Ticket #10729: iwn.2.patch

src/add-ons/kernel/drivers/network/wlan/iprowifi4965/dev/iwn/if_iwn.c

@@ -1 +1 @@
 /*-
+ * Copyright (c) 2013 Cedric GROSS <c.gross@kreiz-it.fr>
+ * Copyright (c) 2011 Intel Corporation
  * Copyright (c) 2007-2009
  *  Damien Bergamini <damien.bergamini@free.fr>
  * Copyright (c) 2008
@@ -26 +28 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_wlan.h"
+#include "opt_iwn.h"
+
 #include <sys/param.h>
 #include <sys/sockio.h>
 #include <sys/sysctl.h>
@@ -71 +76 @@
 
 #include <dev/iwn/if_iwnreg.h>
 #include <dev/iwn/if_iwnvar.h>
+#include <dev/iwn/if_iwn_devid.h>
 
 struct iwn_ident {
     uint16_t    vendor;
@@ -79 +85 @@
 };
 
 static const struct iwn_ident iwn_ident_table[] = {
-    { 0x8086, 0x0082, "Intel Centrino Advanced-N 6205"      },
-    { 0x8086, 0x0083, "Intel Centrino Wireless-N 1000"      },
-    { 0x8086, 0x0084, "Intel Centrino Wireless-N 1000"      },
-    { 0x8086, 0x0085, "Intel Centrino Advanced-N 6205"      },
-    { 0x8086, 0x0087, "Intel Centrino Advanced-N + WiMAX 6250"  },
-    { 0x8086, 0x0089, "Intel Centrino Advanced-N + WiMAX 6250"  },
-    { 0x8086, 0x008a, "Intel Centrino Wireless-N 1030"      },
-    { 0x8086, 0x008b, "Intel Centrino Wireless-N 1030"      },
-    { 0x8086, 0x0090, "Intel Centrino Advanced-N 6230"      },
-    { 0x8086, 0x0091, "Intel Centrino Advanced-N 6230"      },
-#ifdef __HAIKU__
-    { 0x8086, 0x088e, "Intel Centrino Advanced-N 6235"      },
-#endif
-    { 0x8086, 0x0885, "Intel Centrino Wireless-N + WiMAX 6150"  },
-    { 0x8086, 0x0886, "Intel Centrino Wireless-N + WiMAX 6150"  },
-    { 0x8086, 0x0896, "Intel Centrino Wireless-N 130"       },
-    { 0x8086, 0x0887, "Intel Centrino Wireless-N 130"       },
-    { 0x8086, 0x08ae, "Intel Centrino Wireless-N 100"       },
-    { 0x8086, 0x08af, "Intel Centrino Wireless-N 100"       },
-    { 0x8086, 0x4229, "Intel Wireless WiFi Link 4965"       },
-    { 0x8086, 0x422b, "Intel Centrino Ultimate-N 6300"      },
-    { 0x8086, 0x422c, "Intel Centrino Advanced-N 6200"      },
-    { 0x8086, 0x422d, "Intel Wireless WiFi Link 4965"       },
-    { 0x8086, 0x4230, "Intel Wireless WiFi Link 4965"       },
-    { 0x8086, 0x4232, "Intel WiFi Link 5100"            },
-    { 0x8086, 0x4233, "Intel Wireless WiFi Link 4965"       },
-    { 0x8086, 0x4235, "Intel Ultimate N WiFi Link 5300"     },
-    { 0x8086, 0x4236, "Intel Ultimate N WiFi Link 5300"     },
-    { 0x8086, 0x4237, "Intel WiFi Link 5100"            },
-    { 0x8086, 0x4238, "Intel Centrino Ultimate-N 6300"      },
-    { 0x8086, 0x4239, "Intel Centrino Advanced-N 6200"      },
-    { 0x8086, 0x423a, "Intel WiMAX/WiFi Link 5350"          },
-    { 0x8086, 0x423b, "Intel WiMAX/WiFi Link 5350"          },
-    { 0x8086, 0x423c, "Intel WiMAX/WiFi Link 5150"          },
-    { 0x8086, 0x423d, "Intel WiMAX/WiFi Link 5150"          },
+    { 0x8086, IWN_DID_6x05_1, "Intel Centrino Advanced-N 6205"      },
+    { 0x8086, IWN_DID_1000_1, "Intel Centrino Wireless-N 1000"      },
+    { 0x8086, IWN_DID_1000_2, "Intel Centrino Wireless-N 1000"      },
+    { 0x8086, IWN_DID_6x05_2, "Intel Centrino Advanced-N 6205"      },
+    { 0x8086, IWN_DID_6050_1, "Intel Centrino Advanced-N + WiMAX 6250"  },
+    { 0x8086, IWN_DID_6050_2, "Intel Centrino Advanced-N + WiMAX 6250"  },
+    { 0x8086, IWN_DID_x030_1, "Intel Centrino Wireless-N 1030"      },
+    { 0x8086, IWN_DID_x030_2, "Intel Centrino Wireless-N 1030"      },
+    { 0x8086, IWN_DID_x030_3, "Intel Centrino Advanced-N 6230"      },
+    { 0x8086, IWN_DID_x030_4, "Intel Centrino Advanced-N 6230"      },
+    { 0x8086, IWN_DID_6150_1, "Intel Centrino Wireless-N + WiMAX 6150"  },
+    { 0x8086, IWN_DID_6150_2, "Intel Centrino Wireless-N + WiMAX 6150"  },
+    { 0x8086, IWN_DID_2x30_1, "Intel Centrino Wireless-N 2230"      },
+    { 0x8086, IWN_DID_2x30_2, "Intel Centrino Wireless-N 2230"      },
+    { 0x8086, IWN_DID_130_1, "Intel Centrino Wireless-N 130"        },
+    { 0x8086, IWN_DID_130_2, "Intel Centrino Wireless-N 130"        },
+    { 0x8086, IWN_DID_100_1, "Intel Centrino Wireless-N 100"        },
+    { 0x8086, IWN_DID_100_2, "Intel Centrino Wireless-N 100"        },
+    { 0x8086, IWN_DID_4965_1, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, IWN_DID_6x00_1, "Intel Centrino Ultimate-N 6300"      },
+    { 0x8086, IWN_DID_6x00_2, "Intel Centrino Advanced-N 6200"      },
+    { 0x8086, IWN_DID_4965_2, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, IWN_DID_4965_3, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, IWN_DID_5x00_1, "Intel WiFi Link 5100"            },
+    { 0x8086, IWN_DID_4965_4, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, IWN_DID_5x00_3, "Intel Ultimate N WiFi Link 5300"     },
+    { 0x8086, IWN_DID_5x00_4, "Intel Ultimate N WiFi Link 5300"     },
+    { 0x8086, IWN_DID_5x00_2, "Intel WiFi Link 5100"            },
+    { 0x8086, IWN_DID_6x00_3, "Intel Centrino Ultimate-N 6300"      },
+    { 0x8086, IWN_DID_6x00_4, "Intel Centrino Advanced-N 6200"      },
+    { 0x8086, IWN_DID_5x50_1, "Intel WiMAX/WiFi Link 5350"          },
+    { 0x8086, IWN_DID_5x50_2, "Intel WiMAX/WiFi Link 5350"          },
+    { 0x8086, IWN_DID_5x50_3, "Intel WiMAX/WiFi Link 5150"          },
+    { 0x8086, IWN_DID_5x50_4, "Intel WiMAX/WiFi Link 5150"          },
     { 0, 0, NULL }
 };
 
@@ -159 +164 @@
 static int  iwn_read_eeprom(struct iwn_softc *,
             uint8_t macaddr[IEEE80211_ADDR_LEN]);
 static void iwn4965_read_eeprom(struct iwn_softc *);
+#ifdef  IWN_DEBUG
 static void iwn4965_print_power_group(struct iwn_softc *, int);
+#endif
 static void iwn5000_read_eeprom(struct iwn_softc *);
 static uint32_t iwn_eeprom_channel_flags(struct iwn_eeprom_chan *);
 static void iwn_read_eeprom_band(struct iwn_softc *, int);
@@ -319 +326 @@
 static void iwn_scan_curchan(struct ieee80211_scan_state *, unsigned long);
 static void iwn_scan_mindwell(struct ieee80211_scan_state *);
 static void iwn_hw_reset(void *, int);
+#ifdef  IWN_DEBUG
+static char *iwn_get_csr_string(int);
+static void iwn_debug_register(struct iwn_softc *);
+#endif
 
-#define IWN_DEBUG
-#ifdef IWN_DEBUG
+#ifdef  IWN_DEBUG
 enum {
     IWN_DEBUG_XMIT      = 0x00000001,   /* basic xmit operation */
     IWN_DEBUG_RECV      = 0x00000002,   /* basic recv operation */
@@ -336 +346 @@
     IWN_DEBUG_NODE      = 0x00000400,   /* node management */
     IWN_DEBUG_LED       = 0x00000800,   /* led management */
     IWN_DEBUG_CMD       = 0x00001000,   /* cmd submission */
+    IWN_DEBUG_TXRATE    = 0x00002000,   /* TX rate debugging */
+    IWN_DEBUG_PWRSAVE   = 0x00004000,   /* Power save operations */
+    IWN_DEBUG_REGISTER  = 0x20000000,   /* print chipset register */
+    IWN_DEBUG_TRACE     = 0x40000000,   /* Print begin and start driver function */
     IWN_DEBUG_FATAL     = 0x80000000,   /* fatal errors */
     IWN_DEBUG_ANY       = 0xffffffff
 };
@@ -399 +413 @@
     DEVMETHOD(device_shutdown,  iwn_shutdown),
     DEVMETHOD(device_suspend,   iwn_suspend),
     DEVMETHOD(device_resume,    iwn_resume),
-
-    DEVMETHOD_END
+    { 0, 0 }
 };
 
 static driver_t iwn_driver = {
@@ -410 +423 @@
 };
 static devclass_t iwn_devclass;
 
-DRIVER_MODULE(iwn, pci, iwn_driver, iwn_devclass, NULL, NULL);
+DRIVER_MODULE(iwn, pci, iwn_driver, iwn_devclass, 0, 0);
 
 MODULE_VERSION(iwn, 1);
 
@@ -427 +440 @@
         if (pci_get_vendor(dev) == ident->vendor &&
             pci_get_device(dev) == ident->device) {
             device_set_desc(dev, ident->name);
-            return (BUS_PROBE_DEFAULT);
+            return 0;
         }
     }
     return ENXIO;
@@ -439 +452 @@
     struct iwn_softc *sc = (struct iwn_softc *)device_get_softc(dev);
     struct ieee80211com *ic;
     struct ifnet *ifp;
-    int i, error, rid;
+    uint32_t reg;
+    int i, error, result;
     uint8_t macaddr[IEEE80211_ADDR_LEN];
 
     sc->sc_dev = dev;
 
+#ifdef  IWN_DEBUG
+    error = resource_int_value(device_get_name(sc->sc_dev),
+        device_get_unit(sc->sc_dev), "debug", &(sc->sc_debug));
+    if (error != 0)
+        sc->sc_debug = 0;
+#else
+    sc->sc_debug = 0;
+#endif
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: begin\n",__func__);
+
     /*
      * Get the offset of the PCI Express Capability Structure in PCI
      * Configuration Space.
@@ -457 +482 @@
     /* Clear device-specific "PCI retry timeout" register (41h). */
     pci_write_config(dev, 0x41, 0, 1);
 
+    /* Hardware bug workaround. */
+    reg = pci_read_config(dev, PCIR_COMMAND, 2);
+    if (reg & PCIM_CMD_INTxDIS) {
+        DPRINTF(sc, IWN_DEBUG_RESET, "%s: PCIe INTx Disable set\n",
+            __func__);
+        reg &= ~PCIM_CMD_INTxDIS;
+        pci_write_config(dev, PCIR_COMMAND, reg, 2);
+    }
+
     /* Enable bus-mastering. */
     pci_enable_busmaster(dev);
 
-    rid = PCIR_BAR(0);
-    sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
+    sc->mem_rid = PCIR_BAR(0);
+    sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
         RF_ACTIVE);
     if (sc->mem == NULL) {
         device_printf(dev, "can't map mem space\n");
@@ -471 +505 @@
     sc->sc_st = rman_get_bustag(sc->mem);
     sc->sc_sh = rman_get_bushandle(sc->mem);
 
-    i = 1;
-    rid = 0;
-    if (pci_alloc_msi(dev, &i) == 0)
-        rid = 1;
+    sc->irq_rid = 0;
+    if ((result = pci_msi_count(dev)) == 1 &&
+        pci_alloc_msi(dev, &result) == 0)
+        sc->irq_rid = 1;
     /* Install interrupt handler. */
-    sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
-        (rid != 0 ? 0 : RF_SHAREABLE));
+    sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
+        RF_ACTIVE | RF_SHAREABLE);
     if (sc->irq == NULL) {
         device_printf(dev, "can't map interrupt\n");
         error = ENOMEM;
@@ -487 +521 @@
     IWN_LOCK_INIT(sc);
 
     /* Read hardware revision and attach. */
-    sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> 4) & 0xf;
+    sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> IWN_HW_REV_TYPE_SHIFT)
+        & IWN_HW_REV_TYPE_MASK;
+    sc->subdevice_id = pci_get_subdevice(dev);
     if (sc->hw_type == IWN_HW_REV_TYPE_4965)
         error = iwn4965_attach(sc, pci_get_device(dev));
     else
@@ -577 +613 @@
         | IEEE80211_C_IBSS      /* ibss/adhoc mode */
 #endif
         | IEEE80211_C_WME       /* WME */
+        | IEEE80211_C_PMGT      /* Station-side power mgmt */
         ;
 
