sys/dev/iwm/if_iwm.c

   1 /*      $OpenBSD: if_iwm.c,v 1.39 2015/03/23 00:35:19 jsg Exp $ */
   2
   3 /*
   4  * Copyright (c) 2014 genua mbh <info@genua.de>
   5  * Copyright (c) 2014 Fixup Software Ltd.
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 /*-
  21  * Based on BSD-licensed source modules in the Linux iwlwifi driver,
  22  * which were used as the reference documentation for this implementation.
  23  *
  24  * Driver version we are currently based off of is
  25  * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd)
  26  *
  27  ***********************************************************************
  28  *
  29  * This file is provided under a dual BSD/GPLv2 license.  When using or
  30  * redistributing this file, you may do so under either license.
  31  *
  32  * GPL LICENSE SUMMARY
  33  *
  34  * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
  35  *
  36  * This program is free software; you can redistribute it and/or modify
  37  * it under the terms of version 2 of the GNU General Public License as
  38  * published by the Free Software Foundation.
  39  *
  40  * This program is distributed in the hope that it will be useful, but
  41  * WITHOUT ANY WARRANTY; without even the implied warranty of
  42  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  43  * General Public License for more details.
  44  *
  45  * You should have received a copy of the GNU General Public License
  46  * along with this program; if not, write to the Free Software
  47  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  48  * USA
  49  *
  50  * The full GNU General Public License is included in this distribution
  51  * in the file called COPYING.
  52  *
  53  * Contact Information:
  54  *  Intel Linux Wireless <ilw@linux.intel.com>
  55  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  56  *
  57  *
  58  * BSD LICENSE
  59  *
  60  * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
  61  * All rights reserved.
  62  *
  63  * Redistribution and use in source and binary forms, with or without
  64  * modification, are permitted provided that the following conditions
  65  * are met:
  66  *
  67  *  * Redistributions of source code must retain the above copyright
  68  *    notice, this list of conditions and the following disclaimer.
  69  *  * Redistributions in binary form must reproduce the above copyright
  70  *    notice, this list of conditions and the following disclaimer in
  71  *    the documentation and/or other materials provided with the
  72  *    distribution.
  73  *  * Neither the name Intel Corporation nor the names of its
  74  *    contributors may be used to endorse or promote products derived
  75  *    from this software without specific prior written permission.
  76  *
  77  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  78  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  79  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  80  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  81  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  82  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  83  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  84  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  85  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  86  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  87  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  88  */
  89
  90 /*-
  91  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
  92  *
  93  * Permission to use, copy, modify, and distribute this software for any
  94  * purpose with or without fee is hereby granted, provided that the above
  95  * copyright notice and this permission notice appear in all copies.
  96  *
  97  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  98  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  99  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 100  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 101  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 102  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 103  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 104  */
 105 #include <sys/cdefs.h>
 106 __FBSDID("$FreeBSD$");
 107
 108 #include <sys/param.h>
 109 #include <sys/bus.h>
 110 #include <sys/conf.h>
 111 #include <sys/endian.h>
 112 #include <sys/firmware.h>
 113 #include <sys/kernel.h>
 114 #include <sys/malloc.h>
 115 #include <sys/mbuf.h>
 116 #include <sys/mutex.h>
 117 #include <sys/module.h>
 118 #include <sys/proc.h>
 119 #include <sys/rman.h>
 120 #include <sys/socket.h>
 121 #include <sys/sockio.h>
 122 #include <sys/sysctl.h>
 123 #include <sys/linker.h>
 124
 125 #include <machine/bus.h>
 126 #include <machine/endian.h>
 127 #include <machine/resource.h>
 128
 129 #include <dev/pci/pcivar.h>
 130 #include <dev/pci/pcireg.h>
 131
 132 #include <net/bpf.h>
 133
 134 #include <net/if.h>
 135 #include <net/if_var.h>
 136 #include <net/if_arp.h>
 137 #include <net/if_dl.h>
 138 #include <net/if_media.h>
 139 #include <net/if_types.h>
 140
 141 #include <netinet/in.h>
 142 #include <netinet/in_systm.h>
 143 #include <netinet/if_ether.h>
 144 #include <netinet/ip.h>
 145
 146 #include <net80211/ieee80211_var.h>
 147 #include <net80211/ieee80211_regdomain.h>
 148 #include <net80211/ieee80211_ratectl.h>
 149 #include <net80211/ieee80211_radiotap.h>
 150
 151 #include <dev/iwm/if_iwmreg.h>
 152 #include <dev/iwm/if_iwmvar.h>
 153 #include <dev/iwm/if_iwm_debug.h>
 154 #include <dev/iwm/if_iwm_util.h>
 155 #include <dev/iwm/if_iwm_binding.h>
 156 #include <dev/iwm/if_iwm_phy_db.h>
 157 #include <dev/iwm/if_iwm_mac_ctxt.h>
 158 #include <dev/iwm/if_iwm_phy_ctxt.h>
 159 #include <dev/iwm/if_iwm_time_event.h>
 160 #include <dev/iwm/if_iwm_power.h>
 161 #include <dev/iwm/if_iwm_scan.h>
 162
 163 #include <dev/iwm/if_iwm_pcie_trans.h>
 164
 165 const uint8_t iwm_nvm_channels[] = {
 166         /* 2.4 GHz */
 167         1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
 168         /* 5 GHz */
 169         36, 40, 44 , 48, 52, 56, 60, 64,
 170         100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
 171         149, 153, 157, 161, 165
 172 };
 173 #define IWM_NUM_2GHZ_CHANNELS   14
 174
 175 /*
 176  * XXX For now, there's simply a fixed set of rate table entries
 177  * that are populated.
 178  */
 179 const struct iwm_rate {
 180         uint8_t rate;
 181         uint8_t plcp;
 182 } iwm_rates[] = {
 183         {   2,  IWM_RATE_1M_PLCP  },
 184         {   4,  IWM_RATE_2M_PLCP  },
 185         {  11,  IWM_RATE_5M_PLCP  },
 186         {  22,  IWM_RATE_11M_PLCP },
 187         {  12,  IWM_RATE_6M_PLCP  },
 188         {  18,  IWM_RATE_9M_PLCP  },
 189         {  24,  IWM_RATE_12M_PLCP },
 190         {  36,  IWM_RATE_18M_PLCP },
 191         {  48,  IWM_RATE_24M_PLCP },
 192         {  72,  IWM_RATE_36M_PLCP },
 193         {  96,  IWM_RATE_48M_PLCP },
 194         { 108,  IWM_RATE_54M_PLCP },
 195 };
 196 #define IWM_RIDX_CCK    0
 197 #define IWM_RIDX_OFDM   4
 198 #define IWM_RIDX_MAX    (nitems(iwm_rates)-1)
 199 #define IWM_RIDX_IS_CCK(_i_) ((_i_) < IWM_RIDX_OFDM)
 200 #define IWM_RIDX_IS_OFDM(_i_) ((_i_) >= IWM_RIDX_OFDM)
 201
 202 static int      iwm_store_cscheme(struct iwm_softc *, const uint8_t *, size_t);
 203 static int      iwm_firmware_store_section(struct iwm_softc *,
 204                                            enum iwm_ucode_type,
 205                                            const uint8_t *, size_t);
 206 static int      iwm_set_default_calib(struct iwm_softc *, const void *);
 207 static void     iwm_fw_info_free(struct iwm_fw_info *);
 208 static int      iwm_read_firmware(struct iwm_softc *, enum iwm_ucode_type);
 209 static void     iwm_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 210 static int      iwm_dma_contig_alloc(bus_dma_tag_t, struct iwm_dma_info *,
 211                                      bus_size_t, bus_size_t);
 212 static void     iwm_dma_contig_free(struct iwm_dma_info *);
 213 static int      iwm_alloc_fwmem(struct iwm_softc *);
 214 static void     iwm_free_fwmem(struct iwm_softc *);
 215 static int      iwm_alloc_sched(struct iwm_softc *);
 216 static void     iwm_free_sched(struct iwm_softc *);
 217 static int      iwm_alloc_kw(struct iwm_softc *);
 218 static void     iwm_free_kw(struct iwm_softc *);
 219 static int      iwm_alloc_ict(struct iwm_softc *);
 220 static void     iwm_free_ict(struct iwm_softc *);
 221 static int      iwm_alloc_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
 222 static void     iwm_reset_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
 223 static void     iwm_free_rx_ring(struct iwm_softc *, struct iwm_rx_ring *);
 224 static int      iwm_alloc_tx_ring(struct iwm_softc *, struct iwm_tx_ring *,
 225                                   int);
 226 static void     iwm_reset_tx_ring(struct iwm_softc *, struct iwm_tx_ring *);
 227 static void     iwm_free_tx_ring(struct iwm_softc *, struct iwm_tx_ring *);
 228 static void     iwm_enable_interrupts(struct iwm_softc *);
 229 static void     iwm_restore_interrupts(struct iwm_softc *);
 230 static void     iwm_disable_interrupts(struct iwm_softc *);
 231 static void     iwm_ict_reset(struct iwm_softc *);
 232 static int      iwm_allow_mcast(struct ieee80211vap *, struct iwm_softc *);
 233 static void     iwm_stop_device(struct iwm_softc *);
 234 static void     iwm_mvm_nic_config(struct iwm_softc *);
 235 static int      iwm_nic_rx_init(struct iwm_softc *);
 236 static int      iwm_nic_tx_init(struct iwm_softc *);
 237 static int      iwm_nic_init(struct iwm_softc *);
 238 static void     iwm_enable_txq(struct iwm_softc *, int, int);
 239 static int      iwm_post_alive(struct iwm_softc *);
 240 static int      iwm_nvm_read_chunk(struct iwm_softc *, uint16_t, uint16_t,
 241                                    uint16_t, uint8_t *, uint16_t *);
 242 static int      iwm_nvm_read_section(struct iwm_softc *, uint16_t, uint8_t *,
 243                                      uint16_t *);
 244 static void     iwm_init_channel_map(struct iwm_softc *,
 245                                      const uint16_t * const);
 246 static int      iwm_parse_nvm_data(struct iwm_softc *, const uint16_t *,
 247                                    const uint16_t *, const uint16_t *, uint8_t,
 248                                    uint8_t);
 249 struct iwm_nvm_section;
 250 static int      iwm_parse_nvm_sections(struct iwm_softc *,
 251                                        struct iwm_nvm_section *);
 252 static int      iwm_nvm_init(struct iwm_softc *);
 253 static int      iwm_firmware_load_chunk(struct iwm_softc *, uint32_t,
 254                                         const uint8_t *, uint32_t);
 255 static int      iwm_load_firmware(struct iwm_softc *, enum iwm_ucode_type);
 256 static int      iwm_start_fw(struct iwm_softc *, enum iwm_ucode_type);
 257 static int      iwm_fw_alive(struct iwm_softc *, uint32_t);
 258 static int      iwm_send_tx_ant_cfg(struct iwm_softc *, uint8_t);
 259 static int      iwm_send_phy_cfg_cmd(struct iwm_softc *);
 260 static int      iwm_mvm_load_ucode_wait_alive(struct iwm_softc *,
 261                                               enum iwm_ucode_type);
 262 static int      iwm_run_init_mvm_ucode(struct iwm_softc *, int);
 263 static int      iwm_rx_addbuf(struct iwm_softc *, int, int);
 264 static int      iwm_mvm_calc_rssi(struct iwm_softc *, struct iwm_rx_phy_info *);
 265 static int      iwm_mvm_get_signal_strength(struct iwm_softc *,
 266                                             struct iwm_rx_phy_info *);
 267 static void     iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *,
 268                                       struct iwm_rx_packet *,
 269                                       struct iwm_rx_data *);
 270 static int      iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *);
 271 static void     iwm_mvm_rx_rx_mpdu(struct iwm_softc *, struct iwm_rx_packet *,
 272                                    struct iwm_rx_data *);
 273 static int      iwm_mvm_rx_tx_cmd_single(struct iwm_softc *,
 274                                          struct iwm_rx_packet *,
 275                                          struct iwm_node *);
 276 static void     iwm_mvm_rx_tx_cmd(struct iwm_softc *, struct iwm_rx_packet *,
 277                                   struct iwm_rx_data *);
 278 static void     iwm_cmd_done(struct iwm_softc *, struct iwm_rx_packet *);
 279 #if 0
 280 static void     iwm_update_sched(struct iwm_softc *, int, int, uint8_t,
 281                                  uint16_t);
 282 #endif
 283 static const struct iwm_rate *
 284         iwm_tx_fill_cmd(struct iwm_softc *, struct iwm_node *,
 285                         struct ieee80211_frame *, struct iwm_tx_cmd *);
 286 static int      iwm_tx(struct iwm_softc *, struct mbuf *,
 287                        struct ieee80211_node *, int);
 288 static int      iwm_raw_xmit(struct ieee80211_node *, struct mbuf *,
 289                              const struct ieee80211_bpf_params *);
 290 static void     iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *,
 291                                              struct iwm_mvm_add_sta_cmd_v5 *);
 292 static int      iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *,
 293                                                 struct iwm_mvm_add_sta_cmd_v6 *,
 294                                                 int *);
 295 static int      iwm_mvm_sta_send_to_fw(struct iwm_softc *, struct iwm_node *,
 296                                        int);
 297 static int      iwm_mvm_add_sta(struct iwm_softc *, struct iwm_node *);
 298 static int      iwm_mvm_update_sta(struct iwm_softc *, struct iwm_node *);
 299 static int      iwm_mvm_add_int_sta_common(struct iwm_softc *,
 300                                            struct iwm_int_sta *,
 301                                            const uint8_t *, uint16_t, uint16_t);
 302 static int      iwm_mvm_add_aux_sta(struct iwm_softc *);
 303 static int      iwm_mvm_update_quotas(struct iwm_softc *, struct iwm_node *);
 304 static int      iwm_auth(struct ieee80211vap *, struct iwm_softc *);
 305 static int      iwm_assoc(struct ieee80211vap *, struct iwm_softc *);
 306 static int      iwm_release(struct iwm_softc *, struct iwm_node *);
 307 static struct ieee80211_node *
 308                 iwm_node_alloc(struct ieee80211vap *,
 309                                const uint8_t[IEEE80211_ADDR_LEN]);
 310 static void     iwm_setrates(struct iwm_softc *, struct iwm_node *);
 311 static int      iwm_media_change(struct ifnet *);
 312 static int      iwm_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 313 static void     iwm_endscan_cb(void *, int);
 314 static int      iwm_init_hw(struct iwm_softc *);
 315 static void     iwm_init(struct iwm_softc *);
 316 static void     iwm_start(struct iwm_softc *);
 317 static void     iwm_stop(struct iwm_softc *);
 318 static void     iwm_watchdog(void *);
 319 static void     iwm_parent(struct ieee80211com *);
 320 #ifdef IWM_DEBUG
 321 static const char *
 322                 iwm_desc_lookup(uint32_t);
 323 static void     iwm_nic_error(struct iwm_softc *);
 324 #endif
 325 static void     iwm_notif_intr(struct iwm_softc *);
 326 static void     iwm_intr(void *);
 327 static int      iwm_attach(device_t);
 328 static void     iwm_preinit(void *);
 329 static int      iwm_detach_local(struct iwm_softc *sc, int);
 330 static void     iwm_init_task(void *);
 331 static void     iwm_radiotap_attach(struct iwm_softc *);
 332 static struct ieee80211vap *
 333                 iwm_vap_create(struct ieee80211com *,
 334                                const char [IFNAMSIZ], int,
 335                                enum ieee80211_opmode, int,
 336                                const uint8_t [IEEE80211_ADDR_LEN],
 337                                const uint8_t [IEEE80211_ADDR_LEN]);
 338 static void     iwm_vap_delete(struct ieee80211vap *);
 339 static void     iwm_scan_start(struct ieee80211com *);
 340 static void     iwm_scan_end(struct ieee80211com *);
 341 static void     iwm_update_mcast(struct ieee80211com *);
 342 static void     iwm_set_channel(struct ieee80211com *);
 343 static void     iwm_scan_curchan(struct ieee80211_scan_state *, unsigned long);
 344 static void     iwm_scan_mindwell(struct ieee80211_scan_state *);
 345 static int      iwm_detach(device_t);
 346
 347 /*
 348  * Firmware parser.
 349  */
 350
 351 static int
 352 iwm_store_cscheme(struct iwm_softc *sc, const uint8_t *data, size_t dlen)
 353 {
 354         const struct iwm_fw_cscheme_list *l = (const void *)data;
 355
 356         if (dlen < sizeof(*l) ||
 357             dlen < sizeof(l->size) + l->size * sizeof(*l->cs))
 358                 return EINVAL;
 359
 360         /* we don't actually store anything for now, always use s/w crypto */
 361
 362         return 0;
 363 }
 364
 365 static int
 366 iwm_firmware_store_section(struct iwm_softc *sc,
 367     enum iwm_ucode_type type, const uint8_t *data, size_t dlen)
 368 {
 369         struct iwm_fw_sects *fws;
 370         struct iwm_fw_onesect *fwone;
 371
 372         if (type >= IWM_UCODE_TYPE_MAX)
 373                 return EINVAL;
 374         if (dlen < sizeof(uint32_t))
 375                 return EINVAL;
 376
 377         fws = &sc->sc_fw.fw_sects[type];
 378         if (fws->fw_count >= IWM_UCODE_SECT_MAX)
 379                 return EINVAL;
 380
 381         fwone = &fws->fw_sect[fws->fw_count];
 382
 383         /* first 32bit are device load offset */
 384         memcpy(&fwone->fws_devoff, data, sizeof(uint32_t));
 385
 386         /* rest is data */
 387         fwone->fws_data = data + sizeof(uint32_t);
 388         fwone->fws_len = dlen - sizeof(uint32_t);
 389
 390         fws->fw_count++;
 391         fws->fw_totlen += fwone->fws_len;
 392
 393         return 0;
 394 }
 395
 396 /* iwlwifi: iwl-drv.c */
 397 struct iwm_tlv_calib_data {
 398         uint32_t ucode_type;
 399         struct iwm_tlv_calib_ctrl calib;
 400 } __packed;
 401
 402 static int
 403 iwm_set_default_calib(struct iwm_softc *sc, const void *data)
 404 {
 405         const struct iwm_tlv_calib_data *def_calib = data;
 406         uint32_t ucode_type = le32toh(def_calib->ucode_type);
 407
 408         if (ucode_type >= IWM_UCODE_TYPE_MAX) {
 409                 device_printf(sc->sc_dev,
 410                     "Wrong ucode_type %u for default "
 411                     "calibration.\n", ucode_type);
 412                 return EINVAL;
 413         }
 414
 415         sc->sc_default_calib[ucode_type].flow_trigger =
 416             def_calib->calib.flow_trigger;
 417         sc->sc_default_calib[ucode_type].event_trigger =
 418             def_calib->calib.event_trigger;
 419
 420         return 0;
 421 }
 422
 423 static void
 424 iwm_fw_info_free(struct iwm_fw_info *fw)
 425 {
 426         firmware_put(fw->fw_fp, FIRMWARE_UNLOAD);
 427         fw->fw_fp = NULL;
 428         /* don't touch fw->fw_status */
 429         memset(fw->fw_sects, 0, sizeof(fw->fw_sects));
 430 }
 431
 432 static int
 433 iwm_read_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type)
 434 {
 435         struct iwm_fw_info *fw = &sc->sc_fw;
 436         const struct iwm_tlv_ucode_header *uhdr;
 437         struct iwm_ucode_tlv tlv;
 438         enum iwm_ucode_tlv_type tlv_type;
 439         const struct firmware *fwp;
 440         const uint8_t *data;
 441         int error = 0;
 442         size_t len;
 443
 444         if (fw->fw_status == IWM_FW_STATUS_DONE &&
 445             ucode_type != IWM_UCODE_TYPE_INIT)
 446                 return 0;
 447
 448         while (fw->fw_status == IWM_FW_STATUS_INPROGRESS)
 449                 msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfwp", 0);
 450         fw->fw_status = IWM_FW_STATUS_INPROGRESS;
 451
 452         if (fw->fw_fp != NULL)
 453                 iwm_fw_info_free(fw);
 454
 455         /*
 456          * Load firmware into driver memory.
 457          * fw_fp will be set.
 458          */
 459         IWM_UNLOCK(sc);
 460         fwp = firmware_get(sc->sc_fwname);
 461         IWM_LOCK(sc);
 462         if (fwp == NULL) {
 463                 device_printf(sc->sc_dev,
 464                     "could not read firmware %s (error %d)\n",
 465                     sc->sc_fwname, error);
 466                 goto out;
 467         }
 468         fw->fw_fp = fwp;
 469
 470         /*
 471          * Parse firmware contents
 472          */
 473
 474         uhdr = (const void *)fw->fw_fp->data;
 475         if (*(const uint32_t *)fw->fw_fp->data != 0
 476             || le32toh(uhdr->magic) != IWM_TLV_UCODE_MAGIC) {
 477                 device_printf(sc->sc_dev, "invalid firmware %s\n",
 478                     sc->sc_fwname);
 479                 error = EINVAL;
 480                 goto out;
 481         }
 482
 483         sc->sc_fwver = le32toh(uhdr->ver);
 484         data = uhdr->data;
 485         len = fw->fw_fp->datasize - sizeof(*uhdr);
 486
 487         while (len >= sizeof(tlv)) {
 488                 size_t tlv_len;
 489                 const void *tlv_data;
 490
 491                 memcpy(&tlv, data, sizeof(tlv));
 492                 tlv_len = le32toh(tlv.length);
 493                 tlv_type = le32toh(tlv.type);
 494
 495                 len -= sizeof(tlv);
 496                 data += sizeof(tlv);
 497                 tlv_data = data;
 498
 499                 if (len < tlv_len) {
 500                         device_printf(sc->sc_dev,
 501                             "firmware too short: %zu bytes\n",
 502                             len);
 503                         error = EINVAL;
 504                         goto parse_out;
 505                 }
 506
 507                 switch ((int)tlv_type) {
 508                 case IWM_UCODE_TLV_PROBE_MAX_LEN:
 509                         if (tlv_len < sizeof(uint32_t)) {
 510                                 device_printf(sc->sc_dev,
 511                                     "%s: PROBE_MAX_LEN (%d) < sizeof(uint32_t)\n",
 512                                     __func__,
 513                                     (int) tlv_len);
 514                                 error = EINVAL;
 515                                 goto parse_out;
 516                         }
 517                         sc->sc_capa_max_probe_len
 518                             = le32toh(*(const uint32_t *)tlv_data);
 519                         /* limit it to something sensible */
 520                         if (sc->sc_capa_max_probe_len > (1<<16)) {
 521                                 IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV,
 522                                     "%s: IWM_UCODE_TLV_PROBE_MAX_LEN "
 523                                     "ridiculous\n", __func__);
 524                                 error = EINVAL;
 525                                 goto parse_out;
 526                         }
 527                         break;
 528                 case IWM_UCODE_TLV_PAN:
 529                         if (tlv_len) {
 530                                 device_printf(sc->sc_dev,
 531                                     "%s: IWM_UCODE_TLV_PAN: tlv_len (%d) > 0\n",
 532                                     __func__,
 533                                     (int) tlv_len);
 534                                 error = EINVAL;
 535                                 goto parse_out;
 536                         }
 537                         sc->sc_capaflags |= IWM_UCODE_TLV_FLAGS_PAN;
 538                         break;
 539                 case IWM_UCODE_TLV_FLAGS:
 540                         if (tlv_len < sizeof(uint32_t)) {
 541                                 device_printf(sc->sc_dev,
 542                                     "%s: IWM_UCODE_TLV_FLAGS: tlv_len (%d) < sizeof(uint32_t)\n",
 543                                     __func__,
 544                                     (int) tlv_len);
 545                                 error = EINVAL;
 546                                 goto parse_out;
 547                         }
 548                         /*
 549                          * Apparently there can be many flags, but Linux driver
 550                          * parses only the first one, and so do we.
 551                          *
 552                          * XXX: why does this override IWM_UCODE_TLV_PAN?
