
4020         int i, idx, ret, num_active_macs, quota, quota_rem;
4021         int colors[IWM_MAX_BINDINGS] = { -1, -1, -1, -1, };
4022         int n_ifs[IWM_MAX_BINDINGS] = {0, };
4023         uint16_t id;
4024
4025         memset(&cmd, 0, sizeof(cmd));
4026
4027         /* currently, PHY ID == binding ID */
4028         if (in) {
4029                 id = in->in_phyctxt->id;
4030                 KASSERT(id < IWM_MAX_BINDINGS, ("invalid id"));
4031                 colors[id] = in->in_phyctxt->color;
4032
4033                 if (1)
4034                         n_ifs[id] = 1;
4035         }
4036
4037         /*
4038          * The FW's scheduling session consists of
4039          * IWM_MVM_MAX_QUOTA fragments. Divide these fragments
4040          * equally between all the bindings that require quota
4041          */
4042         num_active_macs = 0;
4043         for (i = 0; i < IWM_MAX_BINDINGS; i++) {
4044                 cmd.quotas[i].id_and_color = htole32(IWM_FW_CTXT_INVALID);
4045                 num_active_macs += n_ifs[i];
4046         }
4047
4048         quota = 0;
4049         quota_rem = 0;
4050         if (num_active_macs) {
4051                 quota = IWM_MVM_MAX_QUOTA / num_active_macs;
4052                 quota_rem = IWM_MVM_MAX_QUOTA % num_active_macs;
4053         }
4054
4055         for (idx = 0, i = 0; i < IWM_MAX_BINDINGS; i++) {
4056                 if (colors[i] < 0)
4057                         continue;
4058
4059                 cmd.quotas[idx].id_and_color =
4060                         htole32(IWM_FW_CMD_ID_AND_COLOR(i, colors[i]));
4061
4062                 if (n_ifs[i] <= 0) {
4063                         cmd.quotas[idx].quota = htole32(0);
4064                         cmd.quotas[idx].max_duration = htole32(0);
4065                 } else {
4066                         cmd.quotas[idx].quota = htole32(quota * n_ifs[i]);
4067                         cmd.quotas[idx].max_duration = htole32(0);
4068                 }
4069                 idx++;
4070         }
4071
4072         /* Give the remainder of the session to the first binding */
4073         cmd.quotas[0].quota = htole32(le32toh(cmd.quotas[0].quota) + quota_rem);
4074
4075         ret = iwm_mvm_send_cmd_pdu(sc, IWM_TIME_QUOTA_CMD, IWM_CMD_SYNC,
4076             sizeof(cmd), &cmd);
4077         if (ret)
4078                 device_printf(sc->sc_dev,
4079                     "%s: Failed to send quota: %d\n", __func__, ret);
4080         return ret;
4081 }
4082
4083 /*
4084  * END mvm/quota.c
4085  */
4086
4087 /*
4088  * ieee80211 routines
4089  */
4090
4091 /*
4092  * Change to AUTH state in 80211 state machine.  Roughly matches what
4093  * Linux does in bss_info_changed().
4094  */
4095 static int
4096 iwm_auth(struct ieee80211vap *vap, struct iwm_softc *sc)
4097 {
4098         struct ieee80211_node *ni;
4099         struct iwm_node *in;
4100         struct iwm_vap *iv = IWM_VAP(vap);
4101         uint32_t duration;
4102         int error;
4103
4104         /*
4105          * XXX i have a feeling that the vap node is being
4106          * freed from underneath us. Grr.
4107          */
4108         ni = ieee80211_ref_node(vap->iv_bss);
4109         in = IWM_NODE(ni);
4110         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_STATE,
4111             "%s: called; vap=%p, bss ni=%p\n",
4112             __func__,
4113             vap,
4114             ni);
4115
4116         in->in_assoc = 0;
4117
4118         error = iwm_mvm_sf_config(sc, IWM_SF_FULL_ON);
4119         if (error != 0)
4120                 return error;
4121
4122         error = iwm_allow_mcast(vap, sc);
4123         if (error) {
4124                 device_printf(sc->sc_dev,
4125                     "%s: failed to set multicast\n", __func__);
4126                 goto out;
4127         }
4128
4129         /*
4130          * This is where it deviates from what Linux does.
4131          *
4132          * Linux iwlwifi doesn't reset the nic each time, nor does it
4133          * call ctxt_add() here.  Instead, it adds it during vap creation,
4134          * and always does a mac_ctx_changed().
4135          *
4136          * The openbsd port doesn't attempt to do that - it reset things
4137          * at odd states and does the add here.
4138          *
4139          * So, until the state handling is fixed (ie, we never reset
4140          * the NIC except for a firmware failure, which should drag
4141          * the NIC back to IDLE, re-setup and re-add all the mac/phy
4142          * contexts that are required), let's do a dirty hack here.
4143          */
4144         if (iv->is_uploaded) {
4145                 if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) {
4146                         device_printf(sc->sc_dev,
4147                             "%s: failed to update MAC\n", __func__);
4148                         goto out;
4149                 }
4150                 if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0],
4151                     in->in_ni.ni_chan, 1, 1)) != 0) {
4152                         device_printf(sc->sc_dev,
4153                             "%s: failed update phy ctxt\n", __func__);
4154                         goto out;
4155                 }
4156                 in->in_phyctxt = &sc->sc_phyctxt[0];
4157
4158                 if ((error = iwm_mvm_binding_update(sc, in)) != 0) {
4159                         device_printf(sc->sc_dev,
4160                             "%s: binding update cmd\n", __func__);
4161                         goto out;
4162                 }
4163                 if ((error = iwm_mvm_update_sta(sc, in)) != 0) {
4164                         device_printf(sc->sc_dev,
4165                             "%s: failed to update sta\n", __func__);
4166                         goto out;
4167                 }
4168         } else {
4169                 if ((error = iwm_mvm_mac_ctxt_add(sc, vap)) != 0) {
4170                         device_printf(sc->sc_dev,
4171                             "%s: failed to add MAC\n", __func__);
4172                         goto out;
4173                 }
4174                 if ((error = iwm_mvm_power_update_mac(sc)) != 0) {
4175                         device_printf(sc->sc_dev,
4176                             "%s: failed to update power management\n",
4177                             __func__);
4178                         goto out;
4179                 }
4180                 if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0],
4181                     in->in_ni.ni_chan, 1, 1)) != 0) {
4182                         device_printf(sc->sc_dev,
4183                             "%s: failed add phy ctxt!\n", __func__);
4184                         error = ETIMEDOUT;
4185                         goto out;
4186                 }
4187                 in->in_phyctxt = &sc->sc_phyctxt[0];
4188
4189                 if ((error = iwm_mvm_binding_add_vif(sc, in)) != 0) {
4190                         device_printf(sc->sc_dev,
4191                             "%s: binding add cmd\n", __func__);
4192                         goto out;
4193                 }
4194                 if ((error = iwm_mvm_add_sta(sc, in)) != 0) {
4195                         device_printf(sc->sc_dev,
4196                             "%s: failed to add sta\n", __func__);
4197                         goto out;
4198                 }
4199         }
4200
4201         /*
4202          * Prevent the FW from wandering off channel during association
4203          * by "protecting" the session with a time event.
4204          */
4205         /* XXX duration is in units of TU, not MS */
4206         duration = IWM_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
4207         iwm_mvm_protect_session(sc, in, duration, 500 /* XXX magic number */);
4208         DELAY(100);
4209
4210         error = 0;
4211 out:
4212         ieee80211_free_node(ni);
4213         return (error);
4214 }
4215
4216 static int
4217 iwm_assoc(struct ieee80211vap *vap, struct iwm_softc *sc)
4218 {
4219         struct iwm_node *in = IWM_NODE(vap->iv_bss);
4220         int error;
4221
4222         if ((error = iwm_mvm_update_sta(sc, in)) != 0) {
4223                 device_printf(sc->sc_dev,
4224                     "%s: failed to update STA\n", __func__);
4225                 return error;
4226         }
4227
4228         in->in_assoc = 1;
4229         if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) {
4230                 device_printf(sc->sc_dev,
4231                     "%s: failed to update MAC\n", __func__);
4232                 return error;
4233         }
4234
4235         return 0;
4236 }
4237
4238 static int
4239 iwm_release(struct iwm_softc *sc, struct iwm_node *in)
4240 {
4241         uint32_t tfd_msk;
4242
4243         /*
4244          * Ok, so *technically* the proper set of calls for going
4245          * from RUN back to SCAN is:
4246          *
4247          * iwm_mvm_power_mac_disable(sc, in);
4248          * iwm_mvm_mac_ctxt_changed(sc, in);
4249          * iwm_mvm_rm_sta(sc, in);
4250          * iwm_mvm_update_quotas(sc, NULL);
4251          * iwm_mvm_mac_ctxt_changed(sc, in);
4252          * iwm_mvm_binding_remove_vif(sc, in);
4253          * iwm_mvm_mac_ctxt_remove(sc, in);
4254          *
4255          * However, that freezes the device not matter which permutations
4256          * and modifications are attempted.  Obviously, this driver is missing
4257          * something since it works in the Linux driver, but figuring out what
4258          * is missing is a little more complicated.  Now, since we're going
4259          * back to nothing anyway, we'll just do a complete device reset.
4260          * Up your's, device!
4261          */
4262         /*
4263          * Just using 0xf for the queues mask is fine as long as we only
4264          * get here from RUN state.
4265          */
4266         tfd_msk = 0xf;
4267         mbufq_drain(&sc->sc_snd);
4268         iwm_mvm_flush_tx_path(sc, tfd_msk, IWM_CMD_SYNC);
4269         /*
4270          * We seem to get away with just synchronously sending the
4271          * IWM_TXPATH_FLUSH command.
4272          */
4273 //      iwm_trans_wait_tx_queue_empty(sc, tfd_msk);
4274         iwm_stop_device(sc);
4275         iwm_init_hw(sc);
4276         if (in)
4277                 in->in_assoc = 0;
4278         return 0;
4279
4280 #if 0
4281         int error;
4282
4283         iwm_mvm_power_mac_disable(sc, in);
4284
4285         if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) {
4286                 device_printf(sc->sc_dev, "mac ctxt change fail 1 %d\n", error);
4287                 return error;
4288         }
4289
4290         if ((error = iwm_mvm_rm_sta(sc, in)) != 0) {
4291                 device_printf(sc->sc_dev, "sta remove fail %d\n", error);
4292                 return error;
4293         }
4294         error = iwm_mvm_rm_sta(sc, in);
4295         in->in_assoc = 0;
4296         iwm_mvm_update_quotas(sc, NULL);
4297         if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) {
4298                 device_printf(sc->sc_dev, "mac ctxt change fail 2 %d\n", error);
4299                 return error;
4300         }
4301         iwm_mvm_binding_remove_vif(sc, in);
4302
4303         iwm_mvm_mac_ctxt_remove(sc, in);
4304
4305         return error;
4306 #endif
4307 }
4308
4309 static struct ieee80211_node *
4310 iwm_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
4311 {
4312         return malloc(sizeof (struct iwm_node), M_80211_NODE,
4313             M_NOWAIT | M_ZERO);
4314 }
4315
4316 uint8_t
4317 iwm_ridx2rate(struct ieee80211_rateset *rs, int ridx)
4318 {
4319         int i;
4320         uint8_t rval;
4321
4322         for (i = 0; i < rs->rs_nrates; i++) {
4323                 rval = (rs->rs_rates[i] & IEEE80211_RATE_VAL);
4324                 if (rval == iwm_rates[ridx].rate)
4325                         return rs->rs_rates[i];
4326         }
4327
4328         return 0;
4329 }
4330
4331 static void
4332 iwm_setrates(struct iwm_softc *sc, struct iwm_node *in)
4333 {
4334         struct ieee80211_node *ni = &in->in_ni;
4335         struct iwm_lq_cmd *lq = &in->in_lq;
4336         int nrates = ni->ni_rates.rs_nrates;
4337         int i, ridx, tab = 0;
4338 //      int txant = 0;
4339
4340         if (nrates > nitems(lq->rs_table)) {
4341                 device_printf(sc->sc_dev,
4342                     "%s: node supports %d rates, driver handles "
4343                     "only %zu\n", __func__, nrates, nitems(lq->rs_table));
4344                 return;
4345         }
4346         if (nrates == 0) {
4347                 device_printf(sc->sc_dev,
4348                     "%s: node supports 0 rates, odd!\n", __func__);
4349                 return;
4350         }
4351
4352         /*
4353          * XXX .. and most of iwm_node is not initialised explicitly;
4354          * it's all just 0x0 passed to the firmware.
4355          */
4356
4357         /* first figure out which rates we should support */
4358         /* XXX TODO: this isn't 11n aware /at all/ */
4359         memset(&in->in_ridx, -1, sizeof(in->in_ridx));
4360         IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
4361             "%s: nrates=%d\n", __func__, nrates);
4362
4363         /*
4364          * Loop over nrates and populate in_ridx from the highest
4365          * rate to the lowest rate.  Remember, in_ridx[] has
4366          * IEEE80211_RATE_MAXSIZE entries!