     /* Read MAC address, channels, etc from EEPROM. */
@@ -604 +641 @@
     if (sc->sc_flags & IWN_FLAG_HAS_11N) {
         ic->ic_rxstream = sc->nrxchains;
         ic->ic_txstream = sc->ntxchains;
+
+        /*
+         * The NICs we currently support cap out at 2x2 support
+         * separate from the chains being used.
+         *
+         * This is a total hack to work around that until some
+         * per-device method is implemented to return the
+         * actual stream support.
+         */
+        if (ic->ic_rxstream > 2)
+            ic->ic_rxstream = 2;
+        if (ic->ic_txstream > 2)
+            ic->ic_txstream = 2;
+
         ic->ic_htcaps =
               IEEE80211_HTCAP_SMPS_OFF  /* SMPS mode disabled */
             | IEEE80211_HTCAP_SHORTGI20 /* short GI in 20MHz */
@@ -684 +735 @@
 
     if (bootverbose)
         ieee80211_announce(ic);
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
     return 0;
 fail:
     iwn_detach(dev);
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
     return error;
 }
 
@@ -695 +748 @@
 {
     struct iwn_ops *ops = &sc->ops;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
     ops->load_firmware = iwn4965_load_firmware;
     ops->read_eeprom = iwn4965_read_eeprom;
     ops->post_alive = iwn4965_post_alive;
@@ -725 +779 @@
     sc->txchainmask = IWN_ANT_AB;
     sc->rxchainmask = IWN_ANT_ABC;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "%s: end\n",__func__);
+
     return 0;
 }
 
@@ -733 +789 @@
 {
     struct iwn_ops *ops = &sc->ops;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     ops->load_firmware = iwn5000_load_firmware;
     ops->read_eeprom = iwn5000_read_eeprom;
     ops->post_alive = iwn5000_post_alive;
@@ -809 +867 @@
     default:
         device_printf(sc->sc_dev, "adapter type %d not supported\n",
             sc->hw_type);
+        DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
         return ENOTSUP;
     }
     return 0;
@@ -822 +881 @@
 {
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
-
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
     ieee80211_radiotap_attach(ic,
         &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
         IWN_TX_RADIOTAP_PRESENT,
         &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
         IWN_RX_RADIOTAP_PRESENT);
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
 }
 
 static void
 iwn_sysctlattach(struct iwn_softc *sc)
 {
+#ifdef  IWN_DEBUG
     struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
     struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
 
-#ifdef IWN_DEBUG
-    sc->sc_debug = 0;
     SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
-        "debug", CTLFLAG_RW, &sc->sc_debug, 0, "control debugging printfs");
+        "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
+        "control debugging printfs");
 #endif
 }
 
@@ -851 +911 @@
 {
     struct iwn_vap *ivp;
     struct ieee80211vap *vap;
+    uint8_t mac1[IEEE80211_ADDR_LEN];
+    struct iwn_softc *sc = ic->ic_ifp->if_softc;
 
     if (!TAILQ_EMPTY(&ic->ic_vaps))     /* only one at a time */
         return NULL;
+
+    IEEE80211_ADDR_COPY(mac1, mac);
+
     ivp = (struct iwn_vap *) malloc(sizeof(struct iwn_vap),
         M_80211_VAP, M_NOWAIT | M_ZERO);
     if (ivp == NULL)
         return NULL;
     vap = &ivp->iv_vap;
-    ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
+    ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac1);
+    ivp->ctx = IWN_RXON_BSS_CTX;
+    IEEE80211_ADDR_COPY(ivp->macaddr, mac1);
     vap->iv_bmissthreshold = 10;        /* override default */
     /* Override with driver methods. */
     ivp->iv_newstate = vap->iv_newstate;
     vap->iv_newstate = iwn_newstate;
+    sc->ivap[IWN_RXON_BSS_CTX] = vap;
 
     ieee80211_ratectl_init(vap);
     /* Complete setup. */
@@ -890 +958 @@
     struct ieee80211com *ic;
     int qid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     if (ifp != NULL) {
         ic = ifp->if_l2com;
 
@@ -906 +976 @@
     /* Uninstall interrupt handler. */
     if (sc->irq != NULL) {
         bus_teardown_intr(dev, sc->irq, sc->sc_ih);
-        bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
-            sc->irq);
-        pci_release_msi(dev);
+        bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
+        if (sc->irq_rid == 1)
+            pci_release_msi(dev);
     }
 
     /* Free DMA resources. */
@@ -922 +992 @@
     iwn_free_fwmem(sc);
 
     if (sc->mem != NULL)
-        bus_release_resource(dev, SYS_RES_MEMORY,
-            rman_get_rid(sc->mem), sc->mem);
+        bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
 
     if (ifp != NULL)
         if_free(ifp);
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n", __func__);
     IWN_LOCK_DESTROY(sc);
     return 0;
 }
@@ -1088 +1158 @@
             DELAY(10);
         }
     }
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end timeout\n", __func__);
     return ETIMEDOUT;
 }
 
@@ -1107 +1178 @@
     uint16_t prev, base, next;
     int count, error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Wait for clock stabilization before accessing prph. */
     if ((error = iwn_clock_wait(sc)) != 0)
         return error;
@@ -1150 +1223 @@
         /* Skip "next" word. */
         sc->prom_base = prev + 1;
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
     return 0;
 }
 
@@ -1160 +1236 @@
     uint32_t val, tmp;
     int ntries;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     addr += sc->prom_base;
     for (; count > 0; count -= 2, addr++) {
         IWN_WRITE(sc, IWN_EEPROM, addr << 2);
@@ -1192 +1270 @@
         if (count > 1)
             *out++ = val >> 24;
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
     return 0;
 }
 
@@ -1248 +1329 @@
             bus_dmamap_sync(dma->tag, dma->map,
                 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
             bus_dmamap_unload(dma->tag, dma->map);
-            bus_dmamem_free(dma->tag, &dma->vaddr, dma->map);
+            bus_dmamem_free(dma->tag, dma->vaddr, dma->map);
             dma->vaddr = NULL;
         }
         bus_dmamap_destroy(dma->tag, dma->map);
@@ -1322 +1403 @@
 
     ring->cur = 0;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Allocate RX descriptors (256-byte aligned). */
     size = IWN_RX_RING_COUNT * sizeof (uint32_t);
     error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
@@ -1396 +1479 @@
     bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
         BUS_DMASYNC_PREWRITE);
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return 0;
 
 fail:   iwn_free_rx_ring(sc, ring);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
+
     return error;
 }
 
@@ -1407 +1495 @@
 {
     int ntries;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     if (iwn_nic_lock(sc) == 0) {
         IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
         for (ntries = 0; ntries < 1000; ntries++) {
@@ -1426 +1516 @@
 {
     int i;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
+
     iwn_dma_contig_free(&ring->desc_dma);
     iwn_dma_contig_free(&ring->stat_dma);
 
@@ -1459 +1551 @@
     ring->queued = 0;
     ring->cur = 0;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Allocate TX descriptors (256-byte aligned). */
     size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_desc);
     error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
@@ -1507 +1601 @@
             goto fail;
         }
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
     return 0;
 
 fail:   iwn_free_tx_ring(sc, ring);
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
     return error;
 }
 
@@ -1518 +1616 @@
 {
     int i;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->doing %s \n", __func__);
+
     for (i = 0; i < IWN_TX_RING_COUNT; i++) {
         struct iwn_tx_data *data = &ring->data[i];
 
@@ -1543 +1643 @@
 {
     int i;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
+
     iwn_dma_contig_free(&ring->desc_dma);
     iwn_dma_contig_free(&ring->cmd_dma);
 
@@ -1596 +1698 @@
     uint16_t val;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Check whether adapter has an EEPROM or an OTPROM. */
     if (sc->hw_type >= IWN_HW_REV_TYPE_1000 &&
         (IWN_READ(sc, IWN_OTP_GP) & IWN_OTP_GP_DEV_SEL_OTP))
@@ -1653 +1757 @@
     iwn_apm_stop(sc);   /* Power OFF adapter. */
 
     iwn_eeprom_unlock(sc);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
     return 0;
 }
 
@@ -1663 +1770 @@
     uint16_t val;
     int i;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Read regulatory domain (4 ASCII characters). */
     iwn_read_prom_data(sc, IWN4965_EEPROM_DOMAIN, sc->eeprom_domain, 4);
 
@@ -1701 +1810 @@
             iwn4965_print_power_group(sc, i);
     }
 #endif
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
 }
 
 #ifdef IWN_DEBUG
@@ -1747 +1858 @@
     uint16_t val;
     int i;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Read regulatory domain (4 ASCII characters). */
     iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
     base = le16toh(val);
@@ -1790 +1903 @@
         DPRINTF(sc, IWN_DEBUG_CALIBRATE, "crystal calibration 0x%08x\n",
             le32toh(sc->eeprom_crystal));
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
 }
 
 /*
@@ -1825 +1941 @@
     uint8_t chan;
     int i, nflags;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     for (i = 0; i < band->nchan; i++) {
         if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
             DPRINTF(sc, IWN_DEBUG_RESET,
@@ -1867 +1985 @@
             c->ic_flags |= IEEE80211_CHAN_HT20;
         }
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
 }
 
 static void
@@ -1880 +2001 @@
     uint8_t chan;
     int i, nflags;
 
-    if (!(sc->sc_flags & IWN_FLAG_HAS_11N))
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s start\n", __func__);
+
+    if (!(sc->sc_flags & IWN_FLAG_HAS_11N)) {
+        DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end no 11n\n", __func__);
         return;
+    }
 
     for (i = 0; i < band->nchan; i++) {
         if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
@@ -1929 +2054 @@
         c->ic_flags &= ~IEEE80211_CHAN_HT;
         c->ic_flags |= IEEE80211_CHAN_HT40D | nflags;
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
 }
 
 static void
@@ -2012 +2140 @@
     uint8_t flags;
     int i, j;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
     base = le16toh(val);
     iwn_read_prom_data(sc, base + IWN6000_EEPROM_ENHINFO,
@@ -2062 +2192 @@
             c->ic_maxpower = maxpwr;
         }
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
+
 }
 
 static struct ieee80211_node *
@@ -2090 +2223 @@
     return 0;
 }
 
-static void
-iwn_newassoc(struct ieee80211_node *ni, int isnew)
+/*
+ * Calculate the required PLCP value from the given rate,
+ * to the given node.
+ *
+ * This will take the node configuration (eg 11n, rate table
+ * setup, etc) into consideration.
+ */
+static uint32_t
+iwn_rate_to_plcp(struct iwn_softc *sc, struct ieee80211_node *ni,
+    uint8_t rate)
 {
 #define RV(v)   ((v) & IEEE80211_RATE_VAL)
     struct ieee80211com *ic = ni->ni_ic;
-    struct iwn_softc *sc = ic->ic_ifp->if_softc;
-    struct iwn_node *wn = (void *)ni;
     uint8_t txant1, txant2;
-    int i, plcp, rate, ridx;
+    uint32_t plcp = 0;
+    int ridx;
 
     /* Use the first valid TX antenna. */
     txant1 = IWN_LSB(sc->txchainmask);
     txant2 = IWN_LSB(sc->txchainmask & ~txant1);
 
+    /*
+     * If it's an MCS rate, let's set the plcp correctly
+     * and set the relevant flags based on the node config.
+     */
     if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
-        ridx = ni->ni_rates.rs_nrates - 1;
-        for (i = ni->ni_htrates.rs_nrates - 1; i >= 0; i--) {
-            plcp = RV(ni->ni_htrates.rs_rates[i]) | IWN_RFLAG_MCS;
-            if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
-                plcp |= IWN_RFLAG_HT40;
-                if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI40)
-                    plcp |= IWN_RFLAG_SGI;
-            } else if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI20)
+        /*
+         * Set the initial PLCP value to be between 0->31 for
+         * MCS 0 -> MCS 31, then set the "I'm an MCS rate!"
+         * flag.
+         */
+        plcp = RV(rate) | IWN_RFLAG_MCS;
+
+        /*
+         * XXX the following should only occur if both
+         * the local configuration _and_ the remote node
+         * advertise these capabilities.  Thus this code
+         * may need fixing!
+         */
+
+        /*
+         * Set the channel width and guard interval.
+         */
+        if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
+            plcp |= IWN_RFLAG_HT40;
+            if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI40)
                 plcp |= IWN_RFLAG_SGI;
-            if (RV(ni->ni_htrates.rs_rates[i]) > 7)
-                plcp |= IWN_RFLAG_ANT(txant1 | txant2);
-            else
-                plcp |= IWN_RFLAG_ANT(txant1);
-            if (ridx >= 0) {
-                rate = RV(ni->ni_rates.rs_rates[ridx]);
-                wn->ridx[rate] = plcp;
-            }
-            wn->ridx[IEEE80211_RATE_MCS | i] = plcp;
-            ridx--;
+        } else if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI20) {
+            plcp |= IWN_RFLAG_SGI;
         }
-    } else {
-        for (i = 0; i < ni->ni_rates.rs_nrates; i++) {
-            rate = RV(ni->ni_rates.rs_rates[i]);
-            plcp = rate2plcp(rate);
-            ridx = ic->ic_rt->rateCodeToIndex[rate];
-            if (ridx < IWN_RIDX_OFDM6 &&
-                IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
-                plcp |= IWN_RFLAG_CCK;
+
+        /*
+         * If it's a two stream rate, enable TX on both
+         * antennas.
+         *
+         * XXX three stream rates?
+         */
+        if (rate > 0x87)
+            plcp |= IWN_RFLAG_ANT(txant1 | txant2);
+        else
             plcp |= IWN_RFLAG_ANT(txant1);
-            wn->ridx[rate] = htole32(plcp);
-        }
+    } else {
+        /*
+         * Set the initial PLCP - fine for both
+         * OFDM and CCK rates.
+         */
+        plcp = rate2plcp(rate);
+
+        /* Set CCK flag if it's CCK */
+
+        /* XXX It would be nice to have a method
+         * to map the ridx -> phy table entry
+         * so we could just query that, rather than
+         * this hack to check against IWN_RIDX_OFDM6.
+         */
+        ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
+            rate & IEEE80211_RATE_VAL);
+        if (ridx < IWN_RIDX_OFDM6 &&
+            IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
+            plcp |= IWN_RFLAG_CCK;
+
+        /* Set antenna configuration */
+        plcp |= IWN_RFLAG_ANT(txant1);
     }
+
+    DPRINTF(sc, IWN_DEBUG_TXRATE, "%s: rate=0x%02x, plcp=0x%08x\n",
+        __func__,
+        rate,
+        plcp);
+
+    return (htole32(plcp));
 #undef  RV
 }
 