 553                          * Intentional or a bug?  Observations from
 554                          * current firmware file:
 555                          *  1) TLV_PAN is parsed first
 556                          *  2) TLV_FLAGS contains TLV_FLAGS_PAN
 557                          * ==> this resets TLV_PAN to itself... hnnnk
 558                          */
 559                         sc->sc_capaflags = le32toh(*(const uint32_t *)tlv_data);
 560                         break;
 561                 case IWM_UCODE_TLV_CSCHEME:
 562                         if ((error = iwm_store_cscheme(sc,
 563                             tlv_data, tlv_len)) != 0) {
 564                                 device_printf(sc->sc_dev,
 565                                     "%s: iwm_store_cscheme(): returned %d\n",
 566                                     __func__,
 567                                     error);
 568                                 goto parse_out;
 569                         }
 570                         break;
 571                 case IWM_UCODE_TLV_NUM_OF_CPU:
 572                         if (tlv_len != sizeof(uint32_t)) {
 573                                 device_printf(sc->sc_dev,
 574                                     "%s: IWM_UCODE_TLV_NUM_OF_CPU: tlv_len (%d) < sizeof(uint32_t)\n",
 575                                     __func__,
 576                                     (int) tlv_len);
 577                                 error = EINVAL;
 578                                 goto parse_out;
 579                         }
 580                         if (le32toh(*(const uint32_t*)tlv_data) != 1) {
 581                                 device_printf(sc->sc_dev,
 582                                     "%s: driver supports "
 583                                     "only TLV_NUM_OF_CPU == 1",
 584                                     __func__);
 585                                 error = EINVAL;
 586                                 goto parse_out;
 587                         }
 588                         break;
 589                 case IWM_UCODE_TLV_SEC_RT:
 590                         if ((error = iwm_firmware_store_section(sc,
 591                             IWM_UCODE_TYPE_REGULAR, tlv_data, tlv_len)) != 0) {
 592                                 device_printf(sc->sc_dev,
 593                                     "%s: IWM_UCODE_TYPE_REGULAR: iwm_firmware_store_section() failed; %d\n",
 594                                     __func__,
 595                                     error);
 596                                 goto parse_out;
 597                         }
 598                         break;
 599                 case IWM_UCODE_TLV_SEC_INIT:
 600                         if ((error = iwm_firmware_store_section(sc,
 601                             IWM_UCODE_TYPE_INIT, tlv_data, tlv_len)) != 0) {
 602                                 device_printf(sc->sc_dev,
 603                                     "%s: IWM_UCODE_TYPE_INIT: iwm_firmware_store_section() failed; %d\n",
 604                                     __func__,
 605                                     error);
 606                                 goto parse_out;
 607                         }
 608                         break;
 609                 case IWM_UCODE_TLV_SEC_WOWLAN:
 610                         if ((error = iwm_firmware_store_section(sc,
 611                             IWM_UCODE_TYPE_WOW, tlv_data, tlv_len)) != 0) {
 612                                 device_printf(sc->sc_dev,
 613                                     "%s: IWM_UCODE_TYPE_WOW: iwm_firmware_store_section() failed; %d\n",
 614                                     __func__,
 615                                     error);
 616                                 goto parse_out;
 617                         }
 618                         break;
 619                 case IWM_UCODE_TLV_DEF_CALIB:
 620                         if (tlv_len != sizeof(struct iwm_tlv_calib_data)) {
 621                                 device_printf(sc->sc_dev,
 622                                     "%s: IWM_UCODE_TLV_DEV_CALIB: tlv_len (%d) < sizeof(iwm_tlv_calib_data) (%d)\n",
 623                                     __func__,
 624                                     (int) tlv_len,
 625                                     (int) sizeof(struct iwm_tlv_calib_data));
 626                                 error = EINVAL;
 627                                 goto parse_out;
 628                         }
 629                         if ((error = iwm_set_default_calib(sc, tlv_data)) != 0) {
 630                                 device_printf(sc->sc_dev,
 631                                     "%s: iwm_set_default_calib() failed: %d\n",
 632                                     __func__,
 633                                     error);
 634                                 goto parse_out;
 635                         }
 636                         break;
 637                 case IWM_UCODE_TLV_PHY_SKU:
 638                         if (tlv_len != sizeof(uint32_t)) {
 639                                 error = EINVAL;
 640                                 device_printf(sc->sc_dev,
 641                                     "%s: IWM_UCODE_TLV_PHY_SKU: tlv_len (%d) < sizeof(uint32_t)\n",
 642                                     __func__,
 643                                     (int) tlv_len);
 644                                 goto parse_out;
 645                         }
 646                         sc->sc_fw_phy_config =
 647                             le32toh(*(const uint32_t *)tlv_data);
 648                         break;
 649
 650                 case IWM_UCODE_TLV_API_CHANGES_SET:
 651                 case IWM_UCODE_TLV_ENABLED_CAPABILITIES:
 652                         /* ignore, not used by current driver */
 653                         break;
 654
 655                 default:
 656                         device_printf(sc->sc_dev,
 657                             "%s: unknown firmware section %d, abort\n",
 658                             __func__, tlv_type);
 659                         error = EINVAL;
 660                         goto parse_out;
 661                 }
 662
 663                 len -= roundup(tlv_len, 4);
 664                 data += roundup(tlv_len, 4);
 665         }
 666
 667         KASSERT(error == 0, ("unhandled error"));
 668
 669  parse_out:
 670         if (error) {
 671                 device_printf(sc->sc_dev, "firmware parse error %d, "
 672                     "section type %d\n", error, tlv_type);
 673         }
 674
 675         if (!(sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_PM_CMD_SUPPORT)) {
 676                 device_printf(sc->sc_dev,
 677                     "device uses unsupported power ops\n");
 678                 error = ENOTSUP;
 679         }
 680
 681  out:
 682         if (error) {
 683                 fw->fw_status = IWM_FW_STATUS_NONE;
 684                 if (fw->fw_fp != NULL)
 685                         iwm_fw_info_free(fw);
 686         } else
 687                 fw->fw_status = IWM_FW_STATUS_DONE;
 688         wakeup(&sc->sc_fw);
 689
 690         return error;
 691 }
 692
 693 /*
 694  * DMA resource routines
 695  */
 696
 697 static void
 698 iwm_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 699 {
 700         if (error != 0)
 701                 return;
 702         KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
 703         *(bus_addr_t *)arg = segs[0].ds_addr;
 704 }
 705
 706 static int
 707 iwm_dma_contig_alloc(bus_dma_tag_t tag, struct iwm_dma_info *dma,
 708     bus_size_t size, bus_size_t alignment)
 709 {
 710         int error;
 711
 712         dma->tag = NULL;
 713         dma->size = size;
 714
 715         error = bus_dma_tag_create(tag, alignment,
 716             0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
 717             1, size, 0, NULL, NULL, &dma->tag);
 718         if (error != 0)
 719                 goto fail;
 720
 721         error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr,
 722             BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map);
 723         if (error != 0)
 724                 goto fail;
 725
 726         error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size,
 727             iwm_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT);
 728         if (error != 0)
 729                 goto fail;
 730
 731         bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
 732
 733         return 0;
 734
 735 fail:   iwm_dma_contig_free(dma);
 736         return error;
 737 }
 738
 739 static void
 740 iwm_dma_contig_free(struct iwm_dma_info *dma)
 741 {
 742         if (dma->map != NULL) {
 743                 if (dma->vaddr != NULL) {
 744                         bus_dmamap_sync(dma->tag, dma->map,
 745                             BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 746                         bus_dmamap_unload(dma->tag, dma->map);
 747                         bus_dmamem_free(dma->tag, dma->vaddr, dma->map);
 748                         dma->vaddr = NULL;
 749                 }
 750                 bus_dmamap_destroy(dma->tag, dma->map);
 751                 dma->map = NULL;
 752         }
 753         if (dma->tag != NULL) {
 754                 bus_dma_tag_destroy(dma->tag);
 755                 dma->tag = NULL;
 756         }
 757
 758 }
 759
 760 /* fwmem is used to load firmware onto the card */
 761 static int
 762 iwm_alloc_fwmem(struct iwm_softc *sc)
 763 {
 764         /* Must be aligned on a 16-byte boundary. */
 765         return iwm_dma_contig_alloc(sc->sc_dmat, &sc->fw_dma,
 766             sc->sc_fwdmasegsz, 16);
 767 }
 768
 769 static void
 770 iwm_free_fwmem(struct iwm_softc *sc)
 771 {
 772         iwm_dma_contig_free(&sc->fw_dma);
 773 }
 774
 775 /* tx scheduler rings.  not used? */
 776 static int
 777 iwm_alloc_sched(struct iwm_softc *sc)
 778 {
 779         int rv;
 780
 781         /* TX scheduler rings must be aligned on a 1KB boundary. */
 782         rv = iwm_dma_contig_alloc(sc->sc_dmat, &sc->sched_dma,
 783             nitems(sc->txq) * sizeof(struct iwm_agn_scd_bc_tbl), 1024);
 784         return rv;
 785 }
 786
 787 static void
 788 iwm_free_sched(struct iwm_softc *sc)
 789 {
 790         iwm_dma_contig_free(&sc->sched_dma);
 791 }
 792
 793 /* keep-warm page is used internally by the card.  see iwl-fh.h for more info */
 794 static int
 795 iwm_alloc_kw(struct iwm_softc *sc)
 796 {
 797         return iwm_dma_contig_alloc(sc->sc_dmat, &sc->kw_dma, 4096, 4096);
 798 }
 799
 800 static void
 801 iwm_free_kw(struct iwm_softc *sc)
 802 {
 803         iwm_dma_contig_free(&sc->kw_dma);
 804 }
 805
 806 /* interrupt cause table */
 807 static int
 808 iwm_alloc_ict(struct iwm_softc *sc)
 809 {
 810         return iwm_dma_contig_alloc(sc->sc_dmat, &sc->ict_dma,
 811             IWM_ICT_SIZE, 1<<IWM_ICT_PADDR_SHIFT);
 812 }
 813
 814 static void
 815 iwm_free_ict(struct iwm_softc *sc)
 816 {
 817         iwm_dma_contig_free(&sc->ict_dma);
 818 }
 819
 820 static int
 821 iwm_alloc_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
 822 {
 823         bus_size_t size;
 824         int i, error;
 825
 826         ring->cur = 0;
 827
 828         /* Allocate RX descriptors (256-byte aligned). */
 829         size = IWM_RX_RING_COUNT * sizeof(uint32_t);
 830         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256);
 831         if (error != 0) {
 832                 device_printf(sc->sc_dev,
 833                     "could not allocate RX ring DMA memory\n");
 834                 goto fail;
 835         }
 836         ring->desc = ring->desc_dma.vaddr;
 837
 838         /* Allocate RX status area (16-byte aligned). */
 839         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->stat_dma,
 840             sizeof(*ring->stat), 16);
 841         if (error != 0) {
 842                 device_printf(sc->sc_dev,
 843                     "could not allocate RX status DMA memory\n");
 844                 goto fail;
 845         }
 846         ring->stat = ring->stat_dma.vaddr;
 847
 848         /* Create RX buffer DMA tag. */
 849         error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
 850             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
 851             IWM_RBUF_SIZE, 1, IWM_RBUF_SIZE, 0, NULL, NULL, &ring->data_dmat);
 852         if (error != 0) {
 853                 device_printf(sc->sc_dev,
 854                     "%s: could not create RX buf DMA tag, error %d\n",
 855                     __func__, error);
 856                 goto fail;
 857         }
 858
 859         /*
 860          * Allocate and map RX buffers.
 861          */
 862         for (i = 0; i < IWM_RX_RING_COUNT; i++) {
 863                 if ((error = iwm_rx_addbuf(sc, IWM_RBUF_SIZE, i)) != 0) {
 864                         goto fail;
 865                 }
 866         }
 867         return 0;
 868
 869 fail:   iwm_free_rx_ring(sc, ring);
 870         return error;
 871 }
 872
 873 static void
 874 iwm_reset_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
 875 {
 876
 877         /* XXX print out if we can't lock the NIC? */
 878         if (iwm_nic_lock(sc)) {
 879                 /* XXX handle if RX stop doesn't finish? */
 880                 (void) iwm_pcie_rx_stop(sc);
 881                 iwm_nic_unlock(sc);
 882         }
 883         /* Reset the ring state */
 884         ring->cur = 0;
 885         memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat));
 886 }
 887
 888 static void
 889 iwm_free_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring)
 890 {
 891         int i;
 892
 893         iwm_dma_contig_free(&ring->desc_dma);
 894         iwm_dma_contig_free(&ring->stat_dma);
 895
 896         for (i = 0; i < IWM_RX_RING_COUNT; i++) {
 897                 struct iwm_rx_data *data = &ring->data[i];
 898
 899                 if (data->m != NULL) {
 900                         bus_dmamap_sync(ring->data_dmat, data->map,
 901                             BUS_DMASYNC_POSTREAD);
 902                         bus_dmamap_unload(ring->data_dmat, data->map);
 903                         m_freem(data->m);
 904                         data->m = NULL;
 905                 }
 906                 if (data->map != NULL) {
 907                         bus_dmamap_destroy(ring->data_dmat, data->map);
 908                         data->map = NULL;
 909                 }
 910         }
 911         if (ring->data_dmat != NULL) {
 912                 bus_dma_tag_destroy(ring->data_dmat);
 913                 ring->data_dmat = NULL;
 914         }
 915 }
 916
 917 static int
 918 iwm_alloc_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring, int qid)
 919 {
 920         bus_addr_t paddr;
 921         bus_size_t size;
 922         int i, error;
 923
 924         ring->qid = qid;
 925         ring->queued = 0;
 926         ring->cur = 0;
 927
 928         /* Allocate TX descriptors (256-byte aligned). */
 929         size = IWM_TX_RING_COUNT * sizeof (struct iwm_tfd);
 930         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256);
 931         if (error != 0) {
 932                 device_printf(sc->sc_dev,
 933                     "could not allocate TX ring DMA memory\n");
 934                 goto fail;
 935         }
 936         ring->desc = ring->desc_dma.vaddr;
 937
 938         /*
 939          * We only use rings 0 through 9 (4 EDCA + cmd) so there is no need
 940          * to allocate commands space for other rings.
 941          */
 942         if (qid > IWM_MVM_CMD_QUEUE)
 943                 return 0;
 944
 945         size = IWM_TX_RING_COUNT * sizeof(struct iwm_device_cmd);
 946         error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->cmd_dma, size, 4);
 947         if (error != 0) {
 948                 device_printf(sc->sc_dev,
 949                     "could not allocate TX cmd DMA memory\n");
 950                 goto fail;
 951         }
 952         ring->cmd = ring->cmd_dma.vaddr;
 953
 954         error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
 955             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
 956             IWM_MAX_SCATTER - 2, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
 957         if (error != 0) {
 958                 device_printf(sc->sc_dev, "could not create TX buf DMA tag\n");
 959                 goto fail;
 960         }
 961
 962         paddr = ring->cmd_dma.paddr;
 963         for (i = 0; i < IWM_TX_RING_COUNT; i++) {
 964                 struct iwm_tx_data *data = &ring->data[i];
 965
 966                 data->cmd_paddr = paddr;
 967                 data->scratch_paddr = paddr + sizeof(struct iwm_cmd_header)
 968                     + offsetof(struct iwm_tx_cmd, scratch);
 969                 paddr += sizeof(struct iwm_device_cmd);
 970
 971                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
 972                 if (error != 0) {
 973                         device_printf(sc->sc_dev,
 974                             "could not create TX buf DMA map\n");
 975                         goto fail;
 976                 }
 977         }
 978         KASSERT(paddr == ring->cmd_dma.paddr + size,
 979             ("invalid physical address"));
 980         return 0;
 981
 982 fail:   iwm_free_tx_ring(sc, ring);
 983         return error;
 984 }
 985
 986 static void
 987 iwm_reset_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring)
 988 {
 989         int i;
 990
 991         for (i = 0; i < IWM_TX_RING_COUNT; i++) {
 992                 struct iwm_tx_data *data = &ring->data[i];
 993
 994                 if (data->m != NULL) {
 995                         bus_dmamap_sync(ring->data_dmat, data->map,
 996                             BUS_DMASYNC_POSTWRITE);
 997                         bus_dmamap_unload(ring->data_dmat, data->map);
 998                         m_freem(data->m);
 999                         data->m = NULL;
1000                 }
1001         }
1002         /* Clear TX descriptors. */
1003         memset(ring->desc, 0, ring->desc_dma.size);
1004         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
1005             BUS_DMASYNC_PREWRITE);
1006         sc->qfullmsk &= ~(1 << ring->qid);
1007         ring->queued = 0;
1008         ring->cur = 0;
1009 }
1010
1011 static void
1012 iwm_free_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring)
1013 {
1014         int i;
1015
1016         iwm_dma_contig_free(&ring->desc_dma);
1017         iwm_dma_contig_free(&ring->cmd_dma);
1018
1019         for (i = 0; i < IWM_TX_RING_COUNT; i++) {
1020                 struct iwm_tx_data *data = &ring->data[i];
1021
1022                 if (data->m != NULL) {
1023                         bus_dmamap_sync(ring->data_dmat, data->map,
1024                             BUS_DMASYNC_POSTWRITE);
1025                         bus_dmamap_unload(ring->data_dmat, data->map);
1026                         m_freem(data->m);
1027                         data->m = NULL;
1028                 }
1029                 if (data->map != NULL) {
1030                         bus_dmamap_destroy(ring->data_dmat, data->map);
1031                         data->map = NULL;
1032                 }
1033         }
1034         if (ring->data_dmat != NULL) {
1035                 bus_dma_tag_destroy(ring->data_dmat);
1036                 ring->data_dmat = NULL;
1037         }
1038 }
1039
1040 /*
1041  * High-level hardware frobbing routines
1042  */
1043
1044 static void
1045 iwm_enable_interrupts(struct iwm_softc *sc)
1046 {
1047         sc->sc_intmask = IWM_CSR_INI_SET_MASK;
1048         IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask);
1049 }
1050
1051 static void
1052 iwm_restore_interrupts(struct iwm_softc *sc)
1053 {
1054         IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask);
1055 }
1056
1057 static void
1058 iwm_disable_interrupts(struct iwm_softc *sc)
1059 {
1060         /* disable interrupts */
1061         IWM_WRITE(sc, IWM_CSR_INT_MASK, 0);
1062
1063         /* acknowledge all interrupts */
1064         IWM_WRITE(sc, IWM_CSR_INT, ~0);
1065         IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, ~0);
1066 }
1067
1068 static void
1069 iwm_ict_reset(struct iwm_softc *sc)
1070 {
1071         iwm_disable_interrupts(sc);
1072
1073         /* Reset ICT table. */
1074         memset(sc->ict_dma.vaddr, 0, IWM_ICT_SIZE);
1075         sc->ict_cur = 0;
1076
1077         /* Set physical address of ICT table (4KB aligned). */
1078         IWM_WRITE(sc, IWM_CSR_DRAM_INT_TBL_REG,
1079             IWM_CSR_DRAM_INT_TBL_ENABLE
1080             | IWM_CSR_DRAM_INIT_TBL_WRAP_CHECK
1081             | sc->ict_dma.paddr >> IWM_ICT_PADDR_SHIFT);
1082
1083         /* Switch to ICT interrupt mode in driver. */
1084         sc->sc_flags |= IWM_FLAG_USE_ICT;
1085
1086         /* Re-enable interrupts. */
1087         IWM_WRITE(sc, IWM_CSR_INT, ~0);
1088         iwm_enable_interrupts(sc);
1089 }
1090
1091 /* iwlwifi pcie/trans.c */
1092
1093 /*
1094  * Since this .. hard-resets things, it's time to actually
1095  * mark the first vap (if any) as having no mac context.
1096  * It's annoying, but since the driver is potentially being
1097  * stop/start'ed whilst active (thanks openbsd port!) we
1098  * have to correctly track this.
1099  */
1100 static void
1101 iwm_stop_device(struct iwm_softc *sc)
1102 {
1103         struct ieee80211com *ic = &sc->sc_ic;
1104         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1105         int chnl, ntries;
1106         int qid;
1107
1108         /* tell the device to stop sending interrupts */
1109         iwm_disable_interrupts(sc);
1110
1111         /*
1112          * FreeBSD-local: mark the first vap as not-uploaded,
1113          * so the next transition through auth/assoc
1114          * will correctly populate the MAC context.
1115          */
1116         if (vap) {
1117                 struct iwm_vap *iv = IWM_VAP(vap);
1118                 iv->is_uploaded = 0;
1119         }
1120
1121         /* device going down, Stop using ICT table */
1122         sc->sc_flags &= ~IWM_FLAG_USE_ICT;
1123
1124         /* stop tx and rx.  tx and rx bits, as usual, are from if_iwn */
1125
1126         iwm_write_prph(sc, IWM_SCD_TXFACT, 0);
1127
1128         /* Stop all DMA channels. */
1129         if (iwm_nic_lock(sc)) {
1130                 for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) {
1131                         IWM_WRITE(sc,
1132                             IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl), 0);
1133                         for (ntries = 0; ntries < 200; ntries++) {
1134                                 uint32_t r;
1135
1136                                 r = IWM_READ(sc, IWM_FH_TSSR_TX_STATUS_REG);
1137                                 if (r & IWM_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(
1138                                     chnl))
1139                                         break;
1140                                 DELAY(20);
1141                         }
1142                 }
1143                 iwm_nic_unlock(sc);
1144         }
1145
1146         /* Stop RX ring. */
1147         iwm_reset_rx_ring(sc, &sc->rxq);
1148
1149         /* Reset all TX rings. */
1150         for (qid = 0; qid < nitems(sc->txq); qid++)
1151                 iwm_reset_tx_ring(sc, &sc->txq[qid]);
1152
1153         /*
1154          * Power-down device's busmaster DMA clocks
1155          */
1156         iwm_write_prph(sc, IWM_APMG_CLK_DIS_REG, IWM_APMG_CLK_VAL_DMA_CLK_RQT);
1157         DELAY(5);
1158
1159         /* Make sure (redundant) we've released our request to stay awake */
1160         IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL,
1161             IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
1162
1163         /* Stop the device, and put it in low power state */
1164         iwm_apm_stop(sc);
1165
1166         /* Upon stop, the APM issues an interrupt if HW RF kill is set.
1167          * Clean again the interrupt here
1168          */
1169         iwm_disable_interrupts(sc);
1170         /* stop and reset the on-board processor */
1171         IWM_WRITE(sc, IWM_CSR_RESET, IWM_CSR_RESET_REG_FLAG_NEVO_RESET);
1172
1173         /*
1174          * Even if we stop the HW, we still want the RF kill
1175          * interrupt
1176          */
1177         iwm_enable_rfkill_int(sc);
1178         iwm_check_rfkill(sc);
1179 }
1180
1181 /* iwlwifi: mvm/ops.c */
1182 static void
1183 iwm_mvm_nic_config(struct iwm_softc *sc)
1184 {
1185         uint8_t radio_cfg_type, radio_cfg_step, radio_cfg_dash;
1186         uint32_t reg_val = 0;
1187
1188         radio_cfg_type = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_TYPE) >>
1189             IWM_FW_PHY_CFG_RADIO_TYPE_POS;
1190         radio_cfg_step = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_STEP) >>
1191             IWM_FW_PHY_CFG_RADIO_STEP_POS;
1192         radio_cfg_dash = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_DASH) >>
1193             IWM_FW_PHY_CFG_RADIO_DASH_POS;
1194
1195         /* SKU control */
1196         reg_val |= IWM_CSR_HW_REV_STEP(sc->sc_hw_rev) <<
1197             IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_STEP;
1198         reg_val |= IWM_CSR_HW_REV_DASH(sc->sc_hw_rev) <<
1199             IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_DASH;
1200
1201         /* radio configuration */
1202         reg_val |= radio_cfg_type << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_TYPE;
1203         reg_val |= radio_cfg_step << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_STEP;
1204         reg_val |= radio_cfg_dash << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_DASH;
1205
1206         IWM_WRITE(sc, IWM_CSR_HW_IF_CONFIG_REG, reg_val);
1207
1208         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1209             "Radio type=0x%x-0x%x-0x%x\n", radio_cfg_type,
1210             radio_cfg_step, radio_cfg_dash);
1211
1212         /*
1213          * W/A : NIC is stuck in a reset state after Early PCIe power off
1214          * (PCIe power is lost before PERST# is asserted), causing ME FW
1215          * to lose ownership and not being able to obtain it back.
1216          */
1217         iwm_set_bits_mask_prph(sc, IWM_APMG_PS_CTRL_REG,
1218             IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS,
1219             ~IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS);
1220 }
1221
1222 static int
1223 iwm_nic_rx_init(struct iwm_softc *sc)
1224 {
1225         if (!iwm_nic_lock(sc))
1226                 return EBUSY;
1227
1228         /*
1229          * Initialize RX ring.  This is from the iwn driver.
1230          */
1231         memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat));
1232
1233         /* stop DMA */
1234         IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
1235         IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_RBDCB_WPTR, 0);
1236         IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_FLUSH_RB_REQ, 0);
1237         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RDPTR, 0);
1238         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
1239
1240         /* Set physical address of RX ring (256-byte aligned). */
1241         IWM_WRITE(sc,
1242             IWM_FH_RSCSR_CHNL0_RBDCB_BASE_REG, sc->rxq.desc_dma.paddr >> 8);
1243
1244         /* Set physical address of RX status (16-byte aligned). */
1245         IWM_WRITE(sc,
1246             IWM_FH_RSCSR_CHNL0_STTS_WPTR_REG, sc->rxq.stat_dma.paddr >> 4);
1247
1248         /* Enable RX. */
1249         /*
1250          * Note: Linux driver also sets this:
1251          *  (IWM_RX_RB_TIMEOUT << IWM_FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS) |
1252          *
1253          * It causes weird behavior.  YMMV.