4367          */
4368         for (i = 0; i < min(nrates, IEEE80211_RATE_MAXSIZE); i++) {
4369                 int rate = ni->ni_rates.rs_rates[(nrates - 1) - i] & IEEE80211_RATE_VAL;
4370
4371                 /* Map 802.11 rate to HW rate index. */
4372                 for (ridx = 0; ridx <= IWM_RIDX_MAX; ridx++)
4373                         if (iwm_rates[ridx].rate == rate)
4374                                 break;
4375                 if (ridx > IWM_RIDX_MAX) {
4376                         device_printf(sc->sc_dev,
4377                             "%s: WARNING: device rate for %d not found!\n",
4378                             __func__, rate);
4379                 } else {
4380                         IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
4381                             "%s: rate: i: %d, rate=%d, ridx=%d\n",
4382                             __func__,
4383                             i,
4384                             rate,
4385                             ridx);
4386                         in->in_ridx[i] = ridx;
4387                 }
4388         }
4389
4390         /* then construct a lq_cmd based on those */
4391         memset(lq, 0, sizeof(*lq));
4392         lq->sta_id = IWM_STATION_ID;
4393
4394         /* For HT, always enable RTS/CTS to avoid excessive retries. */
4395         if (ni->ni_flags & IEEE80211_NODE_HT)
4396                 lq->flags |= IWM_LQ_FLAG_USE_RTS_MSK;
4397
4398         /*
4399          * are these used? (we don't do SISO or MIMO)
4400          * need to set them to non-zero, though, or we get an error.
4401          */
4402         lq->single_stream_ant_msk = 1;
4403         lq->dual_stream_ant_msk = 1;
4404
4405         /*
4406          * Build the actual rate selection table.
4407          * The lowest bits are the rates.  Additionally,
4408          * CCK needs bit 9 to be set.  The rest of the bits
4409          * we add to the table select the tx antenna
4410          * Note that we add the rates in the highest rate first
4411          * (opposite of ni_rates).
4412          */
4413         /*
4414          * XXX TODO: this should be looping over the min of nrates
4415          * and LQ_MAX_RETRY_NUM.  Sigh.
4416          */
4417         for (i = 0; i < nrates; i++) {
4418                 int nextant;
4419
4420 #if 0
4421                 if (txant == 0)
4422                         txant = iwm_mvm_get_valid_tx_ant(sc);
4423                 nextant = 1<<(ffs(txant)-1);
4424                 txant &= ~nextant;
4425 #else
4426                 nextant = iwm_mvm_get_valid_tx_ant(sc);
4427 #endif
4428                 /*
4429                  * Map the rate id into a rate index into
4430                  * our hardware table containing the
4431                  * configuration to use for this rate.
4432                  */
4433                 ridx = in->in_ridx[i];
4434                 tab = iwm_rates[ridx].plcp;
4435                 tab |= nextant << IWM_RATE_MCS_ANT_POS;
4436                 if (IWM_RIDX_IS_CCK(ridx))
4437                         tab |= IWM_RATE_MCS_CCK_MSK;
4438                 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
4439                     "station rate i=%d, rate=%d, hw=%x\n",
4440                     i, iwm_rates[ridx].rate, tab);
4441                 lq->rs_table[i] = htole32(tab);
4442         }
4443         /* then fill the rest with the lowest possible rate */
4444         for (i = nrates; i < nitems(lq->rs_table); i++) {
4445                 KASSERT(tab != 0, ("invalid tab"));
4446                 lq->rs_table[i] = htole32(tab);
4447         }
4448 }
4449
4450 static int
4451 iwm_media_change(struct ifnet *ifp)
4452 {
4453         struct ieee80211vap *vap = ifp->if_softc;
4454         struct ieee80211com *ic = vap->iv_ic;
4455         struct iwm_softc *sc = ic->ic_softc;
4456         int error;
4457
4458         error = ieee80211_media_change(ifp);
4459         if (error != ENETRESET)
4460                 return error;
4461
4462         IWM_LOCK(sc);
4463         if (ic->ic_nrunning > 0) {
4464                 iwm_stop(sc);
4465                 iwm_init(sc);
4466         }
4467         IWM_UNLOCK(sc);
4468         return error;
4469 }
4470
4471
4472 static int
4473 iwm_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4474 {
4475         struct iwm_vap *ivp = IWM_VAP(vap);
4476         struct ieee80211com *ic = vap->iv_ic;
4477         struct iwm_softc *sc = ic->ic_softc;
4478         struct iwm_node *in;
4479         int error;
4480
4481         IWM_DPRINTF(sc, IWM_DEBUG_STATE,
4482             "switching state %s -> %s\n",
4483             ieee80211_state_name[vap->iv_state],
4484             ieee80211_state_name[nstate]);
4485         IEEE80211_UNLOCK(ic);
4486         IWM_LOCK(sc);
4487
4488         if (vap->iv_state == IEEE80211_S_SCAN && nstate != vap->iv_state)
4489                 iwm_led_blink_stop(sc);
4490
4491         /* disable beacon filtering if we're hopping out of RUN */
4492         if (vap->iv_state == IEEE80211_S_RUN && nstate != vap->iv_state) {
4493                 iwm_mvm_disable_beacon_filter(sc);
4494
4495                 if (((in = IWM_NODE(vap->iv_bss)) != NULL))
4496                         in->in_assoc = 0;
4497
4498                 if (nstate == IEEE80211_S_INIT) {
4499                         IWM_UNLOCK(sc);
4500                         IEEE80211_LOCK(ic);
4501                         error = ivp->iv_newstate(vap, nstate, arg);
4502                         IEEE80211_UNLOCK(ic);
4503                         IWM_LOCK(sc);
4504                         iwm_release(sc, NULL);
4505                         IWM_UNLOCK(sc);
4506                         IEEE80211_LOCK(ic);
4507                         return error;
4508                 }
4509
4510                 /*
4511                  * It's impossible to directly go RUN->SCAN. If we iwm_release()
4512                  * above then the card will be completely reinitialized,
4513                  * so the driver must do everything necessary to bring the card
4514                  * from INIT to SCAN.
4515                  *
4516                  * Additionally, upon receiving deauth frame from AP,
4517                  * OpenBSD 802.11 stack puts the driver in IEEE80211_S_AUTH
4518                  * state. This will also fail with this driver, so bring the FSM
4519                  * from IEEE80211_S_RUN to IEEE80211_S_SCAN in this case as well.
4520                  *
4521                  * XXX TODO: fix this for FreeBSD!
4522                  */
4523                 if (nstate == IEEE80211_S_SCAN ||
4524                     nstate == IEEE80211_S_AUTH ||
4525                     nstate == IEEE80211_S_ASSOC) {
4526                         IWM_DPRINTF(sc, IWM_DEBUG_STATE,
4527                             "Force transition to INIT; MGT=%d\n", arg);
4528                         IWM_UNLOCK(sc);
4529                         IEEE80211_LOCK(ic);
4530                         /* Always pass arg as -1 since we can't Tx right now. */
4531                         /*
4532                          * XXX arg is just ignored anyway when transitioning
4533                          *     to IEEE80211_S_INIT.
4534                          */
4535                         vap->iv_newstate(vap, IEEE80211_S_INIT, -1);
4536                         IWM_DPRINTF(sc, IWM_DEBUG_STATE,
4537                             "Going INIT->SCAN\n");
4538                         nstate = IEEE80211_S_SCAN;
4539                         IEEE80211_UNLOCK(ic);
4540                         IWM_LOCK(sc);
4541                 }
4542         }
4543
4544         switch (nstate) {
4545         case IEEE80211_S_INIT:
4546                 break;
4547
4548         case IEEE80211_S_AUTH:
4549                 if ((error = iwm_auth(vap, sc)) != 0) {
4550                         device_printf(sc->sc_dev,
4551                             "%s: could not move to auth state: %d\n",
4552                             __func__, error);
4553                         break;
4554                 }
4555                 break;
4556
4557         case IEEE80211_S_ASSOC:
4558                 /*
4559                  * EBS may be disabled due to previous failures reported by FW.
4560                  * Reset EBS status here assuming environment has been changed.
4561                  */
4562                 sc->last_ebs_successful = TRUE;
4563                 if ((error = iwm_assoc(vap, sc)) != 0) {
4564                         device_printf(sc->sc_dev,
4565                             "%s: failed to associate: %d\n", __func__,
4566                             error);
4567                         break;
4568                 }
4569                 break;
4570
4571         case IEEE80211_S_RUN:
4572         {
4573                 struct iwm_host_cmd cmd = {
4574                         .id = IWM_LQ_CMD,
4575                         .len = { sizeof(in->in_lq), },
4576                         .flags = IWM_CMD_SYNC,
4577                 };
4578
4579                 /* Update the association state, now we have it all */
4580                 /* (eg associd comes in at this point */
4581                 error = iwm_assoc(vap, sc);
4582                 if (error != 0) {
4583                         device_printf(sc->sc_dev,
4584                             "%s: failed to update association state: %d\n",
4585                             __func__,
4586                             error);
4587                         break;
4588                 }
4589
4590                 in = IWM_NODE(vap->iv_bss);
4591                 iwm_mvm_enable_beacon_filter(sc, in);
4592                 iwm_mvm_power_update_mac(sc);
4593                 iwm_mvm_update_quotas(sc, in);
4594                 iwm_setrates(sc, in);
4595
4596                 cmd.data[0] = &in->in_lq;
4597                 if ((error = iwm_send_cmd(sc, &cmd)) != 0) {
4598                         device_printf(sc->sc_dev,
4599                             "%s: IWM_LQ_CMD failed\n", __func__);
4600                 }
4601
4602                 iwm_mvm_led_enable(sc);
4603                 break;
4604         }
4605
4606         default:
4607                 break;
4608         }
4609         IWM_UNLOCK(sc);
4610         IEEE80211_LOCK(ic);
4611
4612         return (ivp->iv_newstate(vap, nstate, arg));
4613 }
4614
4615 void
4616 iwm_endscan_cb(void *arg, int pending)
4617 {
4618         struct iwm_softc *sc = arg;
4619         struct ieee80211com *ic = &sc->sc_ic;
4620
4621         IWM_DPRINTF(sc, IWM_DEBUG_SCAN | IWM_DEBUG_TRACE,
4622             "%s: scan ended\n",
4623             __func__);
4624
4625         ieee80211_scan_done(TAILQ_FIRST(&ic->ic_vaps));
4626 }
4627
4628 /*
4629  * Aging and idle timeouts for the different possible scenarios
4630  * in default configuration
4631  */
4632 static const uint32_t
4633 iwm_sf_full_timeout_def[IWM_SF_NUM_SCENARIO][IWM_SF_NUM_TIMEOUT_TYPES] = {
4634         {
4635                 htole32(IWM_SF_SINGLE_UNICAST_AGING_TIMER_DEF),
4636                 htole32(IWM_SF_SINGLE_UNICAST_IDLE_TIMER_DEF)
4637         },
4638         {
4639                 htole32(IWM_SF_AGG_UNICAST_AGING_TIMER_DEF),
4640                 htole32(IWM_SF_AGG_UNICAST_IDLE_TIMER_DEF)
4641         },
4642         {
4643                 htole32(IWM_SF_MCAST_AGING_TIMER_DEF),
4644                 htole32(IWM_SF_MCAST_IDLE_TIMER_DEF)
4645         },
4646         {
4647                 htole32(IWM_SF_BA_AGING_TIMER_DEF),
4648                 htole32(IWM_SF_BA_IDLE_TIMER_DEF)
4649         },
4650         {
4651                 htole32(IWM_SF_TX_RE_AGING_TIMER_DEF),
4652                 htole32(IWM_SF_TX_RE_IDLE_TIMER_DEF)
4653         },
4654 };
4655
4656 /*
4657  * Aging and idle timeouts for the different possible scenarios
4658  * in single BSS MAC configuration.
4659  */
4660 static const uint32_t
4661 iwm_sf_full_timeout[IWM_SF_NUM_SCENARIO][IWM_SF_NUM_TIMEOUT_TYPES] = {
4662         {
4663                 htole32(IWM_SF_SINGLE_UNICAST_AGING_TIMER),
4664                 htole32(IWM_SF_SINGLE_UNICAST_IDLE_TIMER)
4665         },
4666         {
4667                 htole32(IWM_SF_AGG_UNICAST_AGING_TIMER),
4668                 htole32(IWM_SF_AGG_UNICAST_IDLE_TIMER)
4669         },
4670         {
4671                 htole32(IWM_SF_MCAST_AGING_TIMER),
4672                 htole32(IWM_SF_MCAST_IDLE_TIMER)
4673         },
4674         {
4675                 htole32(IWM_SF_BA_AGING_TIMER),
4676                 htole32(IWM_SF_BA_IDLE_TIMER)
4677         },
4678         {
4679                 htole32(IWM_SF_TX_RE_AGING_TIMER),
4680                 htole32(IWM_SF_TX_RE_IDLE_TIMER)
4681         },
4682 };
4683
4684 static void
4685 iwm_mvm_fill_sf_command(struct iwm_softc *sc, struct iwm_sf_cfg_cmd *sf_cmd,
4686     struct ieee80211_node *ni)
4687 {
4688         int i, j, watermark;
4689
4690         sf_cmd->watermark[IWM_SF_LONG_DELAY_ON] = htole32(IWM_SF_W_MARK_SCAN);
4691
4692         /*
4693          * If we are in association flow - check antenna configuration
4694          * capabilities of the AP station, and choose the watermark accordingly.