+static void
+iwn_newassoc(struct ieee80211_node *ni, int isnew)
+{
+    /* Doesn't do anything at the moment */
+}
+
 static int
 iwn_media_change(struct ifnet *ifp)
 {
@@ -2158 +2341 @@
     struct iwn_softc *sc = ic->ic_ifp->if_softc;
     int error = 0;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     DPRINTF(sc, IWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
         ieee80211_state_name[vap->iv_state], ieee80211_state_name[nstate]);
 
@@ -2165 +2350 @@
     IWN_LOCK(sc);
     callout_stop(&sc->calib_to);
 
+    sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
+
     switch (nstate) {
     case IEEE80211_S_ASSOC:
         if (vap->iv_state != IEEE80211_S_RUN)
@@ -2178 +2365 @@
          * !AUTH -> AUTH transition requires state reset to handle
          * reassociations correctly.
          */
-        sc->rxon.associd = 0;
-        sc->rxon.filter &= ~htole32(IWN_FILTER_BSS);
+        sc->rxon->associd = 0;
+        sc->rxon->filter &= ~htole32(IWN_FILTER_BSS);
         sc->calib.state = IWN_CALIB_STATE_INIT;
 
         if ((error = iwn_auth(sc, vap)) != 0) {
@@ -2217 +2404 @@
     }
     IWN_UNLOCK(sc);
     IEEE80211_LOCK(ic);
-    if (error != 0)
+    if (error != 0){
+        DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
         return error;
+    }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return ivp->iv_newstate(vap, nstate, arg);
 }
 
@@ -2282 +2474 @@
     uint32_t flags;
     int error, len, rssi, nf;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     if (desc->type == IWN_MPDU_RX_DONE) {
         /* Check for prior RX_PHY notification. */
         if (!sc->last_rx_valid) {
@@ -2420 +2614 @@
         (void)ieee80211_input_all(ic, m, rssi - nf, nf);
 
     IWN_LOCK(sc);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
 }
 
 /* Process an incoming Compressed BlockAck. */
@@ -2441 +2638 @@
     uint8_t tid;
     int ackfailcnt = 0, i, lastidx, qid, *res, shift;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
 
     qid = le16toh(ba->qid);
     txq = &sc->txq[ba->qid];
     tap = sc->qid2tap[ba->qid];
-    tid = WME_AC_TO_TID(tap->txa_ac);
+    tid = tap->txa_ac; // FreeBSD 10.0.0: tap->txa_tid;
     wn = (void *)tap->txa_ni;
 
     res = NULL;
@@ -2469 +2668 @@
         KASSERT(ni != NULL, ("no node"));
         KASSERT(m != NULL, ("no mbuf"));
 
-        if (m->m_flags & M_TXCB)
-            ieee80211_process_callback(ni, m, 1);
-
-        m_freem(m);
-        ieee80211_free_node(ni);
+        ieee80211_tx_complete(ni, m, 1);
 
         txq->queued--;
         txq->read = (txq->read + 1) % IWN_TX_RING_COUNT;
@@ -2512 +2707 @@
         }
         bitmap >>= 1;
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
 }
 
 /*
@@ -2525 +2723 @@
     struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
     int len, idx = -1;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Runtime firmware should not send such a notification. */
-    if (sc->sc_flags & IWN_FLAG_CALIB_DONE)
+    if (sc->sc_flags & IWN_FLAG_CALIB_DONE){
+        DPRINTF(sc, IWN_DEBUG_TRACE, "->%s received after clib done\n",
+        __func__);
         return;
-
+    }
     len = (le32toh(desc->len) & 0x3fff) - 4;
     bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
 
@@ -2590 +2792 @@
     struct iwn_stats *stats = (struct iwn_stats *)(desc + 1);
     int temp;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Ignore statistics received during a scan. */
     if (vap->iv_state != IEEE80211_S_RUN ||
-        (ic->ic_flags & IEEE80211_F_SCAN))
+        (ic->ic_flags & IEEE80211_F_SCAN)){
+        DPRINTF(sc, IWN_DEBUG_TRACE, "->%s received during calib\n",
+        __func__);
         return;
+    }
 
     bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
 
@@ -2631 +2838 @@
         iwn_collect_noise(sc, &stats->rx.general);
     else if (calib->state == IWN_CALIB_STATE_RUN)
         iwn_tune_sensitivity(sc, &stats->rx);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
 }
 
 /*
@@ -2712 +2921 @@
 
     KASSERT(data->ni != NULL, ("no node"));
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Unmap and free mbuf. */
     bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
     bus_dmamap_unload(ring->data_dmat, data->map);
@@ -2719 +2930 @@
     ni = data->ni, data->ni = NULL;
     vap = ni->ni_vap;
 
-    if (m->m_flags & M_TXCB) {
-        /*
-         * Channels marked for "radar" require traffic to be received
-         * to unlock before we can transmit.  Until traffic is seen
-         * any attempt to transmit is returned immediately with status
-         * set to IWN_TX_FAIL_TX_LOCKED.  Unfortunately this can easily
-         * happen on first authenticate after scanning.  To workaround
-         * this we ignore a failure of this sort in AUTH state so the
-         * 802.11 layer will fall back to using a timeout to wait for
-         * the AUTH reply.  This allows the firmware time to see
-         * traffic so a subsequent retry of AUTH succeeds.  It's
-         * unclear why the firmware does not maintain state for
-         * channels recently visited as this would allow immediate
-         * use of the channel after a scan (where we see traffic).
-         */
-        if (status == IWN_TX_FAIL_TX_LOCKED &&
-            ni->ni_vap->iv_state == IEEE80211_S_AUTH)
-            ieee80211_process_callback(ni, m, 0);
-        else
-            ieee80211_process_callback(ni, m,
-                (status & IWN_TX_FAIL) != 0);
-    }
-
     /*
      * Update rate control statistics for the node.
      */
@@ -2754 +2942 @@
         ieee80211_ratectl_tx_complete(vap, ni,
             IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
     }
-    m_freem(m);
-    ieee80211_free_node(ni);
+
+    /*
+     * Channels marked for "radar" require traffic to be received
+     * to unlock before we can transmit.  Until traffic is seen
+     * any attempt to transmit is returned immediately with status
+     * set to IWN_TX_FAIL_TX_LOCKED.  Unfortunately this can easily
+     * happen on first authenticate after scanning.  To workaround
+     * this we ignore a failure of this sort in AUTH state so the
+     * 802.11 layer will fall back to using a timeout to wait for
+     * the AUTH reply.  This allows the firmware time to see
+     * traffic so a subsequent retry of AUTH succeeds.  It's
+     * unclear why the firmware does not maintain state for
+     * channels recently visited as this would allow immediate
+     * use of the channel after a scan (where we see traffic).
+     */
+    if (status == IWN_TX_FAIL_TX_LOCKED &&
+        ni->ni_vap->iv_state == IEEE80211_S_AUTH)
+        ieee80211_tx_complete(ni, m, 0);
+    else
+        ieee80211_tx_complete(ni, m,
+            (status & IWN_TX_FAIL) != 0);
 
     sc->sc_tx_timer = 0;
     if (--ring->queued < IWN_TX_RING_LOMARK) {
@@ -2766 +2973 @@
             iwn_start_locked(ifp);
         }
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
 }
 
 /*
@@ -2813 +3023 @@
     uint8_t tid;
     int bit, i, lastidx, *res, seqno, shift, start;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
 #ifdef NOT_YET
     if (nframes == 1) {
         if ((*status & 0xff) != 1 && (*status & 0xff) != 2)
@@ -2844 +3056 @@
         bitmap |= 1ULL << bit;
     }
     tap = sc->qid2tap[qid];
-    tid = WME_AC_TO_TID(tap->txa_ac);
+    tid = tap->txa_ac; // FreeBSD 10.0.0: tap->txa_tid;
     wn = (void *)tap->txa_ni;
     wn->agg[tid].bitmap = bitmap;
     wn->agg[tid].startidx = start;
@@ -2871 +3083 @@
         KASSERT(ni != NULL, ("no node"));
         KASSERT(m != NULL, ("no mbuf"));
 
-        if (m->m_flags & M_TXCB)
-            ieee80211_process_callback(ni, m, 1);
-
-        m_freem(m);
-        ieee80211_free_node(ni);
+        ieee80211_tx_complete(ni, m, 1);
 
         ring->queued--;
         ring->read = (ring->read + 1) % IWN_TX_RING_COUNT;
@@ -2899 +3107 @@
             iwn_start_locked(ifp);
         }
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
 }
 
 /*
@@ -3017 +3228 @@
         }
         case IWN_STATE_CHANGED:
         {
-            uint32_t *status = (uint32_t *)(desc + 1);
-
             /*
              * State change allows hardware switch change to be
              * noted. However, we handle this in iwn_intr as we
@@ -3026 +3235 @@
              */
             bus_dmamap_sync(sc->rxq.data_dmat, data->map,
                 BUS_DMASYNC_POSTREAD);
+#ifdef  IWN_DEBUG
+            uint32_t *status = (uint32_t *)(desc + 1);
             DPRINTF(sc, IWN_DEBUG_INTR, "state changed to %x\n",
                 le32toh(*status));
+#endif
             break;
         }
         case IWN_START_SCAN:
         {
-            struct iwn_start_scan *scan =
-                (struct iwn_start_scan *)(desc + 1);
-
             bus_dmamap_sync(sc->rxq.data_dmat, data->map,
                 BUS_DMASYNC_POSTREAD);
+#ifdef  IWN_DEBUG
+            struct iwn_start_scan *scan =
+                (struct iwn_start_scan *)(desc + 1);
             DPRINTF(sc, IWN_DEBUG_ANY,
                 "%s: scanning channel %d status %x\n",
                 __func__, scan->chan, le32toh(scan->status));
+#endif
             break;
         }
         case IWN_STOP_SCAN:
         {
-            struct iwn_stop_scan *scan =
-                (struct iwn_stop_scan *)(desc + 1);
-
             bus_dmamap_sync(sc->rxq.data_dmat, data->map,
                 BUS_DMASYNC_POSTREAD);
+#ifdef  IWN_DEBUG
+            struct iwn_stop_scan *scan =
+                (struct iwn_stop_scan *)(desc + 1);
             DPRINTF(sc, IWN_DEBUG_STATE,
                 "scan finished nchan=%d status=%d chan=%d\n",
                 scan->nchan, scan->status, scan->chan);
+#endif
 
             IWN_UNLOCK(sc);
             ieee80211_scan_next(vap);
@@ -3184 +3398 @@
 
     IWN_LOCK(sc);
 
-#if !defined(__HAIKU__)
     /* Disable interrupts. */
     IWN_WRITE(sc, IWN_INT_MASK, 0);
 
@@ -3209 +3422 @@
             return; /* Hardware gone! */
         r2 = IWN_READ(sc, IWN_FH_INT);
     }
-#else
-    r1 = atomic_get((int32 *)&sc->sc_intr_status_1);
-    r2 = atomic_get((int32 *)&sc->sc_intr_status_2);
-#endif
 
-    DPRINTF(sc, IWN_DEBUG_INTR, "interrupt reg1=%x reg2=%x\n", r1, r2);
+    DPRINTF(sc, IWN_DEBUG_INTR, "interrupt reg1=0x%08x reg2=0x%08x\n"
+    , r1, r2);
 
     if (r1 == 0 && r2 == 0)
         goto done;  /* Interrupt not for us. */
@@ -3235 +3445 @@
     if (r1 & (IWN_INT_SW_ERR | IWN_INT_HW_ERR)) {
         device_printf(sc->sc_dev, "%s: fatal firmware error\n",
             __func__);
+#ifdef  IWN_DEBUG
+        iwn_debug_register(sc);
+#endif
         /* Dump firmware error log and stop. */
         iwn_fatal_intr(sc);
         ifp->if_flags &= ~IFF_UP;
@@ -3287 +3500 @@
 {
     uint16_t *w = &sc->sched[qid * IWN4965_SCHED_COUNT + idx];
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     *w = htole16(len + 8);
     bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
         BUS_DMASYNC_PREWRITE);
@@ -3303 +3518 @@
 {
     uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     *w = htole16(id << 12 | (len + 8));
     bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
         BUS_DMASYNC_PREWRITE);
@@ -3319 +3536 @@
 {
     uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     *w = (*w & htole16(0xf000)) | htole16(1);
     bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
         BUS_DMASYNC_PREWRITE);
@@ -3353 +3572 @@
     uint8_t tid, ridx, txant, type;
     int ac, i, totlen, error, pad, nsegs = 0, rate;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     IWN_LOCK_ASSERT(sc);
 
     wh = mtod(m, struct ieee80211_frame *);
@@ -3398 +3619 @@
         (void) ieee80211_ratectl_rate(ni, NULL, 0);
         rate = ni->ni_txrate;
     }
-    ridx = ic->ic_rt->rateCodeToIndex[rate];
+    ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
+        rate & IEEE80211_RATE_VAL);
 