1254          */
1255         IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG,
1256             IWM_FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL            |
1257             IWM_FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY               |  /* HW bug */
1258             IWM_FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL   |
1259             IWM_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K            |
1260             IWM_RX_QUEUE_SIZE_LOG << IWM_FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS);
1261
1262         IWM_WRITE_1(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_TIMEOUT_DEF);
1263
1264         /* W/A for interrupt coalescing bug in 7260 and 3160 */
1265         if (sc->host_interrupt_operation_mode)
1266                 IWM_SETBITS(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_OPER_MODE);
1267
1268         /*
1269          * Thus sayeth el jefe (iwlwifi) via a comment:
1270          *
1271          * This value should initially be 0 (before preparing any
1272          * RBs), should be 8 after preparing the first 8 RBs (for example)
1273          */
1274         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, 8);
1275
1276         iwm_nic_unlock(sc);
1277
1278         return 0;
1279 }
1280
1281 static int
1282 iwm_nic_tx_init(struct iwm_softc *sc)
1283 {
1284         int qid;
1285
1286         if (!iwm_nic_lock(sc))
1287                 return EBUSY;
1288
1289         /* Deactivate TX scheduler. */
1290         iwm_write_prph(sc, IWM_SCD_TXFACT, 0);
1291
1292         /* Set physical address of "keep warm" page (16-byte aligned). */
1293         IWM_WRITE(sc, IWM_FH_KW_MEM_ADDR_REG, sc->kw_dma.paddr >> 4);
1294
1295         /* Initialize TX rings. */
1296         for (qid = 0; qid < nitems(sc->txq); qid++) {
1297                 struct iwm_tx_ring *txq = &sc->txq[qid];
1298
1299                 /* Set physical address of TX ring (256-byte aligned). */
1300                 IWM_WRITE(sc, IWM_FH_MEM_CBBC_QUEUE(qid),
1301                     txq->desc_dma.paddr >> 8);
1302                 IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
1303                     "%s: loading ring %d descriptors (%p) at %lx\n",
1304                     __func__,
1305                     qid, txq->desc,
1306                     (unsigned long) (txq->desc_dma.paddr >> 8));
1307         }
1308         iwm_nic_unlock(sc);
1309
1310         return 0;
1311 }
1312
1313 static int
1314 iwm_nic_init(struct iwm_softc *sc)
1315 {
1316         int error;
1317
1318         iwm_apm_init(sc);
1319         iwm_set_pwr(sc);
1320
1321         iwm_mvm_nic_config(sc);
1322
1323         if ((error = iwm_nic_rx_init(sc)) != 0)
1324                 return error;
1325
1326         /*
1327          * Ditto for TX, from iwn
1328          */
1329         if ((error = iwm_nic_tx_init(sc)) != 0)
1330                 return error;
1331
1332         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1333             "%s: shadow registers enabled\n", __func__);
1334         IWM_SETBITS(sc, IWM_CSR_MAC_SHADOW_REG_CTRL, 0x800fffff);
1335
1336         return 0;
1337 }
1338
1339 enum iwm_mvm_tx_fifo {
1340         IWM_MVM_TX_FIFO_BK = 0,
1341         IWM_MVM_TX_FIFO_BE,
1342         IWM_MVM_TX_FIFO_VI,
1343         IWM_MVM_TX_FIFO_VO,
1344         IWM_MVM_TX_FIFO_MCAST = 5,
1345 };
1346
1347 const uint8_t iwm_mvm_ac_to_tx_fifo[] = {
1348         IWM_MVM_TX_FIFO_VO,
1349         IWM_MVM_TX_FIFO_VI,
1350         IWM_MVM_TX_FIFO_BE,
1351         IWM_MVM_TX_FIFO_BK,
1352 };
1353
1354 static void
1355 iwm_enable_txq(struct iwm_softc *sc, int qid, int fifo)
1356 {
1357         if (!iwm_nic_lock(sc)) {
1358                 device_printf(sc->sc_dev,
1359                     "%s: cannot enable txq %d\n",
1360                     __func__,
1361                     qid);
1362                 return; /* XXX return EBUSY */
1363         }
1364
1365         /* unactivate before configuration */
1366         iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid),
1367             (0 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE)
1368             | (1 << IWM_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
1369
1370         if (qid != IWM_MVM_CMD_QUEUE) {
1371                 iwm_set_bits_prph(sc, IWM_SCD_QUEUECHAIN_SEL, (1 << qid));
1372         }
1373
1374         iwm_clear_bits_prph(sc, IWM_SCD_AGGR_SEL, (1 << qid));
1375
1376         IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, qid << 8 | 0);
1377         iwm_write_prph(sc, IWM_SCD_QUEUE_RDPTR(qid), 0);
1378
1379         iwm_write_mem32(sc, sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid), 0);
1380         /* Set scheduler window size and frame limit. */
1381         iwm_write_mem32(sc,
1382             sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid) +
1383             sizeof(uint32_t),
1384             ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
1385             IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
1386             ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
1387             IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
1388
1389         iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid),
1390             (1 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
1391             (fifo << IWM_SCD_QUEUE_STTS_REG_POS_TXF) |
1392             (1 << IWM_SCD_QUEUE_STTS_REG_POS_WSL) |
1393             IWM_SCD_QUEUE_STTS_REG_MSK);
1394
1395         iwm_nic_unlock(sc);
1396
1397         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
1398             "%s: enabled txq %d FIFO %d\n",
1399             __func__, qid, fifo);
1400 }
1401
1402 static int
1403 iwm_post_alive(struct iwm_softc *sc)
1404 {
1405         int nwords;
1406         int error, chnl;
1407
1408         if (!iwm_nic_lock(sc))
1409                 return EBUSY;
1410
1411         if (sc->sched_base != iwm_read_prph(sc, IWM_SCD_SRAM_BASE_ADDR)) {
1412                 device_printf(sc->sc_dev,
1413                     "%s: sched addr mismatch",
1414                     __func__);
1415                 error = EINVAL;
1416                 goto out;
1417         }
1418
1419         iwm_ict_reset(sc);
1420
1421         /* Clear TX scheduler state in SRAM. */
1422         nwords = (IWM_SCD_TRANS_TBL_MEM_UPPER_BOUND -
1423             IWM_SCD_CONTEXT_MEM_LOWER_BOUND)
1424             / sizeof(uint32_t);
1425         error = iwm_write_mem(sc,
1426             sc->sched_base + IWM_SCD_CONTEXT_MEM_LOWER_BOUND,
1427             NULL, nwords);
1428         if (error)
1429                 goto out;
1430
1431         /* Set physical address of TX scheduler rings (1KB aligned). */
1432         iwm_write_prph(sc, IWM_SCD_DRAM_BASE_ADDR, sc->sched_dma.paddr >> 10);
1433
1434         iwm_write_prph(sc, IWM_SCD_CHAINEXT_EN, 0);
1435
1436         /* enable command channel */
1437         iwm_enable_txq(sc, IWM_MVM_CMD_QUEUE, 7);
1438
1439         iwm_write_prph(sc, IWM_SCD_TXFACT, 0xff);
1440
1441         /* Enable DMA channels. */
1442         for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) {
1443                 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl),
1444                     IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
1445                     IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
1446         }
1447
1448         IWM_SETBITS(sc, IWM_FH_TX_CHICKEN_BITS_REG,
1449             IWM_FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
1450
1451         /* Enable L1-Active */
1452         iwm_clear_bits_prph(sc, IWM_APMG_PCIDEV_STT_REG,
1453             IWM_APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
1454
1455  out:
1456         iwm_nic_unlock(sc);
1457         return error;
1458 }
1459
1460 /*
1461  * NVM read access and content parsing.  We do not support
1462  * external NVM or writing NVM.
1463  * iwlwifi/mvm/nvm.c
1464  */
1465
1466 /* list of NVM sections we are allowed/need to read */
1467 const int nvm_to_read[] = {
1468         IWM_NVM_SECTION_TYPE_HW,
1469         IWM_NVM_SECTION_TYPE_SW,
1470         IWM_NVM_SECTION_TYPE_CALIBRATION,
1471         IWM_NVM_SECTION_TYPE_PRODUCTION,
1472 };
1473
1474 /* Default NVM size to read */
1475 #define IWM_NVM_DEFAULT_CHUNK_SIZE (2*1024)
1476 #define IWM_MAX_NVM_SECTION_SIZE 7000
1477
1478 #define IWM_NVM_WRITE_OPCODE 1
1479 #define IWM_NVM_READ_OPCODE 0
1480
1481 static int
1482 iwm_nvm_read_chunk(struct iwm_softc *sc, uint16_t section,
1483         uint16_t offset, uint16_t length, uint8_t *data, uint16_t *len)
1484 {
1485         offset = 0;
1486         struct iwm_nvm_access_cmd nvm_access_cmd = {
1487                 .offset = htole16(offset),
1488                 .length = htole16(length),
1489                 .type = htole16(section),
1490                 .op_code = IWM_NVM_READ_OPCODE,
1491         };
1492         struct iwm_nvm_access_resp *nvm_resp;
1493         struct iwm_rx_packet *pkt;
1494         struct iwm_host_cmd cmd = {
1495                 .id = IWM_NVM_ACCESS_CMD,
1496                 .flags = IWM_CMD_SYNC | IWM_CMD_WANT_SKB |
1497                     IWM_CMD_SEND_IN_RFKILL,
1498                 .data = { &nvm_access_cmd, },
1499         };
1500         int ret, bytes_read, offset_read;
1501         uint8_t *resp_data;
1502
1503         cmd.len[0] = sizeof(struct iwm_nvm_access_cmd);
1504
1505         ret = iwm_send_cmd(sc, &cmd);
1506         if (ret)
1507                 return ret;
1508
1509         pkt = cmd.resp_pkt;
1510         if (pkt->hdr.flags & IWM_CMD_FAILED_MSK) {
1511                 device_printf(sc->sc_dev,
1512                     "%s: Bad return from IWM_NVM_ACCES_COMMAND (0x%08X)\n",
1513                     __func__, pkt->hdr.flags);
1514                 ret = EIO;
1515                 goto exit;
1516         }
1517
1518         /* Extract NVM response */
1519         nvm_resp = (void *)pkt->data;
1520
1521         ret = le16toh(nvm_resp->status);
1522         bytes_read = le16toh(nvm_resp->length);
1523         offset_read = le16toh(nvm_resp->offset);
1524         resp_data = nvm_resp->data;
1525         if (ret) {
1526                 device_printf(sc->sc_dev,
1527                     "%s: NVM access command failed with status %d\n",
1528                     __func__, ret);
1529                 ret = EINVAL;
1530                 goto exit;
1531         }
1532
1533         if (offset_read != offset) {
1534                 device_printf(sc->sc_dev,
1535                     "%s: NVM ACCESS response with invalid offset %d\n",
1536                     __func__, offset_read);
1537                 ret = EINVAL;
1538                 goto exit;
1539         }
1540
1541         memcpy(data + offset, resp_data, bytes_read);
1542         *len = bytes_read;
1543
1544  exit:
1545         iwm_free_resp(sc, &cmd);
1546         return ret;
1547 }
1548
1549 /*
1550  * Reads an NVM section completely.
1551  * NICs prior to 7000 family doesn't have a real NVM, but just read
1552  * section 0 which is the EEPROM. Because the EEPROM reading is unlimited
1553  * by uCode, we need to manually check in this case that we don't
1554  * overflow and try to read more than the EEPROM size.
1555  * For 7000 family NICs, we supply the maximal size we can read, and
1556  * the uCode fills the response with as much data as we can,
1557  * without overflowing, so no check is needed.
1558  */
1559 static int
1560 iwm_nvm_read_section(struct iwm_softc *sc,
1561         uint16_t section, uint8_t *data, uint16_t *len)
1562 {
1563         uint16_t length, seglen;
1564         int error;
1565
1566         /* Set nvm section read length */
1567         length = seglen = IWM_NVM_DEFAULT_CHUNK_SIZE;
1568         *len = 0;
1569
1570         /* Read the NVM until exhausted (reading less than requested) */
1571         while (seglen == length) {
1572                 error = iwm_nvm_read_chunk(sc,
1573                     section, *len, length, data, &seglen);
1574                 if (error) {
1575                         device_printf(sc->sc_dev,
1576                             "Cannot read NVM from section "
1577                             "%d offset %d, length %d\n",
1578                             section, *len, length);
1579                         return error;
1580                 }
1581                 *len += seglen;
1582         }
1583
1584         IWM_DPRINTF(sc, IWM_DEBUG_RESET,
1585             "NVM section %d read completed\n", section);
1586         return 0;
1587 }
1588
1589 /*
1590  * BEGIN IWM_NVM_PARSE
1591  */
1592
1593 /* iwlwifi/iwl-nvm-parse.c */
1594
1595 /* NVM offsets (in words) definitions */
1596 enum wkp_nvm_offsets {
1597         /* NVM HW-Section offset (in words) definitions */
1598         IWM_HW_ADDR = 0x15,
1599
1600 /* NVM SW-Section offset (in words) definitions */
1601         IWM_NVM_SW_SECTION = 0x1C0,
1602         IWM_NVM_VERSION = 0,
1603         IWM_RADIO_CFG = 1,
1604         IWM_SKU = 2,
1605         IWM_N_HW_ADDRS = 3,
1606         IWM_NVM_CHANNELS = 0x1E0 - IWM_NVM_SW_SECTION,
1607
1608 /* NVM calibration section offset (in words) definitions */
1609         IWM_NVM_CALIB_SECTION = 0x2B8,
1610         IWM_XTAL_CALIB = 0x316 - IWM_NVM_CALIB_SECTION
1611 };
1612
1613 /* SKU Capabilities (actual values from NVM definition) */
1614 enum nvm_sku_bits {
1615         IWM_NVM_SKU_CAP_BAND_24GHZ      = (1 << 0),
1616         IWM_NVM_SKU_CAP_BAND_52GHZ      = (1 << 1),
1617         IWM_NVM_SKU_CAP_11N_ENABLE      = (1 << 2),
1618         IWM_NVM_SKU_CAP_11AC_ENABLE     = (1 << 3),
1619 };
1620
1621 /* radio config bits (actual values from NVM definition) */
1622 #define IWM_NVM_RF_CFG_DASH_MSK(x)   (x & 0x3)         /* bits 0-1   */
1623 #define IWM_NVM_RF_CFG_STEP_MSK(x)   ((x >> 2)  & 0x3) /* bits 2-3   */
1624 #define IWM_NVM_RF_CFG_TYPE_MSK(x)   ((x >> 4)  & 0x3) /* bits 4-5   */
1625 #define IWM_NVM_RF_CFG_PNUM_MSK(x)   ((x >> 6)  & 0x3) /* bits 6-7   */
1626 #define IWM_NVM_RF_CFG_TX_ANT_MSK(x) ((x >> 8)  & 0xF) /* bits 8-11  */
1627 #define IWM_NVM_RF_CFG_RX_ANT_MSK(x) ((x >> 12) & 0xF) /* bits 12-15 */
1628
1629 #define DEFAULT_MAX_TX_POWER 16
1630
1631 /**
1632  * enum iwm_nvm_channel_flags - channel flags in NVM
1633  * @IWM_NVM_CHANNEL_VALID: channel is usable for this SKU/geo
1634  * @IWM_NVM_CHANNEL_IBSS: usable as an IBSS channel
1635  * @IWM_NVM_CHANNEL_ACTIVE: active scanning allowed
1636  * @IWM_NVM_CHANNEL_RADAR: radar detection required
1637  * @IWM_NVM_CHANNEL_DFS: dynamic freq selection candidate
1638  * @IWM_NVM_CHANNEL_WIDE: 20 MHz channel okay (?)
1639  * @IWM_NVM_CHANNEL_40MHZ: 40 MHz channel okay (?)
1640  * @IWM_NVM_CHANNEL_80MHZ: 80 MHz channel okay (?)
1641  * @IWM_NVM_CHANNEL_160MHZ: 160 MHz channel okay (?)
1642  */
1643 enum iwm_nvm_channel_flags {
1644         IWM_NVM_CHANNEL_VALID = (1 << 0),
1645         IWM_NVM_CHANNEL_IBSS = (1 << 1),
1646         IWM_NVM_CHANNEL_ACTIVE = (1 << 3),
1647         IWM_NVM_CHANNEL_RADAR = (1 << 4),
1648         IWM_NVM_CHANNEL_DFS = (1 << 7),
1649         IWM_NVM_CHANNEL_WIDE = (1 << 8),
1650         IWM_NVM_CHANNEL_40MHZ = (1 << 9),
1651         IWM_NVM_CHANNEL_80MHZ = (1 << 10),
1652         IWM_NVM_CHANNEL_160MHZ = (1 << 11),
1653 };
1654
1655 /*
1656  * Add a channel to the net80211 channel list.
1657  *
1658  * ieee is the ieee channel number
1659  * ch_idx is channel index.
1660  * mode is the channel mode - CHAN_A, CHAN_B, CHAN_G.
1661  * ch_flags is the iwm channel flags.
1662  *
1663  * Return 0 on OK, < 0 on error.
1664  */
1665 static int
1666 iwm_init_net80211_channel(struct iwm_softc *sc, int ieee, int ch_idx,
1667     int mode, uint16_t ch_flags)
1668 {
1669         /* XXX for now, no overflow checking! */
1670         struct ieee80211com *ic = &sc->sc_ic;
1671         int is_5ghz, flags;
1672         struct ieee80211_channel *channel;
1673
1674         channel = &ic->ic_channels[ic->ic_nchans++];
1675         channel->ic_ieee = ieee;
1676
1677         is_5ghz = ch_idx >= IWM_NUM_2GHZ_CHANNELS;
1678         if (!is_5ghz) {
1679                 flags = IEEE80211_CHAN_2GHZ;
1680                 channel->ic_flags = mode;
1681         } else {
1682                 flags = IEEE80211_CHAN_5GHZ;
1683                 channel->ic_flags = mode;
1684         }
1685         channel->ic_freq = ieee80211_ieee2mhz(ieee, flags);
1686
1687         if (!(ch_flags & IWM_NVM_CHANNEL_ACTIVE))
1688                 channel->ic_flags |= IEEE80211_CHAN_PASSIVE;
1689         return (0);
1690 }
1691
1692 static void
1693 iwm_init_channel_map(struct iwm_softc *sc, const uint16_t * const nvm_ch_flags)
1694 {
1695         struct ieee80211com *ic = &sc->sc_ic;
1696         struct iwm_nvm_data *data = &sc->sc_nvm;
1697         int ch_idx;
1698         uint16_t ch_flags;
1699         int hw_value;
1700
1701         for (ch_idx = 0; ch_idx < nitems(iwm_nvm_channels); ch_idx++) {
1702                 ch_flags = le16_to_cpup(nvm_ch_flags + ch_idx);
1703
1704                 if (ch_idx >= IWM_NUM_2GHZ_CHANNELS &&
1705                     !data->sku_cap_band_52GHz_enable)
1706                         ch_flags &= ~IWM_NVM_CHANNEL_VALID;
1707
1708                 if (!(ch_flags & IWM_NVM_CHANNEL_VALID)) {
1709                         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1710                             "Ch. %d Flags %x [%sGHz] - No traffic\n",
1711                             iwm_nvm_channels[ch_idx],
1712                             ch_flags,
1713                             (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ?
1714                             "5.2" : "2.4");
1715                         continue;
1716                 }
1717
1718                 hw_value = iwm_nvm_channels[ch_idx];
1719
1720                 /* 5GHz? */
1721                 if (ch_idx >= IWM_NUM_2GHZ_CHANNELS) {
1722                         (void) iwm_init_net80211_channel(sc, hw_value,
1723                             ch_idx,
1724                             IEEE80211_CHAN_A,
1725                             ch_flags);
1726                 } else {
1727                         (void) iwm_init_net80211_channel(sc, hw_value,
1728                             ch_idx,
1729                             IEEE80211_CHAN_B,
1730                             ch_flags);
1731                         /* If it's not channel 13, also add 11g */
1732                         if (hw_value != 13)
1733                                 (void) iwm_init_net80211_channel(sc, hw_value,
1734                                     ch_idx,
1735                                     IEEE80211_CHAN_G,
1736                                     ch_flags);
1737                 }
1738
1739                 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1740                     "Ch. %d Flags %x [%sGHz] - Added\n",
1741                     iwm_nvm_channels[ch_idx],
1742                     ch_flags,
1743                     (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ?
1744                     "5.2" : "2.4");
1745         }
1746         ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
1747 }
1748
1749 static int
1750 iwm_parse_nvm_data(struct iwm_softc *sc,
1751         const uint16_t *nvm_hw, const uint16_t *nvm_sw,
1752         const uint16_t *nvm_calib, uint8_t tx_chains, uint8_t rx_chains)
1753 {
1754         struct iwm_nvm_data *data = &sc->sc_nvm;
1755         uint8_t hw_addr[IEEE80211_ADDR_LEN];
1756         uint16_t radio_cfg, sku;
1757
1758         data->nvm_version = le16_to_cpup(nvm_sw + IWM_NVM_VERSION);
1759
1760         radio_cfg = le16_to_cpup(nvm_sw + IWM_RADIO_CFG);
1761         data->radio_cfg_type = IWM_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1762         data->radio_cfg_step = IWM_NVM_RF_CFG_STEP_MSK(radio_cfg);
1763         data->radio_cfg_dash = IWM_NVM_RF_CFG_DASH_MSK(radio_cfg);
1764         data->radio_cfg_pnum = IWM_NVM_RF_CFG_PNUM_MSK(radio_cfg);
1765         data->valid_tx_ant = IWM_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1766         data->valid_rx_ant = IWM_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1767
1768         sku = le16_to_cpup(nvm_sw + IWM_SKU);
1769         data->sku_cap_band_24GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_24GHZ;
1770         data->sku_cap_band_52GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_52GHZ;
1771         data->sku_cap_11n_enable = 0;
1772
1773         if (!data->valid_tx_ant || !data->valid_rx_ant) {
1774                 device_printf(sc->sc_dev,
1775                     "%s: invalid antennas (0x%x, 0x%x)\n",
1776                     __func__, data->valid_tx_ant,
1777                     data->valid_rx_ant);
1778                 return EINVAL;
1779         }
1780
1781         data->n_hw_addrs = le16_to_cpup(nvm_sw + IWM_N_HW_ADDRS);
1782
1783         data->xtal_calib[0] = *(nvm_calib + IWM_XTAL_CALIB);
1784         data->xtal_calib[1] = *(nvm_calib + IWM_XTAL_CALIB + 1);
1785
1786         /* The byte order is little endian 16 bit, meaning 214365 */
1787         IEEE80211_ADDR_COPY(hw_addr, nvm_hw + IWM_HW_ADDR);
1788         data->hw_addr[0] = hw_addr[1];
1789         data->hw_addr[1] = hw_addr[0];
1790         data->hw_addr[2] = hw_addr[3];
1791         data->hw_addr[3] = hw_addr[2];
1792         data->hw_addr[4] = hw_addr[5];
1793         data->hw_addr[5] = hw_addr[4];
1794
1795         iwm_init_channel_map(sc, &nvm_sw[IWM_NVM_CHANNELS]);
1796         data->calib_version = 255;   /* TODO:
1797                                         this value will prevent some checks from
1798                                         failing, we need to check if this
1799                                         field is still needed, and if it does,
1800                                         where is it in the NVM */
1801
1802         return 0;
1803 }
1804
1805 /*
1806  * END NVM PARSE
1807  */
1808
1809 struct iwm_nvm_section {
1810         uint16_t length;
1811         const uint8_t *data;
1812 };
1813
1814 static int
1815 iwm_parse_nvm_sections(struct iwm_softc *sc, struct iwm_nvm_section *sections)
1816 {
1817         const uint16_t *hw, *sw, *calib;
1818
1819         /* Checking for required sections */
1820         if (!sections[IWM_NVM_SECTION_TYPE_SW].data ||
1821             !sections[IWM_NVM_SECTION_TYPE_HW].data) {
1822                 device_printf(sc->sc_dev,
1823                     "%s: Can't parse empty NVM sections\n",
1824                     __func__);
1825                 return ENOENT;
1826         }
1827
1828         hw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_HW].data;
1829         sw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_SW].data;
1830         calib = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_CALIBRATION].data;
1831         return iwm_parse_nvm_data(sc, hw, sw, calib,
1832             IWM_FW_VALID_TX_ANT(sc), IWM_FW_VALID_RX_ANT(sc));
1833 }
1834
1835 static int
1836 iwm_nvm_init(struct iwm_softc *sc)
1837 {
1838         struct iwm_nvm_section nvm_sections[IWM_NVM_NUM_OF_SECTIONS];
1839         int i, section, error;
1840         uint16_t len;
1841         uint8_t *nvm_buffer, *temp;
1842
1843         /* Read From FW NVM */
1844         IWM_DPRINTF(sc, IWM_DEBUG_EEPROM,
1845             "%s: Read NVM\n",
1846             __func__);
1847
1848         /* TODO: find correct NVM max size for a section */
1849         nvm_buffer = malloc(IWM_OTP_LOW_IMAGE_SIZE, M_DEVBUF, M_NOWAIT);
1850         if (nvm_buffer == NULL)
1851                 return (ENOMEM);
1852         for (i = 0; i < nitems(nvm_to_read); i++) {
1853                 section = nvm_to_read[i];
1854                 KASSERT(section <= nitems(nvm_sections),
1855                     ("too many sections"));
1856
1857                 error = iwm_nvm_read_section(sc, section, nvm_buffer, &len);
1858                 if (error)
1859                         break;
1860
1861                 temp = malloc(len, M_DEVBUF, M_NOWAIT);
1862                 if (temp == NULL) {
1863                         error = ENOMEM;
1864                         break;
1865                 }
1866                 memcpy(temp, nvm_buffer, len);
1867                 nvm_sections[section].data = temp;
1868                 nvm_sections[section].length = len;
1869         }
1870         free(nvm_buffer, M_DEVBUF);
1871         if (error)
1872                 return error;
1873
1874         return iwm_parse_nvm_sections(sc, nvm_sections);
1875 }
1876
1877 /*
1878  * Firmware loading gunk.  This is kind of a weird hybrid between the
1879  * iwn driver and the Linux iwlwifi driver.