4695          */
4696         if (ni) {
4697                 if (ni->ni_flags & IEEE80211_NODE_HT) {
4698 #ifdef notyet
4699                         if (ni->ni_rxmcs[2] != 0)
4700                                 watermark = IWM_SF_W_MARK_MIMO3;
4701                         else if (ni->ni_rxmcs[1] != 0)
4702                                 watermark = IWM_SF_W_MARK_MIMO2;
4703                         else
4704 #endif
4705                                 watermark = IWM_SF_W_MARK_SISO;
4706                 } else {
4707                         watermark = IWM_SF_W_MARK_LEGACY;
4708                 }
4709         /* default watermark value for unassociated mode. */
4710         } else {
4711                 watermark = IWM_SF_W_MARK_MIMO2;
4712         }
4713         sf_cmd->watermark[IWM_SF_FULL_ON] = htole32(watermark);
4714
4715         for (i = 0; i < IWM_SF_NUM_SCENARIO; i++) {
4716                 for (j = 0; j < IWM_SF_NUM_TIMEOUT_TYPES; j++) {
4717                         sf_cmd->long_delay_timeouts[i][j] =
4718                                         htole32(IWM_SF_LONG_DELAY_AGING_TIMER);
4719                 }
4720         }
4721
4722         if (ni) {
4723                 memcpy(sf_cmd->full_on_timeouts, iwm_sf_full_timeout,
4724                        sizeof(iwm_sf_full_timeout));
4725         } else {
4726                 memcpy(sf_cmd->full_on_timeouts, iwm_sf_full_timeout_def,
4727                        sizeof(iwm_sf_full_timeout_def));
4728         }
4729 }
4730
4731 static int
4732 iwm_mvm_sf_config(struct iwm_softc *sc, enum iwm_sf_state new_state)
4733 {
4734         struct ieee80211com *ic = &sc->sc_ic;
4735         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4736         struct iwm_sf_cfg_cmd sf_cmd = {
4737                 .state = htole32(IWM_SF_FULL_ON),
4738         };
4739         int ret = 0;
4740
4741         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_8000)
4742                 sf_cmd.state |= htole32(IWM_SF_CFG_DUMMY_NOTIF_OFF);
4743
4744         switch (new_state) {
4745         case IWM_SF_UNINIT:
4746         case IWM_SF_INIT_OFF:
4747                 iwm_mvm_fill_sf_command(sc, &sf_cmd, NULL);
4748                 break;
4749         case IWM_SF_FULL_ON:
4750                 iwm_mvm_fill_sf_command(sc, &sf_cmd, vap->iv_bss);
4751                 break;
4752         default:
4753                 IWM_DPRINTF(sc, IWM_DEBUG_PWRSAVE,
4754                     "Invalid state: %d. not sending Smart Fifo cmd\n",
4755                           new_state);
4756                 return EINVAL;
4757         }
4758
4759         ret = iwm_mvm_send_cmd_pdu(sc, IWM_REPLY_SF_CFG_CMD, IWM_CMD_ASYNC,
4760                                    sizeof(sf_cmd), &sf_cmd);
4761         return ret;
4762 }
4763
4764 static int
4765 iwm_send_bt_init_conf(struct iwm_softc *sc)
4766 {
4767         struct iwm_bt_coex_cmd bt_cmd;
4768
4769         bt_cmd.mode = htole32(IWM_BT_COEX_WIFI);
4770         bt_cmd.enabled_modules = htole32(IWM_BT_COEX_HIGH_BAND_RET);
4771
4772         return iwm_mvm_send_cmd_pdu(sc, IWM_BT_CONFIG, 0, sizeof(bt_cmd),
4773             &bt_cmd);
4774 }
4775
4776 static int
4777 iwm_send_update_mcc_cmd(struct iwm_softc *sc, const char *alpha2)
4778 {
4779         struct iwm_mcc_update_cmd mcc_cmd;
4780         struct iwm_host_cmd hcmd = {
4781                 .id = IWM_MCC_UPDATE_CMD,
4782                 .flags = (IWM_CMD_SYNC | IWM_CMD_WANT_SKB),
4783                 .data = { &mcc_cmd },
4784         };
4785         int ret;
4786 #ifdef IWM_DEBUG
4787         struct iwm_rx_packet *pkt;
4788         struct iwm_mcc_update_resp_v1 *mcc_resp_v1 = NULL;
4789         struct iwm_mcc_update_resp *mcc_resp;
4790         int n_channels;
4791         uint16_t mcc;
4792 #endif
4793         int resp_v2 = fw_has_capa(&sc->ucode_capa,
4794             IWM_UCODE_TLV_CAPA_LAR_SUPPORT_V2);
4795
4796         memset(&mcc_cmd, 0, sizeof(mcc_cmd));
4797         mcc_cmd.mcc = htole16(alpha2[0] << 8 | alpha2[1]);
4798         if (fw_has_api(&sc->ucode_capa, IWM_UCODE_TLV_API_WIFI_MCC_UPDATE) ||
4799             fw_has_capa(&sc->ucode_capa, IWM_UCODE_TLV_CAPA_LAR_MULTI_MCC))
4800                 mcc_cmd.source_id = IWM_MCC_SOURCE_GET_CURRENT;
4801         else
4802                 mcc_cmd.source_id = IWM_MCC_SOURCE_OLD_FW;
4803
4804         if (resp_v2)
4805                 hcmd.len[0] = sizeof(struct iwm_mcc_update_cmd);
4806         else
4807                 hcmd.len[0] = sizeof(struct iwm_mcc_update_cmd_v1);
4808
4809         IWM_DPRINTF(sc, IWM_DEBUG_NODE,
4810             "send MCC update to FW with '%c%c' src = %d\n",
4811             alpha2[0], alpha2[1], mcc_cmd.source_id);
4812
4813         ret = iwm_send_cmd(sc, &hcmd);
4814         if (ret)
4815                 return ret;
4816
4817 #ifdef IWM_DEBUG
4818         pkt = hcmd.resp_pkt;
4819
4820         /* Extract MCC response */
4821         if (resp_v2) {
4822                 mcc_resp = (void *)pkt->data;
4823                 mcc = mcc_resp->mcc;
4824                 n_channels =  le32toh(mcc_resp->n_channels);
4825         } else {
4826                 mcc_resp_v1 = (void *)pkt->data;
4827                 mcc = mcc_resp_v1->mcc;
4828                 n_channels =  le32toh(mcc_resp_v1->n_channels);
4829         }
4830
4831         /* W/A for a FW/NVM issue - returns 0x00 for the world domain */
4832         if (mcc == 0)
4833                 mcc = 0x3030;  /* "00" - world */
4834
4835         IWM_DPRINTF(sc, IWM_DEBUG_NODE,
4836             "regulatory domain '%c%c' (%d channels available)\n",
4837             mcc >> 8, mcc & 0xff, n_channels);
4838 #endif
4839         iwm_free_resp(sc, &hcmd);
4840
4841         return 0;
4842 }
4843
4844 static void
4845 iwm_mvm_tt_tx_backoff(struct iwm_softc *sc, uint32_t backoff)
4846 {
4847         struct iwm_host_cmd cmd = {
4848                 .id = IWM_REPLY_THERMAL_MNG_BACKOFF,
4849                 .len = { sizeof(uint32_t), },
4850                 .data = { &backoff, },
4851         };
4852
4853         if (iwm_send_cmd(sc, &cmd) != 0) {
4854                 device_printf(sc->sc_dev,
4855                     "failed to change thermal tx backoff\n");
4856         }
4857 }
4858
4859 static int
4860 iwm_init_hw(struct iwm_softc *sc)
4861 {
4862         struct ieee80211com *ic = &sc->sc_ic;
4863         int error, i, ac;
4864
4865         if ((error = iwm_start_hw(sc)) != 0) {
4866                 printf("iwm_start_hw: failed %d\n", error);
4867                 return error;
4868         }
4869
4870         if ((error = iwm_run_init_mvm_ucode(sc, 0)) != 0) {
4871                 printf("iwm_run_init_mvm_ucode: failed %d\n", error);
4872                 return error;
4873         }
4874
4875         /*
4876          * should stop and start HW since that INIT
4877          * image just loaded
4878          */
4879         iwm_stop_device(sc);
4880         sc->sc_ps_disabled = FALSE;
4881         if ((error = iwm_start_hw(sc)) != 0) {
4882                 device_printf(sc->sc_dev, "could not initialize hardware\n");
4883                 return error;
4884         }
4885
4886         /* omstart, this time with the regular firmware */
4887         error = iwm_mvm_load_ucode_wait_alive(sc, IWM_UCODE_REGULAR);
4888         if (error) {
4889                 device_printf(sc->sc_dev, "could not load firmware\n");
4890                 goto error;
4891         }
4892
4893         if ((error = iwm_send_bt_init_conf(sc)) != 0) {
4894                 device_printf(sc->sc_dev, "bt init conf failed\n");
4895                 goto error;
4896         }
4897
4898         error = iwm_send_tx_ant_cfg(sc, iwm_mvm_get_valid_tx_ant(sc));
4899         if (error != 0) {
4900                 device_printf(sc->sc_dev, "antenna config failed\n");
4901                 goto error;
4902         }
4903
4904         /* Send phy db control command and then phy db calibration */
4905         if ((error = iwm_send_phy_db_data(sc->sc_phy_db)) != 0)
4906                 goto error;
4907
4908         if ((error = iwm_send_phy_cfg_cmd(sc)) != 0) {
4909                 device_printf(sc->sc_dev, "phy_cfg_cmd failed\n");
4910                 goto error;
4911         }
4912
4913         /* Add auxiliary station for scanning */
4914         if ((error = iwm_mvm_add_aux_sta(sc)) != 0) {
4915                 device_printf(sc->sc_dev, "add_aux_sta failed\n");
4916                 goto error;
4917         }
4918
4919         for (i = 0; i < IWM_NUM_PHY_CTX; i++) {
4920                 /*
4921                  * The channel used here isn't relevant as it's
4922                  * going to be overwritten in the other flows.
4923                  * For now use the first channel we have.
4924                  */
4925                 if ((error = iwm_mvm_phy_ctxt_add(sc,
4926                     &sc->sc_phyctxt[i], &ic->ic_channels[1], 1, 1)) != 0)
4927                         goto error;
4928         }
4929
4930         /* Initialize tx backoffs to the minimum. */
4931         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_7000)
4932                 iwm_mvm_tt_tx_backoff(sc, 0);
4933
4934         error = iwm_mvm_power_update_device(sc);
4935         if (error)
4936                 goto error;
4937
4938         if (fw_has_capa(&sc->ucode_capa, IWM_UCODE_TLV_CAPA_LAR_SUPPORT)) {
4939                 if ((error = iwm_send_update_mcc_cmd(sc, "ZZ")) != 0)
4940                         goto error;
4941         }
4942
4943         if (fw_has_capa(&sc->ucode_capa, IWM_UCODE_TLV_CAPA_UMAC_SCAN)) {
4944                 if ((error = iwm_mvm_config_umac_scan(sc)) != 0)
4945                         goto error;
4946         }
4947
4948         /* Enable Tx queues. */
4949         for (ac = 0; ac < WME_NUM_AC; ac++) {
4950                 error = iwm_enable_txq(sc, IWM_STATION_ID, ac,
4951                     iwm_mvm_ac_to_tx_fifo[ac]);
4952                 if (error)
4953                         goto error;
4954         }
4955
4956         if ((error = iwm_mvm_disable_beacon_filter(sc)) != 0) {
4957                 device_printf(sc->sc_dev, "failed to disable beacon filter\n");
4958                 goto error;
4959         }
4960
4961         return 0;
4962
4963  error:
4964         iwm_stop_device(sc);
4965         return error;
4966 }
4967
4968 /* Allow multicast from our BSSID. */
4969 static int
4970 iwm_allow_mcast(struct ieee80211vap *vap, struct iwm_softc *sc)
4971 {
4972         struct ieee80211_node *ni = vap->iv_bss;
4973         struct iwm_mcast_filter_cmd *cmd;
4974         size_t size;
4975         int error;
4976
4977         size = roundup(sizeof(*cmd), 4);
4978         cmd = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
4979         if (cmd == NULL)
4980                 return ENOMEM;
4981         cmd->filter_own = 1;
4982         cmd->port_id = 0;
4983         cmd->count = 0;
4984         cmd->pass_all = 1;
4985         IEEE80211_ADDR_COPY(cmd->bssid, ni->ni_bssid);
4986
4987         error = iwm_mvm_send_cmd_pdu(sc, IWM_MCAST_FILTER_CMD,
4988             IWM_CMD_SYNC, size, cmd);
4989         free(cmd, M_DEVBUF);
4990
4991         return (error);
4992 }
4993
4994 /*
4995  * ifnet interfaces
4996  */
4997
4998 static void
4999 iwm_init(struct iwm_softc *sc)
5000 {
5001         int error;
5002
5003         if (sc->sc_flags & IWM_FLAG_HW_INITED) {
5004                 return;
5005         }
5006         sc->sc_generation++;
5007         sc->sc_flags &= ~IWM_FLAG_STOPPED;
5008
5009         if ((error = iwm_init_hw(sc)) != 0) {
5010                 printf("iwm_init_hw failed %d\n", error);
5011                 iwm_stop(sc);
5012                 return;
5013         }
5014
5015         /*
5016          * Ok, firmware loaded and we are jogging
5017          */
5018         sc->sc_flags |= IWM_FLAG_HW_INITED;
5019         callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc);
5020 }
5021
5022 static int
5023 iwm_transmit(struct ieee80211com *ic, struct mbuf *m)
5024 {
5025         struct iwm_softc *sc;
5026         int error;
5027
5028         sc = ic->ic_softc;
5029
5030         IWM_LOCK(sc);
5031         if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
5032                 IWM_UNLOCK(sc);
5033                 return (ENXIO);
5034         }
5035         error = mbufq_enqueue(&sc->sc_snd, m);
5036         if (error) {
5037                 IWM_UNLOCK(sc);
5038                 return (error);
5039         }
5040         iwm_start(sc);
5041         IWM_UNLOCK(sc);
5042         return (0);
5043 }
5044
5045 /*
5046  * Dequeue packets from sendq and call send.