     /* Encrypt the frame if need be. */
     if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
@@ -3504 +3726 @@
     tx->rts_ntries = 60;
     tx->data_ntries = 15;
     tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
-    tx->rate = wn->ridx[rate];
+    tx->rate = iwn_rate_to_plcp(sc, ni, rate);
     if (tx->id == sc->broadcast_id) {
         /* Group or management frame. */
         tx->linkq = 0;
@@ -3597 +3819 @@
     if (++ring->queued > IWN_TX_RING_HIMARK)
         sc->qfullmsk |= 1 << ring->qid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return 0;
 }
 
@@ -3621 +3845 @@
     int ac, totlen, error, pad, nsegs = 0, i, rate;
     uint8_t ridx, type, txant;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     IWN_LOCK_ASSERT(sc);
 
     wh = mtod(m, struct ieee80211_frame *);
@@ -3635 +3861 @@
 
     /* Choose a TX rate index. */
     rate = params->ibp_rate0;
-    ridx = ic->ic_rt->rateCodeToIndex[rate];
+    ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
+        rate & IEEE80211_RATE_VAL);
     if (ridx == (uint8_t)-1) {
         /* XXX fall back to mcast/mgmt rate? */
         m_freem(m);
@@ -3711 +3938 @@
     tx->rts_ntries = params->ibp_try1;
     tx->data_ntries = params->ibp_try0;
     tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
+
+    /* XXX should just use  iwn_rate_to_plcp() */
     tx->rate = htole32(rate2plcp(rate));
     if (ridx < IWN_RIDX_OFDM6 &&
         IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
         tx->rate |= htole32(IWN_RFLAG_CCK);
+
     /* Group or management frame. */
     tx->linkq = 0;
     txant = IWN_LSB(sc->txchainmask);
     tx->rate |= htole32(IWN_RFLAG_ANT(txant));
+
     /* Set physical address of "scratch area". */
     tx->loaddr = htole32(IWN_LOADDR(data->scratch_paddr));
     tx->hiaddr = IWN_HIADDR(data->scratch_paddr);
@@ -3801 +4032 @@
     if (++ring->queued > IWN_TX_RING_HIMARK)
         sc->qfullmsk |= 1 << ring->qid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return 0;
 }
 
@@ -3813 +4046 @@
     struct iwn_softc *sc = ifp->if_softc;
     int error = 0;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
         ieee80211_free_node(ni);
         m_freem(m);
@@ -3841 +4076 @@
     sc->sc_tx_timer = 5;
 
     IWN_UNLOCK(sc);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return error;
 }
 
@@ -3896 +4134 @@
 
     KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     if (sc->sc_tx_timer > 0) {
         if (--sc->sc_tx_timer == 0) {
             if_printf(ifp, "device timeout\n");
@@ -3963 +4203 @@
     bus_addr_t paddr;
     int totlen, error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     if (async == 0)
         IWN_LOCK_ASSERT(sc);
 
@@ -4018 +4260 @@
     ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
     IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return async ? 0 : msleep(desc, &sc->sc_mtx, PCATCH, "iwncmd", hz);
 }
 
@@ -4027 +4271 @@
     struct iwn4965_node_info hnode;
     caddr_t src, dst;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /*
      * We use the node structure for 5000 Series internally (it is
      * a superset of the one for 4965AGN). We thus copy the common
@@ -4043 +4289 @@
 static int
 iwn5000_add_node(struct iwn_softc *sc, struct iwn_node_info *node, int async)
 {
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Direct mapping. */
     return iwn_cmd(sc, IWN_CMD_ADD_NODE, node, sizeof (*node), async);
 }
@@ -4057 +4306 @@
     uint8_t txant;
     int i, rate, txrate;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Use the first valid TX antenna. */
     txant = IWN_LSB(sc->txchainmask);
 
@@ -4074 +4325 @@
     else
         txrate = rs->rs_nrates - 1;
     for (i = 0; i < IWN_MAX_TX_RETRIES; i++) {
+        uint32_t plcp;
+
         if (IEEE80211_IS_CHAN_HT(ni->ni_chan))
             rate = IEEE80211_RATE_MCS | txrate;
         else
             rate = RV(rs->rs_rates[txrate]);
-        linkq.retry[i] = wn->ridx[rate];
 
-        if ((le32toh(wn->ridx[rate]) & IWN_RFLAG_MCS) &&
-            RV(le32toh(wn->ridx[rate])) > 7)
+        /* Do rate -> PLCP config mapping */
+        plcp = iwn_rate_to_plcp(sc, ni, rate);
+        linkq.retry[i] = plcp;
+
+        /* Special case for dual-stream rates? */
+        if ((le32toh(plcp) & IWN_RFLAG_MCS) &&
+            RV(le32toh(plcp)) > 7)
             linkq.mimo = i + 1;
 
         /* Next retry at immediate lower bit-rate. */
         if (txrate > 0)
             txrate--;
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, 1);
 #undef  RV
 }
@@ -4106 +4366 @@
     uint8_t txant;
     int i, error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
+    sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
+
     memset(&node, 0, sizeof node);
     IEEE80211_ADDR_COPY(node.macaddr, ifp->if_broadcastaddr);
     node.id = sc->broadcast_id;
@@ -4134 +4398 @@
     for (i = 1; i < IWN_MAX_TX_RETRIES; i++) {
         linkq.retry[i] = linkq.retry[0];
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, async);
 }
 
@@ -4145 +4412 @@
     struct iwn_edca_params cmd;
     int aci;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     memset(&cmd, 0, sizeof cmd);
     cmd.flags = htole32(IWN_EDCA_UPDATE);
     for (aci = 0; aci < WME_NUM_AC; aci++) {
@@ -4161 +4430 @@
     (void)iwn_cmd(sc, IWN_CMD_EDCA_PARAMS, &cmd, sizeof cmd, 1);
     IWN_UNLOCK(sc);
     IEEE80211_LOCK(ic);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return 0;
 #undef IWN_EXP2
 }
@@ -4176 +4448 @@
 {
     struct iwn_cmd_led led;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Clear microcode LED ownership. */
     IWN_CLRBITS(sc, IWN_LED, IWN_LED_BSM_CTRL);
 
@@ -4196 +4470 @@
     struct iwn_critical_temp crit;
     int32_t temp;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_CTEMP_STOP_RF);
 
     if (sc->hw_type == IWN_HW_REV_TYPE_5150)
@@ -4216 +4492 @@
     struct iwn_cmd_timing cmd;
     uint64_t val, mod;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     memset(&cmd, 0, sizeof cmd);
     memcpy(&cmd.tstamp, ni->ni_tstamp.data, sizeof (uint64_t));
     cmd.bintval = htole16(ni->ni_intval);
@@ -4238 +4516 @@
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Adjust TX power if need be (delta >= 3 degC). */
     DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d->%d\n",
         __func__, sc->temp, temp);
@@ -4273 +4553 @@
     int i, c, grp, maxpwr;
     uint8_t chan;
 
+    sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
     /* Retrieve current channel from last RXON. */
-    chan = sc->rxon.chan;
+    chan = sc->rxon->chan;
     DPRINTF(sc, IWN_DEBUG_RESET, "setting TX power for channel %d\n",
         chan);
 
@@ -4409 +4690 @@
 {
     struct iwn5000_cmd_txpower cmd;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /*
      * TX power calibration is handled automatically by the firmware
      * for 5000 Series.
@@ -4431 +4714 @@
     uint8_t mask, agc;
     int rssi;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     mask = (le16toh(phy->antenna) >> 4) & IWN_ANT_ABC;
     agc  = (le16toh(phy->agc) >> 7) & 0x7f;
 
@@ -4456 +4741 @@
     uint8_t agc;
     int rssi;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     agc = (le32toh(phy->agc) >> 9) & 0x7f;
 
     rssi = MAX(le16toh(phy->rssi[0]) & 0xff,
@@ -4497 +4784 @@
     struct iwn_ucode_info *uc = &sc->ucode_info;
     int32_t r1, r2, r3, r4, temp;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     r1 = le32toh(uc->temp[0].chan20MHz);
     r2 = le32toh(uc->temp[1].chan20MHz);
     r3 = le32toh(uc->temp[2].chan20MHz);
@@ -4521 +4810 @@
 {
     int32_t temp;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /*
      * Temperature is not used by the driver for 5000 Series because
      * TX power calibration is handled by firmware.
@@ -4544 +4835 @@
     uint32_t flags;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Reset calibration state machine. */
     memset(calib, 0, sizeof (*calib));
     calib->state = IWN_CALIB_STATE_INIT;
@@ -4583 +4876 @@
 {
     struct iwn_ops *ops = &sc->ops;
     struct iwn_calib_state *calib = &sc->calib;
+    struct ifnet *ifp = sc->sc_ifp;
+    struct ieee80211com *ic = ifp->if_l2com;
     uint32_t val;
     int i;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Accumulate RSSI and noise for all 3 antennas. */
     for (i = 0; i < 3; i++) {
         calib->rssi[i] += le32toh(stats->rssi[i]) & 0xff;
@@ -4617 +4914 @@
 
 #ifdef notyet
     /* XXX Disable RX chains with no antennas connected. */
-    sc->rxon.rxchain = htole16(IWN_RXCHAIN_SEL(sc->chainmask));
-    (void)iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 1);
+    sc->rxon->rxchain = htole16(IWN_RXCHAIN_SEL(sc->chainmask));
+    (void)iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 1);
 #endif
 
-#if 0
-    /* XXX: not yet */
     /* Enable power-saving mode if requested by user. */
-    if (sc->sc_ic.ic_flags & IEEE80211_F_PMGTON)
+    if (ic->ic_flags & IEEE80211_F_PMGTON)
         (void)iwn_set_pslevel(sc, 0, 3, 1);
-#endif
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
 }
 
 static int
@@ -4634 +4931 @@
 {
     struct iwn_phy_calib_gain cmd;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     memset(&cmd, 0, sizeof cmd);
     cmd.code = IWN4965_PHY_CALIB_DIFF_GAIN;
     /* Differential gains initially set to 0 for all 3 antennas. */
@@ -4647 +4946 @@
 {
     struct iwn_phy_calib cmd;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     memset(&cmd, 0, sizeof cmd);
     cmd.code = sc->reset_noise_gain;
     cmd.ngroups = 1;
@@ -4663 +4964 @@
     struct iwn_phy_calib_gain cmd;
     int i, delta, noise;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Get minimal noise among connected antennas. */
     noise = INT_MAX;    /* NB: There's at least one antenna. */
     for (i = 0; i < 3; i++)
@@ -4696 +4999 @@
     struct iwn_phy_calib_gain cmd;
     int i, ant, div, delta;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* We collected 20 beacons and !=6050 need a 1.5 factor. */
     div = (sc->hw_type == IWN_HW_REV_TYPE_6050) ? 20 : 30;
 
@@ -4754 +5059 @@
     uint8_t noise[3], noise_ref;
     int i, needs_update = 0;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Check that we've been enabled long enough. */
-    if ((rxena = le32toh(stats->general.load)) == 0)
+    if ((rxena = le32toh(stats->general.load)) == 0){
+        DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end not so long\n", __func__);
         return;
+    }
 
     /* Compute number of false alarms since last call for OFDM. */
     fa  = le32toh(stats->ofdm.bad_plcp) - calib->bad_plcp_ofdm;
@@ -4874 +5183 @@
 
     if (needs_update)
         (void)iwn_send_sensitivity(sc);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
 #undef dec
 #undef inc
 }
@@ -4938 +5250 @@
     uint32_t reg;
     int i;
 
+    DPRINTF(sc, IWN_DEBUG_PWRSAVE,
+        "%s: dtim=%d, level=%d, async=%d\n",
+        __func__,
+        dtim,
+        level,
+        async);
+
     /* Select which PS parameters to use. */
     if (dtim <= 2)
         pmgt = &iwn_pmgt[0][level];
@@ -5041 +5360 @@
         return error;
 
     /* Force BT state machine change. */
-    memset(&btprot, 0, sizeof btprio);
+    memset(&btprot, 0, sizeof btprot);
     btprot.open = 1;
     btprot.type = 1;
     error = iwn_cmd(sc, IWN_CMD_BT_COEX_PROT, &btprot, sizeof(btprot), 1);
@@ -5074 +5393 @@
     uint16_t rxchain;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     if (sc->hw_type == IWN_HW_REV_TYPE_6005) {
         /* Set radio temperature sensor offset. */
         error = iwn5000_temp_offset_calib(sc);
@@ -5123 +5444 @@
     }
 