1880  */
1881
1882 static int
1883 iwm_firmware_load_chunk(struct iwm_softc *sc, uint32_t dst_addr,
1884         const uint8_t *section, uint32_t byte_cnt)
1885 {
1886         struct iwm_dma_info *dma = &sc->fw_dma;
1887         int error;
1888
1889         /* Copy firmware section into pre-allocated DMA-safe memory. */
1890         memcpy(dma->vaddr, section, byte_cnt);
1891         bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
1892
1893         if (!iwm_nic_lock(sc))
1894                 return EBUSY;
1895
1896         sc->sc_fw_chunk_done = 0;
1897
1898         IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL),
1899             IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
1900         IWM_WRITE(sc, IWM_FH_SRVC_CHNL_SRAM_ADDR_REG(IWM_FH_SRVC_CHNL),
1901             dst_addr);
1902         IWM_WRITE(sc, IWM_FH_TFDIB_CTRL0_REG(IWM_FH_SRVC_CHNL),
1903             dma->paddr & IWM_FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
1904         IWM_WRITE(sc, IWM_FH_TFDIB_CTRL1_REG(IWM_FH_SRVC_CHNL),
1905             (iwm_get_dma_hi_addr(dma->paddr)
1906               << IWM_FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
1907         IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_BUF_STS_REG(IWM_FH_SRVC_CHNL),
1908             1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
1909             1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
1910             IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
1911         IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL),
1912             IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE    |
1913             IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE |
1914             IWM_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
1915
1916         iwm_nic_unlock(sc);
1917
1918         /* wait 1s for this segment to load */
1919         while (!sc->sc_fw_chunk_done)
1920                 if ((error = msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfw", hz)) != 0)
1921                         break;
1922
1923         return error;
1924 }
1925
1926 static int
1927 iwm_load_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type)
1928 {
1929         struct iwm_fw_sects *fws;
1930         int error, i, w;
1931         const void *data;
1932         uint32_t dlen;
1933         uint32_t offset;
1934
1935         sc->sc_uc.uc_intr = 0;
1936
1937         fws = &sc->sc_fw.fw_sects[ucode_type];
1938         for (i = 0; i < fws->fw_count; i++) {
1939                 data = fws->fw_sect[i].fws_data;
1940                 dlen = fws->fw_sect[i].fws_len;
1941                 offset = fws->fw_sect[i].fws_devoff;
1942                 IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV,
1943                     "LOAD FIRMWARE type %d offset %u len %d\n",
1944                     ucode_type, offset, dlen);
1945                 error = iwm_firmware_load_chunk(sc, offset, data, dlen);
1946                 if (error) {
1947                         device_printf(sc->sc_dev,
1948                             "%s: chunk %u of %u returned error %02d\n",
1949                             __func__, i, fws->fw_count, error);
1950                         return error;
1951                 }
1952         }
1953
1954         /* wait for the firmware to load */
1955         IWM_WRITE(sc, IWM_CSR_RESET, 0);
1956
1957         for (w = 0; !sc->sc_uc.uc_intr && w < 10; w++) {
1958                 error = msleep(&sc->sc_uc, &sc->sc_mtx, 0, "iwmuc", hz/10);
1959         }
1960
1961         return error;
1962 }
1963
1964 /* iwlwifi: pcie/trans.c */
1965 static int
1966 iwm_start_fw(struct iwm_softc *sc, enum iwm_ucode_type ucode_type)
1967 {
1968         int error;
1969
1970         IWM_WRITE(sc, IWM_CSR_INT, ~0);
1971
1972         if ((error = iwm_nic_init(sc)) != 0) {
1973                 device_printf(sc->sc_dev, "unable to init nic\n");
1974                 return error;
1975         }
1976
1977         /* make sure rfkill handshake bits are cleared */
1978         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
1979         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR,
1980             IWM_CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
1981
1982         /* clear (again), then enable host interrupts */
1983         IWM_WRITE(sc, IWM_CSR_INT, ~0);
1984         iwm_enable_interrupts(sc);
1985
1986         /* really make sure rfkill handshake bits are cleared */
1987         /* maybe we should write a few times more?  just to make sure */
1988         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
1989         IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL);
1990
1991         /* Load the given image to the HW */
1992         return iwm_load_firmware(sc, ucode_type);
1993 }
1994
1995 static int
1996 iwm_fw_alive(struct iwm_softc *sc, uint32_t sched_base)
1997 {
1998         return iwm_post_alive(sc);
1999 }
2000
2001 static int
2002 iwm_send_tx_ant_cfg(struct iwm_softc *sc, uint8_t valid_tx_ant)
2003 {
2004         struct iwm_tx_ant_cfg_cmd tx_ant_cmd = {
2005                 .valid = htole32(valid_tx_ant),
2006         };
2007
2008         return iwm_mvm_send_cmd_pdu(sc, IWM_TX_ANT_CONFIGURATION_CMD,
2009             IWM_CMD_SYNC, sizeof(tx_ant_cmd), &tx_ant_cmd);
2010 }
2011
2012 /* iwlwifi: mvm/fw.c */
2013 static int
2014 iwm_send_phy_cfg_cmd(struct iwm_softc *sc)
2015 {
2016         struct iwm_phy_cfg_cmd phy_cfg_cmd;
2017         enum iwm_ucode_type ucode_type = sc->sc_uc_current;
2018
2019         /* Set parameters */
2020         phy_cfg_cmd.phy_cfg = htole32(sc->sc_fw_phy_config);
2021         phy_cfg_cmd.calib_control.event_trigger =
2022             sc->sc_default_calib[ucode_type].event_trigger;
2023         phy_cfg_cmd.calib_control.flow_trigger =
2024             sc->sc_default_calib[ucode_type].flow_trigger;
2025
2026         IWM_DPRINTF(sc, IWM_DEBUG_CMD | IWM_DEBUG_RESET,
2027             "Sending Phy CFG command: 0x%x\n", phy_cfg_cmd.phy_cfg);
2028         return iwm_mvm_send_cmd_pdu(sc, IWM_PHY_CONFIGURATION_CMD, IWM_CMD_SYNC,
2029             sizeof(phy_cfg_cmd), &phy_cfg_cmd);
2030 }
2031
2032 static int
2033 iwm_mvm_load_ucode_wait_alive(struct iwm_softc *sc,
2034         enum iwm_ucode_type ucode_type)
2035 {
2036         enum iwm_ucode_type old_type = sc->sc_uc_current;
2037         int error;
2038
2039         if ((error = iwm_read_firmware(sc, ucode_type)) != 0)
2040                 return error;
2041
2042         sc->sc_uc_current = ucode_type;
2043         error = iwm_start_fw(sc, ucode_type);
2044         if (error) {
2045                 sc->sc_uc_current = old_type;
2046                 return error;
2047         }
2048
2049         return iwm_fw_alive(sc, sc->sched_base);
2050 }
2051
2052 /*
2053  * mvm misc bits
2054  */
2055
2056 /*
2057  * follows iwlwifi/fw.c
2058  */
2059 static int
2060 iwm_run_init_mvm_ucode(struct iwm_softc *sc, int justnvm)
2061 {
2062         int error;
2063
2064         /* do not operate with rfkill switch turned on */
2065         if ((sc->sc_flags & IWM_FLAG_RFKILL) && !justnvm) {
2066                 device_printf(sc->sc_dev,
2067                     "radio is disabled by hardware switch\n");
2068                 return EPERM;
2069         }
2070
2071         sc->sc_init_complete = 0;
2072         if ((error = iwm_mvm_load_ucode_wait_alive(sc,
2073             IWM_UCODE_TYPE_INIT)) != 0)
2074                 return error;
2075
2076         if (justnvm) {
2077                 if ((error = iwm_nvm_init(sc)) != 0) {
2078                         device_printf(sc->sc_dev, "failed to read nvm\n");
2079                         return error;
2080                 }
2081                 IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, sc->sc_nvm.hw_addr);
2082
2083                 sc->sc_scan_cmd_len = sizeof(struct iwm_scan_cmd)
2084                     + sc->sc_capa_max_probe_len
2085                     + IWM_MAX_NUM_SCAN_CHANNELS
2086                     * sizeof(struct iwm_scan_channel);
2087                 sc->sc_scan_cmd = malloc(sc->sc_scan_cmd_len, M_DEVBUF,
2088                     M_NOWAIT);
2089                 if (sc->sc_scan_cmd == NULL)
2090                         return (ENOMEM);
2091
2092                 return 0;
2093         }
2094
2095         /* Send TX valid antennas before triggering calibrations */
2096         if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0)
2097                 return error;
2098
2099         /*
2100         * Send phy configurations command to init uCode
2101         * to start the 16.0 uCode init image internal calibrations.
2102         */
2103         if ((error = iwm_send_phy_cfg_cmd(sc)) != 0 ) {
2104                 device_printf(sc->sc_dev,
2105                     "%s: failed to run internal calibration: %d\n",
2106                     __func__, error);
2107                 return error;
2108         }
2109
2110         /*
2111          * Nothing to do but wait for the init complete notification
2112          * from the firmware
2113          */
2114         while (!sc->sc_init_complete)
2115                 if ((error = msleep(&sc->sc_init_complete, &sc->sc_mtx,
2116                     0, "iwminit", 2*hz)) != 0)
2117                         break;
2118
2119         return error;
2120 }
2121
2122 /*
2123  * receive side
2124  */
2125
2126 /* (re)stock rx ring, called at init-time and at runtime */
2127 static int
2128 iwm_rx_addbuf(struct iwm_softc *sc, int size, int idx)
2129 {
2130         struct iwm_rx_ring *ring = &sc->rxq;
2131         struct iwm_rx_data *data = &ring->data[idx];
2132         struct mbuf *m;
2133         int error;
2134         bus_addr_t paddr;
2135
2136         m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWM_RBUF_SIZE);
2137         if (m == NULL)
2138                 return ENOBUFS;
2139
2140         if (data->m != NULL)
2141                 bus_dmamap_unload(ring->data_dmat, data->map);
2142
2143         m->m_len = m->m_pkthdr.len = m->m_ext.ext_size;
2144         error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
2145         if (error != 0) {
2146                 device_printf(sc->sc_dev,
2147                     "%s: could not create RX buf DMA map, error %d\n",
2148                     __func__, error);
2149                 goto fail;
2150         }
2151         data->m = m;
2152         error = bus_dmamap_load(ring->data_dmat, data->map,
2153             mtod(data->m, void *), IWM_RBUF_SIZE, iwm_dma_map_addr,
2154             &paddr, BUS_DMA_NOWAIT);
2155         if (error != 0 && error != EFBIG) {
2156                 device_printf(sc->sc_dev,
2157                     "%s: can't not map mbuf, error %d\n", __func__,
2158                     error);
2159                 goto fail;
2160         }
2161         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREREAD);
2162
2163         /* Update RX descriptor. */
2164         ring->desc[idx] = htole32(paddr >> 8);
2165         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2166             BUS_DMASYNC_PREWRITE);
2167
2168         return 0;
2169 fail:
2170         return error;
2171 }
2172
2173 /* iwlwifi: mvm/rx.c */
2174 #define IWM_RSSI_OFFSET 50
2175 static int
2176 iwm_mvm_calc_rssi(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info)
2177 {
2178         int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm;
2179         uint32_t agc_a, agc_b;
2180         uint32_t val;
2181
2182         val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_AGC_IDX]);
2183         agc_a = (val & IWM_OFDM_AGC_A_MSK) >> IWM_OFDM_AGC_A_POS;
2184         agc_b = (val & IWM_OFDM_AGC_B_MSK) >> IWM_OFDM_AGC_B_POS;
2185
2186         val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_RSSI_AB_IDX]);
2187         rssi_a = (val & IWM_OFDM_RSSI_INBAND_A_MSK) >> IWM_OFDM_RSSI_A_POS;
2188         rssi_b = (val & IWM_OFDM_RSSI_INBAND_B_MSK) >> IWM_OFDM_RSSI_B_POS;
2189
2190         /*
2191          * dBm = rssi dB - agc dB - constant.
2192          * Higher AGC (higher radio gain) means lower signal.
2193          */
2194         rssi_a_dbm = rssi_a - IWM_RSSI_OFFSET - agc_a;
2195         rssi_b_dbm = rssi_b - IWM_RSSI_OFFSET - agc_b;
2196         max_rssi_dbm = MAX(rssi_a_dbm, rssi_b_dbm);
2197
2198         IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2199             "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n",
2200             rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b);
2201
2202         return max_rssi_dbm;
2203 }
2204
2205 /* iwlwifi: mvm/rx.c */
2206 /*
2207  * iwm_mvm_get_signal_strength - use new rx PHY INFO API
2208  * values are reported by the fw as positive values - need to negate
2209  * to obtain their dBM.  Account for missing antennas by replacing 0
2210  * values by -256dBm: practically 0 power and a non-feasible 8 bit value.
2211  */
2212 static int
2213 iwm_mvm_get_signal_strength(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info)
2214 {
2215         int energy_a, energy_b, energy_c, max_energy;
2216         uint32_t val;
2217
2218         val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_ENERGY_ANT_ABC_IDX]);
2219         energy_a = (val & IWM_RX_INFO_ENERGY_ANT_A_MSK) >>
2220             IWM_RX_INFO_ENERGY_ANT_A_POS;
2221         energy_a = energy_a ? -energy_a : -256;
2222         energy_b = (val & IWM_RX_INFO_ENERGY_ANT_B_MSK) >>
2223             IWM_RX_INFO_ENERGY_ANT_B_POS;
2224         energy_b = energy_b ? -energy_b : -256;
2225         energy_c = (val & IWM_RX_INFO_ENERGY_ANT_C_MSK) >>
2226             IWM_RX_INFO_ENERGY_ANT_C_POS;
2227         energy_c = energy_c ? -energy_c : -256;
2228         max_energy = MAX(energy_a, energy_b);
2229         max_energy = MAX(max_energy, energy_c);
2230
2231         IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2232             "energy In A %d B %d C %d , and max %d\n",
2233             energy_a, energy_b, energy_c, max_energy);
2234
2235         return max_energy;
2236 }
2237
2238 static void
2239 iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *sc,
2240         struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
2241 {
2242         struct iwm_rx_phy_info *phy_info = (void *)pkt->data;
2243
2244         IWM_DPRINTF(sc, IWM_DEBUG_RECV, "received PHY stats\n");
2245         bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2246
2247         memcpy(&sc->sc_last_phy_info, phy_info, sizeof(sc->sc_last_phy_info));
2248 }
2249
2250 /*
2251  * Retrieve the average noise (in dBm) among receivers.
2252  */
2253 static int
2254 iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *stats)
2255 {
2256         int i, total, nbant, noise;
2257
2258         total = nbant = noise = 0;
2259         for (i = 0; i < 3; i++) {
2260                 noise = le32toh(stats->beacon_silence_rssi[i]) & 0xff;
2261                 if (noise) {
2262                         total += noise;
2263                         nbant++;
2264                 }
2265         }
2266
2267         /* There should be at least one antenna but check anyway. */
2268         return (nbant == 0) ? -127 : (total / nbant) - 107;
2269 }
2270
2271 /*
2272  * iwm_mvm_rx_rx_mpdu - IWM_REPLY_RX_MPDU_CMD handler
2273  *
2274  * Handles the actual data of the Rx packet from the fw
2275  */
2276 static void
2277 iwm_mvm_rx_rx_mpdu(struct iwm_softc *sc,
2278         struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
2279 {
2280         struct ieee80211com *ic = &sc->sc_ic;
2281         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2282         struct ieee80211_frame *wh;
2283         struct ieee80211_node *ni;
2284         struct ieee80211_rx_stats rxs;
2285         struct mbuf *m;
2286         struct iwm_rx_phy_info *phy_info;
2287         struct iwm_rx_mpdu_res_start *rx_res;
2288         uint32_t len;
2289         uint32_t rx_pkt_status;
2290         int rssi;
2291
2292         bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2293
2294         phy_info = &sc->sc_last_phy_info;
2295         rx_res = (struct iwm_rx_mpdu_res_start *)pkt->data;
2296         wh = (struct ieee80211_frame *)(pkt->data + sizeof(*rx_res));
2297         len = le16toh(rx_res->byte_count);
2298         rx_pkt_status = le32toh(*(uint32_t *)(pkt->data + sizeof(*rx_res) + len));
2299
2300         m = data->m;
2301         m->m_data = pkt->data + sizeof(*rx_res);
2302         m->m_pkthdr.len = m->m_len = len;
2303
2304         if (__predict_false(phy_info->cfg_phy_cnt > 20)) {
2305                 device_printf(sc->sc_dev,
2306                     "dsp size out of range [0,20]: %d\n",
2307                     phy_info->cfg_phy_cnt);
2308                 return;
2309         }
2310
2311         if (!(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_CRC_OK) ||
2312             !(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_OVERRUN_OK)) {
2313                 IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2314                     "Bad CRC or FIFO: 0x%08X.\n", rx_pkt_status);
2315                 return; /* drop */
2316         }
2317
2318         if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_RX_ENERGY_API) {
2319                 rssi = iwm_mvm_get_signal_strength(sc, phy_info);
2320         } else {
2321                 rssi = iwm_mvm_calc_rssi(sc, phy_info);
2322         }
2323         rssi = (0 - IWM_MIN_DBM) + rssi;        /* normalize */
2324         rssi = MIN(rssi, sc->sc_max_rssi);      /* clip to max. 100% */
2325
2326         /* replenish ring for the buffer we're going to feed to the sharks */
2327         if (iwm_rx_addbuf(sc, IWM_RBUF_SIZE, sc->rxq.cur) != 0) {
2328                 device_printf(sc->sc_dev, "%s: unable to add more buffers\n",
2329                     __func__);
2330                 return;
2331         }
2332
2333         ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
2334
2335         IWM_DPRINTF(sc, IWM_DEBUG_RECV,
2336             "%s: phy_info: channel=%d, flags=0x%08x\n",
2337             __func__,
2338             le16toh(phy_info->channel),
2339             le16toh(phy_info->phy_flags));
2340
2341         /*
2342          * Populate an RX state struct with the provided information.
2343          */
2344         bzero(&rxs, sizeof(rxs));
2345         rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ;
2346         rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
2347         rxs.c_ieee = le16toh(phy_info->channel);
2348         if (le16toh(phy_info->phy_flags & IWM_RX_RES_PHY_FLAGS_BAND_24)) {
2349                 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ);
2350         } else {
2351                 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_5GHZ);
2352         }
2353         rxs.rssi = rssi - sc->sc_noise;
2354         rxs.nf = sc->sc_noise;
2355
2356         if (ieee80211_radiotap_active_vap(vap)) {
2357                 struct iwm_rx_radiotap_header *tap = &sc->sc_rxtap;
2358
2359                 tap->wr_flags = 0;
2360                 if (phy_info->phy_flags & htole16(IWM_PHY_INFO_FLAG_SHPREAMBLE))
2361                         tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2362                 tap->wr_chan_freq = htole16(rxs.c_freq);
2363                 /* XXX only if ic->ic_curchan->ic_ieee == rxs.c_ieee */
2364                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2365                 tap->wr_dbm_antsignal = (int8_t)rssi;
2366                 tap->wr_dbm_antnoise = (int8_t)sc->sc_noise;
2367                 tap->wr_tsft = phy_info->system_timestamp;
2368                 switch (phy_info->rate) {
2369                 /* CCK rates. */
2370                 case  10: tap->wr_rate =   2; break;
2371                 case  20: tap->wr_rate =   4; break;
2372                 case  55: tap->wr_rate =  11; break;
2373                 case 110: tap->wr_rate =  22; break;
2374                 /* OFDM rates. */
2375                 case 0xd: tap->wr_rate =  12; break;
2376                 case 0xf: tap->wr_rate =  18; break;
2377                 case 0x5: tap->wr_rate =  24; break;
2378                 case 0x7: tap->wr_rate =  36; break;
2379                 case 0x9: tap->wr_rate =  48; break;
2380                 case 0xb: tap->wr_rate =  72; break;
2381                 case 0x1: tap->wr_rate =  96; break;
2382                 case 0x3: tap->wr_rate = 108; break;
2383                 /* Unknown rate: should not happen. */
2384                 default:  tap->wr_rate =   0;
2385                 }
2386         }
2387
2388         IWM_UNLOCK(sc);
2389         if (ni != NULL) {
2390                 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "input m %p\n", m);
2391                 ieee80211_input_mimo(ni, m, &rxs);
2392                 ieee80211_free_node(ni);
2393         } else {
2394                 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "inputall m %p\n", m);
2395                 ieee80211_input_mimo_all(ic, m, &rxs);
2396         }
2397         IWM_LOCK(sc);
2398 }
2399
2400 static int
2401 iwm_mvm_rx_tx_cmd_single(struct iwm_softc *sc, struct iwm_rx_packet *pkt,
2402         struct iwm_node *in)
2403 {
2404         struct iwm_mvm_tx_resp *tx_resp = (void *)pkt->data;
2405         struct ieee80211_node *ni = &in->in_ni;
2406         struct ieee80211vap *vap = ni->ni_vap;
2407         int status = le16toh(tx_resp->status.status) & IWM_TX_STATUS_MSK;
2408         int failack = tx_resp->failure_frame;
2409
2410         KASSERT(tx_resp->frame_count == 1, ("too many frames"));
2411
2412         /* Update rate control statistics. */
2413         IWM_DPRINTF(sc, IWM_DEBUG_XMIT, "%s: status=0x%04x, seq=%d, fc=%d, btc=%d, frts=%d, ff=%d, irate=%08x, wmt=%d\n",
2414             __func__,
2415             (int) le16toh(tx_resp->status.status),
2416             (int) le16toh(tx_resp->status.sequence),
2417             tx_resp->frame_count,
2418             tx_resp->bt_kill_count,
2419             tx_resp->failure_rts,
2420             tx_resp->failure_frame,
2421             le32toh(tx_resp->initial_rate),
2422             (int) le16toh(tx_resp->wireless_media_time));
2423
2424         if (status != IWM_TX_STATUS_SUCCESS &&
2425             status != IWM_TX_STATUS_DIRECT_DONE) {
2426                 ieee80211_ratectl_tx_complete(vap, ni,
2427                     IEEE80211_RATECTL_TX_FAILURE, &failack, NULL);
2428                 return (1);
2429         } else {
2430                 ieee80211_ratectl_tx_complete(vap, ni,
2431                     IEEE80211_RATECTL_TX_SUCCESS, &failack, NULL);
2432                 return (0);
2433         }
2434 }
2435
2436 static void
2437 iwm_mvm_rx_tx_cmd(struct iwm_softc *sc,
2438         struct iwm_rx_packet *pkt, struct iwm_rx_data *data)
2439 {
2440         struct iwm_cmd_header *cmd_hdr = &pkt->hdr;
2441         int idx = cmd_hdr->idx;
2442         int qid = cmd_hdr->qid;
2443         struct iwm_tx_ring *ring = &sc->txq[qid];
2444         struct iwm_tx_data *txd = &ring->data[idx];
2445         struct iwm_node *in = txd->in;
2446         struct mbuf *m = txd->m;
2447         int status;
2448
2449         KASSERT(txd->done == 0, ("txd not done"));
2450         KASSERT(txd->in != NULL, ("txd without node"));
2451         KASSERT(txd->m != NULL, ("txd without mbuf"));
2452
2453         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2454
2455         sc->sc_tx_timer = 0;
2456
2457         status = iwm_mvm_rx_tx_cmd_single(sc, pkt, in);
2458
2459         /* Unmap and free mbuf. */
2460         bus_dmamap_sync(ring->data_dmat, txd->map, BUS_DMASYNC_POSTWRITE);
2461         bus_dmamap_unload(ring->data_dmat, txd->map);
2462
2463         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2464             "free txd %p, in %p\n", txd, txd->in);
2465         txd->done = 1;
2466         txd->m = NULL;
2467         txd->in = NULL;
2468
2469         ieee80211_tx_complete(&in->in_ni, m, status);
2470
2471         if (--ring->queued < IWM_TX_RING_LOMARK) {
2472                 sc->qfullmsk &= ~(1 << ring->qid);
2473                 if (sc->qfullmsk == 0) {
2474                         /*
2475                          * Well, we're in interrupt context, but then again
2476                          * I guess net80211 does all sorts of stunts in
2477                          * interrupt context, so maybe this is no biggie.
2478                          */
2479                         iwm_start(sc);
2480                 }
2481         }
2482 }
2483
2484 /*
2485  * transmit side
2486  */
2487
2488 /*
2489  * Process a "command done" firmware notification.  This is where we wakeup
2490  * processes waiting for a synchronous command completion.