5047  */
5048 static void
5049 iwm_start(struct iwm_softc *sc)
5050 {
5051         struct ieee80211_node *ni;
5052         struct mbuf *m;
5053         int ac = 0;
5054
5055         IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "->%s\n", __func__);
5056         while (sc->qfullmsk == 0 &&
5057                 (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
5058                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
5059                 if (iwm_tx(sc, m, ni, ac) != 0) {
5060                         if_inc_counter(ni->ni_vap->iv_ifp,
5061                             IFCOUNTER_OERRORS, 1);
5062                         ieee80211_free_node(ni);
5063                         continue;
5064                 }
5065                 sc->sc_tx_timer = 15;
5066         }
5067         IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "<-%s\n", __func__);
5068 }
5069
5070 static void
5071 iwm_stop(struct iwm_softc *sc)
5072 {
5073
5074         sc->sc_flags &= ~IWM_FLAG_HW_INITED;
5075         sc->sc_flags |= IWM_FLAG_STOPPED;
5076         sc->sc_generation++;
5077         iwm_led_blink_stop(sc);
5078         sc->sc_tx_timer = 0;
5079         iwm_stop_device(sc);
5080         sc->sc_flags &= ~IWM_FLAG_SCAN_RUNNING;
5081 }
5082
5083 static void
5084 iwm_watchdog(void *arg)
5085 {
5086         struct iwm_softc *sc = arg;
5087         struct ieee80211com *ic = &sc->sc_ic;
5088
5089         if (sc->sc_tx_timer > 0) {
5090                 if (--sc->sc_tx_timer == 0) {
5091                         device_printf(sc->sc_dev, "device timeout\n");
5092 #ifdef IWM_DEBUG
5093                         iwm_nic_error(sc);
5094 #endif
5095                         ieee80211_restart_all(ic);
5096                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
5097                         return;
5098                 }
5099         }
5100         callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc);
5101 }
5102
5103 static void
5104 iwm_parent(struct ieee80211com *ic)
5105 {
5106         struct iwm_softc *sc = ic->ic_softc;
5107         int startall = 0;
5108
5109         IWM_LOCK(sc);
5110         if (ic->ic_nrunning > 0) {
5111                 if (!(sc->sc_flags & IWM_FLAG_HW_INITED)) {
5112                         iwm_init(sc);
5113                         startall = 1;
5114                 }
5115         } else if (sc->sc_flags & IWM_FLAG_HW_INITED)
5116                 iwm_stop(sc);
5117         IWM_UNLOCK(sc);
5118         if (startall)
5119                 ieee80211_start_all(ic);
5120 }
5121
5122 /*
5123  * The interrupt side of things
5124  */
5125
5126 /*
5127  * error dumping routines are from iwlwifi/mvm/utils.c
5128  */
5129
5130 /*
5131  * Note: This structure is read from the device with IO accesses,
5132  * and the reading already does the endian conversion. As it is
5133  * read with uint32_t-sized accesses, any members with a different size
5134  * need to be ordered correctly though!
5135  */
5136 struct iwm_error_event_table {
5137         uint32_t valid;         /* (nonzero) valid, (0) log is empty */
5138         uint32_t error_id;              /* type of error */
5139         uint32_t trm_hw_status0;        /* TRM HW status */
5140         uint32_t trm_hw_status1;        /* TRM HW status */
5141         uint32_t blink2;                /* branch link */
5142         uint32_t ilink1;                /* interrupt link */
5143         uint32_t ilink2;                /* interrupt link */
5144         uint32_t data1;         /* error-specific data */
5145         uint32_t data2;         /* error-specific data */
5146         uint32_t data3;         /* error-specific data */
5147         uint32_t bcon_time;             /* beacon timer */
5148         uint32_t tsf_low;               /* network timestamp function timer */
5149         uint32_t tsf_hi;                /* network timestamp function timer */
5150         uint32_t gp1;           /* GP1 timer register */
5151         uint32_t gp2;           /* GP2 timer register */
5152         uint32_t fw_rev_type;   /* firmware revision type */
5153         uint32_t major;         /* uCode version major */
5154         uint32_t minor;         /* uCode version minor */
5155         uint32_t hw_ver;                /* HW Silicon version */
5156         uint32_t brd_ver;               /* HW board version */
5157         uint32_t log_pc;                /* log program counter */
5158         uint32_t frame_ptr;             /* frame pointer */
5159         uint32_t stack_ptr;             /* stack pointer */
5160         uint32_t hcmd;          /* last host command header */
5161         uint32_t isr0;          /* isr status register LMPM_NIC_ISR0:
5162                                  * rxtx_flag */
5163         uint32_t isr1;          /* isr status register LMPM_NIC_ISR1:
5164                                  * host_flag */
5165         uint32_t isr2;          /* isr status register LMPM_NIC_ISR2:
5166                                  * enc_flag */
5167         uint32_t isr3;          /* isr status register LMPM_NIC_ISR3:
5168                                  * time_flag */
5169         uint32_t isr4;          /* isr status register LMPM_NIC_ISR4:
5170                                  * wico interrupt */
5171         uint32_t last_cmd_id;   /* last HCMD id handled by the firmware */
5172         uint32_t wait_event;            /* wait event() caller address */
5173         uint32_t l2p_control;   /* L2pControlField */
5174         uint32_t l2p_duration;  /* L2pDurationField */
5175         uint32_t l2p_mhvalid;   /* L2pMhValidBits */
5176         uint32_t l2p_addr_match;        /* L2pAddrMatchStat */
5177         uint32_t lmpm_pmg_sel;  /* indicate which clocks are turned on
5178                                  * (LMPM_PMG_SEL) */
5179         uint32_t u_timestamp;   /* indicate when the date and time of the
5180                                  * compilation */
5181         uint32_t flow_handler;  /* FH read/write pointers, RX credit */
5182 } __packed /* LOG_ERROR_TABLE_API_S_VER_3 */;
5183
5184 /*
5185  * UMAC error struct - relevant starting from family 8000 chip.
5186  * Note: This structure is read from the device with IO accesses,
5187  * and the reading already does the endian conversion. As it is
5188  * read with u32-sized accesses, any members with a different size
5189  * need to be ordered correctly though!
5190  */
5191 struct iwm_umac_error_event_table {
5192         uint32_t valid;         /* (nonzero) valid, (0) log is empty */
5193         uint32_t error_id;      /* type of error */
5194         uint32_t blink1;        /* branch link */
5195         uint32_t blink2;        /* branch link */
5196         uint32_t ilink1;        /* interrupt link */
5197         uint32_t ilink2;        /* interrupt link */
5198         uint32_t data1;         /* error-specific data */
5199         uint32_t data2;         /* error-specific data */
5200         uint32_t data3;         /* error-specific data */
5201         uint32_t umac_major;
5202         uint32_t umac_minor;
5203         uint32_t frame_pointer; /* core register 27*/
5204         uint32_t stack_pointer; /* core register 28 */
5205         uint32_t cmd_header;    /* latest host cmd sent to UMAC */
5206         uint32_t nic_isr_pref;  /* ISR status register */
5207 } __packed;
5208
5209 #define ERROR_START_OFFSET  (1 * sizeof(uint32_t))
5210 #define ERROR_ELEM_SIZE     (7 * sizeof(uint32_t))
5211
5212 #ifdef IWM_DEBUG
5213 struct {
5214         const char *name;
5215         uint8_t num;
5216 } advanced_lookup[] = {
5217         { "NMI_INTERRUPT_WDG", 0x34 },
5218         { "SYSASSERT", 0x35 },
5219         { "UCODE_VERSION_MISMATCH", 0x37 },
5220         { "BAD_COMMAND", 0x38 },
5221         { "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C },
5222         { "FATAL_ERROR", 0x3D },
5223         { "NMI_TRM_HW_ERR", 0x46 },
5224         { "NMI_INTERRUPT_TRM", 0x4C },
5225         { "NMI_INTERRUPT_BREAK_POINT", 0x54 },
5226         { "NMI_INTERRUPT_WDG_RXF_FULL", 0x5C },
5227         { "NMI_INTERRUPT_WDG_NO_RBD_RXF_FULL", 0x64 },
5228         { "NMI_INTERRUPT_HOST", 0x66 },
5229         { "NMI_INTERRUPT_ACTION_PT", 0x7C },
5230         { "NMI_INTERRUPT_UNKNOWN", 0x84 },
5231         { "NMI_INTERRUPT_INST_ACTION_PT", 0x86 },
5232         { "ADVANCED_SYSASSERT", 0 },
5233 };
5234
5235 static const char *
5236 iwm_desc_lookup(uint32_t num)
5237 {
5238         int i;
5239
5240         for (i = 0; i < nitems(advanced_lookup) - 1; i++)
5241                 if (advanced_lookup[i].num == num)
5242                         return advanced_lookup[i].name;
5243
5244         /* No entry matches 'num', so it is the last: ADVANCED_SYSASSERT */
5245         return advanced_lookup[i].name;
5246 }
5247
5248 static void
5249 iwm_nic_umac_error(struct iwm_softc *sc)
5250 {
5251         struct iwm_umac_error_event_table table;
5252         uint32_t base;
5253
5254         base = sc->umac_error_event_table;
5255
5256         if (base < 0x800000) {
5257                 device_printf(sc->sc_dev, "Invalid error log pointer 0x%08x\n",
5258                     base);
5259                 return;
5260         }
5261
5262         if (iwm_read_mem(sc, base, &table, sizeof(table)/sizeof(uint32_t))) {
5263                 device_printf(sc->sc_dev, "reading errlog failed\n");
5264                 return;
5265         }
5266
5267         if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) {
5268                 device_printf(sc->sc_dev, "Start UMAC Error Log Dump:\n");
5269                 device_printf(sc->sc_dev, "Status: 0x%x, count: %d\n",
5270                     sc->sc_flags, table.valid);
5271         }
5272
5273         device_printf(sc->sc_dev, "0x%08X | %s\n", table.error_id,
5274                 iwm_desc_lookup(table.error_id));
5275         device_printf(sc->sc_dev, "0x%08X | umac branchlink1\n", table.blink1);
5276         device_printf(sc->sc_dev, "0x%08X | umac branchlink2\n", table.blink2);
5277         device_printf(sc->sc_dev, "0x%08X | umac interruptlink1\n",
5278             table.ilink1);
5279         device_printf(sc->sc_dev, "0x%08X | umac interruptlink2\n",
5280             table.ilink2);
5281         device_printf(sc->sc_dev, "0x%08X | umac data1\n", table.data1);
5282         device_printf(sc->sc_dev, "0x%08X | umac data2\n", table.data2);
5283         device_printf(sc->sc_dev, "0x%08X | umac data3\n", table.data3);
5284         device_printf(sc->sc_dev, "0x%08X | umac major\n", table.umac_major);
5285         device_printf(sc->sc_dev, "0x%08X | umac minor\n", table.umac_minor);
5286         device_printf(sc->sc_dev, "0x%08X | frame pointer\n",
5287             table.frame_pointer);
5288         device_printf(sc->sc_dev, "0x%08X | stack pointer\n",
5289             table.stack_pointer);
5290         device_printf(sc->sc_dev, "0x%08X | last host cmd\n", table.cmd_header);
5291         device_printf(sc->sc_dev, "0x%08X | isr status reg\n",
5292             table.nic_isr_pref);
5293 }
5294
5295 /*
5296  * Support for dumping the error log seemed like a good idea ...
5297  * but it's mostly hex junk and the only sensible thing is the
5298  * hw/ucode revision (which we know anyway).  Since it's here,
5299  * I'll just leave it in, just in case e.g. the Intel guys want to
5300  * help us decipher some "ADVANCED_SYSASSERT" later.