     /* Set mode, channel, RX filter and enable RX. */
-    memset(&sc->rxon, 0, sizeof (struct iwn_rxon));
-    IEEE80211_ADDR_COPY(sc->rxon.myaddr, IF_LLADDR(ifp));
-    IEEE80211_ADDR_COPY(sc->rxon.wlap, IF_LLADDR(ifp));
-    sc->rxon.chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
-    sc->rxon.flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
+    sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
+    memset(sc->rxon, 0, sizeof (struct iwn_rxon));
+    IEEE80211_ADDR_COPY(sc->rxon->myaddr, IF_LLADDR(ifp));
+    IEEE80211_ADDR_COPY(sc->rxon->wlap, IF_LLADDR(ifp));
+    sc->rxon->chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
+    sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
     if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
-        sc->rxon.flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
+        sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
     switch (ic->ic_opmode) {
     case IEEE80211_M_STA:
-        sc->rxon.mode = IWN_MODE_STA;
-        sc->rxon.filter = htole32(IWN_FILTER_MULTICAST);
+        sc->rxon->mode = IWN_MODE_STA;
+        sc->rxon->filter = htole32(IWN_FILTER_MULTICAST);
         break;
     case IEEE80211_M_MONITOR:
-        sc->rxon.mode = IWN_MODE_MONITOR;
-        sc->rxon.filter = htole32(IWN_FILTER_MULTICAST |
+        sc->rxon->mode = IWN_MODE_MONITOR;
+        sc->rxon->filter = htole32(IWN_FILTER_MULTICAST |
             IWN_FILTER_CTL | IWN_FILTER_PROMISC);
         break;
     default:
         /* Should not get there. */
         break;
     }
-    sc->rxon.cck_mask  = 0x0f;  /* not yet negotiated */
-    sc->rxon.ofdm_mask = 0xff;  /* not yet negotiated */
-    sc->rxon.ht_single_mask = 0xff;
-    sc->rxon.ht_dual_mask = 0xff;
-    sc->rxon.ht_triple_mask = 0xff;
+    sc->rxon->cck_mask  = 0x0f; /* not yet negotiated */
+    sc->rxon->ofdm_mask = 0xff; /* not yet negotiated */
+    sc->rxon->ht_single_mask = 0xff;
+    sc->rxon->ht_dual_mask = 0xff;
+    sc->rxon->ht_triple_mask = 0xff;
     rxchain =
         IWN_RXCHAIN_VALID(sc->rxchainmask) |
         IWN_RXCHAIN_MIMO_COUNT(2) |
         IWN_RXCHAIN_IDLE_COUNT(2);
-    sc->rxon.rxchain = htole16(rxchain);
+    sc->rxon->rxchain = htole16(rxchain);
     DPRINTF(sc, IWN_DEBUG_RESET, "%s: setting configuration\n", __func__);
-    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 0);
+    error = iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 0);
     if (error != 0) {
         device_printf(sc->sc_dev, "%s: RXON command failed\n",
             __func__);
@@ -5187 +5509 @@
             "%s: could not set power saving level\n", __func__);
         return error;
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return 0;
 }
 
@@ -5221 +5546 @@
     uint8_t txant;
     int buflen, error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
+    sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
     buf = malloc(IWN_SCAN_MAXSZ, M_DEVBUF, M_NOWAIT | M_ZERO);
     if (buf == NULL) {
         device_printf(sc->sc_dev,
@@ -5262 +5590 @@
     } else {
         hdr->flags = htole32(IWN_RXON_24GHZ | IWN_RXON_AUTO);
         if (sc->hw_type == IWN_HW_REV_TYPE_4965 &&
-            sc->rxon.associd && sc->rxon.chan > 14)
+            sc->rxon->associd && sc->rxon->chan > 14)
             tx->rate = htole32(0xd);
         else {
             /* Send probe requests at 1Mbps. */
@@ -5321 +5649 @@
     } else if (IEEE80211_IS_CHAN_5GHZ(c)) {
         chan->rf_gain = 0x3b;
         chan->active  = htole16(24);
-        if (sc->rxon.associd)
+        if (sc->rxon->associd)
             chan->passive = htole16(78);
         else
             chan->passive = htole16(110);
@@ -5334 +5662 @@
     } else {
         chan->rf_gain = 0x28;
         chan->active  = htole16(36);
-        if (sc->rxon.associd)
+        if (sc->rxon->associd)
             chan->passive = htole16(88);
         else
             chan->passive = htole16(120);
@@ -5356 +5684 @@
         hdr->nchan);
     error = iwn_cmd(sc, IWN_CMD_SCAN, buf, buflen, 1);
     free(buf, M_DEVBUF);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return error;
 }
 
@@ -5368 +5699 @@
     struct ieee80211_node *ni = vap->iv_bss;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
+    sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
     /* Update adapter configuration. */
-    IEEE80211_ADDR_COPY(sc->rxon.bssid, ni->ni_bssid);
-    sc->rxon.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
-    sc->rxon.flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
+    IEEE80211_ADDR_COPY(sc->rxon->bssid, ni->ni_bssid);
+    sc->rxon->chan = ieee80211_chan2ieee(ic, ni->ni_chan);
+    sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
     if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
-        sc->rxon.flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
+        sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
     if (ic->ic_flags & IEEE80211_F_SHSLOT)
-        sc->rxon.flags |= htole32(IWN_RXON_SHSLOT);
+        sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
     if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
-        sc->rxon.flags |= htole32(IWN_RXON_SHPREAMBLE);
+        sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
     if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
-        sc->rxon.cck_mask  = 0;
-        sc->rxon.ofdm_mask = 0x15;
+        sc->rxon->cck_mask  = 0;
+        sc->rxon->ofdm_mask = 0x15;
     } else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
-        sc->rxon.cck_mask  = 0x03;
-        sc->rxon.ofdm_mask = 0;
+        sc->rxon->cck_mask  = 0x03;
+        sc->rxon->ofdm_mask = 0;
     } else {
         /* Assume 802.11b/g. */
-        sc->rxon.cck_mask  = 0x0f;
-        sc->rxon.ofdm_mask = 0x15;
+        sc->rxon->cck_mask  = 0x0f;
+        sc->rxon->ofdm_mask = 0x15;
     }
     DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x cck %x ofdm %x\n",
-        sc->rxon.chan, sc->rxon.flags, sc->rxon.cck_mask,
-        sc->rxon.ofdm_mask);
-    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 1);
+        sc->rxon->chan, sc->rxon->flags, sc->rxon->cck_mask,
+        sc->rxon->ofdm_mask);
+    error = iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 1);
     if (error != 0) {
         device_printf(sc->sc_dev, "%s: RXON command failed, error %d\n",
             __func__, error);
@@ -5415 +5749 @@
             error);
         return error;
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return 0;
 }
 
@@ -5429 +5766 @@
     uint32_t htflags = 0;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
+    sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
     if (ic->ic_opmode == IEEE80211_M_MONITOR) {
         /* Link LED blinks while monitoring. */
         iwn_set_led(sc, IWN_LED_LINK, 5, 5);
@@ -5441 +5781 @@
     }
 
     /* Update adapter configuration. */
-    IEEE80211_ADDR_COPY(sc->rxon.bssid, ni->ni_bssid);
-    sc->rxon.associd = htole16(IEEE80211_AID(ni->ni_associd));
-    sc->rxon.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
-    sc->rxon.flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
+    IEEE80211_ADDR_COPY(sc->rxon->bssid, ni->ni_bssid);
+    sc->rxon->associd = htole16(IEEE80211_AID(ni->ni_associd));
+    sc->rxon->chan = ieee80211_chan2ieee(ic, ni->ni_chan);
+    sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
     if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
-        sc->rxon.flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
+        sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
     if (ic->ic_flags & IEEE80211_F_SHSLOT)
-        sc->rxon.flags |= htole32(IWN_RXON_SHSLOT);
+        sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
     if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
-        sc->rxon.flags |= htole32(IWN_RXON_SHPREAMBLE);
+        sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
     if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
-        sc->rxon.cck_mask  = 0;
-        sc->rxon.ofdm_mask = 0x15;
+        sc->rxon->cck_mask  = 0;
+        sc->rxon->ofdm_mask = 0x15;
     } else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
-        sc->rxon.cck_mask  = 0x03;
-        sc->rxon.ofdm_mask = 0;
+        sc->rxon->cck_mask  = 0x03;
+        sc->rxon->ofdm_mask = 0;
     } else {
         /* Assume 802.11b/g. */
-        sc->rxon.cck_mask  = 0x0f;
-        sc->rxon.ofdm_mask = 0x15;
+        sc->rxon->cck_mask  = 0x0f;
+        sc->rxon->ofdm_mask = 0x15;
     }
     if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
         htflags |= IWN_RXON_HT_PROTMODE(ic->ic_curhtprotmode);
@@ -5477 +5817 @@
         if (IEEE80211_IS_CHAN_HT40D(ni->ni_chan))
             htflags |= IWN_RXON_HT_HT40MINUS;
     }
-    sc->rxon.flags |= htole32(htflags);
-    sc->rxon.filter |= htole32(IWN_FILTER_BSS);
+    sc->rxon->flags |= htole32(htflags);
+    sc->rxon->filter |= htole32(IWN_FILTER_BSS);
     DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x\n",
-        sc->rxon.chan, sc->rxon.flags);
-    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 1);
+        sc->rxon->chan, sc->rxon->flags);
+    error = iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 1);
     if (error != 0) {
         device_printf(sc->sc_dev,
             "%s: could not update configuration, error %d\n", __func__,
@@ -5548 +5888 @@
 
     /* Link LED always on while associated. */
     iwn_set_led(sc, IWN_LED_LINK, 0, 1);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return 0;
 }
 
@@ -5568 +5911 @@
     uint8_t tid;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     tid = MS(le16toh(baparamset), IEEE80211_BAPS_TID);
     ssn = MS(le16toh(baseqctl), IEEE80211_BASEQ_START);
 
@@ -5600 +5945 @@
     struct iwn_node_info node;
     uint8_t tid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* XXX: tid as an argument */
     for (tid = 0; tid < WME_NUM_TID; tid++) {
         if (&ni->ni_rx_ampdu[tid] == rap)
@@ -5623 +5970 @@
     struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
     int qid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     for (qid = sc->firstaggqueue; qid < sc->ntxqs; qid++) {
         if (sc->qid2tap[qid] == NULL)
             break;
@@ -5650 +5999 @@
 {
     struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
     int qid = *(int *)tap->txa_private;
-    uint8_t tid = WME_AC_TO_TID(tap->txa_ac);
+    uint8_t tid = tap->txa_ac; // FreeBSD 10.0.0: tap->txa_tid;
     int ret;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     if (code == IEEE80211_STATUS_SUCCESS) {
         ni->ni_txseqs[tid] = tap->txa_start & 0xfff;
         ret = iwn_ampdu_tx_start(ni->ni_ic, ni, tid);
@@ -5674 +6025 @@
 iwn_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
     uint8_t tid)
 {
-    struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[TID_TO_WME_AC(tid)];
+    struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[tid];
     struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
     struct iwn_ops *ops = &sc->ops;
     struct iwn_node *wn = (void *)ni;
     struct iwn_node_info node;
     int error, qid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Enable TX for the specified RA/TID. */
     wn->disable_tid &= ~(1 << tid);
     memset(&node, 0, sizeof node);
@@ -5709 +6062 @@
 {
     struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
     struct iwn_ops *ops = &sc->ops;
-    uint8_t tid = WME_AC_TO_TID(tap->txa_ac);
+    uint8_t tid = tap->txa_ac; // FreeBSD 10.0.0: tap->txa_tid;
     int qid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     sc->sc_addba_stop(ni, tap);
 
     if (tap->txa_private == NULL)
@@ -5735 +6090 @@
 {
     struct iwn_node *wn = (void *)ni;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Stop TX scheduler while we're changing its configuration. */
     iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
         IWN4965_TXQ_STATUS_CHGACT);
@@ -5770 +6127 @@
 static void
 iwn4965_ampdu_tx_stop(struct iwn_softc *sc, int qid, uint8_t tid, uint16_t ssn)
 {
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Stop TX scheduler while we're changing its configuration. */
     iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
         IWN4965_TXQ_STATUS_CHGACT);
@@ -5792 +6151 @@
 {
     struct iwn_node *wn = (void *)ni;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Stop TX scheduler while we're changing its configuration. */
     iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
         IWN5000_TXQ_STATUS_CHGACT);
@@ -5826 +6187 @@
 static void
 iwn5000_ampdu_tx_stop(struct iwn_softc *sc, int qid, uint8_t tid, uint16_t ssn)
 {
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Stop TX scheduler while we're changing its configuration. */
     iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
         IWN5000_TXQ_STATUS_CHGACT);
@@ -5972 +6335 @@
     if ((error = iwn_nic_lock(sc)) != 0)
         return error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Clear TX scheduler state in SRAM. */
     sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
     iwn_mem_set_region_4(sc, sc->sched_base + IWN4965_SCHED_CTX_OFF, 0,
@@ -6022 +6387 @@
 {
     int error, qid;
 
-#ifndef __HAIKU__
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Switch to using ICT interrupt mode. */
     iwn5000_ict_reset(sc);
-#endif
 
-    if ((error = iwn_nic_lock(sc)) != 0)
+    if ((error = iwn_nic_lock(sc)) != 0){
+        DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
         return error;
+    }
 
     /* Clear TX scheduler state in SRAM. */
     sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
@@ -6105 +6472 @@
         /* Send calibration results to runtime firmware. */
         error = iwn5000_send_calibration(sc);
     }
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return error;
 }
 