2491  * from if_iwn
2492  */
2493 static void
2494 iwm_cmd_done(struct iwm_softc *sc, struct iwm_rx_packet *pkt)
2495 {
2496         struct iwm_tx_ring *ring = &sc->txq[IWM_MVM_CMD_QUEUE];
2497         struct iwm_tx_data *data;
2498
2499         if (pkt->hdr.qid != IWM_MVM_CMD_QUEUE) {
2500                 return; /* Not a command ack. */
2501         }
2502
2503         data = &ring->data[pkt->hdr.idx];
2504
2505         /* If the command was mapped in an mbuf, free it. */
2506         if (data->m != NULL) {
2507                 bus_dmamap_sync(ring->data_dmat, data->map,
2508                     BUS_DMASYNC_POSTWRITE);
2509                 bus_dmamap_unload(ring->data_dmat, data->map);
2510                 m_freem(data->m);
2511                 data->m = NULL;
2512         }
2513         wakeup(&ring->desc[pkt->hdr.idx]);
2514 }
2515
2516 #if 0
2517 /*
2518  * necessary only for block ack mode
2519  */
2520 void
2521 iwm_update_sched(struct iwm_softc *sc, int qid, int idx, uint8_t sta_id,
2522         uint16_t len)
2523 {
2524         struct iwm_agn_scd_bc_tbl *scd_bc_tbl;
2525         uint16_t w_val;
2526
2527         scd_bc_tbl = sc->sched_dma.vaddr;
2528
2529         len += 8; /* magic numbers came naturally from paris */
2530         if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_DW_BC_TABLE)
2531                 len = roundup(len, 4) / 4;
2532
2533         w_val = htole16(sta_id << 12 | len);
2534
2535         /* Update TX scheduler. */
2536         scd_bc_tbl[qid].tfd_offset[idx] = w_val;
2537         bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
2538             BUS_DMASYNC_PREWRITE);
2539
2540         /* I really wonder what this is ?!? */
2541         if (idx < IWM_TFD_QUEUE_SIZE_BC_DUP) {
2542                 scd_bc_tbl[qid].tfd_offset[IWM_TFD_QUEUE_SIZE_MAX + idx] = w_val;
2543                 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
2544                     BUS_DMASYNC_PREWRITE);
2545         }
2546 }
2547 #endif
2548
2549 /*
2550  * Take an 802.11 (non-n) rate, find the relevant rate
2551  * table entry.  return the index into in_ridx[].
2552  *
2553  * The caller then uses that index back into in_ridx
2554  * to figure out the rate index programmed /into/
2555  * the firmware for this given node.
2556  */
2557 static int
2558 iwm_tx_rateidx_lookup(struct iwm_softc *sc, struct iwm_node *in,
2559     uint8_t rate)
2560 {
2561         int i;
2562         uint8_t r;
2563
2564         for (i = 0; i < nitems(in->in_ridx); i++) {
2565                 r = iwm_rates[in->in_ridx[i]].rate;
2566                 if (rate == r)
2567                         return (i);
2568         }
2569         /* XXX Return the first */
2570         /* XXX TODO: have it return the /lowest/ */
2571         return (0);
2572 }
2573
2574 /*
2575  * Fill in various bit for management frames, and leave them
2576  * unfilled for data frames (firmware takes care of that).
2577  * Return the selected TX rate.
2578  */
2579 static const struct iwm_rate *
2580 iwm_tx_fill_cmd(struct iwm_softc *sc, struct iwm_node *in,
2581         struct ieee80211_frame *wh, struct iwm_tx_cmd *tx)
2582 {
2583         struct ieee80211com *ic = &sc->sc_ic;
2584         struct ieee80211_node *ni = &in->in_ni;
2585         const struct iwm_rate *rinfo;
2586         int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2587         int ridx, rate_flags;
2588
2589         tx->rts_retry_limit = IWM_RTS_DFAULT_RETRY_LIMIT;
2590         tx->data_retry_limit = IWM_DEFAULT_TX_RETRY;
2591
2592         /*
2593          * XXX TODO: everything about the rate selection here is terrible!
2594          */
2595
2596         if (type == IEEE80211_FC0_TYPE_DATA) {
2597                 int i;
2598                 /* for data frames, use RS table */
2599                 (void) ieee80211_ratectl_rate(ni, NULL, 0);
2600                 i = iwm_tx_rateidx_lookup(sc, in, ni->ni_txrate);
2601                 ridx = in->in_ridx[i];
2602
2603                 /* This is the index into the programmed table */
2604                 tx->initial_rate_index = i;
2605                 tx->tx_flags |= htole32(IWM_TX_CMD_FLG_STA_RATE);
2606                 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE,
2607                     "%s: start with i=%d, txrate %d\n",
2608                     __func__, i, iwm_rates[ridx].rate);
2609                 /* XXX no rate_n_flags? */
2610                 return &iwm_rates[ridx];
2611         }
2612
2613         /*
2614          * For non-data, use the lowest supported rate for the given
2615          * operational mode.
2616          *
2617          * Note: there may not be any rate control information available.
2618          * This driver currently assumes if we're transmitting data
2619          * frames, use the rate control table.  Grr.
2620          *
2621          * XXX TODO: use the configured rate for the traffic type!
2622          */
2623         if (ic->ic_curmode == IEEE80211_MODE_11A) {
2624                 /*
2625                  * XXX this assumes the mode is either 11a or not 11a;
2626                  * definitely won't work for 11n.
2627                  */
2628                 ridx = IWM_RIDX_OFDM;
2629         } else {
2630                 ridx = IWM_RIDX_CCK;
2631         }
2632
2633         rinfo = &iwm_rates[ridx];
2634
2635         IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, "%s: ridx=%d; rate=%d, CCK=%d\n",
2636             __func__, ridx,
2637             rinfo->rate,
2638             !! (IWM_RIDX_IS_CCK(ridx))
2639             );
2640
2641         /* XXX TODO: hard-coded TX antenna? */
2642         rate_flags = 1 << IWM_RATE_MCS_ANT_POS;
2643         if (IWM_RIDX_IS_CCK(ridx))
2644                 rate_flags |= IWM_RATE_MCS_CCK_MSK;
2645         /* XXX hard-coded tx rate */
2646         tx->rate_n_flags = htole32(rate_flags | rinfo->plcp);
2647
2648         return rinfo;
2649 }
2650
2651 #define TB0_SIZE 16
2652 static int
2653 iwm_tx(struct iwm_softc *sc, struct mbuf *m, struct ieee80211_node *ni, int ac)
2654 {
2655         struct ieee80211com *ic = &sc->sc_ic;
2656         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2657         struct iwm_node *in = IWM_NODE(ni);
2658         struct iwm_tx_ring *ring;
2659         struct iwm_tx_data *data;
2660         struct iwm_tfd *desc;
2661         struct iwm_device_cmd *cmd;
2662         struct iwm_tx_cmd *tx;
2663         struct ieee80211_frame *wh;
2664         struct ieee80211_key *k = NULL;
2665         struct mbuf *m1;
2666         const struct iwm_rate *rinfo;
2667         uint32_t flags;
2668         u_int hdrlen;
2669         bus_dma_segment_t *seg, segs[IWM_MAX_SCATTER];
2670         int nsegs;
2671         uint8_t tid, type;
2672         int i, totlen, error, pad;
2673
2674         wh = mtod(m, struct ieee80211_frame *);
2675         hdrlen = ieee80211_anyhdrsize(wh);
2676         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2677         tid = 0;
2678         ring = &sc->txq[ac];
2679         desc = &ring->desc[ring->cur];
2680         memset(desc, 0, sizeof(*desc));
2681         data = &ring->data[ring->cur];
2682
2683         /* Fill out iwm_tx_cmd to send to the firmware */
2684         cmd = &ring->cmd[ring->cur];
2685         cmd->hdr.code = IWM_TX_CMD;
2686         cmd->hdr.flags = 0;
2687         cmd->hdr.qid = ring->qid;
2688         cmd->hdr.idx = ring->cur;
2689
2690         tx = (void *)cmd->data;
2691         memset(tx, 0, sizeof(*tx));
2692
2693         rinfo = iwm_tx_fill_cmd(sc, in, wh, tx);
2694
2695         /* Encrypt the frame if need be. */
2696         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2697                 /* Retrieve key for TX && do software encryption. */
2698                 k = ieee80211_crypto_encap(ni, m);
2699                 if (k == NULL) {
2700                         m_freem(m);
2701                         return (ENOBUFS);
2702                 }
2703                 /* 802.11 header may have moved. */
2704                 wh = mtod(m, struct ieee80211_frame *);
2705         }
2706
2707         if (ieee80211_radiotap_active_vap(vap)) {
2708                 struct iwm_tx_radiotap_header *tap = &sc->sc_txtap;
2709
2710                 tap->wt_flags = 0;
2711                 tap->wt_chan_freq = htole16(ni->ni_chan->ic_freq);
2712                 tap->wt_chan_flags = htole16(ni->ni_chan->ic_flags);
2713                 tap->wt_rate = rinfo->rate;
2714                 if (k != NULL)
2715                         tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2716                 ieee80211_radiotap_tx(vap, m);
2717         }
2718
2719
2720         totlen = m->m_pkthdr.len;
2721
2722         flags = 0;
2723         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2724                 flags |= IWM_TX_CMD_FLG_ACK;
2725         }
2726
2727         if (type != IEEE80211_FC0_TYPE_DATA
2728             && (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2729             && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2730                 flags |= IWM_TX_CMD_FLG_PROT_REQUIRE;
2731         }
2732
2733         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
2734             type != IEEE80211_FC0_TYPE_DATA)
2735                 tx->sta_id = sc->sc_aux_sta.sta_id;
2736         else
2737                 tx->sta_id = IWM_STATION_ID;
2738
2739         if (type == IEEE80211_FC0_TYPE_MGT) {
2740                 uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2741
2742                 if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
2743                     subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
2744                         tx->pm_frame_timeout = htole16(3);
2745                 else
2746                         tx->pm_frame_timeout = htole16(2);
2747         } else {
2748                 tx->pm_frame_timeout = htole16(0);
2749         }
2750
2751         if (hdrlen & 3) {
2752                 /* First segment length must be a multiple of 4. */
2753                 flags |= IWM_TX_CMD_FLG_MH_PAD;
2754                 pad = 4 - (hdrlen & 3);
2755         } else
2756                 pad = 0;
2757
2758         tx->driver_txop = 0;
2759         tx->next_frame_len = 0;
2760
2761         tx->len = htole16(totlen);
2762         tx->tid_tspec = tid;
2763         tx->life_time = htole32(IWM_TX_CMD_LIFE_TIME_INFINITE);
2764
2765         /* Set physical address of "scratch area". */
2766         tx->dram_lsb_ptr = htole32(data->scratch_paddr);
2767         tx->dram_msb_ptr = iwm_get_dma_hi_addr(data->scratch_paddr);
2768
2769         /* Copy 802.11 header in TX command. */
2770         memcpy(((uint8_t *)tx) + sizeof(*tx), wh, hdrlen);
2771
2772         flags |= IWM_TX_CMD_FLG_BT_DIS | IWM_TX_CMD_FLG_SEQ_CTL;
2773
2774         tx->sec_ctl = 0;
2775         tx->tx_flags |= htole32(flags);
2776
2777         /* Trim 802.11 header. */
2778         m_adj(m, hdrlen);
2779         error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
2780             segs, &nsegs, BUS_DMA_NOWAIT);
2781         if (error != 0) {
2782                 if (error != EFBIG) {
2783                         device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
2784                             error);
2785                         m_freem(m);
2786                         return error;
2787                 }
2788                 /* Too many DMA segments, linearize mbuf. */
2789                 m1 = m_collapse(m, M_NOWAIT, IWM_MAX_SCATTER - 2);
2790                 if (m1 == NULL) {
2791                         device_printf(sc->sc_dev,
2792                             "%s: could not defrag mbuf\n", __func__);
2793                         m_freem(m);
2794                         return (ENOBUFS);
2795                 }
2796                 m = m1;
2797
2798                 error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
2799                     segs, &nsegs, BUS_DMA_NOWAIT);
2800                 if (error != 0) {
2801                         device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
2802                             error);
2803                         m_freem(m);
2804                         return error;
2805                 }
2806         }
2807         data->m = m;
2808         data->in = in;
2809         data->done = 0;
2810
2811         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2812             "sending txd %p, in %p\n", data, data->in);
2813         KASSERT(data->in != NULL, ("node is NULL"));
2814
2815         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2816             "sending data: qid=%d idx=%d len=%d nsegs=%d txflags=0x%08x rate_n_flags=0x%08x rateidx=%d\n",
2817             ring->qid, ring->cur, totlen, nsegs,
2818             le32toh(tx->tx_flags),
2819             le32toh(tx->rate_n_flags),
2820             (int) tx->initial_rate_index
2821             );
2822
2823         /* Fill TX descriptor. */
2824         desc->num_tbs = 2 + nsegs;
2825
2826         desc->tbs[0].lo = htole32(data->cmd_paddr);
2827         desc->tbs[0].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) |
2828             (TB0_SIZE << 4);
2829         desc->tbs[1].lo = htole32(data->cmd_paddr + TB0_SIZE);
2830         desc->tbs[1].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) |
2831             ((sizeof(struct iwm_cmd_header) + sizeof(*tx)
2832               + hdrlen + pad - TB0_SIZE) << 4);
2833
2834         /* Other DMA segments are for data payload. */
2835         for (i = 0; i < nsegs; i++) {
2836                 seg = &segs[i];
2837                 desc->tbs[i+2].lo = htole32(seg->ds_addr);
2838                 desc->tbs[i+2].hi_n_len = \
2839                     htole16(iwm_get_dma_hi_addr(seg->ds_addr))
2840                     | ((seg->ds_len) << 4);
2841         }
2842
2843         bus_dmamap_sync(ring->data_dmat, data->map,
2844             BUS_DMASYNC_PREWRITE);
2845         bus_dmamap_sync(ring->cmd_dma.tag, ring->cmd_dma.map,
2846             BUS_DMASYNC_PREWRITE);
2847         bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2848             BUS_DMASYNC_PREWRITE);
2849
2850 #if 0
2851         iwm_update_sched(sc, ring->qid, ring->cur, tx->sta_id, le16toh(tx->len));
2852 #endif
2853
2854         /* Kick TX ring. */
2855         ring->cur = (ring->cur + 1) % IWM_TX_RING_COUNT;
2856         IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
2857
2858         /* Mark TX ring as full if we reach a certain threshold. */
2859         if (++ring->queued > IWM_TX_RING_HIMARK) {
2860                 sc->qfullmsk |= 1 << ring->qid;
2861         }
2862
2863         return 0;
2864 }
2865
2866 static int
2867 iwm_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2868     const struct ieee80211_bpf_params *params)
2869 {
2870         struct ieee80211com *ic = ni->ni_ic;
2871         struct iwm_softc *sc = ic->ic_softc;
2872         int error = 0;
2873
2874         IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2875             "->%s begin\n", __func__);
2876
2877         if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
2878                 m_freem(m);
2879                 IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
2880                     "<-%s not RUNNING\n", __func__);
2881                 return (ENETDOWN);
2882         }
2883
2884         IWM_LOCK(sc);
2885         /* XXX fix this */
2886         if (params == NULL) {
2887                 error = iwm_tx(sc, m, ni, 0);
2888         } else {
2889                 error = iwm_tx(sc, m, ni, 0);
2890         }
2891         sc->sc_tx_timer = 5;
2892         IWM_UNLOCK(sc);
2893
2894         return (error);
2895 }
2896
2897 /*
2898  * mvm/tx.c
2899  */
2900
2901 #if 0
2902 /*
2903  * Note that there are transports that buffer frames before they reach
2904  * the firmware. This means that after flush_tx_path is called, the
2905  * queue might not be empty. The race-free way to handle this is to:
2906  * 1) set the station as draining
2907  * 2) flush the Tx path
2908  * 3) wait for the transport queues to be empty
2909  */
2910 int
2911 iwm_mvm_flush_tx_path(struct iwm_softc *sc, int tfd_msk, int sync)
2912 {
2913         struct iwm_tx_path_flush_cmd flush_cmd = {
2914                 .queues_ctl = htole32(tfd_msk),
2915                 .flush_ctl = htole16(IWM_DUMP_TX_FIFO_FLUSH),
2916         };
2917         int ret;
2918
2919         ret = iwm_mvm_send_cmd_pdu(sc, IWM_TXPATH_FLUSH,
2920             sync ? IWM_CMD_SYNC : IWM_CMD_ASYNC,
2921             sizeof(flush_cmd), &flush_cmd);
2922         if (ret)
2923                 device_printf(sc->sc_dev,
2924                     "Flushing tx queue failed: %d\n", ret);
2925         return ret;
2926 }
2927 #endif
2928
2929 /*
2930  * BEGIN mvm/sta.c
2931  */
2932
2933 static void
2934 iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *cmd_v6,
2935         struct iwm_mvm_add_sta_cmd_v5 *cmd_v5)
2936 {
2937         memset(cmd_v5, 0, sizeof(*cmd_v5));
2938
2939         cmd_v5->add_modify = cmd_v6->add_modify;
2940         cmd_v5->tid_disable_tx = cmd_v6->tid_disable_tx;
2941         cmd_v5->mac_id_n_color = cmd_v6->mac_id_n_color;
2942         IEEE80211_ADDR_COPY(cmd_v5->addr, cmd_v6->addr);
2943         cmd_v5->sta_id = cmd_v6->sta_id;
2944         cmd_v5->modify_mask = cmd_v6->modify_mask;
2945         cmd_v5->station_flags = cmd_v6->station_flags;
2946         cmd_v5->station_flags_msk = cmd_v6->station_flags_msk;
2947         cmd_v5->add_immediate_ba_tid = cmd_v6->add_immediate_ba_tid;
2948         cmd_v5->remove_immediate_ba_tid = cmd_v6->remove_immediate_ba_tid;
2949         cmd_v5->add_immediate_ba_ssn = cmd_v6->add_immediate_ba_ssn;
2950         cmd_v5->sleep_tx_count = cmd_v6->sleep_tx_count;
2951         cmd_v5->sleep_state_flags = cmd_v6->sleep_state_flags;
2952         cmd_v5->assoc_id = cmd_v6->assoc_id;
2953         cmd_v5->beamform_flags = cmd_v6->beamform_flags;
2954         cmd_v5->tfd_queue_msk = cmd_v6->tfd_queue_msk;
2955 }
2956
2957 static int
2958 iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *sc,
2959         struct iwm_mvm_add_sta_cmd_v6 *cmd, int *status)
2960 {
2961         struct iwm_mvm_add_sta_cmd_v5 cmd_v5;
2962
2963         if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_STA_KEY_CMD) {
2964                 return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA,
2965                     sizeof(*cmd), cmd, status);
2966         }
2967
2968         iwm_mvm_add_sta_cmd_v6_to_v5(cmd, &cmd_v5);
2969
2970         return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA, sizeof(cmd_v5),
2971             &cmd_v5, status);
2972 }
2973
2974 /* send station add/update command to firmware */
2975 static int
2976 iwm_mvm_sta_send_to_fw(struct iwm_softc *sc, struct iwm_node *in, int update)
2977 {
2978         struct iwm_mvm_add_sta_cmd_v6 add_sta_cmd;
2979         int ret;
2980         uint32_t status;
2981
2982         memset(&add_sta_cmd, 0, sizeof(add_sta_cmd));
2983
2984         add_sta_cmd.sta_id = IWM_STATION_ID;
2985         add_sta_cmd.mac_id_n_color
2986             = htole32(IWM_FW_CMD_ID_AND_COLOR(IWM_DEFAULT_MACID,
2987                 IWM_DEFAULT_COLOR));
2988         if (!update) {
2989                 add_sta_cmd.tfd_queue_msk = htole32(0xf);
2990                 IEEE80211_ADDR_COPY(&add_sta_cmd.addr, in->in_ni.ni_bssid);
2991         }
2992         add_sta_cmd.add_modify = update ? 1 : 0;
2993         add_sta_cmd.station_flags_msk
2994             |= htole32(IWM_STA_FLG_FAT_EN_MSK | IWM_STA_FLG_MIMO_EN_MSK);
2995
2996         status = IWM_ADD_STA_SUCCESS;
2997         ret = iwm_mvm_send_add_sta_cmd_status(sc, &add_sta_cmd, &status);
2998         if (ret)
2999                 return ret;
3000
3001         switch (status) {
3002         case IWM_ADD_STA_SUCCESS:
3003                 break;
3004         default:
3005                 ret = EIO;
3006                 device_printf(sc->sc_dev, "IWM_ADD_STA failed\n");
3007                 break;
3008         }
3009
3010         return ret;
3011 }
3012
3013 static int
3014 iwm_mvm_add_sta(struct iwm_softc *sc, struct iwm_node *in)
3015 {
3016         int ret;
3017
3018         ret = iwm_mvm_sta_send_to_fw(sc, in, 0);
3019         if (ret)
3020                 return ret;
3021
3022         return 0;
3023 }
3024
3025 static int
3026 iwm_mvm_update_sta(struct iwm_softc *sc, struct iwm_node *in)
3027 {
3028         return iwm_mvm_sta_send_to_fw(sc, in, 1);
3029 }
3030
3031 static int
3032 iwm_mvm_add_int_sta_common(struct iwm_softc *sc, struct iwm_int_sta *sta,
3033         const uint8_t *addr, uint16_t mac_id, uint16_t color)
3034 {
3035         struct iwm_mvm_add_sta_cmd_v6 cmd;
3036         int ret;
3037         uint32_t status;
3038
3039         memset(&cmd, 0, sizeof(cmd));
3040         cmd.sta_id = sta->sta_id;
3041         cmd.mac_id_n_color = htole32(IWM_FW_CMD_ID_AND_COLOR(mac_id, color));
3042
3043         cmd.tfd_queue_msk = htole32(sta->tfd_queue_msk);
3044
3045         if (addr)
3046                 IEEE80211_ADDR_COPY(cmd.addr, addr);
3047
3048         ret = iwm_mvm_send_add_sta_cmd_status(sc, &cmd, &status);
3049         if (ret)
3050                 return ret;
3051
3052         switch (status) {
3053         case IWM_ADD_STA_SUCCESS:
3054                 IWM_DPRINTF(sc, IWM_DEBUG_RESET,
3055                     "%s: Internal station added.\n", __func__);
3056                 return 0;
3057         default:
3058                 device_printf(sc->sc_dev,
3059                     "%s: Add internal station failed, status=0x%x\n",
3060                     __func__, status);
3061                 ret = EIO;
3062                 break;
3063         }
3064         return ret;
3065 }
3066
3067 static int
3068 iwm_mvm_add_aux_sta(struct iwm_softc *sc)
3069 {
3070         int ret;
3071
3072         sc->sc_aux_sta.sta_id = 3;
3073         sc->sc_aux_sta.tfd_queue_msk = 0;
3074
3075         ret = iwm_mvm_add_int_sta_common(sc,
3076             &sc->sc_aux_sta, NULL, IWM_MAC_INDEX_AUX, 0);
3077
3078         if (ret)
3079                 memset(&sc->sc_aux_sta, 0, sizeof(sc->sc_aux_sta));
3080         return ret;
3081 }
3082
3083 /*
3084  * END mvm/sta.c
3085  */
3086
3087 /*
3088  * BEGIN mvm/quota.c
3089  */
3090
3091 static int
3092 iwm_mvm_update_quotas(struct iwm_softc *sc, struct iwm_node *in)
3093 {
3094         struct iwm_time_quota_cmd cmd;
3095         int i, idx, ret, num_active_macs, quota, quota_rem;
3096         int colors[IWM_MAX_BINDINGS] = { -1, -1, -1, -1, };
3097         int n_ifs[IWM_MAX_BINDINGS] = {0, };
3098         uint16_t id;
3099
3100         memset(&cmd, 0, sizeof(cmd));
3101
3102         /* currently, PHY ID == binding ID */
3103         if (in) {
3104                 id = in->in_phyctxt->id;
3105                 KASSERT(id < IWM_MAX_BINDINGS, ("invalid id"));
3106                 colors[id] = in->in_phyctxt->color;
3107
3108                 if (1)
3109                         n_ifs[id] = 1;
3110         }
3111
3112         /*
3113          * The FW's scheduling session consists of
3114          * IWM_MVM_MAX_QUOTA fragments. Divide these fragments
3115          * equally between all the bindings that require quota
3116          */
3117         num_active_macs = 0;
3118         for (i = 0; i < IWM_MAX_BINDINGS; i++) {
3119                 cmd.quotas[i].id_and_color = htole32(IWM_FW_CTXT_INVALID);
3120                 num_active_macs += n_ifs[i];
3121         }
3122
3123         quota = 0;
3124         quota_rem = 0;
3125         if (num_active_macs) {
3126                 quota = IWM_MVM_MAX_QUOTA / num_active_macs;
3127                 quota_rem = IWM_MVM_MAX_QUOTA % num_active_macs;
3128         }
3129
3130         for (idx = 0, i = 0; i < IWM_MAX_BINDINGS; i++) {
3131                 if (colors[i] < 0)
3132                         continue;
3133
3134                 cmd.quotas[idx].id_and_color =
3135                         htole32(IWM_FW_CMD_ID_AND_COLOR(i, colors[i]));
3136
3137                 if (n_ifs[i] <= 0) {
3138                         cmd.quotas[idx].quota = htole32(0);
3139                         cmd.quotas[idx].max_duration = htole32(0);
3140                 } else {
3141                         cmd.quotas[idx].quota = htole32(quota * n_ifs[i]);
3142                         cmd.quotas[idx].max_duration = htole32(0);
3143                 }
3144                 idx++;
3145         }
3146
3147         /* Give the remainder of the session to the first binding */
3148         cmd.quotas[0].quota = htole32(le32toh(cmd.quotas[0].quota) + quota_rem);
3149
3150         ret = iwm_mvm_send_cmd_pdu(sc, IWM_TIME_QUOTA_CMD, IWM_CMD_SYNC,
3151             sizeof(cmd), &cmd);
3152         if (ret)
3153                 device_printf(sc->sc_dev,
3154                     "%s: Failed to send quota: %d\n", __func__, ret);
3155         return ret;
3156 }
3157
3158 /*
3159  * END mvm/quota.c
3160  */
3161
3162 /*
3163  * ieee80211 routines
3164  */
3165
3166 /*
3167  * Change to AUTH state in 80211 state machine.  Roughly matches what
3168  * Linux does in bss_info_changed().