5301  */
5302 static void
5303 iwm_nic_error(struct iwm_softc *sc)
5304 {
5305         struct iwm_error_event_table table;
5306         uint32_t base;
5307
5308         device_printf(sc->sc_dev, "dumping device error log\n");
5309         base = sc->error_event_table;
5310         if (base < 0x800000) {
5311                 device_printf(sc->sc_dev,
5312                     "Invalid error log pointer 0x%08x\n", base);
5313                 return;
5314         }
5315
5316         if (iwm_read_mem(sc, base, &table, sizeof(table)/sizeof(uint32_t))) {
5317                 device_printf(sc->sc_dev, "reading errlog failed\n");
5318                 return;
5319         }
5320
5321         if (!table.valid) {
5322                 device_printf(sc->sc_dev, "errlog not found, skipping\n");
5323                 return;
5324         }
5325
5326         if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) {
5327                 device_printf(sc->sc_dev, "Start Error Log Dump:\n");
5328                 device_printf(sc->sc_dev, "Status: 0x%x, count: %d\n",
5329                     sc->sc_flags, table.valid);
5330         }
5331
5332         device_printf(sc->sc_dev, "0x%08X | %-28s\n", table.error_id,
5333             iwm_desc_lookup(table.error_id));
5334         device_printf(sc->sc_dev, "%08X | trm_hw_status0\n",
5335             table.trm_hw_status0);
5336         device_printf(sc->sc_dev, "%08X | trm_hw_status1\n",
5337             table.trm_hw_status1);
5338         device_printf(sc->sc_dev, "%08X | branchlink2\n", table.blink2);
5339         device_printf(sc->sc_dev, "%08X | interruptlink1\n", table.ilink1);
5340         device_printf(sc->sc_dev, "%08X | interruptlink2\n", table.ilink2);
5341         device_printf(sc->sc_dev, "%08X | data1\n", table.data1);
5342         device_printf(sc->sc_dev, "%08X | data2\n", table.data2);
5343         device_printf(sc->sc_dev, "%08X | data3\n", table.data3);
5344         device_printf(sc->sc_dev, "%08X | beacon time\n", table.bcon_time);
5345         device_printf(sc->sc_dev, "%08X | tsf low\n", table.tsf_low);
5346         device_printf(sc->sc_dev, "%08X | tsf hi\n", table.tsf_hi);
5347         device_printf(sc->sc_dev, "%08X | time gp1\n", table.gp1);
5348         device_printf(sc->sc_dev, "%08X | time gp2\n", table.gp2);
5349         device_printf(sc->sc_dev, "%08X | uCode revision type\n",
5350             table.fw_rev_type);
5351         device_printf(sc->sc_dev, "%08X | uCode version major\n", table.major);
5352         device_printf(sc->sc_dev, "%08X | uCode version minor\n", table.minor);
5353         device_printf(sc->sc_dev, "%08X | hw version\n", table.hw_ver);
5354         device_printf(sc->sc_dev, "%08X | board version\n", table.brd_ver);
5355         device_printf(sc->sc_dev, "%08X | hcmd\n", table.hcmd);
5356         device_printf(sc->sc_dev, "%08X | isr0\n", table.isr0);
5357         device_printf(sc->sc_dev, "%08X | isr1\n", table.isr1);
5358         device_printf(sc->sc_dev, "%08X | isr2\n", table.isr2);
5359         device_printf(sc->sc_dev, "%08X | isr3\n", table.isr3);
5360         device_printf(sc->sc_dev, "%08X | isr4\n", table.isr4);
5361         device_printf(sc->sc_dev, "%08X | last cmd Id\n", table.last_cmd_id);
5362         device_printf(sc->sc_dev, "%08X | wait_event\n", table.wait_event);
5363         device_printf(sc->sc_dev, "%08X | l2p_control\n", table.l2p_control);
5364         device_printf(sc->sc_dev, "%08X | l2p_duration\n", table.l2p_duration);
5365         device_printf(sc->sc_dev, "%08X | l2p_mhvalid\n", table.l2p_mhvalid);
5366         device_printf(sc->sc_dev, "%08X | l2p_addr_match\n", table.l2p_addr_match);
5367         device_printf(sc->sc_dev, "%08X | lmpm_pmg_sel\n", table.lmpm_pmg_sel);
5368         device_printf(sc->sc_dev, "%08X | timestamp\n", table.u_timestamp);
5369         device_printf(sc->sc_dev, "%08X | flow_handler\n", table.flow_handler);
5370
5371         if (sc->umac_error_event_table)
5372                 iwm_nic_umac_error(sc);
5373 }
5374 #endif
5375
5376 #define ADVANCE_RXQ(sc) (sc->rxq.cur = (sc->rxq.cur + 1) % IWM_RX_RING_COUNT);
5377
5378 /*
5379  * Process an IWM_CSR_INT_BIT_FH_RX or IWM_CSR_INT_BIT_SW_RX interrupt.
5380  * Basic structure from if_iwn
5381  */
5382 static void
5383 iwm_notif_intr(struct iwm_softc *sc)
5384 {
5385         struct ieee80211com *ic = &sc->sc_ic;
5386         uint16_t hw;
5387
5388         bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
5389             BUS_DMASYNC_POSTREAD);
5390
5391         hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff;
5392
5393         /*
5394          * Process responses
5395          */
5396         while (sc->rxq.cur != hw) {
5397                 struct iwm_rx_ring *ring = &sc->rxq;
5398                 struct iwm_rx_data *data = &ring->data[ring->cur];
5399                 struct iwm_rx_packet *pkt;
5400                 struct iwm_cmd_response *cresp;
5401                 int qid, idx, code;
5402
5403                 bus_dmamap_sync(ring->data_dmat, data->map,
5404                     BUS_DMASYNC_POSTREAD);
5405                 pkt = mtod(data->m, struct iwm_rx_packet *);
5406
5407                 qid = pkt->hdr.qid & ~0x80;
5408                 idx = pkt->hdr.idx;
5409
5410                 code = IWM_WIDE_ID(pkt->hdr.flags, pkt->hdr.code);
5411                 IWM_DPRINTF(sc, IWM_DEBUG_INTR,
5412                     "rx packet qid=%d idx=%d type=%x %d %d\n",
5413                     pkt->hdr.qid & ~0x80, pkt->hdr.idx, code, ring->cur, hw);
5414
5415                 /*
5416                  * randomly get these from the firmware, no idea why.
5417                  * they at least seem harmless, so just ignore them for now
5418                  */
5419                 if (__predict_false((pkt->hdr.code == 0 && qid == 0 && idx == 0)
5420                     || pkt->len_n_flags == htole32(0x55550000))) {
5421                         ADVANCE_RXQ(sc);
5422                         continue;
5423                 }
5424
5425                 iwm_notification_wait_notify(sc->sc_notif_wait, code, pkt);
5426
5427                 switch (code) {
5428                 case IWM_REPLY_RX_PHY_CMD:
5429                         iwm_mvm_rx_rx_phy_cmd(sc, pkt, data);
5430                         break;
5431
5432                 case IWM_REPLY_RX_MPDU_CMD:
5433                         iwm_mvm_rx_rx_mpdu(sc, data->m);
5434                         break;
5435
5436                 case IWM_TX_CMD:
5437                         iwm_mvm_rx_tx_cmd(sc, pkt, data);
5438                         break;
5439
5440                 case IWM_MISSED_BEACONS_NOTIFICATION: {
5441                         struct iwm_missed_beacons_notif *resp;
5442                         int missed;
5443
5444                         /* XXX look at mac_id to determine interface ID */
5445                         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5446
5447                         resp = (void *)pkt->data;
5448                         missed = le32toh(resp->consec_missed_beacons);
5449
5450                         IWM_DPRINTF(sc, IWM_DEBUG_BEACON | IWM_DEBUG_STATE,
5451                             "%s: MISSED_BEACON: mac_id=%d, "
5452                             "consec_since_last_rx=%d, consec=%d, num_expect=%d "
5453                             "num_rx=%d\n",
5454                             __func__,
5455                             le32toh(resp->mac_id),
5456                             le32toh(resp->consec_missed_beacons_since_last_rx),
5457                             le32toh(resp->consec_missed_beacons),
5458                             le32toh(resp->num_expected_beacons),
5459                             le32toh(resp->num_recvd_beacons));
5460
5461                         /* Be paranoid */
5462                         if (vap == NULL)
5463                                 break;
5464
5465                         /* XXX no net80211 locking? */
5466                         if (vap->iv_state == IEEE80211_S_RUN &&
5467                             (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
5468                                 if (missed > vap->iv_bmissthreshold) {
5469                                         /* XXX bad locking; turn into task */
5470                                         IWM_UNLOCK(sc);
5471                                         ieee80211_beacon_miss(ic);
5472                                         IWM_LOCK(sc);
5473                                 }
5474                         }
5475
5476                         break;
5477                 }
5478
5479                 case IWM_MFUART_LOAD_NOTIFICATION:
5480                         break;
5481
5482                 case IWM_MVM_ALIVE:
5483                         break;
5484
5485                 case IWM_CALIB_RES_NOTIF_PHY_DB:
5486                         break;
5487
5488                 case IWM_STATISTICS_NOTIFICATION: {
5489                         struct iwm_notif_statistics *stats;
5490                         stats = (void *)pkt->data;
5491                         memcpy(&sc->sc_stats, stats, sizeof(sc->sc_stats));
5492                         sc->sc_noise = iwm_get_noise(sc, &stats->rx.general);
5493                         break;
5494                 }
5495
5496                 case IWM_NVM_ACCESS_CMD:
5497                 case IWM_MCC_UPDATE_CMD:
5498                         if (sc->sc_wantresp == ((qid << 16) | idx)) {
5499                                 memcpy(sc->sc_cmd_resp,
5500                                     pkt, sizeof(sc->sc_cmd_resp));
5501                         }
5502                         break;
5503
5504                 case IWM_MCC_CHUB_UPDATE_CMD: {
5505                         struct iwm_mcc_chub_notif *notif;
5506                         notif = (void *)pkt->data;
5507
5508                         sc->sc_fw_mcc[0] = (notif->mcc & 0xff00) >> 8;
5509                         sc->sc_fw_mcc[1] = notif->mcc & 0xff;
5510                         sc->sc_fw_mcc[2] = '\0';
5511                         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
5512                             "fw source %d sent CC '%s'\n",
5513                             notif->source_id, sc->sc_fw_mcc);
5514                         break;
5515                 }
5516
5517                 case IWM_DTS_MEASUREMENT_NOTIFICATION:
5518                 case IWM_WIDE_ID(IWM_PHY_OPS_GROUP,
5519                                  IWM_DTS_MEASUREMENT_NOTIF_WIDE): {
5520                         struct iwm_dts_measurement_notif_v1 *notif;
5521
5522                         if (iwm_rx_packet_payload_len(pkt) < sizeof(*notif)) {
5523                                 device_printf(sc->sc_dev,
5524                                     "Invalid DTS_MEASUREMENT_NOTIFICATION\n");
5525                                 break;
5526                         }
5527                         notif = (void *)pkt->data;
5528                         IWM_DPRINTF(sc, IWM_DEBUG_TEMP,
5529                             "IWM_DTS_MEASUREMENT_NOTIFICATION - %d\n",
5530                             notif->temp);
5531                         break;
5532                 }
5533
5534                 case IWM_PHY_CONFIGURATION_CMD:
5535                 case IWM_TX_ANT_CONFIGURATION_CMD:
5536                 case IWM_ADD_STA:
5537                 case IWM_MAC_CONTEXT_CMD:
5538                 case IWM_REPLY_SF_CFG_CMD:
5539                 case IWM_POWER_TABLE_CMD:
5540                 case IWM_PHY_CONTEXT_CMD:
5541                 case IWM_BINDING_CONTEXT_CMD:
5542                 case IWM_TIME_EVENT_CMD:
5543                 case IWM_WIDE_ID(IWM_ALWAYS_LONG_GROUP, IWM_SCAN_CFG_CMD):
5544                 case IWM_WIDE_ID(IWM_ALWAYS_LONG_GROUP, IWM_SCAN_REQ_UMAC):
5545                 case IWM_SCAN_ABORT_UMAC:
5546                 case IWM_SCAN_OFFLOAD_REQUEST_CMD:
5547                 case IWM_SCAN_OFFLOAD_ABORT_CMD:
5548                 case IWM_REPLY_BEACON_FILTERING_CMD:
5549                 case IWM_MAC_PM_POWER_TABLE:
5550                 case IWM_TIME_QUOTA_CMD:
5551                 case IWM_REMOVE_STA:
5552                 case IWM_TXPATH_FLUSH:
5553                 case IWM_LQ_CMD:
5554                 case IWM_FW_PAGING_BLOCK_CMD:
5555                 case IWM_BT_CONFIG:
5556                 case IWM_REPLY_THERMAL_MNG_BACKOFF:
5557                         cresp = (void *)pkt->data;
5558                         if (sc->sc_wantresp == ((qid << 16) | idx)) {
5559                                 memcpy(sc->sc_cmd_resp,
5560                                     pkt, sizeof(*pkt)+sizeof(*cresp));
5561                         }
5562                         break;
5563
5564                 /* ignore */
5565                 case 0x6c: /* IWM_PHY_DB_CMD, no idea why it's not in fw-api.h */
5566                         break;
5567
5568                 case IWM_INIT_COMPLETE_NOTIF:
5569                         break;
5570
5571                 case IWM_SCAN_OFFLOAD_COMPLETE:
5572                         iwm_mvm_rx_lmac_scan_complete_notif(sc, pkt);
5573                         if (sc->sc_flags & IWM_FLAG_SCAN_RUNNING) {
5574                                 sc->sc_flags &= ~IWM_FLAG_SCAN_RUNNING;
5575                                 ieee80211_runtask(ic, &sc->sc_es_task);
5576                         }
5577                         break;
5578
5579                 case IWM_SCAN_ITERATION_COMPLETE: {
5580                         struct iwm_lmac_scan_complete_notif *notif;
5581                         notif = (void *)pkt->data;
5582                         break;
5583                 }
5584
5585                 case IWM_SCAN_COMPLETE_UMAC:
5586                         iwm_mvm_rx_umac_scan_complete_notif(sc, pkt);
5587                         if (sc->sc_flags & IWM_FLAG_SCAN_RUNNING) {
5588                                 sc->sc_flags &= ~IWM_FLAG_SCAN_RUNNING;
5589                                 ieee80211_runtask(ic, &sc->sc_es_task);
5590                         }
5591                         break;
5592
5593                 case IWM_SCAN_ITERATION_COMPLETE_UMAC: {
5594                         struct iwm_umac_scan_iter_complete_notif *notif;
5595                         notif = (void *)pkt->data;
5596
5597                         IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "UMAC scan iteration "
5598                             "complete, status=0x%x, %d channels scanned\n",
5599                             notif->status, notif->scanned_channels);
5600                         break;
5601                 }
5602
5603                 case IWM_REPLY_ERROR: {
5604                         struct iwm_error_resp *resp;
5605                         resp = (void *)pkt->data;
5606
5607                         device_printf(sc->sc_dev,
5608                             "firmware error 0x%x, cmd 0x%x\n",
5609                             le32toh(resp->error_type),
5610                             resp->cmd_id);
5611                         break;
5612                 }
5613
5614                 case IWM_TIME_EVENT_NOTIFICATION: {
5615                         struct iwm_time_event_notif *notif;
5616                         notif = (void *)pkt->data;
5617
5618                         IWM_DPRINTF(sc, IWM_DEBUG_INTR,
5619                             "TE notif status = 0x%x action = 0x%x\n",
5620                             notif->status, notif->action);
5621                         break;
5622                 }
5623
5624                 case IWM_MCAST_FILTER_CMD:
5625                         break;
5626
5627                 case IWM_SCD_QUEUE_CFG: {
5628                         struct iwm_scd_txq_cfg_rsp *rsp;
5629                         rsp = (void *)pkt->data;
5630
5631                         IWM_DPRINTF(sc, IWM_DEBUG_CMD,
5632                             "queue cfg token=0x%x sta_id=%d "
5633                             "tid=%d scd_queue=%d\n",
5634                             rsp->token, rsp->sta_id, rsp->tid,
5635                             rsp->scd_queue);
5636                         break;
5637                 }
5638
5639                 default:
5640                         device_printf(sc->sc_dev,
5641                             "frame %d/%d %x UNHANDLED (this should "
5642                             "not happen)\n", qid, idx,
5643                             pkt->len_n_flags);
5644                         break;
5645                 }
5646
5647                 /*
5648                  * Why test bit 0x80?  The Linux driver:
5649                  *
5650                  * There is one exception:  uCode sets bit 15 when it
5651                  * originates the response/notification, i.e. when the
5652                  * response/notification is not a direct response to a
5653                  * command sent by the driver.  For example, uCode issues
5654                  * IWM_REPLY_RX when it sends a received frame to the driver;
5655                  * it is not a direct response to any driver command.