@@ -6228 +6598 @@
     struct iwn_dma_info *dma = &sc->fw_dma;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Copy firmware section into pre-allocated DMA-safe memory. */
     memcpy(dma->vaddr, section, size);
     bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
@@ -6264 +6636 @@
     struct iwn_fw_part *fw;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Load the initialization firmware on first boot only. */
     fw = (sc->sc_flags & IWN_FLAG_CALIB_DONE) ?
         &sc->fw.main : &sc->fw.init;
@@ -6429 +6803 @@
                 sc->noise_gain = tmp + 1;
             }
             break;
+        case IWN_FW_TLV_PAN:
+            sc->sc_flags |= IWN_FLAG_PAN_SUPPORT;
+            DPRINTF(sc, IWN_DEBUG_RESET,
+                "PAN Support found: %d\n", 1);
+            break;
+        case IWN_FW_TLV_FLAGS :
+            sc->tlv_feature_flags = htole32(*ptr);
+            break;
+        case IWN_FW_TLV_PBREQ_MAXLEN:
+        case IWN_FW_TLV_RUNT_EVTLOG_PTR:
+        case IWN_FW_TLV_RUNT_EVTLOG_SIZE:
+        case IWN_FW_TLV_RUNT_ERRLOG_PTR:
+        case IWN_FW_TLV_INIT_EVTLOG_PTR:
+        case IWN_FW_TLV_INIT_EVTLOG_SIZE:
+        case IWN_FW_TLV_INIT_ERRLOG_PTR:
+        case IWN_FW_TLV_WOWLAN_INST:
+        case IWN_FW_TLV_WOWLAN_DATA:
+            DPRINTF(sc, IWN_DEBUG_RESET,
+                "TLV type %d reconized but not handled\n",
+                le16toh(tlv->type));
+            break;
         default:
             DPRINTF(sc, IWN_DEBUG_RESET,
                 "TLV type %d not handled\n", le16toh(tlv->type));
@@ -6446 +6841 @@
     struct iwn_fw_info *fw = &sc->fw;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     IWN_UNLOCK(sc);
 
     memset(fw, 0, sizeof (*fw));
@@ -6527 +6924 @@
     uint32_t reg;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Disable L0s exit timer (NMI bug workaround). */
     IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_DIS_L0S_TIMER);
     /* Don't wait for ICH L0s (ICH bug workaround). */
@@ -6604 +7003 @@
 static int
 iwn4965_nic_config(struct iwn_softc *sc)
 {
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     if (IWN_RFCFG_TYPE(sc->rfcfg) == 1) {
         /*
          * I don't believe this to be correct but this is what the
@@ -6626 +7027 @@
     uint32_t tmp;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     if (IWN_RFCFG_TYPE(sc->rfcfg) < 3) {
         IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
             IWN_RFCFG_TYPE(sc->rfcfg) |
@@ -6674 +7077 @@
 {
     int ntries;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     /* Check if hardware is ready. */
     IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_NIC_READY);
     for (ntries = 0; ntries < 5; ntries++) {
@@ -6711 +7116 @@
     struct iwn_ops *ops = &sc->ops;
     int error, chnl, qid;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     /* Clear pending interrupts. */
     IWN_WRITE(sc, IWN_INT, 0xffffffff);
 
@@ -6810 +7217 @@
         return error;
     }
     /* Do post-firmware initialization. */
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return ops->post_alive(sc);
 }
 
@@ -6818 +7228 @@
 {
     int chnl, qid, ntries;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     IWN_WRITE(sc, IWN_RESET, IWN_RESET_NEVO);
 
     /* Disable interrupts. */
@@ -6871 +7283 @@
     struct ieee80211com *ic = ifp->if_l2com;
     struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     if (vap != NULL) {
         iwn_init(sc);
         ieee80211_init(vap);
@@ -6885 +7299 @@
     struct ieee80211com *ic = ifp->if_l2com;
     struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     iwn_stop(sc);
     if (vap != NULL)
         ieee80211_stop(vap);
@@ -6902 +7318 @@
     struct ifnet *ifp = sc->sc_ifp;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
     IWN_LOCK_ASSERT(sc);
 
     if ((error = iwn_hw_prepare(sc)) != 0) {
@@ -6955 +7373 @@
     ifp->if_drv_flags |= IFF_DRV_RUNNING;
 
     callout_reset(&sc->watchdog_to, hz, iwn_watchdog, sc);
+
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
+
     return;
 
 fail:   iwn_stop_locked(sc);
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
 }
 
 static void
@@ -7043 +7465 @@
     struct iwn_softc *sc = ifp->if_softc;
     int error;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     IWN_LOCK(sc);
     sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
     sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
@@ -7097 +7521 @@
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
 
+    DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
+
     iwn_stop(sc);
     iwn_init(sc);
     ieee80211_notify_radio(ic, 1);
 }
+#ifdef  IWN_DEBUG
+#define IWN_DESC(x) case x: return #x
+#define COUNTOF(array) (sizeof(array) / sizeof(array[0]))
+
+/*
+ * Translate CSR code to string
+ */
+static char *iwn_get_csr_string(int csr)
+{
+    switch (csr) {
+        IWN_DESC(IWN_HW_IF_CONFIG);
+        IWN_DESC(IWN_INT_COALESCING);
+        IWN_DESC(IWN_INT);
+        IWN_DESC(IWN_INT_MASK);
+        IWN_DESC(IWN_FH_INT);
+        IWN_DESC(IWN_GPIO_IN);
+        IWN_DESC(IWN_RESET);
+        IWN_DESC(IWN_GP_CNTRL);
+        IWN_DESC(IWN_HW_REV);
+        IWN_DESC(IWN_EEPROM);
+        IWN_DESC(IWN_EEPROM_GP);
+        IWN_DESC(IWN_OTP_GP);
+        IWN_DESC(IWN_GIO);
+        IWN_DESC(IWN_GP_UCODE);
+        IWN_DESC(IWN_GP_DRIVER);
+        IWN_DESC(IWN_UCODE_GP1);
+        IWN_DESC(IWN_UCODE_GP2);
+        IWN_DESC(IWN_LED);
+        IWN_DESC(IWN_DRAM_INT_TBL);
+        IWN_DESC(IWN_GIO_CHICKEN);
+        IWN_DESC(IWN_ANA_PLL);
+        IWN_DESC(IWN_HW_REV_WA);
+        IWN_DESC(IWN_DBG_HPET_MEM);
+    default:
+        return "UNKNOWN CSR";
+    }
+}
+
+/*
+ * This function print firmware register
+ */
+static void
+iwn_debug_register(struct iwn_softc *sc)
+{
+    int i;
+    static const uint32_t csr_tbl[] = {
+        IWN_HW_IF_CONFIG,
+        IWN_INT_COALESCING,
+        IWN_INT,
+        IWN_INT_MASK,
+        IWN_FH_INT,
+        IWN_GPIO_IN,
+        IWN_RESET,
+        IWN_GP_CNTRL,
+        IWN_HW_REV,
+        IWN_EEPROM,
+        IWN_EEPROM_GP,
+        IWN_OTP_GP,
+        IWN_GIO,
+        IWN_GP_UCODE,
+        IWN_GP_DRIVER,
+        IWN_UCODE_GP1,
+        IWN_UCODE_GP2,
+        IWN_LED,
+        IWN_DRAM_INT_TBL,
+        IWN_GIO_CHICKEN,
+        IWN_ANA_PLL,
+        IWN_HW_REV_WA,
+        IWN_DBG_HPET_MEM,
+    };
+    DPRINTF(sc, IWN_DEBUG_REGISTER,
+        "CSR values: (2nd byte of IWN_INT_COALESCING is IWN_INT_PERIODIC)%s",
+        "\n");
+    for (i = 0; i <  COUNTOF(csr_tbl); i++){
+        DPRINTF(sc, IWN_DEBUG_REGISTER,"  %10s: 0x%08x ",
+            iwn_get_csr_string(csr_tbl[i]), IWN_READ(sc, csr_tbl[i]));
+        if ((i+1) % 3 == 0)
+            DPRINTF(sc, IWN_DEBUG_REGISTER,"%s","\n");
+    }
+    DPRINTF(sc, IWN_DEBUG_REGISTER,"%s","\n");
+}
+#endif

src/add-ons/kernel/drivers/network/wlan/iprowifi4965/dev/iwn/if_iwnreg.h

@@ -18 +18 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#define IWN_CT_KILL_THRESHOLD       114 /* in Celsius */
+#define IWN_CT_KILL_EXIT_THRESHOLD  95  /* in Celsius */
+
 #define IWN_TX_RING_COUNT   256
 #define IWN_TX_RING_LOMARK  192
 #define IWN_TX_RING_HIMARK  224
@@ -38 +41 @@
 #define IWN_ICT_SIZE        4096
 #define IWN_ICT_COUNT       (IWN_ICT_SIZE / sizeof (uint32_t))
 
+/* For cards with PAN command, default is IWN_CMD_QUEUE_NUM */
+#define IWN_CMD_QUEUE_NUM       4
+#define IWN_PAN_CMD_QUEUE       9
+
 /* Maximum number of DMA segments for TX. */
 #define IWN_MAX_SCATTER 20
 
@@ -62 +69 @@
 #define IWN_INT         0x008
 #define IWN_INT_MASK        0x00c
 #define IWN_FH_INT      0x010
+#define IWN_GPIO_IN     0x018   /* read external chip pins */
 #define IWN_RESET       0x020
 #define IWN_GP_CNTRL        0x024
 #define IWN_HW_REV      0x028
@@ -69 +77 @@
 #define IWN_EEPROM_GP       0x030
 #define IWN_OTP_GP      0x034
 #define IWN_GIO         0x03c
+#define IWN_GP_UCODE        0x048
 #define IWN_GP_DRIVER       0x050
+#define IWN_UCODE_GP1       0x054
+#define IWN_UCODE_GP1_SET   0x058
 #define IWN_UCODE_GP1_CLR   0x05c
+#define IWN_UCODE_GP2       0x060
 #define IWN_LED         0x094
 #define IWN_DRAM_INT_TBL    0x0a0
 #define IWN_SHADOW_REG_CTRL 0x0a8
@@ -79 +91 @@
 #define IWN_HW_REV_WA       0x22c
 #define IWN_DBG_HPET_MEM    0x240
 #define IWN_DBG_LINK_PWR_MGMT   0x250
+/* Need nic_lock for use above */
 #define IWN_MEM_RADDR       0x40c
 #define IWN_MEM_WADDR       0x410
 #define IWN_MEM_WDATA       0x418
 #define IWN_MEM_RDATA       0x41c
+#define IWN_TARG_MBX_C      0x430
 #define IWN_PRPH_WADDR      0x444
 #define IWN_PRPH_RADDR      0x448
 #define IWN_PRPH_WDATA      0x44c
@@ -194 +208 @@
 #define IWN_GP_CNTRL_SLEEP      (1 << 4)
 #define IWN_GP_CNTRL_RFKILL     (1 << 27)
 
-/* Possible flags for register IWN_HW_REV. */
-#define IWN_HW_REV_TYPE_SHIFT   4
-#define IWN_HW_REV_TYPE_MASK    0x000000f0
-#define IWN_HW_REV_TYPE_4965    0
-#define IWN_HW_REV_TYPE_5300    2
-#define IWN_HW_REV_TYPE_5350    3
-#define IWN_HW_REV_TYPE_5150    4
-#define IWN_HW_REV_TYPE_5100    5
-#define IWN_HW_REV_TYPE_1000    6
-#define IWN_HW_REV_TYPE_6000    7
-#define IWN_HW_REV_TYPE_6050    8
-#define IWN_HW_REV_TYPE_6005    11
-
 /* Possible flags for register IWN_GIO_CHICKEN. */
 #define IWN_GIO_CHICKEN_L1A_NO_L0S_RX   (1 << 23)
 #define IWN_GIO_CHICKEN_DIS_L0S_TIMER   (1 << 29)
@@ -220 +221 @@
 #define IWN_GP_DRIVER_RADIO_2X2_IPA (2 << 0)
 #define IWN_GP_DRIVER_CALIB_VER6    (1 << 2)
 #define IWN_GP_DRIVER_6050_1X2      (1 << 3)
+#define IWN_GP_DRIVER_REG_BIT_RADIO_IQ_INVERT   (1 << 7)
 
 /* Possible flags for register IWN_UCODE_GP1_CLR. */
 #define IWN_UCODE_GP1_RFKILL        (1 << 1)
 #define IWN_UCODE_GP1_CMD_BLOCKED   (1 << 2)
 #define IWN_UCODE_GP1_CTEMP_STOP_RF (1 << 3)
+#define IWN_UCODE_GP1_CFG_COMPLETE  (1 << 5)
 
 /* Possible flags/values for register IWN_LED. */
 #define IWN_LED_BSM_CTRL    (1 << 5)
 #define IWN_LED_OFF     0x00000038
 #define IWN_LED_ON      0x00000078
 