3169  */
3170 static int
3171 iwm_auth(struct ieee80211vap *vap, struct iwm_softc *sc)
3172 {
3173         struct ieee80211_node *ni;
3174         struct iwm_node *in;
3175         struct iwm_vap *iv = IWM_VAP(vap);
3176         uint32_t duration;
3177         int error;
3178
3179         /*
3180          * XXX i have a feeling that the vap node is being
3181          * freed from underneath us. Grr.
3182          */
3183         ni = ieee80211_ref_node(vap->iv_bss);
3184         in = IWM_NODE(ni);
3185         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_STATE,
3186             "%s: called; vap=%p, bss ni=%p\n",
3187             __func__,
3188             vap,
3189             ni);
3190
3191         in->in_assoc = 0;
3192
3193         error = iwm_allow_mcast(vap, sc);
3194         if (error) {
3195                 device_printf(sc->sc_dev,
3196                     "%s: failed to set multicast\n", __func__);
3197                 goto out;
3198         }
3199
3200         /*
3201          * This is where it deviates from what Linux does.
3202          *
3203          * Linux iwlwifi doesn't reset the nic each time, nor does it
3204          * call ctxt_add() here.  Instead, it adds it during vap creation,
3205          * and always does does a mac_ctx_changed().
3206          *
3207          * The openbsd port doesn't attempt to do that - it reset things
3208          * at odd states and does the add here.
3209          *
3210          * So, until the state handling is fixed (ie, we never reset
3211          * the NIC except for a firmware failure, which should drag
3212          * the NIC back to IDLE, re-setup and re-add all the mac/phy
3213          * contexts that are required), let's do a dirty hack here.
3214          */
3215         if (iv->is_uploaded) {
3216                 if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) {
3217                         device_printf(sc->sc_dev,
3218                             "%s: failed to update MAC\n", __func__);
3219                         goto out;
3220                 }
3221                 if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0],
3222                     in->in_ni.ni_chan, 1, 1)) != 0) {
3223                         device_printf(sc->sc_dev,
3224                             "%s: failed update phy ctxt\n", __func__);
3225                         goto out;
3226                 }
3227                 in->in_phyctxt = &sc->sc_phyctxt[0];
3228
3229                 if ((error = iwm_mvm_binding_update(sc, in)) != 0) {
3230                         device_printf(sc->sc_dev,
3231                             "%s: binding update cmd\n", __func__);
3232                         goto out;
3233                 }
3234                 if ((error = iwm_mvm_update_sta(sc, in)) != 0) {
3235                         device_printf(sc->sc_dev,
3236                             "%s: failed to update sta\n", __func__);
3237                         goto out;
3238                 }
3239         } else {
3240                 if ((error = iwm_mvm_mac_ctxt_add(sc, vap)) != 0) {
3241                         device_printf(sc->sc_dev,
3242                             "%s: failed to add MAC\n", __func__);
3243                         goto out;
3244                 }
3245                 if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0],
3246                     in->in_ni.ni_chan, 1, 1)) != 0) {
3247                         device_printf(sc->sc_dev,
3248                             "%s: failed add phy ctxt!\n", __func__);
3249                         error = ETIMEDOUT;
3250                         goto out;
3251                 }
3252                 in->in_phyctxt = &sc->sc_phyctxt[0];
3253
3254                 if ((error = iwm_mvm_binding_add_vif(sc, in)) != 0) {
3255                         device_printf(sc->sc_dev,
3256                             "%s: binding add cmd\n", __func__);
3257                         goto out;
3258                 }
3259                 if ((error = iwm_mvm_add_sta(sc, in)) != 0) {
3260                         device_printf(sc->sc_dev,
3261                             "%s: failed to add sta\n", __func__);
3262                         goto out;
3263                 }
3264         }
3265
3266         /*
3267          * Prevent the FW from wandering off channel during association
3268          * by "protecting" the session with a time event.
3269          */
3270         /* XXX duration is in units of TU, not MS */
3271         duration = IWM_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3272         iwm_mvm_protect_session(sc, in, duration, 500 /* XXX magic number */);
3273         DELAY(100);
3274
3275         error = 0;
3276 out:
3277         ieee80211_free_node(ni);
3278         return (error);
3279 }
3280
3281 static int
3282 iwm_assoc(struct ieee80211vap *vap, struct iwm_softc *sc)
3283 {
3284         struct iwm_node *in = IWM_NODE(vap->iv_bss);
3285         int error;
3286
3287         if ((error = iwm_mvm_update_sta(sc, in)) != 0) {
3288                 device_printf(sc->sc_dev,
3289                     "%s: failed to update STA\n", __func__);
3290                 return error;
3291         }
3292
3293         in->in_assoc = 1;
3294         if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) {
3295                 device_printf(sc->sc_dev,
3296                     "%s: failed to update MAC\n", __func__);
3297                 return error;
3298         }
3299
3300         return 0;
3301 }
3302
3303 static int
3304 iwm_release(struct iwm_softc *sc, struct iwm_node *in)
3305 {
3306         /*
3307          * Ok, so *technically* the proper set of calls for going
3308          * from RUN back to SCAN is:
3309          *
3310          * iwm_mvm_power_mac_disable(sc, in);
3311          * iwm_mvm_mac_ctxt_changed(sc, in);
3312          * iwm_mvm_rm_sta(sc, in);
3313          * iwm_mvm_update_quotas(sc, NULL);
3314          * iwm_mvm_mac_ctxt_changed(sc, in);
3315          * iwm_mvm_binding_remove_vif(sc, in);
3316          * iwm_mvm_mac_ctxt_remove(sc, in);
3317          *
3318          * However, that freezes the device not matter which permutations
3319          * and modifications are attempted.  Obviously, this driver is missing
3320          * something since it works in the Linux driver, but figuring out what
3321          * is missing is a little more complicated.  Now, since we're going
3322          * back to nothing anyway, we'll just do a complete device reset.
3323          * Up your's, device!
3324          */
3325         //iwm_mvm_flush_tx_path(sc, 0xf, 1);
3326         iwm_stop_device(sc);
3327         iwm_init_hw(sc);
3328         if (in)
3329                 in->in_assoc = 0;
3330         return 0;
3331
3332 #if 0
3333         int error;
3334
3335         iwm_mvm_power_mac_disable(sc, in);
3336
3337         if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) {
3338                 device_printf(sc->sc_dev, "mac ctxt change fail 1 %d\n", error);
3339                 return error;
3340         }
3341
3342         if ((error = iwm_mvm_rm_sta(sc, in)) != 0) {
3343                 device_printf(sc->sc_dev, "sta remove fail %d\n", error);
3344                 return error;
3345         }
3346         error = iwm_mvm_rm_sta(sc, in);
3347         in->in_assoc = 0;
3348         iwm_mvm_update_quotas(sc, NULL);
3349         if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) {
3350                 device_printf(sc->sc_dev, "mac ctxt change fail 2 %d\n", error);
3351                 return error;
3352         }
3353         iwm_mvm_binding_remove_vif(sc, in);
3354
3355         iwm_mvm_mac_ctxt_remove(sc, in);
3356
3357         return error;
3358 #endif
3359 }
3360
3361 static struct ieee80211_node *
3362 iwm_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
3363 {
3364         return malloc(sizeof (struct iwm_node), M_80211_NODE,
3365             M_NOWAIT | M_ZERO);
3366 }
3367
3368 static void
3369 iwm_setrates(struct iwm_softc *sc, struct iwm_node *in)
3370 {
3371         struct ieee80211_node *ni = &in->in_ni;
3372         struct iwm_lq_cmd *lq = &in->in_lq;
3373         int nrates = ni->ni_rates.rs_nrates;
3374         int i, ridx, tab = 0;
3375         int txant = 0;
3376
3377         if (nrates > nitems(lq->rs_table)) {
3378                 device_printf(sc->sc_dev,
3379                     "%s: node supports %d rates, driver handles "
3380                     "only %zu\n", __func__, nrates, nitems(lq->rs_table));
3381                 return;
3382         }
3383         if (nrates == 0) {
3384                 device_printf(sc->sc_dev,
3385                     "%s: node supports 0 rates, odd!\n", __func__);
3386                 return;
3387         }
3388
3389         /*
3390          * XXX .. and most of iwm_node is not initialised explicitly;
3391          * it's all just 0x0 passed to the firmware.
3392          */
3393
3394         /* first figure out which rates we should support */
3395         /* XXX TODO: this isn't 11n aware /at all/ */
3396         memset(&in->in_ridx, -1, sizeof(in->in_ridx));
3397         IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3398             "%s: nrates=%d\n", __func__, nrates);
3399
3400         /*
3401          * Loop over nrates and populate in_ridx from the highest
3402          * rate to the lowest rate.  Remember, in_ridx[] has
3403          * IEEE80211_RATE_MAXSIZE entries!
3404          */
3405         for (i = 0; i < min(nrates, IEEE80211_RATE_MAXSIZE); i++) {
3406                 int rate = ni->ni_rates.rs_rates[(nrates - 1) - i] & IEEE80211_RATE_VAL;
3407
3408                 /* Map 802.11 rate to HW rate index. */
3409                 for (ridx = 0; ridx <= IWM_RIDX_MAX; ridx++)
3410                         if (iwm_rates[ridx].rate == rate)
3411                                 break;
3412                 if (ridx > IWM_RIDX_MAX) {
3413                         device_printf(sc->sc_dev,
3414                             "%s: WARNING: device rate for %d not found!\n",
3415                             __func__, rate);
3416                 } else {
3417                         IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3418                             "%s: rate: i: %d, rate=%d, ridx=%d\n",
3419                             __func__,
3420                             i,
3421                             rate,
3422                             ridx);
3423                         in->in_ridx[i] = ridx;
3424                 }
3425         }
3426
3427         /* then construct a lq_cmd based on those */
3428         memset(lq, 0, sizeof(*lq));
3429         lq->sta_id = IWM_STATION_ID;
3430
3431         /*
3432          * are these used? (we don't do SISO or MIMO)
3433          * need to set them to non-zero, though, or we get an error.
3434          */
3435         lq->single_stream_ant_msk = 1;
3436         lq->dual_stream_ant_msk = 1;
3437
3438         /*
3439          * Build the actual rate selection table.
3440          * The lowest bits are the rates.  Additionally,
3441          * CCK needs bit 9 to be set.  The rest of the bits
3442          * we add to the table select the tx antenna
3443          * Note that we add the rates in the highest rate first
3444          * (opposite of ni_rates).
3445          */
3446         /*
3447          * XXX TODO: this should be looping over the min of nrates
3448          * and LQ_MAX_RETRY_NUM.  Sigh.
3449          */
3450         for (i = 0; i < nrates; i++) {
3451                 int nextant;
3452
3453                 if (txant == 0)
3454                         txant = IWM_FW_VALID_TX_ANT(sc);
3455                 nextant = 1<<(ffs(txant)-1);
3456                 txant &= ~nextant;
3457
3458                 /*
3459                  * Map the rate id into a rate index into
3460                  * our hardware table containing the
3461                  * configuration to use for this rate.
3462                  */
3463                 ridx = in->in_ridx[i];
3464                 tab = iwm_rates[ridx].plcp;
3465                 tab |= nextant << IWM_RATE_MCS_ANT_POS;
3466                 if (IWM_RIDX_IS_CCK(ridx))
3467                         tab |= IWM_RATE_MCS_CCK_MSK;
3468                 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
3469                     "station rate i=%d, rate=%d, hw=%x\n",
3470                     i, iwm_rates[ridx].rate, tab);
3471                 lq->rs_table[i] = htole32(tab);
3472         }
3473         /* then fill the rest with the lowest possible rate */
3474         for (i = nrates; i < nitems(lq->rs_table); i++) {
3475                 KASSERT(tab != 0, ("invalid tab"));
3476                 lq->rs_table[i] = htole32(tab);
3477         }
3478 }
3479
3480 static int
3481 iwm_media_change(struct ifnet *ifp)
3482 {
3483         struct ieee80211vap *vap = ifp->if_softc;
3484         struct ieee80211com *ic = vap->iv_ic;
3485         struct iwm_softc *sc = ic->ic_softc;
3486         int error;
3487
3488         error = ieee80211_media_change(ifp);
3489         if (error != ENETRESET)
3490                 return error;
3491
3492         IWM_LOCK(sc);
3493         if (ic->ic_nrunning > 0) {
3494                 iwm_stop(sc);
3495                 iwm_init(sc);
3496         }
3497         IWM_UNLOCK(sc);
3498         return error;
3499 }
3500
3501
3502 static int
3503 iwm_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3504 {
3505         struct iwm_vap *ivp = IWM_VAP(vap);
3506         struct ieee80211com *ic = vap->iv_ic;
3507         struct iwm_softc *sc = ic->ic_softc;
3508         struct iwm_node *in;
3509         int error;
3510
3511         IWM_DPRINTF(sc, IWM_DEBUG_STATE,
3512             "switching state %s -> %s\n",
3513             ieee80211_state_name[vap->iv_state],
3514             ieee80211_state_name[nstate]);
3515         IEEE80211_UNLOCK(ic);
3516         IWM_LOCK(sc);
3517         /* disable beacon filtering if we're hopping out of RUN */
3518         if (vap->iv_state == IEEE80211_S_RUN && nstate != vap->iv_state) {
3519                 iwm_mvm_disable_beacon_filter(sc);
3520
3521                 if (((in = IWM_NODE(vap->iv_bss)) != NULL))
3522                         in->in_assoc = 0;
3523
3524                 iwm_release(sc, NULL);
3525
3526                 /*
3527                  * It's impossible to directly go RUN->SCAN. If we iwm_release()
3528                  * above then the card will be completely reinitialized,
3529                  * so the driver must do everything necessary to bring the card
3530                  * from INIT to SCAN.
3531                  *
3532                  * Additionally, upon receiving deauth frame from AP,
3533                  * OpenBSD 802.11 stack puts the driver in IEEE80211_S_AUTH
3534                  * state. This will also fail with this driver, so bring the FSM
3535                  * from IEEE80211_S_RUN to IEEE80211_S_SCAN in this case as well.
3536                  *
3537                  * XXX TODO: fix this for FreeBSD!
3538                  */
3539                 if (nstate == IEEE80211_S_SCAN ||
3540                     nstate == IEEE80211_S_AUTH ||
3541                     nstate == IEEE80211_S_ASSOC) {
3542                         IWM_DPRINTF(sc, IWM_DEBUG_STATE,
3543                             "Force transition to INIT; MGT=%d\n", arg);
3544                         IWM_UNLOCK(sc);
3545                         IEEE80211_LOCK(ic);
3546                         vap->iv_newstate(vap, IEEE80211_S_INIT, arg);
3547                         IWM_DPRINTF(sc, IWM_DEBUG_STATE,
3548                             "Going INIT->SCAN\n");
3549                         nstate = IEEE80211_S_SCAN;
3550                         IEEE80211_UNLOCK(ic);
3551                         IWM_LOCK(sc);
3552                 }
3553         }
3554
3555         switch (nstate) {
3556         case IEEE80211_S_INIT:
3557                 sc->sc_scanband = 0;
3558                 break;
3559
3560         case IEEE80211_S_AUTH:
3561                 if ((error = iwm_auth(vap, sc)) != 0) {
3562                         device_printf(sc->sc_dev,
3563                             "%s: could not move to auth state: %d\n",
3564                             __func__, error);
3565                         break;
3566                 }
3567                 break;
3568
3569         case IEEE80211_S_ASSOC:
3570                 if ((error = iwm_assoc(vap, sc)) != 0) {
3571                         device_printf(sc->sc_dev,
3572                             "%s: failed to associate: %d\n", __func__,
3573                             error);
3574                         break;
3575                 }
3576                 break;
3577
3578         case IEEE80211_S_RUN:
3579         {
3580                 struct iwm_host_cmd cmd = {
3581                         .id = IWM_LQ_CMD,
3582                         .len = { sizeof(in->in_lq), },
3583                         .flags = IWM_CMD_SYNC,
3584                 };
3585
3586                 /* Update the association state, now we have it all */
3587                 /* (eg associd comes in at this point */
3588                 error = iwm_assoc(vap, sc);
3589                 if (error != 0) {
3590                         device_printf(sc->sc_dev,
3591                             "%s: failed to update association state: %d\n",
3592                             __func__,
3593                             error);
3594                         break;
3595                 }
3596
3597                 in = IWM_NODE(vap->iv_bss);
3598                 iwm_mvm_power_mac_update_mode(sc, in);
3599                 iwm_mvm_enable_beacon_filter(sc, in);
3600                 iwm_mvm_update_quotas(sc, in);
3601                 iwm_setrates(sc, in);
3602
3603                 cmd.data[0] = &in->in_lq;
3604                 if ((error = iwm_send_cmd(sc, &cmd)) != 0) {
3605                         device_printf(sc->sc_dev,
3606                             "%s: IWM_LQ_CMD failed\n", __func__);
3607                 }
3608
3609                 break;
3610         }
3611
3612         default:
3613                 break;
3614         }
3615         IWM_UNLOCK(sc);
3616         IEEE80211_LOCK(ic);
3617
3618         return (ivp->iv_newstate(vap, nstate, arg));
3619 }
3620
3621 void
3622 iwm_endscan_cb(void *arg, int pending)
3623 {
3624         struct iwm_softc *sc = arg;
3625         struct ieee80211com *ic = &sc->sc_ic;
3626         int done;
3627         int error;
3628
3629         IWM_DPRINTF(sc, IWM_DEBUG_SCAN | IWM_DEBUG_TRACE,
3630             "%s: scan ended\n",
3631             __func__);
3632
3633         IWM_LOCK(sc);
3634         if (sc->sc_scanband == IEEE80211_CHAN_2GHZ &&
3635             sc->sc_nvm.sku_cap_band_52GHz_enable) {
3636                 done = 0;
3637                 if ((error = iwm_mvm_scan_request(sc,
3638                     IEEE80211_CHAN_5GHZ, 0, NULL, 0)) != 0) {
3639                         device_printf(sc->sc_dev, "could not initiate scan\n");
3640                         done = 1;
3641                 }
3642         } else {
3643                 done = 1;
3644         }
3645
3646         if (done) {
3647                 IWM_UNLOCK(sc);
3648                 ieee80211_scan_done(TAILQ_FIRST(&ic->ic_vaps));
3649                 IWM_LOCK(sc);
3650                 sc->sc_scanband = 0;
3651         }
3652         IWM_UNLOCK(sc);
3653 }
3654
3655 static int
3656 iwm_init_hw(struct iwm_softc *sc)
3657 {
3658         struct ieee80211com *ic = &sc->sc_ic;
3659         int error, i, qid;
3660
3661         if ((error = iwm_start_hw(sc)) != 0)
3662                 return error;
3663
3664         if ((error = iwm_run_init_mvm_ucode(sc, 0)) != 0) {
3665                 return error;
3666         }
3667
3668         /*
3669          * should stop and start HW since that INIT
3670          * image just loaded
3671          */
3672         iwm_stop_device(sc);
3673         if ((error = iwm_start_hw(sc)) != 0) {
3674                 device_printf(sc->sc_dev, "could not initialize hardware\n");
3675                 return error;
3676         }
3677
3678         /* omstart, this time with the regular firmware */
3679         error = iwm_mvm_load_ucode_wait_alive(sc, IWM_UCODE_TYPE_REGULAR);
3680         if (error) {
3681                 device_printf(sc->sc_dev, "could not load firmware\n");
3682                 goto error;
3683         }
3684
3685         if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0)
3686                 goto error;
3687
3688         /* Send phy db control command and then phy db calibration*/
3689         if ((error = iwm_send_phy_db_data(sc)) != 0)
3690                 goto error;
3691
3692         if ((error = iwm_send_phy_cfg_cmd(sc)) != 0)
3693                 goto error;
3694
3695         /* Add auxiliary station for scanning */
3696         if ((error = iwm_mvm_add_aux_sta(sc)) != 0)
3697                 goto error;
3698
3699         for (i = 0; i < IWM_NUM_PHY_CTX; i++) {
3700                 /*
3701                  * The channel used here isn't relevant as it's
3702                  * going to be overwritten in the other flows.
3703                  * For now use the first channel we have.
3704                  */
3705                 if ((error = iwm_mvm_phy_ctxt_add(sc,
3706                     &sc->sc_phyctxt[i], &ic->ic_channels[1], 1, 1)) != 0)
3707                         goto error;
3708         }
3709
3710         error = iwm_mvm_power_update_device(sc);
3711         if (error)
3712                 goto error;
3713
3714         /* Mark TX rings as active. */
3715         for (qid = 0; qid < 4; qid++) {
3716                 iwm_enable_txq(sc, qid, qid);
3717         }
3718
3719         return 0;
3720
3721  error:
3722         iwm_stop_device(sc);
3723         return error;
3724 }
3725
3726 /* Allow multicast from our BSSID. */
3727 static int
3728 iwm_allow_mcast(struct ieee80211vap *vap, struct iwm_softc *sc)
3729 {
3730         struct ieee80211_node *ni = vap->iv_bss;
3731         struct iwm_mcast_filter_cmd *cmd;
3732         size_t size;
3733         int error;
3734
3735         size = roundup(sizeof(*cmd), 4);
3736         cmd = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
3737         if (cmd == NULL)
3738                 return ENOMEM;
3739         cmd->filter_own = 1;
3740         cmd->port_id = 0;
3741         cmd->count = 0;
3742         cmd->pass_all = 1;
3743         IEEE80211_ADDR_COPY(cmd->bssid, ni->ni_bssid);
3744
3745         error = iwm_mvm_send_cmd_pdu(sc, IWM_MCAST_FILTER_CMD,
3746             IWM_CMD_SYNC, size, cmd);
3747         free(cmd, M_DEVBUF);
3748
3749         return (error);
3750 }
3751
3752 static void
3753 iwm_init(struct iwm_softc *sc)
3754 {
3755         int error;
3756
3757         if (sc->sc_flags & IWM_FLAG_HW_INITED) {
3758                 return;
3759         }
3760         sc->sc_generation++;
3761         sc->sc_flags &= ~IWM_FLAG_STOPPED;
3762
3763         if ((error = iwm_init_hw(sc)) != 0) {
3764                 iwm_stop(sc);
3765                 return;
3766         }
3767
3768         /*
3769          * Ok, firmware loaded and we are jogging
3770          */
3771         sc->sc_flags |= IWM_FLAG_HW_INITED;
3772         callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc);
3773 }
3774
3775 static int
3776 iwm_transmit(struct ieee80211com *ic, struct mbuf *m)
3777 {
3778         struct iwm_softc *sc;
3779         int error;
3780
3781         sc = ic->ic_softc;
3782
3783         IWM_LOCK(sc);
3784         if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
3785                 IWM_UNLOCK(sc);
3786                 return (ENXIO);
3787         }
3788         error = mbufq_enqueue(&sc->sc_snd, m);
3789         if (error) {
3790                 IWM_UNLOCK(sc);
3791                 return (error);
3792         }
3793         iwm_start(sc);
3794         IWM_UNLOCK(sc);
3795         return (0);
3796 }
3797
3798 /*
3799  * Dequeue packets from sendq and call send.
3800  */
3801 static void
3802 iwm_start(struct iwm_softc *sc)
3803 {
3804         struct ieee80211_node *ni;
3805         struct mbuf *m;
3806         int ac = 0;
3807
3808         IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "->%s\n", __func__);
3809         while (sc->qfullmsk == 0 &&
3810                 (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3811                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3812                 if (iwm_tx(sc, m, ni, ac) != 0) {
3813                         if_inc_counter(ni->ni_vap->iv_ifp,
3814                             IFCOUNTER_OERRORS, 1);
3815                         ieee80211_free_node(ni);
3816                         continue;
3817                 }
3818                 sc->sc_tx_timer = 15;
3819         }
3820         IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "<-%s\n", __func__);
3821 }
3822
3823 static void
3824 iwm_stop(struct iwm_softc *sc)
3825 {
3826
3827         sc->sc_flags &= ~IWM_FLAG_HW_INITED;
3828         sc->sc_flags |= IWM_FLAG_STOPPED;
3829         sc->sc_generation++;
3830         sc->sc_scanband = 0;
3831         sc->sc_auth_prot = 0;
3832         sc->sc_tx_timer = 0;
3833         iwm_stop_device(sc);
3834 }
3835
3836 static void
3837 iwm_watchdog(void *arg)
3838 {
3839         struct iwm_softc *sc = arg;
3840
3841         if (sc->sc_tx_timer > 0) {
3842                 if (--sc->sc_tx_timer == 0) {
3843                         device_printf(sc->sc_dev, "device timeout\n");
3844 #ifdef IWM_DEBUG
3845                         iwm_nic_error(sc);
3846 #endif
3847                         iwm_stop(sc);
3848                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
3849                         return;
3850                 }
3851         }
3852         callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc);
3853 }
3854
3855 static void
3856 iwm_parent(struct ieee80211com *ic)
3857 {
3858         struct iwm_softc *sc = ic->ic_softc;
3859         int startall = 0;
3860
3861         IWM_LOCK(sc);
3862         if (ic->ic_nrunning > 0) {
3863                 if (!(sc->sc_flags & IWM_FLAG_HW_INITED)) {
3864                         iwm_init(sc);
3865                         startall = 1;
3866                 }
3867         } else if (sc->sc_flags & IWM_FLAG_HW_INITED)
3868                 iwm_stop(sc);
3869         IWM_UNLOCK(sc);
3870         if (startall)
3871                 ieee80211_start_all(ic);
3872 }
3873
3874 /*
3875  * The interrupt side of things
3876  */
3877
3878 /*
3879  * error dumping routines are from iwlwifi/mvm/utils.c
3880  */
3881
3882 /*
3883  * Note: This structure is read from the device with IO accesses,
3884  * and the reading already does the endian conversion. As it is
3885  * read with uint32_t-sized accesses, any members with a different size
3886  * need to be ordered correctly though!