5656                  *
5657                  * Ok, so since when is 7 == 15?  Well, the Linux driver
5658                  * uses a slightly different format for pkt->hdr, and "qid"
5659                  * is actually the upper byte of a two-byte field.
5660                  */
5661                 if (!(pkt->hdr.qid & (1 << 7))) {
5662                         iwm_cmd_done(sc, pkt);
5663                 }
5664
5665                 ADVANCE_RXQ(sc);
5666         }
5667
5668         /*
5669          * Tell the firmware what we have processed.
5670          * Seems like the hardware gets upset unless we align
5671          * the write by 8??
5672          */
5673         hw = (hw == 0) ? IWM_RX_RING_COUNT - 1 : hw - 1;
5674         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, hw & ~7);
5675 }
5676
5677 static void
5678 iwm_intr(void *arg)
5679 {
5680         struct iwm_softc *sc = arg;
5681         int handled = 0;
5682         int r1, r2, rv = 0;
5683         int isperiodic = 0;
5684
5685         IWM_LOCK(sc);
5686         IWM_WRITE(sc, IWM_CSR_INT_MASK, 0);
5687
5688         if (sc->sc_flags & IWM_FLAG_USE_ICT) {
5689                 uint32_t *ict = sc->ict_dma.vaddr;
5690                 int tmp;
5691
5692                 tmp = htole32(ict[sc->ict_cur]);
5693                 if (!tmp)
5694                         goto out_ena;
5695
5696                 /*
5697                  * ok, there was something.  keep plowing until we have all.
5698                  */
5699                 r1 = r2 = 0;
5700                 while (tmp) {
5701                         r1 |= tmp;
5702                         ict[sc->ict_cur] = 0;
5703                         sc->ict_cur = (sc->ict_cur+1) % IWM_ICT_COUNT;
5704                         tmp = htole32(ict[sc->ict_cur]);
5705                 }
5706
5707                 /* this is where the fun begins.  don't ask */
5708                 if (r1 == 0xffffffff)
5709                         r1 = 0;
5710
5711                 /* i am not expected to understand this */
5712                 if (r1 & 0xc0000)
5713                         r1 |= 0x8000;
5714                 r1 = (0xff & r1) | ((0xff00 & r1) << 16);
5715         } else {
5716                 r1 = IWM_READ(sc, IWM_CSR_INT);
5717                 /* "hardware gone" (where, fishing?) */
5718                 if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0)
5719                         goto out;
5720                 r2 = IWM_READ(sc, IWM_CSR_FH_INT_STATUS);
5721         }
5722         if (r1 == 0 && r2 == 0) {
5723                 goto out_ena;
5724         }
5725
5726         IWM_WRITE(sc, IWM_CSR_INT, r1 | ~sc->sc_intmask);
5727
5728         /* Safely ignore these bits for debug checks below */
5729         r1 &= ~(IWM_CSR_INT_BIT_ALIVE | IWM_CSR_INT_BIT_SCD);
5730
5731         if (r1 & IWM_CSR_INT_BIT_SW_ERR) {
5732                 int i;
5733                 struct ieee80211com *ic = &sc->sc_ic;
5734                 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5735
5736 #ifdef IWM_DEBUG
5737                 iwm_nic_error(sc);
5738 #endif
5739                 /* Dump driver status (TX and RX rings) while we're here. */
5740                 device_printf(sc->sc_dev, "driver status:\n");
5741                 for (i = 0; i < IWM_MVM_MAX_QUEUES; i++) {
5742                         struct iwm_tx_ring *ring = &sc->txq[i];
5743                         device_printf(sc->sc_dev,
5744                             "  tx ring %2d: qid=%-2d cur=%-3d "
5745                             "queued=%-3d\n",
5746                             i, ring->qid, ring->cur, ring->queued);
5747                 }
5748                 device_printf(sc->sc_dev,
5749                     "  rx ring: cur=%d\n", sc->rxq.cur);
5750                 device_printf(sc->sc_dev,
5751                     "  802.11 state %d\n", (vap == NULL) ? -1 : vap->iv_state);
5752
5753                 /* Don't stop the device; just do a VAP restart */
5754                 IWM_UNLOCK(sc);
5755
5756                 if (vap == NULL) {
5757                         printf("%s: null vap\n", __func__);
5758                         return;
5759                 }
5760
5761                 device_printf(sc->sc_dev, "%s: controller panicked, iv_state = %d; "
5762                     "restarting\n", __func__, vap->iv_state);
5763
5764                 /* XXX TODO: turn this into a callout/taskqueue */
5765                 ieee80211_restart_all(ic);
5766                 return;
5767         }
5768
5769         if (r1 & IWM_CSR_INT_BIT_HW_ERR) {
5770                 handled |= IWM_CSR_INT_BIT_HW_ERR;
5771                 device_printf(sc->sc_dev, "hardware error, stopping device\n");
5772                 iwm_stop(sc);
5773                 rv = 1;
5774                 goto out;
5775         }
5776
5777         /* firmware chunk loaded */
5778         if (r1 & IWM_CSR_INT_BIT_FH_TX) {
5779                 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_TX_MASK);
5780                 handled |= IWM_CSR_INT_BIT_FH_TX;
5781                 sc->sc_fw_chunk_done = 1;
5782                 wakeup(&sc->sc_fw);
5783         }
5784
5785         if (r1 & IWM_CSR_INT_BIT_RF_KILL) {
5786                 handled |= IWM_CSR_INT_BIT_RF_KILL;
5787                 if (iwm_check_rfkill(sc)) {
5788                         device_printf(sc->sc_dev,
5789                             "%s: rfkill switch, disabling interface\n",
5790                             __func__);
5791                         iwm_stop(sc);
5792                 }
5793         }
5794
5795         /*
5796          * The Linux driver uses periodic interrupts to avoid races.
5797          * We cargo-cult like it's going out of fashion.