+#define IWN_MAX_BLINK_TBL   10
+#define IWN_LED_STATIC_ON   0
+#define IWN_LED_STATIC_OFF  1
+#define IWN_LED_SLOW_BLINK  2
+#define IWN_LED_INT_BLINK   3
+#define IWN_LED_UNIT        0x1388  /* 5 ms */
+
+static const struct {
+    uint16_t    tpt;    /* Mb/s */
+    uint8_t     on_time;
+    uint8_t     off_time;
+} blink_tbl[] =
+{
+    {300, 5, 5},
+    {200, 8, 8},
+    {100, 11, 11},
+    {70, 13, 13},
+    {50, 15, 15},
+    {20, 17, 17},
+    {10, 19, 19},
+    {5, 22, 22},
+    {1, 26, 26},
+    {0, 33, 33},
+    /* SOLID_ON */
+};
+
 /* Possible flags for register IWN_DRAM_INT_TBL. */
 #define IWN_DRAM_INT_TBL_WRAP_CHECK (1 << 27)
 #define IWN_DRAM_INT_TBL_ENABLE     (1 << 31)
@@ -377 +406 @@
 } __packed;
 
 struct iwn_rx_desc {
+    /*
+     * The first 4 bytes of the RX frame header contain both the RX frame
+     * size and some flags.
+     * Bit fields:
+     * 31:    flag flush RB request
+     * 30:    flag ignore TC (terminal counter) request
+     * 29:    flag fast IRQ request
+     * 28-14: Reserved
+     * 13-00: RX frame size
+     */
     uint32_t    len;
     uint8_t     type;
 #define IWN_UC_READY              1
 #define IWN_ADD_NODE_DONE        24
 #define IWN_TX_DONE          28
+#define IWN_REPLY_LED_CMD       72
 #define IWN5000_CALIBRATION_RESULT  102
 #define IWN5000_CALIBRATION_DONE    103
 #define IWN_START_SCAN          130
+#define IWN_NOTIF_SCAN_RESULT       131
 #define IWN_STOP_SCAN           132
 #define IWN_RX_STATISTICS       156
 #define IWN_BEACON_STATISTICS       157
@@ -395 +436 @@
 #define IWN_RX_DONE         195
 #define IWN_RX_COMPRESSED_BA        197
 
-    uint8_t     flags;
-    uint8_t     idx;
+    uint8_t     flags;  /* 0:5 reserved, 6 abort, 7 internal */
+    uint8_t     idx;    /* position within TX queue */
     uint8_t     qid;
+    /* 0:4 TX queue id - 5:6 reserved - 7 unsolicited RX
+     * or uCode-originated notification
+     */
 } __packed;
 
+#define IWN_RX_DESC_QID_MSK     0x1F
+#define IWN_UNSOLICITED_RX_NOTIF    0x80
+
+/* CARD_STATE_NOTIFICATION */
+#define IWN_STATE_CHANGE_HW_CARD_DISABLED       0x01
+#define IWN_STATE_CHANGE_SW_CARD_DISABLED       0x02
+#define IWN_STATE_CHANGE_CT_CARD_DISABLED       0x04
+#define IWN_STATE_CHANGE_RXON_CARD_DISABLED     0x10
+
 /* Possible RX status flags. */
 #define IWN_RX_NO_CRC_ERR   (1 <<  0)
 #define IWN_RX_NO_OVFL_ERR  (1 <<  1)
@@ -423 +476 @@
 #define IWN_CMD_LINK_QUALITY         78
 #define IWN_CMD_SET_LED          72
 #define IWN5000_CMD_WIMAX_COEX       90
+#define IWN_TEMP_NOTIFICATION       98
 #define IWN5000_CMD_CALIB_CONFIG    101
 #define IWN5000_CMD_CALIB_RESULT    102
 #define IWN5000_CMD_CALIB_COMPLETE  103
@@ -439 +493 @@
 #define IWN_CMD_PHY_CALIB       176
 #define IWN_CMD_BT_COEX_PRIOTABLE   204
 #define IWN_CMD_BT_COEX_PROT        205
+#define IWN_CMD_BT_COEX_NOTIF       206
+/* PAN commands */
+#define IWN_CMD_WIPAN_PARAMS            0xb2
+#define IWN_CMD_WIPAN_RXON          0xb3
+#define IWN_CMD_WIPAN_RXON_TIMING       0xb4
+#define IWN_CMD_WIPAN_RXON_ASSOC        0xb6
+#define IWN_CMD_WIPAN_QOS_PARAM         0xb7
+#define IWN_CMD_WIPAN_WEPKEY            0xb8
+#define IWN_CMD_WIPAN_P2P_CHANNEL_SWITCH    0xb9
+#define IWN_CMD_WIPAN_NOA_NOTIFICATION      0xbc
+#define IWN_CMD_WIPAN_DEACTIVATION_COMPLETE 0xbd
 
     uint8_t flags;
     uint8_t idx;
@@ -446 +511 @@
     uint8_t data[136];
 } __packed;
 
+/*
+ * Structure for IWN_CMD_GET_STATISTICS = (0x9c) 156
+ * all devices identical.
+ *
+ * This command triggers an immediate response containing uCode statistics.
+ * The response is in the same format as IWN_BEACON_STATISTICS (0x9d) 157.
+ *
+ * If the CLEAR_STATS configuration flag is set, uCode will clear its
+ * internal copy of the statistics (counters) after issuing the response.
+ * This flag does not affect IWN_BEACON_STATISTICS after beacons (see below).
+ *
+ * If the DISABLE_NOTIF configuration flag is set, uCode will not issue
+ * IWN_BEACON_STATISTICS after received beacons.  This flag
+ * does not affect the response to the IWN_CMD_GET_STATISTICS 0x9c itself.
+ */
+struct iwn_statistics_cmd {
+    uint32_t    configuration_flags;
+#define IWN_STATS_CONF_CLEAR_STATS      htole32(0x1)
+#define IWN_STATS_CONF_DISABLE_NOTIF    htole32(0x2)
+} __packed;
+
 /* Antenna flags, used in various commands. */
 #define IWN_ANT_A   (1 << 0)
 #define IWN_ANT_B   (1 << 1)
@@ -453 +539 @@
 /* Shortcuts. */
 #define IWN_ANT_AB  (IWN_ANT_A | IWN_ANT_B)
 #define IWN_ANT_BC  (IWN_ANT_B | IWN_ANT_C)
+#define IWN_ANT_AC  (IWN_ANT_A | IWN_ANT_C)
 #define IWN_ANT_ABC (IWN_ANT_A | IWN_ANT_B | IWN_ANT_C)
 
 /* Structure for command IWN_CMD_RXON. */
@@ -468 +555 @@
 #define IWN_MODE_STA        3
 #define IWN_MODE_IBSS       4
 #define IWN_MODE_MONITOR    6
+#define IWN_MODE_2STA       8
+#define IWN_MODE_P2P        9
 
     uint8_t     air;
     uint16_t    rxchain;
@@ -551 +640 @@
     uint16_t    atim;
     uint32_t    binitval;
     uint16_t    lintval;
-    uint16_t    reserved;
+    uint8_t     dtim_period;
+    uint8_t     delta_cp_bss_tbtts;
 } __packed;
 
 /* Structure for command IWN_CMD_ADD_NODE. */
@@ -565 +655 @@
     uint16_t    reserved2;
     uint8_t     id;
 #define IWN_ID_BSS       0
+#define IWN_STA_ID      1
+
+#define IWN_PAN_ID_BCAST        14
 #define IWN5000_ID_BROADCAST    15
 #define IWN4965_ID_BROADCAST    31
 
@@ -766 +859 @@
 #define IWN_PS_SLEEP_OVER_DTIM  (1 << 2)
 #define IWN_PS_PCI_PMGT     (1 << 3)
 #define IWN_PS_FAST_PD      (1 << 4)
+#define IWN_PS_BEACON_FILTERING (1 << 5)
+#define IWN_PS_SHADOW_REG   (1 << 6)
+#define IWN_PS_CT_KILL      (1 << 7)
+#define IWN_PS_BT_SCD       (1 << 8)
+#define IWN_PS_ADVANCED_PM  (1 << 9)
 
     uint8_t     keepalive;
     uint8_t     debug;
@@ -803 +901 @@
 
 struct iwn_scan_chan {
     uint32_t    flags;
+#define IWN_CHAN_PASSIVE    (0 << 0)
 #define IWN_CHAN_ACTIVE     (1 << 0)
 #define IWN_CHAN_NPBREQS(x) (((1 << (x)) - 1) << 1)
 
@@ -813 +912 @@
     uint16_t    passive;    /* msecs */
 } __packed;
 
+#define IWN_SCAN_CRC_TH_DISABLED    0
+#define IWN_SCAN_CRC_TH_DEFAULT     htole16(1)
+#define IWN_SCAN_CRC_TH_NEVER       htole16(0xffff)
+
 /* Maximum size of a scan command. */
 #define IWN_SCAN_MAXSZ  (MCLBYTES - 4)
 
+#define IWN_ACTIVE_DWELL_TIME_24    (30)    /* all times in msec */
+#define IWN_ACTIVE_DWELL_TIME_52    (20)
+#define IWN_ACTIVE_DWELL_FACTOR_24  (3)
+#define IWN_ACTIVE_DWELL_FACTOR_52  (2)
+
+#define IWN_PASSIVE_DWELL_TIME_24   (20)    /* all times in msec */
+#define IWN_PASSIVE_DWELL_TIME_52   (10)
+#define IWN_PASSIVE_DWELL_BASE      (100)
+#define IWN_CHANNEL_TUNE_TIME       (5)
+
+#define IWN_SCAN_CHAN_TIMEOUT       2
+
 /* Structure for command IWN_CMD_TXPOWER (4965AGN only.) */
 #define IWN_RIDX_MAX    32
 struct iwn4965_cmd_txpower {
@@ -862 +977 @@
 
 struct iwn6000_btcoex_config {
     uint8_t     flags;
+#define IWN_BT_FLAG_COEX6000_CHAN_INHIBITION    1
+#define IWN_BT_FLAG_COEX6000_MODE_MASK      ((1 << 3) | (1 << 4) | (1 << 5 ))
+#define IWN_BT_FLAG_COEX6000_MODE_SHIFT         3
+#define IWN_BT_FLAG_COEX6000_MODE_DISABLED      0
+#define IWN_BT_FLAG_COEX6000_MODE_LEGACY_2W     1
+#define IWN_BT_FLAG_COEX6000_MODE_3W            2
+#define IWN_BT_FLAG_COEX6000_MODE_4W            3
+
+#define IWN_BT_FLAG_UCODE_DEFAULT       (1 << 6)
+#define IWN_BT_FLAG_SYNC_2_BT_DISABLE   (1 << 7)
     uint8_t     lead_time;
     uint8_t     max_kill;
     uint8_t     bt3_t7_timer;
@@ -878 +1003 @@
     uint16_t    rx_prio_boost;
 } __packed;
 
+/* Structure for enhanced command IWN_CMD_BLUETOOTH for 2000 Series. */
+struct iwn2000_btcoex_config {
+    uint8_t     flags;  /* Cf Flags in iwn6000_btcoex_config */
+    uint8_t     lead_time;
+    uint8_t     max_kill;
+    uint8_t     bt3_t7_timer;
+    uint32_t    kill_ack;
+    uint32_t    kill_cts;
+    uint8_t     sample_time;
+    uint8_t     bt3_t2_timer;
+    uint16_t    bt4_reaction;
+    uint32_t    lookup_table[12];
+    uint16_t    bt4_decision;
+    uint16_t    valid;
+
+    uint32_t    prio_boost; /* size change prior to iwn6000_btcoex_config */
+    uint8_t     reserved;   /* added prior to iwn6000_btcoex_config */
+
+    uint8_t     tx_prio_boost;
+    uint16_t    rx_prio_boost;
+} __packed;
+
 struct iwn_btcoex_priotable {
     uint8_t     calib_init1;
     uint8_t     calib_init2;
@@ -996 +1143 @@
     uint16_t    reserved;
 } __packed;
 
+struct iwn5000_phy_calib_temp_offsetv2 {
+    uint8_t     code;
+    uint8_t     group;
+    uint8_t     ngroups;
+    uint8_t     isvalid;
+    int16_t     offset_high;
+    int16_t     offset_low;
+    int16_t     burnt_voltage_ref;
+    int16_t     reserved;
+} __packed;
+
 struct iwn_phy_calib_gain {
     uint8_t code;
     uint8_t group;
@@ -1063 +1221 @@
 } __packed;
 
 /* Structures for IWN_TX_DONE notification. */
+#define IWN_TX_STATUS_MSK       0xff
+#define TX_STATUS_SUCCESS       0x01
+#define TX_STATUS_DIRECT_DONE       0x02
+
 #define IWN_TX_SUCCESS          0x00
 #define IWN_TX_FAIL         0x80    /* all failures have 0x80 set */
 #define IWN_TX_FAIL_SHORT_LIMIT     0x82    /* too many RTS retries */
@@ -1084 +1246 @@
 } __packed;
 