3887  */
3888 struct iwm_error_event_table {
3889         uint32_t valid;         /* (nonzero) valid, (0) log is empty */
3890         uint32_t error_id;              /* type of error */
3891         uint32_t pc;                    /* program counter */
3892         uint32_t blink1;                /* branch link */
3893         uint32_t blink2;                /* branch link */
3894         uint32_t ilink1;                /* interrupt link */
3895         uint32_t ilink2;                /* interrupt link */
3896         uint32_t data1;         /* error-specific data */
3897         uint32_t data2;         /* error-specific data */
3898         uint32_t data3;         /* error-specific data */
3899         uint32_t bcon_time;             /* beacon timer */
3900         uint32_t tsf_low;               /* network timestamp function timer */
3901         uint32_t tsf_hi;                /* network timestamp function timer */
3902         uint32_t gp1;           /* GP1 timer register */
3903         uint32_t gp2;           /* GP2 timer register */
3904         uint32_t gp3;           /* GP3 timer register */
3905         uint32_t ucode_ver;             /* uCode version */
3906         uint32_t hw_ver;                /* HW Silicon version */
3907         uint32_t brd_ver;               /* HW board version */
3908         uint32_t log_pc;                /* log program counter */
3909         uint32_t frame_ptr;             /* frame pointer */
3910         uint32_t stack_ptr;             /* stack pointer */
3911         uint32_t hcmd;          /* last host command header */
3912         uint32_t isr0;          /* isr status register LMPM_NIC_ISR0:
3913                                  * rxtx_flag */
3914         uint32_t isr1;          /* isr status register LMPM_NIC_ISR1:
3915                                  * host_flag */
3916         uint32_t isr2;          /* isr status register LMPM_NIC_ISR2:
3917                                  * enc_flag */
3918         uint32_t isr3;          /* isr status register LMPM_NIC_ISR3:
3919                                  * time_flag */
3920         uint32_t isr4;          /* isr status register LMPM_NIC_ISR4:
3921                                  * wico interrupt */
3922         uint32_t isr_pref;              /* isr status register LMPM_NIC_PREF_STAT */
3923         uint32_t wait_event;            /* wait event() caller address */
3924         uint32_t l2p_control;   /* L2pControlField */
3925         uint32_t l2p_duration;  /* L2pDurationField */
3926         uint32_t l2p_mhvalid;   /* L2pMhValidBits */
3927         uint32_t l2p_addr_match;        /* L2pAddrMatchStat */
3928         uint32_t lmpm_pmg_sel;  /* indicate which clocks are turned on
3929                                  * (LMPM_PMG_SEL) */
3930         uint32_t u_timestamp;   /* indicate when the date and time of the
3931                                  * compilation */
3932         uint32_t flow_handler;  /* FH read/write pointers, RX credit */
3933 } __packed;
3934
3935 #define ERROR_START_OFFSET  (1 * sizeof(uint32_t))
3936 #define ERROR_ELEM_SIZE     (7 * sizeof(uint32_t))
3937
3938 #ifdef IWM_DEBUG
3939 struct {
3940         const char *name;
3941         uint8_t num;
3942 } advanced_lookup[] = {
3943         { "NMI_INTERRUPT_WDG", 0x34 },
3944         { "SYSASSERT", 0x35 },
3945         { "UCODE_VERSION_MISMATCH", 0x37 },
3946         { "BAD_COMMAND", 0x38 },
3947         { "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C },
3948         { "FATAL_ERROR", 0x3D },
3949         { "NMI_TRM_HW_ERR", 0x46 },
3950         { "NMI_INTERRUPT_TRM", 0x4C },
3951         { "NMI_INTERRUPT_BREAK_POINT", 0x54 },
3952         { "NMI_INTERRUPT_WDG_RXF_FULL", 0x5C },
3953         { "NMI_INTERRUPT_WDG_NO_RBD_RXF_FULL", 0x64 },
3954         { "NMI_INTERRUPT_HOST", 0x66 },
3955         { "NMI_INTERRUPT_ACTION_PT", 0x7C },
3956         { "NMI_INTERRUPT_UNKNOWN", 0x84 },
3957         { "NMI_INTERRUPT_INST_ACTION_PT", 0x86 },
3958         { "ADVANCED_SYSASSERT", 0 },
3959 };
3960
3961 static const char *
3962 iwm_desc_lookup(uint32_t num)
3963 {
3964         int i;
3965
3966         for (i = 0; i < nitems(advanced_lookup) - 1; i++)
3967                 if (advanced_lookup[i].num == num)
3968                         return advanced_lookup[i].name;
3969
3970         /* No entry matches 'num', so it is the last: ADVANCED_SYSASSERT */
3971         return advanced_lookup[i].name;
3972 }
3973
3974 /*
3975  * Support for dumping the error log seemed like a good idea ...
3976  * but it's mostly hex junk and the only sensible thing is the
3977  * hw/ucode revision (which we know anyway).  Since it's here,
3978  * I'll just leave it in, just in case e.g. the Intel guys want to
3979  * help us decipher some "ADVANCED_SYSASSERT" later.
3980  */
3981 static void
3982 iwm_nic_error(struct iwm_softc *sc)
3983 {
3984         struct iwm_error_event_table table;
3985         uint32_t base;
3986
3987         device_printf(sc->sc_dev, "dumping device error log\n");
3988         base = sc->sc_uc.uc_error_event_table;
3989         if (base < 0x800000 || base >= 0x80C000) {
3990                 device_printf(sc->sc_dev,
3991                     "Not valid error log pointer 0x%08x\n", base);
3992                 return;
3993         }
3994
3995         if (iwm_read_mem(sc, base, &table, sizeof(table)/sizeof(uint32_t)) != 0) {
3996                 device_printf(sc->sc_dev, "reading errlog failed\n");
3997                 return;
3998         }
3999
4000         if (!table.valid) {
4001                 device_printf(sc->sc_dev, "errlog not found, skipping\n");
4002                 return;
4003         }
4004
4005         if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) {
4006                 device_printf(sc->sc_dev, "Start IWL Error Log Dump:\n");
4007                 device_printf(sc->sc_dev, "Status: 0x%x, count: %d\n",
4008                     sc->sc_flags, table.valid);
4009         }
4010
4011         device_printf(sc->sc_dev, "0x%08X | %-28s\n", table.error_id,
4012                 iwm_desc_lookup(table.error_id));
4013         device_printf(sc->sc_dev, "%08X | uPc\n", table.pc);
4014         device_printf(sc->sc_dev, "%08X | branchlink1\n", table.blink1);
4015         device_printf(sc->sc_dev, "%08X | branchlink2\n", table.blink2);
4016         device_printf(sc->sc_dev, "%08X | interruptlink1\n", table.ilink1);
4017         device_printf(sc->sc_dev, "%08X | interruptlink2\n", table.ilink2);
4018         device_printf(sc->sc_dev, "%08X | data1\n", table.data1);
4019         device_printf(sc->sc_dev, "%08X | data2\n", table.data2);
4020         device_printf(sc->sc_dev, "%08X | data3\n", table.data3);
4021         device_printf(sc->sc_dev, "%08X | beacon time\n", table.bcon_time);
4022         device_printf(sc->sc_dev, "%08X | tsf low\n", table.tsf_low);
4023         device_printf(sc->sc_dev, "%08X | tsf hi\n", table.tsf_hi);
4024         device_printf(sc->sc_dev, "%08X | time gp1\n", table.gp1);
4025         device_printf(sc->sc_dev, "%08X | time gp2\n", table.gp2);
4026         device_printf(sc->sc_dev, "%08X | time gp3\n", table.gp3);
4027         device_printf(sc->sc_dev, "%08X | uCode version\n", table.ucode_ver);
4028         device_printf(sc->sc_dev, "%08X | hw version\n", table.hw_ver);
4029         device_printf(sc->sc_dev, "%08X | board version\n", table.brd_ver);
4030         device_printf(sc->sc_dev, "%08X | hcmd\n", table.hcmd);
4031         device_printf(sc->sc_dev, "%08X | isr0\n", table.isr0);
4032         device_printf(sc->sc_dev, "%08X | isr1\n", table.isr1);
4033         device_printf(sc->sc_dev, "%08X | isr2\n", table.isr2);
4034         device_printf(sc->sc_dev, "%08X | isr3\n", table.isr3);
4035         device_printf(sc->sc_dev, "%08X | isr4\n", table.isr4);
4036         device_printf(sc->sc_dev, "%08X | isr_pref\n", table.isr_pref);
4037         device_printf(sc->sc_dev, "%08X | wait_event\n", table.wait_event);
4038         device_printf(sc->sc_dev, "%08X | l2p_control\n", table.l2p_control);
4039         device_printf(sc->sc_dev, "%08X | l2p_duration\n", table.l2p_duration);
4040         device_printf(sc->sc_dev, "%08X | l2p_mhvalid\n", table.l2p_mhvalid);
4041         device_printf(sc->sc_dev, "%08X | l2p_addr_match\n", table.l2p_addr_match);
4042         device_printf(sc->sc_dev, "%08X | lmpm_pmg_sel\n", table.lmpm_pmg_sel);
4043         device_printf(sc->sc_dev, "%08X | timestamp\n", table.u_timestamp);
4044         device_printf(sc->sc_dev, "%08X | flow_handler\n", table.flow_handler);
4045 }
4046 #endif
4047
4048 #define SYNC_RESP_STRUCT(_var_, _pkt_)                                  \
4049 do {                                                                    \
4050         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\
4051         _var_ = (void *)((_pkt_)+1);                                    \
4052 } while (/*CONSTCOND*/0)
4053
4054 #define SYNC_RESP_PTR(_ptr_, _len_, _pkt_)                              \
4055 do {                                                                    \
4056         bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\
4057         _ptr_ = (void *)((_pkt_)+1);                                    \
4058 } while (/*CONSTCOND*/0)
4059
4060 #define ADVANCE_RXQ(sc) (sc->rxq.cur = (sc->rxq.cur + 1) % IWM_RX_RING_COUNT);
4061
4062 /*
4063  * Process an IWM_CSR_INT_BIT_FH_RX or IWM_CSR_INT_BIT_SW_RX interrupt.
4064  * Basic structure from if_iwn
4065  */
4066 static void
4067 iwm_notif_intr(struct iwm_softc *sc)
4068 {
4069         uint16_t hw;
4070
4071         bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
4072             BUS_DMASYNC_POSTREAD);
4073
4074         hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff;
4075         while (sc->rxq.cur != hw) {
4076                 struct iwm_rx_ring *ring = &sc->rxq;
4077                 struct iwm_rx_data *data = &sc->rxq.data[sc->rxq.cur];
4078                 struct iwm_rx_packet *pkt;
4079                 struct iwm_cmd_response *cresp;
4080                 int qid, idx;
4081
4082                 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
4083                     BUS_DMASYNC_POSTREAD);
4084                 pkt = mtod(data->m, struct iwm_rx_packet *);
4085
4086                 qid = pkt->hdr.qid & ~0x80;
4087                 idx = pkt->hdr.idx;
4088
4089                 IWM_DPRINTF(sc, IWM_DEBUG_INTR,
4090                     "rx packet qid=%d idx=%d flags=%x type=%x %d %d\n",
4091                     pkt->hdr.qid & ~0x80, pkt->hdr.idx, pkt->hdr.flags,
4092                     pkt->hdr.code, sc->rxq.cur, hw);
4093
4094                 /*
4095                  * randomly get these from the firmware, no idea why.
4096                  * they at least seem harmless, so just ignore them for now
4097                  */
4098                 if (__predict_false((pkt->hdr.code == 0 && qid == 0 && idx == 0)
4099                     || pkt->len_n_flags == htole32(0x55550000))) {
4100                         ADVANCE_RXQ(sc);
4101                         continue;
4102                 }
4103
4104                 switch (pkt->hdr.code) {
4105                 case IWM_REPLY_RX_PHY_CMD:
4106                         iwm_mvm_rx_rx_phy_cmd(sc, pkt, data);
4107                         break;
4108
4109                 case IWM_REPLY_RX_MPDU_CMD:
4110                         iwm_mvm_rx_rx_mpdu(sc, pkt, data);
4111                         break;
4112
4113                 case IWM_TX_CMD:
4114                         iwm_mvm_rx_tx_cmd(sc, pkt, data);
4115                         break;
4116
4117                 case IWM_MISSED_BEACONS_NOTIFICATION: {
4118                         struct iwm_missed_beacons_notif *resp;
4119                         int missed;
4120
4121                         /* XXX look at mac_id to determine interface ID */
4122                         struct ieee80211com *ic = &sc->sc_ic;
4123                         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4124
4125                         SYNC_RESP_STRUCT(resp, pkt);
4126                         missed = le32toh(resp->consec_missed_beacons);
4127
4128                         IWM_DPRINTF(sc, IWM_DEBUG_BEACON | IWM_DEBUG_STATE,
4129                             "%s: MISSED_BEACON: mac_id=%d, "
4130                             "consec_since_last_rx=%d, consec=%d, num_expect=%d "
4131                             "num_rx=%d\n",
4132                             __func__,
4133                             le32toh(resp->mac_id),
4134                             le32toh(resp->consec_missed_beacons_since_last_rx),
4135                             le32toh(resp->consec_missed_beacons),
4136                             le32toh(resp->num_expected_beacons),
4137                             le32toh(resp->num_recvd_beacons));
4138
4139                         /* Be paranoid */
4140                         if (vap == NULL)
4141                                 break;
4142
4143                         /* XXX no net80211 locking? */
4144                         if (vap->iv_state == IEEE80211_S_RUN &&
4145                             (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
4146                                 if (missed > vap->iv_bmissthreshold) {
4147                                         /* XXX bad locking; turn into task */
4148                                         IWM_UNLOCK(sc);
4149                                         ieee80211_beacon_miss(ic);
4150                                         IWM_LOCK(sc);
4151                                 }
4152                         }
4153
4154                         break; }
4155
4156                 case IWM_MVM_ALIVE: {
4157                         struct iwm_mvm_alive_resp *resp;
4158                         SYNC_RESP_STRUCT(resp, pkt);
4159
4160                         sc->sc_uc.uc_error_event_table
4161                             = le32toh(resp->error_event_table_ptr);
4162                         sc->sc_uc.uc_log_event_table
4163                             = le32toh(resp->log_event_table_ptr);
4164                         sc->sched_base = le32toh(resp->scd_base_ptr);
4165                         sc->sc_uc.uc_ok = resp->status == IWM_ALIVE_STATUS_OK;
4166
4167                         sc->sc_uc.uc_intr = 1;
4168                         wakeup(&sc->sc_uc);
4169                         break; }
4170
4171                 case IWM_CALIB_RES_NOTIF_PHY_DB: {
4172                         struct iwm_calib_res_notif_phy_db *phy_db_notif;
4173                         SYNC_RESP_STRUCT(phy_db_notif, pkt);
4174
4175                         iwm_phy_db_set_section(sc, phy_db_notif);
4176
4177                         break; }
4178
4179                 case IWM_STATISTICS_NOTIFICATION: {
4180                         struct iwm_notif_statistics *stats;
4181                         SYNC_RESP_STRUCT(stats, pkt);
4182                         memcpy(&sc->sc_stats, stats, sizeof(sc->sc_stats));
4183                         sc->sc_noise = iwm_get_noise(&stats->rx.general);
4184                         break; }
4185
4186                 case IWM_NVM_ACCESS_CMD:
4187                         if (sc->sc_wantresp == ((qid << 16) | idx)) {
4188                                 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
4189                                     BUS_DMASYNC_POSTREAD);
4190                                 memcpy(sc->sc_cmd_resp,
4191                                     pkt, sizeof(sc->sc_cmd_resp));
4192                         }
4193                         break;
4194
4195                 case IWM_PHY_CONFIGURATION_CMD:
4196                 case IWM_TX_ANT_CONFIGURATION_CMD:
4197                 case IWM_ADD_STA:
4198                 case IWM_MAC_CONTEXT_CMD:
4199                 case IWM_REPLY_SF_CFG_CMD:
4200                 case IWM_POWER_TABLE_CMD:
4201                 case IWM_PHY_CONTEXT_CMD:
4202                 case IWM_BINDING_CONTEXT_CMD:
4203                 case IWM_TIME_EVENT_CMD:
4204                 case IWM_SCAN_REQUEST_CMD:
4205                 case IWM_REPLY_BEACON_FILTERING_CMD:
4206                 case IWM_MAC_PM_POWER_TABLE:
4207                 case IWM_TIME_QUOTA_CMD:
4208                 case IWM_REMOVE_STA:
4209                 case IWM_TXPATH_FLUSH:
4210                 case IWM_LQ_CMD:
4211                         SYNC_RESP_STRUCT(cresp, pkt);
4212                         if (sc->sc_wantresp == ((qid << 16) | idx)) {
4213                                 memcpy(sc->sc_cmd_resp,
4214                                     pkt, sizeof(*pkt)+sizeof(*cresp));
4215                         }
4216                         break;
4217
4218                 /* ignore */
4219                 case 0x6c: /* IWM_PHY_DB_CMD, no idea why it's not in fw-api.h */
4220                         break;
4221
4222                 case IWM_INIT_COMPLETE_NOTIF:
4223                         sc->sc_init_complete = 1;
4224                         wakeup(&sc->sc_init_complete);
4225                         break;
4226
4227                 case IWM_SCAN_COMPLETE_NOTIFICATION: {
4228                         struct iwm_scan_complete_notif *notif;
4229                         SYNC_RESP_STRUCT(notif, pkt);
4230                         taskqueue_enqueue(sc->sc_tq, &sc->sc_es_task);
4231                         break; }
4232
4233                 case IWM_REPLY_ERROR: {
4234                         struct iwm_error_resp *resp;
4235                         SYNC_RESP_STRUCT(resp, pkt);
4236
4237                         device_printf(sc->sc_dev,
4238                             "firmware error 0x%x, cmd 0x%x\n",
4239                             le32toh(resp->error_type),
4240                             resp->cmd_id);
4241                         break; }
4242
4243                 case IWM_TIME_EVENT_NOTIFICATION: {
4244                         struct iwm_time_event_notif *notif;
4245                         SYNC_RESP_STRUCT(notif, pkt);
4246
4247                         if (notif->status) {
4248                                 if (le32toh(notif->action) &
4249                                     IWM_TE_V2_NOTIF_HOST_EVENT_START)
4250                                         sc->sc_auth_prot = 2;
4251                                 else
4252                                         sc->sc_auth_prot = 0;
4253                         } else {
4254                                 sc->sc_auth_prot = -1;
4255                         }
4256                         IWM_DPRINTF(sc, IWM_DEBUG_INTR,
4257                             "%s: time event notification auth_prot=%d\n",
4258                                 __func__, sc->sc_auth_prot);
4259
4260                         wakeup(&sc->sc_auth_prot);
4261                         break; }
4262
4263                 case IWM_MCAST_FILTER_CMD:
4264                         break;
4265
4266                 default:
4267                         device_printf(sc->sc_dev,
4268                             "frame %d/%d %x UNHANDLED (this should "
4269                             "not happen)\n", qid, idx,
4270                             pkt->len_n_flags);
4271                         break;
4272                 }
4273
4274                 /*
4275                  * Why test bit 0x80?  The Linux driver:
4276                  *
4277                  * There is one exception:  uCode sets bit 15 when it
4278                  * originates the response/notification, i.e. when the
4279                  * response/notification is not a direct response to a
4280                  * command sent by the driver.  For example, uCode issues
4281                  * IWM_REPLY_RX when it sends a received frame to the driver;
4282                  * it is not a direct response to any driver command.
4283                  *
4284                  * Ok, so since when is 7 == 15?  Well, the Linux driver
4285                  * uses a slightly different format for pkt->hdr, and "qid"
4286                  * is actually the upper byte of a two-byte field.
4287                  */
4288                 if (!(pkt->hdr.qid & (1 << 7))) {
4289                         iwm_cmd_done(sc, pkt);
4290                 }
4291
4292                 ADVANCE_RXQ(sc);
4293         }
4294
4295         IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL,
4296             IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
4297
4298         /*
4299          * Tell the firmware what we have processed.
4300          * Seems like the hardware gets upset unless we align
4301          * the write by 8??
4302          */
4303         hw = (hw == 0) ? IWM_RX_RING_COUNT - 1 : hw - 1;
4304         IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, hw & ~7);
4305 }
4306
4307 static void
4308 iwm_intr(void *arg)
4309 {
4310         struct iwm_softc *sc = arg;
4311         int handled = 0;
4312         int r1, r2, rv = 0;
4313         int isperiodic = 0;
4314
4315         IWM_LOCK(sc);
4316         IWM_WRITE(sc, IWM_CSR_INT_MASK, 0);
4317
4318         if (sc->sc_flags & IWM_FLAG_USE_ICT) {
4319                 uint32_t *ict = sc->ict_dma.vaddr;
4320                 int tmp;
4321
4322                 tmp = htole32(ict[sc->ict_cur]);
4323                 if (!tmp)
4324                         goto out_ena;
4325
4326                 /*
4327                  * ok, there was something.  keep plowing until we have all.
4328                  */
4329                 r1 = r2 = 0;
4330                 while (tmp) {
4331                         r1 |= tmp;
4332                         ict[sc->ict_cur] = 0;
4333                         sc->ict_cur = (sc->ict_cur+1) % IWM_ICT_COUNT;
4334                         tmp = htole32(ict[sc->ict_cur]);
4335                 }
4336
4337                 /* this is where the fun begins.  don't ask */
4338                 if (r1 == 0xffffffff)
4339                         r1 = 0;
4340
4341                 /* i am not expected to understand this */
4342                 if (r1 & 0xc0000)
4343                         r1 |= 0x8000;
4344                 r1 = (0xff & r1) | ((0xff00 & r1) << 16);
4345         } else {
4346                 r1 = IWM_READ(sc, IWM_CSR_INT);
4347                 /* "hardware gone" (where, fishing?) */
4348                 if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0)
4349                         goto out;
4350                 r2 = IWM_READ(sc, IWM_CSR_FH_INT_STATUS);
4351         }
4352         if (r1 == 0 && r2 == 0) {
4353                 goto out_ena;
4354         }
4355
4356         IWM_WRITE(sc, IWM_CSR_INT, r1 | ~sc->sc_intmask);
4357
4358         /* ignored */
4359         handled |= (r1 & (IWM_CSR_INT_BIT_ALIVE /*| IWM_CSR_INT_BIT_SCD*/));
4360
4361         if (r1 & IWM_CSR_INT_BIT_SW_ERR) {
4362                 int i;
4363                 struct ieee80211com *ic = &sc->sc_ic;
4364                 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4365
4366                 iwm_nic_error(sc);
4367
4368                 /* Dump driver status (TX and RX rings) while we're here. */
4369                 device_printf(sc->sc_dev, "driver status:\n");
4370                 for (i = 0; i < IWM_MVM_MAX_QUEUES; i++) {
4371                         struct iwm_tx_ring *ring = &sc->txq[i];
4372                         device_printf(sc->sc_dev,
4373                             "  tx ring %2d: qid=%-2d cur=%-3d "
4374                             "queued=%-3d\n",
4375                             i, ring->qid, ring->cur, ring->queued);
4376                 }
4377                 device_printf(sc->sc_dev,
4378                     "  rx ring: cur=%d\n", sc->rxq.cur);
4379                 device_printf(sc->sc_dev,
4380                     "  802.11 state %d\n", vap->iv_state);
4381
4382                 /* Don't stop the device; just do a VAP restart */
4383                 IWM_UNLOCK(sc);
4384
4385                 if (vap == NULL) {
4386                         printf("%s: null vap\n", __func__);
4387                         return;
4388                 }
4389
4390                 device_printf(sc->sc_dev, "%s: controller panicked, iv_state = %d; "
4391                     "restarting\n", __func__, vap->iv_state);
4392
4393                 /* XXX TODO: turn this into a callout/taskqueue */
4394                 ieee80211_restart_all(ic);
4395                 return;
4396         }
4397
4398         if (r1 & IWM_CSR_INT_BIT_HW_ERR) {
4399                 handled |= IWM_CSR_INT_BIT_HW_ERR;
4400                 device_printf(sc->sc_dev, "hardware error, stopping device\n");
4401                 iwm_stop(sc);
4402                 rv = 1;
4403                 goto out;
4404         }
4405
4406         /* firmware chunk loaded */
4407         if (r1 & IWM_CSR_INT_BIT_FH_TX) {
4408                 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_TX_MASK);
4409                 handled |= IWM_CSR_INT_BIT_FH_TX;
4410                 sc->sc_fw_chunk_done = 1;
4411                 wakeup(&sc->sc_fw);
4412         }
4413
4414         if (r1 & IWM_CSR_INT_BIT_RF_KILL) {
4415                 handled |= IWM_CSR_INT_BIT_RF_KILL;
4416                 if (iwm_check_rfkill(sc)) {
4417                         device_printf(sc->sc_dev,
4418                             "%s: rfkill switch, disabling interface\n",
4419                             __func__);
4420                         iwm_stop(sc);
4421                 }
4422         }
4423
4424         /*
4425          * The Linux driver uses periodic interrupts to avoid races.