5798          */
5799         if (r1 & IWM_CSR_INT_BIT_RX_PERIODIC) {
5800                 handled |= IWM_CSR_INT_BIT_RX_PERIODIC;
5801                 IWM_WRITE(sc, IWM_CSR_INT, IWM_CSR_INT_BIT_RX_PERIODIC);
5802                 if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) == 0)
5803                         IWM_WRITE_1(sc,
5804                             IWM_CSR_INT_PERIODIC_REG, IWM_CSR_INT_PERIODIC_DIS);
5805                 isperiodic = 1;
5806         }
5807
5808         if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) || isperiodic) {
5809                 handled |= (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX);
5810                 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_RX_MASK);
5811
5812                 iwm_notif_intr(sc);
5813
5814                 /* enable periodic interrupt, see above */
5815                 if (r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX) && !isperiodic)
5816                         IWM_WRITE_1(sc, IWM_CSR_INT_PERIODIC_REG,
5817                             IWM_CSR_INT_PERIODIC_ENA);
5818         }
5819
5820         if (__predict_false(r1 & ~handled))
5821                 IWM_DPRINTF(sc, IWM_DEBUG_INTR,
5822                     "%s: unhandled interrupts: %x\n", __func__, r1);
5823         rv = 1;
5824
5825  out_ena:
5826         iwm_restore_interrupts(sc);
5827  out:
5828         IWM_UNLOCK(sc);
5829         return;
5830 }
5831
5832 /*
5833  * Autoconf glue-sniffing
5834  */
5835 #define PCI_VENDOR_INTEL                0x8086
5836 #define PCI_PRODUCT_INTEL_WL_3160_1     0x08b3
5837 #define PCI_PRODUCT_INTEL_WL_3160_2     0x08b4
5838 #define PCI_PRODUCT_INTEL_WL_3165_1     0x3165
5839 #define PCI_PRODUCT_INTEL_WL_3165_2     0x3166
5840 #define PCI_PRODUCT_INTEL_WL_7260_1     0x08b1
5841 #define PCI_PRODUCT_INTEL_WL_7260_2     0x08b2
5842 #define PCI_PRODUCT_INTEL_WL_7265_1     0x095a
5843 #define PCI_PRODUCT_INTEL_WL_7265_2     0x095b
5844 #define PCI_PRODUCT_INTEL_WL_8260_1     0x24f3
5845 #define PCI_PRODUCT_INTEL_WL_8260_2     0x24f4
5846
5847 static const struct iwm_devices {
5848         uint16_t                device;
5849         const struct iwm_cfg    *cfg;
5850 } iwm_devices[] = {
5851         { PCI_PRODUCT_INTEL_WL_3160_1, &iwm3160_cfg },
5852         { PCI_PRODUCT_INTEL_WL_3160_2, &iwm3160_cfg },
5853         { PCI_PRODUCT_INTEL_WL_3165_1, &iwm3165_cfg },
5854         { PCI_PRODUCT_INTEL_WL_3165_2, &iwm3165_cfg },
5855         { PCI_PRODUCT_INTEL_WL_7260_1, &iwm7260_cfg },
5856         { PCI_PRODUCT_INTEL_WL_7260_2, &iwm7260_cfg },
5857         { PCI_PRODUCT_INTEL_WL_7265_1, &iwm7265_cfg },
5858         { PCI_PRODUCT_INTEL_WL_7265_2, &iwm7265_cfg },
5859         { PCI_PRODUCT_INTEL_WL_8260_1, &iwm8260_cfg },
5860         { PCI_PRODUCT_INTEL_WL_8260_2, &iwm8260_cfg },
5861 };
5862
5863 static int
5864 iwm_probe(device_t dev)
5865 {
5866         int i;
5867
5868         for (i = 0; i < nitems(iwm_devices); i++) {
5869                 if (pci_get_vendor(dev) == PCI_VENDOR_INTEL &&
5870                     pci_get_device(dev) == iwm_devices[i].device) {
5871                         device_set_desc(dev, iwm_devices[i].cfg->name);
5872                         return (BUS_PROBE_DEFAULT);
5873                 }
5874         }
5875
5876         return (ENXIO);
5877 }
5878
5879 static int
5880 iwm_dev_check(device_t dev)
5881 {
5882         struct iwm_softc *sc;
5883         uint16_t devid;
5884         int i;
5885
5886         sc = device_get_softc(dev);
5887
5888         devid = pci_get_device(dev);
5889         for (i = 0; i < nitems(iwm_devices); i++) {
5890                 if (iwm_devices[i].device == devid) {
5891                         sc->cfg = iwm_devices[i].cfg;
5892                         return (0);
5893                 }
5894         }
5895         device_printf(dev, "unknown adapter type\n");
5896         return ENXIO;
5897 }
5898
5899 /* PCI registers */
5900 #define PCI_CFG_RETRY_TIMEOUT   0x041
5901
5902 static int
5903 iwm_pci_attach(device_t dev)
5904 {
5905         struct iwm_softc *sc;
5906         int count, error, rid;
5907         uint16_t reg;
5908
5909         sc = device_get_softc(dev);
5910
5911         /* We disable the RETRY_TIMEOUT register (0x41) to keep
5912          * PCI Tx retries from interfering with C3 CPU state */
5913         pci_write_config(dev, PCI_CFG_RETRY_TIMEOUT, 0x00, 1);
5914
5915         /* Enable bus-mastering and hardware bug workaround. */
5916         pci_enable_busmaster(dev);
5917         reg = pci_read_config(dev, PCIR_STATUS, sizeof(reg));
5918         /* if !MSI */
5919         if (reg & PCIM_STATUS_INTxSTATE) {
5920                 reg &= ~PCIM_STATUS_INTxSTATE;
5921         }
5922         pci_write_config(dev, PCIR_STATUS, reg, sizeof(reg));
5923
5924         rid = PCIR_BAR(0);
5925         sc->sc_mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
5926             RF_ACTIVE);
5927         if (sc->sc_mem == NULL) {
5928                 device_printf(sc->sc_dev, "can't map mem space\n");
5929                 return (ENXIO);
5930         }
5931         sc->sc_st = rman_get_bustag(sc->sc_mem);
5932         sc->sc_sh = rman_get_bushandle(sc->sc_mem);
5933
5934         /* Install interrupt handler. */
5935         count = 1;
5936         rid = 0;
5937         if (pci_alloc_msi(dev, &count) == 0)
5938                 rid = 1;
5939         sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
5940             (rid != 0 ? 0 : RF_SHAREABLE));
5941         if (sc->sc_irq == NULL) {
5942                 device_printf(dev, "can't map interrupt\n");
5943                         return (ENXIO);
5944         }
5945         error = bus_setup_intr(dev, sc->sc_irq, INTR_TYPE_NET | INTR_MPSAFE,
5946             NULL, iwm_intr, sc, &sc->sc_ih);
5947         if (sc->sc_ih == NULL) {
5948                 device_printf(dev, "can't establish interrupt");
5949                         return (ENXIO);
5950         }
5951         sc->sc_dmat = bus_get_dma_tag(sc->sc_dev);
5952
5953         return (0);
5954 }
5955
5956 static void
5957 iwm_pci_detach(device_t dev)
5958 {
5959         struct iwm_softc *sc = device_get_softc(dev);
5960
5961         if (sc->sc_irq != NULL) {
5962                 bus_teardown_intr(dev, sc->sc_irq, sc->sc_ih);
5963                 bus_release_resource(dev, SYS_RES_IRQ,
5964                     rman_get_rid(sc->sc_irq), sc->sc_irq);
5965                 pci_release_msi(dev);
5966         }
5967         if (sc->sc_mem != NULL)
5968                 bus_release_resource(dev, SYS_RES_MEMORY,
5969                     rman_get_rid(sc->sc_mem), sc->sc_mem);
5970 }
5971
5972
5973
5974 static int
5975 iwm_attach(device_t dev)
5976 {
5977         struct iwm_softc *sc = device_get_softc(dev);
5978         struct ieee80211com *ic = &sc->sc_ic;
5979         int error;
5980         int txq_i, i;
5981
5982         sc->sc_dev = dev;
5983         sc->sc_attached = 1;
5984         IWM_LOCK_INIT(sc);
5985         mbufq_init(&sc->sc_snd, ifqmaxlen);
5986         callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0);
5987         callout_init_mtx(&sc->sc_led_blink_to, &sc->sc_mtx, 0);
5988         TASK_INIT(&sc->sc_es_task, 0, iwm_endscan_cb, sc);
5989
5990         sc->sc_notif_wait = iwm_notification_wait_init(sc);
5991         if (sc->sc_notif_wait == NULL) {
5992                 device_printf(dev, "failed to init notification wait struct\n");
5993                 goto fail;
5994         }
5995
5996         /* Init phy db */
5997         sc->sc_phy_db = iwm_phy_db_init(sc);
5998         if (!sc->sc_phy_db) {
5999                 device_printf(dev, "Cannot init phy_db\n");
6000                 goto fail;
6001         }
6002
6003         /* Set EBS as successful as long as not stated otherwise by the FW. */
6004         sc->last_ebs_successful = TRUE;
6005
6006         /* PCI attach */
6007         error = iwm_pci_attach(dev);
6008         if (error != 0)
6009                 goto fail;
6010
6011         sc->sc_wantresp = -1;
6012
6013         /* Check device type */
6014         error = iwm_dev_check(dev);
6015         if (error != 0)
6016                 goto fail;
6017
6018         sc->sc_hw_rev = IWM_READ(sc, IWM_CSR_HW_REV);
6019         /*
6020          * In the 8000 HW family the format of the 4 bytes of CSR_HW_REV have
6021          * changed, and now the revision step also includes bit 0-1 (no more
6022          * "dash" value). To keep hw_rev backwards compatible - we'll store it
6023          * in the old format.
6024          */
6025         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_8000)
6026                 sc->sc_hw_rev = (sc->sc_hw_rev & 0xfff0) |
6027                                 (IWM_CSR_HW_REV_STEP(sc->sc_hw_rev << 2) << 2);
6028
6029         if (iwm_prepare_card_hw(sc) != 0) {
6030                 device_printf(dev, "could not initialize hardware\n");
6031                 goto fail;
6032         }
6033
6034         if (sc->cfg->device_family == IWM_DEVICE_FAMILY_8000) {
6035                 int ret;
6036                 uint32_t hw_step;
6037
6038                 /*
6039                  * In order to recognize C step the driver should read the
6040                  * chip version id located at the AUX bus MISC address.
6041                  */
6042                 IWM_SETBITS(sc, IWM_CSR_GP_CNTRL,
6043                             IWM_CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
6044                 DELAY(2);
6045
6046                 ret = iwm_poll_bit(sc, IWM_CSR_GP_CNTRL,
6047                                    IWM_CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
6048                                    IWM_CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
6049                                    25000);
6050                 if (!ret) {
6051                         device_printf(sc->sc_dev,
6052                             "Failed to wake up the nic\n");
6053                         goto fail;
6054                 }
6055
6056                 if (iwm_nic_lock(sc)) {
6057                         hw_step = iwm_read_prph(sc, IWM_WFPM_CTRL_REG);
6058                         hw_step |= IWM_ENABLE_WFPM;
6059                         iwm_write_prph(sc, IWM_WFPM_CTRL_REG, hw_step);
6060                         hw_step = iwm_read_prph(sc, IWM_AUX_MISC_REG);
6061                         hw_step = (hw_step >> IWM_HW_STEP_LOCATION_BITS) & 0xF;
6062                         if (hw_step == 0x3)
6063                                 sc->sc_hw_rev = (sc->sc_hw_rev & 0xFFFFFFF3) |
6064                                                 (IWM_SILICON_C_STEP << 2);
6065                         iwm_nic_unlock(sc);
6066                 } else {
6067                         device_printf(sc->sc_dev, "Failed to lock the nic\n");
6068                         goto fail;
6069                 }
6070         }
6071
6072         /* special-case 7265D, it has the same PCI IDs. */
6073         if (sc->cfg == &iwm7265_cfg &&
6074             (sc->sc_hw_rev & IWM_CSR_HW_REV_TYPE_MSK) == IWM_CSR_HW_REV_TYPE_7265D) {
6075                 sc->cfg = &iwm7265d_cfg;
6076         }
6077
6078         /* Allocate DMA memory for firmware transfers. */
6079         if ((error = iwm_alloc_fwmem(sc)) != 0) {
6080                 device_printf(dev, "could not allocate memory for firmware\n");
6081                 goto fail;
6082         }
6083
6084         /* Allocate "Keep Warm" page. */
6085         if ((error = iwm_alloc_kw(sc)) != 0) {
6086                 device_printf(dev, "could not allocate keep warm page\n");
6087                 goto fail;
6088         }
6089
6090         /* We use ICT interrupts */
6091         if ((error = iwm_alloc_ict(sc)) != 0) {
6092                 device_printf(dev, "could not allocate ICT table\n");
6093                 goto fail;
6094         }
6095
6096         /* Allocate TX scheduler "rings". */
6097         if ((error = iwm_alloc_sched(sc)) != 0) {
6098                 device_printf(dev, "could not allocate TX scheduler rings\n");
6099                 goto fail;
6100         }
6101
6102         /* Allocate TX rings */
6103         for (txq_i = 0; txq_i < nitems(sc->txq); txq_i++) {
6104                 if ((error = iwm_alloc_tx_ring(sc,
6105                     &sc->txq[txq_i], txq_i)) != 0) {
6106                         device_printf(dev,
6107                             "could not allocate TX ring %d\n",
6108                             txq_i);
6109                         goto fail;
6110                 }
6111         }
6112
6113         /* Allocate RX ring. */
6114         if ((error = iwm_alloc_rx_ring(sc, &sc->rxq)) != 0) {
6115                 device_printf(dev, "could not allocate RX ring\n");
6116                 goto fail;
6117         }
6118
6119         /* Clear pending interrupts. */
6120         IWM_WRITE(sc, IWM_CSR_INT, 0xffffffff);
6121
6122         ic->ic_softc = sc;
6123         ic->ic_name = device_get_nameunit(sc->sc_dev);
6124         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
6125         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
6126
6127         /* Set device capabilities. */
6128         ic->ic_caps =
6129             IEEE80211_C_STA |
6130             IEEE80211_C_WPA |           /* WPA/RSN */
6131             IEEE80211_C_WME |
6132             IEEE80211_C_PMGT |
6133             IEEE80211_C_SHSLOT |        /* short slot time supported */
6134             IEEE80211_C_SHPREAMBLE      /* short preamble supported */
6135 //          IEEE80211_C_BGSCAN          /* capable of bg scanning */
6136             ;
6137         /* Advertise full-offload scanning */
6138         ic->ic_flags_ext = IEEE80211_FEXT_SCAN_OFFLOAD;
6139         for (i = 0; i < nitems(sc->sc_phyctxt); i++) {
6140                 sc->sc_phyctxt[i].id = i;
6141                 sc->sc_phyctxt[i].color = 0;
6142                 sc->sc_phyctxt[i].ref = 0;
6143                 sc->sc_phyctxt[i].channel = NULL;
6144         }
6145
6146         /* Default noise floor */
6147         sc->sc_noise = -96;
6148
6149         /* Max RSSI */
6150         sc->sc_max_rssi = IWM_MAX_DBM - IWM_MIN_DBM;
6151
6152         sc->sc_preinit_hook.ich_func = iwm_preinit;
6153         sc->sc_preinit_hook.ich_arg = sc;
6154         if (config_intrhook_establish(&sc->sc_preinit_hook) != 0) {
6155                 device_printf(dev, "config_intrhook_establish failed\n");
6156                 goto fail;
6157         }
6158
6159 #ifdef IWM_DEBUG
6160         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6161             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "debug",
6162             CTLFLAG_RW, &sc->sc_debug, 0, "control debugging");
6163 #endif
6164
6165         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
6166             "<-%s\n", __func__);
6167
6168         return 0;
6169
6170         /* Free allocated memory if something failed during attachment. */
6171 fail:
6172         iwm_detach_local(sc, 0);
6173
6174         return ENXIO;
6175 }
6176
6177 static int
6178 iwm_is_valid_ether_addr(uint8_t *addr)
6179 {
6180         char zero_addr[IEEE80211_ADDR_LEN] = { 0, 0, 0, 0, 0, 0 };
6181
6182         if ((addr[0] & 1) || IEEE80211_ADDR_EQ(zero_addr, addr))
6183                 return (FALSE);
6184
6185         return (TRUE);
6186 }
6187
6188 static int
6189 iwm_update_edca(struct ieee80211com *ic)
6190 {
6191         struct iwm_softc *sc = ic->ic_softc;
6192
6193         device_printf(sc->sc_dev, "%s: called\n", __func__);
6194         return (0);
6195 }
6196
6197 static void
6198 iwm_preinit(void *arg)
6199 {
6200         struct iwm_softc *sc = arg;
6201         device_t dev = sc->sc_dev;
6202         struct ieee80211com *ic = &sc->sc_ic;
6203         int error;
6204
6205         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
6206             "->%s\n", __func__);
6207
6208         IWM_LOCK(sc);
6209         if ((error = iwm_start_hw(sc)) != 0) {
6210                 device_printf(dev, "could not initialize hardware\n");
6211                 IWM_UNLOCK(sc);
6212                 goto fail;
6213         }
6214
6215         error = iwm_run_init_mvm_ucode(sc, 1);
6216         iwm_stop_device(sc);
6217         if (error) {
6218                 IWM_UNLOCK(sc);
6219                 goto fail;
6220         }
6221         device_printf(dev,
6222             "hw rev 0x%x, fw ver %s, address %s\n",
6223             sc->sc_hw_rev & IWM_CSR_HW_REV_TYPE_MSK,
6224             sc->sc_fwver, ether_sprintf(sc->nvm_data->hw_addr));
6225
6226         /* not all hardware can do 5GHz band */
6227         if (!sc->nvm_data->sku_cap_band_52GHz_enable)
6228                 memset(&ic->ic_sup_rates[IEEE80211_MODE_11A], 0,
6229                     sizeof(ic->ic_sup_rates[IEEE80211_MODE_11A]));
6230         IWM_UNLOCK(sc);
6231
6232         iwm_init_channel_map(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
6233             ic->ic_channels);
6234
6235         /*
6236          * At this point we've committed - if we fail to do setup,
6237          * we now also have to tear down the net80211 state.