 struct iwn5000_tx_stat {
-    uint8_t     nframes;
+    uint8_t     nframes;    /* 1 no aggregation, >1 aggregation */
     uint8_t     btkillcnt;
     uint8_t     rtsfailcnt;
     uint8_t     ackfailcnt;
@@ -1096 +1258 @@
     uint16_t    seq;
     uint16_t    len;
     uint8_t     tlc;
-    uint8_t     ratid;
+    uint8_t     ratid;  /* tid (0:3), sta_id (4:7) */
     uint8_t     fc[2];
     uint16_t    status;
     uint16_t    sequence;
@@ -1144 +1306 @@
     uint16_t    chan;
     uint8_t     phybuf[32];
     uint32_t    rate;
+/*
+ * rate bit fields
+ *
+ * High-throughput (HT) rate format for bits 7:0 (bit 8 must be "1"):
+ *  2-0:  0)   6 Mbps
+ *        1)  12 Mbps
+ *        2)  18 Mbps
+ *        3)  24 Mbps
+ *        4)  36 Mbps
+ *        5)  48 Mbps
+ *        6)  54 Mbps
+ *        7)  60 Mbps
+ *
+ *  4-3:  0)  Single stream (SISO)
+ *        1)  Dual stream (MIMO)
+ *        2)  Triple stream (MIMO)
+ *
+ *    5:  Value of 0x20 in bits 7:0 indicates 6 Mbps HT40 duplicate data
+ *
+ * Legacy OFDM rate format for bits 7:0 (bit 8 must be "0", bit 9 "0"):
+ *  3-0:  0xD)   6 Mbps
+ *        0xF)   9 Mbps
+ *        0x5)  12 Mbps
+ *        0x7)  18 Mbps
+ *        0x9)  24 Mbps
+ *        0xB)  36 Mbps
+ *        0x1)  48 Mbps
+ *        0x3)  54 Mbps
+ *
+ * Legacy CCK rate format for bits 7:0 (bit 8 must be "0", bit 9 "1"):
+ *  6-0:   10)  1 Mbps
+ *         20)  2 Mbps
+ *         55)  5.5 Mbps
+ *        110)  11 Mbps
+ *
+ */
     uint16_t    len;
     uint16_t    reserve3;
 } __packed;
@@ -1366 +1564 @@
 #define IWN_FW_TLV_INIT_DATA        4
 #define IWN_FW_TLV_BOOT_TEXT        5
 #define IWN_FW_TLV_PBREQ_MAXLEN     6
+#define IWN_FW_TLV_PAN              7
+#define IWN_FW_TLV_RUNT_EVTLOG_PTR  8
+#define IWN_FW_TLV_RUNT_EVTLOG_SIZE 9
+#define IWN_FW_TLV_RUNT_ERRLOG_PTR  10
+#define IWN_FW_TLV_INIT_EVTLOG_PTR  11
+#define IWN_FW_TLV_INIT_EVTLOG_SIZE 12
+#define IWN_FW_TLV_INIT_ERRLOG_PTR  13
 #define IWN_FW_TLV_ENH_SENS     14
 #define IWN_FW_TLV_PHY_CALIB        15
+#define IWN_FW_TLV_WOWLAN_INST      16
+#define IWN_FW_TLV_WOWLAN_DATA      17
+#define IWN_FW_TLV_FLAGS            18
 
     uint16_t    alt;
     uint32_t    len;
@@ -1401 +1609 @@
 #define IWN4965_EEPROM_VOLTAGE  0x0e9
 #define IWN4965_EEPROM_BANDS    0x0ea
 /* Indirect offsets. */
+#define IWN5000_EEPROM_NO_HT40  0x000
 #define IWN5000_EEPROM_DOMAIN   0x001
 #define IWN5000_EEPROM_BAND1    0x004
 #define IWN5000_EEPROM_BAND2    0x013
@@ -1512 +1721 @@
     IWN5000_EEPROM_BAND7
 };
 
+static const uint32_t iwn1000_regulatory_bands[IWN_NBANDS] = {
+    IWN5000_EEPROM_BAND1,
+    IWN5000_EEPROM_BAND2,
+    IWN5000_EEPROM_BAND3,
+    IWN5000_EEPROM_BAND4,
+    IWN5000_EEPROM_BAND5,
+    IWN5000_EEPROM_BAND6,
+    IWN5000_EEPROM_NO_HT40,
+};
+
 #define IWN_CHAN_BANDS_COUNT     7
 #define IWN_MAX_CHAN_PER_BAND   14
 static const struct iwn_chan_band {
@@ -1531 +1750 @@
     { 11, { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157 } }
 };
 
+static const uint8_t iwn_bss_ac_to_queue[] = {
+    2, 3, 1, 0,
+};
+
+static const uint8_t iwn_pan_ac_to_queue[] = {
+    5, 4, 6, 7,
+};
 #define IWN1000_OTP_NBLOCKS 3 
 #define IWN6000_OTP_NBLOCKS 4 
 #define IWN6050_OTP_NBLOCKS 7
@@ -1540 +1766 @@
 #define IWN_RIDX_OFDM6  4
 
 #define IWN4965_MAX_PWR_INDEX   107
+#define IWN_POWERSAVE_LVL_NONE          0
+#define IWN_POWERSAVE_LVL_VOIP_COMPATIBLE   1
+#define IWN_POWERSAVE_LVL_MAX           5
+
+#define IWN_POWERSAVE_LVL_DEFAULT   IWN_POWERSAVE_LVL_NONE
+
+/* DTIM value to pass in for IWN_POWERSAVE_LVL_VOIP_COMPATIBLE */
+#define IWN_POWERSAVE_DTIM_VOIP_COMPATIBLE  2
 
 /*
  * RF Tx gain values from highest to lowest power (values obtained from
@@ -1722 +1956 @@
     100
 };
 
+/* Get value from linux kernel 3.2.+ in Drivers/net/wireless/iwlwifi/iwl-2000.c*/
+static const struct iwn_sensitivity_limits iwn2030_sensitivity_limits = {
+    105,110,
+    128,232,
+    80,145,
+    128,232,
+    125,175,
+    160,310,
+    97,
+    97,
+    110
+};
+
 /* Map TID to TX scheduler's FIFO. */
 static const uint8_t iwn_tid2fifo[] = {
     1, 0, 0, 1, 2, 2, 3, 3, 7, 7, 7, 7, 7, 7, 7, 7, 3
@@ -1772 +2019 @@
     "NMI_INTERRUPT_DATA_ACTION_PT",
     "NMI_TRM_HW_ER",
     "NMI_INTERRUPT_TRM",
-    "NMI_INTERRUPT_BREAKPOINT",
+    "NMI_INTERRUPT_BREAKPOINT"
     "DEBUG_0",
     "DEBUG_1",
     "DEBUG_2",

src/add-ons/kernel/drivers/network/wlan/iprowifi4965/dev/iwn/if_iwnvar.h

@@ -2 +2 @@
 /*  $OpenBSD: if_iwnvar.h,v 1.18 2010/04/30 16:06:46 damien Exp $   */
 
 /*-
+ * Copyright (c) 2013 Cedric GROSS <cg@cgross.info>
+ * Copyright (c) 2011 Intel Corporation
  * Copyright (c) 2007, 2008
  *  Damien Bergamini <damien.bergamini@free.fr>
  * Copyright (c) 2008 Sam Leffler, Errno Consulting
@@ -18 +20 @@
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
+enum iwn_rxon_ctx_id {
+        IWN_RXON_BSS_CTX,
+        IWN_RXON_PAN_CTX,
+        IWN_NUM_RXON_CTX
+};
+
+struct iwn_pan_slot {
+    uint16_t    time;
+    uint8_t     type;
+    uint8_t     reserved;
+} __packed;
+
+struct iwn_pan_params_cmd {
+    uint16_t flags;
+#define IWN_PAN_PARAMS_FLG_SLOTTED_MODE (1 << 3)
+
+    uint8_t reserved;
+    uint8_t num_slots;
+    struct iwn_pan_slot slots[10];
+} __packed;
+
+struct iwn_led_mode
+{
+    uint8_t     led_cur_mode;
+    uint64_t    led_cur_bt;
+    uint64_t    led_last_bt;
+    uint64_t    led_cur_tpt;
+    uint64_t    led_last_tpt;
+    uint64_t    led_bt_diff;
+    int     led_cur_time;
+    int     led_last_time;
+};
 
 struct iwn_rx_radiotap_header {
     struct ieee80211_radiotap_header wr_ihdr;
@@ -102 +136 @@
     struct  ieee80211_node      ni; /* must be the first */
     uint16_t            disable_tid;
     uint8_t             id;
-    uint32_t            ridx[256];
     struct {
         uint64_t        bitmap;
         int         startidx;
@@ -192 +225 @@
 
     int         (*iv_newstate)(struct ieee80211vap *,
                     enum ieee80211_state, int);
+    int         ctx;
+    int         beacon_int;
+    uint8_t     macaddr[IEEE80211_ADDR_LEN];
+
 };
 #define IWN_VAP(_vap)   ((struct iwn_vap *)(_vap))
 
@@ -211 +248 @@
 #define IWN_FLAG_HAS_11N    (1 << 6)
 #define IWN_FLAG_ENH_SENS   (1 << 7)
 #define IWN_FLAG_ADV_BTCOEX (1 << 8)
+#define IWN_FLAG_PAN_SUPPORT    (1 << 9)
 
     uint8_t         hw_type;
+    /* subdevice_id used to adjust configuration */
+    uint16_t        subdevice_id;
 
     struct iwn_ops      ops;
     const char      *fwname;
@@ -254 +294 @@
     struct iwn_tx_ring  txq[IWN5000_NTXQUEUES];
     struct iwn_rx_ring  rxq;
 
+    int         mem_rid;
     struct resource     *mem;
     bus_space_tag_t     sc_st;
     bus_space_handle_t  sc_sh;
+    int         irq_rid;
     struct resource     *irq;
     void            *sc_ih;
     bus_size_t      sc_sz;
@@ -271 +313 @@
     int         calib_cnt;
     struct iwn_calib_state  calib;
     struct callout      watchdog_to;
-
+    struct callout      ct_kill_exit_to;
     struct iwn_fw_info  fw;
     struct iwn_calib_info   calibcmd[5];
     uint32_t        errptr;
@@ -279 +321 @@
     struct iwn_rx_stat  last_rx_stat;
     int         last_rx_valid;
     struct iwn_ucode_info   ucode_info;
-    struct iwn_rxon     rxon;
+    struct iwn_rxon     rx_on[IWN_NUM_RXON_CTX];
+    struct iwn_rxon     *rxon;
+    int         ctx;
+    struct ieee80211vap *ivap[IWN_NUM_RXON_CTX];
+
+    uint8_t         uc_scan_progress;
     uint32_t        rawtemp;
     int         temp;
     int         noise;
@@ -294 +341 @@
     char            eeprom_domain[4];
     uint32_t        eeprom_crystal;
     int16_t         eeprom_temp;
+    int16_t         eeprom_temp_high;
     int16_t         eeprom_voltage;
     int8_t          maxpwr2GHz;
     int8_t          maxpwr5GHz;
     int8_t          maxpwr[IEEE80211_CHAN_MAX];
 
+    uint32_t        tlv_feature_flags;
+
     int32_t         temp_off;
     uint32_t        int_mask;
     uint8_t         ntxchains;
@@ -308 +358 @@
     uint8_t         chainmask;
 
     int         sc_tx_timer;
+    int         sc_scan_timer;
 
     struct ieee80211_tx_ampdu *qid2tap[IWN5000_NTXQUEUES];
 
@@ -322 +373 @@
     void            (*sc_addba_stop)(struct ieee80211_node *,
                     struct ieee80211_tx_ampdu *);
 
+    struct  iwn_led_mode sc_led;
 
     struct iwn_rx_radiotap_header sc_rxtap;
     struct iwn_tx_radiotap_header sc_txtap;
 
-#if defined(__HAIKU__)
-    uint32_t sc_intr_status_1;
-    uint32_t sc_intr_status_2;
-#endif
+    /* The power save level originally configured by user */
+    int         desired_pwrsave_level;
+
+    /*
+     * The current power save level, this may differ from the
+     * configured value due to thermal throttling etc.
+     */
+    int         current_pwrsave_level;
+
+    /* For specifique params */
+    struct iwn_base_params *base_params;
 };
 
 #define IWN_LOCK_INIT(_sc) \

src/add-ons/kernel/drivers/network/wlan/iprowifi4965/glue.c

@@ -56 +56 @@
         return 0;
     }
 
+    /*
     atomic_set((int32*)&sc->sc_intr_status_1, r1);
     atomic_set((int32*)&sc->sc_intr_status_2, r2);
+    */
 
     IWN_WRITE(sc, IWN_INT_MASK, 0);
         // disable interrupts

src/libs/compat/freebsd_wlan/net80211/ieee80211_output.c

@@ -3063 +3063 @@
 
     return len_changed;
 }
+
+/*
+ * Added in FreeBSD 10.0.0
+ */
+
+/*
+ * Complete an mbuf transmission.
+ *
+ * For now, this simply processes a completed frame after the
+ * driver has completed it's transmission and/or retransmission.
+ * It assumes the frame is an 802.11 encapsulated frame.
+ *
+ * Later on it will grow to become the exit path for a given frame
+ * from the driver and, depending upon how it's been encapsulated
+ * and already transmitted, it may end up doing A-MPDU retransmission,
+ * power save requeuing, etc.
+ *
+ * In order for the above to work, the driver entry point to this
+ * must not hold any driver locks.  Thus, the driver needs to delay
+ * any actual mbuf completion until it can release said locks.
+ *
+ * This frees the mbuf and if the mbuf has a node reference,
+ * the node reference will be freed.
+ */
+void
+ieee80211_tx_complete(struct ieee80211_node *ni, struct mbuf *m, int status)
+{
+
+    if (ni != NULL) {
+        if (m->m_flags & M_TXCB)
+            ieee80211_process_callback(ni, m, status);
+        ieee80211_free_node(ni);
+    }
+    m_freem(m);
+}

src/libs/compat/freebsd_wlan/net80211/ieee80211_phy.h

@@ -137 +137 @@
 }
 
 /*
+ * Declaration required for FreeBSD 10.0.0 iwn
+ */
+
+static __inline__ uint8_t
+ieee80211_legacy_rate_lookup(const struct ieee80211_rate_table *rt,
+    uint8_t rate)
+{
+
+    return (rt->rateCodeToIndex[rate & IEEE80211_RATE_VAL]);
+}
+
+/*
  * Compute the time to transmit a frame of length frameLen bytes
  * using the specified 802.11 rate code, phy, and short preamble
  * setting.

src/libs/compat/freebsd_wlan/net80211/ieee80211_proto.h

@@ -117 +117 @@
         const uint8_t da[IEEE80211_ADDR_LEN],
         const uint8_t bssid[IEEE80211_ADDR_LEN],
         const uint8_t *ssid, size_t ssidlen);
+void    ieee80211_tx_complete(struct ieee80211_node *,
+        struct mbuf *, int);
 /*
  * The formation of ProbeResponse frames requires guidance to
  * deal with legacy clients.  When the client is identified as