4426          * We cargo-cult like it's going out of fashion.
4427          */
4428         if (r1 & IWM_CSR_INT_BIT_RX_PERIODIC) {
4429                 handled |= IWM_CSR_INT_BIT_RX_PERIODIC;
4430                 IWM_WRITE(sc, IWM_CSR_INT, IWM_CSR_INT_BIT_RX_PERIODIC);
4431                 if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) == 0)
4432                         IWM_WRITE_1(sc,
4433                             IWM_CSR_INT_PERIODIC_REG, IWM_CSR_INT_PERIODIC_DIS);
4434                 isperiodic = 1;
4435         }
4436
4437         if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) || isperiodic) {
4438                 handled |= (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX);
4439                 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_RX_MASK);
4440
4441                 iwm_notif_intr(sc);
4442
4443                 /* enable periodic interrupt, see above */
4444                 if (r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX) && !isperiodic)
4445                         IWM_WRITE_1(sc, IWM_CSR_INT_PERIODIC_REG,
4446                             IWM_CSR_INT_PERIODIC_ENA);
4447         }
4448
4449         if (__predict_false(r1 & ~handled))
4450                 IWM_DPRINTF(sc, IWM_DEBUG_INTR,
4451                     "%s: unhandled interrupts: %x\n", __func__, r1);
4452         rv = 1;
4453
4454  out_ena:
4455         iwm_restore_interrupts(sc);
4456  out:
4457         IWM_UNLOCK(sc);
4458         return;
4459 }
4460
4461 /*
4462  * Autoconf glue-sniffing
4463  */
4464 #define PCI_VENDOR_INTEL                0x8086
4465 #define PCI_PRODUCT_INTEL_WL_3160_1     0x08b3
4466 #define PCI_PRODUCT_INTEL_WL_3160_2     0x08b4
4467 #define PCI_PRODUCT_INTEL_WL_7260_1     0x08b1
4468 #define PCI_PRODUCT_INTEL_WL_7260_2     0x08b2
4469 #define PCI_PRODUCT_INTEL_WL_7265_1     0x095a
4470 #define PCI_PRODUCT_INTEL_WL_7265_2     0x095b
4471
4472 static const struct iwm_devices {
4473         uint16_t        device;
4474         const char      *name;
4475 } iwm_devices[] = {
4476         { PCI_PRODUCT_INTEL_WL_3160_1, "Intel Dual Band Wireless AC 3160" },
4477         { PCI_PRODUCT_INTEL_WL_3160_2, "Intel Dual Band Wireless AC 3160" },
4478         { PCI_PRODUCT_INTEL_WL_7260_1, "Intel Dual Band Wireless AC 7260" },
4479         { PCI_PRODUCT_INTEL_WL_7260_2, "Intel Dual Band Wireless AC 7260" },
4480         { PCI_PRODUCT_INTEL_WL_7265_1, "Intel Dual Band Wireless AC 7265" },
4481         { PCI_PRODUCT_INTEL_WL_7265_2, "Intel Dual Band Wireless AC 7265" },
4482 };
4483
4484 static int
4485 iwm_probe(device_t dev)
4486 {
4487         int i;
4488
4489         for (i = 0; i < nitems(iwm_devices); i++)
4490                 if (pci_get_vendor(dev) == PCI_VENDOR_INTEL &&
4491                     pci_get_device(dev) == iwm_devices[i].device) {
4492                         device_set_desc(dev, iwm_devices[i].name);
4493                         return (BUS_PROBE_DEFAULT);
4494                 }
4495
4496         return (ENXIO);
4497 }
4498
4499 static int
4500 iwm_dev_check(device_t dev)
4501 {
4502         struct iwm_softc *sc;
4503
4504         sc = device_get_softc(dev);
4505
4506         switch (pci_get_device(dev)) {
4507         case PCI_PRODUCT_INTEL_WL_3160_1:
4508         case PCI_PRODUCT_INTEL_WL_3160_2:
4509                 sc->sc_fwname = "iwm3160fw";
4510                 sc->host_interrupt_operation_mode = 1;
4511                 return (0);
4512         case PCI_PRODUCT_INTEL_WL_7260_1:
4513         case PCI_PRODUCT_INTEL_WL_7260_2:
4514                 sc->sc_fwname = "iwm7260fw";
4515                 sc->host_interrupt_operation_mode = 1;
4516                 return (0);
4517         case PCI_PRODUCT_INTEL_WL_7265_1:
4518         case PCI_PRODUCT_INTEL_WL_7265_2:
4519                 sc->sc_fwname = "iwm7265fw";
4520                 sc->host_interrupt_operation_mode = 0;
4521                 return (0);
4522         default:
4523                 device_printf(dev, "unknown adapter type\n");
4524                 return ENXIO;
4525         }
4526 }
4527
4528 static int
4529 iwm_pci_attach(device_t dev)
4530 {
4531         struct iwm_softc *sc;
4532         int count, error, rid;
4533         uint16_t reg;
4534
4535         sc = device_get_softc(dev);
4536
4537         /* Clear device-specific "PCI retry timeout" register (41h). */
4538         reg = pci_read_config(dev, 0x40, sizeof(reg));
4539         pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg));
4540
4541         /* Enable bus-mastering and hardware bug workaround. */
4542         pci_enable_busmaster(dev);
4543         reg = pci_read_config(dev, PCIR_STATUS, sizeof(reg));
4544         /* if !MSI */
4545         if (reg & PCIM_STATUS_INTxSTATE) {
4546                 reg &= ~PCIM_STATUS_INTxSTATE;
4547         }
4548         pci_write_config(dev, PCIR_STATUS, reg, sizeof(reg));
4549
4550         rid = PCIR_BAR(0);
4551         sc->sc_mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
4552             RF_ACTIVE);
4553         if (sc->sc_mem == NULL) {
4554                 device_printf(sc->sc_dev, "can't map mem space\n");
4555                 return (ENXIO);
4556         }
4557         sc->sc_st = rman_get_bustag(sc->sc_mem);
4558         sc->sc_sh = rman_get_bushandle(sc->sc_mem);
4559
4560         /* Install interrupt handler. */
4561         count = 1;
4562         rid = 0;
4563         if (pci_alloc_msi(dev, &count) == 0)
4564                 rid = 1;
4565         sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
4566             (rid != 0 ? 0 : RF_SHAREABLE));
4567         if (sc->sc_irq == NULL) {
4568                 device_printf(dev, "can't map interrupt\n");
4569                         return (ENXIO);
4570         }
4571         error = bus_setup_intr(dev, sc->sc_irq, INTR_TYPE_NET | INTR_MPSAFE,
4572             NULL, iwm_intr, sc, &sc->sc_ih);
4573         if (sc->sc_ih == NULL) {
4574                 device_printf(dev, "can't establish interrupt");
4575                         return (ENXIO);
4576         }
4577         sc->sc_dmat = bus_get_dma_tag(sc->sc_dev);
4578
4579         return (0);
4580 }
4581
4582 static void
4583 iwm_pci_detach(device_t dev)
4584 {
4585         struct iwm_softc *sc = device_get_softc(dev);
4586
4587         if (sc->sc_irq != NULL) {
4588                 bus_teardown_intr(dev, sc->sc_irq, sc->sc_ih);
4589                 bus_release_resource(dev, SYS_RES_IRQ,
4590                     rman_get_rid(sc->sc_irq), sc->sc_irq);
4591                 pci_release_msi(dev);
4592         }
4593         if (sc->sc_mem != NULL)
4594                 bus_release_resource(dev, SYS_RES_MEMORY,
4595                     rman_get_rid(sc->sc_mem), sc->sc_mem);
4596 }
4597
4598
4599
4600 static int
4601 iwm_attach(device_t dev)
4602 {
4603         struct iwm_softc *sc = device_get_softc(dev);
4604         struct ieee80211com *ic = &sc->sc_ic;
4605         int error;
4606         int txq_i, i;
4607
4608         sc->sc_dev = dev;
4609         IWM_LOCK_INIT(sc);
4610         mbufq_init(&sc->sc_snd, ifqmaxlen);
4611         callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0);
4612         TASK_INIT(&sc->sc_es_task, 0, iwm_endscan_cb, sc);
4613         sc->sc_tq = taskqueue_create("iwm_taskq", M_WAITOK,
4614             taskqueue_thread_enqueue, &sc->sc_tq);
4615         error = taskqueue_start_threads(&sc->sc_tq, 1, 0, "iwm_taskq");
4616         if (error != 0) {
4617                 device_printf(dev, "can't start threads, error %d\n",
4618                     error);
4619                 goto fail;
4620         }
4621
4622         /* PCI attach */
4623         error = iwm_pci_attach(dev);
4624         if (error != 0)
4625                 goto fail;
4626
4627         sc->sc_wantresp = -1;
4628
4629         /* Check device type */
4630         error = iwm_dev_check(dev);
4631         if (error != 0)
4632                 goto fail;
4633
4634         sc->sc_fwdmasegsz = IWM_FWDMASEGSZ;
4635
4636         /*
4637          * We now start fiddling with the hardware
4638          */
4639         sc->sc_hw_rev = IWM_READ(sc, IWM_CSR_HW_REV);
4640         if (iwm_prepare_card_hw(sc) != 0) {
4641                 device_printf(dev, "could not initialize hardware\n");
4642                 goto fail;
4643         }
4644
4645         /* Allocate DMA memory for firmware transfers. */
4646         if ((error = iwm_alloc_fwmem(sc)) != 0) {
4647                 device_printf(dev, "could not allocate memory for firmware\n");
4648                 goto fail;
4649         }
4650
4651         /* Allocate "Keep Warm" page. */
4652         if ((error = iwm_alloc_kw(sc)) != 0) {
4653                 device_printf(dev, "could not allocate keep warm page\n");
4654                 goto fail;
4655         }
4656
4657         /* We use ICT interrupts */
4658         if ((error = iwm_alloc_ict(sc)) != 0) {
4659                 device_printf(dev, "could not allocate ICT table\n");
4660                 goto fail;
4661         }
4662
4663         /* Allocate TX scheduler "rings". */
4664         if ((error = iwm_alloc_sched(sc)) != 0) {
4665                 device_printf(dev, "could not allocate TX scheduler rings\n");
4666                 goto fail;
4667         }
4668
4669         /* Allocate TX rings */
4670         for (txq_i = 0; txq_i < nitems(sc->txq); txq_i++) {
4671                 if ((error = iwm_alloc_tx_ring(sc,
4672                     &sc->txq[txq_i], txq_i)) != 0) {
4673                         device_printf(dev,
4674                             "could not allocate TX ring %d\n",
4675                             txq_i);
4676                         goto fail;
4677                 }
4678         }
4679
4680         /* Allocate RX ring. */
4681         if ((error = iwm_alloc_rx_ring(sc, &sc->rxq)) != 0) {
4682                 device_printf(dev, "could not allocate RX ring\n");
4683                 goto fail;
4684         }
4685
4686         /* Clear pending interrupts. */
4687         IWM_WRITE(sc, IWM_CSR_INT, 0xffffffff);
4688
4689         ic->ic_softc = sc;
4690         ic->ic_name = device_get_nameunit(sc->sc_dev);
4691         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
4692         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
4693
4694         /* Set device capabilities. */
4695         ic->ic_caps =
4696             IEEE80211_C_STA |
4697             IEEE80211_C_WPA |           /* WPA/RSN */
4698             IEEE80211_C_WME |
4699             IEEE80211_C_SHSLOT |        /* short slot time supported */
4700             IEEE80211_C_SHPREAMBLE      /* short preamble supported */
4701 //          IEEE80211_C_BGSCAN          /* capable of bg scanning */
4702             ;
4703         for (i = 0; i < nitems(sc->sc_phyctxt); i++) {
4704                 sc->sc_phyctxt[i].id = i;
4705                 sc->sc_phyctxt[i].color = 0;
4706                 sc->sc_phyctxt[i].ref = 0;
4707                 sc->sc_phyctxt[i].channel = NULL;
4708         }
4709
4710         /* Max RSSI */
4711         sc->sc_max_rssi = IWM_MAX_DBM - IWM_MIN_DBM;
4712         sc->sc_preinit_hook.ich_func = iwm_preinit;
4713         sc->sc_preinit_hook.ich_arg = sc;
4714         if (config_intrhook_establish(&sc->sc_preinit_hook) != 0) {
4715                 device_printf(dev, "config_intrhook_establish failed\n");
4716                 goto fail;
4717         }
4718
4719 #ifdef IWM_DEBUG
4720         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
4721             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "debug",
4722             CTLFLAG_RW, &sc->sc_debug, 0, "control debugging");
4723 #endif
4724
4725         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4726             "<-%s\n", __func__);
4727
4728         return 0;
4729
4730         /* Free allocated memory if something failed during attachment. */
4731 fail:
4732         iwm_detach_local(sc, 0);
4733
4734         return ENXIO;
4735 }
4736
4737 static int
4738 iwm_update_edca(struct ieee80211com *ic)
4739 {
4740         struct iwm_softc *sc = ic->ic_softc;
4741
4742         device_printf(sc->sc_dev, "%s: called\n", __func__);
4743         return (0);
4744 }
4745
4746 static void
4747 iwm_preinit(void *arg)
4748 {
4749         struct iwm_softc *sc = arg;
4750         device_t dev = sc->sc_dev;
4751         struct ieee80211com *ic = &sc->sc_ic;
4752         int error;
4753
4754         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4755             "->%s\n", __func__);
4756
4757         IWM_LOCK(sc);
4758         if ((error = iwm_start_hw(sc)) != 0) {
4759                 device_printf(dev, "could not initialize hardware\n");
4760                 IWM_UNLOCK(sc);
4761                 goto fail;
4762         }
4763
4764         error = iwm_run_init_mvm_ucode(sc, 1);
4765         iwm_stop_device(sc);
4766         if (error) {
4767                 IWM_UNLOCK(sc);
4768                 goto fail;
4769         }
4770         device_printf(dev,
4771             "revision: 0x%x, firmware %d.%d (API ver. %d)\n",
4772             sc->sc_hw_rev & IWM_CSR_HW_REV_TYPE_MSK,
4773             IWM_UCODE_MAJOR(sc->sc_fwver),
4774             IWM_UCODE_MINOR(sc->sc_fwver),
4775             IWM_UCODE_API(sc->sc_fwver));
4776
4777         /* not all hardware can do 5GHz band */
4778         if (!sc->sc_nvm.sku_cap_band_52GHz_enable)
4779                 memset(&ic->ic_sup_rates[IEEE80211_MODE_11A], 0,
4780                     sizeof(ic->ic_sup_rates[IEEE80211_MODE_11A]));
4781         IWM_UNLOCK(sc);
4782
4783         /*
4784          * At this point we've committed - if we fail to do setup,
4785          * we now also have to tear down the net80211 state.
4786          */
4787         ieee80211_ifattach(ic);
4788         ic->ic_vap_create = iwm_vap_create;
4789         ic->ic_vap_delete = iwm_vap_delete;
4790         ic->ic_raw_xmit = iwm_raw_xmit;
4791         ic->ic_node_alloc = iwm_node_alloc;
4792         ic->ic_scan_start = iwm_scan_start;
4793         ic->ic_scan_end = iwm_scan_end;
4794         ic->ic_update_mcast = iwm_update_mcast;
4795         ic->ic_set_channel = iwm_set_channel;
4796         ic->ic_scan_curchan = iwm_scan_curchan;
4797         ic->ic_scan_mindwell = iwm_scan_mindwell;
4798         ic->ic_wme.wme_update = iwm_update_edca;
4799         ic->ic_parent = iwm_parent;
4800         ic->ic_transmit = iwm_transmit;
4801         iwm_radiotap_attach(sc);
4802         if (bootverbose)
4803                 ieee80211_announce(ic);
4804
4805         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4806             "<-%s\n", __func__);
4807         config_intrhook_disestablish(&sc->sc_preinit_hook);
4808
4809         return;
4810 fail:
4811         config_intrhook_disestablish(&sc->sc_preinit_hook);
4812         iwm_detach_local(sc, 0);
4813 }
4814
4815 /*
4816  * Attach the interface to 802.11 radiotap.
4817  */
4818 static void
4819 iwm_radiotap_attach(struct iwm_softc *sc)
4820 {
4821         struct ieee80211com *ic = &sc->sc_ic;
4822
4823         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4824             "->%s begin\n", __func__);
4825         ieee80211_radiotap_attach(ic,
4826             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
4827                 IWM_TX_RADIOTAP_PRESENT,
4828             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
4829                 IWM_RX_RADIOTAP_PRESENT);
4830         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE,
4831             "->%s end\n", __func__);
4832 }
4833
4834 static struct ieee80211vap *
4835 iwm_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
4836     enum ieee80211_opmode opmode, int flags,
4837     const uint8_t bssid[IEEE80211_ADDR_LEN],
4838     const uint8_t mac[IEEE80211_ADDR_LEN])
4839 {
4840         struct iwm_vap *ivp;
4841         struct ieee80211vap *vap;
4842
4843         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
4844                 return NULL;
4845         ivp = malloc(sizeof(struct iwm_vap), M_80211_VAP, M_WAITOK | M_ZERO);
4846         vap = &ivp->iv_vap;
4847         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
4848         vap->iv_bmissthreshold = 10;            /* override default */
4849         /* Override with driver methods. */
4850         ivp->iv_newstate = vap->iv_newstate;
4851         vap->iv_newstate = iwm_newstate;
4852
4853         ieee80211_ratectl_init(vap);
4854         /* Complete setup. */
4855         ieee80211_vap_attach(vap, iwm_media_change, ieee80211_media_status,
4856             mac);
4857         ic->ic_opmode = opmode;
4858
4859         return vap;
4860 }
4861
4862 static void
4863 iwm_vap_delete(struct ieee80211vap *vap)
4864 {
4865         struct iwm_vap *ivp = IWM_VAP(vap);
4866
4867         ieee80211_ratectl_deinit(vap);
4868         ieee80211_vap_detach(vap);
4869         free(ivp, M_80211_VAP);
4870 }
4871
4872 static void
4873 iwm_scan_start(struct ieee80211com *ic)
4874 {
4875         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4876         struct iwm_softc *sc = ic->ic_softc;
4877         int error;
4878
4879         if (sc->sc_scanband)
4880                 return;
4881         IWM_LOCK(sc);
4882         error = iwm_mvm_scan_request(sc, IEEE80211_CHAN_2GHZ, 0, NULL, 0);
4883         if (error) {
4884                 device_printf(sc->sc_dev, "could not initiate scan\n");
4885                 IWM_UNLOCK(sc);
4886                 ieee80211_cancel_scan(vap);
4887         } else
4888                 IWM_UNLOCK(sc);
4889 }
4890
4891 static void
4892 iwm_scan_end(struct ieee80211com *ic)
4893 {
4894 }
4895
4896 static void
4897 iwm_update_mcast(struct ieee80211com *ic)
4898 {
4899 }
4900
4901 static void
4902 iwm_set_channel(struct ieee80211com *ic)
4903 {
4904 }
4905
4906 static void
4907 iwm_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
4908 {
4909 }
4910
4911 static void
4912 iwm_scan_mindwell(struct ieee80211_scan_state *ss)
4913 {
4914         return;
4915 }
4916
4917 void
4918 iwm_init_task(void *arg1)
4919 {
4920         struct iwm_softc *sc = arg1;
4921
4922         IWM_LOCK(sc);
4923         while (sc->sc_flags & IWM_FLAG_BUSY)
4924                 msleep(&sc->sc_flags, &sc->sc_mtx, 0, "iwmpwr", 0);
4925         sc->sc_flags |= IWM_FLAG_BUSY;
4926         iwm_stop(sc);
4927         if (sc->sc_ic.ic_nrunning > 0)
4928                 iwm_init(sc);
4929         sc->sc_flags &= ~IWM_FLAG_BUSY;
4930         wakeup(&sc->sc_flags);
4931         IWM_UNLOCK(sc);
4932 }
4933
4934 static int
4935 iwm_resume(device_t dev)
4936 {
4937         struct iwm_softc *sc = device_get_softc(dev);
4938         int do_reinit = 0;
4939         uint16_t reg;
4940
4941         /* Clear device-specific "PCI retry timeout" register (41h). */
4942         reg = pci_read_config(dev, 0x40, sizeof(reg));
4943         pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg));
4944         iwm_init_task(device_get_softc(dev));
4945
4946         IWM_LOCK(sc);
4947         if (sc->sc_flags & IWM_FLAG_DORESUME) {
4948                 sc->sc_flags &= ~IWM_FLAG_DORESUME;
4949                 do_reinit = 1;
4950         }
4951         IWM_UNLOCK(sc);
4952
4953         if (do_reinit)
4954                 ieee80211_resume_all(&sc->sc_ic);
4955
4956         return 0;
4957 }
4958
4959 static int
4960 iwm_suspend(device_t dev)
4961 {
4962         int do_stop = 0;
4963         struct iwm_softc *sc = device_get_softc(dev);
4964
4965         do_stop = !! (sc->sc_ic.ic_nrunning > 0);
4966
4967         ieee80211_suspend_all(&sc->sc_ic);
4968
4969         if (do_stop) {
4970                 IWM_LOCK(sc);
4971                 iwm_stop(sc);
4972                 sc->sc_flags |= IWM_FLAG_DORESUME;
4973                 IWM_UNLOCK(sc);
4974         }
4975
4976         return (0);
4977 }
4978
4979 static int
4980 iwm_detach_local(struct iwm_softc *sc, int do_net80211)
4981 {
4982         struct iwm_fw_info *fw = &sc->sc_fw;
4983         device_t dev = sc->sc_dev;
4984         int i;
4985
4986         if (sc->sc_tq) {
4987                 taskqueue_drain_all(sc->sc_tq);
4988                 taskqueue_free(sc->sc_tq);
4989         }
4990         callout_drain(&sc->sc_watchdog_to);
4991         iwm_stop_device(sc);
4992         if (do_net80211)
4993                 ieee80211_ifdetach(&sc->sc_ic);
4994
4995         /* Free descriptor rings */
4996         for (i = 0; i < nitems(sc->txq); i++)
4997                 iwm_free_tx_ring(sc, &sc->txq[i]);
4998
4999         /* Free firmware */
5000         if (fw->fw_fp != NULL)
5001                 iwm_fw_info_free(fw);
5002
5003         /* Free scheduler */
5004         iwm_free_sched(sc);
5005         if (sc->ict_dma.vaddr != NULL)
5006                 iwm_free_ict(sc);
5007         if (sc->kw_dma.vaddr != NULL)
5008                 iwm_free_kw(sc);
5009         if (sc->fw_dma.vaddr != NULL)
5010                 iwm_free_fwmem(sc);
5011
5012         /* Finished with the hardware - detach things */
5013         iwm_pci_detach(dev);
5014
5015         mbufq_drain(&sc->sc_snd);
5016         IWM_LOCK_DESTROY(sc);
5017
5018         return (0);
5019 }
5020
5021 static int
5022 iwm_detach(device_t dev)
5023 {
5024         struct iwm_softc *sc = device_get_softc(dev);
5025
5026         return (iwm_detach_local(sc, 1));
5027 }
5028
5029 static device_method_t iwm_pci_methods[] = {
5030         /* Device interface */
5031         DEVMETHOD(device_probe,         iwm_probe),
5032         DEVMETHOD(device_attach,        iwm_attach),
5033         DEVMETHOD(device_detach,        iwm_detach),
5034         DEVMETHOD(device_suspend,       iwm_suspend),
5035         DEVMETHOD(device_resume,        iwm_resume),
5036
5037         DEVMETHOD_END
5038 };
5039
5040 static driver_t iwm_pci_driver = {
5041         "iwm",
5042         iwm_pci_methods,
5043         sizeof (struct iwm_softc)
5044 };
5045
5046 static devclass_t iwm_devclass;
5047
5048 DRIVER_MODULE(iwm, pci, iwm_pci_driver, iwm_devclass, NULL, NULL);
5049 MODULE_DEPEND(iwm, firmware, 1, 1, 1);
5050 MODULE_DEPEND(iwm, pci, 1, 1, 1);
5051 MODULE_DEPEND(iwm, wlan, 1, 1, 1);