6238          */
6239         ieee80211_ifattach(ic);
6240         ic->ic_vap_create = iwm_vap_create;
6241         ic->ic_vap_delete = iwm_vap_delete;
6242         ic->ic_raw_xmit = iwm_raw_xmit;
6243         ic->ic_node_alloc = iwm_node_alloc;
6244         ic->ic_scan_start = iwm_scan_start;
6245         ic->ic_scan_end = iwm_scan_end;
6246         ic->ic_update_mcast = iwm_update_mcast;
6247         ic->ic_getradiocaps = iwm_init_channel_map;
6248         ic->ic_set_channel = iwm_set_channel;
6249         ic->ic_scan_curchan = iwm_scan_curchan;
6250         ic->ic_scan_mindwell = iwm_scan_mindwell;
6251         ic->ic_wme.wme_update = iwm_update_edca;
6252         ic->ic_parent = iwm_parent;
6253         ic->ic_transmit = iwm_transmit;
6254         iwm_radiotap_attach(sc);
6255         if (bootverbose)
6256                 ieee80211_announce(ic);
6257
6258         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
6259             "<-%s\n", __func__);
6260         config_intrhook_disestablish(&sc->sc_preinit_hook);
6261
6262         return;
6263 fail:
6264         config_intrhook_disestablish(&sc->sc_preinit_hook);
6265         iwm_detach_local(sc, 0);
6266 }
6267
6268 /*
6269  * Attach the interface to 802.11 radiotap.
6270  */
6271 static void
6272 iwm_radiotap_attach(struct iwm_softc *sc)
6273 {
6274         struct ieee80211com *ic = &sc->sc_ic;
6275
6276         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
6277             "->%s begin\n", __func__);
6278         ieee80211_radiotap_attach(ic,
6279             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
6280                 IWM_TX_RADIOTAP_PRESENT,
6281             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
6282                 IWM_RX_RADIOTAP_PRESENT);
6283         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
6284             "->%s end\n", __func__);
6285 }
6286
6287 static struct ieee80211vap *
6288 iwm_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
6289     enum ieee80211_opmode opmode, int flags,
6290     const uint8_t bssid[IEEE80211_ADDR_LEN],
6291     const uint8_t mac[IEEE80211_ADDR_LEN])
6292 {
6293         struct iwm_vap *ivp;
6294         struct ieee80211vap *vap;
6295
6296         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
6297                 return NULL;
6298         ivp = malloc(sizeof(struct iwm_vap), M_80211_VAP, M_WAITOK | M_ZERO);
6299         vap = &ivp->iv_vap;
6300         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
6301         vap->iv_bmissthreshold = 10;            /* override default */
6302         /* Override with driver methods. */
6303         ivp->iv_newstate = vap->iv_newstate;
6304         vap->iv_newstate = iwm_newstate;
6305
6306         ieee80211_ratectl_init(vap);
6307         /* Complete setup. */
6308         ieee80211_vap_attach(vap, iwm_media_change, ieee80211_media_status,
6309             mac);
6310         ic->ic_opmode = opmode;
6311
6312         return vap;
6313 }
6314
6315 static void
6316 iwm_vap_delete(struct ieee80211vap *vap)
6317 {
6318         struct iwm_vap *ivp = IWM_VAP(vap);
6319
6320         ieee80211_ratectl_deinit(vap);
6321         ieee80211_vap_detach(vap);
6322         free(ivp, M_80211_VAP);
6323 }
6324
6325 static void
6326 iwm_scan_start(struct ieee80211com *ic)
6327 {
6328         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
6329         struct iwm_softc *sc = ic->ic_softc;
6330         int error;
6331
6332         IWM_LOCK(sc);
6333         if (sc->sc_flags & IWM_FLAG_SCAN_RUNNING) {
6334                 /* This should not be possible */
6335                 device_printf(sc->sc_dev,
6336                     "%s: Previous scan not completed yet\n", __func__);
6337         }
6338         if (fw_has_capa(&sc->ucode_capa, IWM_UCODE_TLV_CAPA_UMAC_SCAN))
6339                 error = iwm_mvm_umac_scan(sc);
6340         else
6341                 error = iwm_mvm_lmac_scan(sc);
6342         if (error != 0) {
6343                 device_printf(sc->sc_dev, "could not initiate scan\n");
6344                 IWM_UNLOCK(sc);
6345                 ieee80211_cancel_scan(vap);
6346         } else {
6347                 sc->sc_flags |= IWM_FLAG_SCAN_RUNNING;
6348                 iwm_led_blink_start(sc);
6349                 IWM_UNLOCK(sc);
6350         }
6351 }
6352
6353 static void
6354 iwm_scan_end(struct ieee80211com *ic)
6355 {
6356         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
6357         struct iwm_softc *sc = ic->ic_softc;
6358
6359         IWM_LOCK(sc);
6360         iwm_led_blink_stop(sc);
6361         if (vap->iv_state == IEEE80211_S_RUN)
6362                 iwm_mvm_led_enable(sc);
6363         if (sc->sc_flags & IWM_FLAG_SCAN_RUNNING) {
6364                 /*
6365                  * Removing IWM_FLAG_SCAN_RUNNING now, is fine because
6366                  * both iwm_scan_end and iwm_scan_start run in the ic->ic_tq
6367                  * taskqueue.
6368                  */
6369                 sc->sc_flags &= ~IWM_FLAG_SCAN_RUNNING;
6370                 iwm_mvm_scan_stop_wait(sc);
6371         }
6372         IWM_UNLOCK(sc);
6373
6374         /*
6375          * Make sure we don't race, if sc_es_task is still enqueued here.
6376          * This is to make sure that it won't call ieee80211_scan_done
6377          * when we have already started the next scan.
6378          */
6379         taskqueue_cancel(ic->ic_tq, &sc->sc_es_task, NULL);
6380 }
6381
6382 static void
6383 iwm_update_mcast(struct ieee80211com *ic)
6384 {
6385 }
6386
6387 static void
6388 iwm_set_channel(struct ieee80211com *ic)
6389 {
6390 }
6391
6392 static void
6393 iwm_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
6394 {
6395 }
6396
6397 static void
6398 iwm_scan_mindwell(struct ieee80211_scan_state *ss)
6399 {
6400         return;
6401 }
6402
6403 void
6404 iwm_init_task(void *arg1)
6405 {
6406         struct iwm_softc *sc = arg1;
6407
6408         IWM_LOCK(sc);
6409         while (sc->sc_flags & IWM_FLAG_BUSY)
6410                 msleep(&sc->sc_flags, &sc->sc_mtx, 0, "iwmpwr", 0);
6411         sc->sc_flags |= IWM_FLAG_BUSY;
6412         iwm_stop(sc);
6413         if (sc->sc_ic.ic_nrunning > 0)
6414                 iwm_init(sc);
6415         sc->sc_flags &= ~IWM_FLAG_BUSY;
6416         wakeup(&sc->sc_flags);
6417         IWM_UNLOCK(sc);
6418 }
6419
6420 static int
6421 iwm_resume(device_t dev)
6422 {
6423         struct iwm_softc *sc = device_get_softc(dev);
6424         int do_reinit = 0;
6425
6426         /*
6427          * We disable the RETRY_TIMEOUT register (0x41) to keep
6428          * PCI Tx retries from interfering with C3 CPU state.
6429          */
6430         pci_write_config(dev, PCI_CFG_RETRY_TIMEOUT, 0x00, 1);
6431         iwm_init_task(device_get_softc(dev));
6432
6433         IWM_LOCK(sc);
6434         if (sc->sc_flags & IWM_FLAG_SCANNING) {
6435                 sc->sc_flags &= ~IWM_FLAG_SCANNING;
6436                 do_reinit = 1;
6437         }
6438         IWM_UNLOCK(sc);
6439
6440         if (do_reinit)
6441                 ieee80211_resume_all(&sc->sc_ic);
6442
6443         return 0;
6444 }
6445
6446 static int
6447 iwm_suspend(device_t dev)
6448 {
6449         int do_stop = 0;
6450         struct iwm_softc *sc = device_get_softc(dev);
6451
6452         do_stop = !! (sc->sc_ic.ic_nrunning > 0);
6453
6454         ieee80211_suspend_all(&sc->sc_ic);
6455
6456         if (do_stop) {
6457                 IWM_LOCK(sc);
6458                 iwm_stop(sc);
6459                 sc->sc_flags |= IWM_FLAG_SCANNING;
6460                 IWM_UNLOCK(sc);
6461         }
6462
6463         return (0);
6464 }
6465
6466 static int
6467 iwm_detach_local(struct iwm_softc *sc, int do_net80211)
6468 {
6469         struct iwm_fw_info *fw = &sc->sc_fw;
6470         device_t dev = sc->sc_dev;
6471         int i;
6472
6473         if (!sc->sc_attached)
6474                 return 0;
6475         sc->sc_attached = 0;
6476
6477         if (do_net80211)
6478                 ieee80211_draintask(&sc->sc_ic, &sc->sc_es_task);
6479
6480         callout_drain(&sc->sc_led_blink_to);
6481         callout_drain(&sc->sc_watchdog_to);
6482         iwm_stop_device(sc);
6483         if (do_net80211) {
6484                 ieee80211_ifdetach(&sc->sc_ic);
6485         }
6486
6487         iwm_phy_db_free(sc->sc_phy_db);
6488         sc->sc_phy_db = NULL;
6489
6490         iwm_free_nvm_data(sc->nvm_data);
6491
6492         /* Free descriptor rings */
6493         iwm_free_rx_ring(sc, &sc->rxq);
6494         for (i = 0; i < nitems(sc->txq); i++)
6495                 iwm_free_tx_ring(sc, &sc->txq[i]);
6496
6497         /* Free firmware */
6498         if (fw->fw_fp != NULL)
6499                 iwm_fw_info_free(fw);
6500
6501         /* Free scheduler */
6502         iwm_dma_contig_free(&sc->sched_dma);
6503         iwm_dma_contig_free(&sc->ict_dma);
6504         iwm_dma_contig_free(&sc->kw_dma);
6505         iwm_dma_contig_free(&sc->fw_dma);
6506
6507         iwm_free_fw_paging(sc);
6508
6509         /* Finished with the hardware - detach things */
6510         iwm_pci_detach(dev);
6511
6512         if (sc->sc_notif_wait != NULL) {
6513                 iwm_notification_wait_free(sc->sc_notif_wait);
6514                 sc->sc_notif_wait = NULL;
6515         }
6516
6517         mbufq_drain(&sc->sc_snd);
6518         IWM_LOCK_DESTROY(sc);
6519
6520         return (0);
6521 }
6522
6523 static int
6524 iwm_detach(device_t dev)
6525 {
6526         struct iwm_softc *sc = device_get_softc(dev);
6527
6528         return (iwm_detach_local(sc, 1));
6529 }
6530
6531 static device_method_t iwm_pci_methods[] = {
6532         /* Device interface */
6533         DEVMETHOD(device_probe,         iwm_probe),
6534         DEVMETHOD(device_attach,        iwm_attach),
6535         DEVMETHOD(device_detach,        iwm_detach),
6536         DEVMETHOD(device_suspend,       iwm_suspend),
6537         DEVMETHOD(device_resume,        iwm_resume),
6538
6539         DEVMETHOD_END
6540 };
6541
6542 static driver_t iwm_pci_driver = {
6543         "iwm",
6544         iwm_pci_methods,
6545         sizeof (struct iwm_softc)
6546 };
6547
6548 static devclass_t iwm_devclass;
6549
6550 DRIVER_MODULE(iwm, pci, iwm_pci_driver, iwm_devclass, NULL, NULL);
6551 MODULE_DEPEND(iwm, firmware, 1, 1, 1);
6552 MODULE_DEPEND(iwm, pci, 1, 1, 1);
6553 MODULE_DEPEND(iwm, wlan, 1, 1, 1);